It's not just the breachee that pays the price. (Is “breachee” a word or should I call the Oxford dictionary people?)

Home Depot Breach Costs CUs $60M

Nicholas Ballasy reports:

The Home Depot data breach cost credit unions almost $60 million, nearly twice as much as the Target breach, according to survey results released by CUNA Thursday.

In the survey conducted from Oct. 1 to Oct. 24, 835 credit unions reported that 7.2 million credit union debit and credit cards were affected by the breach.

CUNA said the average cost for each violation was $8.02 per card due to fraud, reissuing cards and related costs.

Read more on CreditUnion Times.

It's not strange that drones are flying over their reactors, it's strange that they can't locate the pilots!

http://www.makeuseof.com/tag/nintendo-healthy-currentc-hacked-tech-news-digest/

France Investigates Mystery Drones

France is currently investigating who has been flying drones over its nuclear power plants. Unmanned aerial vehicles (UAVs) have been spotted buzzing seven of France’s state-owned power plants in recent weeks, and the authorities don’t currently have a clue who is responsible.

The drones are commercial models, meaning this could literally be anyone. Greenpeace was accused of being involved, but has vehemently denied it’s behind the stunt. This raises security concerns for obvious reasons, but unless these drones are shot on sight it seems there is very little that can be done to stop them.

Tools for my Ethical Hackers. Of course this is easily prevented, but most organizations won't take that extra step.

http://www.securityweek.com/airhopper-malware-uses-radio-signals-steal-data-isolated-computers

"AirHopper" Malware Uses Radio Signals to Steal Data from Isolated Computers

A proof-of-concept malware developed by researchers at the Ben Gurion University in Israel shows that an attacker can transmit sensitive information from isolated computers to nearby mobile phones by using radio signals.

Numerous organizations have resorted to what is known as "air gapping" to secure their most sensitive information. This security method can be efficient because the protected devices are isolated from the Internet, which makes them difficult to compromise.

… The researchers have demonstrated that data exfiltration from an isolated device is possible via radio signals captured by a mobile device. The proof-of-concept malware they have created, dubbed "AirHopper," uses the infected computer's graphics card to emit electromagnetic signals to a nearby mobile phone that's set up to capture the data.

… The attack has four main steps: getting the piece of malware onto the isolated computer, installing malicious code on one or more mobile phones, setting up a command and control (C&C) channel with the infected mobile device, and transmitting signals emanated by the isolated computer back to the attacker.

For my Computer Forensics students. Won't work on all encryption (not at all on Codes) but might prove useful.

Secret manuals show the spyware sold to despots and cops worldwide

Cora Currier and Morgan Marquis-Boire report:

When Apple and Google unveiled new encryption schemes last month, law enforcement officials complained that they wouldn’t be able to unlock evidence on criminals’ digital devices. What they didn’t say is that there are already methods to bypass encryption, thanks to off-the-shelf digital implants readily available to the smallest national agencies and the largest city police forces — easy-to-use software that takes over and monitors digital devices in real time, according to documents obtained by The Intercept.

We’re publishing in full, for the first time, manuals explaining the prominent commercial implant software “Remote Control System,” manufactured by the Italian company Hacking Team. Despite FBI director James Comey’s dire warnings about the impact of widespread data scrambling — “criminals and terrorists would like nothing more,” he declared — Hacking Team explicitly promises on its website that its software can “defeat encryption.”

Read more on The Intercept.

(Related) How big a problem is encryption? Encryption was used in (41/3576) 1.15% of the wiretaps, and kept the message secure in (9/41) about 22% of the time. So encryption was a real concern (9/3576) 0.25% of the time. One quarter of 1 percent!

http://www.uscourts.gov/Statistics/WiretapReports/wiretap-report-2013.aspx#sa1

Wiretap Report 2013

… The number of federal and state wiretaps reported in 2013 increased 5 percent from 2012. A total of 3,576 wiretaps were reported as authorized in 2013, with 1,476 authorized by federal judges and 2,100 authorized by state judges.

… The number of state wiretaps in which encryption was encountered increased from 15 in 2012 to 41 in 2013. In nine of these wiretaps, officials were unable to decipher the plain text of the messages. Encryption was also reported for 52 state wiretaps that were conducted during previous years, but reported to the AO for the first time in 2013. Officials were able to decipher the plain text of the communications in all 52 intercepts.

This could impact several areas of Computer Security.

http://www.securityweek.com/nist-releases-guide-threat-intelligence-sharing-efforts

NIST Releases Guide for Threat Intelligence Sharing Efforts

The National Institute of Standards and Technology (NIST) is seeking public comment on a draft paper outlining ways to help organizations improve threat intelligence sharing.

The paper, titled 'Guide to Threat Information Sharing', is aimed at providing guidance for improving the effectiveness of cyber-security efforts through strong information sharing practices.

… "When deciding what incident-related information to share with other organizations, the following factors should be considered: risk of disclosure; operational urgency and need for sharing; benefits gained by sharing; sensitivity of the information; trustworthiness of the recipients; [and the] methods and ability to safeguard the information," the report notes.

One to watch...

http://www.securityweek.com/200-organizations-take-part-largest-european-cybersecurity-exercise-date

200 Organizations Take Part in Largest European Cybersecurity Exercise to Date

Today, the European Union Agency for Network and Information Security (ENISA) is conducting the biggest and most complex European cybersecurity exercise to date.

According to the agency, more than 200 organizations and 400 experts from a total of 29 European Union and EFTA countries will participate in Cyber Europe 2014, a large-scale event that's organized every two years. The exercise takes place at several centers all over Europe and is coordinated from a central control center.

… Participants will be presented with over 2,000 incidents, including defacements, data theft, denial-of-service (DoS), intelligence and media reports on malicious cyber operations, and attacks on critical infrastructure. The goal is to test not only the procedures and capabilities of each participant, but also the effectiveness of cooperation in the European Union.

Here's another example Scott Peppet (CU Law Professor) can add to his list.

Samaritans ‘suicide Twitter-sniffer’ backfires over privacy concerns

Jennifer Baker reports:

In response to public outcry via Twitter and personal blogs on Wednesday, the Samaritans have announced an opt-out function for their stalker-friendly app Samaritans Radar.

