I would be shocked if this hadn't happened regularly. Clearly, hackers (including the Russians) have the tools and techniques needed and the White House is quite high on the “bragging list.” Are they jumping to the conclusion it was Russia?

http://www.securityweek.com/hackers-breach-white-house-computer-system

Hackers Breach White House Computer System

The White House's unclassified computer network was recently breached by intruders, a US official said Tuesday, with The Washington Post newspaper reporting that the Russian government was thought to be behind the act.

… The Washington Post quoted sources as saying hackers believed to be working for the Russian government were believed to be responsible. [So, contractors? Bob]

(Related) Another “of course they are” article. Apparently breaking into unsecured civilian phones makes the North feel competent.

http://www.securityweek.com/south-korea-spy-agency-says-north-hacking-smartphones

South Korea Spy Agency Says North Hacking Smartphones

North Korea attempted to hack tens of thousands of South Korean smartphones this year, using malware disguised in mobile gaming apps, the South's spy agency said in a report submitted to parliament this week.

The National Intelligence Service said more than 20,000 smartphones may have been infected by the apps that were posted on South Korean websites between May and September

… The North is believed to run an elite cyber war unit of at least 3,000 personnel, but it has denied any involvement and accuses Seoul of fabricating the incidents to fan cross-border tensions. [Their standard reply Bob]

I'll survey my Computer Security students tonight.

Find Out Whether This Unkillable Tracker Is On Your Smartphone

Kashmir Hill writes:

The generally accepted trade-off on the Internet is that you give up your privacy to get free stuff. It’s summed up by a frequently repeated adage, “If you’re not paying for it, you’re the product.” But sometimes you’re paying for it, and you’re still the product. Verizon and AT&T customers are paying an (often steep) monthly bill, but the payment doesn’t ensure privacy. Researchers say the carriers are inserting a unique code into customers’ browser requests to help serve up personalized ads. The way they are doing it makes you trackable by the sites you visit, third party ad networks, or, of course, the NSA, even if you take measures to protect your privacy, such as clearing your cookies.

Wired reports that it was first discovered by digital rights group EFF. Kenn White, a security consultant, created a site where mobile users can find out whether their phone is broadcasting the tracking code.

Read more on Forbes.

[From the article:

You can check it out here; the tracker is turned on for you if you see a bunch of letters and numbers after “Broadcast UID.”

Perhaps we'll see similar reports from all 50 states?

Attorney General Kamala D. Harris Releases Data Breach Report; 18.5 Million Californians’ Personal Information Put at Risk

LOS ANGELES – Attorney General Kamala D. Harris today released the second annual report detailing the 167 data breaches reported to the Attorney General’s office in 2013 that impacted18.5 million Californians by putting their personal information at risk. The report is accompanied by recommendations from the Attorney General for consumers, businesses and lawmakers on how to protect against data breaches and prevent them in the future.

… In 2013, the number of reported data breaches increased by 28 percent, from 131 in 2012 to 167 in 201. The number of Californians’ whose records were affected increased by over 600 percent, from 2.5 million in 2012 to 18.5 million in 2013. This increase was largely due to two massive retailer breaches at Target and LivingSocial, each of which put the personal information of approximately 7.5 million Californians at risk.

… The full Data Breach 2013 report is available here: https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/2014data_breach_rpt.pdf?

Sort of a mini-background check? Would it creep you out to know they did this to you?

Charlie

https://charlieapp.com/

– Make a killer impression on whoever you’re meeting. Charlie combs through 100’s of sources and automatically sends you a one-pager on everyone you’re going to meet with, before you see them. Be the one they remember by talking about things that truly matter to them. You’ll know what makes them tick, what you have in common, and the critical insights on their company that your competitors won’t.

Perspective. Somewhat simplistic, but interesting.

http://www.theatlantic.com/technology/archive/2014/10/facebook-is-losing-24420-per-minute/382054/

When It Goes Down, Facebook Loses $24,420 Per Minute

Cheaper than drones and no piloting skills required. What does Ohio really use them for?

Pennsylvania law enforcement deploys unmanned balloon in search for alleged cop-killer

The Ohio State Dept. of Transportation has loaned the “eye in the sky” to Pennsylvania, according to IBT and CBS.

No mention of what/how much the balloon records or for how long the data are being retained for people who may be incidentally surveilled in the process of searching for Eric Frein.

[From the IBT article:

The balloon had been scanning Ohio prisons for potential fugitives [Huh? Bob]

Depressing.

The Most Alarming Fact of the HIPAA Audits

Terrific analysis and commentary by Daniel Solove, on LinkedIn.

The joy of BYOD. So, my little Computer Security minions, how do you control this?

Hospitals’ dirty little secret: Caregivers sharing clinical data via personal phones

Heck, that’s not a dirty little secret. It’s widely known as a problem, but I guess VentureBeat editors were looking to sex up the headline.

Mark Sullivan reports:

Hospital caregivers typically bring their own mobile devices to work and use them to share clinical and care coordination information other members of their multidisciplinary care team. It’s a practice that screams “HIPAA violation.”

Much of this information is transmitted via text messages or multimedia SMS. This can even include images.

Read more on VentureBeat.

Similar to setting up a phoney Facebook page for a 'sting?'

Seattle Times ‘Outraged’ at FBI Using Its Name to Infect Computer

June Williams reports:

The FBI used a fake Seattle Times article and Internet link to infect a high school bomb-threat suspect’s computer with spyware, an ACLU technologist said Monday.

Documents obtained by the Electronic Frontier Foundation show the FBI made up a news story about the threats, used an AP byline and emailed a link “in the style of the Seattle Times” to the suspect’s MySpace account. When he clicked on the link, agents were able to track his IP address. [Couldn't they have subpoenaed the IP address from MySpace? Bob]

The Seattle Times appeared unaware of the ruse, and editor Kathy Best said she was “outraged.”

Read more on Courthouse News.

