Bank of America's online banking services have been down most of the day, and its mobile apps were having problems earlier too.

But though BofA's mobile apps are back up and running, banking through the main website is still unavailable, said Tara Burke, a bank spokeswoman.

"We've been experiencing some intermittent service disruption throughout the day," Burke said. "This is not the result of any hacking or malware or anything like that. This is not an attack on Bank of America."

The blame for BofA's online banking outage falls squarely on some routine updates to the bank's software systems over the weekend, she said.

"This was the result of some weekend service updates, and for proprietary reasons we won't get into the details of what that entails," Burke said.

"No customer data has been affected or lost or anything and no branch locations or ATMs or other types of banking have been affected by this disruption either."

Bank of America has been working all day to get the problems fixed and online banking services restored, but as of now, the bank is offering no timeline as to when that will happen, she said.

In 2008, Bank of America's website was down for about five hours for reasons that BofA never fully disclosed to the public.

[Updated: Burke said Bank of America has restored online banking services for California, Connecticut, Massachusetts, New Jersey, New York and North Carolina.

The bank is still working on getting access back up for the rest of its customers, she said.]

RELATED:

Gmail still down for some users; bug in software storage update blamed

JPMorgan Chase reportedly in talks to buy minority share in Twitter

-- Nathan Olivarez-Giles

twitter.com/nateog

Photo: Bank of America customers use an ATM in San Francisco in January. Credit: Justin Sullivan/Getty Images

Image: Screen shot of the red warning box that appears on Bank of America's website notifying users that online banking is unavailable. Credit: Bank of America

McDonald's databases were recently hacked into and personal customer information was stolen, the fast-food giant said in a statement.

"Recently McDonald's was informed by one of its partners that limited customer information collected in connection with our promotions or websites was improperly accessed by a third party," McDonald's said. "Limited customer information such as name, address, phone number, birth date and gender was included in the information that was accessed."

The data that the hackers were able to get was compiled from consumers who signed up to receive e-mails from McDonald's on the websites mcdonalds.com, mcdonalds.ca, mcdonaldsmom.com, mcdlive.com, meencanta.com, monopoly.com, playatmcd.com and 365Black.com, the statement said.

The data did not include credit card information or other financial or personal info, the company said.

McDonald's didn't offer a date as to when the cyber attack took place and officials for the chain were unavailable Monday afternoon.

The company said in its statement that a business partner, Arc Worldwide, was developing a list of its customers' e-mail addresses to send them promotional e-mails.

Arc, whose officials were also unreachable Monday afternoon, hired an e-mail service provider to supervise and manage the e-mail database, McDonald's said.

"That e-mail service provider has advised that its computer systems recently were accessed by an unauthorized third party, and that information, including information that customers provided to McDonald's, was accessed by that unauthorized third party," the burger chain said. "Law enforcement officials have been notified and are investigating this incident."

In its statement, McDonald's sent out a warning to its customers as well.

"In the event that you are contacted by someone claiming to be from McDonald's asking for personal or financial information, do not respond and instead immediately contact us ... so we can contact the authorities," the company said.

McDonald's is asking customers who think their information may have been stolen in the Web attack to report any suspicious contact to a toll-free number: (800) 244-6227.

RELATED:

Gawker websites, Twitter hacked and spammed by 'Gnosis'

Hackers claim to have shut down Visa website in defense of WikiLeaks

-- Nathan Olivarez-Giles

twitter.com/nateog

Image (top): A screen shot of 365black.com, a McDonald's website that compiled some customer information that was recently hacked and stolen. Photo (bottom): A McDonald's in Fullerton, Calif. Credit: Christine Cotter / Los Angeles Times

Microsoft plans to fire people and hire people as it deals with what Chief Executive Steve Ballmer today called a "once-in-a-lifetime set of economic conditions." And the company thinks things will get worse before they get better.

Executives from the Redmond, Wash., company gave Wall Street more specifics about their plans for dealing with the deteriorating global economy. They include cutting thousands of jobs in response to slowing sales of the PCs that run its Windows and Office software and making some hires in areas of potential growth such as Web search.

"We’re certainly in the midst of a once-in-a-lifetime set of economic conditions," Ballmer said during a conference call after the company announced weaker-than-expected quarterly earnings and as many as 5,000 layoffs, or 5.5% of its workforce. "The economy is resetting to a lower level of business and consumer spending."

