Interesting wording. (Only the Lakewood CO store was hit.)

http://www.usatoday.com/story/money/business/2014/08/04/pfchang-credit-debit-card-data-breach/13567795/

P.F. Chang's: 33 restaurants affected in data breach

The restaurant chain P.F. Chang's China Bistro said Monday a security breach first reported in June may have led to the theft of customer data from credit and debit cards used at 33 restaurants.

An intruder may have stolen card numbers and possibly names and expiration dates of customers's credit and debit cards used over the course of about 8 months. But the chain has not determined that any specific card holders' data was stolen. [Another way to say that: “We have no idea what was taken.” Bob]

In Monday's statement the chain updated its progress in investigating a breach first reported in June. The statement said all card data has been processed securely at all locations since June 11.

The security breach of their card processing systems occurred between October 19th of 2013, and June 11th of 2014, one day after the Secret Service made the company aware of the breach. [“It's not like we can just turn off our compromised systems... Well, we could, but then we'd have to process the cards manually and that's like boring dude.” Bob]

… If you dined at any of the listed locations, between the dates noted, you are strongly advised to review your financial records to determine if any fraudulent activity has occurred since that time.

The “Oops!” just keep coming.

Target’s Data Breach Is Going To Cost The Company Even More Than It Previously Thought

Myles Udland reports:

Target’s data breach just got more expensive.

In a statement, the retailer said its second quarter earnings will include a $148 million charge related to losses regarding the massive data breach which occurred during last year’s holiday shopping season. This is more than the company previously estimated.

Read more on BusinessInsider

Gamers in Philadelphia are crooks? Thumbprints ensure the games haven't been stolen? “We're just gathering data for the next thing in Behavioral Advertising – 'Bail Bond ads!'”

New Philadelphia GameStop Policy Requires Customer Fingerprints When Trading In Games

Steve Tawa reports:

The big video game retailer, GameStop, is now requiring its customers in Philadelphia, but not in the suburbs, to provide a fingerprint scan on certain transactions.

When GameStop buys used video games from customers, the chain says it is following a local law that allows the store to collect thumb prints, which go into a database to help law enforcement track down thieves who fence stolen goods.

City Solicitor Shelley Smith says, however, the city is not requiring GameStop to abide by the pawnbroker’s ordinance:

“What GameStop does doesn’t meet any of the elements of the definition in the code, so the pawnbreaker ordinance doesn’t apply to GameStop.”

Read more on CBS Philly.

[From the article:

The Philadelphia Police Department says the company is being proactive by storing fingerprints in a secure database – LeadsOnline – which is the nation’s largest online investigation system.

Still want to allow BYOD in your corporation?

http://www.securityweek.com/most-top-free-and-paid-mobile-apps-pose-threat-enterprises-report

Most Top Free and Paid Mobile Apps Pose Threat to Enterprises: Report

Mobile app risk management solutions provider Appthority has analyzed 400 of the most popular free and paid applications for Android and iOS devices and presented the results in a report released on Monday.

The risky behaviors identified by the company are related to the type of data that's collected, and where the data is going, not outright malware risks. According to Appthority's App Reputation Report for the summer of 2014, most apps collect information on the user's location, they access the address book and the calendar, they identify the user based on the device's IMEI or UDID, and they're capable of performing in-app purchases. The collected data can go to ad networks, social networks, third-party analytic frameworks, third-party crash reporting SDKs, and public cloud file storage providers.

… according to F-Secure's Q1 2014 Mobile Threat Report, more than 99 percent of new mobile threats discovered by the security firm in the first quarter of 2014 targeted Android users.

… Last summer, researchers from Bitdefender unveiled research that also found iOS apps to be just as invasive and curious about user data as Android apps are.

… The complete 2014 App Reputation Report from Appthority is available for download in PDF format.

Schools apparently have little or no resistance to salesmen. Wouldn't it be much simpler (and cheaper) to give the teachers an App that allowed them to do everything related to teaching and grading? (Note to reporters: The bracelets don't track student behavior, they record teacher opinions.)

NZ: School plans microchip bracelets

Abbie Napier reports:

A North Canterbury school’s plan to fit students with microchip bracelets to track their behaviour has prompted concern among parents.

Swannanoa School wants to use silicon bracelets as part of a scheme to reward good behaviour, minutes from a Parent Teacher Association meeting show.

Teachers would use portable scanners to add points to a student’s online good behaviour chart with a reward when a certain amount of points was accumulated.

The school says the scheme would cost $7000 to set up. The proposal has been opposed by some parents.

Read more on Stuff.

[From the article:..

After the school was approached by The Press, parents received a letter about the proposed new system.

In it, McClelland said the bracelet system was an alternative to a previously proposed electronic card that students could lose.

(Related) Of course it's not just schools. My tax dollars, wasted! “Hey, they keep offering us all this money. Should we turn it down?”

Rogue cellphone tracker alarms Seattle privacy activists

Lynn Thompson reports:

More than a year after Seattle police promised to not turn on a network of surveillance cameras and communication nodes installed as part of a federal port-security grant, the department still hasn’t released a draft policy on how it will use the equipment and protect citizen privacy.

The installation of the 30 cameras and a wireless mesh broadband network came shortly after the Police Department’s purchase of two aerial drones, also with a Homeland Security grant, and also without public notice.

Read more on Seattle Times.

Bold headline.

http://blogs.hbr.org/2014/08/the-supreme-court-is-wising-up-on-digital-privacy/

The Supreme Court Is Wising Up on Digital Privacy

While much of Washington grapples with a handful of newly-minted Supreme Court decisions focused on social and campaign finance reform, three largely overlooked court decisions signal a much larger tidal wave of change ahead for the tech community. Taken together, these cases shed light on the court’s views of how the Fourth Amendment’s protections of searches and seizures are complicated when much of our personal information is now digital.

