Every technology that believes it is “new” thinks first about “selling features.” Why no one considers security a selling feature is beyond me. “Always bet on ignorance and intellectual laziness!”

http://www.bankinfosecurity.com/vtech-breach-so-bad-so-avoidable-a-8721

Why VTech Breach is So Bad - and So Avoidable

The data breach involving Hong Kong toymaker VTech highlights a growing concern over manufacturers selling many more devices that are Internet-connected, yet apparently failing to safeguard those devices – and related information that gets collected and stored – against even the most rudimentary types of online attacks

… The apparent severity of the breach at VTech, which reported an annual revenue of $1.9 billion earlier this year, has continued to increase since the company first confirmed Nov. 27 that it had been breached, with the latest count of breach victims hitting 11.2 million people. In its most recent breach notification, released Dec. 2, the company says that on Nov. 14, "an unauthorized party accessed VTech customer data" connected with the databases and servers behind these services:

… Hong Kong's privacy commissioner, as well as attorneys general in multiple U.S. states, have said they are probing the breach.

(Related) Those who do not study history security best practices are doomed to repeat it.

http://www.forbes.com/sites/thomasbrewster/2015/12/02/vtech-innotab-tablet-easy-to-steal-kids-data/

More Trouble For VTech -- Kids Tablet Is 'Easy' To Hack

VTech is having a quite abysmal week following a hack that exposed data on 6.4 million children and 4.8 million adults. Not only has its stock price dipped to a year low, security researchers have found two glaring vulnerabilities in its InnoTab Max tablet for kids, and it is refusing to answer questions on whether it even has a security team.

Ken Munro, who heads up consultancy Pen Test Partners, discovered the issues with the InnoTab within a day. It was simple to find the flaw because it’s been known for more than two years.

… There have been numerous signs VTech hasn’t paid enough attention to security. First, the hack itself, according to a Vice Motherboard report, was perpetrated with an age-old technique – SQL injection – that firms should be prepared for. It was storing most data, including children’s images and chat messages with parents, in unencrypted fashion. Its website was not protected with SSL web encryption. And its Android application used by parents to chat with their children was said to be vulnerable.

The continuing joy of data breaches.

http://www.reuters.com/article/2015/12/03/us-target-breach-settlement-idUSKBN0TL20Y20151203

Target in $39.4 million settlement with banks over data breach

Target Corp has agreed to pay $39.4 million to resolve claims by banks and credit unions that said they lost money because of the retailer's late 2013 data breach.

The settlement filed on Wednesday resolves class-action claims by lenders seeking to hold Target responsible for their costs to reimburse fraudulent charges and issue new credit and debit cards.

… Target reached a similar accord with MasterCard in April, but it was rejected the next month when card issuers deemed the sum too low.

… Earlier this year, Target agreed to pay Visa Inc card issuers as much as $67 million over the breach and reached a $10 million settlement with shoppers. The latter accord won court approval last month.

Last week, Target said it had spent $290 million related to the breach, and expected insurers to reimburse $90 million. It still faces shareholder lawsuits, as well as probes by the Federal Trade Commission and state attorneys general, over the breach.

Almost exactly what my Computer Security students concluded would happen. Perhaps this is easier than giving their hackers a bad performance review?

Chinese government has arrested hackers it says breached OPM database

If I knew emojis, I’d include one for “highly skeptical” to accompany this story. Ellen Nakashima reports:

The Chinese government recently arrested a handful of hackers it says were connected to the breach of Office of Personnel Management’s database earlier this year, a mammoth break-in that exposed the records of more than 22 million current and former federal employees.

The arrests took place shortly before a state visit in late September by President Xi Jinping, and U.S. officials say they appear to have been carried out in an effort to lessen tensions with Washington.

The identities of the suspects — and whether they have any connection to the Chinese government — remain unclear.

Read more on Washington Post.

For my Forensics students.

11th Circuit deepens the circuit split on applying the private search doctrine to computers

Orin Kerr writes:

On Tuesday, the 11th Circuit handed down a new computer search decision, United States v. Johnson, that both sharpens and deepens the circuit split on how the private search doctrine of the Fourth Amendment applies to computers. Johnson isn’t a likely candidate for Supreme Court review. But it does leave the private search doctrine in computer searches ripe for Supreme Court review in other cases working their way through the courts.

Read more on The Volokh Conspiracy.

[From the article:

Because the Fourth Amendment applies only to the government and its agents, the Fourth Amendment is not triggered when private parties not associated with the government conduct searches. When a private party conducts a search and finds evidence of crime, the private party often goes to the police and voluntarily shows the police what she has found. The Supreme Court uses what I have called the “private-search reconstruction” doctrine to regulate what the police are allowed to see without a warrant. The police can reconstruct the private party search, seeing what the private party saw, but they can’t exceed the search the private party conducted.

On to the important legal question: When a private party searches a computer, sees a suspicious file and reports the finding to the police, what kind of government search of the computer counts as merely reconstructing the private search and what kind of search counts as exceeding the private search?

… In 2005, the 5th Circuit ruled that the entire computer was searched. In 2012, the 7th Circuit agreed with the 5th Circuit that the entire computer was searched. In May, the 6th Circuit handed down a ruling concluding that the unit should be data or the file, so that government observation of anything not actually viewed by the private party exceeds the scope of the private search.

The new case, Johnson, also adopts the data or file approach — thus deepening the 2-1 split into a 2-2 split.

I doubt this is what Belgium had in mind.

http://www.computerworld.com/article/3011665/data-privacy/facebook-will-block-belgians-without-accounts-from-access-to-its-content.html

Facebook will block Belgians without accounts from access to its content

Facebook has outlined its plans to follow a court ruling in Belgium requiring it not to track people who do not have accounts on the social networking website.

The company said it was giving the details ahead of the order being served on it by the Belgian Privacy Commission, which is expected later this week.

Among the steps Facebook plans to take is to require people without Facebook accounts in Belgium to create accounts and log in to the social networking website before they can see its publicly available pages and other content, the company said.

"Today, anyone can see Facebook pages for small businesses, sports teams, celebrities and tourist attractions without logging into Facebook—typically found using a search engine," a Facebook spokesman said in an email.

