Source blog: Schneier on Security
Security Risks of Too Much Security
All of the anti-counterfeiting features of the new Canadian $100 bill are resulting in people not bothering to verify them. The fanfare about the security features on the bills, may be part of the problem, said RCMP Sgt. Duncan Pound. "Because the polymer series' notes are so secure ... there's almost an overconfidence among retailers and the public in terms...
Friday Squid Blogging: Striped Pyjama Squid Pet Sculpture
Technically, it's a cuttlefish and not a squid. But it's still nice art. I posted a photo of a real striped pyjama squid way back in 2006. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Applied Cryptography on Elementary
In the episode that aired on May 9th, about eight or nine minutes in, there's a scene with a copy of Applied Cryptography prominently displayed on the coffee table. This isn't the first time that my books have appeared on that TV show....
Bluetooth-Controlled Door Lock
Here is a new lock that you can control via Bluetooth and an iPhone app. That's pretty cool, and I can imagine all sorts of reasons to get one of those. But I'm sure there are all sorts of unforeseen security vulnerabilities in this system. And even worse, a single vulnerability can affect all the locks. Remember that vulnerability found...
Transparency and Accountability
As part of the fallout of the Boston bombings, we're probably going to get some new laws that give the FBI additional investigative powers. As with the Patriot Act after 9/11, the debate over whether these new laws are helpful will be minimal, but the effects on civil liberties could be large. Even though most people are skeptical about sacrificing...
Friday Squid Blogging: Squid Festival in Monterey
It's at the end of May. Note that it's being put on by the Calamari Entertainment Group. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
The Onion on Browser Security
Wise advice: At Chase Bank, we recognize the value of online banking -- its quick, convenient, and available any time you need it. Unfortunately, though, the threats posed by malware and identity theft are very real and all too common nowadays. Thats why, when youre finished with your online banking session, we recommend three simple steps to protect your personal...
Mail Cover
From a FOIAed Department of Transportation document on investigative techniques: A "mail cover" is the process by which the U.S. Postal Service records any data appearing on the outside cover of any class of mail, sealed or unsealed, or by which a record is made of the contents of unsealed (second-, third-, or fourth-class) mail matter as allowed by law....
The Economist on Guantanamo
Maybe the tide is turning: America is in a hole. The last response of the blowhards and cowards who have put it there is always: "So what would you do: set them free?" Our answer remains, yes. There is clearly a risk that some of them would then commit some act of violence -- in Yemen, elsewhere in the Middle...
Reidentifying Anonymous Data
Latanya Sweeney has demonstrated how easy it can be to identify people from their birth date, gender, and zip code. The anonymous data she reidentified happened to be DNA data, but that's not relevant to her methods or results. Of the 1,130 volunteers Sweeney and her team reviewed, about 579 provided zip code, date of birth and gender, the three...
Evacuation Alerts at the Airport
Last week, an employee error caused the monitors at LAX to display a building evacuation order: At a little before 9:47 p.m., the message read: "An emergency has been declared in the terminal. Please evacuate." An airport police source said officers responded to the scene at the Tom Bradley International Terminal, believing the system had been hacked. But an airport...
Is the U.S. Government Recording and Saving All Domestic Telephone Calls?
I have no idea if "former counterterrorism agent for the FBI" Tom Clemente knows what he's talking about, but that's certainly what he implies here: More recently, two sources familiar with the investigation told CNN that Russell had spoken with Tamerlan after his picture appeared on national television April 18. What exactly the two said remains under investigation, the sources...
Intelligence Analysis and the Connect-the-Dots Metaphor
The FBI and the CIA are being criticized for not keeping better track of Tamerlan Tsarnaev in the months before the Boston Marathon bombings. How could they have ignored such a dangerous person? How do we reform the intelligence community to ensure this kind of failure doesn't happen again? It's an old song by now, one we heard after the...
Michael Chertoff on Google Glass
Interesting op-ed by former DHS head Michael Chertoff on the privacy risks of Google Glass. Now imagine that millions of Americans walk around each day wearing the equivalent of a drone on their head: a device capable of capturing video and audio recordings of everything that happens around them. And imagine that these devices upload the data to large-scale commercial...
Honeywords
Here is a simple but clever idea. Seed password files with dummy entries that will trigger an alarm when used. That way a site can know when a hacker is trying to decrypt the password file....
Friday Squid Blogging: Squid Escape Artist
It's amazing how small a hole he can fit through. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Another WWII Message Decoded
It's a really interesting code and story. (The first link has the most detailed information about the code and the cryptanalysis.)...
The Public/Private Surveillance Partnership
Our government collects a lot of information about us. Tax records, legal records, license records, records of government services received-- it's all in databases that are increasingly linked and correlated. Still, there's a lot of personal information the government can't collect. Either they're prohibited by law from asking without probable cause and a judicial order, or they simply have no...
Risks of Networked Systems
Interesting research: Helbing's publication illustrates how cascade effects and complex dynamics amplify the vulnerability of networked systems. For example, just a few long-distance connections can largely decrease our ability to mitigate the threats posed by global pandemics. Initially beneficial trends, such as globalization, increasing network densities, higher complexity, and an acceleration of institutional decision processes may ultimately push human-made or...
More on FinSpy/FinFisher
FinFisher (also called FinSpy) is a commercially sold spyware package that is used by governments world-wide, including the U.S. There's a new report that has a bunch of new information: Our new findings include: We have identified FinFisher Command & Control servers in 11 new Countries. Hungary, Turkey, Romania, Panama, Lithuania, Macedonia, South Africa, Pakistan, Nigeria, Bulgaria, Austria. Taken together...
Google Pays $31,000 for Three Chrome Vulnerabilities
Google is paying bug bounties. This is important; there's a market in vulnerabilities that provides incentives for their being kept secret and exploitable; for Google to buy and patch them makes us all more secure. The U.S. government should do the same....
Details of a Cyberheist
Really interesting article detailing how criminals steal from a company's accounts over the Internet. The costly cyberheist was carried out with the help of nearly 100 different accomplices in the United States who were hired through work-at-home job scams run by a crime gang that has been fleecing businesses for the past five years. Basically, the criminals break into the...
The Importance of Backups
I've already written about the guy who got a new trial because a virus ate his court records. Here's someone who will have to redo his thesis research because someone stole his only copy of the data. Remember the rule: no one ever wants backups, but everyone always wants restores. I have no idea if that image is real or...
Pinging the Entire Internet
Turns out there's a lot of vulnerable systems out there: Many of the two terabytes (2,000 gigabytes) worth of replies Moore received from 310 million IPs indicated that they came from devices vulnerable to well-known flaws, or configured in a way that could to let anyone take control of them. On Tuesday, Moore published results on a particularly troubling segment...
More Links on the Boston Terrorist Attacks
Max Abrahms has two sensible essays. Probably the ultimate in security theater: Williams-Sonoma stops selling pressure cookers "out of respect." They say it's temporary. (I bought a Williams-Sonoma pressure cooker last Christmas; I wonder if I'm now on a list.) A tragedy: Sunil Tripathi, whom Reddit and other sites wrongly identified as one of the bombers, was found dead in...
Friday Squid Blogging: Lego Giant Squid Model
This is a fantastic Lego model of a space kraken attacking a Star Wars Super Star Destroyer. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Tor Needs Bridges
The Internet anonymity service Tor needs people who are willing to run bridges. It's a goodness for the world; do it if you can....
Cryptanalyst on British Postage Stamps
A 92-year-old World War II Bletchley Park codebreaker has had a set of commemorative stamps issued in his honor....
Random Links on the Boston Terrorist Attack
Encouraging poll data says that maybe Americans are starting to have realistic fears about terrorism, or at least are refusing to be terrorized. Good essay by Scott Atran on terrorism and our reaction. Reddit apologizes. I think this is a big story. The Internet is going to help in everything, including trying to identify terrorists. This will happen whether or...
Ellen on Protecting Passwords
Pretty good video. Ellen makes fun of the "Internet Password Minder," which is -- if you think about it -- only slightly different than Password Safe....
More Plant Security Countermeasures
I've talked about plant security systems, both here and in Beyond Fear. Specifically, I've talked about tobacco plants that call air strikes against insects that eat them, by releasing a scent that attracts predators to those insects. Here's another defense: the plants also tag caterpillars for predators by feeding them a sweet snack (full episode here) that makes them give...
The Police Now Like Amateur Photography
PhotographyIsNotACrime.com points out the obvious: after years of warning us that photography is suspicious, the police were happy to accept all of those amateur photographs and videos at the Boston Marathon. Adding to the hypocrisy is that these same authorities will most likely start clamping down on citizens with cameras more than ever once the smoke clears and we once...
Securing Members of Congress from Transparency
I commented in this article on the repeal of the transparency provisions of the STOCK Act: Passed in 2012 after a 60 Minutes report on insider trading practices in Congress, the STOCK Act banned members of Congress and senior executive and legislative branch officials from trading based on government knowledge. To give the ban teeth, the law directed that many...
About Police Shoot Outs and Spectators
Hopefully this advice is superfluous for my audience, but it's so well written it's worth reading nonetheless: 7. SO, the bottom line is this: If you are in a place where you hear steady, and sustained, and nearby (lets call that, for some technical reasons, anything less than 800 meters) gunfire, do these things: Go to your basement. You are...
The Boston Marathon Bomber Manhunt
I generally give the police a lot of tactical leeway in times like this. The very armed and very dangerous suspects warranted extraordinary treatment. They were perfectly capable of killing again, taking hostages, planting more bombs -- and we didn't know the extent of the plot or the group. That's why I didn't object to the massive police dragnet, the...
Me at the Berkman Center
Earlier this month I spent a week at the Berkman Center for Internet and Society, talking to people about power, security, technology, and threats (details here). As part of that week, I gave a public talk at Harvard. Because my thoughts are so diffuse and disjoint, I didn't think I could pull it all together into a coherent talk. Instead,...
Friday Squid Blogging: Giant Squid Bike Rack
It's the first on this page. Apparently this is the finished version of the design I blogged about last year. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
NSA Cryptography Course
This article, from some internal NSA publication, is about Lambros Callimahos, who taught an intensive 18-week course on cryptology for many years and died in 1977. Be sure to notice the great redacted photo of him and his students on page 17....
The Nemim.gen Trojan
This clever piece of malware evades forensic examination by deleting its own components....
Initial Thoughts on the Boston Bombings
I rewrote my "refuse to be terrorized" essay for the Atlantic. David Rothkoph (author of the great book Power, Inc.) wrote something similar, and so did John Cole. It's interesting to see how much more resonance this idea has today than it did a dozen years ago. If other people have written similar essays, please post links in the comments....
FBI and Cell Phone Surveillance
We're learning a lot about how the FBI eavesdrops on cell phones from a recent court battle....
Google Glass Enables New Forms of Cheating
It's mentioned here: Mr. Doerr said he had been wearing the glasses and uses them especially for taking pictures and looking up words while playing Scattergories with his family, though it is questionable whether that follows the game's rules. Questionable? Questionable? It just like using a computer's dictionary while playing Scrabble, or a computer odds program while playing poker, or...
Friday Squid Blogging: Illegal Squid Fishing
While we we're on the subject of squid fishing in Argentina, the country is dealing with foreign boats illegally fishing for squid inside its territorial waters. So yet again, squid and security collide. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Remotely Hijacking an Aircraft
There is a lot of buzz on the the Internet about a talk at the Hack-in-the Box conference by Hugo Teso, who claims he can hack in to remotely control an airplane's avionics. He even wrote an Android app to do it. I honestly can't tell how real this is, and how much of it is the unique configuration of...
Thieves Use Video Camera to Stake Out Properties
If the police can use cameras, so can the burglars....
Security Externalities and DDOS Attacks
Ed Felten has a really good blog post about the externalities that the recent Spamhaus DDOS attack exploited: The attackers' goal was to flood Spamhaus or its network providers with Internet traffic, to overwhelm their capacity to handle incoming network packets. The main technical problem faced by a DoS attacker is how to amplify the attacker's traffic-sending capacity, so that...
Last Battle of Midway Cryptanalyst
The last cryptanalyst at the Battle of Midway, Rear Admiral Donald "Mac" Showers, USN-Ret, passed away 19 October 2012. His interment at Arlington National Cemetery at Arlington, Virginia, will be Monday, April 15, at 3:00. The family made this a public event to celebrate his life and contributions to the cryptologic community....
Nice Security Mindset Example
A real-world one-way function: Alice and Bob procure the same edition of the white pages book for a particular town, say Cambridge. For each letter Alice wants to encrypt, she finds a person in the book whose last name starts with this letter and uses his/her phone number as the encryption of that letter. To decrypt the message Bob has...
Bitcoins in the Mainstream Media
Interesting article from the New Yorker. I'm often asked what I think about bitcoins. I haven't analyzed the security, but what I have seen looks good. The real issues are economic and political, and I don't have the expertise to have an opinion on that. BTW, here's a recent criticism of BitCoins....
Elite Panic
I hadn't heard of this term before, but it's an interesting one. The excerpt below is from an interview with Rebecca Solnit, author of A Paradise Built in Hell: The Extraordinary Communities That Arise in Disaster: The term "elite panic" was coined by Caron Chess and Lee Clarke of Rutgers. From the beginning of the field in the 1950s to...
Government Use of Hackers as an Object of Fear
Interesting article about the perception of hackers in popular culture, and how the government uses the general fear of them to push for more power: But these more serious threats don't seem to loom as large as hackers in the minds of those who make the laws and regulations that shape the Internet. It is the hacker -- a sort...
Friday Squid Blogging: Nighttime Squid Fishing Seen from Space
Page 18 of this thesis explains that squid fishing is done at night, and the lighting is so bright shows up in the satellite surveys of planetary lighting. This video shows the phenomenon off the coast line of Argentina. As usual, you can also use this squid post to talk about the security stories in the news that I haven't...
Apple's iMessage Encryption Seems to Be Pretty Good
The U.S. Drug Enforcement Agency has complained (in a classified report, not publicly) that Apple's iMessage end-to-end encryption scheme can't be broken. On the one hand, I'm not surprised; end-to-end encryption of a messaging system is a fairly easy cryptographic problem, and it should be unbreakable. On the other hand, it's nice to have some confirmation that Apple is looking...
Skein Collision Competition
Xkcd had a Skein collision competition. The contest is over -- Carnegie Mellon University won, with 384 (out of 1024) mismatched bits -- but it's explained here....
IT for Oppression
Whether it's Syria using Facebook to help identify and arrest dissidents or China using its "Great Firewall" to limit access to international news throughout the country, repressive regimes all over the world are using the Internet to more efficiently implement surveillance, censorship, propaganda, and control. They're getting really good at it, and the IT industry is helping. We're helping by...
Narratives of Secrecy
How people talked about the secrecy surrounding the Manhattan project....
Sixth Movie-Plot Threat Contest
It's back, after a two-year hiatus. Terrorism is boring; cyberwar is in. Cyberwar, and its kin: cyber Pearl Harbor, cyber 9/11, cyber Armageddon. (Or make up your own: a cyber Black Plague, cyber Ragnarok, cyber comet-hits-the-earth.) This is how we get budget and power for militaries. This is how we convince people to give up their freedoms and liberties. This...
What I've Been Thinking About
I'm starting to think about my next book, which will be about power and the Internet -- from the perspective of security. My objective will be to describe current trends, explain where those trends are leading us, and discuss alternatives for avoiding that outcome. Many of my recent essays have touched on various facets of this, although Im still looking...
Friday Squid Blogging: Bomb Discovered in Squid at Market
Really: An unexploded bomb was found inside a squid when the fish was slaughtered at a fish market in Guangdong province. Oddly enough, this doesn't seem to be the work of terrorists: The stall owner, who has been selling fish for 10 years, told the newspaper the 1-meter-long squid might have mistaken the bomb for food. Clearly there's much to...
The Dangers of Surveillance
Interesting article, "The Dangers of Surveillance," by Neil M. Richards, Harvard Law Review, 2013. From the abstract: ....We need a better account of the dangers of surveillance. This article offers such an account. Drawing on law, history, literature, and the work of scholars in the emerging interdisciplinary field of "surveillance studies," I explain what those harms are and why they...
New RC4 Attack
This is a really clever attack on the RC4 encryption algorithm as used in TLS. We have found a new attack against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used. The attacks arise from statistical flaws in the keystream generated by the RC4 algorithm which become apparent...
Unwitting Drug Smugglers
This is a story about a physicist who got taken in by an imaginary Internet girlfriend and ended up being arrested in Argentina for drug smuggling. Readers of this blog will see it coming, of course, but it's a still a good read. I don't know whether the professor knew what he was doing -- it's pretty clear that the...
Security Awareness Training
Should companies spend money on security awareness training for their employees? It's a contentious topic, with respected experts on both sides of the debate. I personally believe that training users in security is generally a waste of time, and that the money can be spent better elsewhere. Moreover, I believe that our industry's focus on training serves to obscure greater...
The NSA's Cryptolog
The NSA has published declassified versions of its Cryptolog newsletter. All the issues from Aug 1974 through Summer 1997 are on the web, although there are some pretty heavy redactions in places. (Here's a link to the documents on a non-government site, in case they disappear.) I haven't even begun to go through these yet. If you find anything good,...
Identifying People from Mobile Phone Location Data
Turns out that it's pretty easy: Researchers at the Massachusetts Institute of Technology (MIT) and the Catholic University of Louvain studied 15 months' worth of anonymised mobile phone records for 1.5 million individuals. They found from the "mobility traces" - the evident paths of each mobile phone - that only four locations and times were enough to identify a particular...
Our Internet Surveillance State
I'm going to start with three data points. One: Some of the Chinese military hackers who were implicated in a broad set of attacks against the U.S. government and corporations were identified because they accessed Facebook from the same network infrastructure they used to carry out their attacks. Two: Hector Monsegur, one of the leaders of the LulzSac hacker movement,...
Friday Squid Blogging: Giant Squid Genetics
Despite looking very different from each other and being distributed across the world's oceans, all giant squid are the same species. There's also not a lot of genetic diversity. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Changes to the Blog
I have made a few changes to my blog that I'd like to talk about. The first is the various buttons associated with each post: a Facebook Like button, a Retweet button, and so on. These buttons are ubiquitous on the Internet now. We publishers like them because it makes it easier for our readers to share our content. I...
FBI Secretly Spying on Cloud Computer Users
Both Google and Microsoft have admitted it. Presumably every other major cloud service provider is getting these National Security Letters as well. If you've been following along, you know that a U.S. District Court recently ruled National Security Letters unconstitutional. Not that this changes anything yet....
Text Message Retention Policies
The FBI wants cell phone carriers to store SMS messages for a long time, enabling them to conduct surveillance backwards in time. Nothing new there -- data retention laws are being debated in many countries around the world -- but this was something I did not know: Wireless providers' current SMS retention policies vary. An internal Justice Department document (PDF)...
When Technology Overtakes Security
A core, not side, effect of technology is its ability to magnify power and multiply force -- for both attackers and defenders. One side creates ceramic handguns, laser-guided missiles, and new-identity theft techniques, while the other side creates anti-missile defense systems, fingerprint databases, and automatic facial recognition systems. The problem is that it's not balanced: Attackers generally benefit from new...
Lessons From the FBI's Insider Threat Program
This article is worth reading. One bit: For a time the FBI put its back into coming up with predictive analytics to help predict insider behavior prior to malicious activity. Rather than coming up with a powerful tool to stop criminals before they did damage, the FBI ended up with a system that was statistically worse than random at ferreting...
FinSpy
Twenty five countries are using the FinSpy surveillance software package (also called FinFisher) to spy on their own citizens: The list of countries with servers running FinSpy is now Australia, Bahrain, Bangladesh, Britain, Brunei, Canada, the Czech Republic, Estonia, Ethiopia, Germany, India, Indonesia, Japan, Latvia, Malaysia, Mexico, Mongolia, Netherlands, Qatar, Serbia, Singapore, Turkmenistan, the United Arab Emirates, the United States...
A 1962 Speculative Essay on Computers and Intelligence
From the CIA archives: Orrin Clotworthy, "Some Far-out Thoughts on Computers," Studies in Intelligence v. 6 (1962)....
Prison Escape
Audacious daytime prison escape by helicopter. The escapees have since been recaptured....
Friday Squid Blogging: WTF, Evolution?
WTF, Evolution? is a great blog, and they finally mentioned squid....
Stuxnet is Much Older than We Thought
Symantec has found evidence of Stuxnet variants from way back in 2005. That's much older than the 2009 creation date we originally thought it had. More here and here. What's impressive is how advanced the cyberattack capabilities of the U.S. and/or Israel were back then....
On Secrecy
Interesting law paper: "The Implausibility of Secrecy," by Mark Fenster. Abstract: Government secrecy frequently fails. Despite the executive branchs obsessive hoarding of certain kinds of documents and its constitutional authority to do so, recent high-profile events among them the WikiLeaks episode, the Obama administrations celebrated leak prosecutions, and the widespread disclosure by high-level officials of flattering confidential information to...
Nationalism on the Internet
For technology that was supposed to ignore borders, bring the world closer together, and sidestep the influence of national governments the Internet is fostering an awful lot of nationalism right now. We've started to see increased concern about the country of origin of IT products and services; U.S. companies are worried about hardware from China; European companies are worried about...
Security Theater on the Wells Fargo Website
Click on the "Establishing secure connection" link at the top of this page. It's a Wells Fargo page that displays a progress bar with a bunch of security phrases -- "Establishing Secure Connection," "Sending credentials," "Building Secure Environment," and so on -- and closes after a few seconds. It's complete security theater; it doesn't actually do anything but make account...
Hacking Best-seller Lists
It turns out that you can buy a position for your book on best-seller lists....
Cisco IP Phone Hack
Nice work: All current Cisco IP phones, including the ones seen on desks in the White House and aboard Air Force One, have a vulnerability that allows hackers to take complete control of the devices....
"The Logic of Surveillance"
Interesting essay: Surveillance is part of the system of control. "The more surveillance, the more control" is the majority belief amongst the ruling elites. Automated surveillance requires fewer "watchers", and since the watchers cannot watch all the surveillance, long term storage increases the ability to find some "crime" anyone is guilty of. [...] This is one of the biggest problems...
Dead Drop from the 1870s
Hats: De Blowitz was staying at the Kaiserhof. Each day his confederate went there for lunch and dinner. The two never acknowledged one another, but they hung their hats on neighboring pegs. At the end of the meal the confederate departed with de Blowitz's hat, and de Blowitz innocently took the confederate's. The communications were hidden in the hat's lining....
Is Software Security a Waste of Money?
I worry that comments about the value of software security made at the RSA Conference last week will be taken out of context. John Viega did not say that software security wasn't important. He said: For large software companies or major corporations such as banks or health care firms with large custom software bases, investing in software security can prove...
Friday Squid Blogging: Squid/Whale Yin-Yang
Pretty. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Ross Anderson's Security Engineering Online
The second edition of Ross Anderson's fantastic book, Security Engineering, is now free online. Required reading for any security engineer....
Oxford University Blocks Google Docs
Google Docs is being used for phishing. Oxford University felt that it had to block the service because Google isn't responding to takedown requests quickly enough. Think about this in light of my essay on feudal security. Oxford University has to trust that Google will act in its best interest, and has no other option if it doesn't....
How the FBI Intercepts Cell Phone Data
Good article on "Stingrays," which the FBI uses to monitor cell phone data. Basically, they trick the phone into joining a fake network. And, since cell phones inherently trust the network -- as opposed to computers which inherently do not trust the Internet -- it's easy to track people and collect data. There are lots of questions about whether or...
Browser Security
Interesting discussion on browser security from Communications of the ACM. Also, an article on browser and web privacy from the same issue....
The NSA's Ragtime Surveillance Program and the Need for Leaks
A new book reveals details about the NSA's Ragtime surveillance program: A book published earlier this month, "Deep State: Inside the Government Secrecy Industry," contains revelations about the NSA's snooping efforts, based on information gleaned from NSA sources. According to a detailed summary by Shane Harris at the Washingtonian yesterday, the book discloses that a codename for a controversial NSA...
Al Qaeda Document on Avoiding Drone Strikes
Interesting: 3 Spreading the reflective pieces of glass on a car or on the roof of the building. 4 Placing a group of skilled snipers to hunt the drone, especially the reconnaissance ones because they fly low, about six kilometers or less. 5 Jamming of and confusing of electronic communication using the ordinary water-lifting dynamo fitted with...
Marketing at the RSA Conference
Marcus Ranum has an interesting screed on "booth babes" in the RSA Conference exhibition hall: I'm not making a moral argument about sexism in our industry or the objectification of women. I could (and probably should) but it's easier to just point out the obvious: the only customers that will be impressed by anyone's ability to hire pretty models to...
Technologies of Surveillance
It's a new day for the New York Police Department, with technology increasingly informing the way cops do their jobs. With innovation comes new possibilities but also new concerns. For one, the NYPD is testing a new type of security apparatus that uses terahertz radiation to detect guns under clothing from a distance. As Police Commissioner Ray Kelly explained to...
New Internet Porn Scam
I hadn't heard of this one before. In New Zealand, people viewing adult websites -- it's unclear whether these are honeypot sites, or malware that notices the site being viewed -- get a pop-up message claiming it's from the NZ Police and demanding payment of an instant fine for viewing illegal pornography....
Getting Security Incentives Right
One of the problems with motivating proper security behavior within an organization is that the incentives are all wrong. It doesn't matter how much management tells employees that security is important, employees know when it really isn't -- when getting the job done cheaply and on schedule is much more important. It seems to me that his co-workers understand the...
Friday Squid Blogging: Another Squid Cartoon.
Another. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Me on "Virtually Speaking"
Last week I was on "Virtually Speaking."...
Phishing Has Gotten Very Good
This isn't phishing; it's not even spear phishing. It's laser-guided precision phishing: One of the leaked diplomatic cables referred to one attack via email on US officials who were on a trip in Copenhagen to debate issues surrounding climate change. "The message had the subject line 'China and Climate Change' and was spoofed to appear as if it were from...
The Court of Public Opinion
Recently, Elon Musk and the New York Times took to Twitter and the Internet to argue the data -- and their grievances -- over a failed road test and car review. Meanwhile, an Applebee's server is part of a Change.org petition to get her job back after posting a pastor's no-tip receipt comment online. And when he wasn't paid quickly...
Brazen Physical Thefts
Three brazen robberies are in the news this week. The first was a theft at a small museum of gold nuggets worth $750,000: Police said the daring heist happened between daytime tours, during a 20-minute window. Museum employees said the thief used an ax to smash the acrylic window, and then left the ax behind. "He just grabbed it, threw...
Alan F. Westin Died
Obituary here. His 1967 book, Privacy and Freedom, almost single-handedly created modern privacy law....
How Complex Systems Fail
Good summary list. It's not directly about security, but it's all fundamentally about security. Any real-world security system is inherently complex. I wrote about this long ago in Beyond Fear....
Security Lessons from the Battle of Hoth
Someone has analyzed the security mistakes in the Battle of Hoth, from the movie The Empire Strikes Back....
House Hearing: How Well Is the TSA Doing?
I would have liked to participate in this hearing: Committee on Homeland Security, Subcommittee on Oversight and Management Efficiency: "Assessing DHS 10 Years Later: How Wisely is DHS Spending Taxpayer Dollars?" February 15, 2013....
Me at the RSA Conference
I'll be speaking twice at the RSA Conference this year. I'm giving a solo talk Tuesday at 1:00, and participating in a debate about training Wednesday at noon. This is a short written preview of my solo talk, and this is an audio interview on the topic. Additionally: Akamai is giving away 1,500 copies of Liars and Outliers, and Zcaler...
Another Essay about Liars and Outliers
The Montréal Review asked me to write an essay about my latest book. Not much that regular readers haven't seen before....
Friday Squid Blogging: Land Squids
Funny. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
I Was on Inventing the Future
I was a guest on Inventing the Future, for an episode on surveillance technology. The video is here....
Hacking the Papal Election
As the College of Cardinals prepares to elect a new pope, security people like me wonder about the process. How does it work, and just how hard would it be to hack the vote? The rules for papal elections are steeped in tradition. John Paul II last codified them in 1996, and Benedict XVI left the rules largely untouched. The...
All Those Companies that Can't Afford Dedicated Security
This is interesting: In the security practice, we have our own version of no-man's land, and that's midsize companies. Wendy Nather refers to these folks as being below the "Security Poverty Line." These folks have a couple hundred to a couple thousand employees. That's big enough to have real data interesting to attackers, but not big enough to have a...
More on Chinese Cyberattacks
Wow, is this a crazy media frenzy. We should know better. These attacks happen all the time, and just because the media is reporting about them with greater frequency doesn't mean that they're happening with greater frequency. Hype aside, the Mandiant report on the hackers is very good, especially the part where the Chinese hackers outted themselves through poor opsec:...
Age Biases in Perceptions of Trust
Interesting research (full article is behind a paywall): Abstract: Older adults are disproportionately vulnerable to fraud, and federal agencies have speculated that excessive trust explains their greater vulnerability. Two studies, one behavioral and one using neuroimaging methodology, identified age differences in trust and their neural underpinnings. Older and younger adults rated faces high in trust cues similarly, but older adults...
Fixing Soccer Matches
How international soccer matches are fixed. Right now, Dan Tan's programmers are busy reverse-engineering the safeguards of online betting houses. About $3 billion is wagered on sports every day, most of it on soccer, most of it in Asia. That's a lot of noise on the big exchanges. We can exploit the fluctuations, rig the bets in a way that...
19th-Century Traffic Analysis
There's a nice example of traffic analysis in the book No Name, by Wilkie Collins (1862). The attacker, Captain Wragge, needs to know whether a letter has been placed in the mail. He knows who it will have been addressed to if it has been mailed, and with that information, is able to convince the postmaster to tell him that...
Hacking Citation Counts
Hacking citation counts using Google Scholar....
More State-Sponsored Hacking
After the New York Times broke the story of what seemed to be a state-sponsored hack from China against the newspaper, the Register has stories of two similar attacks: one from Burma and another from China....
Automobile Data Surveillance and the Future of Black Boxes
Tesla Motors gave one of its electric cars to John Broder, a very outspoken electric-car skeptic from the New York Times, for a test drive. After a negative review, Tesla revealed that it logged a dizzying amount of data from that text drive. The company then matched the reporter's claims against its logs and published a rebuttal. Broder rebutted the...
Friday Squid Blogging: More on Flying Squid
Japanese squid researchers have confirmed flying squid can fly, and how they do it. (Note: I have written about flying squid before.) As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Jacob Appelbaum's 29C3 Keynote Speech
This QNsePZj_Yks">speech from last December's 29C3 (29th Chaos Communication Congress) is worth listening to. He talks about what we can do in the face of oppressive power on the Internet. I'm not sure his answers are right, but am glad to hear someone talking about the real problems....
Guessing Smart Phone PINs by Monitoring the Accelerometer
"Practicality of Accelerometer Side Channels on Smartphones," by Adam J. Aviv. Benjamin Sapp, Matt Blaze, and Jonathan M. Smith. Abstract: Modern smartphones are equipped with a plethora of sensors that enable a wide range of interactions, but some of these sensors can be employed as a side channel to surreptitiously learn about user input. In this paper, we show that...
Using the iWatch for Authentication
Usability engineer Bruce Tognazzini talks about how an iWatch -- which seems to be either a mythical Apple product or one actually in development -- can make authentication easier. Passcodes. The watch can and should, for most of us, eliminate passcodes altogether on iPhones, and Macs and, if Apple's smart, PCs: As long as my watch is in range, let...
Anti-Cheating Security in Casinos
Long article. With over a thousand cameras operating 24/7, the monitoring room creates tremendous amounts of data every day, most of which goes unseen. Six technicians watch about 40 monitors, but all the feeds are saved for later analysis. One day, as with OCR scanning, it might be possible to search all that data for suspicious activity. Say, a baccarat...
Real-World Prisoner's Dilemma from France
This is a real story of a pair of identical twins who are suspected in a crime. There is there is CCTV and DNA evidence that could implicate either suspect. Detailed DNA testing that could resolve the guilty twin is prohibitively expensive. So both have been arrested in the hope that one may confess or implicate the other....
New al Qaeda Encryption Tool
There's not a lot of information -- and quite a lot of hyperbole -- in this article: With the release of the Asrar Al Dardashah plugin, GIMF promised "secure correspondence" based on the Pidgin chat client, which supports multiple chat platforms, including Yahoo Messenger, Windows Live Messenger, AOL Instant Messenger, Google Talk and Jabber/XMPP. "The Asrar Al Dardashah plugin supports...
Massive Police Shootout in Cleveland Despite Lack of Criminals
This is an amazing story. I urge you to read the whole thing, but here's the basics: A November car chase ended in a "full blown-out" firefight, with glass and bullets flying, according to Cleveland police officers who described for investigators the chaotic scene at the end of the deadly 25-minute pursuit. But when the smoky haze -- caused by...
Our New Regimes of Trust
Society runs on trust. Over the millennia, we've developed a variety of mechanisms to induce trustworthy behavior in society. These range from a sense of guilt when we cheat, to societal disapproval when we lie, to laws that arrest fraudsters, to door locks and burglar alarms that keep thieves out of our homes. They're complicated and interrelated, but they tend...
Really Clever TLS Attack
This is an extremely clever man-in-the-middle timing attack against AES that exploits the interaction between how the protocol implements AES in CBC mode for encryption, and HMAC-SHA1 for authentication. (And this is a really good plain-language description of it.)...
Platform Fragmentation as a Security Issue
Interesting article about the difficulty Google has pushing security updates onto Android phones. The problem is that the phone manufacturer is in charge, and there are a lot of different phone manufacturers of varying ability and interest....
Friday Squid Blogging: Squid Recipe
Chorizo-stuffed squid with potatoes, capers and sage. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
I Seem to Be a Physical Security Expert Now
This seems so obviously written by someone who Googled me on the Internet, without any other knowledge of who I am or what i do....
Millennials and Cybersecurity
This long report looks at risky online behavior among the Millennial generation, and finds that they respond positively to automatic reminders and prodding. No surprise, really....
Inauguration Security
A first-person account of the security surrounding the second inauguration of President Obama....
Tide Becomes Drug Currency
Basically, Tide detergent is a popular product with a very small profit margin. So small non-chain grocery and convenience stores are happy to buy it cheaply, no questions asked. This makes it easy to sell if you steal it. And drug dealers have started taking it as currency, large bottles being worth about $5....
Over $3M in Prizes to Hack Google Chrome
Google's contest at the CanSecWest conference: Today were announcing our third Pwnium competitionPwnium 3. Google Chrome is already featured in the Pwn2Own competition this year, so Pwnium 3 will have a new focus: Chrome OS. Well issue Pwnium 3 rewards for Chrome OS at the following levels, up to a total of $3.14159 million USD: $110,000: browser or system level...
Why Is Quantum Computing So Hard?
Blog post (and two papers) by Ross Anderson and Robert Brady. News article....
New York Times Hacked by China
This was big news last week, and I spent a lot of time doing press interviews about it. But while it is an important story -- hacking a newspaper, looking for confidential sources is fundamentally different from hacking for financial gain -- it's not much different than GhostNet in 2009, Google's Chinese hacking stories from 2010 and 2011, or others....
Proactive Defense Papers
I just printed this out: "Proactive Defense for Evolving Cyber Threats," a Sandia Report by Richard Colbaugh and Kristin Glass. It's a collection of academic papers, and it looks interesting....
Security Seals
I don't see a lot written about security seals, despite how common they are. This article is a very basic overview of the technologies....
Using Imagery to Avoid Censorship
Interesting: "It's really hard for the government to censor things when they don't understand the made-up words or meaning behind the imagery," said Kevin Lee, COO of China Youthology, in conversation at the DLD conference in Munich on Monday. "The people there aren't even relying on text anymore It's audio, visual, photos. All the young people are creating their own...
Friday Squid Blogging: Squid Anchor
Webpage says that it's "the most effective lightweight, portable anchor around." As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Pentagon Staffs Up U.S. Cyber Command
The Washington Post has the story: The move, requested by the head of the Defense Department's Cyber Command, is part of an effort to turn an organization that has focused largely on defensive measures into the equivalent of an Internet-era fighting force. The command, made up of about 900 personnel, will expand to include 4,900 troops and civilians. [...] The...
Jared Diamond on Common Risks
Jared Diamond has an op-ed in the New York Times where he talks about how we overestimate rare risks and underestimate common ones. Nothing new here -- I and others have written about this sort of thing extensively -- but he says that this is a bias found more in developed countries than in primitive cultures. I first became aware...
The Eavesdropping System in Your Computer
Dan Farmer has an interesting paper (long version here; short version here) discussing the Baseboard Management Controller on your computer's motherboard: The BMC is an embedded computer found on most server motherboards made in the last 10 or 15 years. Often running Linux, the BMC's CPU, memory, storage, and network run independently. It runs Intel's IPMI out-of-band systems management protocol...
Power and the Internet
All disruptive technologies upset traditional power balances, and the Internet is no exception. The standard story is that it empowers the powerless, but that's only half the story. The Internet empowers everyone. Powerful institutions might be slow to make use of that new power, but since they are powerful, they can use it more effectively. Governments and corporations have woken...