The turning point for tech began in 2012 with United States v. Jones, in which the court ruled that attaching a GPS device to a car and monitoring its movements constitutes a search under the Fourth Amendment. This year, the court issued a single opinion on two more cases, Riley v. California and United States v. Wurie, finding that police enforcement must obtain a warrant in order to search digital information on a cell phone seized from an individual at the time of the arrest.

… As we enter an increasingly digital world, a period in which the Internet of Things is poised for explosive growth, it’s reassuring to see that today’s court is equipped to handle cases related to digital privacy. [Slick infographic Bob]

So if I'm sending or receiving high volumes on my phone, I could (temporarily of course) become a “Big Data user” and the medical data I'm sending for diagnosis will wait for some kid's selfie, because that's “fair.”.

http://www.theverge.com/2014/8/4/5968481/verizon-response-to-fcc-throttling-letter

Verizon response to FCC's throttling concerns: everyone's doing it

Verizon Wireless has officially responded to FCC Chairman Tom Wheeler and his data throttling concerns. The Verge has obtained a copy of the carrier's response, dated August 1st, which was written by Kathleen Grillo, the company's SVP of Federal Regulatory Affairs. In it, Verizon underlines the notion that customers will only experience slowdowns "under very limited circumstances." It will only happen at "particular cell sites experiencing unusually high demand," the letter reads. We've outlined the other factors that could result in reduced data speeds previously.

Verizon notes that any throttling will cease immediately when demand on a strained cell site returns to normal. "Our practice is a measured and fair step to ensure that this small group of customers do not disadvantage all others in the sharing of network resources during times of high demand." The carrier insists only big data users who "have an out-sized effect on the network" will be slowed down.

Verizon claims those same people almost always have unlimited data plans and have "no incentive not to" hog up network resources. The top 5 percent of data users will be subject to LTE throttling beginning in October. It may sound difficult to reach that level of data usage, but keep in mind that right now Verizon says exceeding 4.7GB of data would put you there.

Who cares what laws them fur-n-ers got... This here's 'Merica!

http://www.eweek.com/security/federal-court-ruling-orders-microsoft-to-violate-international-law.html?google_editors_picks=true

Federal Court Ruling Orders Microsoft to Violate International Law

Lawyers for Microsoft say they will appeal a federal judge's order that they turn over the contents of a customer's email that's stored on a server in Ireland. But if Microsoft were to comply with the order, it appears that the company would be in violation of both Irish and European laws.

My Computer Security students could build a wiki of useful guides and studies... Not doing it probably won't impact your grade... Probably.

NIST Unveils Security, Privacy Control Assessment Guide Draft

Anna Forrester reports:

The National Institute of Standards and Technology has released a draft guidance for federal agencies, contractors and the intelligence community to evaluate the privacy and security controls used on federal information systems and information technology networks

NIST said Friday that the “Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans” document (SP 800-53A) and the supplementary catalog of controls (SP 800-53) are available for public comments through Sept. 26.

Read more on ExecutiveGov.

Related: Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans (SP 800-53A)

It was the first MS operating system that was “good enough.”

http://www.makeuseof.com/tag/google-reading-emails-hotel-tackles-negative-reviews-tech-news-digest/

Windows XP Is Refusing To Die

Despite Microsoft pulling support for Windows XP in April, the ancient [in Internet years Bob] operating system is refusing to die. According to the latest figures from Net Applications, XP still accounts for 24.82 percent of the Windows market share, down just 1.5 percent since Microsoft pulled the plug.

Meanwhile, Windows 8 and Windows 8.1 continue to struggle, with a 12.48 percent market share for July actually showing a drop on the previous month. Windows 7 now boasts a market share of 51.22 percent, making it by far the most popular version of Windows out in the wild. We hope Microsoft is taking note of these statistics while developing Windows 9.

A way for my website students to “introduce” themselves to potential employers?

http://www.labnol.org/internet/remove-unused-css/28635/

Remove Unused CSS to Reduce the Size of your Stylesheets

The CSS files of your website may have several redundant rules that are no longer used by any element on the web pages. For instance, you may have added a site search box on your website and associated styles went into the stylesheet. Later, if you decide to remove that search box, the styles may continue to exist in your CSS though they aren’t being used anywhere.

These unused entries in your CSS files increase the page load time of your website and also affect the site’s performance as the browser has to do extra work parsing all the extra rules. And even if the impact on performance is minimal, it would make your task of maintaining CSS easier if the files are kept clean and well-structured.

Slick. My Ethical Hackers can learn from this.

http://www.securityweek.com/poweliks-malware-uses-windows-registry-avoid-detection

"Poweliks" Malware Uses Windows Registry to Avoid Detection

Researchers at Trend Micro have analyzed a new Trojan that uses the Windows registry to hide all its malicious code, the security company reported on Friday.

The threat, detected by Trend Micro as TROJ_POWELIKS.A or "Poweliks", is designed to provide attackers with system information which they can use for other operations, but is also capable of downloading additional pieces of malware onto infected computers.

Once it infects a system, Poweliks checks if the Windows PowerShell tool is present. If it's not, the program is downloaded by the malware and installed. PowerShell is used to run an encoded script file containing the Trojan's executable code. Because the code is not executed by Windows or any other application directly, it helps the threat avoid detection, the security company explained.

Then, a blank or NULL key is added to HKEY_CURRENT_USER\Software\Microsoft\Windows \CurrentVersion\Run (startup entry) by using the ZwSetValueKey API. This entry ensures that the malware runs whenever victims turn on their computers. According to Trend Micro, the content of the malicious entry can't be seen by the user because the registry value is NULL. This also means that the entry cannot be deleted.