Samaritans Radar automatically scans the tweets of anyone the user follows and alerts subscribers to potentially suicidal tweets based on “trigger phrases”. However well-meaning the intention, many Twitter users were quick to point out that there were huge privacy implications, not to mention the creepy effect: “The people you follow won’t know you’ve signed up to it and all alerts will be sent directly to your email address,” according to the Samaritans website.

Read more on The Register.

Perspective. (and a business opportunity!)

http://www.bespacific.com/false-promise-anonymity-cdt/

The False Promise of Anonymity – CDT

Sarah St.Vincent and Alex Bradshaw: “In recent weeks, multiple apps promising “secret” messaging have had sensitive data exposed by breaches and the apps’ not-so-secret data-sharing practices. This news makes one thing clear: the term “anonymity,” as used by apps that ostensibly enable individuals to post updates anonymously, often promises too much. Many applications promising anonymity collect highly specific user data despite representations to the contrary. Often, this data is monetized through sharing with third-parties and it is almost always susceptible to unauthorized access. The Whisper incident is an example of this misrepresentation of anonymity. After the Guardian reported that popular messaging app Whisper shares users’ IP addresses with government entities, Whisper conceded that this was true. However the app maintains that the service “does not collect nor store any personally identifiable information (PII) from users and is anonymous.” This position is puzzling for two reasons: first, Whisper’s exclusion of IP addresses from its definition of PII directly contradicts federal authorities’ interpretation of the term – NIST includes IP address in its definition of PII – and secondly, despite how “PII” is defined, simply refraining from collecting PII does not guarantee anonymity.”

Ethical problems or merely bad public relations? I read this as “Cool it! You're making it difficult for us to give you the 'Big Brother' powers you've been asking for.”

http://thehill.com/policy/technology/222378-top-senate-dem-warns-fbi-for-faking-newspaper

Leahy wants change in tactics from FBI, DEA

The head of the Senate Judiciary Committee is “increasingly concerned” with the way that federal agents are carrying out investigations, he told Attorney General Eric Holder on Thursday.

Sen. Patrick Leahy (D-Vt.) wrote to Holder in response to news that the Drug Enforcement Administration (DEA) used a woman’s identity to create a Facebook profile without her knowledge and that the FBI planted a fake Associated Press article on a phony Seattle Times website.

“Such tactics carry ethical and legal risks,” the longtime senator told Holder.

“Tactics such as these may ultimately prove counter-productive if they erode the public’s trust in the judgment and integrity of law enforcement officers.”

… On Thursday, he also said that officials should commit not to impersonate news organizations, days after news emerged that the FBI used a fake AP story to insert a bug into the computer of a teenager suspected of calling in bomb threats at their school.

… In his letter, Leagy noted that news about the controversial investigations come as the FBI is seeking to expand its ability to hack into people’s computers.

… The recent stories are not helping the FBI’s case in that matter, Leahy indicated.

Amusing. Does not seems to work exactly as advertised.

http://www.bespacific.com/wsj-database-consitutents-explore-composition-congressional-representation/

WSJ Database for consitutents to explore composition of Congressional representation

“The U.S. House of Representatives was envisioned as a house of the people, directly elected by voters and reflecting their will. But what if Congress also reflected its constituents’ demographics? Explore how members of the House compare with residents of each of the 435 congressional districts, based on the predominant characteristics within each. Then see how your district stacks up.”

Perspective.

http://thehill.com/policy/technology/222339-report-us-internet-speeds-and-prices-lag-behind-others

Report: US Internet speed, prices lag behind other nations'

The United States lags behind other nations when it comes to Internet speeds and prices, according to a Thursday report.

The Open Technology Institute's report evaluated prices and speeds of home broadband Internet from 24 cities around the world, including eight in the United States.

The study, which tracks with past studies and other recent data, found similar gaps for mobile broadband service as well.

… The report found that U.S. cities with publically owned networks, like Chattanooga or Lafayette, have speeds far exceeding cities with only traditional Internet service providers like Verizon, AT&T or Comcast. [I've advocated public networks for years! Bob]

Was this their strategy all along? With a Starbucks on every corner, delivery will be no big deal. (Thing of the British “Tea lady”)

http://www.geekwire.com/2014/starbucks-deliver-food-coffee-2015-howard-schultz-calls-e-commerce-steroids/?google_editors_picks=true

Starbucks to deliver food and coffee in 2015: Howard Schultz calls it ‘e-commerce on steroids’

… Starbucks CEO Howard Schultz announced that the company plans to begin delivering food and beverages in select cities in the second half of next year, part of a larger effort by the Seattle coffee company to conquer the mobile payments arena.

“Imagine the ability to create a standing order of Starbucks delivered hot or iced to your desk daily,” Schultz said in a conference call with analysts.

Might be fun for our Design students. (I doubt Obama as the Grinch would win)

http://thehill.com/policy/technology/222355-wh-hosting-3d-printed-ornament-contest

WH launches contest for 3D printed ornaments

The White House is hosting a 3D printing contest to see who can design the best holiday ornament.

The contest will run through Nov. 10 and only requires contestants to submit a design rather than create and print out their entry, the White House Office of Science and Technology Policy said Thursday, announcing the contest.

I get it. The FBI is afraid they will not be able to keep up with the crooks if they have to follow the current rules. The new rule would allow a magistrate to issue a warrant (good anywhere) that allows them to hack into any suspect computer. Once this is on the books, what would be next?

FBI demands new powers to hack into computers and carry out surveillance

Ed Pilkington writes:

The FBI is attempting to persuade an obscure regulatory body in Washington to change its rules of engagement in order to seize significant new powers to hack into and carry out surveillance of computers throughout the US and around the world.

Civil liberties groups warn that the proposed rule change amounts to a power grab by the agency that would ride roughshod over strict limits to searches and seizures laid out under the fourth amendment of the US constitution, as well as violate first amendment privacy rights. They have protested that the FBI is seeking to transform its cyber capabilities with minimal public debate and with no congressional oversight.

The regulatory body to which the Department of Justice has applied to make the rule change, the advisory committee on criminal rules, will meet for the first time on November 5 to discuss the issue. The panel will be addressed by a slew of technology experts and privacy advocates concerned about the possible ramifications were the proposals allowed to go into effect next year.