… The dispute largely hinges around Facebook's use of a special cookie called 'datr' that it claims helps it distinguish between legitimate and illegitimate visits to its website, and identifies browsers and not individuals. Facebook claims that by using the security cookie it protected Belgian people from more than 33,000 takeover attempts in the past month.

I think they have a point! (Do we need a division of marketers?)

http://knowledge.wharton.upenn.edu/article/the-soft-power-war-isis-doesnt-want/ .

The ‘Soft Power’ War ISIS Doesn’t Want

For too long, ISIS’ digital influence in social media has gone largely unchecked. We have failed to match their commitment to content, imagery, emotion and reach. (President Obama describes them as “killers with good social media” who recruit in “far flung” places.) In the wake of the Paris attacks and our response, ISIS has “upped” their online game of intimidation and terror.

… In the first 24 hours following the attacks on Paris, there were hundreds of thousands of celebratory tweets from supporters of ISIS. An estimated 50,000 Twitter accounts — each having thousands of followers — streamed photo essays, audio, video, news bulletins and theological writings.

Remarkably, there was no organized response from the West or majority of Muslim countries.

If you don't want to do something, don't say you will!

Court: Cox Willingly Failed to Disconnect Pirating Subscribers

… Internet provider Cox Communications is facing a lawsuit from BMG Rights Management which accuses the ISP of failing to terminate the accounts of subscribers who frequently pirate content.

BMG claimed that Cox gave up its DMCA safe harbor protections due to this inaction, something District Court Judge Liam O’Grady agreed on last week in a summary judgment.

… “The record conclusively establishes that before the fall of 2012 Cox did not implement its repeat infringer policy. Instead, Cox publicly purported to comply with its policy, while privately disparaging and intentionally circumventing the DMCA’s requirements,” the memorandum (pdf) reads.

Let the debate begin!

http://hothardware.com/news/google-calls-out-eff-for-suggesting-that-it-snoops-on-students-via-chromebooks?google_editors_picks=true

Google Calls Out EFF Over Bogus Claims That It Snoops On Students With Its Chromebooks

… "EFF bases this petition on evidence that Google is engaged in collecting, maintaining, using, and sharing student personal information in violation of the 'K-12 School Service Provider Pledge to Safeguard Student Privacy' (Student Privacy Pledge), of which it is a signatory,” alleged the EFF in its initial FTC complaint.

Google takes such allegations very seriously, and has thus responded to every claim brought forth by the EFF. “While we appreciate the EFF’s focus on student data privacy, we are confident that our tools comply with both the law and our promises, including the Student Privacy Pledge, which we signed earlier this year,” said Jonathan Rochelle, the Director of Google Apps for Education.

With respect to Google Apps for Education Core Services (GAFE), Rochelle asserts that all student data stored is “only used to provide the services themselves” and that student data isn’t used for advertising purposes, nor are ads served to students.

For my students. See, It's not just the big guys. Use it just to annoy the FBI director?

http://www.computerworld.com/article/3011659/security/encrypted-messaging-app-signal-now-available-for-desktops.html

Encrypted messaging app Signal now available for desktops

The much-lauded encryption app Signal has launched a beta program for a desktop version of the app, which will run through Google's Chrome browser.

Signal Desktop is Chrome app that will sync messages transmitted between it and an Android device, wrote Moxie Marlinspike, a cryptography expert who had helped develop Signal, in a blog post on Wednesday.

… Signal Desktop won't be able to sync messages with iPhone just yet, although there are plans for iOS compatibility, Marlinspike wrote. It also won't support voice initially.

Signal, which is free, has stood out in a crowded field of encrypted messaging applications, which are notoriously difficult to engineer, and has been endorsed by none other than former U.S. National Security Agency contractor Edward Snowden. [Paid endorsement? Bob]

… Open Whisper Systems itself can't see the plain text of messages or get access to phone calls since it doesn't store the encryption keys.

Signal is open source, which allows developers to closely inspect its code.

Local news.

Uber Launches Insane "Pay-to-Work" Car Rental Program 

Uber is partnering with Enterprise Rent-A-Car, and—as the slogan goes—they’ll pick you up! By “they” I mean the poor schmucks who sign up to pay around $1000 a month to work for Uber.

The pilot program, which launched in Denver, gives people access to a discounted rental car at $210 a week, plus taxes and fees.

… In addition to the base payments, drivers will have to pay a $500 refundable deposit and a $40 sign-up fee. If they go over 2800 miles a month (90 miles a day) there’s also an additional $0.25 per mile fee tacked on.

Perspective.

http://techcrunch.com/2015/12/01/amazon-dominated-36-of-online-black-friday-sales-says-slice/

Amazon Dominated 36% of Online Black Friday Sales, Says Slice

Slice Intelligence, which gathers e-commerce data from receipts linked to its Slice package tracking app, tells TechCrunch that Amazon dominated online Black Friday sales, accounting for 35.7 percent in e-commerce spending on November 27. A distant second, Best Buy brought in 8.23 percent of total online revenue, followed by Macy’s at 3.38 percent, Walmart at 3.35 percent and Nordstrom at 3.11 percent.

For my students… Please.

http://www.makeuseof.com/tag/quickly-improve-handwriting-fantastic-resources/

Quickly Improve Your Handwriting with These Fantastic Resources

Another breach where the numbers have grown far beyond the initial estimate guess. My initial post on Nov. 28 quoted, “nearly 5 million parents and more than 200,000 children.”

http://www.bbc.com/news/technology-34980655

6.4m kids - Vtech hack in numbers

Children's toy company Vtech announced it was hacked last week - with millions of children's accounts accessed.

The stolen data includes names and addresses, as well as, reportedly, pictures and chat logs.

Vtech they are still investigating the full extent of the hack.

On Tuesday, the company shared more information about the breach.

It admitted: "Our database was not as secure as it should have been."

Here's what we now know:

6,368,509 children's accounts affected

4,854,209 parental accounts accessed

Countries most affected:

- USA (2,894,091 children)

- France (1,173,497)

- UK (727,155)

In total, 16 "countries" are affected - Vtech lists Latin America as a single country, so the actual number is unclear.

If someone is pretending to be China, should we expect the Chinese to track them down and stomp on them? Would the US do that?

