Centennial Man: 2010-10-24

Saturday, October 30, 2010

“It's for the children!” How else can they be trained to be submissive little sheep?

http://www.pogowasright.org/?p=16586

School Buses Tracking Kids With Fingerprint and Card Scanners

October 29, 2010 by Dissent

Caleb Johnson writes:

To ensure that kids don’t get off at the wrong stops, some school districts have started using fingerprint and card scanners to track students who ride school buses. The Desert Sands Unified School District, located just north of San Diego, began testing a Biometric Observation Security System (BOSS) on its buses earlier this month, according to USA Today. Students simply touch their fingers to a tiny screen when they get on and off the bus; if a child tries to get off at the wrong stop, BOSS sounds an alarm to notify the driver. About 30 school districts across the country, including ones in Missouri and Illinois, have begun using a similar system called Zpass. Instead of a fingerprint, the system uses an electronic card that’s tethered to a child’s backpack. [Forget your backpack and you can't “get poor Charlie of the MTA!” Bob]

I guess no one can go home with a friend any more without sirens and alarms going off, huh?

This is creepy/spooky. A high resolution photo of the World Series, that allows you to tag anyone with their Facebook profile. Think of it as a sample “facial recognition” application. (and why is the Second Baseman holding his glove that way?)

http://techcrunch.com/2010/10/29/mlbs-tagoramic-lets-you-stare-into-the-face-of-each-and-every-fan-at-the-world-series/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29

MLB’s TagOramic Lets You Stare Into The Face Of Each And Every Fan At The World Series

Were you lucky enough to attend one of the MLB playoff games this month? Then you’ll want to check out TagOramic, a nifty feature on MLB.com that was built to celebrate the Fall Classic. Over the course of the playoffs, MLB has taken some absolutely massive panoramic photos of each stadium — and they’ve taken them at high enough resolution that you can zoom in and see each and every fan.

The site has also integrated support for Facebook Connect, so even if you didn’t get to attend one of the playoff games, you can sign in and see if any of your friends have been tagged in the photo. It sounds silly, but it’s surprisingly fun to see a shot of your friend mid-hot dog, surrounded by a sea of other fans.

We have the technology, so we can do anything we want with it...

http://www.pogowasright.org/?p=16590

Brazilians will be forced to use RFID chips and GPS trackers in their cars

October 29, 2010 by Dissent

Brazil‘s government, behind the facade of open democracy, continues to advance its way as one of the most autoritarian police states in the world.

Brazilian population will be forced very soon to have in their cars identification chips (RFID), besides GPS locators and blockers.

According to several news , the brazilian government hurries to show until november of 2010 the GPS tracker that will be legally required to be in all new cars from February of 2011.

Friday, October 29, 2010

How many other Universities “assume” their faculty web sites are secure? How did the Liberty Coalition access a “faculty” web site? (Why are all these security issues obvious only in retrospect?)

http://www.databreaches.net/?p=14984

UH West O’ahu security breach affects Mānoa students

October 28, 2010 by admin

The University of Hawaii has just posted a breach notice concerning the incident described in an earlier blog entry:

The University of Hawai`i – West O`ahu (UHWO) is notifying approximately 40,000 individuals that their personal information may have been compromised.

The exposure occurred when a faculty member inadvertently uploaded files containing data including names, social security numbers, addresses, birth dates and educational information to an unencrypted faculty web server. Individuals potentially affected are students who attended the University of Hawai`i at Mānoa from 1990 – 1998 and during 2001. In addition, students who attended UHWO during Fall of 1994 or graduated from 1988 – 1993 may also be affected.

The faculty member, who is now retired from UHWO, was conducting a longitudinal study of UH students. The faculty member obtained the files from the University of Hawai`i System Institutional Research Office and placed the files containing the information onto the faculty web server in December 2009.

UHWO promptly removed the unintentionally exposed files and disconnected the affected server from the network, after Liberty Coalition, a non-profit group based in Washington D.C., notified University officials about the exposure on October 18. Different files had different information on some of the individuals, but it is believed that the aggregation of the exposed files could allow matching to create the potential for identity theft, which is highly unlikely to occur.

