Consider: The President was briefed on the JPMorgan hack and the potential for damage was explained.

http://www.foxbusiness.com/economy-policy/2014/10/12/obama-said-to-warn-crippling-cyber-attack-potential/?cmpid=edpick&google_editors_picks=true

Obama Said to Warn of Crippling Cyber Attack Potential

President Barack Obama believes cyber terrorism is one of the biggest threats to national security and says the White House is bracing for a possible doomsday scenario if hackers can successfully penetrate government and business computer systems, the FOX Business Network has learned.

… At the fundraisers, the president laid out what one person with first-hand knowledge of the fundraising meetings called a “doomsday” scenario if hackers can successfully gain entry into government systems or breach security walls at major banks.

“The president is worried that cyber criminals could literally wipe out the identities of millions of people through some breach of government systems and that could lead to massive chaos,” this person said.

(Related) The President is speaking hypothetically, DHS deals with actual events.

http://www.securityweek.com/critical-manufacturing-firm-hit-sophisticated-threat-actors-dhs

Critical Manufacturing Firm Hit by Sophisticated Threat Actors: DHS

Several sophisticated threat groups have breached the systems of a major critical manufacturing company, the Department of Homeland Security (DHS) revealed last week in a report.

According to the report, which summarizes the Industrial Control Systems Cyber Emergency Response Team's (ICS-CERT) activities in the second quarter of 2014, the attackers had access to the unnamed manufacturing organization's networks for several months.

… A study published this summer revealed that 70% of critical infrastructure organizations had suffered at least one security breach that either led to the disruption of operations or the loss of confidential information.

The DHS has been actively involved in the protection of critical infrastructure, but the agency has also made some mistakes that could have had serious consequences. In July, in response to a freedom of information act (FOIA) request, the DHS mistakenly released 840 pages of documents containing details on potentially vulnerable critical infrastructure points across the U.S.

For my Computer Security students. These are fun questions to ask your managers. Tell them it is for a project at school.

http://www.bespacific.com/company-ready-big-data-breach/

Is Your Company Ready for a Big Data Breach?

The Second Annual Study on Data Breach Preparedness – Ponemon Institute© Research Report – Sponsored by Experian® Data Breach Resolution – Independently conducted by Ponemon Institute LLC. Publication Date: September 2014.

“Data breaches are increasing in frequency. Forty-three percent of respondents say their companies had a data breach involving the loss or theft of more than 1,000 records, an increase of 10 percent from 2013. Sixty percent of respondents say their companies have had more than one breach. Last year, 52 percent of respondents said their company had more than one breach. Current data breach preparedness programs often fail to deal with all consequences of an incident. Despite the increased existence of data response teams and plans in organizations represented in this research, Figure 1 reveals 68 percent of respondents do not agree their company would know how to deal with negative public opinion, blog posts and media reports. Further, only 67 percent do not agree their organization understands what needs to be done following a material data breach to prevent the loss of customers’ and business partners’ trust and confidence.”

Apple is not a bank. But, could we someone steal as much from them? Looks like it.

http://www.macrumors.com/2014/10/12/apple-pay-setup-revealed-training-begins/

Apple Pay Setup Process Revealed as Retail Employees and Partners Begin Training

Apple has begun preparing its retail employees and retail partners for the upcoming launch of its Apple Pay mobile payments service with a host of new training materials that show the feature in action, reports 9to5Mac.

Users will be able to set up Apple Pay in Passbook or through the Settings app, as up to eight credit or debit cards be connected with an iTunes account or by scanning one in with the iPhone's camera. Every card connected to the service will allow users to access a number of features, including the ability to see a simple transaction list, the ability to turn on push notifications, and an area that allows quick access to a bank's phone number and an accompanying app. Passbook will also be able to automatically update an expired card with a new expiration date without the need to re-enter information.

(Related)

http://www.securityweek.com/paypal-mobile-api-flaw-allows-security-feature-bypass

PayPal Mobile API Flaw Allows Security Feature Bypass

For security reasons, PayPal accounts are temporarily blocked if someone enters incorrect passwords several times. In order to have the account unblocked, the user must answer a series of security questions.

While this security feature is enforced in the regular Web application, the mobile API doesn't check if the account is restricted before allowing the user to attempt to log in again, Benjamin Kunz Mejri, Vulnerability Lab founder and the one who identified the issue, revealed in an advisory published last week.

Biometric security.

http://www.businessinsider.com/banks-use-voiceprint-on-calls-to-detect-fraud-2014-10?google_editors_picks=true

Banks Are Harvesting Your 'Voiceprint' On The Phone To See If You're Lying

… Two major U.S. banks, JPMorgan Chase & Co. and Wells Fargo & Co., use voice screening, also known as voice biometric blacklists, according to three people familiar with the arrangements, all of whom spoke on condition of anonymity because the system was meant to remain secret.

… "It's in the background. It doesn't affect the call in any way," said Inscoe. "Nobody even knows it's happening."

Healthcare. Apparently the potential to make huge amounts of money is attracting everyone.

http://venturebeat.com/2014/10/12/the-doctor-will-see-you-now-through-google/

The doctor will see you now — through Google

… Developer Jason Houle noticed an interesting feature when he googled “knee pain” on an Android device recently: Google was offering him to “talk with a doctor now” through a video chat. He posted a screenshot to Reddit on Friday, and Engadget confirmed yesterday that Google was indeed testing the feature.

The extraordinary aspect of the feature is that it suggests Google does actually harbor major ambitions for its expert-chatting feature, Helpouts, specifically in the domain of health care.