What else are they looking for?

http://www.telegraph.co.uk/technology/google/11010182/Why-Google-scans-your-emails-for-child-porn.html

Why Google scans your emails for child porn

A convicted sex offender has been arrested after Google flagged images of child abuse found in his GMail account to authorities, according to reports, revealing that

Google spotted that the man had illegal images of a young girl stored in his GMail account during an automated search and reported it to the US non-profit National Center for Missing and Exploited Children. A subsequent police investigation lead to his arrest.

I don't suppose we'll be adding pot classes, no matter how popular.

http://www.livetradingnews.com/marijuana-business-academy-to-launch-educational-seminars-in-denver-63454.htm

Marijuana Business Academy To Launch Educational Seminars In Denver

Another day when apparently nothing happened.

Stalking tool?

http://www.bbc.com/news/technology-28602997

Wearable users tracked with Raspberry Pi

People who use wearable gadgets to monitor their health or activity can be tracked with only $70 (£40) of hardware, research suggests.

The work, carried out by security firm Symantec, used a Raspberry Pi computer to grab data broadcast by the gadgets.

Something to share with my students.

Bolt

https://bolt.co/

– is a free replacement for Android’s default phone app. Install Bolt to talk for free with other Bolt users, automatically discover who you talk to most, and streamline your calling experience. Bolt is a single app you can use to call any contact who has a phone number. No need to add new usernames for your family and friends or leave the app to call your bank. Bolt just works without making you think.

For my Computer Security students. All new malware is, for a time, undetectable.

http://dailygadgetry.com/backoff-malware-sophisticated-can-hardly-traced/4144

Backoff Malware So Sophisticated it Can Hardly be Traced

A never been seen before malware called Backoff, which has infected point of sale systems and remote desktop applications, has gone virtually undetected causing a huge security threat.

Hackers have developed a virus that has infected point of sale (PoS) software for retailers and businesses as well as remote desktop applications which are commonly used by telecommuting employees or independent contractors to connect to the businesses main network.

… businesses and retailers are being cautioned to monitor their traffic patterns and look out for strange IP addresses. They are also warning everyone to ensure they have strong passwords.

Those who have Microsoft’s or Apple’s Remote Desktop system are being asked to pay extra attention to unusual activity and make sure that their passwords are secure.

Silly and poorly thought out. If they can't video from overhead, they'll probably stand across from the gate and video “cars going in and out.” When that's banned, they will move a block away and do the same thing. Then telescopes? Perhaps following the cars with dashboard cams?

LAPD seeks to limit civilian drone flights over police stations

Ah, delicious irony….

Joseph Serna reports:

Los Angeles police on Friday said they have asked the city attorney’s office and county prosecutors to explore whether they can legally prohibit civilians from flying drones with cameras over department-owned parking lots.

The inquiry was sparked after a South Bay man who routinely films police activity and posts the footage on his website flew his drone over the parking lot of the LAPD’s Hollywood station this week and filmed squad cars going in and out.

He then posted the video on YouTube.

“What concerns us is that they are filming over private property and it’s gated – you’re looking at the layout of the police station, how we operate, personnel license plates,” said police Lt. Michael Ling. “It’s kind of like if it was your house, if they’re flying over your backyard you’d start asking questions about it.”

Read more on L.A. Times.

This is the world of social media. People can't imagine living without their toys.

http://dailydigestnews.com/2014/08/facebook-goes-down-panicked-users-call-911/

Facebook goes down, panicked users call 911

When Facebook went down for some on Friday, a few people panicked and called 911, CNET reports. Whether they were prank calls or people truly concerned about the inability to update their status remains a mystery for now.

Interesting article. It seems to suggest that at least for mobile, the neutrality of the Internet is no more.

http://www.wired.com/2014/08/free-mobile-data-plans-are-going-to-crush-the-startup-economy/

Free Mobile Data Plans Are Going to Crush the Startup Economy

The deal sounds great: Stream unlimited music without any data charges. The offer from T-Mobile includes popular services such as Spotify, iTunes, and Pandora. These app s will no longer count against your data plan, the company announced recently, no matter how much you stream across its 4G LTE network.

Or consider Sprint’s new offer, via its Virgin Mobile pre-paid service: unlimited access to Facebook, Twitter, Instagram, or Pinterest for just $12 per month. Unlimited access to all four is $22 monthly, and $5 more also gets you unlimited music.

Yesterday, we described the Sprint deal as a Netflix-like unbundling of mobile data options, an à la carte alternative to standard all-access data plans that resemble nothing so much as cable’s all-or-nothing bundles that force you to pay for channels you don’t actually want. And there’s a truth to this. But a prominent New York venture capitalist has a far more pessimistic take on the new trend toward unlimited data for certain apps. Fred Wilson, co-founder of Union Square Ventures, views such deals—which he calls “zero rating”—as a discriminatory salvo against mobile innovation.

“What all of this zero rating activity is setting up is a mobile internet that looks a lot more like cable TV than our wide open Internet,” Wilson writes. “Soon, a startup will have to negotiate a zero rating plan before launching because mobile app customers will be trained to only use apps that are zero rated on their network.”

I didn't know this was a problem. I'll post the chart for my students.

http://www.labnol.org/internet/share-files-between-phone-and-computer/28018/

How to Share Files Between Mobile Phones and Computers

Your digital photos, documents, music, and other files are spread across a range of devices from your mobile phones to tablets and your computers. The devices are running different operating systems and therefore there’s no standard method that will allow you to easily copy files from one device to another.

Believe it or not, I have students who read for pleasure.