"People, Process, and Technology"
Back in 1999 when I formed Counterpane Internet Security, Inc., I popularized the notion that security was a combination of people, process, and technology. Back then, it was an important notion; security back then was largely technology-only, and I was trying to push the idea that people and process needed to be incorporated into an overall security system. This blog...
Who Does Skype Let Spy?
Lately I've been thinking a lot about power and the Internet, and what I call the feudal model of IT security that is becoming more and more pervasive. Basically, between cloud services and locked-down end-user devices, we have less control and visibility over our security -- and have no point but to trust those in power to keep us safe....
Backdoors Built in to Barracuda Networks Equipment
Don't we know enough not to do this anymore?...
Complexity and Security
I have written about complexity and security for over a decade now (for example, this from 1999). Here's the results of a survey that confirms this: Results showed that more than half of the survey respondents from mid-sized (identified as 50-2500 employees) and enterprise organizations (identified as 2500+ employees) stated that complex policies ultimately led to a security breach, system...
Dangerous Security Theater: Scrambling Fighter Jets
This story exemplifies everything that's wrong with our see-something-say-something war on terror: a perfectly innocent person on an airplane, a random person identifying him as a terrorist threat, and a complete overreaction on the part of the authorities. Typical overreaction, but in this case -- as in several others over the past decade -- F-15 fighter jets were scrambled to...
Violence as a Contagious Disease
This is fascinating: Intuitively we understand that people surrounded by violence are more likely to be violent themselves. This isn't just some nebulous phenomenon, argue Slutkin and his colleagues, but a dynamic that can be rigorously quantified and understood. According to their theory, exposure to violence is conceptually similar to exposure to, say, cholera or tuberculosis. Acts of violence are...
Friday Squid Blogging: Squirming Tentacle USB Drive
Just the thing. (Note that this is different than the previous squid USB drive I blogged about.) As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Video Interview with Me
This interview was conducted last month, at an artificial intelligence conference at Oxford....
Shaming as Punishment for Repeated Drunk Driving
Janesville, Wisconsin, has published information about repeated drunk driving offenders since 2010. The idea is that the public shame will reduce future incidents....
Identifying People from their Writing Style
It's called stylometry, and it's based on the analysis of things like word choice, sentence structure, syntax and punctuation. In one experiment, researchers were able to identify 80% of users with a 5,000-word writing sample. Download tools here, including one to anonymize your writing style....
Identifying People from their DNA
Interesting: The genetic data posted online seemed perfectly anonymous - strings of billions of DNA letters from more than 1,000 people. But all it took was some clever sleuthing on the Web for a genetics researcher to identify five people he randomly selected from the study group. Not only that, he found their entire families, even though the relatives had...
The Security of the Mega File-Sharing Service
Ever since the launch of Kim Dotcom's file-sharing service, I have been asked about the unorthodox encryption and security system. I have not reviewed it, and don't have an opinion. All I know is what I read: this, this, this, this, and this. Please add other links in the comments....
Commenting on Aaron Swartz's Death
There has been an enormous amount written about the suicide of Aaron Swartz. This is primarily a collection of links, starting with those that use his death to talk about the broader issues at play: Orin Kerr, Larry Lessig, Jennifer Granick, Glenn Greenwald, Henry Farrell, danah boyd, Cory Doctorow, James Fallows, Brewster Kahle, Carl Malamud, and Mark Bernstein. Here are...
Google's Authentication Research
Google is working on non-password authentication techniques. But for Google's password-liberation plan to really take off, theyre going to need other websites to play ball. "Others have tried similar approaches but achieved little success in the consumer world," they write. "Although we recognize that our initiative will likewise remain speculative until we've proven large scale acceptance, were eager to test...
Thinking About Obscurity
This essay is worth reading: Obscurity is the idea that when information is hard to obtain or understand, it is, to some degree, safe. Safety, here, doesn't mean inaccessible. Competent and determined data hunters armed with the right tools can always find a way to get it. Less committed folks, however, experience great effort as a deterrent. Online, obscurity is...
TSA Removing Rapiscan Full-Body Scanners from U.S. Airports
This is big news: The U.S. Transportation Security Administration will remove airport body scanners that privacy advocates likened to strip searches after OSI Systems Inc. (OSIS) couldn't write software to make passenger images less revealing. This doesn't mean the end of full-body scanning. There are two categories of these devices: backscatter X-ray and millimeter wave. The government said Friday it...
Friday Squid Blogging: The Search for the Colossal Squid
Now that videographers have bagged a giant squid, the search turns to the colossal squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Man-in-the-Middle Attacks Against Browser Encryption
Last week, a story broke about how Nokia mounts man-in-the-middle attacks against secure browser sessions. The Finnish phone giant has since admitted that it decrypts secure data that passes through HTTPS connections -- including social networking accounts, online banking, email and other secure sessions -- in order to compress the data and speed up the loading of Web pages. The...
Essay on FBI-Mandated Backdoors
Good essay by Matt Blaze and Susan Landau....
Cheating at Chess
There's a fascinating story about a probable tournament chess cheat. No one knows how he does it; there's only the facts that 1) historically he's not nearly as good as his recent record, and 2) his moves correlate almost perfectly with one of best computer chess programs. The general question is how valid statistical evidence is when there is no...
Lexical Warfare
This essay, which uses the suicide of Aaron Swartz as a jumping off point for how the term "hactivist" has been manipulated by various powers, has this to say about "lexical warfare": I believe the debate itself is far broader than the specifics of this unhappy case, for if there was prosecutorial overreach it raises the question of whether we...
Anti-Surveillance Clothing
It's both an art project and a practical clothing line. ...Harvey's line of "Stealth Wear" clothing includes an "anti-drone hoodie" that uses metalized material designed to counter thermal imaging used by drones to spot people on the ground. He's also created a cellphone pouch made of a special "signal attenuating fabric." The pocket blocks your phone signal so that it...
The Origins of War
Philosophy professor David Livingstone Smith on the origins of war....
Friday Squid Blogging: Giant Squid Video
Last week, I blogged about an upcoming Discovery Channel program with actual video footage of a live giant squid. ABC News has a tantalizingly short sneak peak. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Experimental Results: Liars and Outliers Trust Offer
Last August, I offered to sell Liars and Outliers for $11 in exchange for a book review. This was much less than the $30 list price; less even than the $16 Amazon price. For readers outside the U.S., where books can be very expensive, it was a great price. I sold 800 books from this offer -- much more than...
The Politics and Philosophy of National Security
This essay explains why we're all living in failed Hobbesian states: What do these three implications -- states have a great deal of freedom to determine what threatens a people and how to respond to those threats, and in making those determinations, they are influenced by the interests and ideologies of their primary constituencies; states have strong incentives and have...
Denial-of-Service Attack Against Facebook
Just claim the person is dead. All you need to do is fake an online obituary....
Cat Smuggler
Not a cat burglar, a cat smuggler. Guards thought there was something suspicious about a little white cat slipping through a prison gate in northeastern Brazil. A prison official says that when they caught the animal, they found a cellphone, drills, small saws and other contraband taped to its body. Another article, with video. A prison spokesperson was quoted by...
DHS Gets to Spy on Everyone
This Wall Street Journal investigative piece is a month old, but well worth reading. Basically, the Total Information Awareness program is back with a different name: The rules now allow the little-known National Counterterrorism Center to examine the government files of U.S. citizens for possible criminal behavior, even if there is no reason to suspect them. That is a departure...
Details of an Internet Scam
Interesting details of an Amazon Marketplace scam. Worth reading. Most scams use a hook to cause a reaction. The idea being that if you are reacting, they get to control you. If you take the time to stop and think things through, you take control back and can usually spot the scam. Common hooks involve Urgency, Uncertainty, Sex, Fear or...
Friday Squid Blogging: Giant Squid Finally Captured on Video
We'll see it later this month. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
What Facebook Gives the Police
This is what Facebook gives the police in response to a subpoena. (Note that this isn't in response to a warrant; it's in response to a subpoena.) This might be the first one of these that has ever become public....
Classifying a Shape
This is a great essay: Spheres are special shapes for nuclear weapons designers. Most nuclear weapons have, somewhere in them, that spheres-within-spheres arrangement of the implosion nuclear weapon design. You dont have to use spheres -- cylinders can be made to work, and there are lots of rumblings and rumors about non-spherical implosion designs around these here Internets -- but...
Apollo Robbins, Pickpocket
Fascianting story: "Come on," Jillette said. "Steal something from me." Again, Robbins begged off, but he offered to do a trick instead. He instructed Jillette to place a ring that he was wearing on a piece of paper and trace its outline with a pen. By now, a small crowd had gathered. Jillette removed his ring, put it down on...
Terms of Service as a Security Threat
After the Instagram debacle, where it changed its terms of service to give itself greater rights over user photos and reversed itself after a user backlash, it's worth thinking about the security threat stemming from terms of service in general. As cloud computing becomes the norm, as Internet security becomes more feudal, these terms of service agreements define what our...
Friday Squid Blogging: William Gilly, Squid Researcher
Good article. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
I Seem to Be a Verb
From "The Insider's TSA Dictionary": Bruce Schneiered: (V, ints) When a passenger uses logic in order to confound and perplex an officer into submission. Ex: "A TSA officer took my Swiss army knife, but let my scissors go. I then asked him wouldn't it be more dangerous if I were to make my scissors into two blades, or to go...
Becoming a Police Informant in Exchange for a Lighter Sentence
Fascinating article. Snitching has become so commonplace that in the past five years at least 48,895 federal convicts -- one of every eight -- had their prison sentences reduced in exchange for helping government investigators, a USA TODAY examination of hundreds of thousands of court cases found. The deals can chop a decade or more off of their sentences. How...
Breaking Hard-Disk Encryption
The newly announced ElcomSoft Forensic Disk Decryptor can decrypt BitLocker, PGP, and TrueCrypt. And it's only $300. How does it work? Elcomsoft Forensic Disk Decryptor acquires the necessary decryption keys by analyzing memory dumps and/or hibernation files obtained from the target PC. You'll thus need to get a memory dump from a running PC (locked or unlocked) with encrypted volumes...
Public Shaming as a Security Measure
In Liars and Outliers, I talk a lot about the more social forms of security. One of them is reputational. This post is about that squishy sociological security measure: public shaming as a way to punish bigotry (and, by extension, to reduce the incidence of bigotry). It's a pretty rambling post, first listing some of the public shaming sites, then...
Cryptography Engineering Available as an eBook
Finally, Cryptography Engineering is available as an ebook. Even better, it's today's deal of the day at O'Reilly: $27.50 (50% off) and no copy protection. (The discount won't show until you add the book to your cart.)...
Hackers Use Backdoor to Break System
Industrial control system comes with a backdoor: Although the system was password protected in general, the backdoor through the IP address apparently required no password and allowed direct access to the control system. "[Th]e published backdoor URL provided the same level of access to the company's control system as the password-protected administrator login," said the memo. The security of this...
Peruvian Spider Species Creates Decoys
Clyclosa spiders create decoys to fool predators....
Phishing via Twitter
Interesting firsthand phishing story: A few nights ago, I got a Twitter direct message (DM) from a friend saying that someone was saying nasty things about me, with a link. The link was a shortened (t.co) link, so it was hard to see exactly what it pointed to. I followed the link on my cell phone, and got to a...
Friday Squid Blogging: Laughing Squid
The small San Francisco film and video company is celebrating its 17th anniversary. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
This Week's Overreactions
Schools go into lockdown over a thermometer, a car backfiring, a bank robbery a few blocks away, a student alone in a gym, a neighbor on the street, and some vague unfounded rumors. And one high-school kid was arrested for drawing pictures of guns. Everywhere else, post-traumatic stupidity syndrome." (It's not a new phrase -- Google shows hits back to...
Amazon Replacement-Order Scam
Clever: Chris Cardinal discovered someone running such a scam on Amazon using his account: the scammer contacted Amazon pretending to be Chris, supplying his billing address (this is often easy to guess by digging into things like public phone books, credit reports, or domain registration records). Then the scammer secured the order numbers of items Chris recently bought on Amazon....
China Now Blocking Encryption
The "Great Firewall of China" is now able to detect and block encryption: A number of companies providing "virtual private network" (VPN) services to users in China say the new system is able to "learn, discover and block" the encrypted communications methods used by a number of different VPN systems. China Unicom, one of the biggest telecoms providers in the...
Information-Age Law Enforcement Techniques
This is an interesting blog post: Buried inside a recent United Nations Office on Drugs and Crime report titled Use of Internet for Terrorist Purposes one can carve out details and examples of law enforcement electronic surveillance techniques that are normally kept secret. [...] Point 280: International members of the guerilla group Revolutionary Armed Forces of Colombia (FARC) communicated with...
Nasty Samsung Phone Exploit
There's a new exploit against Samsung Galaxy phones that allows a rogue app access to all memory. A hacker could copy all of your data, erase all of your data, and basically brick your phone. I haven't found an offical Samsung response, but there is a quick fix....
Possible Decryption of World War II Pigeon Message
A Canadian claims that the message is based on a WWI codebook. A spokesman from GCHQ remains dubious, but says they'll be happy to look at the proposed solution....
Friday Squid Blogging: Giant PVC Squid
Neat art project. Another link. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Book Review: Against Security
Against Security: How We Go Wrong at Airports, Subways, and Other Sites of Ambiguous Danger, by Harvey Molotch, Princeton University Press, 278 pages, $35 Security is both a feeling and a reality, and the two are different things. People can feel secure when theyre actually not, and they can be secure even when they believe otherwise. This discord explains much...
The History of Security Economics
Ross Anderson recalls the history of security economics (presentation and paper.)...
The Internet in North Korea
How Internet censorship works in North Korea....
QR Code Scams
There's a rise in QR codes that point to fraudulent sites. One of the warning signs seems to be a sticker with the code, rather than a code embedded in an advertising poster. This brings up another question: does anyone actually use these things?...
Detecting Edited Audio
Interesting development in forensic analysis: Comparing the unique pattern of the frequencies on an audio recording with a database that has been logging these changes for 24 hours a day, 365 days a year provides a digital watermark: a date and time stamp on the recording. Philip Harrison, from JP French Associates, another forensic audio laboratory that has been logging...
Drone Flights Over the US
The EFF has been prying data out of the government and analyzing it....
The National Cyber Security Framework Manual
This book is available as a free pdf download: The National Cyber Security Framework Manual provides detailed background information and in-depth theoretical frameworks to help the reader understand the various facets of National Cyber Security, according to different levels of public policy formulation. The four levels of government -- political, strategic, operational and tactical/technical -- each have their own perspectives...
Dictators Shutting Down the Internet
Excellent article: "How to Shut Down Internets." First, he describes what just happened in Syria. Then: Egypt turned off the internet by using the Border Gateway Protocol trick, and also by switching off DNS. This has a similar effect to throwing bleach over a map. The location of every street and house in the country is blotted out. All the...
Bypassing Two-Factor Authentication
Yet another way two-factor authentication has been bypassed: For a user to fall prey to Eurograbber, he or she must first be using a computer infected with the trojan. This was typically done by luring the user onto a malicious web page via a round of unfortunate web surfing or email phishing attempts. Once infected, the trojan would monitor that...
Buy Your Own ATM Skimmer for $3000
I have no idea if this is real. If I had to guess, I would say no....
Squids on the Economist Cover
Four squids on the cover of this week's Economist represent the four massive (and intrusive) data-driven Internet giants: Google, Facebook, Apple, and Amazon. Interestingly, these are the same four companies I've been listing as the new corporate threat to the Internet. The first of three pillars propping up this outside threat are big data collectors, which in addition to Apple...
Comedy and Cryptography
Not the sort of pairing I normally think of, but: Robin Ince and Brian Cox are joined on stage by comedian Dave Gorman, author and Enigma Machine owner Simon Singh and Bletchley Park enthusiast Dr Sue Black as they discuss secret science, code-breaking and the extraordinary achievements of the team working at Bletchley during WW II. Audio here....
Roger Williams' Cipher Cracked
Another historical cipher, this one from the 1600s, has been cracked: Senior math major Lucas Mason-Brown, who has done the majority of the decoding, said his first instinct was to develop a statistical tool. The 21-year-old from Belmont, Mass., used frequency analysis, which looks at the frequency of letters or groups of letters in a text, but initially didn't get...
Feudal Security
Its a feudal world out there. Some of us have pledged our allegiance to Google: We have Gmail accounts, we use Google Calendar and Google Docs, and we have Android phones. Others have pledged allegiance to Apple: We have Macintosh laptops, iPhones, and iPads; and we let iCloud automatically synchronize and back up everything. Still others of us let Microsoft...
Friday Squid Blogging: Possible Squid Eyeball Found in Florida
It's the size of a softball. No sign of the squid it came from. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Hacking by the Syrian Government
Good article on how the Syrian government hacked into the computers of dissidents: The cyberwar in Syria began with a feint. On Feb. 8, 2011, just as the Arab Spring was reaching a crescendo, the government in Damascus suddenly reversed a long-standing ban on websites such as Facebook, Twitter, YouTube, and the Arabic version of Wikipedia. It was an odd...
Advances in Attacking ATMs
Cash traps and card traps are the new thing: [Card traps] involve devices that fit over the card acceptance slot and include a razor-edged spring trap that prevents the customers card from being ejected from the ATM when the transaction is completed. "Spring traps are still being widely used," EAST wrote in its most recently European Fraud Update. "Once the...
James Bond Movie-Plot Threats
Amusing post on the plausibility of the evil plans from the various movies....
The Psychology of IT Security Trade-offs
Good article. I agree with the conclusion that the solution isn't to convince people to make better choices, but to change the IT architecture so that it's easier to make better choices....
Classified Information Confetti
Some of the confetti at the Macy's Thanksgiving Day Parade in New York consisted of confidential documents from the Nassau County Police Department, shredded sideways....
Hackback
Stewart Baker, Orin Kerr, and Eugene Volokh on the legality of hackback....
Liars and Outliers Ebook 50% Off and DRM-Free
Today only, O'Reilly is offering 50% off all its ebooks, including Liars and Outliers. This is probably the cheapest you'll find a DRM-free copy of the book....
Homeland Security Essay Contest
The Naval Postgraduate School's Center for Homeland Defense and Security is running its sixth annual essay competition. There are cash prizes. (Info on previous years here.)...
Friday Squid Blogging: Another Squid Comic
Another squid comic. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Preventing Catastrophic Threats
"Recommendations to Prevent Catastrophic Threats." Federation of American Scientists, 9 November 2012. It's twelve specific sets of recommendations for twelve specific threats. See also this....
Cell Phone Surveillance
Good article on the different ways the police can eavesdrop on cell phone calls....
Decrypting a Secret Society's Documents from the 1740s
Great story, both the cryptanalysis process and the Oculists....
Anonymous Claims it Sabotaged Rove Election Hacking
Can anyone make heads or tails of this story? (More links.) For my part, I'd like a little -- you know -- evidence. Remember that Ohio was not the deciding state in the election. Neither was Florida or Virginia. It was Colorado. So even if there was this magic election-stealing software running in Ohio, it wouldn't have made any difference....
E-Mail Security in the Wake of Petraeus
I've been reading lots of articles articles discussing how little e-mail and Internet privacy we actually have in the U.S. This is a good one to start with: The FBI obliged apparently obtaining subpoenas for Internet Protocol logs, which allowed them to connect the senders anonymous Google Mail account to others accessed from the same computers, accounts that belonged to...
Security Theater in American Diplomatic Missions
I noticed this in an article about how increased security and a general risk aversion is harming US diplomatic missions: "Barbara Bodine, who was the U.S. ambassador to Yemen during the Qaeda bombing of the U.S.S. Cole in 2000, told me she believes that much of the security American diplomats are forced to travel with is counterproductive. "There's this idea...
Friday Squid Blogging: Vampire Squid
Vampire squid eats marine wastes (paper and video). As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Stealing VM Keys from the Hardware Cache
Research into one VM stealing crypto keys from another VM running on the same hardware. ABSTRACT: This paper details the construction of an access-driven side-channel attack by which a malicious virtual machine (VM) extracts fine-grained information from a victim VM running on the same physical computer. This attack is the first such attack demonstrated on a symmetric multiprocessing system virtualized...
The Terrorist Risk of Food Trucks
This is idiotic: Public Intelligence recently posted a Powerpoint presentation from the NYC fire department (FDNY) discussing the unique safety issues mobile food trucks present. Along with some actual concerns (many food trucks use propane and/or gasoline-powered generators to cook; some *gasp* aren't properly licensed food vendors), the presenter decided to toss in some DHS speculation on yet another way...
Webmail as Dead Drop
I noticed this amongst the details of the Petraeus scandal: Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email traffic, one of the law enforcement officials said. Rather than transmitting emails to the other's inbox, they composed at least some messages and instead of transmitting them, left them in a draft folder...
Keys to the Crown Jewels Stolen?
At least, that's the story: The locks at the Tower of London, home to the Crown Jewels, had to be changed after a burglar broke in and stole keys. The intruder scaled gates and took the keys from a sentry post. Guards spotted him but couldn't give chase as they are not allowed to leave their posts. But the story...
Free Online Cryptography Course
Dan Boneh of Stanford University is offering a free online cryptography course. The course runs for six weeks, and has five to seven hours of coursework per week. It just started last week....
Fairy Wren Passwords
Mother fairy wrens teach their children passwords while they're still in their eggs to tell them from cuckoo impostors: She kept 15 nests under constant audio surveillance, and discovered that fairy-wrens call to their unhatched chicks, using a two-second trill with 19 separate elements to it. They call once every four minutes while sitting on their eggs, starting on the...
Encryption in Cloud Computing
This article makes the important argument that encryption -- where the user and not the cloud provider holds the keys -- is critical to protect cloud data. The problem is, it upsets cloud providers' business models: In part it is because encryption with customer controlled keys is inconsistent with portions of their business model. This architecture limits a cloud provider's...
Friday Squid Blogging: Squid Ink as a Condiment
Burger King introduces a black burger with ketchup that includes squid ink. Only in Japan, of course....
How To Tell if Your Hotel Guest Is a Terrorist
From the Department of Homeland Security, a handy list of 19 suspicious behaviors that could indicate that a hotel guest is actually a terrorist. I myself have done several of these. More generally, this is another example of why all the "see something say something" campaigns fail: "If you ask amateurs to act as front-line security personnel, you shouldn't be...
How Terrorist Groups Disband
Interesting research from RAND: Abstract: How do terrorist groups end? The evidence since 1968 indicates that terrorist groups rarely cease to exist as a result of winning or losing a military campaign. Rather, most groups end because of operations carried out by local police or intelligence agencies or because they join the political process. This suggests that the United States...
Gary McGraw on National Cybersecurity
Good essay, making the point that cyberattack and counterattack aren't very useful -- actual cyberdefense is what's wanted. Creating a cyber-rock is cheap. Buying a cyber-rock is even cheaper since zero-day attacks exist on the open market for sale to the highest bidder. In fact, if the bad guy is willing to invest time rather than dollars and become an...
Micromorts
Here's a great concept: a micromort: Shopping for coffee you would not ask for 0.00025 tons (unless you were naturally irritating), you would ask for 250 grams. In the same way, talking about a 1/125,000 or 0.000008 risk of death associated with a hang-gliding flight is rather awkward. With that in mind. Howard coined the term "microprobability" (¼p) to refer...
New SSL Vulnerability
It's hard for me to get too worked up about this vulnerability: Many popular applications, HTTP(S) and WebSocket transport libraries, and SOAP and REST Web-services middleware use SSL/TLS libraries incorrectly, breaking or disabling certificate validation. Their SSL and TLS connections are not authenticated, thus they -- and any software using them -- are completely insecure against a man-in-the-middle attacker. Great...
Regulation as a Prisoner's Dilemma
This is the sort of thing I wrote about in my latest book. The Prisoners Dilemma as outlined above can be seen in action in two variants within regulatory activities, and offers a clear insight into why those involved in regulation act as they do. The first relationship is that between the various people and organisations being regulated banks,...
Three-Rotor Enigma Machine Up for Auction
Expensive, but it's in complete working order. They're also auctioning off a complete set of rotors; those are even rarer than the machines -- which are often missing their rotors....
Wanted: RSA Exhibitor for Book Signing
Is anyone out there interested in buying a pile of copies of my Liars and Outliers for a giveaway and book signing at the RSA Conference? I can guarantee enormous crowds at your booth for as long as there are books to give away. This could also work for an after-hours event. Please let me know. I can get you...
New Vulnerability Against Industrial Control Systems
It doesn't look good. These are often called SCADA vulnerabilities, although it isn't SCADA that's involved here. They're against programmable logic controllers (PLCs): the same industrial controllers that Stuxnet attacked....
New Jersey Allows Voting by E-Mail
I'm not filled with confidence, but this seems like the best of a bunch of bad alternatives....
New WWII Cryptanalysis
I'd sure like to know more about this: Government code-breakers are working on deciphering a message that has remained a secret for 70 years. It was found on the remains of a carrier pigeon that was discovered in a chimney, in Surrey, having been there for decades. It is thought the contents of the note, once decoded, could provide fresh...
On the Ineffectiveness of Airport Security Pat-Downs
I've written about it before, but not half as well as this story: "That search was absolutely useless." I said. "And just shows how much of all of this is security theatre. You guys are just feeling up passengers for no good effect, which means that you get all the downsides of a search -- such as annoyed travellers who...
Loopholes
Interesting This American Life show on loopholes. The first part is about getting around the Church's ban against suicide. The second part is about an interesting insurance scheme....
Peter Neumann Profile
Really nice profile in the New York Times. It includes a discussion of the Clean Slate program: Run by Dr. Howard Shrobe, an M.I.T. computer scientist who is now a Darpa program manager, the effort began with a premise: If the computer industry got a do-over, what should it do differently? The program includes two separate but related efforts: Crash,...
Doping in Professional Sports
I updated a 2006 essay of mine on the security issues around sports doping....
Dan Ariely on Dishonesty
Good talk, and I've always liked these animators....
Detecting Fake Hurricane Photographs
A short tutorial here. Actually, it's good advice even if there weren't a hurricane....
Protecting (and Collecting) the DNA of World Leaders
There's a lot of hype and hyperbole in this story, but here's the interesting bit: According to Ronald Kessler, the author of the 2009 book In the Presidents Secret Service, Navy stewards gather bedsheets, drinking glasses, and other objects the president has touchedthey are later sanitized or destroyedin an effort to keep would be malefactors from obtaining his genetic material....
Friday Squid Blogging: Squid from the Power Ranger Universe
Ika Origami....
Hacking TSA PreCheck
I have a hard time getting worked up about this story: I have X'd out any information that you could use to change my reservation. But it's all there, PNR, seat assignment, flight number, name, ect. But what is interesting is the bolded three on the end. This is the TSA Pre-Check information. The number means the number of beeps....
The Risks of Trusting Experts
I'm not sure what to think about this story: Six Italian scientists and an ex-government official have been sentenced to six years in prison over the 2009 deadly earthquake in L'Aquila. A regional court found them guilty of multiple manslaughter. Prosecutors said the defendants gave a falsely reassuring statement before the quake, while the defence maintained there was no way...
Risks of Data Portability
Peter Swire and Yianni Lagos have pre-published a law journal article on the risks of data portability. It specifically addresses an EU data protection regulation, but the security discussion is more general. ...Article 18 poses serious risks to a long-established E.U. fundamental right of data protection, the right to security of a person's data. Previous access requests by individuals were...
Camera Jammer that Protects Licence Plates
noPhoto reacts to a camera flash, and then jams the image with a bright light. The website makes the point that this is legal, but that can't last....
Friday Squid Blogging: Squid Insurance
This was once a real insurance product. Squid Insurance Marketing was the low-end offering at Astonish, complete with the tagline "Nothing Kills a Squid!" As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Stoking Cyber Fears
A lot of the debate around President Obama's cubsersecurity initiative center on how much of a burden it would be on industry, and how that should be financed. As important as that debate is, it obscures some of the larger issues surrounding cyberwar, cyberterrorism, and cybersecurity in general. It's difficult to have any serious policy discussion amongst the fear mongering....
Analysis of How Bitcoin Is Actually Used
"Quantitative Analysis of the Full Bitcoin Transaction Graph," by Dorit Ron and Adi Shamir: Abstract. The Bitcoin scheme is a rare example of a large scale global payment system in which all the transactions are publicly accessible (but in an anonymous way). We downloaded the full history of this scheme, and analyzed many statistical properties of its associated transaction graph....
Genetic Privacy
New report from the Presidential Commission for the Study of Biothethical Issues. It's called "Privacy and Progress in Whole Genome Sequencing." The Commission described the rapid advances underway in the field of genome sequencing, but also noted growing concerns about privacy and security. The report lists twelve recommendations to improve current practices and to help safeguard privacy and security, including...
Studying Zero-Day Attacks
Interesting paper: "Before We Knew It: An Empirical Study of Zero-Day Attacks In The Real World," by Leyla Bilge and Tudor Dumitras: Abstract: Little is known about the duration and prevalence of zeroday attacks, which exploit vulnerabilities that have not been disclosed publicly. Knowledge of new vulnerabilities gives cyber criminals a free pass to attack any target of their choosing,...
Apple Turns on iPhone Tracking in iOS6
This is important: Previously, Apple had all but disabled tracking of iPhone users by advertisers when it stopped app developers from utilizing Apple mobile device data via UDID, the unique, permanent, non-deletable serial number that previously identified every Apple device. For the last few months, iPhone users have enjoyed an unusual environment in which advertisers have been largely unable to...
Master Keys
Earlier this month, a retired New York City locksmith was selling a set of "master keys" on eBay: Three of the five are standard issue for members of the FDNY, and the set had a metal dog tag that was embossed with an FDNY lieutenant's shield number, 6896. The keys include the all-purpose "1620," a master firefighter key that with...
Another Liars and Outliers Review
I was reviewed in Science: Thus it helps to have a lucid and informative account such as Bruce Schneier's Liars and Outliers. The book provides an interesting and entertaining summary of the state of play of research on human social behavior, with a special emphasis on trust and trustworthiness. [...] Free from preoccupations and personal attachments to any of the...
Friday Squid Blogging: Squid Car
A squid art car. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
"Ask Nicely" Doesn't Work as a Security Mechanism
Apple's map application shows more of Taiwan than Google Maps: The Taiwanese government/military, like many others around the world, requests that satellite imagery providers, such as Google Maps, blur out certain sensitive military installations. Unfortunately, Apple apparently didn't get that memo. [...] According to reports the Taiwanese defence ministry hasn't filed a formal request with Apple yet but thought it...
The Insecurity of Networks
Not computer networks, networks in general: Findings so far suggest that networks of networks pose risks of catastrophic danger that can exceed the risks in isolated systems. A seemingly benign disruption can generate rippling negative effects. Those effects can cost millions of dollars, or even billions, when stock markets crash, half of India loses power or an Icelandic volcano spews...
Story of a CIA Burglar
This is a fascinating story of a CIA burglar, who worked for the CIA until he tried to work against the CIA. The fact that he stole code books and keys from foreign embassies makes it extra interesting, and the complete disregard for the Constitution at the end makes it extra scary....
New Developments in Captchas
In the never-ending arms race between systems to prove that you're a human and computers that can fake it, here's a captcha that tests whether you have human feelings. Instead of your run-of-the-mill alphanumeric gibberish, or random selection of words, the Civil Rights Captcha presents you with a short blurb about a Civil Rights violation and asks you how you...
Friday Squid Blogging: Giant Squid Engraving from the 1870s
Neat book illustration. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
When Will We See Collisions for SHA-1?
On a NIST-sponsored hash function mailing list, Jesse Walker (from Intel; also a member of the Skein team) did some back-of-the-envelope calculations to estimate how long it will be before we see a practical collision attack against SHA-1. I'm reprinting his analysis here, so it reaches a broader audience. According to E-BASH, the cost of one block of a SHA-1...
Maps Showing Spread of ZeroAccess Botnet
The folks at F-Secure have plotted ZeroAccess infections across the U.S. and across Europe. It's interesting to see, but I'm curious to see the data normalized to the number of computers on the Internet....
Authentication Stories
Anecdotes from Asia on seals versus signatures on official documents....
Keccak is SHA-3
NIST has just announced that Keccak has been selected as SHA-3. It's a fine choice. I'm glad that SHA-3 is nothing like the SHA-2 family; something completely different is good. Congratulations to the Keccak team. Congratulations -- and thank you -- to NIST for running a very professional, interesting, and enjoyable competition. The process has increased our understanding about the...
2013 U.S. Homeland Security Budget
Among other findings in this CBO report: Funding for homeland security has dropped somewhat from its 2009 peak of $76 billion, in inflation-adjusted terms; funding for 2012 totaled $68 billion. Nevertheless, the nation is now spending substantially more than what it spent on homeland security in 2001. Note that this is just direct spending on homeland security. This does not...
Scary iPhone Malware Story
This story sounds pretty scary: Developed by Robert Templeman at the Naval Surface Warfare Center in Indiana and a few buddies from Indiana University, PlaceRader hijacks your phone's camera and takes a series of secret photographs, recording the time, and the phone's orientation and location with each shot. Using that information, it can reliably build a 3D model of your...
NPR on Biometric Data Collection
Interesting Talk of the Nation segment....
Replacing Alice and Bob
A proposal to replace cryptography's Alice and Bob with Sita and Rama: Any book on cryptography invariably involves the characters Alice and Bob. It is always Alice who wants to send a message to Bob. This article replaces the dramatis personnae of cryptography with characters drawn from Hindu mythology....
Using Agent-Based Simulations to Evaluate Security Systems
Kay Hamacher and Stefan Katzenbeisser, "Public Security: Simulations Need to Replace Conventional Wisdom," New Security Paradigms Workshop, 2011. Abstract: Is more always better? Is conventional wisdom always the right guideline in the development of security policies that have large opportunity costs? Is the evaluation of security measures after their introduction the best way? In the past, these questions were frequently...
Quantum Cryptography
Long article on quantum cryptography and cryptanalysis....
Security Vulnerability in Windows 8 Unified Extensible Firmware Interface (UEFI)
This is the first one discovered, I think....
SHA-3 to Be Announced
NIST is about to announce the new hash algorithm that will become SHA-3. This is the result of a six-year competition, and my own Skein is one of the five remaining finalists (out of an initial 64). It's probably too late for me to affect the final decision, but I am hoping for "no award." It's not that the new...
Friday Squid Blogging: Beached Firefly Squid
Pretty photo of firefly squid beached along a coast. I've written about firefly squid before. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Another Review of Liars and Outliers
I usually don't post reviews of Liars and Outliers -- they're all here -- but I am particularly proud of this one....
Accountable Algorithms
Ed Felten has two posts about accountable algorithms. Good stuff....
The NSA and the Risk of Off-the-Shelf Devices
Interesting article on how the NSA is approaching risk in the era of cool consumer devices. There's a discussion of the president's network-disabled iPad, and the classified cell phone that flopped because it took so long to develop and was so clunky. Turns out that everyone wants to use iPhones. Levine concluded, "Using commercial devices to process classified phone calls,...
Analysis of PIN Data
An analysis of 3.4 million four-digit PINs. ("1234" is the most common: 10.7% of all PINs. The top 20 PINs are 26.8% of the total. "8068" is the least common PIN -- that'll probably change now that the fact is published.)...
Recent Developments in Password Cracking
A recent Ars Technica article made the point that password crackers are getting better, and therefore passwords are getting weaker. It's not just computing speed; we now have many databases of actual passwords we can use to create dictionaries of common passwords, or common password-generation techniques. (Example: dictionary word plus a single digit.) This really isn't anything new. I wrote...
Friday Squid Blogging: Octonaut
A space-traveling squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Diamond Swallowing as a Ruse
It's a known theft tactic to swallow what you're stealing. It works for food at the supermarket, and it also can work for diamonds. Here's a twist on that tactic: Police say he could have swallowed the stone in an attempt to distract the diamond's owner, Suresh de Silva, while his accomplice stole the real gem. Mr de Silva told...
Friday Squid Blogging: Giant Squid Museum
In Valdés, Spain. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Schneier on Security on Elementary
Two of my books can be seen in the background in CBS' new Sherlock Holmes drama, Elementary. A copy of Schneier on Security is prominently displayed on Sherlock Holmes' bookshelf. You can see it in the first few minutes of the pilot episode. The show's producers contacted me early on to ask permission to use my books, so it didn't...
Man-in-the-Middle Bank Fraud Attack
This sort of attack will become more common as banks require two-factor authentication: Tatanga checks the user account details including the number of accounts, supported currency, balance/limit details. It then chooses the account from which it could steal the highest amount. Next, it initiates a transfer. At this point Tatanga uses a Web Inject to trick the user into believing...
Estimating the Probability of Another 9/11
This statistical research says once per decade: Abstract: Quantities with right-skewed distributions are ubiquitous in complex social systems, including political conflict, economics and social networks, and these systems sometimes produce extremely large events. For instance, the 9/11 terrorist events produced nearly 3000 fatalities, nearly six times more than the next largest event. But, was this enormous loss of life statistically...
Steganography in the Wild
Steganographic information is embedded in World of Warcraft screen shots....