Interesting. Is this for parents to monitor their children or for anyone to monitor anyone? If you have the app and fail to take action, is there liability? Why doesn't the app call (or text) 911? Will this become mandatory? This one is only Twitter, but expect Facebook and Google Mail and everyone else to jump on similar Apps.

http://www.itproportal.com/2014/10/29/samaritans-new-twitter-app-will-tell-you-if-your-friends-are-suicidal/

Twitter wants to tell you if your friends are suicidal

Samaritans Radar is a new Twitter app designed to warn users whether their connections online are at risk of suicide.

Predominantly aimed at those aged 15 to 35, the free app works by using a specially designed algorithm to monitor the tweets of those in people's network. If it finds specific keywords or phrases that throw up red flags that a person may be struggling to cope...

… The app will then send an email alert to a Twitter connection, which will include a link to the tweet that raised the alarm. That person will then be offered guidance on the best way of providing support to the tweeter.

(Related) Google search inside your body!

http://www.business-standard.com/article/news-ians/google-scientists-to-find-hidden-cancer-via-nanoparticles-114102900586_1.html

Google scientists to find 'hidden' cancer via nanoparticles

In a pioneering research, a Google life sciences team - which has two senior Indian-origin researchers - is set to find signs of deadly diseases like cancer by sending 'nanoparticles' in the bloodstream of a person and then get the results via a wearable device.

… "Every test you ever go to the doctor for will be done through this system," Andrew Conrad, head of the Life Sciences team at the Google X research lab, was quoted as saying at a WSJ conference.

The tiny "nanoparticles" will be delivered via a pill.

… According to Conrad, the firm will not collect or store medical data itself but will license the technology to others. [So they will publish the API to help me hack in Bob]

“It's a no brainer! They fly, so we'll regulate them like aircraft (except for blimps). No need to ask anyone if they see things differently.” Did the DHS pressure the FAA? OMG!

http://www.ibtimes.com/faa-criminalizes-use-drones-near-stadiums-violators-could-face-year-jail-1715275

FAA Criminalizes Use Of Drones Near Stadiums, Violators Could Face Up To A Year In Jail

Flying drones or model planes near or over sports stadiums and auto race tracks could land operators in jail, the Federal Aviation Administration, or FAA, warned in a notice, The Associated Press, or AP, reported Tuesday. This is reportedly the first time that the use of drones has been criminalized in the United States.

… The notice is "another attempt by the FAA to impose legal restriction on drones or model aircraft that never existed before,” Brendan Schulman, a New York-based attorney, who represents several drone operators said, according to AP.

… The FAA reportedly stated that the restriction was being imposed for security reasons.

However, Schulman reportedly said that he did not believe that such restrictions would in any way help prevent terrorist attacks. The prohibition reportedly applies to nearly 150 stadiums in the U.S.

Sports teams too have expressed concerns over the new restrictions as drones are used for photographing and recording games, Kenneth Quinn, a former FAA general counsel who also has voiced concerns over the drone restrictions, said, according to AP. Quinn added that the teams wanted permission from the FAA to allow the use of drones by them to record practice sessions for future training.

(Related) Of course, this is not a drone.

http://www.ted.com/talks/sergei_lupashin_a_flying_camera_on_a_leash

A flying camera ... on a leash

As clear as mud. Does this look like a strategy or political tactics?

http://www.washingtonpost.com/blogs/the-switch/wp/2014/10/29/streaming-tv-companies-might-soon-play-by-cables-rules-and-thats-a-good-thing/

Streaming TV companies might soon play by cable’s rules — and that’s a good thing

As Americans begin watching more of their TV online, federal regulators want to even the playing field to make new Internet startups — such as the recently announced CBS streaming app or Aereo — more competitive next to their bigger rivals in the cable and satellite business.

A new proposal being circulated around the Federal Communications Commission would do just that. In a blog post Tuesday, FCC Chairman Tom Wheeler acknowledged that consumers are being forced to "buy channels they never watch."

… When the FCC gets around to voting on the proposal, the result could mean being able to mix and match video sources more easily.

… But the FCC proposal leaves out several of the most well-known video streamers -- Netflix and Amazon Instant Video. This may be a confusing distinction – after all, what's really the difference between CBS's streaming app and Hulu? The agency has said it distinguishes apps like CBS All Access because it provides programming on a schedule, while the Netflixes of the world offer shows on demand. But analysts have said what's really going on here is that the agency does not want to pull Web-based services such as Hulu into its orbit because of the political minefield surrounding the regulation of Web companies.

But there's another big benefit to the FCC proposal. Wheeler argued that the move would also help companies trying to break into the broadband market. These firms, such as Google Fiber, could focus on just building super high-speed connections without having to worry about being treated like a cable company. Currently they are being forced to pay a fee for video programming that travels over their pipes. According to Google, those costs are the single biggest thing holding Google Fiber back.

So it looks like the customers (and the researchers) were right, despite all the denials.

http://www.nytimes.com/2014/10/29/technology/FTC-says-ATT-deceived-consumers-on-unlimited-data-plan.html?_r=0

AT&T Accused of Deceiving Smartphone Customers With Unlimited Data Plans

Three years ago, AT&T warned smartphone customers with “unlimited” data plans that their connections might be slowed if they used a lot of data. On Tuesday, the Federal Trade Commission said AT&T’s disclosure was deceptive because it was not specific enough.

The commission filed a federal lawsuit against AT&T on Tuesday, saying the company had misled customers by slowing the connections of people with unlimited plans after they used more than two gigabytes of data in a month.

For some of the people who hit that threshold, the F.T.C. said, downloads were slowed by as much as 95 percent, essentially making their smartphones unable to gain access to the Internet or use certain apps.

“AT&T promised its customers unlimited data, and in many instances it has failed to deliver on that promise,” said Edith Ramirez, chairwoman of the agency. “The issue here is simple: ‘Unlimited’ means unlimited.” [What a concept! Bob] The commission, which does not have the power to impose fines, said it would seek “millions of dollars” in restitution for consumers.

