Security on Alkahest

"Hacking" predator drones

Fri, 18 Dec 2009 18:05:08 +0000

This just makes me sad. Two articles, one in the WSJ, the other on CNN, describing how insurgents in Iraq are hacking predator drones and receiving the video feeds that the drones are sending back to U.S. ground stations. First things first, let’s fix the headlines. Both are running something like “Iraqi insurgents hacked Predator drone feeds.” That should more clearly read: “Iraqi insurgents watching the videos that the Predator drone sends out unencrypted.” Or maybe “Iraqi insurgents watch Predator drone feeds on TV.”

Great moments in . . .

Thu, 12 Nov 2009 01:39:44 +0000

Minor notes, none worth their own post.

Traffic management: I get a call from K around 5:30. She’s stuck behind an accident and the cops on the scene, a) don’t tell people to take a detour until they’ve been there for a half hour; and b) once the ambulance has left the scene, don’t direct traffic around the one remaining open lane. So, after waiting a half hour, K has to take a 20+ minute detour home.
Memory: Once she gets in, K and I are fixing leftovers for dinner. C: “Hey, where are the mashed potatoes?” K: “Where did you put them?” “In the fridge, but I can’t find them.” “Maybe they’re in the freezer.” “Nope, not there either.” Ten minutes of looking for the potatoes. Did we throw them out on Sunday? Nope, not in the trash. Did C put them in the pantry? Nope. Can’t find ’em, can’t find ’em. Finally, K says, “wait, we fixed rice on Sunday.” There weren’t any potatoes. I would attribute it to getting old, but I’ve always been this way.
FUD (fear, uncertainty and doubt): we’re testing some things at the office – will our authentication system (active directory) honor password failure lockouts when using LDAP authentication? I ask our windows consultant to either a) answer the question, or b) enable an account lockout policy so we can test. He responds back that he can do that, but with the warning that “many Linux services aren’t well-designed for this, and repeatedly try a cached or user-provided password, so that users or service accounts may be mysteriously locked out after one attempt or at some future time when passwords change.” Which is complete and utter B.S. Signs that it’s BS? He references Linux services as opposed to open source, i.e. attempted linux dig. And I used to “own” identity management services, including authentication at a large university and if this was the case, things would have blown up within 10 minutes. I thanked him for the advice and noted that I’ve never seen this, but that it’s why we test.
OS Performance: we’re looking into some new ideas at the office. Things that could be useful as a preprocessor for a host based intrusion detection system. As part of my testing, I told my laptop to audit all syscalls made to the kernel, by all processes on the system. CPU load spiked, system performance went through the floor, the windowing system became almost completely non-responsive. In the two minutes it took to get access to a terminal, I logged 150 MB of audit logs. On the plus side, all of the information we need can be collected. Now I just need to figure out how to keep a usable system.
Self aggrandizement: talking to my technical manager, we need to write up two journal papers based on our recent work. Cool!

I hope everyone had a good Veteran’s Day and remembered to thank the veterans in their lives.

Facebook security vulnerabilities

Thu, 05 Nov 2009 15:32:19 +0000

and this is why I like cross-posting to facebook from my blog. It’s a healthy reminder that nothing on fb is actually private. If it’s online - it’ll be exposed eventually, whether through a new exploit, or just because you “friend” someone in the future that you had written about in the past.

h/t hsarik

So, this is important

Fri, 28 Aug 2009 03:14:27 +0000

I’m not a big baseball fan. For that matter, there are few ball sports that interest me. But, this is important. If you recall, a few years ago (2004), there was a big furor over steroids in baseball. The government searched BALCO and found evidence of rampant steroid use by baseball players. Now I hadn’t been paying attention to this, but there has been an ongoing legal dispute over that search and how it was conducted.