… It’s HIPAA-compliant, ensuring doctors won’t need to worry about the security of patient information, as VentureBeat reported last year.

I hypothesize a zombie attack in my Disaster Recovery class, perhaps I could work robots into my Computer Security class? Will there be a market for drones (balloons?) I can fly to establish that I do use the air over my property and that drones could interfere with that use?

http://www.bespacific.com/self-defense-robots/

Self-Defense Against Robots

A. Michael Froomkin and Zak Colangelo on “Self-Defense Against Robots”

“Deployment of robots in the air, the home, the office, and the street inevitably means their interactions with both property and living things will become more common and more complex. This paper examines when, under U.S. law, humans may use force against robots to protect themselves, their property, and their privacy. In the real world where Asimov’s Laws of Robotics do not exist, robots can pose—or can appear to pose—a threat to life, property, and privacy. May a landowner legally shoot down a trespassing drone? [Make my day! Bob] Can she hold a trespassing autonomous car as security against damage done or further torts? Is the fear that a drone may be operated by a paparazzo or a peeping Tom sufficient grounds to disable or interfere with it? How hard may you shove if the office robot rolls over your foot? This paper addresses all those issues and one more: what rules and standards we could put into place to make the resolution of those questions fairer to all concerned. The default common-law legal rules governing each of these perceived threats are somewhat different, although reasonableness always plays an important role in defining legal rights and options. In certain cases—drone overflights, autonomous cars—national, state, and even local regulation may trump the common law. Because it is in most cases obvious that humans can use force to protect themselves against actual physical attack, the paper concentrates on the more interesting cases of

(1) robot (and especially drone) trespass,

(2) robot (and especially drone) spying, and

(3) responses to perceived threats by robots—perceptions which may not always be justified, but which sometimes may nonetheless be considered reasonable in law.

We argue that the scope of permissible self-help in defending one’s privacy should be quite broad. We also identify seven problems in current law relating to human-robot interaction, all of which involve some kind of uncertainty — usually about what a robot can or will do — and suggest ways of solving or at least ameliorating them, either by making robots less potentially dangerous (banning the arming of robots) or by requiring robots to give clearer notice of their capabilities. We conclude by looking at what the law on human self-defense against robots might tell us about a robot’s right to not be harmed by a human.”

Could this be how we get Russia to back off the Ukraine when “sanctions” don't work? Does Saudi Arabia owe us a favor this big?

http://www.businessinsider.com/russia-saudi-arabia-and-oil-prices-2014-10?google_editors_picks=true

Saudi Arabia's Oil Price 'Manipulation' Could Sink The Russian Economy

The vice-president of Russia's state-owned oil behemoth Rosneft has accused Saudi Arabia of manipulating the oil price for political reasons. Mikhail Leontyev was quoted in Russian media as saying:

Prices can be manipulative. First of all, Saudi Arabia has begun making big discounts on oil. This is political manipulation, and Saudi Arabia is being manipulated, which could end badly.

The news comes as Reuters reports Saudi officials have been privately admitting to oil market participants that they are comfortable with lower oil prices. According to the news service, the Organization of the Petroleum Exporting Countries (OPEC) is willing to accept prices as low as $80 a barrel for as much as the next two years.

Falling prices are of particular concern to Russia. Russia needs high oil prices to buoy its economy. The country has seen its economic performance slow under the weight of sanctions over Ukraine and weakening domestic demand.

One desktop per course. It reduces the clutter...

http://www.tekrevue.com/tip/virtual-desktops-windows/

Don’t Wait for Windows 10: How to Use Virtual Desktops in Windows XP and Up

One of the big new features Microsoft is touting in Windows 10 is virtual desktops, something that OS X and Linux users have long enjoyed. But while virtual desktops might be getting some tweaks for its public debut in Windows 10, the core technology required for the feature has been available in Windows for years — it’s just been hidden.

Starting way back in Windows XP, Microsoft built a hidden Windows architecture called “desktop objects,” which let Windows launch separate Explorer processes to create up to four virtual desktops. The company now provides a free utility called Desktops that lets users access this hidden Windows feature with a clean and simple Taskbar-based user interface.

Gaming was not a large share of GDP 100 years ago. Now, one game can pull in $1 Billion.

http://dailygadgetry.com/league-legends-hit-1-billion-revenue/4537

League of Legends to Hit $1 Billion in Revenue

… Despite the fact that the game is free, revenue is made from the in-game purchases that users make in order to enhance the game. The company has now suggested that by the end of the year, they would have reached the $1 Billion mark.

For my students who insist on chattering in class! Android App.

Spreaker Studio

https://play.google.com/store/apps/details?id=com.spreaker.android.studio&hl

– take over the entire production of your own podcast or radio show with Spreaker Studio. It transforms your device into a fully-equipped radio studio, allowing you to broadcast live or pre-record podcasts while adding tracks and sound effects. Start an active relationship with your listeners by interacting with them directly.

(Related)

http://www.makeuseof.com/tag/run-android-apps-chrome-mac-linux-windows/

How To Run Android Apps in Chrome on Mac / Linux / Windows

It’s now possible to run Android apps in the Chrome browser — it just takes a little bit of work.

Google has officially brought four Android apps to Chromebooks, so it would seem that it’s only a matter of time before more and more Android apps become officially available on the Chrome browser. If you can’t wait, however, let’s run through a few options for running Android apps in Chrome right now.

99 cent Apple App. Formats as well as lists.