It's not renting, it's borrowing. Funny she has never heard of this before.

http://www.freetech4teachers.com/2014/10/rent-ebooks-audiobooks-for-free.html#.VFD1OVcsFHA

Rent eBooks & Audiobooks for FREE

I spend way too much money on books! This year, I made a concerted effort to get more books from the library to help my budget. On my first visit to a local library, [That explains why she didn't know about borrowing Bob] I learned that they used Overdrive to rent eBooks and audiobooks! So now, I can check out eBooks and audiobooks from home and read them on my iPad! Overdrive allows you to rent eBooks, Audiobooks, and even video straight from your local library! There are no fees associated with this service. All you need is a library card!

To see if you library partners with Overdrive, simply make a quick search on their site. You can then create an Overdrive account using your library card. Download the App onto your Computer, iOS, or Android device and you’re ready to start checking out material! The nice thing about an Overdrive account is that you can sync your content across devices! Never lose your spot on your eBook or Audiobook! When your rental expires, it automatically goes back to the library, so no late fees!

I have a couple students writing books. Perhaps they could use this?

Kindle Scout

https://kindlescout.amazon.com/

– is a reader-powered publishing for new, never-before-published books. It’s a place where readers help decide if a book gets published. Selected books will be published by Kindle Press and receive 5-year renewable terms, a $1,500 advance, 50% eBook royalty rate, easy rights reversions and featured Amazon marketing.

For my Computer Security students.

http://www.securityweek.com/credit-card-hacking-americans-top-crime-worry-poll

Credit Card Hacking is Americans' Top Crime Worry: Poll

Credit-card hacking is the number one crime on Americans' worry list, far above getting mugged or murdered, according to a Gallup survey released Monday.

As the number of major retailers reporting cyber breaches grows, with thieves stealing credit card data belonging to tens of millions of their customers, awareness of the hacking threat has taken off.

"Americans today are more worried about their credit card information being hacked from stores than about any other crimes they are asked about, and a relatively high percentage say they have been victims of this hacking," Gallup said.

Sixty-nine percent of Americans said they frequently or occasionally worry about computer hackers stealing the credit-card information they have used at stores.

The only other crime that worries the majority of Americans -- 62 percent -- is hacking and data theft of a computer or smartphone.

(Related)

http://thehill.com/policy/cybersecurity/221936-study-cyber-attacks-up-48-percent-in-2014

Study: Cyberattacks up 48 percent in 2014

The number of detected cyberattacks skyrocketed in 2014 — up 48 percent from 2013 — and they are costing companies more money, according to two global studies released Monday.

This year is expected to see 42.8 million cyberattacks, roughly 117,339 attacks each day, a study from consulting firm PricewaterhouseCoopers found.

Nearly all companies surveyed were hit by a cyberattack in 2014, costing them hundreds of thousands, potentially millions, of dollars.

… Security filings revealed that retail giant Target alone shelled out upwards of $150 million since its data breach during the 2013 holiday shopping season.

Another report from security software vendor Kaspersky Lab estimated an average data security incident costs a company $720,000.

(Related) You may never know you've been a victim.

http://www.bespacific.com/jpmorgan-data-breach-involves-information-76-million-households/

JPMorgan Data Breach Involves Information on 76 Million Households

JPMorgan Data Breach Involves Information on 76 Million Households, 7 Million Small Businesses, CRS Legal Sidebar, October 23, 2014

“JPMorgan did not provide individual customers with notice of the breach because it believed that it had no obligation to do so because no “sensitive customer information” was involved in the data breach. This means that JPMorgan apparently has complied with data breach notification standards promulgated by the federal banking regulators pursuant to the privacy provisions of the Gramm-Leach-Bliley Act (GLBA). These standards specify the contents of breach notices that must be supplied by telephone, mail, or electronic mail to all affected customers when a data breach involves “sensitive customer information.” Should “sensitive customer information” be involved in a data breach, the guidelines require financial institutions, such as JPMorgan, to notify customers only if after a “reasonable investigation” the company determines that “misuse of its information about a customer has occurred or is reasonably possible.”

Notice that the US government does not make this accusation about a group that is not part of the Chinese government. This is pure diplomatic speak.

Researchers identify sophisticated Chinese cyberespionage group

Ellen Nakashima reports:

A coalition of security researchers has identified a Chinese cyberespionage group that appears to be the most sophisticated of any publicly known Chinese hacker unit and targets not only U.S. and Western government agencies but also dissidents inside and outside China.

News of the state-sponsored hacker group dubbed Axiom comes a week before Secretary of State John F. Kerry and two weeks before President Obama are due to arrive in Beijing for a series of high-level talks, including on the issue of cybersecurity.

Read more on Washington Post.

(Related) Countries (particularly China and Russia) tend to take accusations personally.

http://www.securityweek.com/fireeye-links-russia-cyber-espionage-campaign-dating-back-2007

FireEye Links Russia to Cyber Espionage Campaign Dating Back to 2007

Security firm FireEye has released a new report uncovering and detailing a large cyber-espionage campaign that the company believes is sponsored by the Russian government and dates back to 2007.

The group behind the campaign, which FireEye is calling APT28, is a skilled team of developers and operators collecting intelligence on defense and geopolitical issues that would clearly benefit Russia.

Unlike many attacks often attributed to China and detailed in Mandiant’s (now part of FireEye) APT1 report released in 2013, the APT28 attackers do not appear to be after intellectual property theft for economic gain.

… Last week, Trend Micro released a report on a cyber-espionage operation dubbed "Operation Pawn Storm" which targeted military, government and media organizations around the world and utilized the Sofacy malware.

But according to McWhorter, the direct link and attribution to Russia is what FireEye is highlighting in its APT28 report.

… the report (PDF)

About time someone initiated a smackdown!

EFF and ACLU of Tennessee Team Up to Challenge Unconstitutional School District Policy

Nate Cardozo and Jamie Lee Williams write:

School districts across the country are grappling with how to deal with their students’ use of technology and social media. All too often, in an attempt to protect students, they end up implementing technology polices that give administrators too much power and go too far in restricting what students can do online. Williamson County Schools, a public school district in affluent Williamson County, Tennessee, is one such school district. Recently, a concerned parent, Daniel Pomerantz, brought the policy to the attention of EFF and the ACLU of Tennessee (ACLU-TN). Mr. Pomerantz was right to be concerned.