China Accused Of ‘Massive’ Hack Into AU’s Bureau Of Meteorology

Chris Uhlmann reports:

China is being blamed for a major cyber attack on the computers at the Bureau of Meteorology, which has compromised sensitive systems across the Federal Government.

Multiple official sources have confirmed the recent attack, and the ABC has been told it will cost millions of dollars to plug the security breach, as other agencies have also been affected.

The bureau owns one of Australia’s largest supercomputers and provides critical information to a host of agencies.

China denies any involvement in the attack:

“As we have reiterated on many occasions, the Chinese government is opposed to all forms of cyber attacks,” Chinese foreign ministry spokeswoman Hua Chunying said.

Read more on ABC (AU).

(Related) Something for my Computer Security students to ponder.

http://www.securityweek.com/chased-dragon-containment-new-detection

Chased by the Dragon: Containment is the New Detection

... Visiongain estimates today’s cybersecurity market to be worth $75B worldwide and Gartner estimates it will grow to $100B+ by 2018, a CAGR of roughly 10 percent. Contrast that with overall IT spending, which is crawling along with an annual growth rate in the low single digits.

… Perhaps the singular focus on detecting cyber incursions is not the answer.

Perhaps a coequal focus on containing attacks after they occur is equally as important.

If we have learned one thing in the past few years, relying exclusively on detection technologies such as IDS and APT will cause significant problems. We must also look at how attacks spread laterally and remain active over extended periods of time, especially in data center and cloud environments. It is now time to prioritize visibility and containment, augmenting the priority of looking for suspicious and anomalous communications to the attack surface.

… A recent SANS Institute survey, The State of Dynamic Data Center and Cloud Security in the Modern Enterprise Survey and Research Report, underscores that most IT professionals are unhappy with the level of visibility and containment provided by the traditional tools they use to monitor traffic between data centers and internal or external clouds. Nowhere is this more evident than in the time these technologies take to stop and contain breaches: fewer than 50% of breaches are detected and contained within 24 hours.

It is hard to explain technology to juries, particularly when lawyers try to do it.

Confusion Abounds in Supreme Court Arguments in Mussachio

Molly Willms reports on a case before the U.S. Supreme Court that touches on “exceeding authorized access” under CFAA:

The confusion that plagued a jury in a computer hacking trial has followed the case all the way to the U.S. Supreme Court, where hypotheticals and technical questions abounded during oral argument Monday.

Michael Musacchio was convicted in May 2013 of one felony count of conspiracy to make unauthorized access to a protected computer and two felony counts of hacking. He was sentenced to 63 months in prison.

[…]

The jury in Musacchio’s case received the erroneous instruction that it had to find proof that he had accessed a private computer without authorization and exceeded his authorized access, according to the Fifth Circuit ruling. The jury found him guilty on all three counts, after which he claimed that the government failed to prove both elements of the charge as it was explained to the jury.

Read more on Courthouse News. The transcript of yesterday’s oral argument can be found here (pdf).

As if Greece didn't have enough problems.

Armada Collective threatens Greek banks with DDoS if they don’t pay $7.2M ransom

Ashley Carman reports:

Three unnamed Greek banks are the most recent victims of an extortion campaign in which a hacker group is attempting to fully take down their websites. The group, calling itself the Armada Collective, apparently made its first demand on Thursday of last week, at which point it also launched the first of its distributed denial-of-service (DDoS) attacks. Those attacks succeeded in disrupting transactions at every bank, the Financial Times reported. DDoS attacks overload websites’ servers in an effort to take them fully offline, and the Armada Collective has a set price to stop its efforts: each bank must pay 20,000 Bitcoin, or $7,208,200. The financial institutions aren’t bending under pressure, however, and are instead strengthening their DDoS defenses. Greece’s central bank and its police electronic crime unit are also monitoring the banks’ computer systems.

Read more on The Verge.

Something for my Computer Security students to debate. I include this because I don't agree with all of his points.

http://www.bespacific.com/the-moral-character-of-cryptographic-work/

The Moral Character of Cryptographic Work

by Sabrina I. Pacifici on Dec 1, 2015

The Moral Character of Cryptographic Work, Phillip Rogaway, Department of Computer Science, University of California, Davis, USA. December 1, 2015

“Cryptography rearranges power: it con figures who can do what, from what. This makes cryptography an inherently political tool, and it confers on the field an intrinsically moral dimension. The Snowden revelations motivate a reassessment of the political and moral positioning of cryptography. They lead one to ask if our inability to effectively address mass surveillance constitutes a failure of our field. I believe that it does. I call for a community-wide effort to develop more effective means to resist mass surveillance. I plea for a reinvention of our disciplinary culture to attend not only to puzzles and math, but, also, to the societal implications of our work.”

Advanced research on potential Ad targets?

https://www.eff.org/press/releases/google-deceptively-tracks-students-internet-browsing-eff-says-complaint-federal-trade

Google Deceptively Tracks Students’ Internet Browsing, EFF Says in FTC Complaint

San Francisco—The Electronic Frontier Foundation (EFF) filed a complaint today with the Federal Trade Commission (FTC) against Google for collecting and data mining school children’s personal information, including their Internet searches—a practice EFF uncovered while researching its “Spying on Students” campaign, which launched today.

… Google’s practices fly in the face of commitments made when it signed the Student Privacy Pledge, a legally enforceable document whereby companies promise to refrain from collecting, using, or sharing students’ personal information except when needed for legitimate educational purposes or if parents provide permission.

Would it be worth creating a false phone “trail?” Probably not. But automating the process will reduce cost.

http://www.wsj.com/article_email/lending-startups-look-at-borrowers-phone-usage-to-assess-creditworthiness-1448933308-lMyQjAxMTE1MjAzMTgwMTExWj

Lending Startups Look at Borrowers’ Phone Usage to Assess Creditworthiness

A handful of Silicon Valley-backed startups are looking to revolutionize lending in the developing world, where banks are scarce and many would-be borrowers have no credit history.

Their strategy: Show me your smartphone, and my app will find out how creditworthy you are.

Smartphones can dramatically reduce the cost of lending, experts say, because the apps they run generate huge amounts of data—texts, emails, GPS coordinates, social-media posts, retail receipts, and so on—indicating thousands of subtle patterns of behavior that correlate with repayment or default.