As businesses and consumers have reduced spending and bought fewer PCs, Office and Windows sales also have slowed. Microsoft's client business, which includes those products, saw revenue fall 8% to $3.9 billion in its fiscal first quarter, which ended Dec. 31. PC spending, which the company had anticipated would grow 10%-12%, was flat, said Bill Koefoed, general manager of investor relations.

Ballmer said that as many as 5,000 Microsoft jobs would be cut, as well as thousands of external jobs held by independent contractors and vendors. The reductions will be in the areas of research and development, marketing, sales, finance, legal, human resources and information technology, and about 1,400 of those cuts will occur today. However, the company does anticipate adding 2,000 to 3,000 jobs in ...

Let's say you're a big-name advertiser, and one of your TV commercials mocks airplanes, flying and water landings. You probably wouldn't want to run that ad during CNN's coverage of US Airways Flight 1549, which crash-landed Thursday in the Hudson River, right? Unfortunately for tech giant Cisco Systems, it's sometimes difficult to pull such an ad from TV networks across the country in the unlikely event of a water landing.

Cisco's Travel Less, Save More commercial begins with a man talking to the screen, welcoming people to flight 1120. Various people recite familiar flight attendant lines throughout the ad, talking about how to buckle a seat belt, how oxygen masks will drop from the ceiling and what will happen in the "unlikely" event of a water landing. They wear floating devices. They play with oxygen masks. Then the ad ends with a voice-over about the "endless hours" lost to airport delays.

Some people watching real-life coverage of US Airways flight 1549 yesterday on CNN saw the ad during a commercial break. They were treated to the jarring feeling of watching real-life coverage of ...

Most people know it's probably not a good idea to use your corporate e-mail account to write about how you skipped out on work and had too many beers at the Dodgers game. But you may want to think twice about doing the same via text message on your work-issued phone.

New guidelines for financial firms that were issued in December (you can read a PDF download here) mean that companies are responsible for any secure information employees send over their mobile phones, in addition to e-mail. Hospitals and other organizations that work with personal information are also cracking down on employees who send messages over phones.

But it's not as easy for employers to read your text messages as it is for them to read your e-mail. Right now, text messages sent on employee phones are archived, but a hole in most systems means that if an employee sends a text message and then deletes the sent file, the archive won't store it.

So Onset Technology has come up with Big Brother software that enables employers to monitor employees' texts, as well as control who they're writing texts to and what they're writing. It's called METAmessage Advanced Compliance Tool.

"We scan and block text messages so the company makes sure there are no text messages going out that violate company policy," said Zack Silvinger, the company's vice president of business development and marketing.

That means if your company has decided that curse words, sexually explicit words, or even the word "beer" aren't acceptable, you'll be thwarted every time you try to send a text message with banned words on it. What's more, your message will be sent to the human resources department. Yikes!

Companies using the software can also create blacklists to control whom employees can text.

If you're scared now, you might get some relief knowing that federal law prevents service providers from turning over contents of text messages to an employer, even if an employer pays for the service. But with this software, your employer scans the text messages before you even send them.

It may seem ridiculous for companies to employ these tactics, but they can prevent legal issues from arising, said Patrick Corr, Onset's vice president of sales. "The idea is to protect the enterprise," he said.

In non-business speak, this means your employer is monitoring your texts to save its own rear end. And maybe prevent you from saying things about the Dodgers you might later regret.

-- Alana Semuels

Photo: Surveillance cameras in London. Credit: akanekal via Flickr

Gas prices are soaring, roads are congested and you've gotten kind of hooked on Days of Our Lives. Sounds like it's time to telecommute.

But good luck trying to use your virtual private network, or VPN, while sending e-mail and surfing the Web. According to a Forrester Research study released Wednesday, telecommunication companies don't focus on consumers who work from home. As a result, those workers suffer slower Web speeds, slower customer service and security issues they otherwise might not face if they were working at the office.

"Because home workers' telecommunication needs are not strictly personal nor precisely business-based, providers have a difficult time creating a product strategy for these consumers," analyst Sally M. Cohen wrote in the report.

They should start thinking about consumers who telecommute (Cohen calls them "prosumers"). According to Forrester, 41% of adults who use a computer at work also work at home after-hours. About 9% of online consumers telecommute regularly, and 22.8 million consumers run a business from home.