Earlier today, EFF and ACLU-TN sent a letter to the board on behalf of our client detailing our concerns. As we outline in our letter to the school board, the school district’s technology and Internet policy is troubling in a number of ways. Indeed, the policy violates the First and Fourth Amendment rights of 35,000 Williamson County students across the district’s 41 schools. We teamed up with ACLU-TN to demand that the Williamson County School Board immediately suspend the unconstitutional policy.

Read more on EFF.

If it takes analysis of Big Data to determine who to discriminate against, will it be obvious to anyone who does not analyze Big Data that documents the discrimination?

http://thehill.com/policy/technology/222009-aclu-tells-feds-watch-online-discrimination

ACLU tells feds: Watch online discrimination

Companies that target certain people based on their online behavior could be practicing a form of discrimination, the American Civil Liberties Union (ACLU) warned on Monday.

Some businesses look at massive amounts of information about what people do on the Internet to target ads to one group over another, which the ACLU told the Federal Trade Commission (FTC) “has the potential to significantly reinforce existing economic disparities between racial groups."

“Because decisions about which advertisements to display are in some cases based on data about race or factors closely linked to race, we are in danger of segregating the consumer experience on the Web,” ACLU officials told FTC Chairwoman Edith Ramirez in a formal filing.

Both the FTC and the Consumer Financial Protection Bureau should investigate whether or not companies are violating the rules by using new forms of discrimination, the civil liberties group said.

“Sell 'em while they're young!” (and don't forget to tell them how hard it is to use Windows!)

http://thehill.com/policy/technology/221999-apple-unveils-plans-to-increase-school-tech

Apple unveils plans to increase school tech

… The tech giant has chosen 114 schools in 29 states to get grants as part of the Obama administration’s ConnectED effort, which seeks to connect 99 percent of the country’s students to high-speed broadband Internet.

“We believe that the young minds and young innovators of tomorrow should have every opportunity to realize their potential through today’s powerful learning tools,” Apple said in announcing its plans.

In the schools Apple will be targeting, 96 percent of students are eligible for free or reduced-price lunch, a common metric of poverty. Ninety-two percent of students in the schools are of a racial or ethnic minority.

“Despite their economic challenges, these schools share a vision of what their students’ lives would be like with Apple technology,” Apple said.

I think I'll start using this as my best example of something that will never happen. Politicians limiting the lies they can tell? You must be joking.

http://thehill.com/policy/technology/221946-gop-election-commissioner-warns-of-government-review-board-culling-the

Agency chief warns of 'regulatory regime' watching the Internet

Disclosure rules pushed by Democrats [Next week it's the Republican's turn Bob] could result in the creation of a government review board monitoring the Internet, the chairman of the Federal Election Commission (FEC) warned Monday.

… The FEC deadlocked last month on the question of whether there should be more stringent reporting requirements for political advertisements that are distributed only on the Internet.

I keep meaning to buy more cocoa... I don't remember why.

http://www.bespacific.com/clinical-trial-shows-cocoa-diet-reverses-age-related-memory-cognitive-decline/

Clinical Trial Shows Cocoa Diet Reverses Age-Related Memory And Cognitive Decline

Clinical Trial Shows Cocoa Diet Reverses Age-Related Memory And Cognitive Decline: 60 Year Old Cognition Reverted to 30-40 Year Old

“A new study and clinical trial by scientists at Columbia University Medical Center has shown that in healthy human adults, a diet of cocoa that is rich in flavanols is able to reverse the effects of age-related memory decline. Imaging reveals one region of the brain that is responsible for the improvement in cognition. The study is one of the first to show that dietary modification results in startling brain function improvement upon targeting of one specific brain region. Cognition tests reveal significant improvements in memory recall and reaction times, to the extent that performance of older people resembled that of younger.

… Previous studies have shown that age-related memory decline starts in early adulthood but has little impact on quality of life until the sixth and seventh decades.

Interesting. Would anyone notice if he (for example) changed the code to favor one political party over another? That would not break any laws, would it?

http://www.bespacific.com/facebook-changing-way-users-consume-journalism/

How Facebook Is Changing the Way Its Users Consume Journalism

NYT – Ravi Somaiya: “Many of the people who read this article will do so because Greg Marra, 26, a Facebook engineer, calculated that it was the kind of thing they might enjoy. Mr. Marra’s team designs the code that drives Facebook’s News Feed – the stream of updates, photographs, videos and stories that users see. He is also fast becoming one of the most influential people in the news business… About 30 percent of adults in the United States get their news on Facebook. Roughly once a week, he and his team of about 16 adjust the complex computer code that decides what to show a user when he or she first logs on to Facebook. The code is based on ‘thousands and thousands’ of metrics, Mr. Marra said, including what device a user is on, how many comments or likes a story has received and how long readers spend on an article.”

For my Intro to Computer Security students. Why wait for banks to issue the “Next Generation” of credit cards? Use the security of “Chip-enabled” cards to guarantee payment.

http://krebsonsecurity.com/2014/10/replay-attacks-spoof-chip-card-charges/

‘Replay’ Attacks Spoof Chip Card Charges

An odd new pattern of credit card fraud emanating from Brazil and targeting U.S. financial institutions could spell costly trouble for banks that are just beginning to issue customers more secure chip-based credit and debit cards.

Over the past week, at least three U.S. financial institutions reported receiving tens of thousands of dollars in fraudulent credit and debit card transactions coming from Brazil and hitting card accounts stolen in recent retail heists, principally cards compromised as part of the breach at Home Depot.

The most puzzling aspect of these unauthorized charges? They were all submitted through Visa and MasterCard‘s networks as chip-enabled transactions, even though the banks that issued the cards in question haven’t even yet begun sending customers chip-enabled cards.

The most frustrating aspect of these unauthorized charges? They’re far harder for the bank to dispute.

… However, banks are responsible for all of the fraud costs that occur from any fraudulent use of their customers’ chip-enabled credit/debit cards — even fraudulent charges disguised as these pseudo-chip transactions.