29 Sites That Monitor Amazon For Free Kindle eBooks

It’s a tedious thing to monitor time sensitive offers at Amazon, especially free ones these days. Fortunately independent sites that monitor such offers do exist and the good news is – they’re in abundance. Daily offers or very limited time free kindle ebook offers will be posted on a daily basis, allowing you the option to download and sample these stories without the need to log in to Amazon for the latest lists.

This is for my students who spend class time catching up on their favorite TV shows.

http://www.newsforshoppers.com/hulu-android-app-updated-now-streaming-free-content/36726757/

Hulu Android App Updated, Now Streaming Free Content

This week, video-streaming service provider Hulu released a major update to its app designed for Android smartphones and tablets.

The latest update allows mobile Android users to access and stream select TV shows and movies for free.

To download the updated Android Hulu Plus app, visit https://play.google.com/store/apps/details?id=com.hulu.plus&hl=en

(Related) I'll have to pull their earbuds to get their attention, but the might like this.

Atraci

http://getatraci.net/

– listen instantly to 60 million songs. Atraci is an application for Windows, Mac and Linux that lets you listen instantly to more than 60 million songs (way more than iTunes’s 26 million). It requires no sign up, displays no ads and is 100% safe.

Android and iOS apps on the way

I can't believe this happens every week!

Hack Education Weekly News

… Missouri Governor Jay Nixon has signed a bill extending existing privacy laws for library records to include materials related to e-books, streaming video, and downloadable audiobooks. More via School Library Journal. [“Library records” didn't include this information? Bob]

… In order to stop cheating, the Air Force dropped grading as part of the examination procedures for its nuclear officers

… This story from the Hoboken School District of its plans to destroy, yes destroy, all its laptops from its “failed” 1:1 laptop program details an amazing amount of administrative incompetence.

… Some 31 million people enrolled in college during the last 20 years left without earning a degree. And via the chart-loving Vox: “7 charts that show what happened to 31 million American college dropouts.”

Oh no! Not Jimmy Johns!

http://krebsonsecurity.com/2014/07/sandwich-chain-jimmy-johns-investigating-breach-claims/

Sandwich Chain Jimmy John’s Investigating Breach Claims

Sources at a growing number of financial institutions in the United States say they are tracking a pattern of fraud that indicates nationwide sandwich chain Jimmy John’s may be the latest retailer dealing with a breach involving customer credit card data. The company says it is working with authorities on an investigation.

… The unauthorized card activity witnessed by various financial institutions contacted by this author is tied to so-called “card-present” fraud, where the fraudsters are able to create counterfeit copies of stolen credit cards.

Beyond ATM skimmers, the most prevalent sources of card-present fraud are payment terminals in retail stores that have been compromised by malicious software.

… Reports of a possible card compromise at Jimmy John’s comes amid news that the Delaware Restaurant Association is warning its members about a new remote-access breach that appears to have been the result of compromised point-of-sale software.

Oh look, banks have rules!

http://www.bespacific.com/financial-crimes-enforcement-network-customer-due-diligence-requirements-financial-institutions/?utm_source=rss&utm_medium=rss&utm_campaign=financial-crimes-enforcement-network-customer-due-diligence-requirements-financial-institutions

Financial Crimes Enforcement Network: Customer Due Diligence Requirements for Financial Institutions

by Sabrina I. Pacifici on Jul 31, 2014

News release: “The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) today issued a Notice of Proposed Rulemaking (NPRM) to amend existing Bank Secrecy Act (BSA) regulations to help prevent the use of anonymous companies to engage in or launder the proceeds of illegal activity in the U.S. financial sector. The proposed rule would clarify and strengthen customer due diligence obligations of banks and other financial institutions (including brokers or dealers in securities, mutual funds, futures commission merchants, and introducing brokers in commodities). The proposed amendments would add a new requirement that these entities know and verify the identities of the real people (also known as beneficial owners) who own, control, and profit from the companies they service… The proposed rule benefits from extensive outreach and discussion with financial institutions and regulatory agencies. These proposed amendments represent significant enhancements to the BSA and build upon post-9/11 augmentation of the regulations designed to protect the U.S. financial system. They would make valuable information needed to disrupt illicit finance networks available to law enforcement. The resulting increase in financial transparency would enhance the ability of financial institutions and law enforcement to identify the assets and accounts of criminals and national security threats. The rule also would further the United States commitments in the G-8 Action Plan for Transparency of Company Ownership and Control published in June 2013. The rulemaking clarifies that customer due diligence includes four core elements: identifying and verifying the identity of customers; identifying and verifying the beneficial owners of legal entity customers; understanding the nature and purpose of customer relationships; and conducting ongoing monitoring to maintain and update customer information and to identify and report suspicious transactions. The proposed requirement to identify and verify the identity of beneficial owners is addressed through the proposal of a new requirement for covered financial institutions to collect beneficial ownership in a standardized format. Those financial institutions will have to identify and verify any individual who owns 25 percent of more of a legal entity, and an individual who controls the legal entity.”

Is this really unexpected?

http://dailydigestnews.com/2014/07/twitter-and-the-us-government-square-off-yet-again/

Twitter and the US government square off yet again

Twitter’s latest transparency report shows a steady rise in government requests for account information. And an increasing number of requests are coming from foreign governments. In the past six months, the company received more than 2,000 different requests from 54 different countries, an increase of almost 150 percent since Twitter began releasing the data in 2012.

(Related) Or this one?

http://www.bbc.com/news/technology-28601788

Microsoft ordered to hand over emails on Dublin server

Microsoft's latest attempt to resist a US government warrant demanding access to emails stored on servers in Ireland has been dismissed by a federal judge.