The FBI and Honolulu Police Department have been notified. At this time, UHWO has no evidence that anyone’s personal information was accessed for malicious intent. UHWO is also working with UH System to adopt more proactive security measures to ensure better privacy protection.

Notice what’s missing from the above? No mention that they didn’t discover the breach at all and it had to be pointed out to them.

Their full statement also includes reference to an FAQ on the incident, but it’s not available on the site at the time of this posting.

Interesting, but less that a single Computer Security lecture would provide...

http://tech.slashdot.org/story/10/10/29/0428206/Separating-Cyber-Warfare-Fact-From-Fantasy?from=rss

Separating Cyber-Warfare Fact From Fantasy

Posted by timothy on Friday October 29, @08:04AM

"This week's New Yorker magazine has an investigative essay by Seymour Hersh about the US and its part in cyber-warfare that makes for interesting reading. Hersh talks about the financial incentives behind many of the people currently pushing for increased US spending on supposed solutions to network vulnerabilities and the fine and largely ignored distinction between espionage and warfare. Two quotes in particular stood out: one interviewee said, 'Current Chinese officials have told me that [they're] not going to attack Wall street, because [they] basically own it,' and Whitfield Diffie, on encryption, 'I'm not convinced that lack of encryption is the primary problem [of vulnerability to network attack]. The problem with the Internet is that it's meant for communication among non-friends.' The article also has some interesting details on the Chinese disassembly and reverse-engineering of a Lockheed P-3 Orion filled with espionage and eavesdropping hardware that was forced to land in China after a midair collision."

Another Facebook “Privacy invasion” tool?

http://news.cnet.com/8301-13577_3-20021068-36.html?part=rss&subj=news&tag=2547-1_3-0-20

Facebook launches quirky 'friendship pages'

Facebook today launched a feature called "Friendship Pages," which lets users load up the interactions between themselves and individual friends, or between any two friends, on the social network. You'll see their posts on one another's walls, events to which both RSVP'd, photos in which both are tagged, and other interactions that you would otherwise be able to access on either friend's profile (i.e. nothing that wouldn't otherwise be public)

… This is the brainchild of a single Facebook engineer, Wayne Kao, who built the feature at one of the company's all-night "hackathons" along with a designer. "One of my favorite Facebook moments is browsing photos from friends in the News Feed after they've begun a new relationship, gotten engaged or gotten married," Kao wrote in a blog post. "It gives me a fun and meaningful glimpse of the friendship between two people I know. I realized that a similarly magical experience was possible if all of the photos and posts between two friends were brought together."

Facebook’s Dominance Leaves President No Choice

In an effort to increase voter turnout for next Tuesday’s Congressional Election, President Barack Obama has put out a call on Twitter for constituents to install a Facebook application called the “Commit to Vote Challenge.” Like a more noble version of Fast Company’s Influence Project, the Commit to Vote Challenge takes advantage of the “network effect” by using Facebook to spam your friends about voting. Facebook’s population is currently greater than that of the United States. [Which, to a Chicago politician is even more attractive than registering dead voters! Bob]

(Related) What do you do with 500 million users who have no privacy? Behavioral Advertising! (Or, “Your friends were dumb enough to buy this, so you probably will too!”

http://news.cnet.com/8301-13577_3-20021141-36.html?part=rss&subj=news&tag=2547-1_3-0-20

Facebook applies for ad-targeting patent

This is interesting: Earlier this month, Facebook filed for a patent to further hone its ad-targeting technology so that ads can be based on what a user's friends interests may be. The reason for this, it appears, is so that Facebook can better serve ads toward users who have not filled out their profiles with enough information for traditional ad targeting.

Facebook calls this second-degree targeting "inferential."

Continuing the theme of “Our security must be working, we haven't been attacked by a single Klingon since we started!” If you don't have a 'reasonable suspicion,' semantically isn't that the same as having an “unreasonable suspicion?”

http://www.pogowasright.org/?p=16550

UK: Over 100,000 stops-and-searches: zero terrorists

October 28, 2010 by Dissent

Jane Fae Ozimek reports:

When it comes to wasting police time, the biggest offenders appear to be…the police. That, at least, appears to be the conclusion of the Home Office. Its official statistics, published today, show that while police stopped over 100,000 individuals last year to “prevent acts of terrorism”, there was not a single arrest for a terror offence as a result of these stops.