Read more on The Guardian.

(Related) Something is missing from this story. What judge would issue a warrant based on a video obtained this way?

http://thehill.com/policy/technology/222223-lawsuit-alleges-fbi-posed-as-tech-repairmen-to-obtain-evidence

Lawsuit alleges FBI posed as tech repairmen to obtain evidence

A lawsuit alleges that FBI agents shut off internet access to three Las Vegas villas and then posed as repairman to gain access to the houses.

The agency was investigating the residents of the houses — located at a luxury hotel — for their suspected involvement in online sports betting.

Defense attorneys for the men who were charged in the betting case said FBI agents used the tactic despite the opposition of an assistant U.S. attorney.

… Posing as technicians, they recorded video that was later used to obtain a warrant to arrest the residents.

Worth reading and thinking about.

http://www.pewinternet.org/2014/03/11/digital-life-in-2025/

Digital Life in 2025

The world is moving rapidly towards ubiquitous connectivity that will further change how and where people associate, gather and share information, and consume media. A canvassing of 2,558 experts and technology builders about where we will stand by the year 2025 finds striking patterns in their predictions.

… In their responses, these experts foresee an ambient information environment where accessing the Internet will be effortless and most people will tap into it so easily it will flow through their lives “like electricity.” They predict mobile, wearable, and embedded computing will be tied together in the Internet of Things, allowing people and their surroundings to tap into artificial intelligence-enhanced cloud-based information storage and sharing.

(Related) A graphic novel explaining Big Data (and the Internet of Things) for the complete novice.

http://projects.aljazeera.com/2014/terms-of-service/#1

Terms of Service

For my Computer Forensics students. What happens when a reporter calls your CEO asking for confirmation? You better have a plan.

How to spot a fake online data dump

Both Kelly Jackson Higgins and Brian Krebs had columns yesterday on a report by Allison Nixon of Deloitte on how to vet a data dump. The report should be required reading for journalists as the reputation harm that can occur by publishing or repeating false claims of a hack can be significant. While many will immediately think of Dropbox’s recent attempt to reassure users they had not been hacked, remember that Dropbox was also in the news earlier this year over a claimed hack that was not a hack at all.

Regular readers know that this blog and DataLossDB.org instituted policies of attempting to verify breach claims with the breached entity before publishing claims of a breach by anonymous hackers or hacktivists. It’s been a useful policy. Although it may delay publication of “news,” it reduces the risk of falsely reporting an entity has been compromised when they haven’t been. Unfortunately, not all entities respond to inquiries or requests, often leaving us with a “Go – No Go” decision to make. The techniques Nixon describes are not foolproof (see the discussion of “combolists”), but it’s a lot better than just repeating claims without investigation.

Brian has kindly uploaded a copy of the report here (pdf).

I would be shocked if this hadn't happened regularly. Clearly, hackers (including the Russians) have the tools and techniques needed and the White House is quite high on the “bragging list.” Are they jumping to the conclusion it was Russia?

http://www.securityweek.com/hackers-breach-white-house-computer-system

Hackers Breach White House Computer System

The White House's unclassified computer network was recently breached by intruders, a US official said Tuesday, with The Washington Post newspaper reporting that the Russian government was thought to be behind the act.

… The Washington Post quoted sources as saying hackers believed to be working for the Russian government were believed to be responsible. [So, contractors? Bob]

(Related) Another “of course they are” article. Apparently breaking into unsecured civilian phones makes the North feel competent.

http://www.securityweek.com/south-korea-spy-agency-says-north-hacking-smartphones

South Korea Spy Agency Says North Hacking Smartphones

North Korea attempted to hack tens of thousands of South Korean smartphones this year, using malware disguised in mobile gaming apps, the South's spy agency said in a report submitted to parliament this week.

The National Intelligence Service said more than 20,000 smartphones may have been infected by the apps that were posted on South Korean websites between May and September

… The North is believed to run an elite cyber war unit of at least 3,000 personnel, but it has denied any involvement and accuses Seoul of fabricating the incidents to fan cross-border tensions. [Their standard reply Bob]

I'll survey my Computer Security students tonight.

Find Out Whether This Unkillable Tracker Is On Your Smartphone

Kashmir Hill writes:

The generally accepted trade-off on the Internet is that you give up your privacy to get free stuff. It’s summed up by a frequently repeated adage, “If you’re not paying for it, you’re the product.” But sometimes you’re paying for it, and you’re still the product. Verizon and AT&T customers are paying an (often steep) monthly bill, but the payment doesn’t ensure privacy. Researchers say the carriers are inserting a unique code into customers’ browser requests to help serve up personalized ads. The way they are doing it makes you trackable by the sites you visit, third party ad networks, or, of course, the NSA, even if you take measures to protect your privacy, such as clearing your cookies.

Wired reports that it was first discovered by digital rights group EFF. Kenn White, a security consultant, created a site where mobile users can find out whether their phone is broadcasting the tracking code.

Read more on Forbes.

[From the article:

You can check it out here; the tracker is turned on for you if you see a bunch of letters and numbers after “Broadcast UID.”

Perhaps we'll see similar reports from all 50 states?

Attorney General Kamala D. Harris Releases Data Breach Report; 18.5 Million Californians’ Personal Information Put at Risk

LOS ANGELES – Attorney General Kamala D. Harris today released the second annual report detailing the 167 data breaches reported to the Attorney General’s office in 2013 that impacted18.5 million Californians by putting their personal information at risk. The report is accompanied by recommendations from the Attorney General for consumers, businesses and lawmakers on how to protect against data breaches and prevent them in the future.

… In 2013, the number of reported data breaches increased by 28 percent, from 131 in 2012 to 167 in 201. The number of Californians’ whose records were affected increased by over 600 percent, from 2.5 million in 2012 to 18.5 million in 2013. This increase was largely due to two massive retailer breaches at Target and LivingSocial, each of which put the personal information of approximately 7.5 million Californians at risk.

… The full Data Breach 2013 report is available here: https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/2014data_breach_rpt.pdf?

Sort of a mini-background check? Would it creep you out to know they did this to you?