Digital Amway

Sat, 29 Mar 2008 02:22:52 +0000

A few years ago, I was accused of using the word “interesting in subtle ways. Sometimes it means a truly novel idea that I would like to learn more about, other times, it’s a novel idea of which I’m more than a little skeptical. In both cases, I stand by the description, to me, both are interesting – but it can make it a little hard to know what I’m really thinking. So take it with a grain of salt that I just read an interesting article in the February 2008 issue of IEEE Computer on how to turn music lovers (particularly teenagers) into music distributors.

Who could have guessed?

Thu, 06 Mar 2008 12:27:36 +0000

Gee, nobody could have predicted this I suppose:

The FBI improperly used national security letters in 2006 to obtain personal data on Americans during terror and spy investigations, Director Robert Mueller said Wednesday.

Admittedly, Mueller goes on to say that the reports were prior to new policies being put into place, but somehow that doesn’t make me feel much better. It’s things like this that have always made me very nervous about partnerships between law enforcement and industry. I’ll try to post something about InfraGard one of these days. It’s a little scary in its own right.

Is this thing on?

Wed, 16 Jan 2008 02:25:28 +0000

Is this thing still on?

Okay, it’s been about three weeks since I’ve blogged anything. As I’ve stated before, this tends to happen when I’m too involved in living life to actually write about it. Fortunately (unfortunately?) it’s nothing terribly exciting. Let’s see:

Guitar: my guitar playing has been scientifically shown to have 10% less suck than it did a month ago. However, with such a large amount of suck to begin with, we’re still not at anything that looks like good. I’m getting more fluent with the open chords and can switch between them reasonably well. I’m just starting to learn barre chords – the E barre chord to start with. There are still vast tracts of untouched suck in the barre chords. Also, I’m actually thinking of picking up some lessons – the ones at jamplay.com seem pretty good.
Work: still going well. There’s enough to do. I’m still not entirely used to billing by the (tenth of an) hour. Also, not really looking forward to flying to Ohio next week. I’ll only be gone for a day, but, ugh – who wants a 6am flight to Dayton!
Break-in update: nothing much new here. Still looking to make it harder for someone to break in. Had a neighborhood watch meeting last weekend – that’ll be good. Turns out this may be neither contractors nor kids. There are apparently some professional (stretching that word a bit) thieves working this area. There have been some eight different break-ins near by.
Non-profit work: I’m convinced that whomever coined the phrase “academic politics are so sorted because the stakes are so small never worked with a non-profit. It’s just amazing the degree to which politics enters into the smallest damned thing.
New year’s resolutions: didn’t make any – never do. That said, I am trying to exercise more and cut down on my use of vulgarities. Profanity and cursing can wait until another year 🙂

I think that’s about it for now.

Two factor authentication

Wed, 07 Nov 2007 02:05:42 +0000

A couple of weeks ago, Hunter and I were talking about passwords. More to the point, the inadequacy of passwords and why we haven’t moved beyond them yet. This touches on several points that I made last year. Specifically, that a password that is secure enough starts to restrict its usability.

In a nutshell, authentication is proving that you are who you claim to be. The standard ways of authenticating yourself are through: something you know (e.g., a password), something you have (e.g., a token) or something you are (e.g., biometrics, facial recognition, etc.). So the claim here is that the human brain is not good enough at remembering things to make “something you know secure. Unfortunately, it’s cheap and easy to implement. Two things which are always important.

Bob Ross

Wed, 14 Mar 2007 20:54:24 +0000

Created by “ the Robot Economist, and for hsarik, it’s Bob Ross and the Joy of Painting Missiles. Click the picture for the full sized image with rotating scenery.

The FBI's national security letters

Sat, 10 Mar 2007 02:55:19 +0000

Sometime in late September or early October of 2001, I received a call from an individual identifying himself as an agent of the FBI and asking for information about the owner of an email account from the place I worked. He stated that he believed the account was relevant to a terrorist investigation. Of course, this was in the immediate aftermath of September 11th and everyone had security concerns, but I was also certain that I didn’t want to give away information to someone who shouldn’t have it. Following a fairly standard procedure, I requested his phone number, badge number and locale so that I could contact the FBI to confirm his identity. The agent gave me a lot of grief about this, noted that I was putting lives at risk by not immediately complying, etc., but I assured him that I would call right back.

and people wonder why the change to DST worries me...