(Related) I can see how this could be used to suck cash from your bank account. (I can create my own QR code and tie it to my account in Brazil.) Since it comes through your phone, will you be liable?

http://www.makeuseof.com/tag/apple-pay-blow-facebook-plagiarism-tech-news-digest/

Dirty Tactics Thwart Mobile Payments

… Rite Aid and CVS have actively disabled NFC (near-field communication) card readers in their stores to prevent customers from using Apple Pay, Google Wallet, and other mobile payments platforms. It has to be assumed this is a bid to keep CurrentC from being surplus to requirements even before it launches in 2015.

CurrentC works differently from Apple Pay, with the customer scanning a QR code into their phone to have the payment taken directly from their bank account. This is designed to cut credit card companies (and their processing fees) out of the equation. Which is why no banks are backing CurrentC.

Also for my Computer Security students. This will be a big concern for most companies. The article suggests a couple of approaches, but consider what would work for you.

http://www.securityweek.com/what-employees-want-vs-what-it-wants-venn-diagram-doesnt-overlap

What Employees Want vs. What IT Wants - The Venn Diagram that Doesn't Overlap

… A large part of what employees want is the ability to do their jobs more efficiently. They want to be able to collaborate internally and externally, and share content. They want to use the devices they need to get their jobs done, and they want to work from Starbucks, from their kid’s soccer field practice and in a hotel room.

… IT, on the other hand is responsible and accountable for the availability and security of the business, and the easiest way to do that is to limit the avenues of risks. But, sometimes, this backfires. Locking down corporate mobile devices encourages employees to use their own mobile devices in search of productivity. Forcing users to access cloud services through a VPN defeats the agility of these services by making them slow and thus also encourages circumvention.

For my Ethical Hackers: This is not a replacement for Uber! (Strange that data on how the reprogramming equipment is used is not reported back to the manufacturer, like all other IoT devices.)

http://www.bbc.com/news/technology-29786320

Keyless cars 'increasingly targeted by thieves using computers'

Organised criminal gangs are increasingly targeting high-end cars with keyless security systems, a motoring industry group has warned.

The thieves are acquiring equipment intended only for legitimate mechanics, the Society of Motor Manufacturers and Traders (SMMT) said.

Manufacturers are trying to stay ahead of the thieves by updating software.

It has been reported that some London-based owners of Range Rovers have been denied insurance over the issue.

… "The challenge remains that the equipment being used to steal a vehicle in this way is legitimately used by workshops to carry out routine maintenance," a spokesman said.

"As part of the need for open access to technical information to enable a flourishing after-market, this equipment is available to independent technicians. However a minority of individuals are exploiting this to obtain the equipment to access vehicles fraudulently.

A challenge for my Computer Forensics students.

http://www.bbc.com/news/technology-29464889

Devices being remotely wiped in police custody

All the data on some of the tablets and phones seized as evidence is being wiped out, remotely, while they are in police custody, the BBC has learned.

Cambridgeshire, Derbyshire, Nottingham and Durham police all told BBC News handsets had been remotely "wiped".

And Dorset police said this had happened to six of the seized devices it had in custody, within one year.

The technology used was designed to allow owners to remove sensitive data from their phones if they are stolen.

"If a device has a signal, in theory it is possible to wipe it remotely," said Ken Munro, a digital forensics expert with Pen Test Partners.

This sounds a bit like a straight line, but it is clearly another “Big Data can make new businesses” story.

http://www.bespacific.com/big-data-dumpster-diving-new-ethics-waste-management/

Big Data, Dumpster Diving and the New Ethics of Waste Management

New York Times: “Rubicon, based in Atlanta, isn’t in the business of hauling waste. It doesn’t own a single truck or landfill. Rather, companies hire it as a kind of waste consultant. It begins by holding an online bidding process for its clients’ waste contracts, fostering competition among waste management businesses and bringing down their prices…. Though unscientific, Dumpster-diving remains the primary way that those in waste management analyze their customers’ trash. “It’s literally: Here’s paper, here’s a cup, here’s books, here’s e-waste,” explained Ms. Beason, who has spent 25 years rummaging around Dumpsters in various waste management jobs… Mr. Morris says he believes that the future of the trash business lies in data. And Rubicon collects all sorts of it: the value per ton and per cubic yard of various materials, in various regions; the volume of clients’ waste; how often that waste is removed; which haulers are servicing which locations for which clients, and so on. The data lives in Rubicon’s proprietary software platform, called Caesar. (Mr. Morris, a fan of the classics, sees in Julius Caesar’s irrevocable river crossing “a fantastic story of disruption.”) One of Rubicon’s most basic data applications is simply to determine whether a client can have its garbage picked up less often. Because haulers traditionally charge per visit, they have an incentive to empty Dumpsters even when they’re only half full. Rubicon sees emerging technologies as creating opportunities to reduce such inefficiencies. It is experimenting, for instance, with a sonar-equipped device that measures whether a Dumpster is full…. Even more grandly, Mr. Morris has said he would like all of his clients to divert 100 percent of their waste from landfills by 2022. Reaching such a goal would seem a threat to companies like Waste Management that are heavily invested in landfills. Yet Waste Management doesn’t appear to be worried about Rubicon, or to think a future without landfills is near.”

Not all of this is free.

http://www.bespacific.com/elsevier-adds-five-new-subject-areas-legacy-ebook-collection/

Elsevier Adds Five New Subject Areas to Legacy eBook Collection

News release: “Elsevier, a world-leading provider of scientific, technical and medical information products and services, today announced it added five new subject areas to its Legacy eBook Collection on ScienceDirect. The Legacy Collection consists of digitized, classic scholarly book content, now including nearly 13,000 books. The new subject areas are arts and humanities; computer science; economics, econometrics and finance; immunology and microbiology; and mathematics. In addition, there are newly digitized books in the engineering and the biochemistry, genetics, and molecular biology collections. The Legacy Collection includes books with contributions from notable authors like leading business management thinker Peter Drucker, and Nobel Laureates such as Lev Davidovich Landau, George Olah, Peter Diamond and Sir Frank McFarlane Burnet. For the first time, the books in the Elsevier’s Legacy Collection are also being made available to more than 70 third-party ebook distributors. Customers can purchase these revived titles through online retailers or through library ebook service providers.”