… The loans average $30, enough for a taxi driver to pay for gas or a fruit seller to stock up on produce. Branch charges between 6% and 12% interest—based on the borrower’s creditworthiness—and loans are usually repaid between three weeks and six months later.

We're thinking of a 3D printer class. Could be fun!

http://blogs.gartner.com/pete-basiliere/2015/12/02/gartner-predicts-2016-3d-printing-disrupts-healthcare-and-manufacturing/

Gartner Predicts 2016: 3D Printing Disrupts Healthcare and Manufacturing

Strategic Planning Assumption: By 2019, 10% of people in the developed world will be living with 3D-printed items that are on or in their bodies.

Strategic Planning Assumption: By 2019, 3D printing will be a critical tool in over 35% of surgical procedures requiring prosthetic and implant devices (including synthetic organs) placed inside and around the body.

Strategic Planning Assumption: By 2019, technological and material innovation will result in 10% of counterfeit drugs and pharmaceuticals being produced with 3D printers.

Strategic Planning Assumption: By 2019, 10% of all discrete manufacturers will be using 3D printers to produce parts for the products they sell or service.

Are you ready for any of these? Infographic.

http://www.makeuseof.com/tag/have-the-coolest-home-on-the-block-with-these-gadgets/

Have The Coolest Home On The Block With These Gadgets

A number of interesting graphs to share with my Statistics students. I really like the “CORRELATION vs. CAUSATION” graph. Might be fun to try a few myself.

http://fivethirtyeight.com/features/our-favorite-examples-of-how-the-internet-talks-on-reddit/

Our Favorite Examples Of How The Internet Talks

About two weeks ago, we published our Reddit Ngram interactive — a tool that lets you search for any term to see how frequently it has been used in Reddit comments since late 2007. And readers (plus a few FiveThirtyEighters) have been sharing some interesting findings, especially on Twitter and, of course, Reddit. Below are some of our favorites so far.

Perspective.

http://thehill.com/policy/technology/261657-cellphone-only-homes-become-the-norm-cdc-survey-finds

Cellphone-only homes becoming the norm, CDC finds

New statistics from the Centers for Disease Control and Prevention (CDC) released Tuesday found 47 percent of homes only use cellphones and do not have a landline phone.

That is about 5 percentage points higher than homes that use both wireless and landline phones, which still represent 41 percent of households.

… Pollsters are most likely to see wireless-only homes among individuals aged 24-34, where 68 percent to 71 percent only use cellphones. About 85 percent of adults living with nonrelated roommates live in a cellphone-only house. Renters are also far more likely than homeowners to only use cellphones.

The CDC has asked the telephone question since 2003 to help it along with health-related survey research.

For all my students, Computer Security in particular.

http://www.makeuseof.com/tag/5-best-free-internet-security-suites-windows/

5 Best Free Internet Security Suites for Windows

As a Windows user, you have three possible paths when it comes to system security: use the built-in Windows Defender, install third-party security software, or ignore security altogether (the last option isn’t possible on Home versions of Windows 10). The path you take is crucial.

In our piece on important facts about Windows Defender, we noted that Windows Defender is good enough for most users — but do you really want to settle for “good enough” when your security is at stake? Seems like an unnecessary risk to take…

So here are five of the best free security suites for Windows, all of which offer anti-virus, anti-malware, and real-time protection features. Some of these lack firewall functionality, but you can always supplement with a free third-party Windows firewall.

Something for all of our business students. (Remember to “tip: your professor with 1% of your founders stock.)

http://www.makeuseof.com/tag/free-ebook-startup-best-practices-from-15-serial-entrepreneurs/

Free eBook: ‘Startup Best Practices from 15 Serial Entrepreneurs’

… Today, we have a free eBook called “Startup Best Practices from 15 Serial Entrepreneurs” that will teach you about starting a business from the past experiences of the people who have seen it all.

… To redeem your copy and download the free eBook, just head over to this page and sign up for a free account. The process will take just a few seconds, and then you will be sent an email with a link to download a free copy.

Handy for my niece who is doing a semester abroad in Chile.

http://www.makeuseof.com/tag/how-to-make-free-calls-to-any-u-s-number-from-anywhere/

How to Make Free Calls to Any U.S. Number From Anywhere

urn to Google Voice. Whether you’re in Brazil or Ireland, all you need is an account in order to make free calls to the United States and Canada. The most common method is to call through the PC app, but calls can also be made with both the Google Voice and Google Hangouts apps on Android.

As of now, Google calls are limited to 3 hours in duration, but there aren’t any restrictions on how many times you can redial the same number.

… You can try these free apps for calling to the U.S. as well.

Another tool for students.

http://www.freetech4teachers.com/2015/12/grammarflip-online-grammar-lessons-for.html

GrammarFlip - Online Grammar Lessons for Students

GrammarFlip is a free service that offers an extensive set of grammar lessons. The basic format of the lessons in GrammarFlip is a video and slideshow followed by a couple of review exercises. The content of the video is based on the slideshow. The video in the lesson is essentially a narration of the slides. The review exercises in GrammarFlip lessons are a mix of multiple choice questions and fill-in-the-blank questions.

Teachers can register on GrammarFlip and create online classrooms. Once you have created a classroom on GrammarFlip students can join it by entering an access code that you assign to the room. Within your GrammarFlip classroom you can distribute lessons and track your students' progress on the lessons that you have assigned to them.

For my next batch of IT Governance students,

http://knowledge.wharton.upenn.edu/article/corporate-governance-in-the-age-of-cyber-risks/

Corporate Governance in the Age of Cyber Risks

Handy!

http://www.makeuseof.com/tag/how-to-quickly-find-your-lost-mouse-cursor-on-every-os/

How to Quickly Find Your Lost Mouse Cursor on Every OS

… For Windows users: Search for Mouse in the Start menu, and switch to the Pointer Options tab. At the bottom, check the box for Show the location of the pointer when I press the Ctrl key. Now, anytime you can’t find your cursor, just tap either Ctrl key and a ring will pulse around your cursor to help you find it.

Doesn't sound so good now, does it?