View Source

https://itunes.apple.com/us/app/view-source-html-javascript/id917660039

– is an app plus an iOS 8 Safari extension that makes it easy to do one key web developer task: view the HTML, JavaScript and CSS source of any web page, with beautiful and customisable syntax highlighting. As an app, you can enter a URL and immediately see the source code behind it. As an extension, it’s even easier.

We will add this to our Data Mining and Data Analytics course. Perhaps we can create some Open Source tools for smaller businesses. (And of course, my Ethical Hacker are interested!)

http://fortune.com/2014/10/10/ge-data-robotics-sensors/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+fortunebrainstormtech+%28Fortune+Brainstorm+Tech%29#

How GE generates $1 billion from data

The company can now offer predictive maintenance and optimization services for more than $1 trillion worth of Internet-connected industrial equipment, ranging from medical equipment to jet engines.

… For GE, this is the next phase of the “Industrial Internet,” its in-house phrase for what others call the Internet of Things—the ever-growing collection of connected devices “talking” to businesses with valuable data.

This phenomenon is worth an estimated $1 billion in incremental revenue for the company this year alone, mostly in the form of advanced asset performance management services, according to GE’s top executive.

… Using its Predix technology, GE already captures 50 million data points collected and communicated by 10 million sensors installed on $1 trillion worth of equipment ranging from medical imaging systems to locomotives to jet engines, Immelt said.

… By the end of 2014, there will be more than 40 applications and services based on GE’s platform but the company hopes to spur many others by making Predix available to businesses interested in developing industry-specific solutions.

This could be amusing.

http://www.bespacific.com/uh-law-center-debuts-first-database-fortune-500-company-codes-conduct/

UH Law Center debuts first database of Fortune 500 company codes of conduct

“The University of Houston Law Center today released a searchable database that contains the compliance codes for Fortune 500 companies. The project was led by Houston attorney Ryan McConnell, an adjunct professor at the University of Houston Law Center. McConnell worked with a team of recent graduates and current students to develop the database, which covers 42 different topics.

“The free database allows any company to conduct benchmarking on virtually every compliance area covered in a code of conduct and to spot compliance trends within their industry,” McConnell explained. “In addition to proactively building a program, when compliance failures occur, whether a foreign bribery violation or environmental issue, stakeholders – whether they are shareholders in a lawsuit or criminal investigators – frequently scrutinize the company’s compliance program. This database provides a powerful tool for anyone to evaluate the strength of a company’s compliance program, including subject matters addressed in the code and the organization’s core values.”

The Wall Street Journal has already dubbed the online tool as “catnip for compliance officers.”

Perhaps something my next Statistics class could tackle?

http://www.theatlantic.com/technology/archive/2014/10/no-one-knows-how-teens-listen-to-music/381348/

No One Knows How Teens Listen to Music

… After surveying a national group of 7,200 teens, analysts at the research arm of Piper Jaffray discovered that teens like listening to music the 2000-and-late way, through downloaded music onto iTunes libraries or MP3 players:

That's 42 percent of teens listening to music through MP3s, according to the bank. But what does that statistic mean? Piper Jaffray told us that the "42 percent" figure was compiled from four survey questions, but it hasn't revealed how. Nor has it indicated what that percentage indicates—whether it's 42 percent of teens preferring MP3s over other options, or if it's that, 42 percent of the time they listen to music, teens are using MP3s to do it.

… That's a 13 percent increase this year for MP3s. Given those stats, maybe Apple shouldn't have discontinued the iPod.

This game would be better if we could overwrite the face of the lawyer. (You can play these games on your PC.)

http://www.makeuseof.com/tag/free-android-game-play-scumbag-lawyer-rpg-devils-attorney/

Free Android Game: Play A Scumbag Lawyer In RPG Devil’s Attorney

… Devil’s Attorney, a game set in the 1980s and starring a defense attorney dedicated to keeping criminals on the streets, is free until the end of next week as part of a Humble Mobile Bundle promotion. All the games offered are worth checking out, but even if you’re not interested in the bundle, there’s no reason to not pick up this gem.

For my Ethical Hackers (and six-year-olds everywhere).

TakeItApart

https://www.takeitapart.com/

– is a place for the world to share photo-driven disassembly guides. It is a place to see how to take apart everyday things, and to find things to do once inside. It will void the warranties of devices, but in the process, you may learn a lot about how a device works internally. It can be a simple Zippo lighter or a complicated MacBook Air.

Optimism. Sometimes it's really funny.

http://dilbert.com/strips/comic/2014-10-12/

For my Ethical Hackers, a challenge: I don't think anyone liked the conclusions we reached at yesterday's Privacy Foundation seminar. As the world fills (and I mean that literally) with sensors connected to the Internet, it will be increasingly difficult to avoid, evade or escape being “sensed” as you move through the world.

Marriott found a way to force your wifi devices to use their wifi so they could charge you for that “service.” The FBI can force your cell phone to connect via their “simulated” cell phone towers, so they can collect metadata (and perhaps intercept your conversation).

If we can collect similar technologies to override all the sensors we might contact and make it small enough to carry in your pocket, we could become a “roach motel” for sensor data. Data enters but never leaves.

Our task then is to replace the actual sensor data with simulated data that properly reports that it has “nothing to report.” This is significantly more difficult than using a certain law school professor's name on your King Sooper's loyalty card. We will need to identify each unique type of device (and there will be thousands upon thousands) and then generate an accurate “false signal.”

Merely blocking all sensor data turns us into a “Black Hole” which flags us as “highly suspicious, probably terrorists” and may automatically summon the black helicopters or even a drone-launched smart bomb.

I'm not sure that even IBM's Watson could do this. (But it might be fun to try.)

