Enabling Secure Business Operations

Zimbabwean Hacking the Censors

February 27th, 2007

Cool:


Broadcasts from SW Radio Africa, started by a Zimbabwean journalist in London to avoid the media crackdown, have been jammed for nearly two years.

Strict media laws have been introduced in Zimbabwe in recent years.

So far about 2,000 people have signed up to SW Radio Africa’s text scheme in the last two months.

She said it had also forced journalists to be more concise as complex stories have to be condensed to 160 characters.


DHS Makes A Mess Out Of No-Fly Mess

February 25th, 2007

It seems as thought the DHS has decided that perhaps all of the people on the no-fly list might not be terrorists after all.

So, you can now attempt to get off the no-fly list, if you dare:

  1. First off, the page isn’t off of the dhs.gov site but instead run by a third party. That url, which has been taken down was this: rms.desyne.com
    A ton of spoof sites have already been making the rounds.
  2. To attempt to get off of the no-fly list you have to enter in all sorts of personal information. Good thing the page is not encrypted (via SSL) in case you are a terrorist all of the personal information you enter will float oh so easy-to-read across the very safe place known as the Internet.

I really hate to get on the government-is-stupid bandwagon…but aside from all of the technical bloopers, why should innocent people go out of their way to get off of a list that has been shown to be full of problems?

Shouldn’t the innocent citizens wrongly put on the list be contacted in person?

Guess it would be possible if the no-fly list weren’t so long.

Trojan Horse Used to Catch Child Molester

February 22nd, 2007

Committing crime to prevent crime is not legal. This guy should be arrested for monitoring (at least) 3,000 people who happened to have downloaded the trojan he wrote.


Dubbed “Citizen Tipster” by police, Brad Willman, spent night after night writing a Trojan Horse program that gave him complete control over every computer that downloaded it.

Alone and in the dark, he sat for up to 16 hours a day monitoring hundreds of targets, secretly reading their e-mail and tracking their every step online.

He started keeping files on the targeted users. He tracked them for almost three years —recording everything. The majority of his targets were ordinary people — but some in the files included priests, social workers, soldiers, police officers and justice officials.


Mr. Willman should also be put behind bars even despite discovering a few serious child predators. I guarantee that you would too if you were reading every single email, IM, and downloading files from 3,000+ people.

Hidden Messages In Plain Sight

February 21st, 2007

Hiding messages in places that are heavily scrutinized is an old practice.


Japanese firm Fujitsu is pushing a technology that can encode data into a picture that is invisible to the human eye but can be decoded by a mobile phone with a camera.

...

Fujitsu’s technique works by taking advantage of the sensitivities of the human eye, which struggles to see the colour yellow.

“The key is to take the yellow hue in the picture and we skew that ever so slightly to create a pattern,” said Mr Nelson.

“A camera is perfectly sensitive to that yellow hue but the human eye doesn’t see it very well.

“Any camera, even those in mobile phones, can decode it very easily.”

Pictures printed with the technique look perfectly normal but a camera can see the code printed into the image.


Distraction is an important aspect of security and one that is overlooked often.

I do wonder though if these messages are picked up by the subconscious? Imagine billboards of the future..

Drive-by Pharming

February 19th, 2007

Here is an interesting attack brought to us by the Symantec Security Response team.

It allows attackers to create a Web page that, simply when viewed, results in substantive configuration changes to your home broadband router or wireless access point. As a result, attackers gain complete control over the conduit by which you surf the Web, allowing them to direct you to sites they designed (no matter what Web address you direct your Web browser to).

Basically through the use of some known default passwords and flaws in home-based wireless router firmware, one can take control of the router—including changing DNS records and so forth. So, even if you type in your desired destination in the web browser, you might end up elsewhere.

Why call it “drive-by”? As an attacker, you could drive through neighborhoods, launching these attacks against any wireless router you come in contact with. Then the entire home/neighbors/others who use the router will also be subject to the same attacks. So, if you open your router up for free access, please make sure it is secured with a password and its firmware is up to date.

Identity Theft

February 15th, 2007

There are constantly articles about identity theft, whether through the loss of a wallet, a computer or hard drive with information on it, dumpster diving, or any other method… What have been lacking are some good step-by-step guides for what to do if your identity is stolen.

Lifehacker just linked to an article on the Credit Score Tips & Advice blog called 8 Things You Must Do If Your Identity Is Stolen

Identity theft doesn’t have to ruin your life or your credit. By staying calm, getting organized, and taking these crucial steps, you can bounce back from this stressful situation and stop thieves dead in their tracks.

I think this is a pretty darn good starting point, and probably should be copied on the FTC website.

Google Earth Provides Information For Both Sides of Iraqi Security

February 14th, 2007

The Iraq League’s use of Google Earth demonstrates the dual nature of technology/software use.


As the communal bloodshed has worsened, some Iraqis have set up advice websites to help others avoid the death squads.

One tip – on the Iraq League site, one of the best known – is for people to draw up maps of their local area using Google Earth’s detailed imagery of Baghdad so they can work out escape routes and routes to block.

It’s another example of the central role technology plays in the conflict – with the widespread use of mobile phones, satellite television as well as the internet – by all sides and for many purposes.


The flip side:

Terrorists attacking British bases in Basra are using aerial footage displayed by the Google Earth internet tool to pinpoint their attacks, say Army intelligence sources.

Documents seized during raids on the homes of insurgents last week uncovered print-outs from photographs taken from Google.

Technology is not inherently good or bad, how people use it determines that. Many times people look to the IT security folks to make software ‘good’ or prevent ‘bad’ (think DRM) – both things that can’t really be done.

School’s Closed!

February 13th, 2007

Just finished reading this article on SecurityFocus.

Two Ohio high-school students face expulsion and criminal charges after allegedly using their access to a Web server to post a notice that the local schools had closed due to snow.

It seems that the unnamed perpetrators used their own valid access password to make the modification to the website. How can the school district not have foreseen this?

I’m not sure if criminal charges should apply. It was perhaps more effective at getting them out of school than wearing their pajamas inside out, but still was just a prank.