Stopping Terrorism
Nice essay on the futility of trying to prevent another 9/11: "Never again." It is as simplistic as it is absurd. It is as vague as it is damaging. No two words have provided so little meaning or context; no catchphrase has so warped policy discussions that it has permanently confused the public's understanding of homeland security. It convinced us...
A Real Movie-Plot Threat Contest
The "Australia's Security Nightmares: The National Security Short Story Competition" is part of Safeguarding Australia 2012. To aid the national security community in imagining contemporary threats, the Australian Security Research Centre (ASRC) is organising Australia's Security Nightmares: The National Security Short Story Competition. The competition aims to produce a set of short stories that will contribute to a better conception...
New Attack Against Chip-and-Pin Systems
Well, new to us: You see, an EMV payment card authenticates itself with a MAC of transaction data, for which the freshly generated component is the unpredictable number (UN). If you can predict it, you can record everything you need from momentary access to a chip card to play it back and impersonate the card at a future date and...
Security at the 9/11 WTC Memorial
There's a lot: Advance tickets are required to enter this public, outdoor memorial. To book them, youre obliged to provide your home address, email address, and phone number, and the full names of everyone in your party. It is strongly recommended that you print your tickets at home, which is where you must leave explosives, large bags, hand soap, glass...
Another Stuxnet Post
Larry Constantine disputes David Stanger's book about Stuxnet: So, what did he get wrong? First of all, the Stuxnet worm did not escape into the wild. The analysis of initial infections and propagations by Symantec show that, in fact, that it never was widespread, that it affected computers in closely connected clusters, all of which involved collaborators or companies that...
Friday Squid Blogging: Controlling Squid Chromatophores with Music
Wacky. Other stories about the story. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Hacking Marathon Races
Truly bizarre story of someone who seems to have figured out how to successfully cheat at marathons. The evidence of his cheating is overwhelming, but no one knows how he does it....
CSOs/CISOs Wanted: Cloud Security Questions
I'm trying to separate cloud security hype from reality. To that end, I'd like to talk to a few big corporate CSOs or CISOs about their cloud security worries, requirements, etc. If you're willing to talk, please contact me via e-mail. Eventually I will share the results of this inquiry. Thank you....
Database of 12 Million Apple UDIDs Haked
In this story, we learn that hackers got their hands on a database of 12 million Apple Apple Unique Device Identifiers (UDIDs) by hacking an FBI laptop. When I first read the story, my questions were not about the hack but about the data. Why does an FBI agent have user identification information about 12 million iPhone users on his...
Wall Street Journal Review of Liars and Outliers
Liars and Outliers (along with two other books: Kip Hawley's memoir of his time at the TSA and Against Security, by Harvey Molotch) has been reviewed in the Wall Street Journal....
Hacking Brain-Computer Interfaces
In this fascinating piece of research, the question is asked: can we surreptitiously collect secret information from the brains of people using brain-computer interface devices? One article: A team of security researchers from Oxford, UC Berkeley, and the University of Geneva say that they were able to deduce digits of PIN numbers, birth months, areas of residence and other personal...
Eye Twitch Patterns as a Biometric
Yet another biometric: eye twitch patterns: ...a person's saccades, their tiny, but rapid, involuntary eye movements, can be measured using a video camera. The pattern of saccades is as unique as an iris or fingerprint scan but easier to record and so could provide an alternative secure biometric identification technology. Probably harder to fool than iris scanners....
Friday Squid Blogging: "The Seasick Squid"
A fable. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Conversation about Liars and Outliers on The WELL
I'm on The WELL right now -- for the next week or so -- discussing my new book with anyone who wants to participate. I'm also at Dragon*Con this weekend in Atlanta....
The Psychological Effects of Terrorism
Shelly C. McArdle, Heather Rosoff, Richard S. John (2012), "The Dynamics of Evolving Beliefs, Concerns Emotions, and Behavioral Avoidance Following 9/11: A Longitudinal Analysis of Representative Archival Samples," Risk Analysis v. 32, pp. 744761. Abstract: September 11 created a natural experiment that enables us to track the psychological effects of a large-scale terror event over time. The archival data came...
Shared Lock
A reader sent me this photo of a shared lock. It's at the gate of a large ranch outside of Victoria, Texas. Multiple padlocks secure the device, but when a single padlock is removed, the center pin can be fully lifted and the gate can be opened. The point is to allow multiple entities (oil and gas, hunting parties, ranch...
The Importance of Security Engineering
In May, neuroscientist and popular author Sam Harris and I debated the issue of profiling Muslims at airport security. We each wrote essays, then went back and forth on the issue. I don't recommend reading the entire discussion; we spent 14,000 words talking past each other. But what's interesting is how our debate illustrates the differences between a security engineer...
Friday Squid Blogging: Squid Sacrifices Arms to Avoid Predators
The squid Octopoteuthis deletron will drop portions of an arm to escape from a predator. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Internet Safety Talking Points for Schools
A surprisingly sensible list. E. Why are you penalizing the 95% for the 5%? You don't do this in other areas of discipline at school. Even though you know some students will use their voices or bodies inappropriately in school, you don't ban everyone from speaking or moving. You know some students may show up drunk to the prom, yet...
Fear and How it Scales
Nice post: The screaming fear in your stomach before you give a speech to 12 kids in the fifth grade is precisely the same fear a presidential candidate feels before the final debate. The fight-or-flight reflex that speeds up your heart when you're about to get a speeding ticket you don't deserve isn't very different than the chemical reaction in...
Exaggerating Cybercrime
Finally, someone takes a look at the $1 trillion number government officials are quoting as the cost of cybercrime. While it's a good figure to scare people, it doesn't have much of a basis in reality....
Video Filter that Detects a Pulse
Fascinating. How long before someone claims he can use this technology to detect nervous people in airports?...
Five "Neglects" in Risk Management
Good list, summarized here: 1. Probability neglect people sometimes dont consider the probability of the occurrence of an outcome, but focus on the consequences only. 2. Consequence neglect just like probability neglect, sometimes individuals neglect the magnitude of outcomes. 3. Statistical neglect instead of subjectively assessing small probabilities and continuously updating them, people choose to use rules-of-thumb...
Poll: Americans Like the TSA
Gallup has the results: Despite recent negative press, a majority of Americans, 54%, think the U.S. Transportation Security Administration is doing either an excellent or a good job of handling security screening at airports. At the same time, 41% think TSA screening procedures are extremely or very effective at preventing acts of terrorism on U.S. airplanes, with most of the...
Is iPhone Security Really this Good?
Simson Garfinkel writes that the iPhone has such good security that the police can't use it for forensics anymore: Technologies the company has adopted protect Apple customers' content so well that in many situations it's impossible for law enforcement to perform forensic examinations of devices seized from criminals. Most significant is the increasing use of encryption, which is beginning to...
Help Cryptanalyze Gauss
Kaspersky is looking for help decrypting the Gauss payload....
Passive Sensor that Sees Through Walls
A new technology uses the radiation given off by wi-fi devices to sense the positions of people through a one-foot-thick brick wall....
The View from an Israeli Security Checkpoint
This is an extraordinary (and gut-wrenching) first-person account of what it's like to staff an Israeli security checkpoint. It shows how power corrupts: how it's impossible to make humane decisions in such a circumstance....
Friday Squid Blogging: Efforts to Film a Live Giant Squid
Japanese researchers are attempting to film the elusive giant squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
$200 for a Fake Security System
This is pretty funny: Moving red laser beams scare away potential intruders Laser beams move along floor and wall 180 degrees Easy to install, 110v comes on automatically w/timer Watch the video. This is not an alarm, and it doesn't do anything other than the laser light show. But, as the product advertisement says, "perception can be an excellent deterrent...
Rudyard Kipling on Societal Pressures
In the short story "A Wayside Comedy," published in 1888 in Under the Deodars, Kipling wrote: You must remember, though you will not understand, that all laws weaken in a small and hidden community where there is no public opinion. When a man is absolutely alone in a Station he runs a certain risk of falling into evil ways. This...
An Analysis of Apple's FileVault 2
This is an analysis of Apple's disk encryption program, FileVault 2, that first appeared in the Lion operating system. Short summary: they couldn't break it. (Presumably, the version in Mountain Lion isn't any different.)...
Lousy Password Security on Tesco Website
Good post, not because it picks on Tesco but because it's filled with good advice on how not to do it wrong....
Sexual Harassment at DefCon (and Other Hacker Cons)
Excellent blog post by Valerie Aurora about sexual harassment at the DefCon hackers conference. Aside from the fact that this is utterly reprehensible behavior by the perpetrators involved, this is a real problem for our community. The response of "this is just what hacker culture is, and changing it will destroy hackerdom" is just plain wrong. When swaths of the...
Liars and Outliers on Special Discount
Liars and Outliers has been out since late February, and while it's selling great, I'd like it to sell better. So I have a special offer for my regular readers. People in the U.S. can buy a signed copy of the book for $11, Media Mail postage included. (Yes, I'm selling the book at a loss.) People in other countries...
Schneier in the News
Here are links to three news articles about me, and two video interviews with me....
Measuring Cooperation and Defection using Shipwreck Data
In Liars and Outliers, I talk a lot about social norms and when people follow them. This research uses survival data from shipwrecks to measure it. The authors argue that shipwrecks can actually tell us a fair bit about human behavior, since everyone stuck on a sinking ship has to do a bit of cost-benefit analysis. People will weigh their...
Cryptocat
I'm late writing about this one. Cryptocat is a web-based encrypted chat application. After Wired published a pretty fluffy profile on the program and its author, security researcher Chris Soghoian wrote an essay criticizing the unskeptical coverage. Ryan Singal, the editor (not the writer) of the Wired piece, responded by defending the original article and attacking Soghoian. At this point,...
Preventive vs. Reactive Security
This is kind of a rambling essay on the need to spend more on infrastructure, but I was struck by this paragraph: Here's a news flash: There are some events that no society can afford to be prepared for to the extent that we have come to expect. Some quite natural events -- hurricanes, earthquakes, tsunamis, derechos -- have such...
U.S. and China Talking About Cyberweapons
Stuart Baker calls them "proxy talks" because they're not government to government, but it's a start....
Friday Squid Blogging: Dumpling Squid
The sex life of the dumpling squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Termite Suicide Bombers
Some termites blow themselves up to expel invaders from their nest....
11-Year-Old Bypasses Airport Security
Sure, stories like this are great fun, but I don't think it's much of a security concern. Terrorists can't build a plot around random occasional security failures....
Rolling Stone Magazine Writes About Computer Security
It's a virus that plays AC/DC, so it makes sense. Surreal, though. Another article....
Detecting Spoofed GPS Signals
This is the latest in the arms race between spoofing GPS signals and detecting spoofed GPS signals. Unfortunately, the countermeasures all seem to be patent pending....
Chinese Gang Sells Fake Professional Certifications
They were able to hack into government websites: The gangs USP, and the reason it could charge up to 10,000 yuan (£1,000) per certificate, was that it could hack the relevant government site and tamper with the back-end database to ensure that the fake certs name and registration number appeared legitimate. The gang made £30M before being arrested....
Yet Another Risk of Storing Everything in the Cloud
A hacker can social-engineer his way into your cloud storageand delete everything you have. It turns out, a billing address and the last four digits of a credit card number are the only two pieces of information anyone needs to get into your iCloud account. Once supplied, Apple will issue a temporary password, and that password grants access to iCloud....
Peter Swire Testifies on the Inadequacy of Privacy Self-Regulation
Ohio State University Law Professor Peter Swire testifies before Congress on the inadequacy of industry self-regulation to protect privacy....
Verifying Elections Using Risk-Limiting Auditing
Interesting article on using risk-limiting auditing in determining if an election's results are likely to be valid. The risk, in this case, is in the chance of a false negative, and the election being deemed valid. The risk level determines the extent of the audit....
Breaking Microsoft's PPTP Protocol
Some things never change. Thirteen years ago, Mudge and I published a paper breaking Microsoft's PPTP protocol and the MS-CHAP authentication system. I haven't been paying attention, but I presume it's been fixed and improved over the years. Well, it's been broken again. ChapCrack can take captured network traffic that contains a MS-CHAPv2 network handshake (PPTP VPN or WPA2 Enterprise...
State-by-State Report on Electronic Voting
The Verified Voting Foundation has released a comprehensive state-by-state report on electronic voting machines (report, executive summary, and news coverage). Let's hope it does some good....
Friday Squid Blogging: SQUIDS and Quantum Computing
It seems that quantum computers might use superconducting quantum interference devices (SQUIDs). As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Unsafe Safes
In a long article about insecurities in gun safes, there's this great paragraph: Unfortunately, manufacturers and consumers are deceived and misled into a false sense of security by electronic credentials, codes, and biometrics. We have seen this often, even with high security locks. Our rule: electrons do not open doors; mechanical components do. If you can compromise the mechanisms then...
Overreaction and Overly Specific Reactions to Rare Risks
Horrific events, such as the massacre in Aurora, can be catalysts for social and political change. Sometimes it seems that they're the only catalyst; recall how drastically our policies toward terrorism changed after 9/11 despite how moribund they were before. The problem is that fear can cloud our reasoning, causing us to overreact and to overly focus on the specifics....
Court Orders TSA to Answer EPIC
Year ago, EPIC sued the TSA over full body scanners (I was one of the plantiffs), demanding that they follow their own rules and ask for public comment. The court agreed, and ordered the TSA to do that. In response, the TSA has done nothing. Now, a year later, the court has again ordered the TSA to answer EPIC's position....
Hotel Door Lock Vulnerability
The attack only works sometimes, but it does allow access to millions of hotel rooms worldwide that are secured by Onity brand locks. Basically, you can read the unit's key out of the power port on the bottom of the lock, and then feed it back to the lock to authenticate an open command using the same power port....
Profile on Eugene Kaspersky
Wired has an interesting and comprehensive profile on Eugene Kaspersky. Especially note Kaspersky Lab's work to uncover US cyberespionage against Iran, Kaspersky's relationship with Russia's state security services, and the story of the kidnapping of Kaspersky's son, Ivan. Kaspersky responded (not kindly) to the article, and the author responded to the response....
Lone Shooters and Body Armor
The new thing about the Aurora shooting wasn't the weaponry, but the armor: What distinguished Holmes wasn't his offense. It was his defense. At Columbine, Harris and Klebold did their damage in T-shirts and cargo pants. Cho and Loughner wore sweatshirts. Hasan was gunned down in his Army uniform. Holmes' outfit blew these jokers away. He wore a ballistic helmet,...
Fake Irises Fool Scanners
We already know you can wear fake irises to fool a scanner into thinking you're not you, but this is the first fake iris you can use for impersonation: to fool a scanner into thinking you're someone else....
Hacking Tool Disguised as a Power Strip
This is impressive: The device has Bluetooth and Wi-Fi adapters, a cellular connection, dual Ethernet ports, and hacking and remote access tools that let security professionals test the network and call home to be remotely controlled via the cellular network. The device comes with easy-to-use scripts that cause it to boot up and then phone home for instructions. A "text-to-bash"...
Fear-Mongering at TED
This TED talk trots out the usual fear-mongering that technology leads to terrorism. The facts are basically correct, but there are no counterbalancing facts, and the conclusions all one-sided. I'm not impressed with the speaker's crowdsourcing solution, either. Sure, crowdsourcing is a great tool for a lot of problems, but it's not the single thing that's going to protect us...
Detroit Bomb Threats
There have been a few hoax bomb threats in Detroit recently (Windsor tunnel, US-Canada bridge, Tiger Stadium). The good news is that police learned; during the third one, they didn't close down the threatened location....
Friday Squid Blogging: Tentacle Doorstop
Now this is neat. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Liars and Outliers Summed Up in Two Comic Strips
I don't know the context, but these strips sum up my latest book nicely....
Criminals Using Commercial Spamflooding Services
Cybercriminals are using commercial spamflooding services to distract their victims during key moments of a cyberattack. Clever, but in retrospect kind of obvious....
Police Sting Operation Yields No Mobile Phone Thefts
Police in Hastings, in the UK, outfitted mobile phones with tracking devices and left them in bars and restaurants, hoping to catch mobile phone thieves in the act. But no one stole them: Nine premises were visited in total and officers were delighted that not one of the bait phones was 'stolen'. In fact, on nearly every occasion good hearted...
Making Handcuff Keys with 3D Printers
Handcuffs pose a particular key management problem. Officers need to be able to unlock handcuffs locked by another officer, so they're all designed to be opened by a standard set of keys. This system only works if the bad guys can't get a copy of the key, and modern handcuff manufacturers go out of their way to make it hard...
Implicit Passwords
This is a really interesting research paper (article here) on implicit passwords: something your unconscious mind remembers but your conscious mind doesn't know. The Slashdot post is a nice summary: A cross-disciplinary team of US neuroscientists and cryptographers have developed a password/passkey system that removes the weakest link in any security system: the human user. It's ingenious: The system still...
How the Norwegians Reacted to Terrorism
An antidote to the American cycle of threat, fear, and overspending in response to terrorism is this, about Norway on the first anniversary of its terrorist massacre: And at the political level, the Prime Minister Jens Stoltenberg pledged to do everything to ensure the country's core values were not undermined. "The Norwegian response to violence is more democracy, more openness...
Friday Squid Blogging: Preserved Squid
Science or art? As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Camera-Transparent Plastic
I just wrote about the coming age of invisible surveillance. Here's another step along that process. The material is black in color and cannot be seen through with the naked eye. However, if you point a black and white camera at a sheet of Black-Ops Plastic, it becomes transparent allowing the camera to record whatever is on the other side....
Chinese Airline Rewards Crew for Resisting Hijackers
Normally, companies instruct their employees not to resist. But Hainan Airlines did the opposite: Two safety officers and the chief purser got cash and property worth 4m yuan ($628,500; £406,200) each. The rest got assets worth 2.5m yuan each. That's a lot of money, especially in China. I'm sure it will influence future decisions by crew, and even passengers, about...
Remote Scanning Technology
I don't know if this is real or fantasy: Within the next year or two, the U.S. Department of Homeland Security will instantly know everything about your body, clothes, and luggage with a new laser-based molecular scanner fired from 164 feet (50 meters) away. From traces of drugs or gun powder on your clothes to what you had for breakfast...
Friday Squid Blogging: Barbecued Squid -- New Summer Favorite
In the UK, barbecued squid is in: Sales of squid have tripled in recent months due to the growing popularity of Mediterranean food and the rise of the Dukan diet, as calamari looks set to become the barbecue hit of the summer....
Hacking BMW's Remote Keyless Entry System
It turns out to be surprisingingly easy: The owner, who posted the video at 1addicts.com, suspects the thieves broke the glass to access the BMW's on-board diagnostics port (OBD) in the footwell of the car, then used a special device to obtain the car's unique key fob digital ID and reprogram a blank key fob to start the car. It...
All-or-Nothing Access Control for Mobile Phones
This paper looks at access control for mobile phones. Basically, it's all or nothing: either you have a password that protects everything, or you have no password and protect nothing. The authors argue that there should be more user choice: some applications should be available immediately without a password, and the rest should require a password. This makes a lot...
Dropped USB Sticks in Parking Lot as Actual Attack Vector
For years, it's been a clever trick to drop USB sticks in parking lots of unsuspecting businesses, and track how many people plug them into computers. I have long argued that the problem isn't that people are plugging the sticks in, but that the computers trust them enough to run software off of them. This is the first time I've...
Petition the U.S. Government to Force the TSA to Follow the Law
This is important: In July 2011, a federal appeals court ruled that the Transportation Security Administration had to conduct a notice-and-comment rulemaking on its policy of using "Advanced Imaging Technology" for primary screening at airports. TSA was supposed to publish the policy in the Federal Register, take comments from the public, and justify its policy based on public input. The...
Cryptanalyze the Agrippa Code
William Gibson's Grippa Code is available for cryptanalysis. Break the code, win a prize....
Attacking Fences
From an article on the cocaine trade between Mexico and the U.S.: "They erect this fence," he said, "only to go out there a few days later and discover that these guys have a catapult, and they're flinging hundred-pound bales of marijuana over to the other side." He paused and looked at me for a second. "A catapult," he repeated....
Sensible Comments about Terrorism
Two, at least: "Bee stings killed as many in UK as terrorists, says watchdog." "Americans Are as Likely to Be Killed by Their Own Furniture as by Terrorism." Is this a new trend in common sense? In case you forgot, here's a comprehensive list of ridiculous predictions about terrorist attacks (and an essay). And here's the best data on U.S....
Students Hack DHS Drone
A team at the University of Texas successfully spoofed the GPS and took control of a DHS drone, for about $1,000 in off-the-shelf parts. Does anyone think that the bad guys won't be able to do this?...
Friday Squid Blogging: Dissecting a Squid
This was suprisingly interesting. When a body is mysterious, you cut it open. You peel back the skin and take stock of its guts. It is the science of an arrow, the epistemology of a list. There and here and look: You tick off organs, muscles, bones. Its belly becomes fact. It glows like fluorescent lights. The air turns aseptic...
Me on Military Cyberattacks and Cyberweapons Treaties
I did a short Q&A for Network World....
Naming Pets
Children are being warned that the name of their first pet should contain at least eight characters and a digit....
So You Want to Be a Security Expert
I regularly receive e-mail from people who want advice on how to learn more about computer security, either as a course of study in college or as an IT person considering it as a career choice. First, know that there are many subspecialties in computer security. You can be an expert in keeping systems from being hacked, or in creating...
Commercial Espionage Virus
It's designed to steal blueprints and send them to China. Note that although this is circumstantial evidence that the virus is from China, it is possible that the Chinese e-mail accounts that are collecting the blueprints are simply drops, and the controllers are elsewhere on the planet....
WEIS 2012
Last week I was at the Workshop on Economics and Information Security in Berlin. Excellent conference, as always. Ross Anderson liveblogged the event; see the comments for summaries of the talks. On the second day, Ross and I debated -- well, discussed -- cybersecurity spending. A the first WEIS, he and I had a similar discussion: I argued that we...
Friday Squid Blogging: Another Giant Squid Found
A dead 13-foot-long giant squid has been found off the coast of New South Wales. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
FireDogLake Book Salon for Liars and Outliers
Here's the permalink....
On Securing Potentially Dangerous Virology Research
Abstract: The problem of securing biological research data is a difficult and complicated one. Our ability to secure data on computers is not robust enough to ensure the security of existing data sets. Lessons from cryptography illustrate that neither secrecy measures, such as deleting technical details, nor national solutions, such as export controls, will work. --------- Science and Nature have...
Nuclear Fears
Interesting review -- by David Roepik -- of The Rise of Nuclear Fear, by Spencer Weart: Along with contributing to the birth of the environmental movement, Weart shows how fear of radiation began to undermine society's faith in science and modern technology. He writes "Polls showed that the number of Americans who felt 'a great deal' of confidence in science...
Top Secret America on the Post-9/11 Cycle of Fear and Funding
I'm reading Top Secret America: The Rise of the New American Security State, by Dana Priest and William M. Arkin. Both work for The Washington Post. The book talks about the rise of the security-industrial complex in post 9/11 America. This short quote is from Chapter 3: Such dread was a large part of the post-9/11 decade. A culture of...
Russian Nuclear Launch Code Backup Procedure
If the safe doesn't open, use a sledgehammer: The sledgehammer's existence first came to light in 1980, when a group of inspecting officers from the General Staff visiting Strategic Missile Forces headquarters asked General Georgy Novikov what he would do if he received a missile launch order but the safe containing the launch codes failed to open. Novikov said he...
E-Mail Accounts More Valuable than Bank Accounts
This informal survey produced the following result: "45% of the users found their email accounts more valuable than their bank accounts." The author believes this is evidence of some sophisticated security reasoning on the part of users: From a security standpoint, I cant agree more with these people. Email accounts are used most commonly to reset other websites account passwords,...
Resilience
There was a conference on resilience (highlights here, and complete videos here) earlier this year. Here's an interview with professor Sander van der Leeuw on the topic. Although he never mentions security, it's all about security. Any system, whether its the financial system, the environmental system, or something else, is always subject to all kinds of pressures. If it can...
Op-ed Explaining why Terrorism Doesn't Work
Good essay by Max Abrams. I've written about his research before....
Friday Squid Blogging: Giant Mutant Squid at the Queen's Jubilee
I think this is a parody, but you can never be sure. Millions of Britons turned out for the Queens four-day celebrations, undaunted by the 500-foot mutant squid that was destroying London. Huge crowds of well-wishers lined the banks of the Thames on Sunday to watch a spectacular flotilla, continuing to cheer and wave even as tentacles thicker than tree...
Colbert Report on the Orangutan Cyberthreat
Very funny video exposé of the cyberthreat posed by giving iPads to orangutans. Best part is near the end, when Richard Clarke suddenly realizes that he's being interviewed about orangutans -- and not the Chinese....
Economic Analysis of Bank Robberies
Yes, it's clever: The basic problem is the average haul from a bank job: for the three-year period, it was only £20,330.50 (~$31,613). And it gets worse, as the average robbery involved 1.6 thieves. So the authors conclude, "The return on an average bank robbery is, frankly, rubbish. It is not unimaginable wealth. It is a very modest £12,706.60 per...
Far-Fetched Scams Separate the Gullible from Everyone Else
Interesting conclusion by Cormac Herley, in this paper: "Why Do Nigerian Scammers Say They are From Nigeria?" Abstract: False positives cause many promising detection technologies to be unworkable in practice. Attackers, we show, face this problem too. In deciding who to attack true positives are targets successfully attacked, while false positives are those that are attacked but yield nothing. This...
Apple Patents Data-Poisoning
It's not a new idea, but Apple Computer has received a patent on "Techniques to pollute electronic profiling": Abstract: Techniques to pollute electronic profiling are provided. A cloned identity is created for a principal. Areas of interest are assigned to the cloned identity, where a number of the areas of interest are divergent from true interests of the principal. One...
Rand Paul Takes on the TSA
Paul Rand has introduced legislation to rein in the TSA. There are two bills: One bill would require that the mostly federalized program be turned over to private screeners and allow airports with Department of Homeland Security approval to select companies to handle the work. This seems to be a result of a fundamental misunderstanding of the economic...
Switzerland National Defense
Interesting blog post about this book about Switzerland's national defense. To make a long story short, McPhee describes two things: how Switzerland requires military service from every able-bodied male Swiss citizen -- a model later emulated and expanded by Israel -- and how the Swiss military has, in effect, wired the entire country to blow in the event of foreign...
Attack Against Point-of-Sale Terminal
Clever attack: When you pay a restaurant bill at your table using a point-of-sale machine, are you sure it's legit? In the past three months, Toronto and Peel police have discovered many that aren't. In what is the latest financial fraud, crooks are using distraction techniques to replace merchants' machines with their own, police say. At the end of the...
The Failure of Anti-Virus Companies to Catch Military Malware
Mikko Hyponnen of F-Secure attempts to explain why anti-virus companies didn't catch Stuxnet, DuQu, and Flame: When we went digging through our archive for related samples of malware, we were surprised to find that we already had samples of Flame, dating back to 2010 and 2011, that we were unaware we possessed. They had come through automated reporting mechanisms, but...
England's Prince Phillip on Security
On banning guns: "If a cricketer, for instance, suddenly decided to go into a school and batter a lot of people to death with a cricket bat,which he could do very easily, I mean, are you going to ban cricket bats?" In a Radio 4 interview shortly after the Dunblane shootings in 1996. He said to the interviewer off-air afterwards:...
Honor System Farm Stands
Many roadside farm stands in the U.S. are unmanned. They work on the honor system: take what you want, and pay what you owe. And today at his farm stand, Cochran says, just as at the donut shop years ago, most customers leave more money than they owe. That doesn't surprise social psychologist Michael Cunningham of the University of Louisville...
Friday Squid Blogging: Woman's Mouth Inseminated by Cooked Squid
This story is so freaky I'm not even sure I want to post it. But if I don't, you'll all send me the links. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
FireDogLake Book Salon for Liars and Outliers
On Sunday, I will be participating in a public discussion about my new book on the FireDogLake website. James Fallows will be the moderator, and I will be answering questions from all comers -- you do have to register an ID, though -- from 5:00 - 7:00 EDT. Stop by and join the discussion....
Rare Rational Comment on al Qaeda's Capabilities
From "CNN national security analyst" Peter Bergen: Few Americans harbor irrational fears about being killed by a lightning bolt. Abu Yahya al-Libi's death on Monday should remind them that fear of al Qaeda in its present state is even more irrational. Will anyone listen?...
Cheating in Online Classes
Interesting article: In the case of that student, the professor in the course had tried to prevent cheating by using a testing system that pulled questions at random from a bank of possibilities. The online tests could be taken anywhere and were open-book, but students had only a short window each week in which to take them, which was not...
Cyberwar Treaties
We're in the early years of a cyberwar arms race. It's expensive, it's destabilizing, and it threatens the very fabric of the Internet we use every day. Cyberwar treaties, as imperfect as they might be, are the only way to contain the threat. If you read the press and listen to government leaders, we're already in the middle of a...
Teaching the Security Mindset
In 2008 I wrote about the security mindset and how difficult it is to teach. Two professors teaching a cyberwarfare class gave an exam where they expected their students to cheat: Our variation of the Kobayashi Maru utilized a deliberately unfair exam -- write the first 100 digits of pi (3.14159...) from memory and took place in the pilot offering...
High-Quality Fake IDs from China
USA Today article: Most troubling to authorities is the sophistication of the forgeries: Digital holograms are replicated, PVC plastic identical to that found in credit cards is used, and ink appearing only under ultraviolet light is stamped onto the cards. Each of those manufacturing methods helps the IDs defeat security measures aimed at identifying forged documents. The overseas forgers are...
Israel Demanding Passwords at the Border
There have been a bunch of stories about employers demanding passwords to social networking sites, like Facebook, from prospective employees, and several states have passed laws prohibiting this practice. This is the first story I've seen of a country doing this at its borders. The country is Israel, and they're asking for passwords to e-mail accounts....
Changing Surveillance Techniques for Changed Communications Technologies
New paper by Peter P. Swire -- "From Real-Time Intercepts to Stored Records: Why Encryption Drives the Government to Seek Access to the Cloud": Abstract: This paper explains how changing technology, especially the rising adoption of encryption, is shifting law enforcement and national security lawful access to far greater emphasis on stored records, notably records stored in the cloud. The...
Friday Squid Blogging: Baby Opalescent Squid
Baby squid larvae are transparent after they hatch, so you can see the chromataphores (color control mechanisms) developing after a few days. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
The Catastrophic Consequences of 9/11
This is an interesting essay -- it claims to be the first in a series -- that looks at the rise of "homeland security" as a catastrophic consequence of the 9/11 terrorist attacks: In this usage catastrophic is not a pejorative, it is a description of an atypically radical shift in perception and behavior from one condition to another very...
Homeland Security as Security Theater Metaphor
Look at the last sentence in this article on hotel cleanliness: "I relate this to homeland security. We are not any safer, but many people believe that we are," he said. It's interesting to see the waste-of-money meme used so cavalierly....
Ghostery
Ghostery is a Firefox plug-in that tracks who is tracking your browsing habits in cyberspace. Here's a TED talk by Gary Kovacs, the CEO of Mozilla Corp., on it. I use AdBlock Plus, and dump my cookies whenever I close Firefox. Should I switch to Ghostery? What do other people do for web privacy?...
Security and Human Behavior (SHB 2012)
I'm at the Fifth Interdisciplinary Workshop on Security and Human Behavior, SHB 2012. Google is hosting this year, at its offices in lower Manhattan. SHB is an invitational gathering of psychologists, computer security researchers, behavioral economists, sociologists, law professors, business school professors, political scientists, anthropologists, philosophers, and others -- all of whom are studying the human side of security --...
Interesting Article on Libyan Internet Intelligence Gathering
This is worth reading, for the insights it provides on how a country goes about monitoring its citizens in the information age: a combination of targeted attacks and wholesale surveillance. I'll just quote one bit, this list of Western companies that helped: Amesys, with its Eagle system, was just one of Libya's partners in repression. A South African firm called...
The Unreliability of Eyewitness Testimony
Interesting article: The reliability of witness testimony is a vastly complex subject, but legal scholars and forensic psychologists say it's possible to extract the truth from contradictory accounts and evolving memories. According to Barbara Tversky, professor emerita of psychology at Stanford University, the bottom line is this: "All other things equal, earlier recountings are more likely to be accurate than...
Flame
Flame seems to be another military-grade cyber-weapon, this one optimized for espionage. The worm is at least two years old, and is mainly confined to computers in the Middle East. (It does not replicate and spread automatically, which is certainly so that its controllers can target it better and evade detection longer.) And its espionage capabilities are pretty impressive. We'll...
Friday Squid Blogging: Mimicking Squid Camouflage
Interesting: Cephalopods - squid, cuttlefish and octopuses - change colour by using tiny muscles in their skins to stretch out small sacs of black colouration. These sacs are located in the animal's skin cells, and when a cell is ready to change colour, the brain sends a signal to the muscles and they contract. This makes the sacs expand and...
Obama's Role in Stuxnet and Iranian Cyberattacks
Really interesting article....
The Vulnerabilities Market and the Future of Security
Recently, there have been several articles about the new market in zero-day exploits: new and unpatched computer vulnerabilities. It's not just software companies, who sometimes pay bounties to researchers who alert them of security vulnerabilities so they can fix them. And it's not only criminal organizations, who pay for vulnerabilities they can exploit. Now there are governments, and companies who...
Tax Return Identity Theft
I wrote about this sort of thing in 2006 in the UK, but it's even bigger business here: The criminals, some of them former drug dealers, outwit the Internal Revenue Service by filing a return before the legitimate taxpayer files. Then the criminals receive the refund, sometimes by check but more often though a convenient but hard-to-trace prepaid debit card....
Bar Code Switching
A particularly clever form of retail theft -- especially when salesclerks are working fast and don't know the products -- is to switch bar codes. This particular thief stole Lego sets. If you know Lego, you know there's a vast price difference between the small sets and the large ones. He was caught by in-store surveillance....
The Psychology of Immoral (and Illegal) Behavior
When I talk about Liars and Outliers to security audiences, one of the things I stress is our traditional security focus -- on technical countermeasures -- is much narrower than it could be. Leveraging moral, repetitional, and institutional pressures are likely to be much more effective in motivating cooperative behavior. This story illustrates the point. It's about the psychology of...
The Problem of False Alarms
The context is tornado warnings: The basic problem, Smith says, it that sirens are sounded too often in most places. Sometimes they sound in an entire county for a warning that covers just a sliver of it; sometimes for other thunderstorm phenomena like large hail and/or strong straight-line winds; and sometimes for false alarm warnings warnings for tornadoes that...
Backdoor Found in Chinese-Made Military Silicon Chips
We all knew this was possible, but researchers have found the exploit in the wild: Claims were made by the intelligence agencies around the world, from MI5, NSA and IARPA, that silicon chips could be infected. We developed breakthrough silicon chip scanning technology to investigate these claims. We chose an American military chip that is highly secure with sophisticated encryption...
Interview with a Safecracker
The legal kind. It's interesting: Q: How realistic are movies that show people breaking into vaults? A: Not very! In the movies it takes five minutes of razzle-dazzle; in real life it's usually at least a couple of hours of precision work for an easy, lost combination lockout. [...] Q: Have you ever met a lock you couldn't pick? A:...
My Last Post About Ethnic Profiling at Airports
Remember my rebuttal of Sam Harris's essay advocating the profiling of Muslims at airports? That wasn't the end of it. Harris and I conducted a back-and-forth e-mail discussion, the results of which are here. At 14,000+ words, I only recommend it for the most stalwort of readers....
Friday Squid Blogging: Squid Ink from the Jurassic
Seems that squid ink hasn't changed much in 160 million years. From this, researchers argue that the security mechanism of spraying ink into the water and escaping is also that old. Simon and his colleagues used a combination of direct, high-resolution chemical techniques to determine that the melanin had been preserved. The researchers also compared the chemical composition of the...
The Explosive from the Latest Foiled Al Qaeda Underwear Bomb Plot
Interesting: Although the plot was disrupted before a particular airline was targeted and tickets were purchased, al Qaeda's continued attempts to attack the U.S. speak to the organization's persistence and willingness to refine specific approaches to killing. Unlike Abdulmutallab's bomb, the new device contained lead azide, an explosive often used as a detonator. If the new underwear bomb had been...
The Ubiquity of Cyber-Fears
A new study concludes that more people are worried about cyber threats than terrorism. ...the three highest priorities for Americans when it comes to security issues in the presidential campaign are: Protecting government computer systems against hackers and criminals (74 percent) Protecting our electric power grid, water utilities and transportation systems against computer or terrorist attacks (73 percent) Homeland security...
The Banality of Surveillance Photos
Interesting essay on a trove on surveillance photos from Cold War-era Prague. Cops, even secret cops, are for the most part ordinary people. Working stiffs concerned with holding down jobs and earning a living. Even those who thought it was important to find enemies recognized the absurdity of their task. I take photos all the time and these empty blurry...
Lessons in Trust from Web Hoaxes
Interesting discussion of trust in this article on web hoaxes. Kelly's students, like all good con artists, built their stories out of small, compelling details to give them a veneer of veracity. Ultimately, though, they aimed to succeed less by assembling convincing stories than by exploiting the trust of their marks, inducing them to lower their guard. Most of us...