Wed, 28 Feb 2007 23:38:06 +0000

In 2005, congress mandated a change to daylight savings time, essentially, starting it three weeks earlier (March 11th, this year) and ending it three weeks later. Our local paper is requesting suggestions for what people will do with their 22 extra hours of daylight. Here’s my suggestion: spend the time fixing all of the computer problems caused by the DST change.

Essentially, a change to DST is very similar to a self-inflicted Y2K problem. If you want to get a sense of how time/date issues can affect computer systems that aren’t prepared, take a look at this article regarding the new F-22 Raptor and it’s problems with the International Date Line. I wasn’t worried about Y2K because we knew about the issue for years and most modern operating systems and software had already addressed it. With the DST changes, we haven’t had nearly enough notice or preparation. Now, I’m not stocking up on canned goods, but I’m pretty certain that March 11th is going to bring about extra work.

Poindexter

Fri, 24 Nov 2006 17:55:40 +0000

It’s taken me a bit to write about Admiral Poindexter’s visit and the small group talk we had with him. Let me start by reminding folks that here’s a guy who was convicted of lying to congress. The conviction was later overturned on a technicality. He’s also very politically savvy. I once asked my father if he would ever pursue becoming a general in the army. He told me that he was hoping to make full colonel (he later retired as a lt. colonel), but that becoming a general required a literal act of congress and that you needed to become a politician. I would assume the same thing is the case with an admiral and doubly so in the case of Poindexter who managed to become the highest ranking geek in government. All of which is to say take my impressions with a grain of salt.

Admiral John Poindexter to speak at Duke University

Mon, 13 Nov 2006 04:06:24 +0000

In case you are looking for something interesting to do next week, go to Love Auditorium at Duke University on November 15th at 5pm. Admiral John Poindexter will be giving a talk: “ A Vision for Countering Terrorism Through Information and Privacy Protection Technologies for the 21st Century. It should be an interesting and thought provoking discussion of where Poindexter draws the line between security and privacy.

I’ll be meeting with Poindexter and a small group at 3pm – quite the birthday present.

North Korean nuclear test

Tue, 07 Nov 2006 00:03:14 +0000

Well, it seems that we finally know what happened with the North Korean nuclear test that fizzled. They apparently mistranslated the Arabic documents the U.S. posted online.

Okay, so neither of those is really very funny. On the one hand, the U.S. posted a whole host of Arabic documents from Iraq that had never been examined before in the vague hope that someone would be able to find evidence that Iraq had a WMD program before we invaded. This was idiotic. It’s equivalent to my posting an entire database of personal information in the hopes that someone online could determine if there were social security numbers in it.

Biometrics - fingerprint scanners

Mon, 23 Oct 2006 14:00:05 +0000

I recently had a small argument with a vendor selling biometric fingerprint scanners tied to your credit card number. He said that they were the greatest and most secure thing ever; I said that there weren’t any standards and that the security of the devices was questionable.

I wish I had seen this earlier.

Thinking about security and usability

Sat, 14 Oct 2006 03:06:24 +0000

IT security (and for that matter, other security concerns too) are often seen as conflicting with usability. There is something to that. If you take any given technology and turn up the level of security it provides, you will almost always decrease the usability of the system.

Consider passwords. If people are allowed to choose their own passwords, they will typically choose something very usable for them. They’ll pick their dog’s name, their wife’s name, their userid, etc. These passwords don’t provide much security. To compensate, we often turn up the security knob and require “stronger passwords, e.g., minimum of six characters with no dictionary words and multiple “character classes.

for the record, Kip Hawley is an idiot

Sun, 01 Oct 2006 18:05:43 +0000

I missed this when it came out last week, but apparently, a gentleman named Ryan Bird was detained at the airport last week for writing “ Kip Hawley is an idiot on his plastic baggie filled with toiletries. Apparently, the security trolls highly educated and diligent TSA employees took the statement to be a threat or at least behavior that they didn’t approve of and detained Mr. Bird – while telling him that he didn’t have 1st Amendment Rights at the TSA checkpoint.