VTech hack included children’s pictures and chat logs

Lorenzo Franceshi-Bicchierai has a follow-up to his early report on VTECH:

Over the weekend, the hacker, who asked to remain anonymous, told me that VTech left other sensitive data exposed on its servers, including kids’ photos and chat logs between children and parents. This data is from the company’s Kid Connect, a service that allows parents using a smartphone app to chat with their kids using a VTech tablet. In online tutorials, the company encourages parents and kids to take headshots and use them in their apps.

Read more on Motherboard.

The VTech hack is getting a lot of mainstream media attention, and understandably so, as it’s a cautionary tale. But keep in mind that so far, it doesn’t sound like this hacker has any intention of misusing the data. If s/he did, it would have been put up for sale and not helpfully disclosed to Motherboard. It sounds like the hacker wants to make a point about security. Yes, it’s still a crime, and everyone – company and parents – need to be more cautious going forward, but it’s not clear what the real and imminent risk is from this particular hack.

Yet another follow-up. How can you manage what you don't know exists?

http://www.theatlantic.com/technology/archive/2015/11/opm-just-figured-out-how-much-data-it-owns/417669/

OPM Just Now Figured Out How Much Data It Owns

... According to its inspector general, at the time of the breaches, OPM did not have a complete inventory of the servers, databases, and network devices that it owns, maintains, and operates. Not having the inventory “drastically diminishe[d] the effectiveness of its security controls,” wrote Michael Esser, the agency’s assistant inspector general for audits, in an oversight report published this month.

“Failure to maintain an accurate IT inventory undermines all attempts at securing OPM’s information systems,” the report read.

… The high-profile data breaches have kept OPM in the news, but it’s far from the only government agency that has fallen short of basic IT standards.

A recent report compiled by the House Oversight Committee graded federal agencies on their implementation of a key federal IT law. The majority of agencies—including OPM—received a D grade. Three agencies received an F: the Department of Education, the Department of Energy, and NASA. No agency received an A.

This week, my Computer Security students are discussing encryption.

http://www.securityweek.com/blackberry-exits-pakistan-over-backdoor-request

BlackBerry Exits Pakistan Over Backdoor Request

The Canadian smartphone maker revealed that the Pakistani government was looking for means to monitor all BlackBerry Enterprise Service traffic in the country. However, as BlackBerry refused to comply with this demand, the government decided to prohibit BlackBerry’s BES servers from operating in Pakistan starting in December.

Definitely one for my Computer Security students to discuss.

http://www.techtimes.com/articles/112076/20151201/target-website-s-near-cyber-monday-crash-in-ironic-twist-customers-forced-to-wait-on-line.htm

Target Website’s Near Cyber Monday Crash: In Ironic Twist, Customers Forced To Wait On Line

The website for Target, one of the largest retailers in the U.S., almost crashed on Cyber Monday, due to a huge number of bargain hunters attempting to access the site simultaneously. To manage the deluge, the store set up a queue reminiscent of in-store Black Friday lines, in which Web customers were required to wait behind others who were already shopping.

… By just midday, according to the company, traffic on the site had already doubled that of the formerly most busy day in Target website history.

Another article for my Computer Security students.

http://fusion.net/story/238742/tor-carnegie-mellon-attack/

The attack that broke the Dark Web—and how Tor plans to fix it

Backup. Backup. Backup.

http://hothardware.com/news/british-man-blames-apple-for-erasing-his-iphones-data-files-7500-lawsuit?google_editors_picks=true

British Man Blames Apple For Erasing His iPhone’s Data, Wins $3,000 In Lawsuit

… it appears that at least one British man didn’t use enough caution when he took his malfunctioning iPhone in to be serviced at a local Apple Store. Deric White claims the Apple Geniuses never asked him if he had backed up his iPhone 5, and took it upon themselves to reset the iPhone, wiping out all of its data in the process, in order to solve his issues.

“It was only after staff fiddled around they asked if I’d backed my things up,” said White, who was obviously distraught over the fact that he lost 15 years worth of contacts and countless photos with sentimental value.

… The judge said that Apple had acted negligently in erasing the data from Mr. White’s phone while performing a reset.

… If Mr. White had an iCloud account, he would have been able to easily restore his data (including contact information and photos). But in this case, he didn’t even setup an iCloud account, stating that he “[didn’t] like the databank in the sky.” Likewise, an iTunes backup would have made for an even quicker way to restore his iPhone 5 to its previous state before he visited the Apple Store. This method of backing up data also eluded Mr. White.

The overreaction to 9/11 continues.

http://www.zdnet.com/article/fbi-can-force-companies-to-turn-over-user-data-without-a-warrant/

Revealed: FBI can demand web history, phone location data without a warrant

The FBI can compel companies and individuals to turn over vast sums of personal data without a warrant, it has been revealed for the first time.

In a case that's lasted more than a decade, a court filing released Monday showed how the FBI used secret interpretations to determine the scope of national security letters (NSLs).

Nicholas Merrill, founder of internet provider Calyx Internet Access, who brought the 11-year-old case to court after his company was served a national security letter, won the case earlier this year.

National security letters are almost always bundled with a gag order, preventing Merrill from speaking freely about the letter he received.

… In a statement on Monday, Merrill revealed the FBI has used its authority to force companies and individuals to turn over complete web browsing history; the IP addresses of everyone a person has corresponded with; online purchase information, and also cell-site location information, which he said can be used to turn a person's phone into a "location tracking device."

According to a release, the FBI can also force a company to release postal addresses, email addresses, and "any other information which [is] considered to be an electronic communication transactional record."

Merrill said in remarks: "The FBI has interpreted its NSL authority to encompass the websites we read, the web searches we conduct, the people we contact, and the places we go. This kind of data reveals the most intimate details of our lives, including our political activities, religious affiliations, private relationships, and even our private thoughts and beliefs."

… Merrill is the first person who has succeeded in completely lifting a national security letter gag order.

Yes, it's a big deal. Now all they need do is get others to use the yuan.

http://in.reuters.com/article/2015/12/01/us-imf-china-yuan-idINKBN0TK44G20151201

China needs more users for 'freely usable' yuan after IMF nod

The International Monetary Fund's decision to add China's yuan to its reserves basket is a triumph for Beijing, but the fund's verdict that the currency met its "freely usable" test will have little financial impact unless Beijing recruits more users.