Ask, “Who benefits?” It's election time again here in the US too. Will we see the electronic version of “hanging chad?”

http://www.securityweek.com/hackers-target-ukraines-election-website

Hackers Target Ukraine's Election Website

Hackers attacked Ukraine's election commission website Saturday on the eve of parliamentary polls, officials said, but they denied Russian reports that the vote counting system itself had been put out of action.

… A report on Russia's state news agency RIA Novosti quoted a statement on the personal website of the Ukrainian prosecutor general saying that the electronic vote counting system was out of order and that Sunday's ballots would have to be counted by hand.

The commission spokesman, Kostyantyn Khivrenko, called the RIA Novosti report a "fake".

… In another possible sign of cyber tensions, the Ukrainska Pravda news website on Friday reported that outdoor video screens across Kiev were briefly hacked.

The screens, which are used for advertising, including pre-election political ads, reportedly started to display "scary and horrible images," the report said.

Engineers went out "to physically unplug" the screens, according to the report.

The report could not be confirmed, but footage on YouTube purporting to capture the incident showed a street screen abruptly switching to footage of destroyed buildings and dead bodies, as well as the images of two nationalist politicians running for parliament, with the words "war criminals".

Yet another reason to avoid PowerPoint.

http://dailygadgetry.com/security-flaw-powerpoint-allows-hackers-gain-control/4615

Security Flaw in PowerPoint Allows Hackers to Gain Control

A security flaw has been found in Microsofts’ PowerPoint after hackers exploited the service to gain control of computer systems.

A security advisor on Microsofts website stated that so far the attacks have been limited however, those who have been affected have lost control of their computers completely.

… For the hackers to have access, users have to open the corrupted file which is most often downloaded from the web. Currently, Microsoft are warning people to not download any Power point presentations at this time.

Can't wait to Google your house!

http://www.forbes.com/sites/aarontilley/2014/10/24/googles-nest-acquires-smart-home-hub-maker-revolv/

Google's Nest Acquires Smart Home Hub Startup Revolv To Control Every Device In Your Home

Nest, best known for its “learning thermostat,” has made another step into being the center of the smart home world. Today it announced it has acquired smart home hub startup Revolv.

… Colorado-based Revolv made a hardware hub with a bunch of radios packed inside to make all the various smart home devices talk to each other. Through the Revolv app, you could sync up smart home interactions.

“Nest bought a team of people knowledgable in the interoperability of a wide variety of radio technology and software protocols in order to make integration easier for partners and customers,” said Forrester analyst Frank Gillett.

… These new partnerships will do things like allow Nest to better know when family members are away from home with family app Life360 or control your thermostat from your Pebble watch.

Business opportunity! Drone swatters (repackaged flyswatters) This one has an umbilical cord, so it can't fly to Afghanistan and back, but should be fine for SWAT or special forces.

http://news.discovery.com/tech/gear-and-gadgets/new-drone-fits-in-your-pocket-flies-for-two-hours-141023.htm

New Drone Fits in Your Pocket, Flies for Two Hours

Anybody who's ever flown a rotary wing drone will look at the stats of CyPhy Works' new Pocket Flyer drone and be amazed. It fits in your pocket and weights a mere 80 grams. It'll fly continuously for two hours or more, sending back high quality HD video the entire time. What's the catch? There isn't one, except for the clever thing that grants all of CyPhy's UAVs their special powers: a microfilament tether that unspools the drone and keeps it constantly connected to communications and power.

For my student game addicts...

http://www.makeuseof.com/tag/waste-life-playing-games-pong-weird-wonderful-web/

Waste Away Your Life Playing All The Games On Pong.com

… Pong.com wants to be the new home of browser-based games, those free Flash games which are currently spread across the Web without any sense of order or meaning. Pong acts as a Pinterest-like platform, with users invited to create boards and add games from around the Web to these categorized collections.

Anyone can play the games posted to Pong, without any need to sign up for an account. These passing visitors can simply click on the game they want to play and, assuming they have Adobe Flash Player installed, they can play away to their heart’s content.

At some point, someone needs to be the “Bad Example.”

FCC jumps into data security; plans $10 million fine for carriers that breached consumer privacy

Back in 2013, I blogged about a breach involving TerraCom and YourTel. Their breach response was so poor that I devoted two posts to criticizing them. But as bad as the breach and their response were, things got even worse when Scripps News kept investigating and uncovered more problems. It was no surprise, therefore, to learn that the Indiana Attorney General was investigating.

What is a surprise, however, is an announcement today by FCC that they intend to fine TerraCom and YourTel $10 million:

They probably got my brother...

Breach involving Cape May-Lewes Ferry’s terminals and vessels went undetected for almost a year

On July 30, 2014, Delaware River and Bay Authority (“the Authority”) was notified [“Someone had to tell us” Bob] of a possible security compromise involving credit and debit card data stored on certain systems at the Cape May-Lewes Ferry‘s terminals and vessels. An investigation into this incident was immediately initiated and our team, including third-party forensics experts, has been working continuously to understand the nature and scope of the incident. Although this investigation is ongoing, we have determined that the security of card processing systems relating to food, beverage, and retail sales at the Cape May – Lewes Ferry were compromised and some data from certain credit and debit cards that were used from September 20, 2013 to August 7, 2014 at Cape May – Lewes Ferry’s terminals and vessels may be at risk.

… “Despite any company’s best efforts, intrusions can occur. [True as stated. But that's like saying, “It's the best we can do.” Not, “It's the best thing to do.” Bob] With the help of professional experts, we want to understand the nature and scope of this incident so we can learn from it.” The Authority is also working with these experts to enhance the security of its credit and debit card processing systems at the Cape May-Lewes Ferry’s terminals and vessels. Gehrke emphasized that the food, beverage, and retail locations at the Cape May – Lewes’s terminals and vessels have been processing credit and debit card transactions securely since August 8, 2014. [“We have fixed our lousy security.” Bob] Gehrke also stressed that only food, beverage, and retail sales locations were affected by the security compromise. The Cape May – Lewes Ferry reservation system, including on-line bookings and terminal point-of-sale locations, utilized for the purchase of vehicle or passenger tickets was not compromised.