Charlie

https://charlieapp.com/

– Make a killer impression on whoever you’re meeting. Charlie combs through 100’s of sources and automatically sends you a one-pager on everyone you’re going to meet with, before you see them. Be the one they remember by talking about things that truly matter to them. You’ll know what makes them tick, what you have in common, and the critical insights on their company that your competitors won’t.

Perspective. Somewhat simplistic, but interesting.

http://www.theatlantic.com/technology/archive/2014/10/facebook-is-losing-24420-per-minute/382054/

When It Goes Down, Facebook Loses $24,420 Per Minute

Cheaper than drones and no piloting skills required. What does Ohio really use them for?

Pennsylvania law enforcement deploys unmanned balloon in search for alleged cop-killer

The Ohio State Dept. of Transportation has loaned the “eye in the sky” to Pennsylvania, according to IBT and CBS.

No mention of what/how much the balloon records or for how long the data are being retained for people who may be incidentally surveilled in the process of searching for Eric Frein.

[From the IBT article:

The balloon had been scanning Ohio prisons for potential fugitives [Huh? Bob]

Depressing.

The Most Alarming Fact of the HIPAA Audits

Terrific analysis and commentary by Daniel Solove, on LinkedIn.

The joy of BYOD. So, my little Computer Security minions, how do you control this?

Hospitals’ dirty little secret: Caregivers sharing clinical data via personal phones

Heck, that’s not a dirty little secret. It’s widely known as a problem, but I guess VentureBeat editors were looking to sex up the headline.

Mark Sullivan reports:

Hospital caregivers typically bring their own mobile devices to work and use them to share clinical and care coordination information other members of their multidisciplinary care team. It’s a practice that screams “HIPAA violation.”

Much of this information is transmitted via text messages or multimedia SMS. This can even include images.

Read more on VentureBeat.

Similar to setting up a phoney Facebook page for a 'sting?'

Seattle Times ‘Outraged’ at FBI Using Its Name to Infect Computer

June Williams reports:

The FBI used a fake Seattle Times article and Internet link to infect a high school bomb-threat suspect’s computer with spyware, an ACLU technologist said Monday.

Documents obtained by the Electronic Frontier Foundation show the FBI made up a news story about the threats, used an AP byline and emailed a link “in the style of the Seattle Times” to the suspect’s MySpace account. When he clicked on the link, agents were able to track his IP address. [Couldn't they have subpoenaed the IP address from MySpace? Bob]

The Seattle Times appeared unaware of the ruse, and editor Kathy Best said she was “outraged.”

Read more on Courthouse News.

Interesting. Is this for parents to monitor their children or for anyone to monitor anyone? If you have the app and fail to take action, is there liability? Why doesn't the app call (or text) 911? Will this become mandatory? This one is only Twitter, but expect Facebook and Google Mail and everyone else to jump on similar Apps.

http://www.itproportal.com/2014/10/29/samaritans-new-twitter-app-will-tell-you-if-your-friends-are-suicidal/

Twitter wants to tell you if your friends are suicidal

Samaritans Radar is a new Twitter app designed to warn users whether their connections online are at risk of suicide.

Predominantly aimed at those aged 15 to 35, the free app works by using a specially designed algorithm to monitor the tweets of those in people's network. If it finds specific keywords or phrases that throw up red flags that a person may be struggling to cope...

… The app will then send an email alert to a Twitter connection, which will include a link to the tweet that raised the alarm. That person will then be offered guidance on the best way of providing support to the tweeter.

(Related) Google search inside your body!

http://www.business-standard.com/article/news-ians/google-scientists-to-find-hidden-cancer-via-nanoparticles-114102900586_1.html

Google scientists to find 'hidden' cancer via nanoparticles

In a pioneering research, a Google life sciences team - which has two senior Indian-origin researchers - is set to find signs of deadly diseases like cancer by sending 'nanoparticles' in the bloodstream of a person and then get the results via a wearable device.

… "Every test you ever go to the doctor for will be done through this system," Andrew Conrad, head of the Life Sciences team at the Google X research lab, was quoted as saying at a WSJ conference.

The tiny "nanoparticles" will be delivered via a pill.

… According to Conrad, the firm will not collect or store medical data itself but will license the technology to others. [So they will publish the API to help me hack in Bob]

“It's a no brainer! They fly, so we'll regulate them like aircraft (except for blimps). No need to ask anyone if they see things differently.” Did the DHS pressure the FAA? OMG!

http://www.ibtimes.com/faa-criminalizes-use-drones-near-stadiums-violators-could-face-year-jail-1715275

FAA Criminalizes Use Of Drones Near Stadiums, Violators Could Face Up To A Year In Jail

Flying drones or model planes near or over sports stadiums and auto race tracks could land operators in jail, the Federal Aviation Administration, or FAA, warned in a notice, The Associated Press, or AP, reported Tuesday. This is reportedly the first time that the use of drones has been criminalized in the United States.

… The notice is "another attempt by the FAA to impose legal restriction on drones or model aircraft that never existed before,” Brendan Schulman, a New York-based attorney, who represents several drone operators said, according to AP.

… The FAA reportedly stated that the restriction was being imposed for security reasons.

However, Schulman reportedly said that he did not believe that such restrictions would in any way help prevent terrorist attacks. The prohibition reportedly applies to nearly 150 stadiums in the U.S.

Sports teams too have expressed concerns over the new restrictions as drones are used for photographing and recording games, Kenneth Quinn, a former FAA general counsel who also has voiced concerns over the drone restrictions, said, according to AP. Quinn added that the teams wanted permission from the FAA to allow the use of drones by them to record practice sessions for future training.

(Related) Of course, this is not a drone.

http://www.ted.com/talks/sergei_lupashin_a_flying_camera_on_a_leash

A flying camera ... on a leash

As clear as mud. Does this look like a strategy or political tactics?

http://www.washingtonpost.com/blogs/the-switch/wp/2014/10/29/streaming-tv-companies-might-soon-play-by-cables-rules-and-thats-a-good-thing/

Streaming TV companies might soon play by cable’s rules — and that’s a good thing

As Americans begin watching more of their TV online, federal regulators want to even the playing field to make new Internet startups — such as the recently announced CBS streaming app or Aereo — more competitive next to their bigger rivals in the cable and satellite business.