Privacy Concerns Around "Social Reading"
Interesting paper: "The Perils of Social Reading," by Neil M. Richards, from the Georgetown Law Journal. Abstract: Our law currently treats records of our reading habits under two contradictory rules rules mandating confidentiality, and rules permitting disclosure. Recently, the rise of the social Internet has created more of these records and more pressures on when and how they should...
Racism as a Vestigal Remnant of a Security Mechanism
"Roots of Racism," by Elizabeth Culotta in Science: Our attitudes toward outgroups are part of a threat-detection system that allows us to rapidly determine friend from foe, says psychologist Steven Neuberg of ASU Tempe. The problem, he says, is that like smoke detectors, the system is designed to give many false alarms rather than miss a true threat. So outgroup...
Security Incentives and Advertising Fraud
Details are in the article, but here's the general idea: Let's follow the flow of the users: Scammer buys user traffic from PornoXo.com and sends it to HQTubeVideos. HQTubeVideos loads, in invisible iframes, some parked domains with innocent-sounding names (relaxhealth.com, etc). In the parked domains, ad networks serve display and PPC ads. The click-fraud sites click on the ads that...
Friday Squid Blogging: Squid Scalp Massager
Cheap! As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Kip Hawley Reviews Liars and Outliers
In his blog: I think the most important security issues going forward center around identity and trust. Before knowing I would soon encounter Bruce again in the media, I bought and read his new book Liars & Outliers and it is a must-read book for people looking forward into our security future and thinking about where this all leads. For...
Cybersecurity at the Doctor's Office
I like this essay because it nicely illustrates the security mindset....
Rules for Radicals
It was written in 1971, but this still seems like a cool book: For an elementary illustration of tactics, take parts of your face as the point of reference; your eyes, your ears, and your nose. First the eyes: if you have organized a vast, mass-based people's organization, you can parade it visibly before the enemy and openly show your...
USB Drives and Wax Seals
Need some pre-industrial security for your USB drive? How about a wax seal? Neat, but I recommend combining it with encryption for even more security!...
Security Vulnerabilities in Airport Full-Body Scanners
According to a report from the DHS Office of Inspector General: Federal investigators "identified vulnerabilities in the screening process" at domestic airports using so-called "full body scanners," according to a classified internal Department of Homeland Security report. EPIC obtained an unclassified version of the report in a FOIA response. Here's the summary....
U.S. Exports Terrorism Fears
To New Zealand: United States Secretary of Homeland Security Janet Napolitano has warned the New Zealand Government about the latest terrorist threat known as "body bombers." [...] "Do we have specific credible evidence of a [body bomb] threat today? I would not say that we do, however, the importance is that we all lean forward." Why the headline of this...
The Trouble with Airport Profiling
Why do otherwise rational people think it's a good idea to profile people at airports? Recently, neuroscientist and best-selling author Sam Harris related a story of an elderly couple being given the twice-over by the TSA, pointed out how these two were obviously not a threat, and recommended that the TSA focus on the actual threat: "Muslims, or anyone who...
Friday Squid Blogging: New Book on Squid
Kraken: The Curious, Exciting, and Slightly Disturbing Science of Squid. And a review. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Smart Phone Privacy App
MobileScope looks like a great tool for monitoring and controlling what information third parties get from your smart phone apps: We built MobileScope as a proof-of-concept tool that automates much of what we were doing manually; monitoring mobile devices for surprising traffic and highlighting potentially privacy-revealing flows [...] Unlike PCs, we have little control over the underlying privacy and security...
RuggedCom Inserts Backdoor into Its Products
All RuggedCom equipment comes with a built-in backdoor: The backdoor, which cannot be disabled, is found in all versions of the Rugged Operating System made by RuggedCom, according to independent researcher Justin W. Clarke, who works in the energy sector. The login credentials for the backdoor include a static username, "factory," that was assigned by the vendor and can't be...
A Foiled Terrorist Plot
We don't know much, but here are my predictions: There's a lot more hyperbole to this story than reality. The explosive would have either 1) been caught by pre-9/11 security, or 2) not been caught by post-9/11 security. Nonetheless, it will be used to justify more invasive airport security....
Overreacting to Potential Bombs
This is a ridiculous overreaction: The police bomb squad was called to 2 World Financial Center in lower Manhattan at midday when a security guard reported a package that seemed suspicious. Brookfield Properties, which runs the property, ordered an evacuation as a precaution. That's the entire building, a 44-story, 2.5-million-square-foot office building. And why? The bomb squad determined the package...
Naval Drones
With all the talk about airborne drones like the Predator, it's easy to forget that drones can be in the water as well. Meet the Common Unmanned Surface Vessel (CUSV): The boat -- painted in Navy gray and with a striking resemblance to a PT boat -- is 39 feet long and can reach a top speed of 28 knots....
Friday Squid Blogging: Squid Bicycle Parking Sculpture
Neat. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Tampon-Shaped USB Drive
This vendor is selling a tampon-shaped USB drive. Although it's less secure now that there are blog posts about it....
Facial Recognition of Avatars
I suppose this sort of thing might be useful someday. In Second Life, avatars are easily identified by their username, meaning police can just ask San Francisco-based Linden Labs, which runs the virtual world, to look up a particular user. But what happens when virtual worlds start running on peer-to-peer networks, leaving no central authority to appeal to? Then there...
Criminal Intent Prescreening and the Base Rate Fallacy
I've often written about the base rate fallacy and how it makes tests for rare events -- like airplane terrorists -- useless because the false positives vastly outnumber the real positives. This essay uses that argument to demonstrate why the TSA's FAST program is useless: First, predictive software of this kind is undermined by a simple statistical problem known as...
Al Qaeda Steganography
The reports are still early, but it seems that a bunch of terrorist planning documents were found embedded in a digital file of a porn movie. Several weeks later, after laborious efforts to crack a password and software to make the file almost invisible, German investigators discovered encoded inside the actual video a treasure trove of intelligence -- more than...
Cybercrime as a Tragedy of the Commons
Two very interesting points in this essay on cybercrime. The first is that cybercrime isn't as big a problem as conventional wisdom makes it out to be. We have examined cybercrime from an economics standpoint and found a story at odds with the conventional wisdom. A few criminals do well, but cybercrime is a relentless, low-profit struggle for the majority....
When Investigation Fails to Prevent Terrorism
I've long advocated investigation, intelligence, and emergency response as the places where we can most usefully spend our counterterrorism dollars. Here's an example where that didn't work: Starting in April 1991, three FBI agents posed as members of an invented racist militia group called the Veterans Aryan Movement. According to their cover story, VAM members robbed armored cars, using the...
JCS Chairman Sows Cyberwar Fears
Army General Martin E. Dempsey, the chairman of the Joint Chiefs of Staff, said: A cyber attack could stop our society in its tracks. Gadzooks. A scared populace is much more willing to pour money into the cyberwar arms race....
Vote for Liars and Outliers
Actionable Books is having a vote to determine which of four books to summarize on their site. If you are willing, please go there and vote for Liars and Outliers. (Voting requires a Facebook ID.) Voting closes Monday at noon EST, although I presume they mean EDT....
Friday Squid Blogging: Chesapeake Bay Squid
Great pictures. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Attack Mitigation
At the RSA Conference this year, I noticed a trend of companies that have products and services designed to help victims recover from attacks. Kelly Jackson Higgins noticed the same thing: "Damage Mitigation as the New Defense." That new reality, which has been building for several years starting in the military sector, has shifted the focus from trying to stop...
Biometric Passports Make it Harder for Undercover CIA Officers
Last year, I wrote about how social media sites are making it harder than ever for undercover police officers. This story talks about how biometric passports are making it harder than ever for undercover CIA agents. Busy spy crossroads such as Dubai, Jordan, India and many E.U. points of entry are employing iris scanners to link eyeballs irrevocably to a...
Fear and the Attention Economy
danah boyd is thinking about -- in a draft essay, and as a recording of a presentation -- fear and the attention economy. Basically, she is making the argument that the attention economy magnifies the culture of fear because fear is a good way to get attention, and that this is being made worse by the rise of social media....
Amazing Round of "Split or Steal"
In Liars and Outliers, I use the metaphor of the Prisoner's Dilemma to exemplify the conflict between group interest and self-interest. There are a gazillion academic papers on the Prisoner's Dilemma from a good dozen different academic disciplines, but the weirdest dataset on real people playing the game is from a British game show called Golden Balls. In the final...
Alan Turing Cryptanalysis Papers
GCHQ, the UK government's communications headquarters, has released two new -- well, 70 years old, but new to us -- cryptanalysis documents by Alan Turing. The papers, one entitled The Applications of Probability to Crypt, and the other entitled Paper on the Statistics of Repetitions, discuss mathematical approaches to code breaking. [...] According to the GCHQ mathematician, who identified himself...
Friday Squid Blogging: Extracting Squid Ink
How to extract squid ink. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Liars & Outliers Update
Liars & Outliers has been available for about two months, and is selling well both in hardcover and e-book formats. More importantly, I'm very pleased with the book's reception. The reviews I've gotten have been great, and I read a lot of tweets from people who have enjoyed the book. My goal was to give people new ways to think...
TSA Behavioral Detection Statistics
Interesting data from the U.S. Government Accounting Office: But congressional auditors have questions about other efficiencies as well, like having 3,000 "behavior detection" officers assigned to question passengers. The officers sidetracked 50,000 passengers in 2010, resulting in the arrests of 300 passengers, the GAO found. None turned out to be terrorists. Yet in the same year, behavior detection teams apparently...
Dance Moves As an Identifier
A burglar was identified by his dance moves, captured on security cameras: "The 16-year-old juvenile suspect is known for his 'swag,' or signature dance move," Heyse said, "and [he] does it in the hallways at school." Presumably, although the report doesn't make it clear, a classmate or teacher saw the video, recognized the distinctive swag and notified authorities. But is...
Smart Meter Hacks
Brian Krebs writes about smart meter hacks: But it appears that some of these meters are smarter than others in their ability to deter hackers and block unauthorized modifications. The FBI warns that insiders and individuals with only a moderate level of computer knowledge are likely able to compromise meters with low-cost tools and software readily available on the Internet....
Password Security at Linode
Here's something good: We have implemented sophisticated brute force protection for Linode Manager user accounts that combines a time delay on failed attempts, forced single threading of log in attempts from a given remote address, and automatic tarpitting of requests from attackers. And this: Some of you may have noticed a few changes to the Linode Manger over the past...
Stolen Phone Database
This article talks about a database of stolen cell phone IDs that will be used to deny service. While I think this is a good idea, I don't know how much it would deter cell phone theft. As long as there are countries that don't implement blocking based on the IDs in the databases -- and surely there will always...
Forever-Day Bugs
That's a nice turn of phrase: Forever day is a play on "zero day," a phrase used to classify vulnerabilities that come under attack before the responsible manufacturer has issued a patch. Also called iDays, or "infinite days" by some researchers, forever days refer to bugs that never get fixed--even when they're acknowledged by the company that developed the software....
Outliers in Intelligence Analysis
From the CIA journal Studies in Intelligence: "Capturing the Potential of Outlier Ideas in the Intelligence Community." In war you will generally find that the enemy has at any time three courses of action open to him. Of those three, he will invariably choose the fourth. Helmuth Von Moltke With that quip, Von Moltke may have launched a spirited debate...
Hawley Channels His Inner Schneier
Kip Hawley wrote an essay for the Wall Street Journal on airport security. In it, he says so many sensible things that people have been forwarding it to me with comments like "did you ghostwrite this?" and "it looks like you won an argument" and "how did you convince him?" (Sadly, the essay was published in the Journal, which means...
How Information Warfare Changes Warfare
Really interesting paper on the moral and ethical implications of cyberwar, and the use of information technology in war (drones, for example): "Information Warfare: A Philosophical Perspective," by Mariarosaria Taddeo, Philosophy and Technology, 2012. Abstract: This paper focuses on Information Warfare -- the warfare characterised by the use of information and communication technologies. This is a fast growing phenomenon, which...
Friday Squid Blogging: Squid Fiction
Great short story in Nature. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Me at RSA 2012
This is not a video of my talk at the RSA Conference earlier this year. This is a 16-minute version of that talk -- TED-like -- that the conference filmed the day after for the purpose of putting it on the Internet. Today's Internet threats are not technical; they're social and political. They aren't criminals, hackers, or terrorists. They're the...
Disguising Tor Traffic as Skype Video Calls
One of the problems with Tor traffic is that it can de detected and blocked. Here's SkypeMorph, a clever system that disguises Tor traffic as Skype video traffic. To prevent the Tor traffic from being recognized by anyone analyzing the network flow, SkypeMorph uses what's known as traffic shaping to convert Tor packets into User Datagram Protocol packets, as used...
Bomb Threats As a Denial-of-Service Attack
The University of Pittsburgh has been the recipient of 50 bomb threats in the past two months (over 30 during the last week). Each time, the university evacuates the threatened building, searches it top to bottom -- one of the threatened buildings is the 42-story Cathedral of Learning -- finds nothing, and eventually resumes classes. This seems to be nothing...
Brian Snow on Cybersecurity
Interesting video of Brian Snow speaking from last November. (Brian used to be the Technical Director of NSA's Information Assurance Directorate.) About a year and a half ago, I complained that his words were being used to sow cyber-fear. This talk -- about 30 minutes -- is a better reflection of what he really thinks....
"Raise the Crime Rate"
I read this a couple of months ago, and I'm still not sure what I think about it. It's definitely of the most thought-provoking essays I've read this year. According to government statistics, Americans are safer today than at any time in the last forty years. In 1990, there were 2,245 homicides in New York City. In 2010, there were...
A Heathrow Airport Story about Trousers
Usually I don't bother posting random stories about dumb or inconsistent airport security measures. But this one is particularly interesting: "Sir, your trousers." "Pardon?" "Sir, please take your trousers off." A pause. "No." "No?" The security official clearly was not expecting that response. He begins to look like he doesn't know what to do, bless him. "You have no power...
Teenagers and Privacy
Good article debunking the myth that young people don't care about privacy on the Intenet. Most kids are well aware of risks, and make "fairly sophisticated" decisions about privacy settings based on advice and information from their parents, teachers, and friends. They differentiate between people they don't know out in the world (distant strangers) and those they don't know in...
Laptops and the TSA
The New York Times tries to make sense of the TSA's policies on computers. Why do you have to take your tiny laptop out of your bag, but not your iPad? Their conclusion: security theater....
Friday Squid Blogging: Squid Art
Happy Easter. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
A Systems Framework for Catastrophic Disaster Response
The National Academies Press has published Crisis Standards of Care: A Systems Framework for Catastrophic Disaster Response. When a nation or region prepares for public health emergencies such as a pandemic influenza, a large-scale earthquake, or any major disaster scenario in which the health system may be destroyed or stressed to its limits, it is important to describe how standards...
James Randi on Magicians and the Security Mindset
Okay, so he doesn't use that term. But he explains how a magician's inherent ability to detect deception can be useful to science. We can't make magicians out of scientists -- we wouldn't want to -- but we can help scientists "think in the groove" -- think like a magician. And we should. We are not scientists with a...
Helen Nussenbaum, Privacy, and the Federal Trade Commission
Good article....
JetBlue Captain Clayton Osbon and Resilient Security
This is the most intelligent thing I've read about the JetBlue incident where a pilot had a mental breakdown in the cockpit: For decades, public safety officials and those who fund them have focused on training and equipment that has a dual-use function for any hazard that may come our way. The post-9/11 focus on terrorism, with all the gizmos...
The Battle for Internet Governance
Good article on the current battle for Internet governance: The War for the Internet was inevitable -- a time bomb built into its creation. The war grows out of tensions that came to a head as the Internet grew to serve populations far beyond those for which it was designed. Originally built to supplement the analog interactions among American soldiers...
Lost Smart Phones and Human Nature
Symantec deliberately "lost" a bunch of smart phones with tracking software on them, just to see what would happen: Some 43 percent of finders clicked on an app labeled "online banking." And 53 percent clicked on a filed named "HR salaries." A file named "saved passwords" was opened by 57 percent of finders. Social networking tools and personal e-mail were...
Law Enforcement Forensics Tools Against Smart Phones
Turns out the password can be easily bypassed: XRY works by first jailbreaking the handset. According to Micro Systemation, no backdoors created by Apple used, but instead it makes use of security flaws in the operating system the same way that regular jailbreakers do. Once the iPhone has been jailbroken, the tool then goes on to brute-force the passcode, trying...
Computer Forensics: An Example
Paul Ceglia's lawsuit against Facebook is fascinating, but that's not the point of this blog post. As part of the case, there are allegations that documents and e-mails have been electronically forged. I found this story about the forensics done on Ceglia's computer to be interesting....
Buying Exploits on the Grey Market
This article talks about legitimate companies buying zero-day exploits, including the fact that "an undisclosed U.S. government contractor recently paid $250,000 for an iOS exploit." The price goes up if the hack is exclusive, works on the latest version of the software, and is unknown to the developer of that particular software. Also, more popular software results in a higher...
Friday Squid Blogging: How Squid Hear
Interesting research: The squid use two closely spaced organs called statocysts to sense sound. "I think of a statocyst as an inside-out tennis ball," explains Dr Mooney. "It's got hairs on the inside and this little dense calcium stone that sits on those hair cells. "What happens is that the sound wave actually moves the squid back and forth, and...
Summer Schools in Cryptography and Software Security at Penn State
Normally I just delete these as spam, but this summer program for graduate students 1) looks interesting, and 2) has some scholarship money available....
Harms of Post-9/11 Airline Security
As I posted previously, I have been debating former TSA Administrator Kip Hawley on the Economist website. I didn't bother reposting my opening statement and rebuttal, because -- even thought I thought I did a really good job with them -- they were largely things I've said before. In my closing statement, I talked about specific harms post-9/11 airport security...
SHARCS Conference
Last weekend was the 2012 SHARCS (Special-Purpose Hardware for Attacking Cryptographic Systems) conference. The presentations are online....
The Effects of Data Breach Litigation
"Empirical Analysis of Data Breach Litigation," Sasha Romanosky, David Hoffman, and Alessandro Acquisti: Abstract: In recent years, a large number of data breaches have resulted in lawsuits in which individuals seek redress for alleged harm resulting from an organization losing or compromising their personal information. Currently, however, very little is known about those lawsuits. Which types of breaches are litigated,...
Congressional Testimony on the TSA
I was supposed to testify today about the TSA in front of the House Committee on Oversight and Government Reform. I was informally invited a couple of weeks ago, and formally invited last Tuesday: The hearing will examine the successes and challenges associated with Advanced Imaging Technology (AIT), the Screening of Passengers by Observation Techniques (SPOT) program, the Transportation Worker...
Rare Spanish Enigma Machine
This is a neat story: A pair of rare Enigma machines used in the Spanish Civil War have been given to the head of GCHQ, Britain's communications intelligence agency. The machines - only recently discovered in Spain - fill in a missing chapter in the history of British code-breaking, paving the way for crucial successes in World War II. Fun...
Friday Squid Blogging: Giant Squid Eyes
It seems that the huge eyes of the giant squid are optimized to see sperm whales....
The Economist Debate on Airplane Security
On The Economist website, I am currently debating Kip Hawley on airplane security. On Tuesday we posted our initial statements, and today (London time) we posted our rebuttals. We have one more round to go. I've set it up to talk about the myriad of harms airport security has caused: loss of trust in government, increased fear, creeping police state,...
Can the NSA Break AES?
In an excellent article in Wired, James Bamford talks about the NSA's codebreaking capability. According to another top official also involved with the program, the NSA made an enormous breakthrough several years ago in its ability to cryptanalyze, or break, unfathomably complex encryption systems employed by not only governments around the world but also many average computer users in the...
Another Liars and Outliers Excerpt
IT World published an excerpt from Chapter 4....
Unprinter
A way to securely erase paper: "The key idea was to find a laser energy level that is high enough to ablate - or vaporise - the toner that at the same time is lower than the destruction threshold of the paper substrate. It turns out the best wavelength is 532 nanometres - that's green visible light - with a...
Hacking Critical Infrastructure
A otherwise uninteresting article on Internet threats to public infrastructure contains this paragraph: At a closed-door briefing, the senators were shown how a power company employee could derail the New York City electrical grid by clicking on an e-mail attachment sent by a hacker, and how an attack during a heat wave could have a cascading impact that would lead...
Avi Rubin on Computer Security
Avi Rubin has a TEDx talk on hacking various computer devices: medical devices, automobiles, police radios, smart phones, etc....
Australian Security Theater
I like the quote at the end of this excerpt: Aviation officials have questioned the need for such a strong permanent police presence at airports, suggesting they were there simply "to make the government look tough on terror". One senior executive said in his experience, the officers were expensive window-dressing. "When you add the body scanners, the ritual humiliation of...
Friday Squid Blogging: Squid-Shaped USB Drive
It looks great. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
BitCoin Security Musings
Jon Callas talks about BitCoin's security model, and how susceptible it would be to a Goldfinger-style attack (destroy everyone else's BitCoins)....
Non-Lethal Heat Ray
The U.S. military has a non-lethal heat ray. No details on what "non-lethal" means in this context....
Assorted Schneier News Stories
I have several stories in the news (and one podcast), mostly surrounding the talks I gave at the RSA Conference last month....
More "Liars and Outliers" Links
First, five new reviews of the book. Second, four new AV interviews about the book. Third, I take the Page 99 Test....
On Cyberwar Hype
Good article by Thomas Rid on the hype surrounding cyberwar. It's well worth reading. And in a more academic paper, published in the RUSI Journal, Thomas Rid and Peter McBurney argue that cyber-weapons aren't all that destructive and that we've been misled by some bad metaphors. Some fundamental questions on the use of force in cyberspace are still unanswered. Worse,...
A Negative Liars and Outliers Review
Ths person didn't like it at all. It'll go up on the book's webpage, along with all the positive reviews....
The Security of Multi-Word Passphrases
Interesting research on the security of passphrases. From a blog post on the work: We found about 8,000 phrases using a 20,000 phrase dictionary. Using a very rough estimate for the total number of phrases and some probability calculations, this produced an estimate that passphrase distribution provides only about 20 bits of security against an attacker trying to compromise 1%...
Video Shows TSA Full-Body Scanner Failure
The Internet is buzzing about this video, showing a blogger walking through two different types of full-body scanners with metal objects. Basically, by placing the object on your side, the black image is hidden against the scanner's black background. This isn't new, by the way. This vulnerability was discussed in a paper published last year by the Journal of Transportation...
Jamming Speech with Recorded Speech
This is cool: The idea is simple. Psychologists have known for some years that it is almost impossible to speak when your words are replayed to you with a delay of a fraction of a second. Kurihara and Tsukada have simply built a handheld device consisting of a microphone and a speaker that does just that: it records a person's...
Friday Squid Blogging: Humboldt Squid Can Dive to 1.5 km
Yet another impressive Humboldt squid feat: "We've seen them make really impressive dives up to a kilometre and a half deep, swimming straight through a zone where there's really low oxygen," the Hopkins Marine Station researcher said. "They're able to spend several hours at this kilometre-and-a-half-deep, and then they go back up and continue their normal daily swimming behaviour. It's...
Liars and Outliers: Book Excerpt
Gizmodo published the beginning of Chapter 17: the last chapter....
Cloud Computing As a Man-in-the-Middle Attack
This essay uses the interesting metaphor of the man-in-the-middle attacker to describe cloud providers like Facebook and Google. Basically, they get in the middle of our interactions with others and eavesdrop on the data going back and forth....
NSA's Secure Android Spec
The NSA has released its specification for a secure Android. One of the interesting things it's requiring is that all data be tunneled through a secure VPN: Inter-relationship to Other Elements of the Secure VoIP System The phone must be a commercial device that supports the ability to pass data over a commercial cellular network. Standard voice phone calls, with...
How Changing Technology Affects Security
Security is a tradeoff, a balancing act between attacker and defender. Unfortunately, that balance is never static. Changes in technology affect both sides. Society uses new technologies to decrease what I call the scope of defection -- what attackers can get away with -- and attackers use new technologies to increase it. What's interesting is the difference between how the...
The Keywords the DHS Is Using to Analyze Your Social Media Posts
According to this document, received by EPIC under the Freedom of Information Act, the U.S. Department of Homeland Security is combing through the gazillions of social media postings looking for terrorists. A partial list of keywords is included in the document (pages 2023), and is reprinted in this blog post....
Themes from the RSA Conference
Last week was the big RSA Conference in San Francisco: something like 20,000 people. From what I saw, these were the major themes on the show floor: Companies that deal with "Advanced Persistent Threat." Companies that help you recover after you've been hacked. Companies that deal with "Bring Your Own Device" at work, also known as consumerization. Who else went...
Friday Squid Blogging: Squid Vision
Some squid can see aspects of light that are invisible to humans, including polarized light. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Liars and Outliers: The Big Idea
My big idea is a big question. Every cooperative system contains parasites. How do we ensure that society's parasites don't destroy society's systems? It's all about trust, really. Not the intimate trust we have in our close friends and relatives, but the more impersonal trust we have in the various people and systems we interact with in society. I trust...
GPS Spoofers
Great movie-plot threat: Financial institutions depend on timing that is accurate to the microsecond on a global scale so that stock exchanges in, say, London and New York are perfectly synchronised. One of the main ways of doing this is through GPS, and major financial institutions will have a GPS antenna on their main buildings. "They are always visible because...
State Department Redacts Wikileaks Cables
The ACLU filed a FOIA request for a bunch of cables that Wikileaks had already released complete versions of. This is what happened: The agency released redacted versions of 11 and withheld the other 12 in full. The five excerpts below show the government's selective and self-serving decisions to withhold information. Because the leaked versions of these cables have already...
Detect Which Social Networking Sites Website Visitors Are Logged Into
Clever hack....
FBI Special Agent and Counterterrorism Expert Criticizes the TSA
Good essay. Nothing I haven't said before, but it's good to hear it from someone with a widely different set of credentials than I have....
"Cyberwar Is the New Yellowcake"
Good essay on the dangers of cyberwar rhetoric -- and the cyberwar arms race....
Liars and Outliers: Interview on The Browser
I was asked to talk about five books related to privacy. You're best known as a security expert but our theme today is "trust". How would you describe the connection between the two? Security exists to facilitate trust. Trust is the goal, and security is how we enable it. Think of it this way: As members of modern society, we...
U.S. Federal Court Rules that it is Unconstitutional for the Police to Force Someone to Decrypt their Laptop
A U.S. Federal Court ruled that it is unconstitutional for the police to force someone to decrypt their laptop computer: Thursdays decision by the 11th U.S. Circuit Court of Appeals said that an encrypted hard drive is akin to a combination to a safe, and is off limits, because compelling the unlocking of either of them is the equivalent of...
Friday Squid Blogging: Squid Can Fly to Save Energy
There's a new study that shows that squid are faster in the air than in the water. Squid of many species have been seen to 'fly' using the same jet-propulsion mechanisms that they use to swim: squirting water out of their mantles so that they rocket out of the sea and glide through the air. Until now, most researchers have...
Liars and Outliers News
The book is selling well. (Signed copies are still available on the website.) All the online stores have it, and most bookstores as well. It is available in Europe and elsewhere outside the U.S. And for those who wanted a DRM-free electronic copy, it's available on the OReilly.com bookstore for $11.99. I have collected four new reviews. And a bunch...
Press Mentions
One article on me, and a podcast about my RSA talk next week....
Mention of Cryptography in a Rap Song
The new movie Safe House features the song "No Church in the Wild," by Kanye West, which includes this verse: I live by you, desire I stand by you, walk through the fire Your love is my scripture Let me into your encryption...
Computer Security when Traveling to China
Interesting: When Kenneth G. Lieberthal, a China expert at the Brookings Institution, travels to that country, he follows a routine that seems straight from a spy film. He leaves his cellphone and laptop at home and instead brings "loaner" devices, which he erases before he leaves the United States and wipes clean the minute he returns. In China, he disables...
Another Piece of the Stuxnet Puzzle
We can now conclusively link Stuxnet to the centrifuge structure at the Natanz nuclear enrichment lab in Iran. Watch this new video presentation from Ralph Langner, the researcher who has done the most work on Stuxnet. It's a long clip, but the good stuff is between 21:00 and 29:00. The pictures he's referring to are still up. My previous writings...
Mobile Malware Is Increasing
According to a report by Juniper, mobile malware is increasing dramatically. In 2011, we saw unprecedented growth of mobile malware attacks with a 155 percent increase across all platforms. Most noteworthy was the dramatic growth in Android Malware from roughly 400 samples in June to over 13,000 samples by the end of 2011. This amounts to a cumulative increase of...
"1234" and Birthdays Are the Most Common PINs
Research paper: "A birthday present every eleven wallets? The security of customer-chosen banking PINs," by Joseph Bonneau, Sören Preibusch, and Ross Anderson: Abstract: We provide the first published estimates of the difficulty of guessing a human-chosen 4-digit PIN. We begin with two large sets of 4-digit sequences chosen outside banking for online passwords and smartphone unlock-codes. We use a regression...
Covert Communications Channel in Tarsiers
Marissa A. Ramsier, Andrew J. Cunningham, Gillian L. Moritz, James J. Finneran, Cathy V. Williams, Perry S. Ong, Sharon L. Gursky-Doyen, and Nathaniel J. Dominy (2012), "Primate communication in the pure ultrasound," Biology Letters. Abstract: Few mammals -- cetaceans, domestic cats and select bats and rodents -- can send and receive vocal signals contained within the ultrasonic domain, or pure...
Friday Squid Blogging: Squid Desk Lamp
Beautiful sculpture. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Self-Domestication in Bonobos and Other Animals
Self-domestication happens when the benefits of cooperation outweigh the costs: But why and how could natural selection tame the bonobo? One possible narrative begins about 2.5 million years ago, when the last common ancestor of bonobos and chimpanzees lived both north and south of the Zaire River, as did gorillas, their ecological rivals. A massive drought drove gorillas from the...
Cryptanalysis of Satellite Phone Encryption Algorithms
From the abstract of the paper: In this paper, we analyze the encryption systems used in the two existing (and competing) satphone standards, GMR-1 and GMR-2. The first main contribution is that we were able to completely reverse engineer the encryption algorithms employed. Both ciphers had not been publicly known previously. We describe the details of the recovery of the...
Lousy Random Numbers Cause Insecure Public Keys
There's some excellent research (paper, news articles) surveying public keys in the wild. Basically, the researchers found that a small fraction of them (27,000 out of 7.1 million, or 0.38%) share a common factor and are inherently weak. The researchers can break those public keys, and anyone who duplicates their research can as well. The cause of this is almost...
Dumb Risk of the Day
Geotagged images of children: Joanne Kuzma of the University of Worcester, England, has analyzed photos that clearly show children's faces on the photo sharing site Flickr. She found that a significant proportion of those analyzed were geotagged and a large number of those were associated with 50 of the more expensive residential zip codes in the USA. The location information...
The Sudafed Security Trade-Off
This writer wrestles with the costs and benefits of tighter controls on pseudoephedrine, a key chemical used to make methamphetamine: Now, personally, I sincerely doubt that the pharmaceutical industry has reliable estimates of how many of their purchasers actually have colds--or that they would share data indicating that half of their revenues came from meth cooks. But let's say this...
Trust Requires Transparency
Adam Shostack explains to Verisign that trust requires transparency. This is a lesson Path should have learned....
Liars and Outliers Update
Liars and Outliers is available. Amazon and Barnes & Noble have ben shipping the book since the beginning of the month. Both the Kindle and the Nook versions are available for download. I have received 250 books myself. Everyone who read and commented on a draft will get a copy in the mail. And as of today, I have shipped...
What Happens When the Court Demands You Decrypt a Document and You Forget the Key?
Last month, a U.S. court demanded that a defendent surrender the encryption key to a laptop so the police could examine it. Now it seems that she's forgotten the key. What happens now? It seems as if this excuse would always be available to someone who doesn't want the police to decrypt her files. On the other hand, it might...
Friday Squid Blogging: Squid's Beard
It's an acoustic bluegrass band. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Securing iPads for Exams
Interesting blog post about locking down an iPad so students can take exams on them....
Security Implications of "Lower-Risk Aircraft"
Interesting paper: Paul J. Freitas (2012), "Passenger aviation security, risk management, and simple physics," Journal of Transportation Security. Abstract: Since the September 11, 2001 suicide hijacking attacks on the United States, preventing similar attacks from recurring has been perhaps the most important goal of aviation security. In addition to other measures, the US government has increased passenger screening requirements to...
Solving the Underlying Economic Problem of Internet Piracy
This essay is definitely thinking along the correct directions....
Error Rates of Hand-Counted Voting Systems
The error rate for hand-counted ballots is about two percent. All voting systems have nonzero error rates. This doesn't surprise technologists, but does surprise the general public. There's a myth out there that elections are perfectly accurate, down to the single vote. They're not. If the vote is within a few percentage points, they're likely a statistical tie. (The problem,...
The Failure of Two-Factor Authentication
In 2005, I wrote an essay called "The Failure of Two-Factor Authentication," where I predicted that attackers would get around multi-factor authentication systems with tools that attack the transactions in real time: man-in-the-middle attacks and Trojan attacks against the client endpoint. This BBC article describes exactly that: After logging in to the bank's real site, account holders are being tricked...
Friday Squid Blogging: Clothing that Keeps an Exercise Journal
It's called Squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
The Problems of Too Much Information Sharing
Funny. Fake, but funny....
VeriSign Hacked, Successfully and Repeatedly, in 2010
Reuters discovered the information: The VeriSign attacks were revealed in a quarterly U.S. Securities and Exchange Commission filing in October that followed new guidelines on reporting security breaches to investors. It was the most striking disclosure to emerge in a review by Reuters of more than 2,000 documents mentioning breach risks since the SEC guidance was published. The company, unsurprisingly,...
Prisons in the U.S.
Really good article on the huge incarceration rate in the U.S., its causes, its effects, and its value: Over all, there are now more people under "correctional supervision" in America -- more than six million -- than were in the Gulag Archipelago under Stalin at its height. That city of the confined and the controlled, Lockuptown, is now the second...
The Idaho Loophole
Brian C. Kalt (2012), "The Idaho Loophole," Georgetown Law Journal, Vol. 93, No. 2. Abstract: This article argues that there is a 50-square-mile swath of Idaho in which one can commit felonies with impunity. This is because of the intersection of a poorly drafted statute with a clear but neglected constitutional provision: the Sixth Amendment's Vicinage Clause. Although lesser criminal...
Possibly the Most Incompetent TSA Story Yet
The storyline: TSA screener finds two pipes in passenger's bags. Screener determines that they're not a threat. Screener confiscates them anyway, because of their "material and appearance." Because they're not actually a threat, screener leaves them at the checkpoint. Everyone forgets about them. Six hours later, the next shift of TSA screeners notices the pipes and -- not being able...
Biases in Forensic Science
Some errors in forensic science may be the result of the biases of the medical examiners: Though they cannot prove it, Dr Dror and Dr Hampikian suspect the difference in contextual information given to the examiners was the cause of the different results. The original pair may have subliminally interpreted ambiguous information in a way helpful to the prosecution, even...
Liars and Outliers Update
According to my publisher, the book was printed last week and the warehouse is shipping orders to booksellers today. Amazon is likely to start shipping books on Thursday. (Yes, Amazon's webpage claims that the book will be published on February 21, 2012, but they'll ship copies as soon as they get them -- this ain't Harry Potter.) The Kindle edition...
British Tourists Arrested in the U.S. for Tweeting
Does this story make sense to anyone? The Department of Homeland Security flagged him as a potential threat when he posted an excited tweet to his pals about his forthcoming trip to Hollywood which read: 'Free this week, for quick gossip/prep before I go and destroy America'. After making their way through passport control at Los Angeles International Airport (LAX)...
The Nature of Cyberwar
This was pretty good, I thought: However, it may be difficult to write military doctrine for many aspects of cyberconflict that are truly revolutionary. Here are no fewer than 10 to consider: The Internet is an artificial environment that can be shaped in part according to national security requirements. The blinding proliferation of technology and hacker tools makes it impossible...
Password Sharing Among American Teenagers
Interesting article from the New York Times on password sharing as a show of affection. "It's a sign of trust," Tiffany Carandang, a high school senior in San Francisco, said of the decision she and her boyfriend made several months ago to share passwords for e-mail and Facebook. "I have nothing to hide from him, and he has nothing to...
Evidence on the Effectiveness of Terrorism
Readers of this blog will know that I like the works of Max Abrams, and regularly blog them. He has a new paper (full paper behind paywall) in Defence and Peace Economics, 22:6 (2011), 58394, "Does Terrorism Really Work? Evolution in the Conventional Wisdom since 9/11, Defence and Peace Economics": The basic narrative of bargaining theory predicts that, all else...
Federal Judge Orders Defendant to Decrypt Laptop
A U.S. federal judge has ordered a defendent to decrypt her laptop....
Supreme Court Rules that GPS Tracking Requires a Warrant
The U.S Supreme Court has ruled that the police cannot attach a GPS tracking device to a car without a warrant....
