Something my Ethical
Hackers should consider. Will we look back at Syria as the first
true “Digital Battlefield,” even though it is very one sided
(that we can prove) and targeted at non-combatants as well as the
“rebels.” No violation of the “laws of war” (Is it?) but how
do you counter?
Social
Engineering and Malware in Syria: EFF and Citizen Lab’s Latest
Report on the Digital Battlefield
by Sabrina
I. Pacifici on December 23, 2013
“More than two years
into the Syrian conflict, the violence continues both on the ground
and in the digital realm. Just as human rights investigators and
weapons inspectors search for evidence of chemical weapons, EFF, and
the University of Toronto’s Citizen
Lab have been collecting, dissecting, and documenting malicious
software deployed against the Syrian opposition. Citizen Lab
security researchers Morgan Marquis-Boire and John Scott-Railton and
EFF Global Policy Analyst Eva Galperin today published their latest
technical paper, Quantum
of Surveillance: Familiar Actors and Possible False Flags in Syrian
Malware Campaigns. The report outlines how pro-government
attackers have targeted the opposition, as well as
NGO workers and journalists, with social engineering and
“Remote Access Tools” (RAT).”
Very nice summary.
Really really helpful
post over on 451 Security. Here’s the intro:
I’ve
written this post for two reasons. First, the recent Target breach
has led to some confusion, which I will try to clear up here.
Second, I wanted to create an easily referenced educational
resource on how credit cards are designed to work. I’m hoping
this will help people understand the intricacies of credit card fraud
and how some credit card features attempt to limit it.
Here
is the TL;DR version: CVV codes were compromised and should not be
stored post-authorization, but the CVV codes compromised are not
the codes printed on the card that we get asked for when making
online purchases. There are actually two separate security
codes: one to prove possession of the card when it is swiped
(stored on the magnetic strip) and another printed on the card, to
prove possession of the card when it is used in card-not-present
transactions, like e-commerce or over the phone. The same value is
not used for both codes.
Read more on 451
Security.
[From
the article:
Based on what we know
about the breach, it sounds like track data was either potentially
stored by Target (against PCI DSS rules), was captured in transit or
was captured pre-authorization (PCI says you can’t store track data
after authorization). If full track data was
compromised, the primary threat of consumer fraud from this breach
will be for stolen data to be copied to fake credit cards and used
in-person.
Just up the road, but
also available globally via Live Stream.
This sounds like a
not-to-be-missed event. Wish I could get there to attend, but I’ll
have to console myself with watching the live stream.
Friday,
January 17, 2014; 9:00 AM – 5:30 PM
@
University of Colorado Law School, Room 101
Live
Stream: to view, click
here
What
harms are privacy laws designed to prevent? How are people injured
when corporations, governments, or other individuals collect,
disclose, or use information about them in ways that defy
expectations, prior agreements, formal rules, or settled norms? How
has technology changed the nature of privacy harm?
These
questions loom large in debates over privacy law. Often, they are
answered skeptically. The President of the United States justifies
massive NSA surveillance programs by arguing that non-content
surveillance is not very harmful. Advertisers resist calls for
aggressive forms of Do Not Track by arguing that the way they track
online behavior creates little risk of harm. Judges dismiss lawsuits
brought by users suing services that suffer massive data breaches,
for lack of harm.
Meanwhile,
many privacy law scholars and advocates do not speak consistently, if
they speak at all, about privacy harm. Some prefer to talk about
“problems” or “conflicts” not harms. Others point primarily
to abstract, societal harms such as chilling effects or harms to
dignity or individual autonomy. Many of these people have tried to
move the conversation away from harm and what they see as crabbed,
tort-centric approaches to privacy protection.
It
is time to revisit old conversations about harm. New
practices and technologies raise new threats of harm. [Or
automate existing ones? Bob] The fear of Big Data
techniques (for example in the public debate over the pregnancy
prediction program of the retailer Target) have inspired new theories
of harm. Economists and computer scientists have developed new ways
of measuring privacy harm. Regulators have adopted new ways of
talking about harm.
Join
the Silicon Flatirons Center for Law, Technology, and
Entrepreneurship on Friday, January 17, 2014, from 9:00 AM – 4:15
PM as we venture into the New Frontiers of Privacy Harm. We will
assemble thought leaders and top practitioners and regulators for a
diverse and rich set of conversations about privacy harm.
You can see the great
line-up of presenters and discussants, and access the day’s
schedule here.
(Related) Interesting
article!
From a recent article
by Woodrow Hartzog in Ohio
State Law Journal, Vol. 74, p. 995, 2013:
Abstract:
As
online social media grow, it is increasingly important to distinguish
between the different threats to privacy that arise from the
conversion of our social interactions into data. One
well-recognized threat is from the robust concentrations of
electronic information aggregated into colossal databases. Yet
much of this same information is also consumed socially and dispersed
through a user interface to hundreds, if not thousands, of peer
users.
In
order to distinguish relationally shared information from the threat
of the electronic database, this essay identifies the massive amounts
of personal information shared via the user interface of social
technologies as “social data.” The main thesis of this essay
is that, unlike electronic databases, which are the focus of the Fair
Information Practice Principles (FIPPs), there are no commonly
accepted principles to guide the recent explosion of voluntarily
adopted practices, industry codes, and laws that address social data.
This
essay aims to remedy that by proposing three social data principles —
a sort of FIPPs for the front-end of social media: the Boundary
Regulation Principle, the Identity Integrity Principle, and the
Network Integrity Principle. These principles can help courts,
policymakers, and organizations create more consistent and effective
rules regarding the use of social data.