A new proposal being circulated around the Federal Communications Commission would do just that. In a blog post Tuesday, FCC Chairman Tom Wheeler acknowledged that consumers are being forced to "buy channels they never watch."

… When the FCC gets around to voting on the proposal, the result could mean being able to mix and match video sources more easily.

… But the FCC proposal leaves out several of the most well-known video streamers -- Netflix and Amazon Instant Video. This may be a confusing distinction – after all, what's really the difference between CBS's streaming app and Hulu? The agency has said it distinguishes apps like CBS All Access because it provides programming on a schedule, while the Netflixes of the world offer shows on demand. But analysts have said what's really going on here is that the agency does not want to pull Web-based services such as Hulu into its orbit because of the political minefield surrounding the regulation of Web companies.

But there's another big benefit to the FCC proposal. Wheeler argued that the move would also help companies trying to break into the broadband market. These firms, such as Google Fiber, could focus on just building super high-speed connections without having to worry about being treated like a cable company. Currently they are being forced to pay a fee for video programming that travels over their pipes. According to Google, those costs are the single biggest thing holding Google Fiber back.

So it looks like the customers (and the researchers) were right, despite all the denials.

http://www.nytimes.com/2014/10/29/technology/FTC-says-ATT-deceived-consumers-on-unlimited-data-plan.html?_r=0

AT&T Accused of Deceiving Smartphone Customers With Unlimited Data Plans

Three years ago, AT&T warned smartphone customers with “unlimited” data plans that their connections might be slowed if they used a lot of data. On Tuesday, the Federal Trade Commission said AT&T’s disclosure was deceptive because it was not specific enough.

The commission filed a federal lawsuit against AT&T on Tuesday, saying the company had misled customers by slowing the connections of people with unlimited plans after they used more than two gigabytes of data in a month.

For some of the people who hit that threshold, the F.T.C. said, downloads were slowed by as much as 95 percent, essentially making their smartphones unable to gain access to the Internet or use certain apps.

“AT&T promised its customers unlimited data, and in many instances it has failed to deliver on that promise,” said Edith Ramirez, chairwoman of the agency. “The issue here is simple: ‘Unlimited’ means unlimited.” [What a concept! Bob] The commission, which does not have the power to impose fines, said it would seek “millions of dollars” in restitution for consumers.

It's not renting, it's borrowing. Funny she has never heard of this before.

http://www.freetech4teachers.com/2014/10/rent-ebooks-audiobooks-for-free.html#.VFD1OVcsFHA

Rent eBooks & Audiobooks for FREE

I spend way too much money on books! This year, I made a concerted effort to get more books from the library to help my budget. On my first visit to a local library, [That explains why she didn't know about borrowing Bob] I learned that they used Overdrive to rent eBooks and audiobooks! So now, I can check out eBooks and audiobooks from home and read them on my iPad! Overdrive allows you to rent eBooks, Audiobooks, and even video straight from your local library! There are no fees associated with this service. All you need is a library card!

To see if you library partners with Overdrive, simply make a quick search on their site. You can then create an Overdrive account using your library card. Download the App onto your Computer, iOS, or Android device and you’re ready to start checking out material! The nice thing about an Overdrive account is that you can sync your content across devices! Never lose your spot on your eBook or Audiobook! When your rental expires, it automatically goes back to the library, so no late fees!

I have a couple students writing books. Perhaps they could use this?

Kindle Scout

https://kindlescout.amazon.com/

– is a reader-powered publishing for new, never-before-published books. It’s a place where readers help decide if a book gets published. Selected books will be published by Kindle Press and receive 5-year renewable terms, a $1,500 advance, 50% eBook royalty rate, easy rights reversions and featured Amazon marketing.

For my Computer Security students.

http://www.securityweek.com/credit-card-hacking-americans-top-crime-worry-poll

Credit Card Hacking is Americans' Top Crime Worry: Poll

Credit-card hacking is the number one crime on Americans' worry list, far above getting mugged or murdered, according to a Gallup survey released Monday.

As the number of major retailers reporting cyber breaches grows, with thieves stealing credit card data belonging to tens of millions of their customers, awareness of the hacking threat has taken off.

"Americans today are more worried about their credit card information being hacked from stores than about any other crimes they are asked about, and a relatively high percentage say they have been victims of this hacking," Gallup said.

Sixty-nine percent of Americans said they frequently or occasionally worry about computer hackers stealing the credit-card information they have used at stores.

The only other crime that worries the majority of Americans -- 62 percent -- is hacking and data theft of a computer or smartphone.

(Related)

http://thehill.com/policy/cybersecurity/221936-study-cyber-attacks-up-48-percent-in-2014

Study: Cyberattacks up 48 percent in 2014

The number of detected cyberattacks skyrocketed in 2014 — up 48 percent from 2013 — and they are costing companies more money, according to two global studies released Monday.

This year is expected to see 42.8 million cyberattacks, roughly 117,339 attacks each day, a study from consulting firm PricewaterhouseCoopers found.

Nearly all companies surveyed were hit by a cyberattack in 2014, costing them hundreds of thousands, potentially millions, of dollars.

… Security filings revealed that retail giant Target alone shelled out upwards of $150 million since its data breach during the 2013 holiday shopping season.

Another report from security software vendor Kaspersky Lab estimated an average data security incident costs a company $720,000.

(Related) You may never know you've been a victim.

http://www.bespacific.com/jpmorgan-data-breach-involves-information-76-million-households/

JPMorgan Data Breach Involves Information on 76 Million Households

JPMorgan Data Breach Involves Information on 76 Million Households, 7 Million Small Businesses, CRS Legal Sidebar, October 23, 2014

“JPMorgan did not provide individual customers with notice of the breach because it believed that it had no obligation to do so because no “sensitive customer information” was involved in the data breach. This means that JPMorgan apparently has complied with data breach notification standards promulgated by the federal banking regulators pursuant to the privacy provisions of the Gramm-Leach-Bliley Act (GLBA). These standards specify the contents of breach notices that must be supplied by telephone, mail, or electronic mail to all affected customers when a data breach involves “sensitive customer information.” Should “sensitive customer information” be involved in a data breach, the guidelines require financial institutions, such as JPMorgan, to notify customers only if after a “reasonable investigation” the company determines that “misuse of its information about a customer has occurred or is reasonably possible.”