This perhaps is the final nail in the coffin for the widely criticised section 44 of the Terrorism Act 2000, which gives police forces powers to stop and search individuals – in so-called “designated areas” – to prevent acts of terrorism without the need for reasonable grounds of suspicion. According to today’s report: “In 2009/10, 101,248 stops-and-searches were made under this power.

Thursday, October 28, 2010

Keeping it “small.” Now that the unknown “Henry Ford of skimmers” has commoditized (by mass producing) the card skimming tools, this fraud seems to offer a steady income with low risk.

http://www.databreaches.net/?p=14960

Credit card ‘flash attack’ steals up to $500,000 a month

October 28, 2010 by admin

Dan Goodin reports:

Credit card fraudsters may have pocketed as much as $500,000 over the past month by pursuing a new type of attack that exploits a major blind spot in payment processors’ defenses, an analyst said.

The “flash attacks” recruit hundreds of money mules who go to ATMs throughout the US and almost simultaneously withdraw relatively small sums of money from a single compromised account, according to Avivah Litan, vice president at market research firm Gartner, who follows the credit card industry. They then move on to a new account. At the end of the month, the heists can fetch as much as $500,000.

“The resulting cash transactions fly under the radar of existing fraud detection systems — they are typically small amounts that don’t raise any alarms,” Litan blogged on Tuesday.

Wednesday, October 27, 2010

This could be nothing. At least, they are not sure it is something. The servers were down over the weekend for “maintenance,” so this could be a problem introduced by those changes.

http://www.databreaches.net/?p=14937

TX: HISD investigating how its computers were hacked

October 27, 2010 by admin

Erika Mellon reports:

Houston school district officials suspect their computer system was hacked over the weekend, leaving employees and students without access to the Internet, online classes and e-mail for two days.

The electronic blackout ended late Tuesday afternoon, but the district’s police department was continuing to work with the FBI to investigate the suspected cyber-attack. HISD officials said they had found no evidence so far that hackers had tampered with personal information, such as payroll data or students’ grades.

As one of the largest employers in Houston, the school district has loads of electronic data on its 30,000 workers and 202,000 students that could have been compromised.

Read more on PCWorld.

[From the ComputerWorld article:

The Armenian man had constructed a massive botnet, at one point infecting up to 29 million computers in countries including Italy, Spain, South Africa, the US and the UK.

"We wanted to take down the botnet," Prins said. "What we also wanted to do was make sure the botnet wouldn't switch over to other infrastructure under his control."

The Dutch police decided to use a tactic they have apparently used before, taking over the computers infected with Bredolab and directing them to servers not under the control of the Armenian. Fox IT helped with that by uploading a "good" bot developed by police [Are US computer cops also doing this? Bob] to those PCs, Prins said.

… So far, at least 100,000 computers have displayed the Web page, which also has a link where people can file a complaint about Bredolab. So far, 55 people have filled out the complaint form, according to the Dutch National Prosecutor's Office.

[From the PC World article:

The action by the Dutch police is likely a breach of the Computer Misuse Act, said Struan Robertson, a technology lawyer with Pinsent Masons. Since the territorial scope of the legislation is wide, in theory it could be used against somebody in the Netherlands hacking into a U.K. computer, he said.

"There is no defense in the Computer Misuse Act for unauthorized access to another computer being for noble purposes," Robertson said. " That said, I think it is important to note it is unthinkable that anyone would prosecute for this," Robertson said. "They were making the best of a bad situation."

But in an era where fake Web pages are rampant, it begs the question of whether people will believe that the warning is legitimate. Fraudsters could also simply copy the Web page, set up a new domain and create a site that actually infects people's computers with Bredolab or other malware.