Research into an Information Security Risk Rating
The NSF is funding research on giving organizations information-security risk ratings, similar to credit ratings for individuals: Existing risk management techniques are based on annual audits and only provide a snapshot of a partner's security posture. However, new vulnerabilities are discovered everyday and the industry needs a solution that enables a business to continuously monitor changing risk posture of all...
Using Plant DNA for Authentication
Turns out you can create unique signatures from plant DNA. The idea is to spray this stuff on military components in order to verify authentic items and detect counterfeits, similar to SmartWater. It's a good idea in theory, but my guess is that the security is not going to center around counterfeiting the plant DNA, but rather in subverting the...
Authentication by "Cognitive Footprint"
DARPA is funding research into new forms of biometrics that authenticate people as they use their computer: things like keystroke patterns, eye movements, mouse behavior, reading speed, and surfing and e-mail response behavior. The idea -- and I think this is a good one -- is that the computer can continuously authenticate people, and not just authenticate them once when...
The Continued Militarization of the U.S. Police
The state of Texas gets an armed PT boat. I guess armed drones weren't enough for them....
Using False Alarms to Disable Security
I wrote about this technique in Beyond Fear: Beginning Sunday evening, the robbers intentionally set off the gallery's alarm system several times without entering the building, according to police. The security staffers on duty, who investigated and found no disturbances, subsequently disabled at least one alarm. The burglars then entered through a balcony door....
Going Dark to Protest SOPA/PIPA
Tomorrow, from 8 am to 8 pm EDT, this site, Schneier on Security, is going on strike to protest SOPA and PIPA. In doing so, I'll be joining Wikipedia (in English), BoingBoing, WordPress, and many others. A list of participants, and HTML and JavaScript code for anyone who wants to participate, can be found here....
The Importance of Good Backups
Thankfully, this doesn't happen very often: A US man who had been convicted on a second-degree murder charge will get a new trial after a computer virus destroyed transcripts of court proceedings....
PCI Lawsuit
This is a first: ...the McCombs allege that the bank, and the payment card industry (PCI) in general, force merchants to sign one-sided contracts that are based on information that arbitrarily changes without notice, and that they impose random fines on merchants without providing proof of a breach or of fraudulent losses and without allowing merchants a meaningful opportunity to...
Friday Squid Blogging: Argentina Attempts a Squid Blockage against the Falkland Islands
Yet another story that combines squid and security. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Recovering a Hacked Gmail Account
Long (but well-written and interesting) story of someone whose Gmail account was hacked and erased, and eventually restored. Many interesting lessons about the security of largely support-free cloud services....
"Going Dark" vs. a "Golden Age of Surveillance"
It's a policy debate that's been going on since the crypto wars of the early 1990s. The FBI, NSA, and other agencies continue to claim they're losing their ability to engage in surveillance: that it's "going dark." Whether the cause of the problem is encrypted e-mail, digital telephony, or Skype, the bad guys use it to communicate, so we need...
Abolish the Department of Homeland Security
I have a love/hate relationship with the CATO Institute. Most of their analysis I strongly disagree with, but some of it I equally strongly agree with. Last September 11 -- the tenth anniversary of 9/11 -- CATO's David Rittgers published "Abolish the Department of Homeland Security": DHS has too many subdivisions in too many disparate fields to operate effectively. Agencies...
TSA Cupcake Update
The TSA claims that the cupcake they confiscated was in a jar. So this is a less obviously stupid story than I previously thought....
A Theory of Online Jihadist Sites
Very interesting: The counterterrorism community has spent years trying to determine why so many people are engaged in online jihadi communities in such a meaningful way. After all, the life of an online administrator for a hard-line Islamist forum is not as exciting as one might expect. You don't get paid, and you spend most of your time posting links...
Apple Split-Key Patent
Apple has a patent on splitting a key between a portable device and its power supply. Clever idea....
Protecting Your Privacy at International Borders
The EFF has published a good guide. My own advice is here and here....
Collecting Expert Predictions about Terrorist Attacks
John Mueller has been collecting them: Some 116 of these Very People were surveyed in 2006 by Foreign Policy magazine in a joint project with the Center for America Progress. The magazine stressed that its survey drew from the "highest echelons of Americas foreign policy establishment" and included the occasional secretary of state and national security adviser, as well as...
Stealing Source Code
Hackers stole some source code to Symantec's products. We don't know what was stolen or how recent the code is -- the company is, of course, minimizing the story -- but it's hard to get worked up about this. Yes, maybe the bad guys will comb the code looking for vulnerabilities, and maybe there's some smoking gun that proves Symantec's...
The TSA Proves its Own Irrelevance
Have you wondered what $1.2 billion in airport security gets you? The TSA has compiled its own "Top 10 Good Catches of 2011": 10) Snakes, turtles, and birds were found at Miami (MIA) and Los Angeles (LAX). Im just happy there werent any lions, tigers, and bears& [...] 3) Over 1,200 firearms were discovered at TSA checkpoints across the nation...
Time to Patch Your HP Printers
It's a serious vulnerability. Note that this is the research that was mistakenly reported as allowing hackers to set your printer on fire. Here's a list of all the printers affected....
Improving the Security of Four-Digit PINs on Cell Phones
The author of this article notices that it's often easy to guess a cell phone PIN because of smudge marks on the screen. Those smudge marks indicate the four PIN digits, so an attacker knows that the PIN is one of 24 possible permutations of those digits. Then he points out that if your PIN has only three different digits...
Liars and Outliers News
The Liars and Outliers webpage is live. On it you can find links to order both paper and e-book copies from a variety of online retailers, and signed copies directly from me. I've also posted the jacket copy, the table of contents, the first chapter, the 15 figures from the book, an image of the full wraparound cover, and all...
Newly Released Papers from NSA Journals
The papers are old, but they have just been released under FOIA....
Sending Coded Messages with Postage Stamps
The history of coded messages in postage-stamp placement. I wonder how prevalent this actually was. My guess is that it was more a clever idea than an actual signaling system. And I notice that a lot of the code systems don't have a placement that indicates "no message; this is just as stamp."...
Allocating Security Resources to Protect Critical Infrastructure
Alan T. Murray and Tony H. Grubesic, "Critical Infrastructure Protection: The Vulnerability Conundrum," Telematics & Informatics, 29 (February 2012): 5665 (full article behind paywall). Abstract: Critical infrastructure and key resources (CIKR) refer to a broad array of assets which are essential to the everyday functionality of social, economic, political and cultural systems in the United States. The interruption of CIKR...
Applying Game Theory to Cyberattacks and Defenses
Behzad Zare Moayedi, Mohammad Abdollahi Azgomi, "A Game Theoretic Framework for Evaluation of the Impacts of Hackers Diversity on Security Measures," Reliability Engineering & System Safety, 99 (2012): 45-54 (full article behind paywall). Abstract: Game theoretical methods offer new insights into quantitative evaluation of dependability and security. Currently, there is a wide range of useful game theoretic approaches to model...
Studying Airport Security
Alan A. Kirschenbaum, Michele Mariani, Coen Van Gulijk, Sharon Lubasz, Carmit Rapaport, and Hinke Andriessen, "Airport Security: An Ethnographic Study," Journal of Air Transport Management, 18 (January 2012): 68-73 (full article is behind a paywall). Abstract: This paper employs a behavioral science perspective of airport security to, examine security related decision behaviors using exploratory ethnographic observations. Sampling employees from a...
Tying Up Phone Lines as a Cyberattack Tactic
There's a service that can be hired to tie up target phone lines indefinitely. The article talks about how this can be used as a diversionary tactic to mask a cyberattack, but that seems a bit odd to me. I'd be more concerned about how this sort of thing could be used to disrupt the operations of a political candidate...
Hacking Marconi's Wireless in 1903
A great story: Yet before the demonstration could begin, the apparatus in the lecture theatre began to tap out a message. At first, it spelled out just one word repeated over and over. Then it changed into a facetious poem accusing Marconi of "diddling the public". Their demonstration had been hacked -- and this was more than 100 years before...
Butt Identification
Here's a new biometric: how you sit: ...researchers there developed a system that can recognize a person by the backside when the person takes a seat. The system performs a precise measurement of the person's posterior, its contours and the way the person applies pressure on the seat. The developers say that in lab tests, the system was able to...
The Collar Bomb Robbery
Really interesting story of the collar-bomb robbery -- and subsequent investigation -- from 2003....
Hacking Subway's POS System
The story of how Subway's point-of-sale system was hacked for $3M....
Merry Christmas from the TSA
Cupcakes deemed security threat: Rebecca Hains says she was going through security at the airport in Las Vegas when a TSA agent pulled her aside and said the cupcake frosting was "gel-like" enough to constitute a security risk. The TSA has officially jumped the shark....
Friday Squid Blogging: Goldman Sachs and the Vampire Squid Metaphor
It's a metaphor that will not die. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Me on Airport Security
Charles Mann made me the central focus of his article on airport security for Vanity Fair. (Mann also wrote about me in 2002 for The Atlantic.) The article was supposed to have been in the tenth-anniversary-of-9/11 issue, but got delayed....
Human Ear Biometric
I have no idea how good this biometric actually is....
Giveaway: Liars and Outliers Galleys
My box of galley copies arrived in the mail yesterday. They're filled with uncorrected typos, but otherwise look great. Wiley printed about 500 of them, and they're mostly going to journalists and book reviewers, with some going to different wholesale and retail outlets. I have 20 copies to give away to readers of my blog and Crypto-Gram. Earlier this month,...
Chinese Hacking of iBahn Internet Services
Citing unexplained "intelligence data," an unnamed "senior intelligence official," and an anonymous "privacy security official," Bloomberg News claims that iBahn -- the company that runs Internet services for a bunch of hotel chains -- has been hacked by the Chinese. The rest of the story is pretty obvious: all sorts of private e-mails stolen, corporate networks hacked via iBahn, China...
Multiple Protocol Attacks
In 1997, I wrote about something called a chosen-protocol attack, where an attacker can use one protocol to break another. Here's an example of the same thing in the real world: two different parking garages that mask different digits of credit cards on their receipts. Find two from the same car, and you can reconstruct the entire number. I have...
How to Open a Padlock with a Coke Can
A nice tutorial on making and using shims to open padlocks....
Plasmonics Anti-Counterfeiting Technology
This could be interesting: NOtES exploits an obscure area of physics to accomplish its bright and sharp display, known as plasmonics. Light waves interact with the array of nano-scale holes on a NOtES display--which are typically 100-200 nanometers in diameter--in a way that creates what are called "surface plasmons." In the words of the company, this means light "[collects] on...
Friday Squid Blogging: Squid Season
It's squid season off the coast of Southern California. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Me Speaking on Cryptography in 1997
In 1997, I spoke at the Beyond HOPE Conference in New York. (HOPE stood for "Hackers Over Planet Earth.) A video of that talk is available online....
Cameo in a Rock Video
At the 1:46 mark, you'll see my first cameo appearance in a transvestite-themed rock video....
More on the Captured U.S. Drone
There's a report that Iran hacked the drones' GPS systems: "The GPS navigation is the weakest point," the Iranian engineer told the Monitor, giving the most detailed description yet published of Iran's "electronic ambush" of the highly classified US drone. "By putting noise [jamming] on the communications, you force the bird into autopilot. This is where the bird loses its...
Snow Cone Machines for Homeland Security
When you give out money based on politics, without any accounting, this is what you get: The West Michigan Shoreline Regional Development Commission (WMSRDC) is a federal- and state-designated agency responsible for managing and administrating the homeland security program in Montcalm County and 12 other counties. The WMSRDC recently purchased and transferred homeland security equipment to these counties -- including...
Liars and Outliers Galleys
My publisher is printing galley copies of Liars and Outliers. If anyone out there has a legitimate reason to get one, like writing book reviews for a newspaper, magazine, popular blog, etc., send me an e-mail and I'll forward your request to Wiley's PR department. I think they'll be ready in a week or so, although it might be after...
Investigative Report on "Buckshot Yankee"
This is a really good analysis about the Buckshot Yankee attack against the classified military computer network in 2008. It contains a bunch of details I had not previously known....
Feeling vs. Reality of Security in Sparrows
Sparrows have fewer surviving offspring if they feel insecure, regardless of whether they actually are insecure. Liana Y. Zanette, Aija F. White, Marek C. Allen, and Michael Clinchy, "Perceived Predation Risk Reduces the Number of Offspring Songbirds Produce per Year," Science, 9 Dec 2011: Abstract: Predator effects on prey demography have traditionally been ascribed solely to direct killing in studies...
Yet More Fear-Mongering from the DHS
Al Qaeda is sewing bombs into people. Actually, not really. This is an "aspirational" terrorist threat, which basically means that someone mentioned it while drunk in a bar somewhere. Of course, that won't stop the DHS from trying to terrorize people with the idea and the security-industrial complex from selling us an expensive "solution" to reduce our fears. Wired: "So:...
Assessing Terrorist Threats to Commercial Aviation
This article on airplane security says many of the same things I've been saying for years: Given the breadth and complexity of threats to commercial aviation, those who criticize the TSA and other aviation security regulatory agencies for reactive policies and overly narrow focus appear to have substantial grounding. Three particularly serious charges can be levied against the TSA: it...
Iranians Capture U.S. Drone
Iran has captured a U.S. surveillance drone. No one is sure how it happened. Looking at the pictures of the drone, it wasn't shot down and it didn't crash. The various fail-safe mechanisms on the drone seem to have failed; otherwise, it would have returned home. The U.S. claims that it was a simple "malfunction," but that doesn't make a...
Dumbest Camera Ban Ever
In London: While photography bans are pretty common, the station has decided to only ban DSLRs due to "their combination of high quality sensor and high resolution". Other cameras are allowed in, as long as they don't look "big" enough to shoot amazing photos. The iPhone 4S camera is pretty amazing....
First-Person Account of a TSA Airport Screener
This is a few years old, but I seem not to have blogged it before....
Friday Squid Blogging: Humbolt Squid Mystery Solved
Humbolt Squid off the coast of Mexico are spawning younger and smaller than usual. El Nino is to blame. The mystery was solved by a class of biology students. (A blog of the expedition.) As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Lockable USB Hard Drive
Just in time for Christmas, a USB drive housed in a physical combination lock....
DARPA Unshredding Contest
DARPA held an unshredding contest, and there's a winner: "Lots of experts were skeptical that a solution could be produced at all let alone within the short time frame," said Dan Kaufman, director, DARPA Information Innovation Office. "The most effective approaches were not purely computational or crowd-sourced, but used a combination blended with some clever detective work. We are impressed...
Skype Security Flaw
Just announced: The researchers found several properties of Skype that can track not only users' locations over time, but also their peer-to-peer (P2P) file-sharing activity, according to a summary of the findings on the NYU-Poly web site. Earlier this year, a German researcher found a cross-site scripting flaw in Skype that could allow someone to change an account password without...
Tagging People with Invisible Ink
In Montreal, police marked protesters with invisible ink to be able to identify them later. The next step is going to be a spray that marks people surreptitiously, maybe with SmartWater....
Security Problems with U.S. Cloud Providers
Invasive U.S. surveillance programs, either illegal like the NSA's wiretapping of AT&T phone lines or legal as authorized by the PATRIOT Act, are causing foreign companies to think twice about putting their data in U.S. cloud systems. I think these are legitimate concerns. I don't trust the U.S. government, law or no law, not to spy on my data if...
Recent Developments in Full Disclosure
Last week, I had a long conversation with Robert Lemos over an article he was writing about full disclosure. He had noticed that companies have recently been reacting more negatively to security researchers publishing vulnerabilities about their products. The debate over full disclosure is as old as computing, and I've written about it before. Disclosing security vulnerabilities is good for...
GCHQ Hacking Contest
GCHQ is holding a hacking contest to drum up ">new recruits....
Carrier IQ Spyware
Spyware on many smart phones monitors your every action, including collecting individual keystrokes. The company that makes and runs this software on behalf of different carriers, Carrier IQ, freaked when a security researcher outed them. It initially claimed it didn't monitor keystrokes -- an easily refuted lie -- and threatened to sue the researcher. It took EFF getting involved to...
I Received an Honorary Doctorate
Last weekend, I received an honorary PhD from the University of Westminster, in London. I have had mixed feelings about this since I was asked early this year. The best piece of advice I've read is: "It's a great honor, but it is an honor, not a degree."...
Hacking Printers and Setting Them on Fire
It's the kind of research result that screams hype, but online attacks that have physical-world consequences are fundamentally a different sort of threat. I suspect we'll learn more about what's actually possible in the coming weeks. HP has issued a rebuttal....
Walls as Security Theater
Interesting essay on walls and their effects: Walls, then, are built not for security, but for a sense of security. The distinction is important, as those who commission them know very well. What a wall satisfies is not so much a material need as a mental one. Walls protect people not from barbarians, but from anxieties and fears, which can...
Full-Disk Encryption Works
According to researchers, full-disk encryption is hampering police forensics. The authors of the report suggest there are some things law enforcement can do, but they all must happen prior to a drive being buttoned up by encryption. Specifically, they say that law enforcement should stop turning computers off to bring them to another location for study, doing so only causes...
Status Report: Liars and Outliers
After a long and hard year, Liars and Outliers is done. I submitted the manuscript to the publisher on Oct 1, got edits back from both an outside editor and a copyeditor about a week later, spent another week integrating the comments and edits, and submitted the final manuscript to the publisher just before Thanksgiving. Now it's being laid out,...
Full Disclosure in Biology
The debate over full disclosure in computer security has been going on for the better part of two decades now. The stakes are much higher in biology: The virus is an H5N1 avian influenza strain that has been genetically altered and is now easily transmissible between ferrets, the animals that most closely mimic the human response to flu. Scientists believe...
Bad CIA Operational Security
I have no idea if this story about CIA spies in Lebanon is true, and it will almost certainly never be confirmed or denied: But others inside the American intelligence community say sloppy "tradecraft" -- the method of covert operations -- by the CIA is also to blame for the disruption of the vital spy networks. In Beirut, two Hezbollah...
Security Systems as a Marker for High-Value Targets
If something is protected by heavy security, it's obviously worth stealing. Here's an example from the insect world: Maize plants, like many others, protect themselves with poisons. They pump their roots with highly toxic insecticides called BXDs, which deters hungry mandibles. But these toxins dont come free. The plant needs energy to act as its own pharmacist, so it distributes...
Shopper Surveillance Using Cell Phones
Electronic surveillance is becoming so easy that even marketers can do it: The cellphone tracking technology, called Footpath, is made by Path Intelligence Ltd., a Portsmouth, U.K.-based company. It uses sensors placed throughout the mall to detect signals from mobile phones and track their path around the mall. The sensors cannot gather phone numbers or other identifying data, or intercept...
Spider Webs Contain Ant Poison
Shichang Zhang, Teck Hui Koh, Wee Khee Seah, Yee Hing Lai, Mark A. Elgar, and Daiqin Li (2011), "A Novel Property of Spider Silk: Chemical Defence Against Ants," Proceedings of the Royal Society B: Biological Sciences (full text is behind a paywall). Abstract: Spider webs are made of silk, the properties of which ensure remarkable efficiency at capturing prey. However,...
The DHS Partners with Major League Soccer to Promote Fear
It seems to be harder and harder to keep people scared: The Departments "If You See Something, Say Something"" partnership with the MLS Cup will feature a "If You See Something, Say Something"" graphic that will aired on the video board during the MLS Cup championship game in Carson City, Calif. Safety messaging will also be printed on the back...
Friday Squid Blogging: Cephalopod Art Conference
There was an interdisciplinary cephalopod art conference earlier this year, in Minneapolis. Videos of the conference are available online. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Android Malware
The Android platform is where the malware action is: What happens when anyone can develop and publish an application to the Android Market? A 472% increase in Android malware samples since July 2011. These days, it seems all you need is a developer account, that is relatively easy to anonymize, pay $25 and you can post your applications. [...] In...
Free Cryptography Class
Dan Boheh of Stanford University is teaching a free cryptography class starting in January....
Hack Against SCADA System
A hack against a SCADA system controlling a water pump in Illinois destroyed the pump. We know absolutely nothing here about the attack or the attacker's motivations. Was it on purpose? An accident? a fluke?...
Friday Squid Blogging: Squid Camouflage
Some squid can switch their camouflage instantly. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
A Link between Altruism and Fairness
I write a lot about altruism, fairness, and cooperation in my new book (out in February!), and this sort of thing interests me a lot: In a new study, researchers had 15-month old babies watch movies of a person distributing crackers or milk to two others, either evenly or unevenly. Babies look at things longer when they're surprised, so measuring...
EU Bans X-Ray Body Scanners
The European Union has banned X-ray full body scanners at airports. Millimeter wave scanners are allowed as long as they conform to privacy guidelines. Under the new EU legislation the use of security scanners is only allowed in accordance with minimum conditions such as for example that: security scanners shall not store, retain, copy, print or retrieve images; any unauthorised...
Detecting Psychopaths by their Speech Patterns
Interesting: The researchers interviewed 52 convicted murderers, 14 of them ranked as psychopaths according to the Psychopathy Checklist-Revised, a 20-item assessment, and asked them to describe their crimes in detail. Using computer programs to analyze what the men said, the researchers found that those with psychopathic scores showed a lack of emotion, spoke in terms of cause-and-effect when describing their...
Paul Kocher
Really nice article on crypotographer Paul Kocher and his company, Cryptography Research, Inc....
Sam Harris on Self-Defense
I thought this was very interesting. His three principles are: Avoid dangerous people and dangerous places. Do not defend your property. Respond immediately and escape....
Identity Theft Call Center
There's a group who charges to make social engineering calls to obtain missing personal information for identity theft. This doesn't surprise me at all. Fraud is a business, too....
More SSL Woes
From Mikko Hypponen: "We found a malware sample. Which was signed. With a valid certificate. Belonging to the Government of Malaysia."...
Remotely Opening Prison Doors
This seems like a bad vulnerability: Researchers have demonstrated a vulnerability in the computer systems used to control facilities at federal prisons that could allow an outsider to remotely take them over, doing everything from opening and overloading cell door mechanisms to shutting down internal communications systems. [...] The researchers began their work after Strauchs was called in by a...
Commentary on Strong Passwords
It turns out that "2bon2btitq" is not a strong password....
Advanced Persistent Threat (APT)
It's taken me a few years, but I've come around to this buzzword. It highlights an important characteristic of a particular sort of Internet attacker. A conventional hacker or criminal isn't interested in any particular target. He wants a thousand credit card numbers for fraud, or to break into an account and turn it into a zombie, or whatever. Security...
Unlocking any iPad2 using a Smart Cover
This security bug is just plain weird....
Cutting Wallets Out of Drunks' Pockets on New York City Subways
It's a crime with finesse: But he is actually a middle-aged or older man who has been doing this for a very long time. And he is a fading breed. "It's like a lost art," the lieutenant said. "It's all old-school guys who cut the pocket. They die off." And they do not seem to be replacing themselves, he said....
Fake Documents that Alarm if Opened
This sort of thing seems like a decent approach, but it has a lot of practical problems: In the wake of Wikileaks, the Department of Defense has stepped up its game to stop leaked documents from making their way into the hands of undesirables -- be they enemy forces or concerned citizens. A new piece of software has created a...
Friday Squid Blogging: Star Trek IV, now with Squid
Someone edited Star Trek IV, removing the whales and replacing them with giant squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Weaponized UAV Drones in the Hands of Local Police
Why does anyone think this is a good idea? The police in Montgomery County and area north of Houston, Texas is the first local police in the united States to deploy a drone that can carry weapons. [...] He said they are designed to carry weapons for local law enforcement. "The aircraft has the capability to have a...
Journal Article on Cyberwar
From the Journal of Strategic Studies: "Cyber War Will Not Take Place" (full article is behind a paywall): Abstract: For almost two decades, experts and defense establishments the world over have been predicting that cyber war is coming. But is it? This article argues in three steps that cyber war has never happened in the past, that cyber war does...
Underage Children on Facebook
Interesting research on how parents help their children lie about their age to get onto Facebook. One reaction to our data might be that companies should not be allowed to restrict access to children on their sites. Unfortunately, getting the parental permission required by COPPA is technologically difficult, financially costly, and ethically problematic. Sites that target children take on this...
DARPA Cyber Colloquium
I note that the three "industry leaders" speaking at the DARPA Cyber Colloquium next week have about 75 years of government experience between them....
Cell Phone Surveillance System
I was not surprised that police forces are buying this system, but at its capabilities. Britain's largest police force is operating covert surveillance technology that can masquerade as a mobile phone network, transmitting a signal that allows authorities to shut off phones remotely, intercept communications and gather data about thousands of users in a targeted area. The surveillance system has...
Another ATM Theft Tactic
This brazen tactic is from Malaysia. Robbers sabotage the machines, and then report the damage to the bank. When the banks send repair technicians to open and repair the machines, the robbers take the money at gunpoint. It's hardly a technology-related attack. But from what I know about ATM machines, the security of the money safe inside the machine is...
Friday Squid Blogging: Video of Kid Eating Squid
It's hard to tell if he likes it. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Full Extent of the Attack that Compromised RSA in March
Brian Kerbs has done the analysis; it's something like 760 companies that were compromised. Among the more interesting names on the list are Abbott Labs, the Alabama Supercomputer Network, Charles Schwabb & Co., Cisco Systems, eBay, the European Space Agency, Facebook, Freddie Mac, Google, the General Services Administration, the Inter-American Development Bank, IBM, Intel Corp., the Internal Revenue Service (IRS),...
Secret Codes in Bacteria
Neat: Researchers have invented a new form of secret messaging using bacteria that make glowing proteins only under certain conditions. In addition to being useful to spies, the new technique could also allow companies to encode secret identifiers into crops, seeds, or other living commodities. [...] The new scheme replaces the fuse with seven colonies of Escherichia coli bacteria, each...
The Security of SSL
EFF reports on the security of SSL: The most interesting entry in that table is the "CA compromise" one, because those are incidents that could affect any or every secure web or email server on the Internet. In at least 248 cases, a CA chose to indicate that it had been compromised as a reason for revoking a cert. Such...
Cracking the Copiale Cipher
I don't follow historical cryptography, so all of this comes as a surprise to me. But something called the Copiale Cipher from the 18th Century has been cracked....
Demands from Law Enforcement for Google Data
Google releases statistics: Google received more than 15,600 requests in the January-June period, 10 percent more than the final six months of last year. The requests in the latest period spanned more than 25,400 individual accounts worldwide - a tiny fraction of Google's more than billion users. [...] The highest volume of government demands for user data came from the...
Twofish Mentioned in Thriller Novel
I've been told that the Twofish encryption algorithm is mentioned in the book Abuse of Power, in the first paragraph of Chapter 3. Did rhe terrorists use it? Did our hero break it? I am unlikely to read it; can someone scan the page for me....
NSA Acronyms
The second document in this file is the recently unclassified "Guide to Historical Cryptologic Acronyms and Abbreviations, 1940-1980," from the NSA Note that there are still some redactions....
Blue Coat Products Enable Web Censorship in Syria
It's illegal for Blue Coat to sell its technology for this purpose, but there are lots of third-parties who are willing to act as middlemen: "Blue Coat does not sell to Syria. We comply with US export laws and we do not allow our partners to sell to embargoed countries," [Blue Coat spokesman Steve] Schick told the Bureau. "In addition,...
Facebook Patent to Track Users Even When They are Not Logged In to Facebook
Patent number 2,011,023,240: Communicating Information in a Social Network System about Activities from Another Domain Abstract: In one embodiment, a method is described for tracking information about the activities of users of a social networking system while on another domain. The method includes maintaining a profile for each of one or more users of the social networking system, each profile...
Random Passwords in the Wild
Interesting analysis: the hacktivist group Anonymous hacked into several BART servers. They leaked part of a database of users from myBART, a website which provides frequent BART riders with email updates about activities near BART stations. An interesting aspect of the leak is that 1,346 of the 2,002 accounts seem to have randomly-generated passwords-a rare opportunity to study this approach...
New Malware: Duqu
A newly discovered piece of malware, Duqu, seems to be a precursor to the next Stuxnet-like worm and uses some of the same techniques as the original....
Discovering What Facebook Knows About You
Things are getting interesting in Europe: Max is a 24 year old law student from Vienna with a flair for the interview and plenty of smarts about both technology and legal issues. In Europe there is a requirement that entities with data about individuals make it available to them if they request it. That's how Max ended up with a...
Friday Squid Blogging: Prehistoric Sentient SquidOr Not
There's big news in the world of giant squid: Researchers initially thought that this strange grouping of 45-foot-long marine reptiles had either died en masse from a poisonous plankton bloom or had become stranded in shallow water. But recent geological analysis of the fossil site indicates that the park was deep underwater when these shonisaurs swam the prehistoric seas. So...
Burglars Tip Off Police About Bigger Crime
I find this fascinating: A central California man has been arrested for possession of child pornography, thanks to a tip from burglars who robbed the man's property, authorities said. I am reminded of the UK story of a burglar finding some military secrets on a laptop -- or perhaps a USB drive -- that he stole, and returning them with...
Weird World War II Security Puzzle
Read this. Anyone have any ideas?...
Official Malware from the German Police
The Chaos Computer Club has disassembled and analyzed the Trojan used by the German police for legal intercept. In its default mode, it takes regular screenshots of the active window and sends it to the police. It encrypts data in AES Electronic Codebook mode with -- are you ready? -- a fixed key across all versions. There's no authentication built...
New Attacks on CAPTCHAs
Nice research: Abstract: We report a novel attack on two CAPTCHAs that have been widely deployed on the Internet, one being Google's home design and the other acquired by Google (i.e. reCAPTCHA). With a minor change, our attack program also works well on the latest ReCAPTCHA version, which uses a new defence mechanism that was unknown to us when we...
U.S. Drones Have a Computer Virus
You'd think we would be more careful than this: A computer virus has infected the cockpits of Americas Predator and Reaper drones, logging pilots every keystroke as they remotely fly missions over Afghanistan and other warzones. [...] "We keep wiping it off, and it keeps coming back," says a source familiar with the network infection, one of three that told...
Friday Squid Blogging: Hundreds of Squid Wash Up on Southern California Beaches
Humboldt squid are washing up on beaches across Southern California. Seems like it's no big deal; the squid just swam too close to shore....
Security Seals on Voting Machines
Related to this blog post from Wednesday, here's a paper that looks at security seals on voting machines. Andrew W. Appel, "Security Seals on Voting Machines: A Case Study," ACM Transactions on Information and System Security, 14 (2011): 129. Abstract: Tamper-evident seals are used by many states' election officials on voting machines and ballot boxes, either to protect the computer...
FBI-Sponsored Backdoors
From a review of Susan Landau's Surveillance or Security?: To catch up with the new technologies of malfeasance, FBI director Robert Mueller traveled to Silicon Valley last November to persuade technology companies to build "backdoors" into their products. If Muellers wish were granted, the FBI would gain undetected real-time access to suspects Skype calls, Facebook chats, and other online communicationsand...
Status Report: Liars and Outliers
Last weekend, I completely reframed the book. I realized that the book isn't about security. It's about trust. I'm writing about how society induces people to behave in the group interest instead of some competing personal interest. It's obvious that society needs to do this; otherwise, it can never solve collective action problems. And as a social species, we have...
Insider Attack Against Diebold Voting Machines
This is both news and not news: Indeed, the Argonne team's attack required no modification, reprogramming, or even knowledge, of the voting machine's proprietary source code. It was carried out by inserting a piece of inexpensive "alien electronics" into the machine. It's not news because we already know that if you have access to the internals of a voting machine,...
Security Cartoon
Nice cartoon on the problems of content filtering....
National Cybersecurity Awareness Month
October is National Cybersecurity Awareness Month, sponsored by the Department of Homeland Security. The website has some sample things you can do to to celebrate, but they're all pretty boring. Surely we can do better. Post your suggestions in comments....
Isaac Asimov on Security Theater
A great find: In his 1956 short story, "Let's Get Together," Isaac Asimov describes security measures proposed to counter a terrorist threat: "Consider further that this news will leak out as more and more people become involved in our countermeasures and more and more people begin to guess what we're doing. Then what? The panic might do us more harm...
HTC Android Vulnerability
Custom HTC firmware breaks standard permissions and allows rogue apps to access location, address book, and account info without authorization....
Friday Squid Blogging: Interesting Squid Recipes
Plus a slide show of pretty dishes....
Insecure Chrome Extensions
An analysis of extensions to the Chrome browser shows that 25% of them are insecure: We reviewed 100 Chrome extensions and found that 27 of the 100 extensions leak all of their privileges to a web or WiFi attacker. Bugs in extensions put users at risk by leaking private information (like passwords and history) to web and WiFi attackers. Web...
Problems with Mac OS X Lion Passwords
Seems like some dumb mistakes. News article....
Tor Arms Race
Iran blocks Tor, and Tor releases a workaround on the same day. How did the filter work technically? Tor tries to make its traffic look like a web browser talking to an https web server, but if you look carefully enough you can tell some differences. In this case, the characteristic of Tor's SSL handshake they looked at was the...
Friday Squid Blogging: Sex Life of Deep-Sea Squid
There's evidence of indiscriminate fertilization in deep-sea squid. They mate with any other squid the encounter, male or female. This unusual behaviour, they said, may be explained by the fact the squid is boosting its chances of successfully passing on its genes in the challenging environment it lives in. In the Royal Society paper the team writes: "In the deep,...
Man-in-the-Middle Attack Against SSL 3.0/TLS 1.0
It's the Browser Exploit Against SSL/TLS Tool, or BEAST: The tool is based on a blockwise-adaptive chosen-plaintext attack, a man-in-the-middle approach that injects segments of plain text sent by the target's browser into the encrypted request stream to determine the shared key. The code can be injected into the user's browser through JavaScript associated with a malicious advertisement distributed through...
Three Emerging Cyber Threats
On Monday I participated a panel at the Information Systems Forum in Berlin. The moderator asked us what the top three emerging threats were in cyberspace. I went last, and decided to focus on the top three threats that are not criminal: The Rise of Big Data. By this I mean industries that trade on our data. These include traditional...
An Interesting Software Liability Proposal
This proposal is worth thinking about. Clause 1. If you deliver software with complete and buildable source code and a license that allows disabling any functionality or code by the licensee, then your liability is limited to a refund. This clause addresses how to avoid liability: license your users to inspect and chop off any and all bits of your...
U.S.-Australia Cyberwar Treaty
The long-standing ANZUS military treaty now includes cyberspace attacks: According to Reuters, the decision was made in discussions between the two countries this week. The extension of the treaty would mean that a cyber-attack on either country would be considered an attack on both. Exactly what this means in practice is less clear: practically every government with a connection to...
Shifting Risk Instead of Reducing Risk
Risks of teen driving: For more than a decade, California and other states have kept their newest teen drivers on a tight leash, restricting the hours when they can get behind the wheel and whom they can bring along as passengers. Public officials were confident that their get-tough policies were saving lives. Now, though, a nationwide analysis of crash data...
Complex Electronic Banking Fraud in Malaysia
The interesting thing about this attack is how it abuses a variety of different security systems. Investigations revealed that the syndicate members had managed to retrieve personal particulars including the usernames, passwords from an online banking kiosk at a bank in Petaling Jaya and even obtained the transaction authorisation code (TAC) which is sent out by the bank to the...
Pretty Creepy Type of Cyberstalking
Luis "Guicho" Mijangos, "sextortionist."...
The Effectiveness of Plagiarism Detection Software
As you'd expect, it's not very good: But this measure [Turnitin] captures only the most flagrant form of plagiarism, where passages are copied from one document and pasted unchanged into another. Just as shoplifters slip the goods they steal under coats or into pocketbooks, most plagiarists tinker with the passages they copy before claiming them as their own. In other...
Identifying Speakers in Encrypted Voice Communication
I've already written how it is possible to detect words and phrases in encrypted VoIP calls. Turns out it's possible to detect speakers as well: Abstract: Most of the voice over IP (VoIP) traffic is encrypted prior to its transmission over the Internet. This makes the identity tracing of perpetrators during forensic investigations a challenging task since conventional speaker recognition...
Domain-in-the-Middle Attacks
It's an easy attack. Register a domain that's like your target except for a typo. So it would be countrpane.com instead of counterpane.com, or mailcounterpane.com instead of mail.counterpane.com. Then, when someone mistypes an e-mail address to someone at that company and you receive it, just forward it on as if nothing happened. These are called "doppleganger domains." To test the...
Sharing Security Information and the Prisoner's Dilemma
New paper: Dengpan Liu, Yonghua Ji, and Vijay Mookerjee (2011), "Knowledge Sharing and Investment Decisions in Information Security," Decision Support Systems, in press. Abstract: We study the relationship between decisions made by two similar firms pertaining to knowledge sharing and investment in information security. The analysis shows that the nature of information assets possessed by the two firms, either complementary...
A Status Report: "Liars and Outliers"
It's been a long hard year, but the book is almost finished. It's certainly the most difficult book I've ever written, mostly because I've had to learn academic fields I don't have a lot of experience in. But the book is finally coming together as a coherent whole, and I am optimistic that the results will prove to be worth...