(Related) Knowing the tools used to surveil you, allows you to take anti-surveillance measures.

http://www.securityweek.com/hackers-show-nsas-capabilities-are-not-magic

Hackers Show the NSA's Capabilities Are Not Magic

A group of security researchers, hardware hackers, hardware developers and hobbyists have set out to demonstrate that many of the tools similar to those used by the United States National Security Agency (NSA) for surveillance operations can be reproduced on a low budget with open source software and hardware components. The project, called the "NSA Playset," came out of a collaboration between security researcher Dean Pierce and Michael Ossmann, founder of Great Scott Gadgets. Shortly after the NSA's ANT catalog was leaked online, they recruited several others who had already implemented or were working on implementing capabilities that were similar to the ANT tools.

The ANT catalog is a 48-page classified document containing information on the technologies used by the NSA's Tailored Access Operations (TAO) unit for cyber surveillance. The document is one of the many files obtained by the former NSA contractor Edward Snowden.

Local. See how easy it is to “breach” privacy? If they had put the survey in an envelope, there would have been no breach.

http://www.9news.com/story/news/local/2014/10/10/colorado-health-officials-announce-privacy-breach/17055779/

Colorado health officials announce privacy breach

Colorado health officials say they accidentally violated the medical privacy of about 15,000 people in a recent postcard mailing.

… Whether someone receives behavioral health care services is considered protected private medical information.

Soon it will be easier to list the retailers who have not been breached.

http://online.wsj.com/articles/sears-reports-data-breach-at-kmart-1412979038

Kmart Stores Hit by Data Breach

Sears Holdings Corp. said the payment systems at its Kmart stores were breached by malicious software, the latest in a string of major retailers that have been successfully attacked by hackers.

The breach, believed to have started in early September, was discovered Thursday, Sears said, noting some debit and credit-card numbers of customers who shopped at Kmart were compromised.

… Chris Brathwaite, a Sears spokesman, declined to say how many credit and debit cards were affected. [They don't know? Bob]

Not the most compelling argument, but still worth watching this 20 minute video.

http://www.ted.com/talks/glenn_greenwald_why_privacy_matters

Why Privacy matters

Glenn Greenwald was one of the first reporters to see — and write about — the Edward Snowden files, with their revelations about the United States' extensive surveillance of private citizens. In this searing talk, Greenwald makes the case for why you need to care about privacy, even if you’re “not doing anything you need to hide."

I could use this in my classroom. Smile and nod, your grade goes up. Frown and shake your head, your grade goes down.

Comedy club charges per laugh with facial recognition

Joe Cadillic sends along this eyebrow-elevating news from BBC:

A comedy club in Barcelona is experimenting with charging users per laugh, using facial-recognition technology to track how much they enjoyed the show.

The software is installed on tablets attached to the back of each seat at the Teatreneu club.

Each laugh is charged at 0.30 euros (23p) with a cap of 24 euros (£18). Takings are up so far.

The project was developed to combat falling audience numbers.

Partnering with advertising agency The Cyranos McCann, the experiment was a reaction to increased government taxes on theatre tickets, which in turn led to drastic drops in audience numbers.

Read more on BBC.

OK, but apart from the obvious surveillance/privacy issues, wouldn’t this encourage the audience not to laugh too much – so they save money?

Would this money be better spent ensuring that all students have digital tools? That they are trained to use them? That they work better than non-digital tools?

Ed. Data-Mining Research Effort Wins Federal Grant, Raises Privacy Questions

Benjamin Herold reports:

The National Science Foundation earlier this month awarded a $4.8 million grant to a coalition of prominent research universities aiming to build a massive repository for storing, sharing, and analyzing the information students generate when using digital learning tools.

The project, dubbed “LearnSphere,” highlights the continued optimism that “big” educational data might be used to dramatically transform K-12 schooling.

It also raises new questions in the highly charged debate over student-data privacy.

Read more on Education Week (reg. Required).

I suppose it's always a matter of interpretation. I look at this as proof that there was no plan for dealing with “too big to fail” bank failures, and that they are scrambling to come up with one. Eventually, they will need to through someone off the troika to appease the wolves.

http://www.ft.com/cms/s/0/1dd4bca2-508c-11e4-9822-00144feab7de.html

US and UK to play financial ‘war game’

Britain and the US will stage the first transatlantic simulation of a crisis in a large bank on Monday. It is a sign of growing confidence that the authorities can now deal with the failure of large institutions.

All of the main players who would need to be involved in a failure of a company such as Bank of America, Goldman Sachs, Barclays or HSBC will gather in Washington DC to make sure they would know what to do, who to call and how to inform the public.

The move reflects the authorities’ view that they are getting close to solving the “too big to fail” problem, even for cross-border banks, outside a full-blown system-wide crisis.

Biometrics: Be sure to bring your (someone's) finger!

http://www.geekwire.com/2014/alaska-airlines-thumbprint-boarding-tickets/?google_editors_picks=true

Check in with your finger: Alaska Airlines testing ‘e-thumb’ technology

Physical boarding passes — and even mobile ticketing — may be a thing of the past if the new “e-thumb” technology that Alaska Airlines is currently testing catches on.

Bloomberg reports that the Seattle-based airliner has installed fingerprint readers in four of its airport lounges as a way for fliers to check-in without having to show an employee a boarding pass and physical identification.

Logic like this is what convinces me I'd never make it as a lawyer.