Notice that the US government does not make this accusation about a group that is not part of the Chinese government. This is pure diplomatic speak.

Researchers identify sophisticated Chinese cyberespionage group

Ellen Nakashima reports:

A coalition of security researchers has identified a Chinese cyberespionage group that appears to be the most sophisticated of any publicly known Chinese hacker unit and targets not only U.S. and Western government agencies but also dissidents inside and outside China.

News of the state-sponsored hacker group dubbed Axiom comes a week before Secretary of State John F. Kerry and two weeks before President Obama are due to arrive in Beijing for a series of high-level talks, including on the issue of cybersecurity.

Read more on Washington Post.

(Related) Countries (particularly China and Russia) tend to take accusations personally.

http://www.securityweek.com/fireeye-links-russia-cyber-espionage-campaign-dating-back-2007

FireEye Links Russia to Cyber Espionage Campaign Dating Back to 2007

Security firm FireEye has released a new report uncovering and detailing a large cyber-espionage campaign that the company believes is sponsored by the Russian government and dates back to 2007.

The group behind the campaign, which FireEye is calling APT28, is a skilled team of developers and operators collecting intelligence on defense and geopolitical issues that would clearly benefit Russia.

Unlike many attacks often attributed to China and detailed in Mandiant’s (now part of FireEye) APT1 report released in 2013, the APT28 attackers do not appear to be after intellectual property theft for economic gain.

… Last week, Trend Micro released a report on a cyber-espionage operation dubbed "Operation Pawn Storm" which targeted military, government and media organizations around the world and utilized the Sofacy malware.

But according to McWhorter, the direct link and attribution to Russia is what FireEye is highlighting in its APT28 report.

… the report (PDF)

About time someone initiated a smackdown!

EFF and ACLU of Tennessee Team Up to Challenge Unconstitutional School District Policy

Nate Cardozo and Jamie Lee Williams write:

School districts across the country are grappling with how to deal with their students’ use of technology and social media. All too often, in an attempt to protect students, they end up implementing technology polices that give administrators too much power and go too far in restricting what students can do online. Williamson County Schools, a public school district in affluent Williamson County, Tennessee, is one such school district. Recently, a concerned parent, Daniel Pomerantz, brought the policy to the attention of EFF and the ACLU of Tennessee (ACLU-TN). Mr. Pomerantz was right to be concerned.

Earlier today, EFF and ACLU-TN sent a letter to the board on behalf of our client detailing our concerns. As we outline in our letter to the school board, the school district’s technology and Internet policy is troubling in a number of ways. Indeed, the policy violates the First and Fourth Amendment rights of 35,000 Williamson County students across the district’s 41 schools. We teamed up with ACLU-TN to demand that the Williamson County School Board immediately suspend the unconstitutional policy.

Read more on EFF.

If it takes analysis of Big Data to determine who to discriminate against, will it be obvious to anyone who does not analyze Big Data that documents the discrimination?

http://thehill.com/policy/technology/222009-aclu-tells-feds-watch-online-discrimination

ACLU tells feds: Watch online discrimination

Companies that target certain people based on their online behavior could be practicing a form of discrimination, the American Civil Liberties Union (ACLU) warned on Monday.

Some businesses look at massive amounts of information about what people do on the Internet to target ads to one group over another, which the ACLU told the Federal Trade Commission (FTC) “has the potential to significantly reinforce existing economic disparities between racial groups."

“Because decisions about which advertisements to display are in some cases based on data about race or factors closely linked to race, we are in danger of segregating the consumer experience on the Web,” ACLU officials told FTC Chairwoman Edith Ramirez in a formal filing.

Both the FTC and the Consumer Financial Protection Bureau should investigate whether or not companies are violating the rules by using new forms of discrimination, the civil liberties group said.

“Sell 'em while they're young!” (and don't forget to tell them how hard it is to use Windows!)

http://thehill.com/policy/technology/221999-apple-unveils-plans-to-increase-school-tech

Apple unveils plans to increase school tech

… The tech giant has chosen 114 schools in 29 states to get grants as part of the Obama administration’s ConnectED effort, which seeks to connect 99 percent of the country’s students to high-speed broadband Internet.

“We believe that the young minds and young innovators of tomorrow should have every opportunity to realize their potential through today’s powerful learning tools,” Apple said in announcing its plans.

In the schools Apple will be targeting, 96 percent of students are eligible for free or reduced-price lunch, a common metric of poverty. Ninety-two percent of students in the schools are of a racial or ethnic minority.

“Despite their economic challenges, these schools share a vision of what their students’ lives would be like with Apple technology,” Apple said.

I think I'll start using this as my best example of something that will never happen. Politicians limiting the lies they can tell? You must be joking.

http://thehill.com/policy/technology/221946-gop-election-commissioner-warns-of-government-review-board-culling-the

Agency chief warns of 'regulatory regime' watching the Internet

Disclosure rules pushed by Democrats [Next week it's the Republican's turn Bob] could result in the creation of a government review board monitoring the Internet, the chairman of the Federal Election Commission (FEC) warned Monday.

… The FEC deadlocked last month on the question of whether there should be more stringent reporting requirements for political advertisements that are distributed only on the Internet.

I keep meaning to buy more cocoa... I don't remember why.

http://www.bespacific.com/clinical-trial-shows-cocoa-diet-reverses-age-related-memory-cognitive-decline/

Clinical Trial Shows Cocoa Diet Reverses Age-Related Memory And Cognitive Decline

Clinical Trial Shows Cocoa Diet Reverses Age-Related Memory And Cognitive Decline: 60 Year Old Cognition Reverted to 30-40 Year Old

“A new study and clinical trial by scientists at Columbia University Medical Center has shown that in healthy human adults, a diet of cocoa that is rich in flavanols is able to reverse the effects of age-related memory decline. Imaging reveals one region of the brain that is responsible for the improvement in cognition. The study is one of the first to show that dietary modification results in startling brain function improvement upon targeting of one specific brain region. Cognition tests reveal significant improvements in memory recall and reaction times, to the extent that performance of older people resembled that of younger.

… Previous studies have shown that age-related memory decline starts in early adulthood but has little impact on quality of life until the sixth and seventh decades.