Risk Tolerance and Culture
This is an interesting study on cultural differences in risk tolerance. The Cultures of Risk Tolerance Abstract: This study explores the links between culture and risk tolerance, based on surveys conducted in 23 countries. Altogether, more than 4,000 individuals participated in the surveys. Risk tolerance is associated with culture. Risk tolerance is relatively low in countries where uncertainty avoidance is...
TSA Administrator John Pistole on the Future of Airport Security
There's a lot here that's worth watching. He talks about expanding behavioral detection. He talks about less screening for "trusted travelers." So, what do the next 10 years hold for transportation security? I believe it begins with TSA's continued movement toward developing and implementing a more risk-based security system, a phrase you may have heard the last few months. When...
Human Pattern-Matching Failures in Airport Screening
I've written about this before: the human brain just isn't suited to finding rare anomalies in a screening situation. The Role of the Human Operator in Image-Based Airport Security Technologies Abstract: Heightened international concerns relating to security and identity management have led to an increased interest in security applications, such as face recognition and baggage and passenger screening at airports....
Risk Perception and Terrorism
I've been posting about a lot of academic articles of late, because that's what I'm reading. Here's another. Clinton M. Jenkin (2006), Risk Perception and Terrorism, Homeland Security Affairs....
More 9/11 Retrospectives
Joseph Stiglitz on the price of 9/11. How 9/11 changed surveillance. New scientific research as a result of 9/11. A good controversial piece. The day we lost our privacy and power. The probability of another 9/11-magnitude terrorist attack. To justify the current U.S. spending on homeland security -- not including our various official and unofficial wars -- we'd have to...
ACLU Report on the War on Terror
This report is really good: "A Call to Courage: Reclaiming Our Liberties Ten Years After 9/11."...
Friday Squid Blogging: Beautiful Squid Drawings
From Italy. As before, use the comments to this post to write about and discuss security stories that don't have their own post....
New Lows in Secret Questions
I've already written about secret questions, the easier-to-guess low-security backup password that sites want you to have in case you forget your harder-to-remember higher-security password. Here's a new one, courtesey of the National Archives: "What is your preferred internet password?" I have been told that Priceline has the same one, which implies that this is some third-party login service or...
The Legality of Government Critical Infrastructure Monitoring
Mason Rice, Robert Miller, and Sujeet Shenoi (2011), "May the US Government Monitor Private Critical Infrastructure Assets to Combat Foreign Cyberspace Threats?" International Journal of Critical Infrastructure Protection, 4 (April 2011): 313. Abstract: The government owns the entire US airspaceit can install radar systems, enforce no-fly zones and interdict hostile aircraft. Since the critical infrastructure and the associated cyberspace are...
Outing a CIA Agent
Interesting article on how difficult it is to keep an identity secret in the information age....
Optimizing Airport Security
New research: Adrian J. Lee and Sheldon H. Jacobson (2011), "The Impact of Aviation Checkpoint Queues on Optimizing Security Screening Effectiveness," Reliability Engineering & System Safety, 96 (August): 900911. Abstract: Passenger screening at aviation security checkpoints is a critical component in protecting airports and aircraft from terrorist threats. Recent developments in screening device technology have increased the ability to detect...
Where Are All the Terrorists?
From Foreign Policy: "Why Is It So Hard to Find a Suicide Bomber These Days?" And from Stratfor: "Why al Qaeda is Unlikely to Execute Another 9/11." Me from May 2010: "Where Are All the Terrorist Attacks?"...
Friday Squid Blogging: SQUIDS Game
It's coming to the iPhone and iPad, then to other platforms: In SQUIDS, players will command a small army of stretchy, springy sea creatures to protect an idyllic underwater kingdom from a sinister emerging threat. An infectious black ooze is spreading through the lush seascape, turning ordinary crustaceans into menacing monsters. Now a plucky team of Squidseach with unique personalities,...
The Efficacy of Post-9/11 Counterterrorism
This is an interesting article. The authors argue that the whole war-on-terror nonsense is useless -- that's not new -- but that the security establishment knows it doesn't work and abandoned many of the draconian security measures years ago, long before Obama became president. All that's left of the war on terror is political, as lawmakers fund unwanted projects in...
A Professional ATM Theft
Fidelity National Information Services Inc. (FIS) lost $13M to an ATM theft earlier this year: KrebsOnSecurity recently discovered previously undisclosed details of the successful escapade. According to sources close to the investigation, cyber thieves broke into the FIS network and targeted the Sunrise platform's "open-loop" prepaid debit cards. The balances on these prepaid cards aren't stored on the cards themselves;...
Unredacted U.S. Diplomatic WikiLeaks Cables Published
It looks as if the entire mass of U.S. diplomatic cables that WikiLeaks had is available online somewhere. How this came about is a good illustration of how security can go wrong in ways you don't expect. Near as I can tell, this is what happened: In order to send the Guardian the cables, WikiLeaks encrypted them and put them...
Forged Google Certificate
There's been a forged Google certificate out in the wild for the past month and a half. Whoever has it -- evidence points to the Iranian government -- can, if they're in the right place, launch man-in-the-middle attacks against Gmail users and read their mail. This isn't Google's mistake; the certificate was issued by a Dutch CA that has nothing...
Job Opening: TSA Public Affairs Specialist
This job can't be fun: This Public Affairs Specialist position is located in the Office of Strategic Communications and Public Affairs (SCPA), Transportation Security Administration (TSA), Department of Homeland Security (DHS). If selected for this position, you will serve as the Press Secretary and senior representative/liaison working with Federal and stakeholder partners. You will utilize your expert knowledge and mastery...
The Effects of Social Media on Undercover Policing
Social networking sites make it very difficult, if not impossible, to have undercover police officers: "The results found that 90 per cent of female officers were using social media compared with 81 per cent of males." The most popular site was Facebook, followed by Twitter. Forty seven per cent of those surveyed used social networking sites daily while another 24...
Facebook Privacy Guide
It's actually pretty good. Also note that the site is redesigning its privacy. As we learned from Microsoft, nothing motivates a company to improve its security like competition....
Details of the RSA Hack
We finally have some, even though the company isn't talking: So just how well crafted was the e-mail that got RSA hacked? Not very, judging by what F-Secure found. The attackers spoofed the e-mail to make it appear to come from a "web master" at Beyond.com, a job-seeking and recruiting site. Inside the e-mail, there was just one line of...
Screenshots of Chinese Hacking Tool
It's hard to know how serious this really is: The screenshots appear as B-roll footage in the documentary for six secondsbetween 11:04 and 11:10 minutes -- showing custom built Chinese software apparently launching a cyber-attack against the main website of the Falun Gong spiritual practice, by using a compromised IP address belonging to a United States university. As of Aug....
Friday Squid Blogging: Squid Fishing in Ulleungdo, Korea
The industry is in decline: A generation ago, most of the island's 10,000 residents worked in the squid industry, either as sellers like Kim or as farmer-fishermen who toiled in the fields each winter and went to sea during summer. Ulleungdo developed a reputation for large, tasty squid that were once exported to the mainland and Japan. The volcanic island,...
Preventing the Theft of Wire Cutters
This is a picture of a pair of wire cutters secured to a table with a wire. Someone isn't thinking this through.......
The Problem with Using the Cold War Metaphor to Describe Cyberspace Risks
Nice essay on the problems with talking about cyberspace risks using "Cold War" metaphors: The problem with threat inflation and misapplied history is that there are extremely serious risks, but also manageable responses, from which they steer us away. Massive, simultaneous, all-encompassing cyberattacks on the power grid, the banking system, transportation networks, etc. along the lines of a Cold War...
Terrorism in the U.S. Since 9/11
John Mueller and his students analyze the 33 cases of attempted terrorism in the U.S. since 9/11. So few of them are actually real, and so many of them were created or otherwise facilitated by law enforcement....
Funniest Joke at the Edinburgh Fringe Festival
Nick Helm won an award for the funniest joke at the Edinburgh Fringe Festival: Nick Helm: "I needed a password with eight characters so I picked Snow White and the Seven Dwarves." Note that two other jokes were about security: Tim Vine: "Crime in multi-storey car parks. That is wrong on so many different levels." Andrew Lawrence: "I admire these...
Moving 211 Tons of Gold
The security problems associated with moving $12B in gold from London to Venezuela. It seems to me that Chávez has four main choices here. He can go the FTs route, and just fly the gold to Caracas while insuring each shipment for its market value. He can go the Spanish route, and try to transport the gold himself, perhaps making...
The Security Risks of Not Teaching Malware
Essay by George Ledin on the security risks of not teaching students malware....
Stealing ATM PINs with a Thermal Camera
It's easy: Researchers from UCSD pointed thermal cameras towards plastic ATM PIN pads and metal ATM PIN pads to test how effective they were at stealing PIN numbers. The thermal cams didn't work against metal pads but on plastic pads the success rate of detecting all the digits was 80% after 10 seconds and 60% after 45 seconds. If you...
Smartphone Keystroke Logging Using the Motion Sensor
Clever: "When the user types on the soft keyboard on her smartphone (especially when she holds her phone by hand rather than placing it on a fixed surface), the phone vibrates. We discover that keystroke vibration on touch screens are highly correlated to the keys being typed." Applications like TouchLogger could be significant because they bypasses protections built into both...
Security for Implanted Medical Devices
Worried about someone hacking your implanted medical devices? Here's a signal-jamming device you can wear....
Cheating at Casinos with Hidden Cameras
Sleeve cameras aren't new, but they're now smaller than ever and the cheaters are getting more sophisticated: In January, at the newly opened $4-billion Cosmopolitan casino in Las Vegas, a gang called the Cutters cheated at baccarat. Before play began, the dealer offered one member of the group a stack of eight decks of cards for a pre-game cut. The...
Movie-Plot Threat: Open Airplane Cockpit Doors During Bathroom Breaks
James Fallows has a nice debunking of a movie-plot threat....
How Microsoft Develops Security Patches
I thought this was an interesting read....
Pseudonymity
Long essay on the value of pseudonymity. From the conclusions: Here lies the huge irony in this discussion. Persistent pseudonyms aren't ways to hide who you are. They provide a way to be who you are. You can finally talk about what you really believe; your real politics, your real problems, your real sexuality, your real family, your real self....
Looking Backward at Terrorism
Nice essay on the danger of too much security: The great lie of the war on terror is not that we can sacrifice a little liberty for greater security. It is that fear can be eliminated, and that all we need to do to improve our society is defeat terrorism, rather than look at the other causes of our social,...
The Dilemma of Counterterrorism Policy
Any institution delegated with the task of preventing terrorism has a dilemma: they can either do their best to prevent terrorism, or they can do their best to make sure they're not blamed for any terrorist attacks. I've talked about this dilemma for a while now, and it's nice to see some research results that demonstrate its effects. A. Peter...
Steven Pinker on Terrorism
It's almost time for a deluge of "Ten Years After 9/11" essays. Here's Steven Pinker: The discrepancy between the panic generated by terrorism and the deaths generated by terrorism is no accident. Panic is the whole point of terrorism, as the root of the word makes clear: "Terror" refers to a psychological state, not an enemy or an event. The...
New Attack on AES
"Biclique Cryptanalysis of the Full AES," by Andrey Bogdanov, Dmitry Khovratovich, and Christian Rechberger. Abstract. Since Rijndael was chosen as the Advanced Encryption Standard, improving upon 7-round attacks on the 128-bit key variant or upon 8-round attacks on the 192/256-bit key variants has been one of the most difficult challenges in the cryptanalysis of block ciphers for more than a...
Alarm Geese
A prison in Brazil uses geese as part of its alarm system. There's a long tradition of this. Circa 400 BC, alarm geese alerted a Roman citadel to a Gaul attack....
Security by Default
Nice essay by Christopher Soghoian on why cell phone and Internet providers need to enable security options by default....
Search Redirection and the Illicit Online Prescription Drug Trade
Really interesting research. Search-redirection attacks combine several well-worn tactics from black-hat SEO and web security. First, an attacker identifies high-visibility websites (e.g., at universities) that are vulnerable to code-injection attacks. The attacker injects code onto the server that intercepts all incoming HTTP requests to the compromised page and responds differently based on the type of request: Requests from search-engine crawlers...
New, Undeletable, Web Cookie
A couple of weeks ago Wired reported the discovery of a new, undeletable, web cookie: Researchers at U.C. Berkeley have discovered that some of the nets most popular sites are using a tracking service that cant be evaded -- even when users block cookies, turn off storage in Flash, or use browsers incognito functions. The Wired article was very short...
Interview with Me
Here's an interview with me from the Homeland Security News Wire....
Friday Squid Blogging: Giant Squid Painted on Canal Narrowboat
Pretty. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Liars and Outliers Cover
My new book, Liars and Outliers, has a cover. Publication is still scheduled for the end of February -- in time for the RSA Conference -- assuming I finish the manuscript in time....
Rat that Applies Poison to its Fur
The African crested rat applies tree poison to its fur to make itself more deadly. The researchers made their discovery after presenting a wild-caught crested rat with branches and roots of the Acokanthera tree, whose bark includes the toxin ouabain. The animal gnawed and chewed the tree's bark but avoided the nontoxic leaves and fruit. The rat then applied the...
Counterfeit Pilot IDs and Uniforms Will Now Be Sufficient to Bypass Airport Security
This seems like a really bad idea: ...the Transportation Security Administration began a program Tuesday allowing pilots to skirt the security-screening process. The TSA has deployed approximately 500 body scanners to airports nationwide in a bid to prevent terrorists from boarding domestic flights, but pilots don't have to go through the controversial nude body scanners or other forms of screening....
Security Flaws in Encrypted Police Radios
"Why (Special Agent) Johnny (Still) Cant Encrypt: A Security Analysis of the APCO Project 25 Two-Way Radio System," by Sandy Clark, Travis Goodspeed, Perry Metzger, Zachary Wasserman, Kevin Xu, and Matt Blaze. Abstract: APCO Project 25a ( P25 ) is a suite of wireless communications protocols used in the US and elsewhere for public safety two-way (voice) radio systems. The protocols include...
Friday Squid Blogging: Smaller Male Squid Have Bigger Sperm
Loligo bleekeri males have two different reproductive strategies, depending on their size. It's kind of like a covert channel....
GPRS Hacked
Just announced: Nohl's group found a number of problems with GPRS. First, he says, lax authentication rules could allow an attacker to set up a fake cellular base station and eavesdrop on information transmitted by users passing by. In some countries, they found that GPRS communications weren't encrypted at all. When they were encrypted, Nohl adds, the ciphers were often...
"Taxonomy of Operational Cyber Security Risks"
I'm a big fan of taxonomies, and this -- from Carnegie Mellon -- seems like a useful one: The taxonomy of operational cyber security risks, summarized in Table 1 and detailed in this section, is structured around a hierarchy of classes, subclasses, and elements. The taxonomy has four main classes: actions of people -- action, or lack of action, taken...
Free-Riding on Plant Security Countermeasures
There's a security story from biology I've used a few times: plants that use chemicals to call in airstrikes by wasps on the herbivores attacking them. This is a new variation: a species of orchid that emits the same signals as a trick, to get pollinated....
MRI Lie Detectors
An article from Salon -- lots of interesting research. My previous blog post on the topic....
New Bank-Fraud Trojan
Nasty: The German Federal Criminal Police (the Bundeskriminalamt or BKA for short) recently warned consumers about a new Windows malware strain that waits until the victim logs in to his bank account. The malware then presents the customer with a message stating that a credit has been made to his account by mistake, and that the account has been frozen...
Business Week on The Cyberwar Arms Race
I've been using the phrase "arms race" to describe the world's militaries' rush into cyberspace for a couple of years now. Here's a good article on the topic that uses the same phrase....
Friday Squid Blogging: Severed Hand is Actually A Dried Squid
I just can't make this stuff up: A report of a severed hand found at an Oahu seabird sanctuary has turned out to be dried squid. Remember: if you see something, say something. Again this week, please use the squid post to talk about the security stories in the news that I didn't cover....
Zodiac Cipher Cracked
I admit I don't pay much attention to pencil-and-paper ciphers, so I knew nothing about the Zodiac cipher. Seems it has finally been broken: The Zodiac Killer was a serial killer who preyed on couples in Northern California in the years between 1968 and 1970. Of his seven confirmed victims, five died. More victims and attacks are suspected. The killer...
German Police Call Airport Full-Body Scanners Useless
I'm not surprised: The weekly Welt am Sonntag, quoting a police report, said 35 percent of the 730,000 passengers checked by the scanners set off the alarm more than once despite being innocent. The report said the machines were confused by several layers of clothing, boots, zip fasteners and even pleats, while in 10 percent of cases the passenger's posture...
Hacking Lotteries
Two items on hacking lotteries. The first is about someone who figured out how to spot winner in a scratch-off tic-tac-toe style game, and a daily draw style game where expcted payout can exceed the ticket price. The second -- behind a paywall, sorry -- is about someone who has won the lottery four times, with speculation that she had...
New Information on the Inventor of the One-Time Pad
Seems that the one-time pad was not first invented by Vernam: He could plainly see that the document described a technique called the one-time pad fully 35 years before its supposed invention during World War I by Gilbert Vernam, an AT&T engineer, and Joseph Mauborgne, later chief of the Army Signal Corps. [...] The 1882 monograph that Dr. Bellovin stumbled...
Identifying People by their Writing Style
The article is in the context of the big Facebook lawsuit, but the part about identifying people by their writing style is interesting: Recently, a team of computer scientists at Concordia University in Montreal took advantage of an unusual set of data to test another method of determining e-mail authorship. In 2003, the Federal Energy Regulatory Commission, as part of...
Developments in Facial Recognition
Eventually, it will work. You'll be able to wear a camera that will automatically recognize someone walking towards you, and a earpiece that will relay who that person is and maybe something about him. None of the technologies required to make this work are hard; it's just a matter of getting the error rate down low enough for it to...
Attacking PLCs Controlling Prison Doors
Embedded system vulnerabilities in prisons: Some of the same vulnerabilities that the Stuxnet superworm used to sabotage centrifuges at a nuclear plant in Iran exist in the countrys top high-security prisons, according to security consultant and engineer John Strauchs, who plans to discuss the issue and demonstrate an exploit against the systems at the DefCon hacker conference next week in...
Breaking the Xilinx Virtex-II FPGA Bitstream Encryption
It's a power-analysis attack, which makes it much harder to defend against. And since the attack model is an engineer trying to reverse-engineer the chip, it's a valid attack. Abstract: Over the last two decades FPGAs have become central components for many advanced digital systems, e.g., video signal processing, network routers, data acquisition and military systems. In order to protect...
Using Science Fiction to Teach Computer Security
Interesting paper: "Science Fiction Prototyping and Security Education: Cultivating Contextual and Societal Thinking in Computer Security Education and Beyond," by Tadayoshi Kohno and Brian David Johnson. Abstract: Computer security courses typically cover a breadth of technical topics, including threat modeling, applied cryptography, software security, and Web security. The technical artifacts of computer systems -- and their associated computer security risks...
Hacking Apple Laptop Batteries
Interesting: Security researcher Charlie Miller, widely known for his work on Mac OS X and Apple's iOS, has discovered an interesting method that enables him to completely disable the batteries on Apple laptops, making them permanently unusable, and perform a number of other unintended actions. The method, which involves accessing and sending instructions to the chip housed on smart batteries...
ShareMeNot
ShareMeNot is a Firefox add-on for preventing tracking from third-party buttons (like the Facebook "Like" button or the Google "+1" button) until the user actually chooses to interact with them. That is, ShareMeNot doesn't disable/remove these buttons completely. Rather, it allows them to render on the page, but prevents the cookies from being sent until the user actually clicks on...
Data Privacy as a Prisoner's Dilemma
Good analysis: Companies would be better off if they all provided meaningful privacy protections for consumers, but privacy is a collective action problem for them: many companies would love to see the ecosystem fixed, but no one wants to put themselves at a competitive disadvantage by imposing unilateral limitations on what they can do with user data. The solution --...
Cryptography and Wiretapping
Matt Blaze analyzes the 2010 U.S. Wiretap Report. In 2000, government policy finally reversed course, acknowledging that encryption needed to become a critical part of security in modern networks, something that deserved to be encouraged, even if it might occasionally cause some trouble for law enforcement wiretappers. And since that time the transparent use of cryptography by everyday people (and...
Ars Technica on Liabilities and Computer Security
Good article: Halderman argued that secure software tends to come from companies that have a culture of taking security seriously. But it's hard to mandate, or even to measure, "security consciousness" from outside a company. A regulatory agency can force a company to go through the motions of beefing up its security, but it's not likely to be effective unless...
Duplicating Physical Keys from Photographs (Sneakey)
In this demonstration, researchers photographed keys from 200 feet away and then made working copies. From the paper: The access control provided by a physical lock is based on the assumption that the information content of the corresponding key is private -- that duplication should require either possession of the key or a priori knowledge of how it was cut....
iPhone Iris Scanning Technology
No indication about how well it works: The smartphone-based scanner, named Mobile Offender Recognition and Information System, or MORIS, is made by BI2 Technologies in Plymouth, Massachusetts, and can be deployed by officers out on the beat or back at the station. An iris scan, which detects unique patterns in a person's eyes, can reduce to seconds the time it...
Revenge Effects of Too-Safe Playground Equipment
Sometimes too much security isn't good. After observing children on playgrounds in Norway, England and Australia, Dr. Sandseter identified six categories of risky play: exploring heights, experiencing high speed, handling dangerous tools, being near dangerous elements (like water or fire), rough-and-tumble play (like wrestling), and wandering alone away from adult supervision. The most common is climbing heights. "Climbing equipment needs...
Smuggling Drugs in Unwitting People's Car Trunks
This is clever: A few miles away across the Rio Grande, the FBI determined that Chavez and Gomez were using lookouts to monitor the SENTRI Express Lane at the border. The lookouts identified "targets" -- people with regular commutes who primarily drove Ford vehicles. According to the FBI affidavit, the smugglers would follow their targets and get the vehicle identification...
Is There a Hacking Epidemic?
Freakonomics asks: "Why has there been such a spike in hacking recently? Or is it merely a function of us paying closer attention and of institutions being more open about reporting security breaches?" They posted five answers, including mine: The apparent recent hacking epidemic is more a function of news reporting than an actual epidemic. Like shark attacks or school...
Google Detects Malware in its Search Data
This is interesting: As we work to protect our users and their information, we sometimes discover unusual patterns of activity. Recently, we found some unusual search traffic while performing routine maintenance on one of our data centers. After collaborating with security engineers at several companies that were sending this modified traffic, we determined that the computers exhibiting this behavior were...
Members of "Anonymous" Hacker Group Arrested
The police arrested sixteen suspected members of the Anonymous hacker group. Whatever you may think of their politics, the group committed crimes and their members should be arrested and prosecuted. I just hope we don't get a media flurry about how they were some sort of cyber super criminals. Near as I can tell, they were just garden variety hackers...
Telex Anti-Censorship System
This is really clever: Many anticensorship systems work by making an encrypted connection (called a tunnel ) from the user's computer to a trusted proxy server located outside the censor's network. This server relays requests to censored websites and returns the responses to the user over the encrypted tunnel. This approach leads to a cat-and-mouse game, where the censor attempts to...
British Phone Hacking Scandal
Ross Anderson discusses the technical and policy details....
Interview in Infosecurity Magazine
I think I gave this interview at the RSA Conference in February....
Degree Plans of the Future
You can now get a Master of Science in Strategic Studies in Weapons of Mass Destruction. Well, maybe you can't: "It's not going to be open enrollment (or) traditional students," Giever said. "You worry about whether you might be teaching the wrong person this stuff." At first, the FBI will select students from within its ranks, though Giever wants to...
My Next Book Title: Liars and Outliers
Thank you for all your comments and suggestions regarding my next book title. It will be: Liars and Outliers: How Security Holds Society Together We're still deciding on a cover, but it won't be any of the five from the above link. Vaguely ominous crowd scenes are not what I want....
Physical Key Escrow
This creates far more security risks than it solves: The city council in Cedar Falls, Iowa has absolutely crossed the line. They voted 6-1 in favor of expanding the use of lock boxes on commercial property. Property owners would be forced to place the keys to their businesses in boxes outside their doors so that firefighters, in that one-in-a-million chance,...
Insurgent Groups Exhibit Learning Curve
Interesting research: After analyzing reams of publicly available data on casualties from Iraq, Afghanistan, Pakistan and decades of terrorist attacks, the scientists conclude that "insurgents pretty much seemed to be following a progress curve–or a learning curve–that's very common in the manufacturing literature," says physicist Neil Johnson of the University of Miami in Florida and lead author of the study....
Friday Squid Blogging: Giant Squid Egg
Interesting pictures. Article is in Italian, though. Google Translate translation....
Organized Crime in Ireland Evolves As Security Increases
The whole article is interesting, but here's just one bit: The favoured quick-fix money-making exercise of the average Irish organised crime gang had, for decades, been bank robberies. But a massive investment by banks in branch security has made the traditional armed hold-up raids increasingly difficult. The presence of CCTV cameras in most banks means any raider would need to...
Comparing al Qaeda and the IRA
A really interesting article: Al Qaeda played all out, spent all its assets in a few years. In my dumb-ass 2005 article, I called the Al Qaeda method "real war" and the IRA's slow-perc campaign "nerf war." That was ignorance talking, boyish war-loving ignorance. I wanted more action, that was all. I saw what an easy target the London transport...
Man Flies with Someone Else's Ticket and No Legal ID
Last week, I got a bunch of press calls about Olajide Oluwaseun Noibi, who flew from New York to Los Angeles using an expired ticket in someone else's name and a university ID. They all wanted to know what this says about airport security. It says that airport security isn't perfect, and that people make mistakes. But it's not something...
Research in Secure Chips
Unsuprisingly, the U.S. military is funding reseach in this....
Friday Squid Blogging: Giant Squid as an Emblem for Ocean Conservation
It's a proposal....
TDSS Rootkit
There's a new version: The latest TDL-4 version of the rootkit, which is used as a persistent backdoor to install other types of malware, infected 4.52 million machines in the first three months of this year, according to a detailed technical analysis published Wednesday by antivirus firm Kaspersky Lab. Almost a third of the compromised machines were located in the...
Menwith Hill
Article on the NSA's Menwith Hill listening station in the UK....
Chinese Army Developed Online Wargame
This is a really weird story: After setting up its own cyber-warfare team, China's military has now developed its first online war game aimed at improving combat skills and battle awareness, state press said on Wednesday. After setting up its own cyber-warfare team, China's military has now developed its first online war game aimed at improving combat skills and battle...
Yet Another "People Plug in Strange USB Sticks" Story
I'm really getting tired of stories like this: Computer disks and USB sticks were dropped in parking lots of government buildings and private contractors, and 60% of the people who picked them up plugged the devices into office computers. And if the drive or CD had an official logo on it, 90% were installed. Of course people plugged in UBS...
Common PINs
There's some great data on common iPhone passwords. I'm sure the results also apply to banking PINs....
Friday Squid Blogging: Eating Humboldt Squid
Chris Cosentino, chef at Incanto in San Francisco, wants to serve you Humboldt squid....
Selling a Good Reputation on eBay
Here's someone who is selling positive feedback on eBay: Hello, for sale is a picture of a tree. This tree is an original and was taken by me. I have gotten nothing but 100% feedback from people from this picture. Great Picture! Once payment is made I will send you picture via email. Once payment is made and I send...
Assisting a Hostage Taker via Facebook
It's a new world: An armed Valdez, 36, held a woman hostage at a motel in a tense 16-hour, overnight standoff with SWAT teams, all while finding time to keep his family and friends updated on Facebook. [...] In all, Valdez made six posts and added at least a dozen new friends. His family and friends responded with 100 comments....
Protecting Private Information on Smart Phones
AppFence is a technology -- with a working prototype -- that protects personal information on smart phones. It does this by either substituting innocuous information in place of sensitive information or blocking attempts by the application to send the sensitive information over the network. The significance of systems like AppFence is that they have the potential to change the balance...
NSA Style Manual
National Security Agency (NSA) SIGINT Reporter's Style and Usage Manual, 2010....
Insider Attack Against M&A Information in Document Titles
Protecting against insiders is hard. Kluger and two accomplices -- a Wall Street trader and a mortgage broker -- allegedly stole and traded on material nonpublic information about M&A deals over a period of 17 years, according to federal authorities. The trio, facing charges from the U.S. Securities and Exchange Commission and the Department of Justice, allegedly made at least...
Did Reason Evolve as a Persuasion Tool?
Many of our informal security systems involve convincing others to do what we want them to. Here's a theory that says human reasoning evolved not as a tool to better understand the world or solve problems, but to win arguments and persuade other humans. (Paper here.)...
My Next Book: Title and Cover
As my regular readers already know, I'm in the process of writing my next book. It's a book about why security exists: specifically, how a group of people protects itself from individuals within that group. My working title has been The Dishonest Minority. The idea behind the title is that "honesty" is defined by social convention, then those that don't...
The Problem with Cyber-crime Surveys
Good paper: "Sex, Lies and Cyber-crime Surveys," Dinei Florêncio and Cormac Herley, Microsoft Research. Abstract: Much of the information we have on cyber-crime losses is derived from surveys. We examine some of the difficulties of forming an accurate estimate by survey. First, losses are extremely concentrated, so that representative sampling of the population does not give representative sampling of the...
RAND Corporation on Trusted Traveler
New paper: "Assessing the Security Benefits of a Trusted Traveler Program in the Presence of Attempted Attacker Exploitation and Compromise": Current aviation security procedures screen all passengers uniformly. Varying the amount of screening individuals receive based on an assessment of their relative risk has the potential to reduce the security burdens on some travelers, while improving security overall. This paper...
Fourth SHB Workshop
I'm at SHB 2011, the fourth Interdisciplinary Workshop on Security and Human Behavior, at Carnegie Mellon University. This is a two-day invitational gathering of computer security researchers, psychologists, behavioral economists, sociologists, political scientists, anthropologists, philosophers, and others -- all of whom are studying the human side of security -- organized by Alessandro Acquisti, Ross Anderson, and me. It's not just...
Friday Squid Blogging: Beautiful Deep-Sea Squid Picture
From the Telegraph (also here)....
Court Ruling on "Reasonable" Electronic Banking Security
One of the pleasant side effects of being too busy to write longer blog posts is that -- if I wait long enough -- someone else writes what I would have wanted to. The ruling in the Patco Construction vs. People's United Bank case is important, because the judge basically ruled that the bank's substandard security was good enough --...
WEIS 2011
I'm at the Tenth Workshop on Economics of Information Security (WEIS 2011) , at George Mason University. Most of the papers are online, and Ross Anderson is liveblogging the talks....
The Non-Anonymity of Bubble Forms
It turns out that "fill-in-the-bubble" forms are not so anonymous....
Status Report on the War on Photography
Worth reading: Morgan Leigh Manning, "Less than Picture Perfect: The Legal Relationship between Photographers' Rights and Law Enforcement," Tennessee Law Review, Vol. 78, p. 105, 2010. Abstract: Threats to national security and public safety, whether real or perceived, result in an atmosphere conducive to the abuse of civil liberties. History is littered with examples: The Alien and Sedition Acts of...
Yet Another Way to Evade TSA's Full-Body Scanners
Last night, at the Third EPIC Champion of Freedom Awards Dinner, we gave an award to Susie Castillo, whose blog post and video of her treatment in the hands of the TSA has inspired thousands to complain about the agency and their treatment of travellers. Sitting with her at dinner, I learned yet another way to evade the TSA's full...
Why it's So Difficult to Trace Cyber-Attacks
I've been asked this question by countless reporters in the past couple of weeks. Here's a good explanation. Shorter answer: it's easy to spoof source destination, and it's easy to hijack unsuspecting middlemen and use them as proxies. No, mandating attribution won't solve the problem. Any Internet design will necessarily include anonymity....
Two Good Rants
Patrick Gray on why we secretly love LulzSec, and Robert Cringely on why we openly hate RSA....
New Airport Scanning Technology
Interesting: Iscon's patented, thermo-conductive technology combines infrared (IR) and heat transfer, for high-resolution imaging without using any radiation. The core of this is state of the art imaging which detects and processes a break in the established thermal balance between the clothes and a hidden object. The IR camera detects the heat radiating from even a tiny object, producing a...
Spam as a Business
Interesting research: Kirill Levchenko, et al. (2010), "Click Trajectories -- End-to-End Analysis of the Spam Value Chain," IEEE Symposium on Security and Privacy 2011, Oakland, California, 24 May 2011. Abstract: Spam-based advertising is a business. While it has engendered both widespread antipathy and a multi-billion dollar anti-spam industry, it continues to exist because it fuels a profitable enterprise. We lack,...
25% of U.S. Criminal Hackers are Police Informants
I have no idea if this is true: In some cases, popular illegal forums used by cyber criminals as marketplaces for stolen identities and credit card numbers have been run by hacker turncoats acting as FBI moles. In others, undercover FBI agents posing as "carders" hackers specialising in ID theft have themselves taken over the management of crime...
Tennessee Makes Password Sharing Illegal
Here's a new law that won't work: State lawmakers in country music's capital have passed a groundbreaking measure that would make it a crime to use a friend's login -- even with permission -- to listen to songs or watch movies from services such as Netflix or Rhapsody. [...] The legislation was aimed at hackers and thieves who sell passwords...
Fighting Terrorism with Cupcakes
MI6 hacked into an online al-Qaeda magazine and replaced bomb-making instructions with a cupcake recipe. It's a more polite hack than subtly altering the recipe so it blows up during the making process. (I've been told, although I don't know for sure, that the 1971 Anarchist's Cookbook has similarly flawed recipes.)...
Analysis of Redaction Failures
Redaction failures are so common that I stopped blogging about them years ago. This is the first analysis I have seen of technical redaction failures. And here's the NSA on how to redact....
World War II Tunny Cryptanalysis Machine Rebuilt at Bletchley Park
Neat: The rebuild team had only a few photographs, partial circuit diagrams and the fading memories of a few original Tunny operators to go on. Nonetheless a team led by John Pether and John Whetter was able to complete this restoration work. Pether explained that getting the electronics to work proved to be the most difficult part of the restoration...
Security vs. Privacy
Daniel Solove on the security vs. privacy debate....
Open-Source Software Feels Insecure
At first glance, this seems like a particularly dumb opening line of an article: Open-source software may not sound compatible with the idea of strong cybersecurity, but.... But it's not. Open source does sound like a security risk. Why would you want the bad guys to be able to look at the source code? They'll figure out how it works....
Spear Phishing Attacks from China Against Gmail Accounts
Reporters have been calling me pretty much constantly about this story, but I can't figure out why in the world this is news. Attacks from China -- old news; attacks from China against Google -- old news; attacks from China against Google Gmail accounts -- old news. Spear phishing attacks from China against senior government officials -- old news. There's...
Man-in-the-Middle Attack Against the MCAT Exam
In Applied Cryptography, I wrote about the "Chess Grandmaster Problem," a man-in-the-middle attack. Basically, Alice plays chess remotely with two grandmasters. She plays Grandmaster 1 as white and Grandmaster 2 as black. After the standard opening of 1. e4, she just replays the moves from one game to the other, and convinces both of them that she's a grandmaster in...
Three-Volume History of Counterintelligence
CI Reader: An American Revolution Into the New Millennium, Volumes I, II, and III is published by the U.S. Office of the National Counterintelligence Executive. (No, I've never heard of them, either.)...
The U.S. Seems to Have a Secret Stealth Helicopter
That's what the U.S. destroyed after a malfunction in Pakistan during the Bin Laden assassination. (For helicopters, "stealth" is less concerned with radar signatures and more concerned with acoustical quiet.) There was some talk about Pakistan sending it to China, but they're returning it to the U.S. I presume that the Chinese got everything they needed quickly....
Keeping Sensitive Information Out of the Hands of Terrorists Through Self-Restraint
In my latest book (available February), I talk about various mechanisms for societal security: how we as a group protect ourselves from the "dishonest minority" within us. I have four types of societal security systems: moral systems -- any internal rewards and punishments; reputational systems -- any informal external rewards and punishments; rule-based systems -- any formal system of rewards...
Lockheed Martin Hack Linked to RSA's SecurID Breach
All I know is what I read in the news....
Aggressive Social Engineering Against Consumers
Cyber criminals are getting aggressive with their social engineering tactics. Val Christopherson said she received a telephone call last Tuesday from a man stating he was with an online security company who was receiving error messages from the computer at her Charleswood home. “He said he wanted to fix my problem over the phone,” Christopherson said. She said she was...
Friday Squid Blogging: Hand-Cut Paper Silhouette
Surprisingly pretty....
Apple's iOS 4 Hardware Encryption Cracked
All I know is what's in these two blog posts from Elcomsoft. Note that they didn't break AES-256; they figured out how to extract the keys from the hardware (iPhones, iPads). The company "will be releasing the product implementing this functionality for the exclusive use of law enforcement, forensic and intelligence agencies."...
U.S. Presidential Limo Defeated by Steep-Grade Parking Ramp
It's not something I know anything about -- actually, it's not something many people know about -- but I've posted some links about the security features of the U.S. presidential limousine. So it's amusing to watch the limo immobilized by a steep grade at the U.S. embassy in Dublin. (You'll get a glimpse of how thick the car doors are...