A court in New York ruled against the tech company, which has consistently fought the order issued in December as part of a drug-trafficking trial.

Microsoft immediately announced plans to challenge the decision.

The company has previously said it will allow users to choose where their data is stored.

Is there a trend to make more/less data sensitive?

What Is Sensitive Data? Different Definitions in Privacy Law

Daniel Solove writes:

…. I find it interesting what various countries define as sensitive data, and K Royal has created an awesome chart that she shared with me. To a privacy wonk like me, a chart like this makes me giddy with excitement, and so I thought I’d share it with you (with her permission, of course).

First, here’s a tally of the various types of most-commonly recognized categories of sensitive data. This is based on a chart of the sensitive data category of many countries that K Royal created.

See the chart and read more on LinkedIn.

If nothing else, ammunition for the annual budget wars.

http://www.bespacific.com/ny-ag-releases-report-showing-rise-data-breaches-provides-security-tips-small-businesses-consumers/?utm_source=rss&utm_medium=rss&utm_campaign=ny-ag-releases-report-showing-rise-data-breaches-provides-security-tips-small-businesses-consumers

NY AG Releases Report Showing Rise In Data Breaches, Provides Security Tips To Small Businesses & Consumers

by Sabrina I. Pacifici on Jul 31, 2014

“Attorney General Eric T. Schneiderman today issued a new report examining the growing number, complexity, and costs of data breaches in the New York State. Using information provided to the Attorney General’s Office pursuant to the New York State Information Security Breach & Notification Act, the report, titled “Information Exposed: Historical Examination of Data Security in New York State, analyzes eight years of security breach data and how it has impacted New Yorkers. The report reveals that the number of reported data security breaches in New York more than tripled between 2006 and 2013. In that same period, 22.8 million personal records of New Yorkers have been exposed in nearly 5,000 data breaches, which have cost the public and private sectors in New York upward of $1.37 billion in 2013. In addition, the report also found that hacking intrusions – in which third parties gain unauthorized access to data stored on a computer system – were the leading cause of data security breaches, accounting for roughly 40 percent of all breaches. Attorney General Schneiderman’s report also presents new recommendations on steps that both organizations and consumers can take to protect themselves from data loss.”

Rethinking our security strategy?

http://techpageone.dell.com/technology/dont-let-your-enterprise-network-fail-on-the-basics/?DGC=BA&DGSeg=GB&CID=27904&LID=5303104&acd=12309203937467604

Don’t let your enterprise network fail on ‘the basics’

As many have pointed out, network security relies not on defenses that never fail, but on defenses that fail intelligently. However, today’s enterprise networks most often “fail on the basics,” according to Dmitriy Ayrapetov, director of product management at Dell SonicWall.

That has been a recurring theme at the Gartner Security & Risk Management Summit this week in Washington, D.C. New research from Gartner shifts the focus of security planning away from “preventive controls (such as signature-based anti-malware, network and host intrusion prevention systems, pervasive encryption and continuous patching),” calling such controls “increasingly ineffective.” Instead, Gartner’s analysis concludes that “the digital workplace reinforces the need to focus more on detective and reactive controls.”

… He noted the recent collapse of CodeSpaces.com, a code-hosting and project management service provider whose customer data was eradicated last week by an unknown intruder, causing the company to fail within a day. According to a published IDG News Service release published by ComputerWorld and other sources, “The devastating security breach happened over a span of 12 hours and initially started with a distributed denial-of-service attack followed by an attempt to extort money from the company.”

(Related)

http://www.securityweek.com/mobile-apps-are-replacing-web-your-enterprise-ready

Mobile Apps Are Replacing the Web - Is Your Enterprise Ready?

We know mobile is quickly changing the way we do business and now it’s also beginning to replace the web. A recent Gartner study shows that 86 percent of users are now using mobile apps compared to the 14 percent still using mobile browsers. The trajectory is very clearly shifting from web to mobile and as CISOs, we really need to reevaluate if we are ready to properly secure and protect mobile applications from threats.

A recent study showed that this year, mobile users actually surpassed desktop users. The “mobile first” trend has finally arrived and it’s coming in at full force.

Whether we like it or not, BYOD is here and being adopted in most organizations.

… Gartner reports that by 2015, 75 percent of mobile apps will fail basic security tests.

… Follow OWASP’s top 10 mobile risks and the remediation for those risks is a great start. This covers everything from data encryption to preventing man-in-the-middle attacks to client side injection.

Perhaps we could host a war game?

http://www.securityweek.com/deloitte-brings-cyber-war-games-enterprise

Deloitte Brings Cyber War Games to the Enterprise

Deloitte's Cyber Risk Services group has launched new “cyber war-gaming and simulation services” that aim to unite those tasked with managing enterprise-wide responses to cyber-attacks.

According to Deloitte, its cyber threat war-gaming approach relies on thinking from the military and academia and incorporates lessons learned from war-game simulations conducted for multi-national companies, government entities, regulatory bodies and industry groups.

Deloitte co-authored the "After Action" report (PDF)for Quantum Dawn 2, a simulated systemic cyber attack on the U.S. financial system back in June 2013.

(Related)

http://www.securityweek.com/microsoft-launches-emet-50

Microsoft Launches EMET 5.0

Microsoft announced on Thursday the general availability of the Enhanced Mitigation Experience Toolkit (EMET) 5.0.

According to the company, version 5.0 of the free security tool comes with two new mitigations, Attack Surface Reduction (ASR) and Export Address Table Filtering Plus (EAF+), both of which were introduced in EMET 5.0 Technical Preview.

Should be enlightening.