The desire of Chinese reformers to internationalize the currency has a clear economic rationale; a yuan in wide circulation overseas would reduce China's dependence on the dollar system and on policy set in Washington.

It would also make it easier for Chinese firms to invoice and borrow offshore in yuan, reducing the risk of exchange rate fluctuations and prompting China's inefficient state-owned banks to improve their performance or lose business.

Those concerned about a potential global liquidity crisis caused by overdependence on the United States might also welcome the yuan as an alternative to the dollar, as would countries locked out of dollar capital markets by sanctions.

Perspective.

http://techcrunch.com/2015/11/30/itu-3-2b-people-now-online-globally-mobile-broadband-overtakes-home-internet-use/

ITU: 3.2B People Now Online Globally, Mobile Broadband Overtakes Home Internet Use

… according to International Telecommunication Union, which today published its annual global survey

Perspective. “Out, out damned driver! Out, I say!” (If Lady MacBeth was a programmer)

http://www.theatlantic.com/technology/archive/2015/12/driverless-cars-are-this-centurys-space-race/417672/

The High-Stakes Race to Rid the World of Human Drivers

Perspective. Remember, this is not an Internet First company, like Amazon.

http://www.rttnews.com/2586239/walmart-nearly-half-of-orders-since-thanksgiving-placed-on-mobile-device.aspx?google_editors_picks=true

Walmart: Nearly Half Of Orders Since Thanksgiving Placed On Mobile Device

… Mobile is making up more than 70 percent of traffic to Walmart.com, and now, nearly half of our orders since Thanksgiving have been placed on a mobile device - that's double compared to last year."

Hummm.

http://www.bespacific.com/want-to-obtain-fbi-records-a-little-quicker-try-new-efoia-system/

Want to Obtain FBI Records a Little Quicker? Try New eFOIA System

by Sabrina I. Pacifici on Nov 30, 2015

“The FBI recently began open beta testing of eFOIA, a system that puts Freedom of Information Act (FOIA) requests into a medium more familiar to an ever-increasing segment of the population. This new system allows the public to make online FOIA requests for FBI records and receive the results from a website where they have immediate access to view and download the released information. Previously, FOIA requests have only been made through regular mail, fax, or e-mail, and all responsive material was sent to the requester through regular mail either in paper or disc format. “The eFOIA system,” says David Hardy, chief of the FBI’s Record/Information Dissemination Section, “is for a new generation that’s not paper-based.” Hardy also notes that the new process should increase FBI efficiency and decrease administrative costs. The eFOIA system continues in an open beta format to optimize the process for requesters. The Bureau encourages requesters to try eFOIA and to e-mail foipaquestions@ic.fbi.gov with any questions or difficulties encountered while using it. In several months, the FBI plans to move eFOIA into full production mode.”

An article to leave on my wife's chair… Hint, hint babe.

http://www.bloomberg.com/news/articles/2015-11-27/tavour-a-delivery-service-for-beer-geeks?cmpid=google&google_editors_picks=true

A New Delivery Service Gives Beer Geeks Their Monthly Fix

… Customers reply to the daily e-mails if they want the beers on offer, and Tavour stockpiles the orders for a monthly delivery. Recent prices range from $2.50 to $20 a beer. Regardless of how many it’s sending you, the company charges $15 shipping to any of the seven states it covers so far: Arizona, California, Colorado, New Mexico, Ohio, Oregon, and Washington.

Storage, for my Math students.

http://www.infostor.com/storage-management/storage-enters-the-age-of-erasure-coding-1.html?google_editors_picks=true

Storage Enters the Age of Erasure Coding

Its appeals are obvious: it's a data protection system that's more space efficient than straight replication, and one which tolerates more faults and allows you to recover lost data far more quickly than is possible with traditional RAID systems.

Here are just a few examples of storage offerings that are getting serious about the technology: Intel and Cloudera are developing erasure coding in HDFS for release in Hadoop 3.0, and Nutanix has begun showing off its own proprietary erasure coding called EC-X in the current versions of its Nutanix OS in preparation for its launch in NOS 5. Ceph, the open source software storage platform, introduced erasure coding last year with the Firefly (v0.80) release, and erasure coding is at the heart of Cleversafe's dispersed storage systems. (Earlier this month IBM announced that it had acquired Cleversafe for an undisclosed sum.)

How Erasure Coding Works

Erasure coding works by splitting a file in to a number of equally sized pieces, and then doing some fancy mathematics [Not so fancy… Bob] encoding to produce a larger number of pieces. For example, you could start with a single file, split it in to 6 pieces, and then do the encoding to produce 10 pieces.

What's clever about the encoding is that you would only need 6 of the 10 encoded pieces to get back to the original file – you can lose any four and without resulting in any data loss.

To get an idea of how EC works, let's look at a very simple example where you split a file into 2 pieces, and then encode those in to 4 encoded pieces.

So we start with a single file, split it into 2 pieces which we'll call P1 and P2, and then encode those into 4 encoded pieces EP1, EP2, EP3 and EP4

So what happens if two if these encoded pieces, EP2 and EP4 are lost?

We are left with EP1 and EP3, and we know that EP1 is identical to P1, and EP3 is simply P1 +P2. So with a little mathematical equation solving it is possible to get the original file back from just these two encoded pieces.

That's the principal. In fact erasure coding is more complex than that. A common form of erasure coding is called Reed-Solomon (RS) erasure coding, invented in 1960 at MIT Lincoln Laboratory by Irving S. Reed and Gustave Solomon. It uses linear algebra operations to generate extra encoded pieces, and can be configured in different ways so that a file is split in to k pieces, and then encoded to produce an extra m encoded pieces which are effectively parity pieces.

My students will be writing Apps next Quarter.

http://www.zdnet.com/article/microsoft-takes-wraps-off-powerapps-mobile-app-creation-service/

Microsoft takes wraps off PowerApps mobile-app creation service

… Microsoft's goal in developing PowerApps is to allow business users to harness the power of data scattered throughout their organizations in both software-as-a-service and on-premises apps without having to know how to write a single line of code.