(Related) The next botnet won't be as easily defeated.

http://www.securityweek.com/rise-small-botnet

The Rise of the Small Botnet

In September, law enforcement agencies in the US and Europe announced that they had cracked a major ZeuS botnet operation allegedly responsible for the theft of over $70 million.

… Reports of such law enforcement crackdowns are increasingly common, but they represent merely the tip of the iceberg in addressing the real underlying problem. Botnets controlled by criminal enterprises all over the world continue to multiply at a steep rate, and it is now arguably the smaller, harder-to-trace operations that organizations should be the most worried about. Not only are smaller botnets cheaper and easier to build out and operate, but criminals have already realized that large-scale botnet activity attracts unwanted attention, and not just of law enforcement.

I vote “Hell Yes!”

http://www.phiprivacy.net/?p=4750

Should HHS fine entities who experience repeated avoidable security failures?

By Dissent, October 26, 2010

I’m working on a breach post for later today but started mulling over the question of whether HHS needs to start fining covered entities who have repeat breaches where the entity did not seem to adequately harden their security after the first breach or to really learn from experience.

This is 2010. The excuse “we were in the process of encrypting” or “now we’re going to encrypt” seems inadequate. HIPAA went into effect in 1996. Why are some of these easily avoidable breaches still occurring? HHS has adopted an educative and corrective approach, but how many times do some entities need to be educated before the government starts hitting them with fines in addition to the other costs of a breach?

Do you think that it would help if HHS started handing out fines to repeat offenders? If so, what scenarios would you think should lead to fines? I’d nominate inadequately secured PHI on a device stolen off-premises as my first nomination. As a close second, repeated theft of devices from hospital premises where the data at rest were not adequately protected.

Your thoughts?

(Related) Should this also go beyond lip service?

http://www.phiprivacy.net/?p=4741

Consent and privacy in HIT, redux

By Dissent, October 26, 2010

Julie Chang reported on a recent Texas Tribune interview with David Blumenthal, the national coordinator of Health Information Technology. Here’s the section dealing with privacy issues, and it follows on the heels of some great reporting by the Austin Bulldog, covered previously on this blog, that revealed how a lot of patient data is being sold for “research” purposes:

TT: The issue of privacy has been a hotbed of concern. There have been reports, even here in Texas, of patient electronic records being sold to research companies. How do you respond to concerns that electronic records will only increase the risk of violating patient privacy?

Blumenthal: Well, they shouldn’t be sold if people don’t give consent. We’re committed to having patients control the uses of their health data. Their consent is going to be vital.

Okay, stop right there. Isn’t that what some of us have been saying should be the requirement — consent — and not just “consent” but “informed consent?” And for our advocacy, we’ve been called privacy alarmists or just viewed as the enemy of progress.

TT: Whose responsibility is it to ensure that patient privacy is protected?

Blumenthal: It’s a collective responsibility. We, in the federal government, give our best judgment about what the preferred approach is to getting patient consent. I think we also need to enforce the existing laws that penalize people who don’t carefully guard patient information, and there are substantial penalties available. States have a responsibility because they have a lot of freedom to set local laws to make sure that they involve the public in creating those statutes and those regulations. Doctors and hospitals have to understand what patients want and need from them in the way of privacy in the electronic world.

Privacy is not his first strategic objective, but “Do no evil” is...

http://www.computerworld.com/s/article/9193178/5_comments_from_Google_s_CEO_on_privacy

5 comments from Google's CEO on privacy

On Monday, for instance, Schmidt raised the latest privacy hubbub by saying that if people don't like having their homes photographed for Google Street View for the world to see, they can "just move."

… The comment wasn't the first controversial remark Schmidt has made regarding privacy. Here are others:

"If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place," Schmidt said during an interview on CNBC in December 2009.
"We know where you are... with your permission. We know where you've been with your permission. We can more or less guess what you're thinking about," he said earlier this month, speaking at the Washington Ideas Forum and cited by The Atlantic.
"There is what I call the creepy line. The Google policy on a lot of things is to get right up to the creepy line and not cross it," Schmidt is quoted as saying by The Hill Web site last month during an event at the Newseum in Washington.
"I actually think most people don't want Google to answer their questions," he said. "They want Google to tell them what they should be doing next," he said, adding that at some point young adults will change their names so they can hide from youthful hijinks stored on social networks. He made the comments during an August interview with the Wall Street Journal.
"In a world of asynchronous threats, it is too dangerous for there not to be some way to identify you. We need a [verified] name service for people. Governments will demand it," Schmidt said at the Techonomy conference in April, according to a ReadWriteWeb blog by Marshall Kirkpatrick.