DC Circuit Rules for EPIC in Case Against NSA, Vacates Lower Court Ruling That Secret Order Is Not Subject to FOIA

From EPIC:

The U.S. Court of Appeals for the D.C. Circuit ruled in favor of EPIC today in a Freedom of Information Act case seeking the full text of National Security Presidential Directive 54, a previously-secret Presidential order granting the government broad authority over cybersecurity matters. EPIC successfully obtained the Directive from the NSA, and the DC Circuit has vacated the lower court’s Fall 2013 ruling that NSPD-54 was not an “agency record” subject to the FOIA. The Directive also includes the Comprehensive National Cybersecurity Initiative and evidences government efforts to enlist private sector companies to assist in monitoring Internet traffic. EPIC has several related FOIA cases against the NSA pending in federal court. For more information, see EPIC v. NSA: NSPD-54 Appeal and EPIC: Freedom of Information Act Cases.

Might be useful

Resource: Videos from 2014 Health Privacy Summit available online

If you missed the 2014 Health Privacy Summit, you can view videos from the conference on Patient Privacy Rights’ site.

I'm shocked, shocked I tell you! Imagine a regulation requiring you to treat every request as if it was rational and reasonable. Then imagine individuals with no such requirements.

Some are twisting the facts in requests to be forgotten, Google says

Zach Miners reports:

Some of those seeking to scrub their histories from the Web under Europe’s “right to be forgotten” rule are being economical with the truth when making their requests, Google said Thursday.

In a letter to European data regulators, Google listed some of the challenges it faces in complying with the ruling, which allows people to compel search engines like Google and Bing to remove links to pages that mention their name, if the references are “inadequate,” “irrelevant” or “excessive.”

Read more on Computerworld.

SkyNet will not work unless robots can self-repair.

http://www.bbc.com/news/technology-28564349

Robot 'learns to keep going with broken leg'

Engineers have taken a step towards having machines that can operate when damaged by developing a robot that can teach itself to walk, even with a broken leg.

Using "intelligent trial and error", their six-legged robot learned how to walk again in less than 2 minutes.

Something useless for the game club. (Wink wink)

http://www.makeuseof.com/tag/usb-port-security-risk-sony-offers-streaming-gaming-tech-news-digest/

Play Game Boy Advanced Games On Your iPhone

Apple doesn’t allow emulators on its platform, but coders keep finding a way to offer them. GBA4IOS is a free Game Boy Advanced emulator you can install on your iPhone or iPad, for free.

Installing this is a little odd: you’ll need to set your time back 24 hours before you can download it, a trick that apparently lets this unapproved app get around Apple’s walled garden.

Of course, you can’t play any games with this unless you download ROMs – which would be illegal. We know none of you would break the law, ever, so I suppose this isn’t useful – just like the emulators you installed on your Raspberry Pi.

Oh well.

I know some students who will love this.

http://www.theatlantic.com/technology/archive/2014/07/a-tool-that-answers-whats-that-typeface/375397/

A Tool That Answers 'What's That Typeface?'

… it's so addicting to be able to mouse over and identify any font you see online. That's what the browser plug-in FontFace Ninja allows. There's even a button that lets you hide everything on the page except for the text.

Looks like some people are taking Russia's offer seriously.

http://www.securityweek.com/tor-warns-attack-attempting-deanonymize-users

Tor Warns of Attack Attempting to Deanonymize Users

The Tor Project has disclosed details of an attack which appeared to be an attempt to deanonymize users of the popular anonymity network.

According to Tor Project Leader Roger Dingledine, the attack was detected on July 4 while the organization was trying to identify attacks leveraging a method discovered by researchers at Carnegie Mellon University's CERT.

The researchers, Michael McCord and Alexander Volynkin, planned on detailing a way to break the anonymity network by exploiting fundamental flaws in its design and implementation at the upcoming Black Hat security conference, but their presentation was cancelled because their materials had not been approved for public release by the Software Engineering Institute at Carnegie Mellon University.

Probably small, but not the kind of message you want to send your customers. Points for honesty? Probably not. I wonder if they have records (activity logs) going back to 2011?

Lasko’s system may have been hacked back in 2011

Ouch. Lasko is notifying some customers of the Lasko and Air King web sites that on July 2, they became aware that some customers were receiving phishing e-mails. Investigation suggested that it may have been related to a hack of their system that exposed customers’ names, email addresses, phone numbers, credit card numbers and card expiration dates.

“Although most of the activity associated with this unauthorized hacking into our computer network appears to have occurred during March – June 2014, we can not rule out the possibility of unauthorized access to our network leading to the exposure of credit card information dating back to 2011,” writes Edward V. McAssey III, Chief Operating Officer. The meta-data for their submission to the California Attorney General’s Office indicates that the hack may have occurred in December 2011.

Those notified were offered a year of free services through AllClear ID, but there’s no indication in the letter how many customers are being notified.

(Related) People say they are concerned, but they don't seem to act that way.

http://www.securityweek.com/customer-loyalty-seriously-affected-data-breaches-safenet

Customer Loyalty Seriously Affected by Data Breaches: SafeNet

A global survey conducted by data protection solutions provider SafeNet once again confirms that data breaches, especially ones that involve financial data, have a negative impact on customer loyalty.

According to the study, 65% of the roughly 4,500 respondents are unlikely to do business with a company that experienced an incident in which credit card details, bank account numbers or online banking login data was stolen. Consumers in the United States and Germany appear to be the least concerned, with 54%, respectively 53%, saying that they would not do business with a firm that suffered a data breach. Japan is at the other end of the poll with 82%.

… The Q2 Breach Level Index published by SafeNet on Wednesday shows that a total of 175 million records were exposed worldwide in the second quarter as a result of the 237 data breaches that occurred during this period.