May 'splain y my students don't right gud.

http://www.psmag.com/nature-and-technology/in-text-messages-punctuation-conveys-meaning

OMG! In Text Messages, Punctuation Conveys Meaning

… A Binghamton University research team has apparently identified one such indicator: Whether or not you put a period at the end of a reply.

In the journal Computers in Human Behavior, researchers led by psychologist Celia Klin report that college students perceive text messages that end with a period to be less sincere than ones that do not.

Students: How's this for a Computer Security final exam? Tell be everything Vtech did wrong. (Since we only have 5 hours for the exam, I won't actually use this.) A truly damning article.

http://www.troyhunt.com/2015/11/when-children-are-breached-inside.html

When children are breached – inside the massive VTech hack

Someone actually read the Privacy Policy?

Ca: TD Visa customers’ browsing activities open to ‘surveillance’ by bank

Rosa Marchitelli reports:

A B.C. man decided to Go Public after discovering Canada’s second-biggest bank can access and collect information on all of its customers’ online activities, even those that aren’t banking-related.

Colin Laughlan is one of thousands of Canadians who had his Visa cards switched from CIBC to TD in 2014 after the Aeroplan rewards program changed banks.

“When I saw this — I really had to read it two or three times to make myself believe I was reading what I was reading,” he said.

He points to two lines in the 66-page Visa cardholder agreement that allows TD to collect details about anything — and everything — customers do online.

Under the privacy section of the cardholder agreement:

“COLLECTING AND USING YOUR INFORMATION — At the time you request to begin a relationship with us and during the course of our relationship, we may collect information including:

• Details about your browsing activity on your browser or mobile device.

• Your preferences and activities.

Read more on CBC.ca to learn what happened next when the consumer brought it to the bank’s attention and they promised to delete it from their terms – but didn’t.

And this, kids, is why we need to read the fine print and privacy policies.

Could this have any impact on Kim Dotcom's extradition?

http://www.theguardian.com/technology/2015/nov/30/pirate-bay-stockholm-district-court-sweden-refuses-order-isp-block-site

Sweden refuses to order ISP to block Pirate Bay

Sweden’s internet service providers cannot be forced to block file sharing site the Pirate Bay nor be held responsible for copyright infringements by users, a court has ruled.

Stockholm District Court rejected a lawsuit filed by the Swedish Film Industry, Nordisk Film, Universal Music, Sony Music and Warner Music last year which argued that Sweden’s second-largest internet service provider (ISP) Bredbandsbolaget should be held liable for the copyright infringements of its users should it refuse to block access to the Pirate Bay.

The court said in a statement: “The District Court considers that Bredbandsbolaget’s operation and conduct in the present case does not constitute participation under Swedish law.”

The court blocked the action by a unanimous decision and the film and music rightsholders who filed the lawsuit were ordered to pay Bredbandsbolaget’s costs.

The ruling leaves the door open to further action within the Svea Court of Appeal, where it is possible Bredbandsbolaget could still be ordered to block the Pirate Bay, as is the case for many ISPs across Europe.

Those who do not study history are doomed to repeat it.

http://www.makeuseof.com/tag/7-search-engines-that-rocked-before-google-even-existed/

7 Search Engines That Rocked Before Google Even Existed

Though the Web became publicly available in 1990, the first web search engine didn’t arrive until 1993. Up until then, all websites were manually tracked and indexed by people.

And while we now recognize Google as the king of web search, Google wasn’t even in the game until 1998.

I need to understand Bitcoins, don't you?

http://www.bespacific.com/summary-of-the-bitcoin-seminar-held-at-kaye-scholer-in-new-york-on-october-15-2015/

Summary of the Bitcoin Seminar Held at Kaye Scholer in New York on October 15, 2015

by Sabrina I. Pacifici on Nov 29, 2015

New on LLRX.com – Summary of the Bitcoin Seminar Held at Kaye Scholer in New York on October 15, 2015 – The market quote for Bitcoin on October 15, 2016 at 5:00 pm EST was $255.64 US according to CoinDesk.com on the site’s Price & Data page. At that same moment, Alan Rothman was attending a presentation entitled the Bitcoin Seminar. Rothman expertly documents the facets, vocabulary, instances and key components of the quickly emerging technologies that comprise bitcoin, blockchain and cryptocurrency, and their impact on the financial sector.

Everyone should be able to recognize simple terms like: “Free shipping” ( 免費送貨 )

http://www.freetech4teachers.com/2015/11/learn-chinese-with-pleco.html

Learn Chinese with Pleco

This is a guest post from Jennifer Carey (@TeacherJenCarey) of EdTechTeacher, an advertiser on this site.

In the last few years, Chinese (Mandarin and Cantonese) has become a prominent language in American Classrooms. As learning Chinese requires not only learning the spoken word, but learning a new text and character system, touch screen tools have become incredibly helpful in teaching students how to craft Chinese characters.

One of the best, free tools for students learning Chinese is Pleco, available in both Pleco iOS and Android Pleco. The free dictionary includes over 100,00 entries that are updated regularly. Students can look up words by Chinese characters, Pinyin (spaces and tones), or English and can even hand-write characters to look up information. Students can also cross-reference words by looking up character components and breaking down words into individual characters. Students can also use the Touch to Speak system to hear word pronunciation and sample sentences.

In addition to numerous free resources, there are several add-on purchases, including higher quality text to speech options, Document Reader with OCR recognition (you can upload content with your phone’s camera), and flash card creation. This is an excellent tool to add to your Chinese language learning toolbox.

The preferred encrypted communication tool of ISIS?

Encrypted Messaging App Telegram Leaks Usage Data

Joseph Cox reports:

Even if an app allows encrypted communication, there are often still ways to find out about the people using it. Bearing that in mind, a researcher has found that just about anyone can snoop on the activity of Telegram users, and potentially figure out who they are talking to, by using a third party piece of software.

[…]

Ola Flisbäck, a consultant at Sony Mobile Communications, posted the findings to Github on Saturday. To uncover the flaws, Flisbäck used a third party, command line interface (CLI) client for Telegram.

Read more on Motherboard.

[From the article:

He found that the “android app sends a notification to all contacts when it becomes or stops being the "foreground" app on the device.” In other words, whenever someone stops using Telegram—be that for typing or reading messages—that fact is sent to all of the user's contacts.