Interesting. Would anyone notice if he (for example) changed the code to favor one political party over another? That would not break any laws, would it?

http://www.bespacific.com/facebook-changing-way-users-consume-journalism/

How Facebook Is Changing the Way Its Users Consume Journalism

NYT – Ravi Somaiya: “Many of the people who read this article will do so because Greg Marra, 26, a Facebook engineer, calculated that it was the kind of thing they might enjoy. Mr. Marra’s team designs the code that drives Facebook’s News Feed – the stream of updates, photographs, videos and stories that users see. He is also fast becoming one of the most influential people in the news business… About 30 percent of adults in the United States get their news on Facebook. Roughly once a week, he and his team of about 16 adjust the complex computer code that decides what to show a user when he or she first logs on to Facebook. The code is based on ‘thousands and thousands’ of metrics, Mr. Marra said, including what device a user is on, how many comments or likes a story has received and how long readers spend on an article.”

For my Intro to Computer Security students. Why wait for banks to issue the “Next Generation” of credit cards? Use the security of “Chip-enabled” cards to guarantee payment.

http://krebsonsecurity.com/2014/10/replay-attacks-spoof-chip-card-charges/

‘Replay’ Attacks Spoof Chip Card Charges

An odd new pattern of credit card fraud emanating from Brazil and targeting U.S. financial institutions could spell costly trouble for banks that are just beginning to issue customers more secure chip-based credit and debit cards.

Over the past week, at least three U.S. financial institutions reported receiving tens of thousands of dollars in fraudulent credit and debit card transactions coming from Brazil and hitting card accounts stolen in recent retail heists, principally cards compromised as part of the breach at Home Depot.

The most puzzling aspect of these unauthorized charges? They were all submitted through Visa and MasterCard‘s networks as chip-enabled transactions, even though the banks that issued the cards in question haven’t even yet begun sending customers chip-enabled cards.

The most frustrating aspect of these unauthorized charges? They’re far harder for the bank to dispute.

… However, banks are responsible for all of the fraud costs that occur from any fraudulent use of their customers’ chip-enabled credit/debit cards — even fraudulent charges disguised as these pseudo-chip transactions.

(Related) I can see how this could be used to suck cash from your bank account. (I can create my own QR code and tie it to my account in Brazil.) Since it comes through your phone, will you be liable?

http://www.makeuseof.com/tag/apple-pay-blow-facebook-plagiarism-tech-news-digest/

Dirty Tactics Thwart Mobile Payments

… Rite Aid and CVS have actively disabled NFC (near-field communication) card readers in their stores to prevent customers from using Apple Pay, Google Wallet, and other mobile payments platforms. It has to be assumed this is a bid to keep CurrentC from being surplus to requirements even before it launches in 2015.

CurrentC works differently from Apple Pay, with the customer scanning a QR code into their phone to have the payment taken directly from their bank account. This is designed to cut credit card companies (and their processing fees) out of the equation. Which is why no banks are backing CurrentC.

Also for my Computer Security students. This will be a big concern for most companies. The article suggests a couple of approaches, but consider what would work for you.

http://www.securityweek.com/what-employees-want-vs-what-it-wants-venn-diagram-doesnt-overlap

What Employees Want vs. What IT Wants - The Venn Diagram that Doesn't Overlap

… A large part of what employees want is the ability to do their jobs more efficiently. They want to be able to collaborate internally and externally, and share content. They want to use the devices they need to get their jobs done, and they want to work from Starbucks, from their kid’s soccer field practice and in a hotel room.

… IT, on the other hand is responsible and accountable for the availability and security of the business, and the easiest way to do that is to limit the avenues of risks. But, sometimes, this backfires. Locking down corporate mobile devices encourages employees to use their own mobile devices in search of productivity. Forcing users to access cloud services through a VPN defeats the agility of these services by making them slow and thus also encourages circumvention.

For my Ethical Hackers: This is not a replacement for Uber! (Strange that data on how the reprogramming equipment is used is not reported back to the manufacturer, like all other IoT devices.)

http://www.bbc.com/news/technology-29786320

Keyless cars 'increasingly targeted by thieves using computers'

Organised criminal gangs are increasingly targeting high-end cars with keyless security systems, a motoring industry group has warned.

The thieves are acquiring equipment intended only for legitimate mechanics, the Society of Motor Manufacturers and Traders (SMMT) said.

Manufacturers are trying to stay ahead of the thieves by updating software.

It has been reported that some London-based owners of Range Rovers have been denied insurance over the issue.

… "The challenge remains that the equipment being used to steal a vehicle in this way is legitimately used by workshops to carry out routine maintenance," a spokesman said.

"As part of the need for open access to technical information to enable a flourishing after-market, this equipment is available to independent technicians. However a minority of individuals are exploiting this to obtain the equipment to access vehicles fraudulently.

A challenge for my Computer Forensics students.

http://www.bbc.com/news/technology-29464889

Devices being remotely wiped in police custody

All the data on some of the tablets and phones seized as evidence is being wiped out, remotely, while they are in police custody, the BBC has learned.

Cambridgeshire, Derbyshire, Nottingham and Durham police all told BBC News handsets had been remotely "wiped".

And Dorset police said this had happened to six of the seized devices it had in custody, within one year.

The technology used was designed to allow owners to remove sensitive data from their phones if they are stolen.

"If a device has a signal, in theory it is possible to wipe it remotely," said Ken Munro, a digital forensics expert with Pen Test Partners.