Presentation

Tue, 26 Sep 2006 01:14:14 +0000

I survived giving my presentation today – in spite of the fact that I showed up to the wrong hotel, in the wrong part of the city. I blame my boss. I mentioned that the talk was at the Sheraton Imperial (although I hadn’t looked to see where that was yet) and he said, oh yeah, the one down on Campus Walk road. Get to the hotel on Campus Walk – oops, that’s the Millenium. Call my administrative assistant, she looks up the location and it’s 15 miles away.

Oops...

Mon, 25 Sep 2006 01:22:30 +0000

Checking my schedule for tomorrow, I realized that I have to give a talk at a major “human studies conference about security risks in web-based surveys. Unfortunately, I haven’t actually prepared anything. I’ve got my slides from the last time I did the talk, but I really wanted to do something more interesting and interactive this time – preferably with audience volunteers wearing silly hats. I may still try to put something together in the morning. I have an idea – but no sense of the feasibility.

Stock spam

Sun, 24 Sep 2006 22:26:26 +0000

One of the disadvantages of having so many email accounts is the number of spam you get. Recently, I’ve been noticing an increase in stock spam making it through my spam filters. I’ve been wondering how effective the spam is and whether or not one could make money shorting these stocks.

Apparently, I’m not the only one. The local paper carried a NYT article titled “ Many people fall for stock spam. In the article, the author describes the work of Frieder and Zittrain. Frieder and Zittrain found that pink sheet stocks that were heavily touted in spam were significantly more likely to be traded than non-touted stocks. Purchasing these stocks would lead a 5.25% loss within two days. For the most heavily touted stocks, the average loss was almost 8% in two days.

racial profiling for terrorism

Tue, 22 Aug 2006 22:53:26 +0000

I’ve heard and read a number of people saying “political correctness be damned, we should use racial profiling to identify terrorists. The problem I’ve always had with this is that it makes no sense. Try the following test, identify the terrorist:

young muslim male
young muslim female
asian male or female
caucasian male or female
black male or female
hispanic male or female

If you said that 1 and 2 have been terrorists and therefore we should profile them, you are partially right. However, what about all of the asian terrorists (e.g. Fillipinos)? Caucasians? Hmm, the IRA, David Koresh, Timmothy McVeigh, etc. As near as I can guess, the only racial groups that shouldn’t be profiled would be blacks and hispanics. This can’t work.

things that make a security officer cry

Mon, 14 Aug 2006 19:33:35 +0000

I spent a lot of time last week looking at an application in order to assess its security. The thing that was troubling me was that this is a web application and the primary form for data entry was defined like:

form name=foo method=post action=

This means that the nothing happens when you hit submit on the form – at least not in the html world. So, I took a closer look and found that each of the buttons (submit and clear) actually had a field “onclick=’doSomething();’ attribute.

a nomenclature question

Tue, 08 Aug 2006 16:49:29 +0000

given that the vulnerability and the patches haven’t yet been released, does this constitute a “-1 day exploit?

Password security question

Wed, 19 Jul 2006 15:00:21 +0000

I wonder if these folks have read the recent article in the NY Times regarding prosopagnosia?

The company Passfaces has a password replacement technology that uses the brain’s ability to recognize faces. The idea is that the user selects a set of faces. They are then presented with a series of options where each of their faces is hidden in a group of other faces. By correctly selecting their faces, they authenticate themselves. The company says that using Passfaces will reduce calls to a help desk because people can remember faces for years without seeing them. There’s a demo which allows you to test how easy the system is.