Cohen listed a few features telecommuters might need:

• More bandwith. About half of enterprises in the U.S. and Europe have virtual private networks that can be accessed from home, but logging in with low bandwith can be next to impossible.
• Better customer care. The last thing telecommuters want to do when they're rushing to file a report is wait in a customer-service line or yell at voice prompts.
• Increased security. Telecommuting can create privacy concerns for employers and employees.

I asked AT&T, Charter, Time Warner and Verizon what services they offer for people who telecommute. The answer: nothing special. But consumers who pay a bit more for Internet might be all set anyway. Verizon's FiOS, only available in some areas, transmits at speeds up to 50 megabits per second. Its DSL goes up to 7 megabits. Time Warner's top package transmits at 6 megabits per second, although some areas get service as fast as 10 megabits per second. AT&T's DSL and U-Verse (also only available in some areas), offer the same speeds as Time Warner.

For now, telecommuters in Glendale, Burbank, Long Beach and Riverside have it best: those with Charter Communications can get speeds as fast as 16 megabits per second as well as a free anti-virus and security package to boot.

-- Alana Semuels

Semuels, a Times staff writer, covers marketing and the L.A. tech scene.

Photo by Stanley Leary / Associated Press

Acclaimed Internet security researcher Dan Kaminsky detailed a flaw in the current architecture of the Internet today, firing the starting gun for a race between hackers who can now take advantage of the vulnerability and the big companies who have yet to patch their systems.

Speaking to hundreds of technology security professionals and enthusiasts at the annual Black Hat conference in Las Vegas, Kaminsky said that a majority of the Fortune 500 have protected their machines with a series of fixes developed in secret since March.

Kaminsky coordinated an industry-wide effort that brought out patches from Microsoft, Cisco, Sun Microsystems and other major technology vendors, and customers began applying them after he issued a public warning a month ago.

The hole lies in the Domain Name System, which steers Internet users seeking a site by title, such as www.google.com, to a numerical address. Kaminsky showed today how hackers could corrupt the process, taking users to an imitation site that could install malicious programs.

He called the problem the worst discovered since 1997. The standing-room only crowd gave Kaminsky two ovations, in part for the technical significance of the find and in part for his handling of the crisis. Microsoft, Google, Yahoo, Facebook, MySpace, EBay and many Internet service providers have secured their machines.

"We got lucky with this bug," Kaminsky said in his talk, saying other profound flaws are lurking that will be just as hard to resolve. "We have to have disaster-recovery planning. The 90-days-to-fix-it thing isn't going to fly."

Kaminsky also showed how the flaw could be used to attack places that some professionals had believed immune.

The Secure Sockets Layer, signified by "https://" at the beginning of a website address, could be circumvented, as one example. Impostors could fool the authentication companies, such as Verisign, and so get an approved digital certificate shown to site visitors, though Kaminsky said those companies have revamped their procedures. A large number of firms simply sign their own certificates, which an impostor could do, without dissuading consumers from continuing.

"Everywhere you look, SSL shoots itself in the face," Kaminsky said.

Corporate firewalls can likewise be thwarted through computers connecting to outside partners, such as payment processors.

Other scary scenarios include intercepted and manipulated e-mail coming from trusted parties and the fact that automatic software updates, which are a key way to get security fixes installed automatically, can easily be hijacked.

There are so many different ways for malicious actors to try to use the flaw that Kaminsky said it marked the start of a new era of hacking.

"DNS is the Achilles' heel of the Internet," agreed Joris Evers, a spokesman for security company McAfee Inc. "There's a lot of attention that's been focused on this -- and that's good."

In an interview, Kaminsky said that more than 120 million home broadband users have already been protected, and that workplace systems might be more at risk. Some attacks have already occurred, and Kaminsky said he was most worried about the tens of millions of sites that have a link to click on if users forget their passwords. A hacker could pretend to be specific users and get the passwords sent to them.

Ordinary computer users can't do much to patch their own machines, though they can prod their employers or Internet service providers to act. They can check to see if patches have been applied by visiting www.doxpara.com and clicking on "Check my DNS."

-- Joseph Menn

Black Hat company logo from richardmasoner via Flickr; photo of Kaminsky courtesy of the subject.

The U.S. Justice Department said today that it had charged 11 people for their alleged roles in the largest identify theft case cracked to date, one best known for the loss of personal information on customers at chains owned by TJX Cos., including TJ Maxx.