Blackhole Exploit Kit
It's now available as a free download: A free version of the Blackhole exploit kit has appeared online in a development that radically reduces the entry-level costs of getting into cybercrime. The Blackhole exploit kit, which up until now would cost around $1,500 for an annual licence, creates a handy way to plant malicious scripts on compromised websites. Surfers visiting...
New Siemens SCADA Vulnerabilities Kept Secret
SCADA systems -- computer systems that control industrial processes -- are one of the ways a computer hack can directly affect the real world. Here, the fears multiply. It's not bad guys deleting your files, or getting your personal information and taking out credit cards in your name; it's bad guys spewing chemicals into the atmosphere and dumping raw sewage...
Dropbox Security
I haven't written about Dropbox's security problems; too busy with the book. But here's an excellent summary article from The Economist. The meta-issue is pretty simple. If you expect a cloud provider to do anything more interesting than simply store your files for you and give them back to you at a later date, they are going to have to...
CDC on the Zombie Apocalypse
The Centers for Disease Control and Prevention weigh in on preparations for the zombie apocalypse....
The Normalization of Security
TSA-style security is now so normal that it's part of a Disney ride: The second room of the queue is now a security check area, similar to a TSA checkpoint. The two G-series droids are still there, G2-9T scanning luggage and G2-4T scanning passengers. For those attraction junkies, you'll remember that the G-series droids are so named because in the...
Forged Subway Passes in Boston
For years, an employee of Cubic Corp -- the company who makes the automatic fair card systems for most of the subway systems around the world -- forged forged and then sold monthly passes for the Boston MBTA system. The scheme was discovered by accident: Coakley said the alleged scheme was only discovered after a commuter rail operator asked a...
Bin Laden Maintained Computer Security with an Air Gap
From the Associated Ptress: Bin Laden's system was built on discipline and trust. But it also left behind an extensive archive of email exchanges for the U.S. to scour. The trove of electronic records pulled out of his compound after he was killed last week is revealing thousands of messages and potentially hundreds of email addresses, the AP has learned....
Mobile Phone Privacy App Contest
Entries due by the end of the month....
Fingerprint Scanner that Works at a Distance
Scanning fingerprints from six feet away. Slightly smaller than a square tissue box, AIRprint houses two 1.3 megapixel cameras and a source of polarized light. One camera receives horizontally polarized light, while the other receives vertically polarized light. When light hits a finger, the ridges of the fingerprint reflect one polarization of light, while the valleys reflect another. "That's where...
The Inner Workings of an FBI Surveillance Device
This FBI surveillance device, designed to be attached to a car, has been taken apart and analyzed. A recent ruling by the 9th U.S. Circuit Court of Appeals affirms that it's legal for law enforcement to secretly place a tracking device on your car without a warrant, even if it's parked in a private driveway....
Friday Squid Blogging: Squid Sous Vide
Yum: We learned to cook squid sous vide at 59°C when we were at Atelier in Canada. The cooking time and temperature we picked up produce squid which is meaty, juicy and rich in texture. Here we marinated the squid with mango pickle and then cooked them for three hours at 59°C. Then we cooled them down in an ice...
Interview with Me About the Sony Hack
These are what I get for giving interviews when I'm in a bad mood. For the record, I think Sony did a terrible job with its customers' security. I also think that most companies do a terrible job with customers' security, simply because there isn't a financial incentive to do better. And that most of us are pretty secure, despite...
Drugging People and Then Robbing Them
This is a pretty scary criminal tactic from Turkey. Burglars dress up as doctors, and ring doorbells handing out pills under some pretense or another. They're actually powerful sedatives, and when people take them they pass out, and the burglars can ransack the house. According to the article, when the police tried the same trick with placebos, they got an...
RFID Tags Protecting Hotel Towels
The stealing of hotel towels isn't a big problem in the scheme of world problems, but it can be expensive for hotels. Sure, we have moral prohibitions against stealing -- that'll prevent most people from stealing the towels. Many hotels put their name or logo on the towels. That works as a reputational societal security system; most people don't want...
"Resilience of the Internet Interconnection Ecosystem"
This blog post by Richard Clayton is worth reading. If you have more time, there's 238-page report and a 31-page executive summary....
Medieval Tally Stick Discovered in Germany
Interesting: The well-preserved tally stick was used in the Middle Ages to count the debts owed by the holder in a time when most people were unable to read or write. "Debts would have been carved into the stick in the form of small notches. Then the stick would have been split lengthways, with the creditor and the borrower each...
The Era of "Steal Everything"
Good comment: "We're moving into an era of 'steal everything'," said David Emm, a senior security researcher for Kaspersky Labs. He believes that cyber criminals are now no longer just targeting banks or retailers in the search for financial details, but instead going after social and other networks which encourage the sharing of vast amounts of personal information. As both...
Vulnerabilities in Online Payment Systems
This hack was conducted as a research project. It's unlikely it's being done in the wild: In one attack, Wang and colleagues used a plug-in for the Firefox web browser to examine data being sent and received by the online retailer Buy.com. When users make a purchase, Buy.com directs them to PayPal. Once they have paid, PayPal sends Buy.com a...
Status Report: The Dishonest Minority
Three months ago, I announced that I was writing a book on why security exists in human societies. This is basically the book's thesis statement: All complex systems contain parasites. In any system of cooperative behavior, an uncooperative strategy will be effective -- and the system will tolerate the uncooperatives -- as long as they're not too numerous or too...
Friday Squid Blogging: Noise Pollution and Squid
It literally blows holes in their heads: In the study, led by Michel André of the Technical University of Catalonia in Barcelona, biologists exposed 87 individual cephalopods of four species -- Loligo vulgaris, Sepia officinalis, Octopus vulgaris and Illex coindeti -- to short sweeps of relatively low intensity, low frequency sound between 50 and 400 Hertz (Hz). Then they examined...
Friday Squid Blogging: Squids in Space
There are live squids on the last Endeavor mission....
Forged Memory
A scary development in rootkits: Rootkits typically modify certain areas in the memory of the running operating system (OS) to hijack execution control from the OS. Doing so forces the OS to present inaccurate results to detection software (anti-virus, anti-rootkit). For example rootkits may hide files, registries, processes, etc., from detection software. So rootkits typically modify memory. And anti-rootkit tools...
Stolen Camera Finder
Here's a clever Web app that locates your stolen camera by searching the EXIF data on public photo databases for your camera's serial number....
Extreme Authentication
Exactly how did they confirm it was Bin Laden's body? Officials compared the DNA of the person killed at the Abbottabad compound with the bin Laden "family DNA" to determine that the 9/11 mastermind had in fact been killed, a senior administration official said. It was not clear how many different family members' samples were compared or whose DNA was...
Osama's Death Causes Spike in Suspicious Package Reports
It's not that the risk is greater, it's that the fear is greater. Data from New York: There were 10,566 reports of suspicious objects across the five boroughs in 2010. So far this year, the total was 2,775 as of Tuesday compared with 2,477 through the same period last year. [...] The daily totals typically spike when terrorist plot makes...
"Operation Pumpkin"
Wouldn't it be great if this were not a joke: the security contingency that was in place in the event that Kate Middleton tried to run away just before the wedding. After protracted, top-secret negotiations between royal staff from Clarence House and representatives from the Metropolitan Police, MI5 and elements of the military, a compromise was agreed. In the event...
Unintended Security Consequences of the New Pyrex Recipe
This is interesting: When World Kitchen took over the Pyrex brand, it started making more products out of prestressed soda-lime glass instead of borosilicate. With pre-stressed, or tempered, glass, the surface is under compression from forces inside the glass. It is stronger than borosilicate glass, but when it's heated, it still expands as much as ordinary glass does. It doesn't...
Decline in Cursive Writing Leads to Increase in Forgery Risk?
According to this article, students are no longer learning how to write in cursive. And, if they are learning it, they're forgetting how. Certainly the ubiquity of keyboards is leading to a decrease in writing by hand. Relevant to this blog, the article claims that this is making signtatures easier to forge. While printing might be legible, the less complex...
Nikon Image Authentication System Cracked
Not a lot of details: ElcomSoft research shows that image metadata and image data are processed independently with a SHA-1 hash function. There are two 160-bit hash values produced, which are later encrypted with a secret (private) key by using an asymmetric RSA-1024 algorithm to create a digital signature. Two 1024-bit (128-byte) signatures are stored in EXIF MakerNote tag 0×0097...
LiveBlogging the Bin Ladin Assassination
"VirtualReality" tweeted the Bin Ladin assassination without realizing it....
Hijacking the Coreflood Botnet
Earlier this month, the FBI seized control of the Coreflood botnet and shut it down: According to the filing, ISC, under law enforcement supervision, planned to replace the servers with servers that it controlled, then collect the IP addresses of all infected machines communicating with the criminal servers, and send a remote "stop" command to infected machines to disable the...
Friday Squid Blogging: Giant Squid Eye Preserved in a Jar
Great picture from the Smithsonian Institution....
TED Talk
This is a surprise. My TED talk made it to the website. It's a surprise because I didn't speak at TED. I spoke last year at a regional TED event, TEDxPSU. And not all talks from the regional events get on the main site, only the good ones....
The Cyberwar Arms Race
Good paper: "Loving the Cyber Bomb? The Dangers of Threat Inflation in Cybersecurity Policy," by Jerry Brito and Tate Watkins. Over the past two years there has been a steady drumbeat of alarmist rhetoric coming out of Washington about potential catastrophic cyber threats. For example, at a Senate Armed Services Committee hearing last year, Chairman Carl Levin said that "cyberweapons...
Social Solidarity as an Effect of the 9/11 Terrorist Attacks
It's standard sociological theory that a group experiences social solidarity in response to external conflict. This paper studies the phenomenon in the United States after the 9/11 terrorist attacks. Conflict produces group solidarity in four phases: (1) an initial few days of shock and idiosyncratic individual reactions to attack; (2) one to two weeks of establishing standardized displays of solidarity...
Security Risks of Running an Open WiFi Network
As I've written before, I run an open WiFi network. It's stories like these that may make me rethink that. The three stories all fall along the same theme: a Buffalo man, Sarasota man, and Syracuse man all found themselves being raided by the FBI or police after their wireless networks were allegedly used to download child pornography. "You're a...
Friday Squid Blogging: Squid Fabric Designs
Some of these are actually nice....
Hard-Drive Steganography through Fragmentation
Clever: Khan and his colleagues have written software that ensures clusters of a file, rather than being positioned at the whim of the disc drive controller chip, as is usually the case, are positioned according to a code. All the person at the other end needs to know is which file's cluster positions have been encoded. The code depends on...
Friday Squid Blogging: Squid Prints
Okay, this is a little weird: This year's Earth Day will again include the celebrated "squid printing" activity with two big, beautiful Pacific Humboldt squid donated from the Gulf of the Farallones National Marine Sanctuary. We'll be inking them up and laying them out on paper to create fascinating one-of-a- kind imprints of their bodies. I don't know what's worse:...
Declassified World War I Security Documents
The CIA has just declassified six (1, 2, 3, 4, 5, and 6) documents about World War I security techniques. (The media is reporting they're CIA documents, but the CIA didn't exist before 1947.) Lots of stuff about secret writing and pre-computer tradecraft....
Large-Scale Food Theft
A criminal gang is stealing truckloads of food: Late last month, a gang of thieves stole six tractor-trailer loads of tomatoes and a truck full of cucumbers from Florida growers. They also stole a truckload of frozen meat. The total value of the illegal haul: about $300,000. The thieves disappeared with the shipments just after the price of Florida tomatoes...
Costs of Security
Interesting blog post on the security costs for the $50B Air Force bomber program -- estimated to be $8B. This isn't all computer security, but the original article specifically calls out Chinese computer espionage as a primary threat....
Software as Evidence
Increasingly, chains of evidence include software steps. It's not just the RIAA suing people -- and getting it wrong -- based on automatic systems to detect and identify file sharers. It's forensic programs used to collect and analyze data from computers and smart phones. It's audit logs saved and stored by ISPs and websites. It's location data from cell phones....
WikiLeaks Cable about Chinese Hacking of U.S. Networks
We know it's prevelent, but there's some new information: Secret U.S. State Department cables, obtained by WikiLeaks and made available to Reuters by a third party, trace systems breaches -- colorfully code-named "Byzantine Hades" by U.S. investigators -- to the Chinese military. An April 2009 cable even pinpoints the attacks to a specific unit of China's People's Liberation Army. Privately,...
Friday Squid Blogging: Omega 3 Oil from Squid
New health supplement....
"Schneier's Law"
Back in 1998, I wrote: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break. In 2004, Cory Doctorow called this Schneier's law: ...what I think of as Schneier's Law: "any person can invent a security system so clever that she or he can't think of how to break it." The...
Unanticipated Security Risk of Keeping Your Money in a Home Safe
In Japan, lots of people -- especially older people -- keep their life savings in cash in their homes. (The country's banks pay very low interest rates, so the incentive to deposit that money into bank accounts is lower than in other countries.) This is all well and good, until a tsunami destroys your home and washes your money out...
Changing Incentives Creates Security Risks
One of the things I am writing about in my new book is how security equilibriums change. They often change because of technology, but they sometimes change because of incentives. An interesting example of this is the recent scandal in the Washington, DC, public school system over teachers changing their students' test answers. In the U.S., under the No Child...
Security Fears of Wi-Fi in London Underground
The London Underground is getting Wi-Fi. Of course there are security fears: But Will Geddes, founder of ICP Group which specialises in reducing terror or technology-related threats, said the plan was problematic. He said: "There are lots of implications in terms of terrorism and security. "This will enable people to use their laptop on the Tube as if it was...
Euro Coin Recycling Scam
This story is just plain weird. Regularly, damaged coins are taken out of circulation. They're destroyed and then sold to scrap metal dealers. That makes sense, but it seems that one- and two-euro coins aren't destroyed very well. They're both bi-metal designs, and they're just separated into an inner core and an outer ring and then sold to Chinese scrap...
Israel's Counter-Cyberterrorism Unit
You'd think the country would already have one of these: Israel is mulling the creation of a counter-cyberterrorism unit designed to safeguard both government agencies and core private sector firms against hacking attacks. The proposed unit would supplement the efforts of Mossad and other agencies in fighting cyberespionage and denial of service attacks....
How did the CIA and FBI Know that Australian Government Computers were Hacked?
Newspapers are reporting that, for about a month, hackers had access to computers "of at least 10 federal ministers including the Prime Minister, Foreign Minister and Defence Minister." That's not much of a surprise. What is odd is the statement that "Australian intelligence agencies were tipped off to the cyber-spy raid by US intelligence officials within the Central Intelligence Agency...
New French Law Reduces Website Security
I didn't know about this: The law obliges a range of e-commerce sites, video and music services and webmail providers to keep a host of data on customers. This includes users' full names, postal addresses, telephone numbers and passwords. The data must be handed over to the authorities if demanded. Police, the fraud office, customs, tax and social security bodies...
The CIA and Assassinations
The former CIA general counsel, John A. Rizzo, talks about his agency's assassination program, which has increased dramatically under the Obama administration: The hub of activity for the targeted killings is the CIA's Counterterrorist Center, where lawyersthere are roughly 10 of them, says Rizzo -- write a cable asserting that an individual poses a grave threat to the United States....
Friday Squid Blogging: A New Book About Squid
Wendy Williams, Kraken: The Curious, Exciting, and Slightly Disturbing Science of Squid. Kraken is the traditional name for gigantic sea monsters, and this book introduces one of the most charismatic, enigmatic, and curious inhabitants of the sea: the squid. The pages take the reader on a wild narrative ride through the world of squid science and adventure, along the way...
Get Your Terrorist Alerts on Facebook and Twitter
Colors are so last decade: The U.S. government's new system to replace the five color-coded terror alerts will have two levels of warnings elevated and imminent that will be relayed to the public only under certain circumstances for limited periods of time, sometimes using Facebook and Twitter, according to a draft Homeland Security Department plan obtained by The...
Pinpointing a Computer to Within 690 Meters
This is impressive, and scary: Every computer connected to the web has an internet protocol (IP) address, but there is no simple way to map this to a physical location. The current best system can be out by as much as 35 kilometres. Now, Yong Wang, a computer scientist at the University of Electronic Science and Technology of China in...
Detecting Cheaters
Our brains are specially designed to deal with cheating in social exchanges. The evolutionary psychology explanation is that we evolved brain heuristics for the social problems that our prehistoric ancestors had to deal with. Once humans became good at cheating, they then had to become good at detecting cheating -- otherwise, the social group would fall apart. Perhaps the most...
Optical Stun Ray
It's been patented; no idea if it actually works. ...newly patented device can render an assailant helpless with a brief flash of high-intensity light. It works by overloading the neural networks connected to the retina, saturating the target's world in a blinding pool of white light. "It's the inverse of blindness–the technical term is a loss of contrast sensitivity," says...
Counterterrorism Security Cost-Benefit Analysis
"Terror, Security, and Money: Balancing the Risks, Benefits, and Costs of Homeland Security," by John Mueller and Mark Stewart: Abstract:The cumulative increase in expenditures on US domestic homeland security over the decade since 9/11 exceeds one trillion dollars. It is clearly time to examine these massive expenditures applying risk assessment and cost-benefit approaches that have been standard for decades. Thus...
Epsilon Hack
I have no idea why the Epsilon hack is getting so much press. Yes, millions of names and e-mail addresses might have been stolen. Yes, other customer information might have been stolen, too. Yes, this personal information could be used to create more personalized and better targeted phishing attacks. So what? These sorts of breaches happen all the time, and...
Reducing Bribery by Legalizing the Giving of Bribes
Here's some very clever thinking from India's chief economic adviser. In order to reduce bribery, he proposes legalizing the giving of bribes: Under the current law, discussed in some detail in the next section, once a bribe is given, the bribe giver and the bribe taker become partners in crime. It is in their joint interest to keep this fact...
Ebook Fraud
Interesting post -- and discussion -- on Making Light about ebook fraud. Currently there are two types of fraud. The first is content farming, discussed in these two interesting blog posts. People are creating automatically generated content, web-collected content, or fake content, turning it into a book, and selling it on an ebook site like Amazon.com. Then they use multiple...
34 SCADA Vulnerabilities Published
It's hard to tell how serious this is. Computer security experts who examined the code say the vulnerabilities are not highly dangerous on their own, because they would mostly just allow an attacker to crash a system or siphon sensitive data, and are targeted at operator viewing platforms, not the backend systems that directly control critical processes. But experts caution...
Comodo Group Issues Bogus SSL Certificates
This isn't good: The hacker, whose March 15 attack was traced to an IP address in Iran, compromised a partner account at the respected certificate authority Comodo Group, which he used to request eight SSL certificates for six domains: mail.google.com, www.google.com, login.yahoo.com, login.skype.com, addons.mozilla.org and login.live.com. The certificates would have allowed the attacker to craft fake pages that would have...
How Peer Review Doesn't Work
In this amusing story of a terrorist plotter using pencil-and-paper cryptography instead of actually secure cryptography, there's this great paragraph: Despite urging by the Yemen-based al Qaida leader Anwar Al Anlaki, Karim also rejected the use of a sophisticated code program called "Mujhaddin Secrets", which implements all the AES candidate cyphers, "because 'kaffirs', or non-believers, know about it so it...
Federated Authentication
New paper by Ross Anderson: "Can We Fix the Security Economics of Federated Authentication?": There has been much academic discussion of federated authentication, and quite some political manoeuvring about `e-ID'. The grand vision, which has been around for years in various forms but was recently articulated in the US National Strategy for Trustworthy Identities in Cyberspace (NSTIC), is that a...
Biliteral Ciphers
Interesting article on William Friedman and biliteral ciphers....
Friday Squid Blogging: Squid Fabric Designs
Some of these are actually nice....
Authenticating the Authenticators
This is an interesting read: It was a question that changed his life, and changed mine, and may have changed -- even saved -- all of ours by calling attention to flaws in our nuclear command and control system at the height of the Cold War. It was a question that makes Maj. Hering an unsung hero of the nuclear...
Identifying Tor Users Through Insecure Applications
Interesting research: "One Bad Apple Spoils the Bunch: Exploiting P2P Applications to Trace and Profile Tor Users": Abstract: Tor is a popular low-latency anonymity network. However, Tor does not protect against the exploitation of an insecure application to reveal the IP address of, or trace, a TCP stream. In addition, because of the linkability of Tor streams sent together over...
Detecting Words and Phrases in Encrypted VoIP Calls
Interesting: Abstract: Although Voice over IP (VoIP) is rapidly being adopted, its security implications are not yet fully understood. Since VoIP calls may traverse untrusted networks, packets should be encrypted to ensure confidentiality. However, we show that it is possible to identify the phrases spoken within encrypted VoIP calls when the audio is encoded using variable bit rate codecs. To...
Transmitting Data Through Steel
This is cool: Tristan Lawry, doctoral candidate in electrical and computer engineering, has developed equipment which can transmit data at high rates through thick, solid steel or other barriers. Significantly, Lawry's kit also transmits power. One obvious application here would be transmission through the steel pressure hull of a submarine: at the moment such hulls must have hundreds of penetrations...
Threats vs. Vulnerabilities
I found this article on the difference between threats and vulnerabilities to be very interesting. I like his taxonomy....
Folk Models in Home Computer Security
This is a really interesting paper: "Folk Models of Home Computer Security," by Rick Wash. It was presented at SOUPS, the Symposium on Usable Privacy and Security, last year. Abstract: Home computer systems are frequently insecure because they are administered by untrained, unskilled users. The rise of botnets has amplified this problem; attackers can compromise these computers, aggregate them, and...
Times Square Video Screen Hacked with an iPhone
I didn't post about it when I first saw it because I suspected a hoax. Turns out, I was right. It wasn't even two guys faking hacking a Times Square video screen. It was a movie studio faking two guys faking hacking a Times Square video screen....
RSA Security, Inc Hacked
The company, not the algorithm. Here's the corporate spin. Our investigation has led us to believe that the attack is in the category of an Advanced Persistent Threat (APT). Our investigation also revealed that the attack resulted in certain information being extracted from RSA's systems. Some of that information is specifically related to RSA's SecurID two-factor authentication products. While at...
Zombie Fungus
The security connection is pretty tenuous, so I figured I'd blog this on a Saturday. Once it infects an ant, the fungus uses as-yet-unidentified chemicals to control the ant's behavior, Hughes told LiveScience. It directs the ant to leave its colony (a very un-ant-like thing to do) and bite down on the underside of a leaf – the ant's soon-to-be...
Hacking ATM Users by Gluing Down Keys
Clever hack: The thieves glue down the "enter," "cancel" and "clear" buttons on the keypad and wait until the customer goes into the bank for help before withdrawing money from their account. The robbed customers have already punched in their PINs when they realize the keypad buttons are stuck. The unwitting customers either do not know that they can use...
Hacking Cars with MP3 Files
Impressive research: By adding extra code to a digital music file, they were able to turn a song burned to CD into a Trojan horse. When played on the car's stereo, this song could alter the firmware of the car's stereo system, giving attackers an entry point to change other components on the car....
Using Language Patterns to Identify Anonymous E-Mail
Interesting research. It only works when there's a limited number of potential authors: To test the accuracy of their technique, Fung and his colleagues examined the Enron Email Dataset, a collection which contains over 200,000 real-life emails from 158 employees of the Enron Corporation. Using a sample of 10 emails written by each of 10 subjects (100 emails in all),...
Video Interview with Me
This three-part video interview with me was conducted at the RSA Conference last month....
FBI and the Future of Wiretapping
Last month I posted Susan Landau's testimony before the House Judiciary Committee, Subcommittee on Crime, Terrorism, and Homeland Security on government eavesdropping. In fairness to the other side, here's testimony of Valerie Caproni, General Counsel of the FBI....
Full Body Scanners
Wired.com has a good three-part story on full-body scanners....
Malware as Job Security
A programmer installed malware into the Whack-a-Mole arcade game as a form of job security. It didn't work....
Criminals Stealing Cars by Calling Tow Trucks
It's a clever hack, but an old problem: the authentication in these sorts of normal operations isn't good enough to prevent abuse....
Recently Declassified NSA History Document
"American Cryptography During the Cold War 1945-1989; Book IV: Cryptologic Rebirth 1981-1989." Document was first declassified in 2009. Here are some newly declassified pages....
Friday Squid Blogging: Giant Squid Washes Ashore
A giant squid washed ashore in New South Wales....
Interesting Research in Using Animals to Detect Substances
Fascinating research summarized in The Economist. Basically, detecting dogs respond to unconscious cues from their handlers, and generate false alarms because of them. It makes sense, as dogs are so attuned to humans. I'll bet bomb-sniffing bees don't make the same mistakes....
Pickpockets are a Dying Breed
Pickpockets in America are dying out. This is the bit I found interesting: And perhaps most important, the centuries-old apprenticeship system underpinning organized pickpocketing has been disrupted. Pickpocketing has always perpetuated itself by having older hooks -- nicknamed "Fagins," after the crime boss in Oliver Twist -- teach younger ones the art, and then absorbing them into canons. But due...
NIST SHA-3 News
NIST has finally published its rationale for selecting the five finalists....
Erasing Data from Flash Drives
"Reliably Erasing Data From Flash-Based Solid State Drives," by Michael Wei, Laura M. Grupp, Frederick E. Spada, and Steven Swanson. Abstract: Reliably erasing data from storage media (sanitizing the media) is a critical component of secure data management. While sanitizing entire disks and individual files is well-understood for hard drives, flash-based solid state disks have a very different internal architecture,...
Anonymous vs HBGary
One of the effects of writing a book is that I don't have the time to devote to other writing. So while I've been wanting to write about Anonymous vs HBGary, I don't think I will have time. Here's an excellent series of posts on the topic from ArsTechnica. In cyberspace, the balance of power is on the side of...
Friday Squid Blogging: Squid Tattoo
Impressive, even if it isn't real....
HBGary and the Future of the IT Security Industry
This is a really good piece by Paul Roberts on Anonymous vs. HBGary: not the tactics or the politics, but what HBGary demonstrates about the IT security industry. But I think the real lesson of the hack - and of the revelations that followed it - is that the IT security industry, having finally gotten the attention of law makers,...
Good Article About the Terrorist Non-Threat
From Reason: Know thy enemy is an ancient principle of warfare. And if America had heeded it, it might have refrained from a full-scale "war" on terrorism whose price tag is touching $2 TRILLION. That's because the Islamist enemy it is confronting is not some hyper-power capable of inflicting existential -- or even grave -- harm. It is, rather, a...
Susan Landau on Government Surveillance of the Internet
Excellent House testimony....
Terrorist-Catching Con Man
Interesting story about a con man who conned the U.S. government, and how the government is trying to hide its dealings with him. For eight years, government officials turned to Dennis Montgomery, a California computer programmer, for eye-popping technology that he said could catch terrorists. Now, federal officials want nothing to do with him and are going to extraordinary lengths...
Friday Squid Blogging: Research into Squid Hearing
Interesting: Squid can hear, scientists have confirmed. But they don't detect the changes in pressure associated with sound waves, like we do. They have another, more primitive, technique for listening: They sense the motion generated by sound waves. [...] Squid have two sac-like organs called statocysts near the base of their brains. Hair cells line the sac and project into...
Biometric Wallet
Not an electronic wallet, a physical one: Virtually indestructible, the dunhill Biometric Wallet will open only with touch of your fingerprint. It can be linked via Bluetooth to the owner's mobile phone sounding an alarm if the two are separated by more than 5 metres! This provides a brilliant warning if either the phone or wallet is stolen or...
NIST Defines New Versions of SHA-512
NIST has just defined two new versions of SHA-512. They're SHA-512/224 and SHA-512/256: 224- and 256-bit truncations of SHA-512 with a new IV. They've done this because SHA-512 is faster than SHA-256 on 64-bit CPUs, so these new SHA variants will be faster. This is a good thing, and exactly what we did in the design of Skein. We defined...
Historical Study of the NSA Scientific Advisory Board
Recently declassified: "Historical Study: The National Security Agency Scientific Advisory Board 1952¿1963."...
Romanian Hackers
Interesting article from Wired: "How a Remote Town in Romania Has Become Cybercrime Central."...
The Seven Types of Hackers
Roger Grimes has an article describing "the seven types of malicious hackers." I generally like taxonomies, and this one is pretty good. He says the seven types are: Cyber criminals Spammers and adware spreaders Advanced persistent threat (APT) agents Corporate spies Hactivists Cyber warriors Rogue hackers...
Societal Security
Humans have a natural propensity to trust non-kin, even strangers. We do it so often, so naturally, that we don't even realize how remarkable it is. But except for a few simplistic counterexamples, it's unique among life on this planet. Because we are intelligently calculating and value reciprocity (that is, fairness), we know that humans will be honest and nice:...
Credit Card Fraud Ring
It amazes me that credit card fraud is so easy that you can run it from prison....
Friday Squid Blogging: Squid Pheromone
A newly discovered female squid pheromone sparks aggression in male squids. Article....
Julian Sanchez on Balancing Privacy and Security
From a blog post: In my own area of study, the familiar trope of "balancing privacy and security" is a source of constant frustration to privacy advocates, because while there are clearly sometimes tradeoffs between the two, it often seems that the zero-sum rhetoric of "balancing" leads people to view them as always in conflict. This is, I suspect, the...
How Feed-Over-Email Circumvents Chinese Censorship
Neat article, both the technology and the hacker who created it....
Hacking Scratch Lottery Tickets
Design failure means you can pick winning tickets before scratching the coatings off. Most interesting is that there's statistical evidence that this sort of attack has been occurring in the wild: not necessarily this particular attack, but some way to separate winners from losers without voiding the tickets. Since this article was published in Wired, another technique of hacking scratch...
Bomb-Sniffing Mice
I was interviewed for this story on a mouse-powered explosives detector. Animal senses are better than any detection machine current technology can build, which makes it a good idea. But the challenges of using animals in this sort of situation are considerable. The neat thing about the technology profiled in the article, which the article didn't make as clear as...
Micromorts
I'd never heard the term "micromort" before. It's a probability: a one-in-a-million probability of death. For example, one-micromort activities are "travelling 230 miles (370 km) by car (accident)," and "living 2 days in New York or Boston (air pollution)." I don't know if that data is accurate; it's from the Wikipedia entry. In any case, I think it's a useful...
Scareware: How Crime Pays
Scareware is fraudulent software that uses deceptive advertising to trick users into believing they're infected with some variety of malware, then convinces them to pay money to protect themselves. The infection isn't real, and the software they buy is fake, too. It's all a scam. Here's one scareware operator who sold "more than 1 million software products" at "$39.95 or...
Friday Squid Blogging: Reducing Squid Odor
Research from Japan: "Improvement of 'kurozukuri ika-shiokara' (fermented squid meat with ink) odor with Staphylococcus nepalensis isolated from the fish sauce mush of frigate mackerel Auxis rochei."...
UK Immigration Officer Puts Wife on the No-Fly List
A UK immigration officer decided to get rid of his wife by putting her on the no-fly list, ensuring that she could not return to the UK from abroad. This worked for three years, until he put in for a promotion and -- during the routine background check -- someone investigated why his wife was on the no-fly list. Okay,...
Terrorist Targets of Choice
This makes sense. Generally, militants prefer to attack soft targets where there are large groups of people, that are symbolic and recognizable around the world and that will generate maximum media attention when attacked. Some past examples include the World Trade Center in New York, the Taj Mahal Hotel in Mumbai and the London Underground. The militants' hope is that...
ATM Skimmer on Bank Door Lock
This is a clever development in ATM skimming technology. It's a skimmer that attaches to the ATM-room door lock, not the ATM itself. Combined with a hidden camera, it's an ATM skimmer that requires no modification to the ATM....
Hacking HTTP Status Codes
One website can learn if you're logged into other websites. When you visit my website, I can automatically and silently determine if you're logged into Facebook, Twitter, GMail and Digg. There are almost certainly thousands of other sites with this issue too, but I picked a few vulnerable well known ones to get your attention. You may not care that...
Kip Hawley Comments on the Domodedovo Airport Bombing
This is the first piece of writing I've seen from Kip Hawley since he left the TSA in 2009. It's mostly generalities and platitudes....
Me on Color-Coded Terrorist Threat Levels
I wrote an op-ed for CNN.com on the demise of the color-coded terrorist theat level system. It's nothing I haven't said before, so I won't reprint it here. The best thing about the system was the jokes it inspired late-night comedians, and others, to make. In memoriam, people should post the funniest of those jokes here....
Jury Says it's Okay to Record the TSA
The Seattle man who refused to show ID to the TSA and recorded the whole incident has been cleared of all charges: [The jury] returned not guilty verdicts for charges that included concealing his identity, refusing to obey a lawful order, trespassing, and disorderly conduct. Papers, Please! says the acquittal proves what TSA critics have said all along: That checkpoint...
Trojan Steals Credit Card Numbers
It's only a proof of concept, but it's scary nonetheless. It's a Trojan for Android phones that looks for credit-card numbers, either typed or spoken, and relays them back to its controller. Software released for Android devices has to request permissions for each system function it accesses–with apps commonly requesting access to the network, phone call functionality, internal and external...
Domodedovo Airport Bombing
I haven't written anything about the suicide bombing at Moscow's Domodedovo Airport because I didn't think there was anything to say. The bomber was outside the security checkpoint, in the area where family and friends wait for arriving passengers. From a security perspective, the bombing had nothing to do with airport security. He could have just as easily been in...
$100 to Put a Bomb on an Airplane
An undercover TSA agent successfully bribed JetBlue ticket agent to check a suitcase under a random passenger's name and put it on an airplane. As with a lot of these tests, I'm not that worried because it's not a reliable enough tactic to build a plot around. But untrustworthy airline personnel -- or easily bribeable airline personal -- could be...
Whitelisting vs. Blacklisting
The whitelist/blacklist debate is far older than computers, and it's instructive to recall what works where. Physical security works generally on a whitelist model: if you have a key, you can open the door; if you know the combination, you can open the lock. We do it this way not because it's easier -- although it is generally much easier...
U.S. Strategy to Prevent Leaks is Leaked
As the article says, it doesn't get any more ironic than that. More importantly, it demonstrates how hard it is to keep secrets in the age of the Internet. Me: I think the government is learning what the music and movie industries were forced to learn years ago: it's easy to copy and distribute digital files. That's what's different between...
Security Theater in the Theater
This is a bit surreal: Additional steps are needed to prepare Broadway theaters in New York City for a potential WMD attack or other crisis, a New York state legislature subcommittee said yesterday. [...] Broadway district personnel did not know "what to do in case of an emergency as well as the unique problems that a theater workplace poses in...
Unsecured IP Security Cameras
It's amazing how many security cameras are on the Internet, accessible by anyone. And it's not just for viewing; a lot of these cameras can be reprogrammed by anyone....
Bioencryption
A group of students at the Chinese University in Hong Kong have figured out how to store data in bacteria. The article talks about how secure it is, and the students even coined the term "bioencryption," but I don't see any encryption. It's just storage. Another article: They have also developed a three-tier security fence to encode the data, which...
REAL-ID Implementation
According to this study, REAL-ID has not only been cheaper to implement than the states estimated, but also helpful in reducing fraud. States are finding that implementation of the 2005 REAL ID Act is much easier and less expensive than previously thought, and is a significant factor in reducing fraud. In cases like Indiana, REAL ID has significantly improved customer...
Hacking Tamper-Evident Devices
At the Black Hat conference lasts week, Jamie Schwettmann and Eric Michaud presented some great research on hacking tamper-evident seals. Jamie Schwettmann and Eric Michaud of i11 Industries went through a long list of tamper evident devices at the conference here and explained, step-by-step, how each seal can be circumvented with common items, such as various solvents, hypodermic needles, razors,...
Brute-Force Safecracking
This safecracking robot tries every possible combination, one after another: Combination space optimization is the key. By exploiting of the mechanical tolerances of the lock and certain combination "forbidden zones", we reduced the number of possible combinations by about an order of magnitude. Opening the safe took "just a few hours." Along the same lines, here's a Lego robot that...
Blowfish in Good Time Max
This screen shot is from the movie "Good Time Max." 17 minutes and 52 seconds into the movie, it shows Blowfish being used as an encryption algorithm....
Cyberwar is Overhyped
A new report from the OECD says the threat of cyberwar has been grossly exaggerated. (Hey, that's what I said.) There are lots of news articles. Also worth reading is this article on cyberwar hype and how it isn't serving our national interests, with some good policy guidelines....
The Legality of the Certificate Authority Trust Model
Interesting research: We looked at the standard legal documents issued by the certificate authorities or "CAs," including exemplar Subscriber Agreements (agreements between CAs and website operators); "Certification Practice Statements" (statements by CAs outlining their business practices); and Relying Party Agreements (purported agreements between CAs and "relying parties," such as end-users). What we found was surprising: "Relying Party Agreements" purport to...
Cost-Benefit Analysis of Full-Body Scanners
Research paper from Mark Stewart and John Mueller: The Transportation Security Administration (TSA) has been deploying Advanced Imaging Technologies (AIT) that are full-body scanners to inspect a passenger's body for concealed weapons, explosives, and other prohibited items. The terrorist threat that AITs are primarily dedicated to is preventing the downing of a commercial airliner by an IED (Improvised Explosive Device)...
Do Corporations Have a Right to Privacy?