Judge Rejects Defense That FBI Illegally Hacked Silk Road—On a Technicality

Andy Greenberg reports:

Lawyers for Ross Ulbricht have spent the last two months shifting the focus from their client, charged with creating the billion-dollar drug market the Silk Road, and putting it onto the potential illegality of the FBI’s investigation. Now the judge in that case has spoken, and it’s clear she intends to put Ulbricht on trial, not the FBI.

In a 38-page ruling Friday, Judge Katherine Forrest dismissed the defense’s motion to suppress evidence that hinged on the argument that law enforcement had violated Ulbricht’s Fourth Amendment right to privacy from unreasonable searches.

Read more on Wired.

[From the article:

But the Judge’s rejection of that argument comes down to what may be seen as a fateful technicality: she argues that even if the FBI did hack the Silk Road server, Ulbricht hadn’t sufficiently demonstrated that the server belonged to him, and thus can’t claim that his privacy rights were violated by its search.

Definitely, positively, absolutely something for my students! Can we find one that does this on other phones?

Mr Silent

https://play.google.com/store/apps/details?id=com.biztech.mrsilent&hl=en

– is an Android application, which offers a solution to those who wish to keep their mobile phones on silent mode for specific geographical locations, time, occasions and for specific contacts. You simply need to provide the desired conditions – occasions, times and geographical locations when you would like to keep your mobile silent.

I probably shouldn't laugh at these...

Hack Education Weekly News

… For-profit giant Kaplan University launches “Open College,” which “will include free online services and personalized mentoring to help people identify and organize prior experience and skills that could count toward a degree or move them closer to a new career.

… The Academy of Art University used to grant students permanent licenses for the Adobe CS6 Master Collection as part of their tuition. But apparently Adobe has deactivated these licenses, without any warning, demanding students now pay a $60/month subscription fee to continue access.

… Hackers have released a cache of 13GB of Snapchat users’ photos. Although users believe Snapchats disappear after viewing, a third-party app has apparently been collecting these images for several years. About half of Snapchats’ users are between age 13 and 17. “4chan users say the collection of photos has a large amount of child pornography, including many videos sent between teenagers who believed the files would be immediately deleted after viewing.”

I'll be at the Privacy Foundation seminar ( http://www.law.du.edu/index.php/privacy-foundation ) today, learning what could possibly go wrong with Internet connected eCigarettes.

http://www.theatlantic.com/technology/archive/2014/10/the-cigarette-that-charges-for-every-puff/381305/

The Cigarette That Charges for Every Puff

A recent patent from Phillip Morris imagines a web-connected e-cig. It could help users quit—but it could also open their pipe up to tracking and hacking.

… Once smartened-up, the Internet-connected pipe can do many things. Not-so-usefully, it could let users initiate a puff from the computer—in case, I suppose, old-fashioned inhaling gets too hard. Slightly-more-usefully, it could automatically send doctors information about how much tobacco was burned and for how long. That feature could be especially handy if the cigarette’s user is participating in a clinical trial, or trying—with someone or something else’s help—to stop smoking.

… In the patent’s ninth column, its authors propose one feature that might help them understand smoking’s costs: pay-as-you-puff. Smokers, it says, might want to charge themselves a little bit of money every time they take a hit:

… Goldman Sachs has identified e-cigarettes of all sorts as one of the eight great disruptive technologies of 2014, and it’s named the Internet of Things as the “next mega-trend.”

… when you connect some previously dumb object to the Internet, it can be both hacked, and you can be tracked.

… And—perhaps most importantly, and as pay-as-you-smoke testifies—when you connect an object to the Internet, you don’t quite own it the same way as you did before.

“Contained?” Bold words.

http://online.wsj.com/articles/international-dairy-queen-confirms-data-breach-1412891919

International Dairy Queen Confirms Data Breach

International Dairy Queen Inc. became the latest company to confirm a data breach, announcing Thursday the “Backoff” malware affected payment card information at 395 of its 4,500-plus U.S. locations.

… The company said “based on our investigation, we are confident that this malware has been contained.”

(Related) Listed so you know when to panic!

http://www.bizjournals.com/denver/news/2014/10/09/12-colorado-dairy-queen-stores-hit-by-data-breach.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+industry_2+%28Industry+Banking+%26+Financial+Services%29

12 Colorado Dairy Queen stores hit by data breach

Twelve Colorado Dairy Queen and Orange Julius locations were among the 395 hit by information-thieving hackers nationwide since Aug. 1, the company says.

Government, thy name is not clarity. Something to keep an eye on.

Is the precedent set for when a contractor gets breached?

Drew Hansen reports:

As we reported, the Office of Personnel Management’s decision not to renew two contracts with Falls Chuch-based US Investigations Services LLC led to the loss of 2,500 jobs. But it might also have set a precedent for how government handles contractor breaches.

As a reminder, in July, the background checks division at USIS was hit by a cyber attack that reportedly affected 25,000 government employees. USIS suspected it to be “state-sponsored.” The government quickly suspended work with USIS and then opted to drop its contracts with the company.

Read more on Washington Business Journal.

If the government was going to set a precedent of terminating contracts for security or data breaches, they probably should have set it years ago after a number of breaches involving SAIC, no?

In this case, I wonder if the government would have cancelled the USIS contract if it had not been for an earlier problem with USIS not running the background checks it was supposed to run.

So is it really one strike and you’re out? I think the answer is “not really, but if your security is really abysmal, maybe.”