The ring is accused of driving past retailers and restaurants with wireless equipment, looking for ways into the corporate wireless networks. Once inside, they planted "sniffers" to capture credit card and debit card information as it was being transmitted internally, according to indictments in Boston and San Diego.

A three-year undercover investigation turned up records on 41 million people stored on computers in Eastern Europe. Tens of millions of dollars were lost as the perpetrators created new bank cards with stolen data and then made withdrawals from ATM machines.

U.S. Atty. Gen. Michael Mukasey and other officials said the ring was led by a Secret Service informant who functioned as a triple agent, warning suspects of ongoing probes. Albert Gonzalez of Miami faces a maximum penalty of life in prison.

Also charged were residents of Ukraine, Estonia and China, underscoring the increasing globalization of cyber-crime.

-- Joseph Menn

Photo: Atty. Gen. Michael Mukasey. Credit: Gerald Herbert / Associated Press

Telecommuting has its distinct advantages: no stressful trips on the freeway, a kitchen full of snacks, working in pajamas, even animal companionship (just watch out for paws on the keyboard).

But working from home isn't all kitty cats and cozy fires. A study released this morning by the Center for Democracy and Technology and Ernst & Young said telecommuting and other remote access of corporate networks poses data security and privacy challenges for employers. The report, "The State of Telecommuting: Privacy and Security" (PDF download) warns:

It is difficult enough to secure a corporate network with the constant and persistent threat from malicious external parties, from hackers to spammers to viruses. But for the chief technology officer or chief risk officer of today's organization, perhaps no issue presents more complexity -- or more headaches -- than the necessity to protect corporate and personal information in an environment where employees travel widely or routinely work at home, using personal computers, laptops, non-corporate-owned machines and personal digital assistants.

The CDT and Ernst & Young surveyed 73 organizations from 10 industries in the United States, Canada and Europe and found that the risks of telecommuting often were ignored. Half of the respondents said they had no formal policies or training for remote access of their systems.

"Most of the security and privacy risks associated with telecommuting are already known," CDT Vice President Ari Schwartz said in a release unveiling the study.  "In a lot of cases those risks can be addressed if companies would simply put more emphasis on the procedures and policies they already have in place."

And it's not just electronic data. Only 25% of the respondents said they require telecommuters to store paper records in secured cabinets. Even then, the records aren't always secure, as this 2007 episode demonstrates: Confidential files of 13 people from the Social Security Administration office in Milwaukee were lost for months when a telecommuting worker took them home. The employee said she kept them in a locked cabinet, but believes she left them behind when she fled her home because of domestic violence. Some of the files -- which contained Social Security numbers, medical information and other private data -- were eventually found in a Milwaukee dumpster.

The study recommends that employers focus more on telecommuters, whose ranks are expected to grow to 46 million by 2011. Among the suggestions are inspecting home offices, using encryption to connect to corporate networks and providing locked cabinets and shredders for paper records. Just make sure the cat stays away from the shredders.

-- Jim Puzzanghera

Puzzanghera, a Times staff writer, covers tech and media policy from Washington, D.C.

Photo by DDFic via Flickr

The Motorola DynaTAC 8000X holds its place in wireless history as the world's first commercial cellphone. The hefty device (both in weight -- like a brick -- and price -- nearly $4,000 when introduced in 1984) also represents state-of-the-art as far as federal tax law is concerned.

That's bad news if your employer provides you with a cellphone.

As you can read in our story today, many employers may stop paying for employee cellphones because the Internal Revenue Service recently has been cracking down on tax rules set in 1989. Those rules consider cellphones a pricey fringe benefit, reserved for the likes of high-powered businessmen such as Gordon Gekko.

The IRS says employees must keep detailed logs of their calls, indicating which are for business and which are personal. If they don't, the phone and its monthly service plan are considered taxable income.

UCLA was hit this year with a bill for $239,196 in unpaid taxes for employee cellphones and is considering changing its policy.

Those changes are on hold as Congress considers bringing IRS cellphone rules into the 21st Century. Legislation to do so passed the House this year, and a similar bill is pending in the Senate. 

-- Jim Puzzanghera

Puzzanghera, a Times staff writer, covers tech and media policy from Washington, D.C.

Photo: Motorola DynaTAC 8000X, circa 1984. Credit: Motorola