Security as “competitive advantage.” Interesting.

http://www.forbes.com/sites/maribellopez/2014/07/30/can-blackberry-become-the-next-security-superpower/

Can BlackBerry Become The Next Security Superpower?

BlackBerry announced its intent to acquire Secusmart. It’s a company that offers high-security voice and data encryption and anti-eavesdropping solutions for government organizations, enterprises and telecommunications service providers.

… BlackBerry is hanging its hat on becoming the next security company…and that’s not a bad thing. BlackBerry is making progress with its Enterprise Mobility Management (EMM) solution but this is a tough market to win against the likes of Vmware/Airwarch and Mobileiron.

Is this all in reaction to NSA surveillance?

http://www.securityweek.com/iphone-app-signal-enables-free-encrypted-phone-calls

iPhone App "Signal" Enables Free Encrypted Phone Calls

Open Whisper Systems, the creators of the RedPhone secure calling app for Android, announced on Tuesday the availability of Signal, an iPhone application that lets users make encrypted voice calls worldwide for free.

According to the open source software group, Signal is specifically created for mobile devices and it's fully compatible with RedPhone. The new application uses existing phone numbers and it's designed to display only contacts that area reachable through Signal.

Users don't need any passwords when utilizing the app. Instead, both the caller and the receiver are presented with a pair of words. If the words match on both ends, the connection is secure; if not, someone is possibly eavesdropping on the conversation.

In order to ensure that communications are protected, Signal uses ZRTP, a protocol invented by Phil Zimmermann, who is also the creator of Pretty Good Privacy (PGP). In fact, Zimmermann also co-founded Silent Circle, a company providing encrypted communications services.

Is DNA like fingerprints? I kinda think it is.

Appeals court upholds retention of volunteered DNA

Ian Duncan reports:

An appeals court on Wednesday sanctioned the police’s use of genetic material obtained in one investigation to solve other crimes, but agreed with attorneys for a burglar that questions surround the little known practice.

Three judges of the Court of Special Appeals upheld the burglary conviction of George Varriale, a homeless Anne Arundel County man, which was based in part on DNA that he had voluntarily given to police to clear himself in a rape investigation.

Read more on Baltimore Sun.

(Related) Do we need a global DNA database? (No doubt the FBI would volunteer to run it)

Mass DNA swap with Belgium may solve hundreds of crimes

From DutchNews.nl:

A ‘mass exchange’ of DNA profiles between the Netherlands and Belgium may have helped solve hundreds of crimes, Belgian media report on Thursday.

In total, 1,745 matches were found when crime scene DNA held in data banks in the two countries was compared. In 576 cases, DNA found at a crime scene in one country could be linked to someone who had been forced to give a sample in the other.

[...]

Belgium will also soon make DNA exchanges with German and French DNA banks.

Since 2005, everyone convicted of a crime punishable by four years or more in jail in the Netherlands must give a dna sample. This is kept on the data base for 20 years.

There’s no mention in this article of any privacy or human rights concerns. How would you feel if the U.S. shared your DNA with other countries for law enforcement purposes? I can see querying in particular cases, but mass exchange?

No decision, but lots of argument.

http://www.bespacific.com/national-consensus-cell-phone-location-records-private-eff/?utm_source=rss&utm_medium=rss&utm_campaign=national-consensus-cell-phone-location-records-private-eff

A National Consensus: Cell Phone Location Records Are Private – EFF

by Sabrina I. Pacifici on Jul 30, 2014

“The Fourth Amendment protects us from “unreasonable” government searches of our persons, houses, papers and effects. How courts should determine what is and isn’t reasonable in our increasingly digital world is the subject of a new amicus brief we filed today in San Francisco federal court. At issue is historical cell site data—the records of the cell towers a customer’s cell phone connects to. The government has long maintained that it’s unreasonable for customers to expect those records to remain private. As a result, the government argues it does not need a search warrant to obtain historical cell site records from cell phone providers. Federal appeals courts are divided on the issue. In 2013, the Fifth Circuit Court of Appeals, which covers Louisiana, Mississippi and Texas, ruled there was no expectation of privacy in historical cell site data. But last month, the Eleventh Circuit Court of Appeals, which covers Alabama, Florida and Georgia, reached the opposite conclusion, ruling people did have an expectation of privacy in this information. Federal magistrate judge Nathanael Cousins in San Francisco, who is not required to follow either the Fifth or Eleventh Circuit–he’s bound to follow the Ninth Circuit which hasn’t ruled on the issue yet–recently requested the local U.S. Attorney’s office to explain why the government believed it did not need a search warrant to obtain cell site records. He invited the San Francisco Federal Defender to file a response as well, and we filed an amicus brief supporting a warrant requirement. The ACLU of Northern California and University of San Francisco law professor Susan Freiwald and EFF special counsel Marcia Hofmann also submitted amicus briefs. A Fourth Amendment “search” is an intrusion upon something in which a person has a subjective expectation of privacy that society considers reasonable. By definition, determining whether a search is “reasonable” requires looking at what society considers to be deserving of privacy protection. So our amicus brief explains why many Americans actually expect this detailed and sensitive location information to remain private, even when it’s stored by phone companies.”

Today it's to study traffic flow, tomorrow it will be for “prevention of terrorism!”

‘Big Brother’ airport installs world’s first real-time passenger tracking system

Soo Kim reports:

All mobile phones logged into the Wi-Fi network at Helsinki Airport will be monitored by an in-house tracking system that identifies passengers’ real-time movements.

The technology has been criticised by privacy advocate groups, but is said to be aimed at monitoring crowds and preventing bottlenecking at the airport, which sees around 15 million passengers a year, Bloomberg reports.

Read more on The Telegraph.

Another case of lawyers (and lobbyists) knowing more about health tan mere doctors?