It's important to emphasise that this snooping is nothing to do with the actual content of a message. Telegram has a “Secret Chat” feature, where users can activate end-to-end encryption of their chats, meaning that their contents can't be read by anyone intercepting the messages.

Nevertheless, metadata can still reveal a substantial amount of information about a user. Indeed, the operational security expert known as The Grugq tweeted that this method could be used to “accurately guess who is talking to whom.”

Flisbäck wrote that “An 'attacker' will sometimes see the victim and another contact taking turns going active/inactive as they pass messages back and forth.”

Anything that catches the eye of my Computer Security students is valuable. Remember, you may not “use the Force” on your Finals.

http://www.geekwire.com/2015/5-tips-every-infosec-jedi-can-learn-from-the-original-star-wars-movies/?google_editors_picks=true

How to be a tech security Jedi: 5 lessons from the original ‘Star Wars’ movies

… it dawned on me that there are tons of subtle parallels between information security (InfoSec) and the original Star Wars movies

Be sure to focus on this…

http://www.bespacific.com/odni-announces-transition-to-new-telephone-metadata-program/

ODNI Announces Transition to New Telephone Metadata Program

by Sabrina I. Pacifici on Nov 28, 2015

News release: “Beginning Sunday, November 29, the government is prohibited from collecting telephone metadata records in bulk under Section 215, including of both U.S. and non-U.S. persons. And, while under the prior program NSA collected metadata in bulk and sought court approval for individual queries, the USA FREEDOM Act requires that the government must now base any application for telephone metadata records under FISA on a “specific selection term”—a term that specifically identifies a person, account, address, or personal device in a way that limits the scope of information sought to the greatest extent reasonably practicable. This further ensures that collection of information for intelligence purposes is appropriately focused and targeted, and is limited to information that telephone service providers have historically used for their internal billing and operational needs. Moreover, under the Act, the Government will report annually to Congress and to the public, among other things, the total number or orders issued under this authority and the number of targets of such orders. As previously stated, NSA analytic access to the historical metadata collected under Section 215 has ceased. However, NSA has requested limited access to historical Section 215 metadata until February 29, 2016, limited to technical personnel and solely for the purpose of verifying that the new targeted production mechanism authorized by the USA FREEDOM Act is working as intended. The FISC is currently considering this request…”

(Related) ...and not on this.

The Government Wants You To Forget It Will Still Collect Your Phone Records in Bulk

Emptywheel writes:

I Con the Record [Interesting and very deliberate typo for “IC on the Record” Bob] released two statements to mark the end of the Section 215 phone dragnet (which will take place at midnight tomorrow night): a statement and a “fact” sheet. They’re a curious mix of true statements, false statements, and probably false statements.

Here’s the true statement that USAF boosters aren’t retweeting (but which Jim Comey recently mentioned in congressional testimony):

Moreover, the overall volume of call detail records subject to query pursuant to court order is greater under USA FREEDOM Act.

Read more on Emptywheel.

The deepest wounds are self-inflicted.

http://gulfnews.com/business/sectors/media/how-europeans-get-google-to-bury-what-other-people-say-about-them-on-facebook-1.1628273

How Europeans get Google to bury what other people say about them on Facebook

When people have the opportunity to erase personal information online, they often want to wipe out social media posts. That’s the big takeaway from new data released by Google on which search results about themselves European internet users were able to hide under the “right to be forgotten” policy.

The top site targeted was Facebook, followed by Profile Engine, a social account searching service. Google’s own social platforms, including Google Groups, YouTube and Google Plus, also make the top 10 — as do Twitter and a social-dating network called Badoo. Combined, the top 10 sites account for nine per cent of all removal requests, according to Google.

… Google’s own data shows that content being “self-authored” is among the top reasons it turns down “right to be forgotten” removal requests. That suggests people aren’t going to have much luck getting search results about social media posts they wrote themselves removed. That makes sense because, in most cases, people should be able to remove those posts from the source on their own. The company does appear to make some exceptions for people whose online postings are hijacked by someone else.

Another step toward “thought police?” At least another burden for ISPs.

Supreme Court Opens Door for Pirate Site Blockades in Germany

The German Supreme Court has today opened the door for ISP blockades of copyright infringing sites. In a landmark decision the court ruled that ISPs can be required to block websites if copyright holders fail to identify their operators or hosting providers. [How hard will they try? Bob]

… Blocking requests from both the music and movie sector are widespread around Europe, but until now Germany has been excluded.

… the case eventually ended up at the Supreme Court which ruled on the issue today.

Interesting. Useful for my Criminal Justice students?

http://www.bespacific.com/precision-local-and-state-government-search/

Precision Local and State Government Search

by Sabrina I. Pacifici on Nov 28, 2015

“GovScan searches thousands of local government websites to bring you targeted, precision results.

Whether you are a government zoning official determining other city zoning regulations, a developer researching available land, or a concerned citizen investigating government issues, GovScan is here to help. Using search technology from Google, we give you a search engine that will only return results from city, county, state and other government websites.”

Always looking for new reasons to be sued?

http://fortune.com/2015/11/24/mp3-com-founder/

Mp3.com Founder Launches Radio Search Service, Talks Copyright

… The serial entrepreneur is now working on several new ventures, one of which is called OnRadio. The service, introduced this week, indexes all the music playing on more than 100,000 online radio stations and allows users to search across that database and listen to any song. It also lets them share those songs through a variety of chat applications such as Snapchat and Twitter, using a unique URL.

“Because Google doesn’t index online radio streams, radio is invisible to searchers and radio companies are missing out on more than 100 million users per day,” Robertson said in a statement. “Our goal at OnRad.io is to make it one-click easy to find any song playing on the radio and to easily share those songs with friends.”

[From the website's About statement:

An OnRad.io URL is short and intuitive. Just append an artist or song or both with multiple words separated by periods to onrad.io/. Examples:

onrad.io/Hello
onrad.io/Ellie.Goulding
onrad.io/Metallica.One

When an OnRad.io URL is clicked the most popular match will automatically play. On a desktop computer it will play in a browser window. If on a smartphone, the user will be asked to install the free OnRad.io app and then the song will play

Apparently Dilbert feels just like my students when it comes to group projects.

http://dilbert.com/strip/2015-11-29