Picture this...

http://www.businessinsider.com/snapchat-hacked-the-snappening-2014-10?google_editors_picks=true

Hundreds Of Thousands Of Teens Have Had Their Snapchat Photos And Videos Intercepted By Hackers

A giant database of intercepted Snapchat photos and videos has been released by hackers who have been collecting the files for years. Shocked users of the notorious chat forum 4chan are referring to the hack as "The Snappening," noting that this is far bigger in scale than the iCloud hacks that recently targeted celebrities.

Underground photo trading chatrooms have been filled in recent weeks with hints that something big was coming. Thursday night it finally arrived: A third-party Snapchat client app has been collecting every single photo and video file sent through it for years, giving hackers access to a 13GB library of Snapchats that users thought had been deleted.

This has potential but has no RSS feed! Good idea poorly executed.

http://www.bespacific.com/eff-launches-ifightsurveillance-org-counter-surveillance-success-stories/

EFF Launches IFightSurveillance.org and Counter-Surveillance Success Stories

“The Electronic Frontier Foundation (EFF) today launched IFightSurveillance.org, a new site showcasing digital privacy advocates from around the world who are leading the fight against mass surveillance. The site includes figures from the organization’s growing list of Counter-Surveillance Success Stories, a set of guides showing how individuals and organizations have taken on state and corporate spying in their own countries—and won. Translated into 16 languages, IFightSurveillance.org highlights images and quotes from activists, business leaders, lawyers, and technologists.

Is this a “Right to be Forgotten” issue or a “Free Speech” issue?

Google Suffers New Privacy Setback in Japan

Megumi Fujikawa reports:

Google Inc. has suffered another setback on privacy issues, this time in Japan, following a European court ruling that gave Internet users the right to ask the company to remove information about them from search results.

The Tokyo District Court on Thursday issued an injunction, ordering Google to remove some Internet search results about a Japanese man that are considered to be violating his privacy, representatives from both sides said.

Though the Tokyo court order has far less sweeping implications than the precedent-setting ruling by the European Court of Justice, it touches on similar issues.

Read more on WSJ.

Not sure I get this. None of this is new. All of this has been addressed and (more or less) solved.

http://www.securityweek.com/new-research-examines-ways-bridge-cybersecurity-workforce-gap

Report Examines Ways to Bridge Cybersecurity Workforce Gap

A new report from the (ISC)² Foundation and University of Phoenix highlights the challenges posed by the shortage of cybersecurity professionals and identifies key ways for schools and businesses to address the situation.

Culled from conversations with tech industry, higher education and talent development leaders, the report identifies key gaps challenging employers related to competency, professional experience and "education speed-to-market."

… "With the rising demand for qualified cybersecurity talent, industry leaders are increasingly calling for a common definition of the scope of work that cybersecurity covers—and agreed-upon competencies that cybersecurity professionals must demonstrate," according to the report. [The Common Body of Knowledge has been out there for some time. http://www.techrepublic.com/article/build-your-skills-learn-these-10-security-domains-to-obtain-cissp-certification/ Bob]

… On the higher education level, the report recommends among other things that schools build case studies into the curriculum to ensure students have to apply their knowledge and skills in real-world scenarios. [There are several Computer Security lab tools to walk students through security software or analysis tools. Bob]

… In regards to professional experience, the report recommends industry associations support student membership, and advises employers to hire interns and partner with universities. Colleges meanwhile should create networking opportunities for students to use to build their resumes and experience, the report (PDF) adds.

Have a GoPro camera? Planning to do something truly stupid? Be sure to broadcast it live!

Livestream

https://itunes.apple.com/us/app/livestream/id493086499?mt=8

– Watch or broadcast live events from your iPhone or iPad. Watch live local news, sports, music, conferences and thousands of other events broadcasting live from all over the world. Follow your friends and get notified when they go live. Broadcast live from your device camera to viewers watching on Livestream.com or Livestream apps.

Interesting that the Privacy Foundation had selected the Internet of Things as tomorrow's seminar topic months before Gartner published this list. Join us! Go to http://www.law.du.edu/index.php/privacy-foundation and register today!

http://www.computerworld.com/article/2692619/gartner-lays-out-its-top-10-tech-trends-for-2015.html

Gartner lays out its top 10 tech trends for 2015

The Internet of Things, and everything that's part of its universe, including smart machines, pervasive analytics and 3D printing, are on Gartner's annual list of strategic technologies for the year ahead.

1: Computing Everywhere. To Gartner, this simply means ubiquitous access to computing capabilities.

2: The Internet of Things (IoT).

3: 3D printing.

4: Advanced, Pervasive and Invisible Analytics. Every application is an analytical app today.

5: Context Rich Systems. Knowing the user, the location, what they have done in the past, their preferences, social connections and other attributes all become inputs into applications.

6: Smart Machines.

7: Cloud and Client Computing.

8: Software Defined Applications and Infrastructure.

9: Web-Scale IT.

10: Security. In particular, Gartner envisions more attention to application self-protection.

We can does not mean we must.

Google Can Read Your Emailed Bills and Remind You to Pay Up

Alistair Barr reports:

Google already scans users’ Gmail email accounts to show more relevant ads. Now the Internet giant is scouring emails for bills.

The company said Tuesday that its Google Search mobile app can now remind users when bills are due by spotting emailed bills in their Gmail accounts and automatically reading the important details.

Users can tap the microphone icon in the app and ask “Show me my bills” or “My bills due this week,” and it will show upcoming bills, how much is owed, as well as a summary of past bills.

Read more on WSJ.

Interesting. I don't think they mean their targets are dumb, rather that they don't think their security needs through. For instance, Al Queda leaders used their cellphones normally until President Clinton mentioned that we could track (target) them using the cellphone signal. They all stopped using cellphones.