Physicians to Appeal ‘Docs v. Glocks’ Ruling in FL

John Commins reports that physician groups will appeal the 11th Circuit ruling upholding Florida’s “Docs vs. Glocks” law. I am glad to hear that as I think the law is not only a gag on health professionals’ First Amendment rights, but a prohibition on professional speech/conduct that is a disservice to public health and safety. In my opinion, states should only be interfering in (regulating) doctor-patient discussions or care when there is sufficient evidence that a practice causes harm or puts patients at unacceptable risk. There has been no such demonstration in this case.

Just as pediatricians and those of us who work with children may routinely inquire about a child’s nutrition and sleep patterns in screening for factors that may contribute to health and functioning, so too do professionals screen for other factors that may affect our patients’ health – including the presence of guns in homes where there are impulsive or curious young children. Mental health issues such as depression or anger issues are not the only reason or justification for asking about guns.

Those supporting the Docs vs. Glocks law seem to believe that inquiring is just an attempt by professional groups to condemn guns or interfere with adults Second Amendment rights to own guns. It’s not. It’s an attempt to do our jobs properly.

And given that we are required to maintain patient confidentiality and no law requires us to record all of a patient’s answers, why is there even a problem?

In any event, the Docs vs. Glocks needs to be struck down - to protect the health and safety of the public and so that health professionals’ hands are not unreasonably tied. If the state wants to regulate our speech, it should have to meet a higher level of scrutiny.

Perhaps my Ethical Hackers could do the same here? Students only? (Not really)

http://www.pcworld.com/article/2460120/facebook-app-gives-free-internet-to-mobile-users-in-zambia.html

Facebook app gives free Internet to mobile users in Zambia

Facebook introduced an app on Thursday that will give mobile phone subscribers in Zambia access to a set of free basic mobile data services—and Facebook.

The app is part of Facebook’s Internet.org project that aims to bring Internet access to the two thirds of the world’s population that doesn’t have it. With the app, people can browse a set of health, employment and local information services without data charges, Facebook said on Thursday.

“By providing free basic services via the app, we hope to bring more people online and help them discover valuable services they might not have otherwise,” Facebook’s director of product management, Guy Rosen , wrote.

… Facebook has already done something similar in the Philippines where it partnered with service provider Globe to offer services for free. It also has partnered with carrier Tigo in Paraguay in the early stages of the Internet.org project. According to Facebook CEO Mark Zuckerberg the number of Internet users doubled in the Philippines while Tigo saw the growth of Internet users rise by 50 percent as a result as a result of the tests.

I wonder of Facebook et al pay for this?

http://www.mycentraloregon.com/2014/07/30/what-sprints-new-wireless-plan-says-about-the-future-of-mobile/

What Sprint's New Wireless Plan Says About the Future of Mobile

Sprint and Virgin Mobile USA announced phone plans Wednesday that will let you access only four of the most popular social media apps in the country.

Marketed with parental controls and targeted toward families, customers can pay $11.98 for the new Virgin Mobile Custom plan, a no-annual-contract program for unlimited access to one of four social media apps: Facebook, Twitter, Pinterest or Instagram.

Each pre-paid $6.98 base plan includes 20 minutes of voice and 20 texts. Another $5 provides customers with unlimited access to one of those four apps. Or, you can choose to pay $15 for access to all four of those apps.

“Phones have migrated largely away from ‘talking’ at this point and are much more utilized for apps, searching and making purchases,” said Ken Wisnefski, founder and CEO of online marketing agency WebiMax. “Talking is secondary. Who talks on a phone anymore?”

...'cause us teachers love Wikipedia.

Kiwix

http://kiwix.org/wiki/Main_Page/

– enables you to have the whole of Wikipedia on hand wherever you go. On a boat, in the middle of nowhere or in jail, Kiwix gives you access to the whole of human knowledge. You don’t need the Internet, as everything is stored on your computer, USB flash drive or DVD. Kiwix is free software, which means you can freely copy, modify and distribute it.

[From the webpage:

Kiwix is mostly installed in schools, universities and libraries which can't afford a broadband Internet access. It is much faster than the Internet and also can be used by many institutions to save bandwidth and reader's time. But many people use Kiwix for their own personal purposes, for example, of people suffering from censorship or prisoners.

Translating student speak. (Of course, you can always Google it)

http://www.makeuseof.com/tag/speak-gen-z/

How To Speak Gen Z

Have you ever received text messages from Mum or Dad (maybe Grandma) asking,”What’s ‘LOL’?” or “What’s “FML’?” If you’re still unsure about the lingo of today’s generation Z, here’s a quick cheat sheet to get you back on track.

While you’re at it, you may as well learn the alphabet the geeky way, as opposed to learning the alphabet the obsolete way.

For my students.

http://www.makeuseof.com/tag/tech-jobs-future-study-want-cool-job-tomorrow/

Tech Jobs of the Future: What To Study If You Want a Cool Job Tomorrow

… If you’re a student and looking to establish yourself in a field of study that has a bright future in the world of high technology, then you’ll need the mindset of a futurist. Understanding the direction of technology will help you decide how you want to position yourself to succeed, and figure out exactly what you need to study to get there.

Modern state of the art throughout the world of tech ranges across many disciplines, including virtual reality, artificial intelligence, drones, and even biotechnology. How do you know where to start? The following are a few examples of the sort of tech jobs you can expect to see within the next 5 to 10 years if advancements continue along the paths they are going. Review them and decide whether your personality and interests would make you a good candidate for any of these future jobs.

Cyber Security

Drone Programmers

Virtual Reality Designers

Vehicle Programmers

Smart Home Programmers

Advanced Automation

Artificial Intelligence Programmer