… An update on the Cape May – Lewes Ferry web site states:

The credit and debit card data potentially at risk includes the card number, the cardholder’s name and/or the card’s expiration date. We have not determined that any specific cardholder’s credit or debit card data was stolen by the intruder. [“We didn't know we were breached, we have no idea what was taken...” Typocal. Bob] We’re offering free identity protection services, including credit monitoring, to any customer who has purchased food, beverages or retail items at the Cape May – Lewes Ferry from September 2013 through August 2014.

For my Ethical Hackers. Halloween is coming. What do you think of a nation-wide zombie alert? (They had to send this alert, right? If an alert message comes in, what would tell them it is false?)

http://www.techtimes.com/articles/18692/20141024/bogus-emergency-warnings-irk-at-t-u-verse-subscribers.htm

Bogus federal agency emergency warnings irk AT&T U-verse subscribers

… Red banners lined the television screens of viewers in the affected areas, falsely alerting them an important message was inbound. U-verse is AT&T's fiber optic service.

"A Federal Emergency Management Agency (FEMA) investigation indicates that a nationally syndicated radio show not affiliated with AT&T accidentally sent a message over the National Emergency Alert System," stated an AT&T spokeswoman.

A scam by any other name would still stink. I had worked out the rough outlines of a Computer Leasing company once, but with the proliferation of hand-held devices (phones, tablets, etc.) I kind of lost interest. Perhaps it is time to re-visit this market?

http://www.pcadvisor.co.uk/news/tech-industry/3582576/court-shuts-down-alleged-pc-tech-support-scam/

Court shuts down alleged PC tech support scam

A court has shut down a New York tech support vendor after the U.S. Federal Trade Commission accused the company of scamming computer users into paying hundreds of dollars for services they did not need.

The FTC's complaint against Pairsys, based in Albany, New York, also alleged that the company charged customers for software that was otherwise available for free.

Pairsys cold-called computer users in the U.S. and other countries, claiming to be representatives of Microsoft or Facebook, and convinced them to allow the company's workers to gain remote control over the customers' PCs as a way to diagnose computer problems, the FTC said.

Pairsys charged computer owners US$149 to $249 to fix nonexistent problems on their PCs, the FTC alleged.

I prefer Calibre, but the local library makes it easier to use Adobe DE to download eBooks.

http://www.securityweek.com/adobe-updates-digital-editions-following-privacy-controversy

Adobe Updates Digital Editions Following Privacy Controversy

In response to accusations that it's spying on users of the e-book reader application Adobe Digital Editions, Adobe Systems has released a new version of the software that addresses some of the reported issues.

Earlier this month, reports surfaced about Adobe collecting information from Digital Editions 4.0 users, including the books they read and the ones stored in their library. Researchers also noticed that all the data was sent back to Adobe's servers without being encrypted.

“Adobe Digital Editions allows users to view and manage eBooks and other digital publications across their preferred reading devices—whether they purchase or borrow them. All information collected from the user is collected solely for purposes such as license validation and to facilitate the implementation of different licensing models by publishers," Adobe said at the time.

… Adobe maintains its position that the data collected by the e-book reader software has been in line with the end user license agreement and the company's privacy policy. However, the company wants to be more explicit about its practices so it has added a dedicated page to the Adobe Privacy Policy where it details the collection and use of data.

… On the other hand, many experts and users say there still are some questions related to Adobe's data collection practices that remain unanswered.

For my Ethical Hackers. Half for you, half for your professor...

http://newsmaine.net/21117-apple-pay-glitch-nearly-1000-bank-america-debit-transactions-mistakenly-duplicated

Apple Pay glitch: Nearly 1,000 Bank of America debit transactions mistakenly duplicated

As a result of an apparent glitch in Apple's newly-launched Apple Pay mobile payment system, the debit transactions of nearly 1,000 customers of Bank of America were mistakenly duplicated on the system.

A source familiar with the glitch has revealed on the condition of anonymity that the Apple Pay malfunction was seemingly rooted in a processing error which occurred between Bank of America and at least one payment network. The source also said that the glitch was fixed on Wednesday.

It is an interesting question, but is repeating the failures of inBloom the best way to answer it?

Big Data Research Effort Faces Student-Privacy Questions

Benjamin Herold reports:

A coalition of prominent research universities is receiving federal support to redesign and scale up a massive repository for storing, sharing, and analyzing learning and behavioral data that students generate when using digital instructional tools, demonstrating the continued faith that many personalized-learning proponents have in the power of “big data” to transform schooling.

But the project, which is dubbed “LearnSphere” and in some respects echoes the ill-fated attempt by controversial nonprofit inBloom to facilitate the collection and sharing of large amounts of educational information, also raises raising new questions in the highly charged debate over student-data privacy.

Read more on Government Technology.

[From the article:

• Chat-window dialogue sent by students participating in some online courses and tutoring programs;
• Potentially, "affect" and biometric data, including information generated from classroom observations, computerized analysis of students' posture, and sensors placed on students' skin, in order to track measures such as student engagement.

[Can this data be “anonymized?” Bob]

Eventually, there will be a resolution.

Automated Mass Surveillance is Unconstitutional, EFF Explains in Jewel v. NSA

Cindy Cohn and Andrew Crocker write:

Today EFF filed our latest brief in Jewel v. NSA, our longstanding case on behalf of AT&T customers aimed at ending the NSA’s dragnet surveillance of millions of ordinary Americans’ communications. The brief specifically argues that the Fourth Amendment is violated when the government taps into the Internet backbone at places like the AT&T facility on Folsom Street in San Francisco.

Read more on EFF.

