As Bruce Schneier points out in this blog post some “clever” folks decided to use an old phone scam to steal credit card numbers. A fraudster contacts an AT&T service rep and says he works at a pizza parlor and that the phone is having trouble. Until things get fixed, he requests that all incoming calls be forwarded to another number, which he provides. Pizza orders are thus routed by AT&T to the fraudster’s line. When a call comes in, the fraudster pretends to take the customer’s order but says payment must be made in advance by credit card. Makes me think of something that happened to me last week – I called our local cable company to get some[…]
Category: users
The Washington Post had an article in yesterday’s paper called E-Mail at Risk? Cover It With Encryption. “Current e-mail technology does not provide any confidentiality,” said Peter Hesse, president of Gemini Security Solutions, a Chantilly-based firm specializing in security audits and installations. “In fact, the e-mail standards include routing messages between mail servers . . . each transmission and each server offer opportunities to read messages.” Read the article for that and many other brilliant comments by yours truly! Actually, the premise of the article is interesting. It’s in the Sunday paper, which means it’s going to be read by many average people over coffee and donuts. I wonder if it will lead to any more adoption of PGP or[…]
Bruce Schneier posted about a phishing scheme that “defeats” two factor authentication. It does so by being a man-in-the-middle. Other than that I agree with most commenters that it’s user stupidity, not a failure of two-factor auth, it brings up two points: 1. Two-factor needs to be combined with “two-way” 2. Security mechanisms already in place need to be more user friendly. When I say two-factor authentication needs to be “two-way”, I mean that both sides need to prove themselves, not just one. In this case, the user gives something he knows and something he has to the web site, but the web site doesn’t quite return the favor. The web site is giving somethings it has (an SSL certificate).[…]
This article from the Seattle Times starts off like this: A government consultant, using computer programs easily found on the Internet, managed to crack the FBI’s classified computer system and gain the passwords of 38,000 employees, including that of FBI Director Robert Mueller. I’m not sure if everyone is aware of how easy Rainbow Tables are to implement against Windows networks. Ophcrack 2 is a quite speedy implementation using Rainbow Tables to quickly crack Windows network passwords. Try it against your network, you might be surprised. Yawn… yet another argument against passwords and for the use of stronger authentication mechanisms.
NIH Federal Credit Union is the most recent problem with identity theft – except this time, nothing was stolen, nothing was broken into. The CU isn’t acknowledging that it’s an inside job, but really, what else could it be? I have a friend who went to GWU and so has an account there. He hadn’t heard anything about it when I called him last night to tell him. Now, according to the press report, only those who are already victims of identity theft will get a credit report and year of monitoring service. I find that amusing as when laptops were stolen/lost and people may or may not have been affected, these groups were offering monitoring service. Now, we have[…]
Stung by recent laptop losses, thefts, and private information disclosure, the Washington Post is reporting on OMB Guidelines for Federal Employee Laptop Security. You can read the OMB memo as well. Unfortunately, the OMB is (in my opinion) unnecessarily rushing things by giving agencies 45 days to comply. In my experience, rushed implementations lead to: Users unhappy with another barrier to their work Vendors forcing sales at risk of non-compliance Laptops which you think are secure really aren’t Data loss when recovery procedures aren’t well thought out We’ll see how this one plays out… I expect there are more losses and problems ahead for the Federal Government.