Judge Rejects DOJ’s Secrecy Argument That Public Doesn’t Know How to Evade Location Tracking

Kevin Gosztola writes:

In a case involving a Freedom of Information Act request for information related to government policies and procedures for law enforcement use of cell phone tracking, a federal judge has ordered the release of records, which the Justice Department sought to keep secret by claiming they would “alert law violators”—otherwise known as criminals—to how to evade detection.

The ACLU in Northern California and San Francisco Bay Guardian filed a lawsuit seeking documents on location tracking technology on July 31, 2012. The Justice Department has produced a few documents but has continued to insist that many of the documents requested are “work product” so they are protected from disclosure. The agency has also refused to search for documents that were requested.

Read more on Firedoglake.

e-Drugs for recreation? What could possibly go wrong? If you can elevate your mood, can my Ethical Hackers bring you back down? Will there be a record of this mind alteration after the (inevitable) accident? Could this be why Facebook was conducting those “experiments” on its users?

http://blogs.wsj.com/venturecapital/2014/10/08/thync-to-launch-first-mood-altering-wearable-with-13m-led-by-khosla/

Thync to Launch First Mood-Altering Wearable With $13M Led by Khosla

… After working in stealth for several years, Thync Inc. has announced that next year it will launch the first wearable health gadget for the mind, and that it has raised $13 million from venture capitalists to do so.

… People world-wide spend billions every year on various products to change or enhance their mood, including energy drinks, alcohol, coffee and other stimulants and depressants. Thync will attempt to bring consumers to their happy place by using electrical waveforms and neuro-signaling algorithms, Dr. Tyler said.

The head-worn device will send electrical signals to regions of the brain, he said. Though it will be subject to regulation, the company will seek to sell the wearable as a consumer device, meaning it will have a less rigorous pathway to approval than new drugs or many medical devices.

Sort of like stalking you based on your phone's unique “fingerprint.” ...and Facebook isn't the only one doing this.

http://www.wired.com/2014/10/facebook-extends-ad-targeting-talents-yet/

Even More Facebook Ads Will Now Appear in Your Other Apps

Facebook is extending the reach of its ad-targeting talents—again.

On Tuesday, the social networking giant invited all mobile app developers and publishers onto the Facebook Audience Network, a mobile advertising network that extends beyond Facebook itself and onto third-party mobile apps.

… That means any developer or publisher can sign up to display the network’s ads inside their apps—and take a cut of the revenue.

… The Audience Network is just one way that Facebook is expanding this sort of ad targeting beyond its own social network. Last week, the company unveiled Atlas, a separate tool that allows companies to grab ads from all sorts of sources and serve them across all sorts of sites and services, and it too can target ads based on Facebook data.

With the Audience Network, Sriram Krishnan explains, Facebook targets users via a mobile device identifier—a software token that’s specific to a particular phone or tablet.

We'll need to integrate this into our Data Mining and Data Analysis classes.

Information Accountability Foundation Releases a Unified Ethical Frame for Big Data Analysis

Martin Abrams writes:

The Foundation has released the first paper from its Big Data Ethics Project. The project’s purpose is to establish tools for both companies and enforcement agencies to assure people get the benefits of big data but are not boxed in by inappropriate analysis or application. Part A of the project establishes the basis for the other three parts that will follow. (Read Part A.)

The term algorithmist was invented a few years ago to define the person who would fix all the ethical problems associated with big data. Since then, I have been interested in just how they would they do that.

Read more on IAF.

Everything you ever wanted to know about Microsoft but were afraid to ask? Hardly.

http://www.vanityfair.com/business/2014/11/satya-nadella-bill-gates-steve-ballmer-microsoft

The Empire Reboots

Definitely something for my students.

http://q13fox.com/2014/10/08/if-you-purchased-a-red-bull-since-2002-they-owe-you-10-heres-how-to-get-it/

If you purchased a Red Bull since 2002, they owe you $10 – here’s how to get it

Customers who purchased a Red Bull product between 2002 and Oct. 3, 2014 are owed $10 cash or $15 in Red Bull products, according to a settlement the company agreed to last month.

… To receive a $10 cash payment or $15 in Red Bull products, you must submit a claim form. No proof of purchase is necessary to obtain settlement benefits.

On this website (filed online by no later than March 2, 2015)

As it happens, I'm teaching a spreadsheet class. This will be a useful “handout.”

http://www.makeuseof.com/tag/10-helpful-spreadsheet-templates-help-manage-finances/

10 Helpful Spreadsheet Templates To Help Manage Your Finances

The Adobe eBook reader. This will likely go well beyond kerfuffle. Fortunately, I use DE2 – downloaded from my local library.

Adobe is Spying on Users, Collecting Data on Their eBook Libraries

Nate Hoffelder reports:

Adobe has just given us a graphic demonstration of how not to handle security and privacy issues.

A hacker acquaintance of mine has tipped me to a huge security and privacy violation on the part of Adobe. That anonymous acquaintance was examining Adobe’s DRm for educational purposes when they noticed that Digital Editions 4, the newest version of Adobe’s Epub app, seemed to be sending an awful lot of data to Adobe’s servers.

My source told me, and I can confirm, that Adobe is tracking users in the app and uploading the data to their servers. (Adobe was contacted in advance of publication, but declined to respond.)

Read more on The Digital Reader.

Update: The Register now reports that they have also confirmed the allegations, and that Adobe is “looking into the matter.” Because such slurping seems to violate Adobe’s representations to customers, I hope the FTC is “looking into the matter” too.

[From the article:

But wait, there’s more.