This week, the U.S. Supreme Court will hear arguments about whether or not corporations have the same rights to "personal privacy" that individuals do. This is a good analysis of the case. I signed on to a "friend of the court" brief put together by EPIC, arguing that they do not. More background here. And an editorial from The Washington...
Odd Art Forger
He's not in it for the money: Mr. Landis...has been one of the most prolific forgers American museums have encountered in years, writing, calling and presenting himself at their doors, where he tells well-concocted stories about his family's collection and donates small, expertly faked works, sometimes in honor of nonexistent relatives. Unlike most forgers, he does not seem to be...
Movie-Plot Threats at the U.S. Capitol
This would make a great movie: Rep. Dan Burton, R-Ind., renewed his call for the installation of an impenetrable, see-through security shield around the viewing gallery overlooking the House floor. Burton points out that, while guns and some bombs would be picked up by metal detectors, a saboteur could get into the Capitol concealing plastic explosives. The House floor, he...
More Stuxnet News
This long New York Times article includes some interesting revelations. The article claims that Stuxnet was a joint Israeli-American project, and that its effectiveness was tested on live equipment: "Behind Dimona's barbed wire, the experts say, Israel has spun nuclear centrifuges virtually identical to Iran's at Natanz, where Iranian scientists are struggling to enrich uranium." The worm itself now appears...
New Revelations in the Mahmoud al-Mabhouh Assassination
I wrote a lot last year about the assassination of Mahmoud al-Mabhouh in Dubai. There's a new article by an Israeli investigative journalist that tells the story we already knew, and adds a bunch of interesting details. Well worth reading....
Friday Squid Blogging: Deep-Sea Squid Video
"Anthology of Deep-Sea Squids," from the Monterey Bay Aquarium....
Me on Airport Security
Last week, I spoke at an airport security conference hosted by EPIC: The Stripping of Freedom: A Careful Scan of TSA Security Procedures. Here's the video of my half-hour talk....
Loaded Gun Slips Past TSA
I'm not really worried about mistakes like this. Sure, a gun slips through occasionally, and a knife slips through even more often. (I'm sure the TSA doesn't catch 100% of all bombs in tests, either.) But these items are caught by the TSA often enough, and when the TSA does catch someone, they're going to call the police and totally...
Surviving a Terrorist's Nuclear Attack
Interesting reading, mostly for the probable effects of a terrorist-sized nuclear bomb. A terrorist bomb is likely to be relatively small -- possibly only a fraction of the Hiroshima bomb's explosive power -- and likely exploded at ground level. This means that the area totally destroyed by the explosion is likely to be much smaller than the area exposed to...
Stealing SIM Cards from Traffic Lights
Johannesburg installed hundreds of networked traffic lights on its streets. The lights use a cellular modem and a SIM card to communicate. Those lights introduced a security risk I'll bet no one gave a moment's thought to: that criminals might steal the SIM cards from the traffic lights and use them to make free phone calls. But that's exactly what...
The Security Threat of Forged Law-Enforcement Credentials
Here's a U.S. Army threat assessment of forged law-enforcement credentials. The authors bought a bunch of fake badges: Between November 2009 and March 2010, undercover investigators were able to purchase nearly perfect counterfeit badges for all of the Department of Defense's military criminal investigative organizations to include the Army Criminal Investigation Command (Army CID), Naval Criminal Investigative Service (NCIS), Air...
Attacking High-Frequency Trading Networks
Turns out you can make money by manipulating the network latency. cPacket has developed a proof of concept showing that these side-channel attacks can be used to create tiny delays in the transmission of market data and trades. By manipulating specific trading activities by several microseconds, an attacker could gain unfair trading advantage. And because the operation occurs outside the...
"Homeland Security Hasn't Made Us Safer"
This will be nothing new to readers of this blog, but it's nice to read other people saying it too....
James Fallows on Political Shootings
Interesting: So the train of logic is: anything that can be called an "assassination" is inherently political; very often the "politics" are obscure, personal, or reflecting mental disorders rather than "normal" political disagreements. But now a further step, the political tone of an era can have some bearing on violent events. The Jonestown/Ryan and Fromme/Ford shootings had no detectable source...
Friday Squid Blogging: Biggest Squid Ever
It's an oil field: Brazil's state-run Petrobras confirmed Wednesday that oil fields recently discovered offshore contained 8.3 billion barrels of recoverable crude and gas -- and said the biggest field was being renamed "Lula." That nomenclature happens to be the nickname of President Luiz Inacio Lula da Silva, who steps down on Saturday after overseeing eight years of prosperity in...
The Social Dynamics of Terror
Good essay: Nineteenth-century anarchists promoted what they called the "propaganda of the deed," that is, the use of violence as a symbolic action to make a larger point, such as inspiring the masses to undertake revolutionary action. In the late 1960s and early 1970s, modern terrorist organizations began to conduct operations designed to serve as terrorist theater, an undertaking greatly...
SMS of Death
This will be hard to fix: Using only Short Message Service (SMS) communications–messages that can be sent between mobile phones–a pair of security researchers were able to force low-end phones to shut down abruptly and knock them off a cellular network. As well as text messages, the SMS protocol can be used to transmit small programs, called "binaries," that run...
Sony PS3 Security Broken
Sony used an ECDSA signature scheme to protect the PS3. Trouble is, they didn't pay sufficient attention to their random number generator....
Eavesdropping on GSM Calls
It's easy and cheap: Speaking at the Chaos Computer Club (CCC) Congress in Berlin on Tuesday, a pair of researchers demonstrated a start-to-finish means of eavesdropping on encrypted GSM cellphone calls and text messages, using only four sub-$15 telephones as network "sniffers," a laptop computer, and a variety of open source software. The encryption is lousy: Several of the individual...
Guard Towers at WalMart
This feels very creepy and police-state-like. What on earth could WalMart be worried about?...
Polar Bears Destroying Hidden Cameras
Watch the video. What valuable security lessons does this teach? EDITED TO ADD (1/3): And why aren't the polar bears destroying the hidden cameras that are filming the polar bears destroying the hidden cameras?...
Friday Squid Blogging: Research into Squid Skin
DoD awarded a $6M grant to study squid skin: "Our internal nickname for this project is 'squid skin,' but it is really about fundamental research," said Naomi Halas, a nano-optics pioneer at Rice and the principal investigator on the four-year grant. "Our deliverable is knowledge -- the basic discoveries that will allow us to make materials that are observant, adaptive...
TSA Inspecting Thermoses
This is new: Adm. James Winnefeld told The Associated Press Friday that the Transportation Security Administration is "always trying to think ahead." Winnefeld is the head of the U.S. Northern Command, which is charged with protecting the homeland. TSA officials had said Thursday that in coming days, passengers flying within and to the U.S. may notice additional security measures related...
Terrorism Reading List
Interesting interview, discussing five books (none of which I've read, by the way)....
An Honest Privacy Policy
Funny: The data we collect is strictly anonymous, unless you've been kind enough to give us your name, email address, or other identifying information. And even if you have been that kind, we promise we won't sell that information to anyone else, unless of course our impossibly obtuse privacy policy says otherwise and/or we change our minds tomorrow. There's a...
This Suspicious Photography Stuff Is Confusing
See: Last week, Metro Transit Police received a report from a rider about suspicious behavior at the L'Enfant Plaza station and on an Orange Line train to Vienna. The rider told Metro he saw two men acting suspiciously and videotaping platforms, trains and riders. "The men, according to the citizen report, were trying to be inconspicuous, holding the cameras at...
PlugBot
Interesting: PlugBot is a hardware bot. It's a covert penetration testing device designed for use during physical penetration tests. PlugBot is a tiny computer that looks like a power adapter; this small size allows it to go physically undetected all the while powerful enough to scan, collect and deliver test results externally. How do you use it? Gain access to...
Cyberwar Movie Plot from an Actual Thriller Writer
It could make a good movie....
Interview with the European Union Privacy Chief
Interesting interview with Viviane Reding, the vice president of the EU Justice Commission and head of privacy regulation: The basic values in Europe are that we have the right to our own private, personal data. It's mine. And if one agrees to give that data,then it is available. That is known as opt-in consent and we've had that as law...
Adam Shostack on TSA Threat Modeling
Good commentary: I've said before and I'll say again, there are lots of possible approaches to threat modeling, and they all involve tradeoffs. I've commented that much of the problem is the unmeetable demands TSA labors under, and suggested fixes. If TSA is trading planned responses to Congress for effective security, I think Congress ought to be asking better questions....
Recording the Police
I've written a lot on the "War on Photography," where normal people are harassed as potential terrorists for taking pictures of things in public. This article is different; it's about recording the police: Allison's predicament is an extreme example of a growing and disturbing trend. As citizens increase their scrutiny of law enforcement officials through technologies such as cell phones,...
Book Review: Cyber War
Cyber War: The Next Threat to National Security and What to do About It by Richard Clarke and Robert Knake, HarperCollins, 2010. Cyber War is a fast and enjoyable read. This means you could give the book to your non-techy friends, and they'd understand most of it, enjoy all of it, and learn a lot from it. Unfortunately, while there's...
Computational Forensics
Interesting article from IEEE Spectrum: During two years of deliberation by the National Academy's forensic science committee (of which I was a member), a troubling picture emerged. A large part of current forensics practice is skill and art rather than science, and the influences present in a typical law-enforcement setting are not conducive to doing the best science. Also, many...
"Architecture of Fear"
I like the phrase: Németh said the zones not only affect the appearance of landmark buildings but also reflect an 'architecture of fear' as evidenced, for example, by the bunker-like appearance of embassies and other perceived targets. Ultimately, he said, these places impart a dual message -- simultaneously reassuring the public while causing a sense of unease. And in the...
Friday Squid Blogging: Prosthetic Tentacle
Impressive: Designed for a class project while getting her degree at the Industrial Design Department at the University of Washington, Kaylene Kau has not only exploded perceptions of how prosthetic arms should look, but sent an entire subset of Japanese Hentai fans to their feet, cheering her on. If that's not worth an employer's attention, I don't know what is....
Hiding PETN from Full-Body Scanners
From the Journal of Transporation Security, "An evaluation of airport x-ray backscatter units based on image characteristics," by Leon Kaufman and Joseph W. Carlson: Abstract: Little information exists on the performance of x-ray backscatter machines now being deployed through UK, US and other airports. We implement a Monte Carlo simulation using as input what is known about the x-ray spectra...
Did the FBI Plant Backdoors in OpenBSD?
It has been accused of it. I doubt this is true. One, it's a very risky thing to do. And two, there are more than enough exploitable security vulnerabilities in a piece of code that large. Finding and exploiting them is a much better strategy than planting them. But maybe someone at the FBI is that dumb. Further information is...
Fake Amazon Receipt Generators
They can be used to scam Amazon Marketplace merchants: What happens once our scammer is armed with his fake receipt? Well, many sellers on Amazon will ask you to send them a copy of your receipt should you run into trouble, have orders go missing, lose your license key for a piece of software and so on. The gag here...
Security in 2020
There's really no such thing as security in the abstract. Security can only be defined in relation to something else. You're secure from something or against something. In the next 10 years, the traditional definition of IT security–that it protects you from hackers, criminals, and other bad guys–will undergo a radical shift. Instead of protecting you from the bad guys,...
Realistic Masks
They're causing problems: A white bank robber in Ohio recently used a "hyper-realistic" mask manufactured by a small Van Nuys company to disguise himself as a black man, prompting police there to mistakenly arrest an African American man for the crimes. In October, a 20-year-old Chinese man who wanted asylum in Canada used one of the same company's masks to...
Evan Kohlmann
Interesting profile of Evan Kohlmann: Evan Kohlmann spends his days lurking in the darkest corners of the Internet, where jihadists recruit sympathizers from across the globe. He has testified in over two dozen terrorism trials -- and sees danger everywhere he looks. Is he prescient or naïve?...
Proprietary Encryption in Car Immobilizers Cracked
This shouldn't be a surprise: Karsten Nohl's assessment of dozens of car makes and models found weaknesses in the way immobilisers are integrated with the rest of the car's electronics. The immobiliser unit should be connected securely to the vehicle's electronic engine control unit, using the car's internal data network. But these networks often use weaker encryption than the immobiliser...
Sometimes CCTV Cameras Work
Sex attack caught on camera. Hamilton police have arrested two men after a sex attack on a woman early today was caught on the city's closed circuit television (CCTV) cameras. CCTV operators contacted police when they became concerned about the safety of a woman outside an apartment block near the intersection of Victoria and Collingwood streets about 5am today. Remember,...
CRB Check Backlash
Against stupid CRB checks: Last January, Annabel Hayter, chairwoman of Gloucester Cathedral Flower Guild, received an email saying that she and her 60 fellow flower arrangers would have to undergo a CRB check. CRB stands for Criminal Records Bureau, and a CRB check is a time-consuming, sometimes expensive, pretty much always pointless vetting procedure that you must go through if...
Interview with TSA Administrator John Pistole
He's more realistic than one normally hears: So if they get through all those defenses, they get to Reagan [National Airport] over here, and they've got an underwear bomb, they got a body cavity bomb -- what's reasonable to expect TSA to do? Hopefully our behavior detection people will see somebody sweating, or they're dancing on their shoes or something,...
Friday Squid Blogging: Glowing Squid
Recent research. And an older video....
New TSA Security Test
I experienced a new TSA security check at Phoenix Airport last Thursday. The agent took my over-three-ounce bottle of saline, put a drop of it on a white cardboard strip, and then put a drop of another liquid on top of that. Nothing changed color, and she let me go. Anyone know what the test is, and what it's testing...
NIST Announces SHA-3 Finalists (Skein is One of Them)
Yesterday, NIST announced the five hash functions to advance to the third (and final) round in the SHA-3 selection process: BLAKE, Grøstl, JH, Keccak, and Skein. Not really a surprise; my predictions -- which I did not publish -- listed ECHO instead of JH, but correctly identified the other four. (Most of the predictions I saw guessed BLAKE, Grøstl, Keccak,...
Alternate Scanning Technologies
Iscon uses infrared light rather than X-rays. I have no idea how well it works. And Rapiscan has a new patent: Abstract: The present invention is directed towards an X-ray people screening system capable of rapidly screening people for detection of metals, low Z materials (plastics, ceramics and illicit drugs) and other contraband which might be concealed beneath the person's...
Department of Homeland Security Getting a Little too 1984ish
A DHS video message, reminding people to look out for and report suspicious activity, will be displayed at WalMart stores around the country....
WikiLeaks
I don't have a lot to say about WikiLeaks, but I do want to make a few points. 1. Encryption isn't the issue here. Of course the cables were encrypted, for transmission. Then they were received and decrypted, and -- so it seems -- put into an archive on SIPRNet, where lots of people had access to them. 2. Secrets...
Never Let the Terrorists Know How We're Storing Road Salt
This seems not to be a joke: The American Civil Liberties Union has filed a lawsuit against the state after it refused to release the construction plans for a barn used to store road salt, on the basis that doing so would be a security risk. [...] Chiaffarano filed an OPRA request for the state's building plans, but was denied...
Sane Comments on Terrorism
From Michael Leiter, the director of the National Counterterrorism Center: Ultimately, Leiter said, it'll be the "quiet, confident resilience" of Americans after a terrorist attack that will "illustrate ultimately the futility of terrorism." That doesn't mean not to hit back: Leiter quickly added that "we will hold those accountable [and] we will be ready to respond to those attacks." But...
Profiling Lone Terrorists
Masters Thesis from the Naval Postgraduate School: "Patterns of Radicalization: Identifying the Markers and Warning Signs of Domestic Lone Wolf Terrorists in Our Midst." Abstract: This thesis will scrutinize the histories of our nation's three most prolific domestic lone wolf terrorists: Tim McVeigh, Ted Kaczynski, and Eric Rudolph. It will establish a chronological pattern to their radicalization and reveal that...
FTC Privacy Report
The U.S. Federal Trade Commission released its privacy report: "Protecting Consumer Privacy in an Era of Rapid Change." From the press release: One method of simplified choice the FTC staff recommends is a "Do Not Track" mechanism governing the collection of information about consumer's Internet activity to deliver targeted advertisements and for other purposes. Consumers and industry both support increased...
Cyberwar and the Future of Cyber Conflict
The world is gearing up for cyberwar. The U.S. Cyber Command became operational in November. NATO has enshrined cyber security among its new strategic priorities. The head of Britain's armed forces said recently that boosting cyber capability is now a huge priority for the UK. And we know China is already engaged in broad cyber espionage attacks against the west....
Friday Squid Blogging: New Species of Squid Discovered
New species of squid discovered in the Southern Indian Ocean....
Football Match Fixing
Detecting fixed football (soccer) games. There is a certain buzz of expectation, because Oscar, one of the fraud analysts, has spotted a game he is sure has been fixed. "We've been watching this for a couple of weeks now," he says. "The odds have gone to a very suspicious level. We believe that this game will finish in an away...
Full Body Scanners: What's Next?
Organizers of National Opt Out Day, the Wednesday before Thanksgiving when air travelers were urged to opt out of the full-body scanners at security checkpoints and instead submit to full-body patdowns -- were outfoxed by the TSA. The government pre-empted the protest by turning off the machines in most airports during the Thanksgiving weekend. Everyone went through the metal...
Close the Washington Monument
Securing the Washington Monument from terrorism has turned out to be a surprisingly difficult job. The concrete fence around the building protects it from attacking vehicles, but there's no visually appealing way to house the airport-level security mechanisms the National Park Service has decided are a must for visitors. It is considering several options, but I think we should close...
Brian Snow Sows Cyber Fears
That's no less sensational than the Calgary Herald headline: "Total cyber-meltdown almost inevitable, expert tells Calgary audience." That's former NSA Technical Director Brian Snow talking to a university audience. "It's long weeks to short months at best before there's a security meltdown," said Snow, as a guest lecturer for the Institute for Security, Privacy and Information Assurance, an interdisciplinary group...
Risk Reduction Strategies on Social Networking Sites
By two teenagers: Mikalah uses Facebook but when she goes to log out, she deactivates her Facebook account. She knows that this doesn't delete the account that's the point. She knows that when she logs back in, she'll be able to reactivate the account and have all of her friend connections back. But when she's not logged in, no...
Software Monoculture
In 2003, a group of security experts -- myself included -- published a paper saying that 1) software monocultures are dangerous and 2) Microsoft, being the largest creator of monocultures out there, is the most dangerous. Marcus Ranum responded with an essay that basically said we were full of it. Now, eight years later, Marcus and I thought it would...
The Constitutionality of Full-Body Scanners
Jeffrey Rosen opines: Although the Supreme Court hasn't evaluated airport screening technology, lower courts have emphasized, as the U.S. Court of Appeals for the 9th Circuit ruled in 2007, that "a particular airport security screening search is constitutionally reasonable provided that it 'is no more extensive nor intensive than necessary, in the light of current technology, to detect the presence...
Mohamed Osman Mohamud
I agree with Glenn Greenwald. I don't know if it's an actual terrorist that the FBI arrested, or if it's another case of entrapment. All of the information about this episode -- all of it -- comes exclusively from an FBI affidavit filed in connection with a Criminal Complaint against Mohamud. As shocking and upsetting as this may be to...
Zoo Security
From a study on zoo security: Among other measures, the scientists recommend not allowing animals to walk freely within the zoo grounds, and ensuring there is a physical barrier marking the zoo boundaries, and preventing individuals from escaping through drains, sewers or any other channels. Isn't all that sort of obvious?...
Causing Terror on the Cheap
Total cost for the Yemeni printer cartridge bomb plot: $4200. "Two Nokia mobiles, $150 each, two HP printers, $300 each, plus shipping, transportation and other miscellaneous expenses add up to a total bill of $4,200. That is all what Operation Hemorrhage cost us," the magazine said. Even if you add in costs for training, recruiting, logistics, and everything else, that's...
Friday Squid Blogging: Studying Squid Hearing
At Woods Hole: It is known now, through the work of Mooney and others, that the squid hearing system has some similarities and some differences compared to human hearing. Squid have a pair of organs called statocysts, balance mechanisms at the base of the brain that contain a tiny grain of calcium, which maintains its position as the animal maneuvers...
Psychopaths and Security
I have been thinking a lot about security against psychopaths. Or, at least, how we have traditionally secured social systems against these sorts of people, and how we can secure our socio-technical systems against them. I don't know if I have any conclusions yet, only a short reading list....
The Withdrawal of the A5/2 Encryption Algorithm
Interesting story of the withdrawal of the A5/2 encryption algorithm from GSM phones....
The DHS is Getting Rid of the Color-Coded Terrorism Alert System
Good. It was always a dumb idea: The color-coded threat levels were doomed to fail because "they don't tell people what they can do -- they just make people afraid," said Bruce Schneier, an author on security issues. He said the system was "a relic of our panic after 9/11" that "never served any security purpose." I wrote this in...
New ATM Skimming Attack
In Europe, although the article doesn't say where: Many banks have fitted ATMs with devices that are designed to thwart criminals from attaching skimmers to the machines. But it now appears in some areas that those devices are being successfully removed and then modified for skimming, according to the latest report from the European ATM Security Team (EAST), which collects...
David Kahn Donates his Cryptography Collection to the National Cryptologic Museum
Good for him. I think that's where my collection will be going, too....
Spoofing Geolocation
How to spoof your location on Facebook with your BlackBerry....
Me on Airport Security
Yesterday I participated in a New York Times "Room for Debate" discussion on airline security. My contribution is nothing I haven't said before, so I won't reprint it here. The other participants are worth reading too. I also did an interview in -- or all places -- Popular Mechanics....
Defeating al Qaeda
Rare common sense: But Gen Richards told the BBC it was not possible to defeat the Taliban or al-Qaeda militarily. "You can't. We've all said this. David Petraeus has said it, I've said it. "The trick is the balance of things that you're doing and I say that the military are just about, you know, there. "The biggest problem's been...
Stuxnet News
Another piece of the puzzle: New research, published late last week, has established that Stuxnet searches for frequency converter drives made by Fararo Paya of Iran and Vacon of Finland. In addition, Stuxnet is only interested in frequency converter drives that operate at very high speeds, between 807 Hz and 1210 Hz. The malware is designed to change the output...
Friday Squid Blogging: Flying Squid
Photographic evidence from Jamaica....
Me on Cyberwar
Last week, I gave a talk on cyberwar and cyberconflict at the Institute for International and European Affairs in Dublin. Here's the video. It was only the second time I've given the talk. About three quarters in, I noticed that I didn't have my fourth and final page of notes. So if the ending feels a bit scattered, that's why....
TSA Backscatter X-ray Backlash
Things are happening so fast that I don't know if I should bother. But here are some links and observations. The head of the Allied Pilots Association is telling its members to avoid both the full body scanners and the patdowns. This first-hand report, from a man who refused to fly rather than subject himself to a full-body scan or...
Airplane Terrorism Twenty Years Ago
Excellent: Here's a scenario: Middle Eastern terrorists hijack a U.S. jetliner bound for Italy. A two-week drama ensues in which the plane's occupants are split into groups and held hostage in secret locations in Lebanon and Syria. While this drama is unfolding, another group of terrorists detonates a bomb in the luggage hold of a 747 over the North Atlantic,...
Unsolicited Terrorism Tips to the U.S. Government
Adding them all up, the U.S. government "receives between 8,000 and 10,000 pieces of information per day, fingering just as many different people as potential threats. They also get information about 40 supposed plots against the United States or its allies daily." All of this means that first-time suspects and isolated pieces of information are less likely to be exhaustively...
New Biometric
Eye movements instead of eye structures. The new system tracks the way a person's eye moves as he watches an icon roam around a computer screen. The way the icon moves can be different every time, but the user's eye movements include "kinetic features" -- slight variations in trajectory -- that are unique, making it possible to identify him....
Term Paper Writing for Hire
This recent essay (commentary here) reminded me of this older essay, both by people who write student term papers for hire. There are several services that do automatic plagiarism detection -- basically, comparing phrases from the paper with general writings on the Internet and even caches of previously written papers -- but detecting this kind of custom plagiarism work is...
Internet Quarantines
Last month, Scott Charney of Microsoft proposed that infected computers be quarantined from the Internet. Using a public health model for Internet security, the idea is that infected computers spreading worms and viruses are a risk to the greater community and thus need to be isolated. Internet service providers would administer the quarantine, and would also clean up and update...
Albert Gonzalez
Long article on convicted hacker Albert Gonzalez from The New York Times Magazine....
Camouflaging Test Cars
Interesting: In an effort to shield their still-secret products from prying eyes, automakers testing prototype models, often in the desert and at other remote locales, have long covered the grilles and headlamps with rubber, vinyl and tape the perfunctory equivalent of masks and hats. Now the old materials are being replaced or supplemented with patterned wrappings applied like wallpaper....
Bulletproof Service Providers
From Brian Krebs: Hacked and malicious sites designed to steal data from unsuspecting users via malware and phishing are a dime a dozen, often located in the United States, and are a key target for takedown by ISPs and security researchers. But when online miscreants seek stability in their Web projects, they often turn to so-called "bulletproof hosting" providers, mini-ISPs...
Changing Passwords
How often should you change your password? I get asked that question a lot, usually by people annoyed at their employer's or bank's password expiration policy: people who finally memorized their current password and are realizing they'll have to write down their new password. How could that possibly be more secure, they want to know. The answer depends on what...
Removing Belts at Airport Security
The TSA is making us remove our belts even when we don't have to. European airports have made us remove our belts for years. My normal tactic is to pull my shirt tails out of my pants and over my belt. Then I flash my waist and tell them I'm not wearing a belt. It doesn't set off the metal...
Securing the Washington Monument
Good article on security options for the Washington Monument: Unfortunately, the bureaucratic gears are already grinding, and what will be presented to the public Monday doesn't include important options, including what became known as the "tunnel" in previous discussions of the issue. Nor does it include the choice of more minimal visitor screening -- simple wanding or visual bag inspection...
Crowdsourcing Surveillance
Internet Eyes is a U.K. startup designed to crowdsource digital surveillance. People pay a small fee to become a "Viewer." Once they do, they can log onto the site and view live anonymous feeds from surveillance cameras at retail stores. If they notice someone shoplifting, they can alert the store owner. Viewers get rated on their ability to differentiate real...
Kahn, Diffie, Clark, and Me at Bletchley Park
Saturday, I visited Bletchley Park to speak at the Annual ACCU Security Fundraising Conference. They had a stellar line of speakers this year, and I was pleased to be a part of the day. Talk #1: "The Art of Forensic Warfare," Andy Clark. Riffing on Sun Tzu's The Art of War, Clark discussed the war -- the back and forth...
Young Man in "Old Man" Mask Boards Plane in Hong Kong
It's kind of an amazing story. A young Asian man used a rubber mask to disguise himself as an old Caucasian man and, with a passport photo that matched his disguise, got through all customs and airport security checks and onto a plane to Canada. The fact that this sort of thing happens occasionally doesn't surprise me. It's human nature...
The End of In-Flight Wi-Fi?
Okay, now the terrorists have really affected me personally: they're forcing us to turn off airplane Wi-Fi. No, it's not that the Yemeni package bombs had a Wi-Fi triggering mechanism -- they seem to have had a cell phone triggering mechanism, dubious at best -- but we can imagine an Internet-based triggering mechanism. Put together a sloppy and unsuccessful package...
"A Social Network Approach to Understanding an Insurgency"
Interesting....
The Business of Botnets
It can be lucrative: Avanesov allegedly rented and sold part of his botnet, a common business model for those who run the networks. Other cybercriminals can rent the hacked machines for a specific time for their own purposes, such as sending a spam run or mining the PCs for personal details and files, among other nefarious actions. Dutch prosecutors believe...
Did the FBI Invent the D.C. Bomb Plot?
Last week the police arrested Farooque Ahmed for plotting a terrorist attack on the D.C. Metro system. However, it's not clear how much of the plot was his idea and how much was the idea of some paid FBI informants: The indictment offers some juicy tidbits -- Ahmed allegedly proposed using rolling suitcases instead of backpacks to bomb the Metro...
Dan Geer on "Cybersecurity and National Policy"
Worth reading: Those with either an engineering or management background are aware that one cannot optimize everything at once that requirements are balanced by constraints. I am not aware of another domain where this is as true as it is in cybersecurity and the question of a policy response to cyber insecurity at the national level. In engineering, this...
Control Fraud
I had never heard the term "control fraud" before: Control fraud theory was developed in the savings and loan debacle. It explained that the person controlling the S&L (typically the CEO) posed a unique risk because he could use it as a weapon. The theory synthesized criminology (Wheeler and Rothman 1982), economics (Akerlof 1970), accounting, law, finance, and political science....
Halloween and the Irational Fear of Stranger Danger
From the Wall Street Journal: Take "stranger danger," the classic Halloween horror. Even when I was a kid, back in the "Bewitched" and "Brady Bunch" costume era, parents were already worried about neighbors poisoning candy. Sure, the folks down the street might smile and wave the rest of the year, but apparently they were just biding their time before stuffing...
Cargo Security
The New York Times writes: "Despite the increased scrutiny of people and luggage on passenger planes since 9/11, there are far fewer safeguards for packages and bundles, particularly when loaded on cargo-only planes." Well, of course. We've always known this. We've not worried about terrorism on cargo planes because it isn't very terrorizing. Packages aren't people. If a passenger plane...
Friday Squid Blogging: Dissecting a Giant Squid
Interesting television program from UK Channel 4....
Me at TED
Okay, it's not TED. It's one of the independent regional TED events: TEDxPSU. My talk was "Reconceptualizing Security," a condensation of the hour-long talk into 18 minutes....
New Orleans Scrapping Surveillance Cameras
They're not worth it: In seven years, New Orleans' crime camera program has yielded six indictments: three for crimes caught on video and three for bribes and kickbacks a vendor is accused of paying a former city official to sell the cameras to City Hall....
FBI Bugging Embassies in 1940
Old -- but recently released -- document discussing the bugging of the Russian embassy in 1940. The document also mentions bugging the embassies of France, Germany, Italy, and Japan....
Firesheep
Firesheep is a new Firefox plugin that makes it easy for you to hijack other people's social network connections. Basically, Facebook authenticates clients with cookies. If someone is using a public WiFi connection, the cookies are sniffable. Firesheep uses wincap to capture and display the authentication information for accounts it sees, allowing you to hijack the connection. Slides from the...
Declassified NSA Documents
It's a long list. These items are not online; they're at the National Archives and Records Administration in College Park, MD. You can either ask for copies by mail under FOIA (at a 75 cents per page) or come in in person. There, you can read and scan them for free, or photocopy them for about 20 cents a page....
Steganography in the Longfin Inshore Squid
Really: While the notion that a few animals produce polarization signals and use them in communication is not new, Mäthger and Hanlon's findings present the first anatomical evidence for a “hidden communication channel” that can remain masked by typical camouflage patterns. Their results suggest that it might be possible for squid to send concealed polarized signals to one another while...
Video Interview with Me from RSA Europe
I was interviewed this week at RSA Europe....
FaceTime for Mac Security Hole
Once a user has logged into FaceTime, anyone with access to the machine can change the user's Apple ID password without knowing the old password....
Electronic Car Lock Denial-of-Service Attack
Clever: Inspector Richard Haycock told local newspapers that the possible use of the car lock jammers would help explain a recent spate of thefts from vehicles that have occurred without leaving any signs of forced entry. "We do get quite a lot of car crime in the borough where there's no sign of a break-in and items have been taken...
Workshop on the Economics of Information Security
I am the program chair for WEIS 2011, which is to be held next June in Washington, DC. Submissions are due at the end of February. Please forward and repost the call for papers....
Predator Software Pirated?
This isn't good: Intelligent Integration Systems (IISi), a small Boston-based software development firm, alleges that their Geospatial Toolkit and Extended SQL Toolkit were pirated by Massachusetts-based Netezza for use by a government client. Subsequent evidence and court proceedings revealed that the "government client" seeking assistance with Predator drones was none other than the Central Intelligence Agency. IISi is seeking an...
Hiding in Plain Sight
Ha! When he's out and about near his Denver home, former Broncos quarterback John Elway has come up with a novel way to travel incognito–he wears his own jersey. "I do that all the time here," the 50-year-old Hall of Famer told me. "I go to the mall that way. They know it's not me because they say there's no...
Fingerprinting Telephone Calls
This is clever: The tool is called PinDr0p, and works by analysing the various characteristic noise artifacts left in audio by the different types of voice network -- cellular, VoIP etc. For instance, packet loss leaves tiny gaps in audio signals, too brief for the human ear to detect, but quite perceptible to the PinDr0p algorithms. Vishers and others wishing...
Indian OS
India is writing its own operating system so it doesn't have to rely on Western technology: India's Defence Research and Development Organisation (DRDO) wants to build an OS, primarily so India can own the source code and architecture. That will mean the country won't have to rely on Western operating systems that it thinks aren't up to the job of...
Picking a Single Voice out of a Crowd
Interesting new technology. Squarehead's new system is like bullet-time for sound. 325 microphones sit in a carbon-fiber disk above the stadium, and a wide-angle camera looks down on the scene from the center of this disk. All the operator has to do is pinpoint a spot on the court or field using the screen, and the Audioscope works out how...
Pen-and-Paper SQL Injection Attack Against Swedish Election
Some copycat imitated this xkcd cartoon in Sweden, hand writing an SQL injection attack onto a paper ballot. Even though the ballot was manually entered into the vote database, the attack (and the various other hijinks) failed. This time. Three news links, in Swedish....
The FBI is Tracking Whom?
They're tracking a college student in Silicon Valley. He's 20, partially Egyptian, and studying marketing at Mission College. He found the tracking device attached to his car. Near as he could tell, what he did to warrant the FBI's attention is be the friend of someone who did something to warrant the FBI's attention. Afifi retrieved the device from his...
The Mahmoud al-Mabhouh Assassination
Remember the Mahmoud al-Mabhouh assassination last January? The police identified 30 suspects, but haven't been able to find any of them. Police spent about 10,000 hours poring over footage from some 1,500 security cameras around Dubai. Using face-recognition software, electronic-payment records, receipts and interviews with taxi drivers and hotel staff, they put together a list of suspects and publicized it....
The Economist on Biometrics
Good article. Here's my essay on biometrics, from 1999....
The Ineffectiveness of Vague Security Warnings
From Slate: We do nothing, first and foremost, because there is nothing we can do. Unless the State Department gets specific–e.g., "don't go to the Eiffel Tower tomorrow"–information at that level of generality is completely meaningless. Unless we are talking about weapons of mass destruction, the chances of being hit by a car while crossing the street are still greater...
Hacking Trial Breaks D.C. Internet Voting System
Sounds like it was easy: Last week, the D.C. Board of Elections and Ethics opened a new Internet-based voting system for a weeklong test period, inviting computer experts from all corners to prod its vulnerabilities in the spirit of "give it your best shot." Well, the hackers gave it their best shot -- and midday Friday, the trial period was...
Stuxnet
Computer security experts are often surprised at which stories get picked up by the mainstream media. Sometimes it makes no sense. Why this particular data breach, vulnerability, or worm and not others? Sometimes it's obvious. In the case of Stuxnet, there's a great story. As the story goes, the Stuxnet worm was designed and released by a government--the U.S. and...
The Politics of Allocating Homeland Security Money to States
From the Journal of Homeland Security and Emergency Management: "Politics or Risks? An Analysis of Homeland Security Grant Allocations to the States." Abstract: In the days following the September 11 terrorist attacks on the United States, the nation's elected officials created the USA Patriot Act. The act included a grant program for the 50 states that was intended to assist...
Putting Unique Codes on Objects to Detect Counterfeiting
This will help some. At least two rival systems plan to put unique codes on packages containing antimalarials and other medications. Buyers will be able to text the code to a phone number on the package and get an immediate reply of "NO" or "OK," with the drug's name, expiration date, and other information. To defeat the system, the counterfeiter...
Analyzing CAPTCHAs
New research: "Attacks and Design of Image Recognition CAPTCHAs." Abstract. We systematically study the design of image recognition CAPTCHAs (IRCs) in this paper. We first review and examine all IRCs schemes known to us and evaluate each scheme against the practical requirements in CAPTCHA applications, particularly in large-scale real-life applications such as Gmail and Hotmail. Then we present a security...
Sky Marshals Flying First Class
I regularly say that security decisions are primarily made for non-security reasons. This article about the placement of sky marshals on airplanes is an excellent example. Basically, the airlines would prefer they fly coach instead of first class. Airline CEOs met recently with TSA administrator John Pistole and officials from the Federal Air Marshal Service requesting the TSA to reconsider...
Monitoring Employees' Online Behavior
Not their online behavior at work, but their online behavior in life. Using automation software that slogs through Facebook, Twitter, Flickr, YouTube, LinkedIn, blogs, and "thousands of other sources," the company develops a report on the "real you" --- not the carefully crafted you in your resume. The service is called Social Intelligence Hiring. The company promises a 48-hour turn-around....
My Recording Debut
Okay, so this isn't a normal blog post. It's not about security. I've been playing doumbek with a band at the Minneapolis Renaissance Festival called Brother Seamus. They've released a CD, "Hale and Sound," where I play on three of the tracks. If you're interested in a copy, it's only $15 -- including shipping anywhere in the world. If you're...