Some interesting insights.

http://blogs.hbr.org/2014/10/the-internet-of-things-will-change-your-company-not-just-your-products/

The Internet of Things Will Change Your Company, Not Just Your Products

… Product management. Successful IoT plays require more than simply adding connectivity to a product and charging for service — something many companies don’t immediately understand. Building an IoT offering requires design thinking from the get-go. Specifically, it requires reimagining the business you are in, empathizing with your target customers and their challenges, and creatively determining how to most effectively solve their problems.

… Finance. Finance teams, which are not known for their flexibility to begin with, often have trouble changing their traditional planning, budgeting, and forecasting processes to accommodate radically new IoT business models. I saw this when traditional manufacturers tried to build internet intelligence into products like refrigerators, office products, and health management devices. The finance departments of these companies struggled to account in the same set of books for both one-time revenues for product sales and the recurring subscription revenues for IoT-related services.

… Operations. When product-based companies add services and connectivity, operational requirements increase. The resulting challenges may include new contract-manufacturing relationships, which can be a complicated and disorienting process for the uninitiated.

… Sales. In IoT businesses, sales departments often struggle to determine how to best take a combined product and service to market.

… Human resources. HR has the job of developing the human capabilities needed to capture the IoT opportunity. These may involve new areas for the company (e.g., telemetry, communications and connectivity protocols, electrical hardware engineering). Building them can be an especially daunting task when the business itself is unsure of what capabilities are required.

… Engineering. It is rare for a single company to have all the required engineering capabilities under one roof. Consider the breadth and scope that may involve communications and connectivity technologies (telemetry, WiFi, Bluetooth, Zigbee), electrical hardware engineering (sensor technologies, chips, firmware, etc.), and design and user experience. Developing these engineering skills is one big challenge; integrating them into a functional, integrated engineering effort is another.

Interesting. Apparently ignorance is not bliss, it is fear!

http://www.bespacific.com/chapman-university-survey-american-fears/

The Chapman University Survey on American Fears

“Chapman University has initiated a nationwide poll on what strikes fear in Americans. The Chapman University Survey on American Fears included 1,500 participants from across the nation and all walks of life. The research team leading this effort pared the information down into four basic categories: personal fears, crime, natural disasters and fear factors. According to the Chapman poll, the number one fear in America today is walking alone at night.”

Okay, this is a bit depressing. I know I haven't seen them in a while, but are you telling me ALL the dinosaurs are gone?

http://www.freetech4teachers.com/2014/10/your-life-on-earth-how-world-has.html#.VEu2JVcsFHA

Your Life On Earth - How the World Has Changed In Your Lifetime

Your Life On Earth is a feature of the BBC's Earth website. Your Life On Earth shows you how the world has changed during your lifetime. Enter your birthdate and Your Life On Earth will show you things like how much the world's population has grown, how many new species have been discovered, and how many earthquakes and volcanic eruptions have occurred since you were born.

For the library.

http://www.freetech4teachers.com/2014/10/a-handy-sheet-of-google-search-modifiers.html#.VEu1RFcsFHA

A Handy Sheet of Google Search Modifiers

Back in August I shared an infographic featuring search strategies that every student can use. Yesterday, Vicki Davis posted a great companion to that infographic. Vicki shared this Google Search Modifiers Poster (link opens a PDF). Many of the modifiers featured in the poster can also be used by opening the advanced search menu in Google and making search choices.

The infographic and the search modifiers poster together make a good set of reminders for students. Print them out and post them in your library, computer lab, or classroom.

For my Data Science students.

http://www.bespacific.com/open-data-hub-european-union/

Open Data Hub of the European Union

“This portal is about transparency, open government and innovation. The Open Data Portal will provide access to open public data from the European Union. It will also provide access to data of other Union institutions, bodies, offices and agencies at their request. The published data will be downloadable by everyone interested to facilitate reuse, linking and the creation of innovative services. Moreover, this Data Portal will promote and build literacy around Europe’s data. The data publishers, application developers and the general public will be able to use new functionalities enabled by the semantic technologies.”

An Android Camera App.

Camera51

https://play.google.com/store/apps/details?id=com.camera51.android

– automatically detects and analyzes faces, scenes, objects and lines and guides you to the perfect frame in every click. Camera51 invites you to start taking photos like a professional. It uses photography principles used by professional photographers and artists and applies this vast knowledge in a fun and simple interface.

My students may resist this, but perhaps I can use these ideas when I tutor.

http://www.makeuseof.com/tag/want-become-expert-something-try-deliberate-practice/

Want To Become An Expert At Something? Try Deliberate Practice

It’s all too easy to feel crestfallen when you’re arduously trying to improve a certain skill (say, learning a new programming language), yet seem to be fighting (and losing) an uphill battle. In cases like these, it may be high time to try your hand at some deliberate practice to get you over that infuriating plateau.

… But hold on…there is another way! All it takes is one hour of deliberate practice each day. Allow me to explain.

Time for humor.

Hack Education Weekly News

… LAUSD’s new superintendent Ramon Cortines says that construction bonds shouldn’t pay for iPads and Pearson curriculum. Currently, construction bonds are paying for the district’s iPads and Pearson curriculum. So the LAUSD iPad saga continues…

… Via Tressie McMillan Cottom: the top degree-granting institutions for African Americans. Take a guess at what they are. Then read Tressie’s article and analysis. [Not what I guessed. Bob]

… Researchers from the Stanford Center on Longevity and the Berlin Max Planck Institute for Human Development issued a statement this week about the promises made by “brain training” companies: “To date, there is little evidence that playing brain games improves underlying broad cognitive abilities, or that it enables one to better navigate a complex realm of everyday life.” (Hello ed-tech: please keep this in mind the next time you see someone drop the phrase “brain based” into their blog posts or webinars.) Meanwhile, “Research shows Portal 2 is better for you than ‘Brain training’ software.”

… “The Impact of Open Textbooks on Secondary Science Learning Outcomes.” From the abstract: “Although the effect size of the gains were relatively small, and not consistent across all textbooks, the finding that open textbooks can be as effective or even slightly more effective than their traditional counterparts has important considerations in terms of school district policy in a climate of finite educational funding.” [Part of my reasoning for having students create their own textbooks. Bob]