Adobe isn’t just tracking what users are doing in DE4; this app was also scanning my computer, gathering the metadata from all of the ebooks sitting on my hard disk, and uploading that data to Adobe’s servers.

In. Plain. Text.

And just to be clear, this includes not just ebooks I opened in DE4, but also ebooks I store in Calibre and every Epub ebook I happen to have sitting on my hard disk.

As April showers bring May flowers... Hacks that grab customer information invite spear phishing. (Perhaps this will be Russia's way of giving their hackers a “Bonus.”)

http://www.foxbusiness.com/industries/2014/10/06/jpmorgan-bracing-for-spear-phishing-campaign-sources/?cmpid=edpick&google_editors_picks=true

JPMorgan Bracing For 'Spear Phishing' Campaign: Sources

JPMorgan Chase (NYSE: JPM) officials are bracing for a massive spear phishing campaign launched by cyber thieves who broke into the bank’s servers in the biggest cyber-attack on a U.S. bank to date. Cyber criminals thought to be emanating from Russia or former Soviet satellite states hacked into numerous JPMorgan computer servers and accessed contact information like names and email addresses for 76 million customers and seven million small businesses.

For my Ethical Hackers. I see a business opportunity here.

http://www.makeuseof.com/tag/your-usb-devices-are-not-safe-thanks-badusb/

Your USB Devices Aren’t Safe Anymore, Thanks To BadUSB

… The earth-shattering revelations that USB isn’t as secure as first thought was first disclosed by security researchers Karsten Nohl and Jakob Lell in July, 2014. The malware they created – dubbed BadUSB – exploits a critical vulnerability in the design of USB devices which allowed them to hijack a user’s Internet traffic, install additional malware and even surreptitiously gain control of a user’s keyboard and mouse.

The BadUSB malware isn’t stored on the user-accessible storage partition, but rather on the firmware of a USB device – including Keyboards, phones and flash drives. This means that it’s virtually undetectable to conventional anti-virus packages, and can survive the drive being formatted.

Fortunately, would-be attackers have been unable to take advantage of BadUSB, due to Nohl and Lell not publishing the code in order to give the industry an opportunity to ready a fix. Until recently, that is.

In a talk given at DerbyCon – a computer security conference held in Louisville, Kentucky – Adam Caudill and Brandon Wilson demonstrated their successful reverse-engineering of BadBSD, and published their exploit code on code-sharing platform GitHub.

There is always more to learn.

Working Paper: Data Breaches in Europe: Reported Breaches of Compromised Personal Records in Europe, 2005‐2014

Data Breaches in Europe: Reported Breaches of Compromised Personal Records in Europe, 2005‐2014

Philip N. Howard

… You can download the full report here (pdf)

Pledges don't protect anything. Will their actions match their words?

http://www.geekwire.com/2014/microsoft-pledges-keep-students-data-private/?google_editors_picks=true

Microsoft pledges to keep students’ data private

Microsoft announced today that it is one of the first companies to sign a new pledge designed to protect students’ privacy at a time when more technology is flooding into the classroom.

The “K-12 School Service Provider Pledge to Safeguard Student Privacy,” which was organized by the Future of Privacy Forum and the Software & Information Industry Association, is designed to identify companies that will keep data from students safe.

… Today’s announcement comes a week after California Governor Jerry Brown signed a law that restricts what companies can do with student data.

For my Data Mining students.

http://uncovercalifornia.com/content/21945-wsj-microsoft-has-signed-letter-intent-acquire-israeli-text-analysis-firm-equivio

WSJ: Microsoft has signed letter of intent to acquire Israeli text analysis firm Equivio

According to a Wall Street Journal (WSJ) report, US software giant Microsoft has signed a letter of intent to purchase Israeli text analysis firm Equivio.

… The company's clients include the US Department of Justice, the Federal Trade Commission, KPMG and Deloitte.

The text analysis software developed by Equivio can, with the help of machine learning algorithms, group together relevant texts from massive amounts of documents, including emails as well as other organizational social and collaboration networks.

The list of the users of Equivio's text analysis software clearly indicates that the company's technology is currently being used by organizations that provide litigation support services to law firms and corporate legal departments trying to dig out relevant data - like legal contracts - from large amounts of documents.

“I keep finding all these new continents that people are adding to the world.” C. Columbus

http://www.theatlantic.com/technology/archive/2014/10/the-quiet-rise-of-the-satellite-spy-national-geospatial-intelligence-agency/381179/

The Quiet Rise of the Satellite Spy Agency

As far as intelligence agencies go, the National Geospatial-Intelligence Agency has remained relatively low profile—attracting neither the intrigue of, say, the CIA nor the umbrage directed toward the National Security Agency.

For my students.

http://www.makeuseof.com/tag/google-stay-twitter-government-tech-news-digest/

GitHub Gives Away Free Developer Tools

GitHub has launched the GitHub Student Developer Pack, a set of developer tools aimed exclusively at students. The GitHub Student Developer Pack, released as part of GitHub Education, includes hackable text editor Atom, cloud applications manager Bitnami, crowdsourcing enrichment platform Crowdflower, and database portfolio Orchestrate, as well as a host of other tools.

To be eligible for the GitHub Student Developer Pack, you need to be “a student aged 13+ and enrolled in degree or diploma granting course of study,” and provide a “school-issued email address, valid student identification card, or other official proof of enrollment.” Which seems fairly generous to us.

Interested parties should be aware that while some of the tools are being given away for free, others are being offered by platform credits which may quickly run out. But even with that caveat, it’s still a great initiative.