This sounds a bit like a straight line, but it is clearly another “Big Data can make new businesses” story.

http://www.bespacific.com/big-data-dumpster-diving-new-ethics-waste-management/

Big Data, Dumpster Diving and the New Ethics of Waste Management

New York Times: “Rubicon, based in Atlanta, isn’t in the business of hauling waste. It doesn’t own a single truck or landfill. Rather, companies hire it as a kind of waste consultant. It begins by holding an online bidding process for its clients’ waste contracts, fostering competition among waste management businesses and bringing down their prices…. Though unscientific, Dumpster-diving remains the primary way that those in waste management analyze their customers’ trash. “It’s literally: Here’s paper, here’s a cup, here’s books, here’s e-waste,” explained Ms. Beason, who has spent 25 years rummaging around Dumpsters in various waste management jobs… Mr. Morris says he believes that the future of the trash business lies in data. And Rubicon collects all sorts of it: the value per ton and per cubic yard of various materials, in various regions; the volume of clients’ waste; how often that waste is removed; which haulers are servicing which locations for which clients, and so on. The data lives in Rubicon’s proprietary software platform, called Caesar. (Mr. Morris, a fan of the classics, sees in Julius Caesar’s irrevocable river crossing “a fantastic story of disruption.”) One of Rubicon’s most basic data applications is simply to determine whether a client can have its garbage picked up less often. Because haulers traditionally charge per visit, they have an incentive to empty Dumpsters even when they’re only half full. Rubicon sees emerging technologies as creating opportunities to reduce such inefficiencies. It is experimenting, for instance, with a sonar-equipped device that measures whether a Dumpster is full…. Even more grandly, Mr. Morris has said he would like all of his clients to divert 100 percent of their waste from landfills by 2022. Reaching such a goal would seem a threat to companies like Waste Management that are heavily invested in landfills. Yet Waste Management doesn’t appear to be worried about Rubicon, or to think a future without landfills is near.”

Not all of this is free.

http://www.bespacific.com/elsevier-adds-five-new-subject-areas-legacy-ebook-collection/

Elsevier Adds Five New Subject Areas to Legacy eBook Collection

News release: “Elsevier, a world-leading provider of scientific, technical and medical information products and services, today announced it added five new subject areas to its Legacy eBook Collection on ScienceDirect. The Legacy Collection consists of digitized, classic scholarly book content, now including nearly 13,000 books. The new subject areas are arts and humanities; computer science; economics, econometrics and finance; immunology and microbiology; and mathematics. In addition, there are newly digitized books in the engineering and the biochemistry, genetics, and molecular biology collections. The Legacy Collection includes books with contributions from notable authors like leading business management thinker Peter Drucker, and Nobel Laureates such as Lev Davidovich Landau, George Olah, Peter Diamond and Sir Frank McFarlane Burnet. For the first time, the books in the Elsevier’s Legacy Collection are also being made available to more than 70 third-party ebook distributors. Customers can purchase these revived titles through online retailers or through library ebook service providers.”

Ask, “Who benefits?” It's election time again here in the US too. Will we see the electronic version of “hanging chad?”

http://www.securityweek.com/hackers-target-ukraines-election-website

Hackers Target Ukraine's Election Website

Hackers attacked Ukraine's election commission website Saturday on the eve of parliamentary polls, officials said, but they denied Russian reports that the vote counting system itself had been put out of action.

… A report on Russia's state news agency RIA Novosti quoted a statement on the personal website of the Ukrainian prosecutor general saying that the electronic vote counting system was out of order and that Sunday's ballots would have to be counted by hand.

The commission spokesman, Kostyantyn Khivrenko, called the RIA Novosti report a "fake".

… In another possible sign of cyber tensions, the Ukrainska Pravda news website on Friday reported that outdoor video screens across Kiev were briefly hacked.

The screens, which are used for advertising, including pre-election political ads, reportedly started to display "scary and horrible images," the report said.

Engineers went out "to physically unplug" the screens, according to the report.

The report could not be confirmed, but footage on YouTube purporting to capture the incident showed a street screen abruptly switching to footage of destroyed buildings and dead bodies, as well as the images of two nationalist politicians running for parliament, with the words "war criminals".

Yet another reason to avoid PowerPoint.

http://dailygadgetry.com/security-flaw-powerpoint-allows-hackers-gain-control/4615

Security Flaw in PowerPoint Allows Hackers to Gain Control

A security flaw has been found in Microsofts’ PowerPoint after hackers exploited the service to gain control of computer systems.

A security advisor on Microsofts website stated that so far the attacks have been limited however, those who have been affected have lost control of their computers completely.

… For the hackers to have access, users have to open the corrupted file which is most often downloaded from the web. Currently, Microsoft are warning people to not download any Power point presentations at this time.

Can't wait to Google your house!

http://www.forbes.com/sites/aarontilley/2014/10/24/googles-nest-acquires-smart-home-hub-maker-revolv/

Google's Nest Acquires Smart Home Hub Startup Revolv To Control Every Device In Your Home

Nest, best known for its “learning thermostat,” has made another step into being the center of the smart home world. Today it announced it has acquired smart home hub startup Revolv.

… Colorado-based Revolv made a hardware hub with a bunch of radios packed inside to make all the various smart home devices talk to each other. Through the Revolv app, you could sync up smart home interactions.

“Nest bought a team of people knowledgable in the interoperability of a wide variety of radio technology and software protocols in order to make integration easier for partners and customers,” said Forrester analyst Frank Gillett.

… These new partnerships will do things like allow Nest to better know when family members are away from home with family app Life360 or control your thermostat from your Pebble watch.

Business opportunity! Drone swatters (repackaged flyswatters) This one has an umbilical cord, so it can't fly to Afghanistan and back, but should be fine for SWAT or special forces.

http://news.discovery.com/tech/gear-and-gadgets/new-drone-fits-in-your-pocket-flies-for-two-hours-141023.htm

New Drone Fits in Your Pocket, Flies for Two Hours

Anybody who's ever flown a rotary wing drone will look at the stats of CyPhy Works' new Pocket Flyer drone and be amazed. It fits in your pocket and weights a mere 80 grams. It'll fly continuously for two hours or more, sending back high quality HD video the entire time. What's the catch? There isn't one, except for the clever thing that grants all of CyPhy's UAVs their special powers: a microfilament tether that unspools the drone and keeps it constantly connected to communications and power.

For my student game addicts...

http://www.makeuseof.com/tag/waste-life-playing-games-pong-weird-wonderful-web/

Waste Away Your Life Playing All The Games On Pong.com

… Pong.com wants to be the new home of browser-based games, those free Flash games which are currently spread across the Web without any sense of order or meaning. Pong acts as a Pinterest-like platform, with users invited to create boards and add games from around the Web to these categorized collections.

Anyone can play the games posted to Pong, without any need to sign up for an account. These passing visitors can simply click on the game they want to play and, assuming they have Adobe Flash Player installed, they can play away to their heart’s content.