You can download the
full article from SSRN.
You may also wish to see the other articles in the same
issue of the Ohio State Law Journal
I doubt most people
even think about why privacy is of concern to magazines like Forbes.
Over on Forbes, Kashmir
Hill writes:
Forget
“twerking” and “selfies.” Dictionary.com dubbed “privacy”
the
word of the year in 2013. Here at The Not-So Private Parts,
it feels a little like the unknown indie band we’ve been obsessed
with for years just won best album at the Grammys. So why did the
plight of our personal data achieve Arcade Fire-level fame this year?
Read more on Forbes.
(Related) Illogical or
merely ignorant?
Liz Gannes reports:
When
asked to choose which is more important to them, protecting their
personal information online or protecting their online behavior,
respondents to a recent survey said hacking is a bigger concern than
tracking.
Some
75 percent of those surveyed said they are worried about hackers
stealing their personal information, while 54 percent are worried
about their browsing history being tracked by advertisers.
Read more on
AllThingsD.
These are common
failings in all industries. Managers do not like to spend money or
resources on things like logs that are only useful in the unlikely
event they are breached. Rational or irrational?
From the Executive
Summary of a newly released report:
WHAT
WE FOUND
Nearly
all hospitals with EHR technology had RTI-recommended audit functions
in place, but they may not be using them to their full extent.
In addition, all hospitals employed a variety of RTI-recommended
user authorization and access controls. Nearly all hospitals were
using RTI-recommended data transfer safeguards. Almost half of
hospitals had begun implementing RTI-recommended tools to include
patient involvement in anti-fraud efforts. Finally, only about one
quarter of hospitals had policies regarding the use of the copy-paste
feature in EHR technology, which, if used improperly, could pose a
fraud vulnerability.
WHAT
WE RECOMMEND
We
recommend that audit logs be operational whenever EHR technology
is available for updates or viewing. We also recommend that ONC and
CMS strengthen their collaborative efforts to develop a comprehensive
plan to address fraud vulnerabilities in EHRs. Finally, we recommend
that CMS develop guidance on the use of the copy-paste feature in EHR
technology. CMS and ONC concurred with all of our recommendations.
You can access the full
report here
(pdf, 30 pp.)
Sign up an you can be
among the first to know you've been had. Possibly even before the
breachee.
Have
you been pwned? Now you can be automatically told when you are!
Just under three weeks
ago now, I
launched Have I been pwned? which could tell you if you owned one
of 154 million email addresses that had been caught up in recent
data breaches. Subsequently, the site turned
out to be wildly popular and as with such things, a lot of good
ideas came up in terms of features people would like to see.
Without doubt, the
number one request was for notifications. Searching for accounts
that may have been pwned up to the current date is one thing, but the
real value is in being automatically notified when you get
pwned in the future. So I built it – oh and I’ve
made it a free service.
Signing up for
notifications
Let me talk you through
it: First of all, jump over to haveibeenpwned.com
and search for your email address. You can always just hit the
“Notify me” link in the nav but I suspect most people will want
to kick off by looking at whether they’ve already been compromised.
This is pretty much
business as usual, except now you’ve got a “Notify me if my
address gets pwned in the future” hyperlink just above the social
media icons. Click that guy and you’ll get a little window:
I like lists like this,
because I always try to steal learn from the best!
Many more blogs listed at the site.
Announcing
the 2013 Blawggie Awards – Tenth Edition
2013
Blawggie Award Categories and Winners.
1.
Best Overall Law-Related Blog – 3
Geeks and a Law Blog
2.
The “Marty
Schwimmer” Best Practice-Specific Legal Blog – Sharon
Nelson’s Ride the Lightning
3.
Best Law Practice Management Blog – Adam
Smith, Esq.
4.
Best Law-related Blog Category – Law Librarian Blogs BeSpacific
Blog
5.
The “Kennedy-Mighell Report” Best Legal Podcast – The Return of
the Legal
Talk Network
6.
The “Sherry Fowler” Best Writing on a Blawg Award – Sharon
Nelson’s Ride the Lightning
7.
Best Law Professor Blog – Legal
Skills Prof Blog
8.
The “DennisKennedy.Blog” Best Legal Technology Blog – V.
Mary Abraham’s Above and Beyond KM
9.
Best New Blawg – Jerry
Lawson’s NetLawTools
10.
Best Blawg Aggregator – Tie: TechnoLawyer’s
BlawgWorld; Pinhawk
Law Technology Daily Digest
For
my Apple toting students...
Year
in Review: 5 Most Notable New iOS Apps of 2013
For my Ethical Hackers
… why not steal
away by yourself for a few hours and work on the SANS
Institute’s 10th annual Holiday Hacking Challenge?
… The learning
opportunity comes into play when you don’t already understand
something you encounter in the packet capture file. You are expected
to do your own research to understand the artifact well enough to
explain it in your response. Given that this year’s scenario is
based on a virtual city’s critical infrastructure, Skoudis says
there will be some protocols that network professionals probably
aren’t familiar with. It’s a chance to stretch your knowledge a
bit and build some in-demand skills in a fun way.
Since this is the 10th
year for the competition, some of the previous years’ challenges
and answers are posted online.
… For a look at the
2012 Holiday Hacking Challenge and the winning and honorable mention
responses, click
here.
Details about the
Holiday Hacking Challenge, which is now live, can be found here.
You have until January 6, 2014 to send your results to
HolidayChallenge@counterhackchallenges.com.
Good luck!
No comments:
Post a Comment