(Related) Tip number one: ignore the boss?

http://www.makeuseof.com/dir/familysafetycenter-safe-internet-use-for-kids/

FamilySafetyCenter: Tips & resources on safe internet use for kids & family

FamilySafetyCenter is a portal put together by Google that contains lots of tips, answers, videos and articles to help provide a safe internet use for kids and family. In addition to a list of safety tools that are embedded in various Google services, the site has a detailed FAQ section on how Google handles various related issues.

www.google.com/familysafety

Humor A Venn diagram of Privacy and the Internet...

http://www.makeuseof.com/tech-fun/privacy-and-the-internet/

It's almost Halloween – think of this as sneaking up on your employees and yelling, “Boo!” (Assuming your employees have serious heart conditions...) Perhaps they learned about changing policies without notice from their favorite Internet sites?

http://www.pogowasright.org/?p=16466

Drug Testing Poses Quandary for Employers

October 27, 2010 by Dissent

Katie Zezima and Abby Goodnough report:

The news, delivered in a phone call, left Sue Bates aghast: she was losing her job of 22 years after testing positive for a legally prescribed drug.

Her employer, Dura Automotive Systems, had changed the policy at its sprawling plant here to test for certain prescription drugs as well as illicit ones. The medication that Mrs. Bates was taking for back pain — hydrocodone, a narcotic prescribed by her doctor — was among many that the company, which makes car parts, had suddenly deemed unsafe.

Read more in the New York Times. Hat-tip, Privacy Lives.

The future of Copyright Law? When do we implement ACTA? Would any US ISP resist government “recommendations?”

http://tech.slashdot.org/story/10/10/26/1926201/Korea-Kicking-People-Offline-With-One-Strike?from=rss

Korea Kicking People Offline With One Strike

Posted by CmdrTaco on Tuesday October 26, @04:15PM

"While there's lots of talk of 'three strikes' laws in places like France, it may be worth looking over at South Korea, which put in place a strict new copyright law, required by a 'free trade' agreement with the US (which was the basis for ACTA). It went into effect in the middle of 2009, and now there's some data about how the program is going. What's most troubling is that the Copyright Commission appears to be using its powers to 'recommend' ISPs suspend user accounts based on just one strike, with no notice and no warning. The system lets the Commission make recommendations, but in well over 99% of the cases, the ISPs follow the recommendations, and they've never refused to suspend a user's account."

Gee, it must be election time again. We always see reports of election machine flaws before the election and whoever win quickly suppresses any investigation that might reveal how he won...

http://news.slashdot.org/story/10/10/26/1428226/Voting-Machines-Selecting-Default-Candidates?from=rss

Voting Machines Selecting Default Candidates

Posted by CmdrTaco on Tuesday October 26, @10:47AM

"Some voters in Las Vegas have noticed that Democrat Harry Reid's name is checked by default on their electronic voting machines. By way of explanation, the Clark County Registrar says that when voters choose English instead of Spanish, Reid's Republican opponent, Sharron Angle, has her name checked by default."

Cable must move to the Internet or be replaced by Google?

http://www.wired.com/epicenter/2010/10/comcast-gives-tv-anywhere-another-nudge-in-the-right-direction/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired%2Findex+%28Wired%3A+Index+3+%28Top+Stories+2%29%29

Comcast Gives ‘TV Anywhere’ Another Nudge in Right Direction

Fancast.com has programs from about 90 content partners, and Comcast customers also get access to the premium digital channels they pay. The array of programming is a smallish subset of 225 sources already available from Hulu, the web-based video service whose backers include NBC Universal, News Corp. (Fox) and Walt Disney (ABC), even though Hulu serves up much of the programming on Fancast. But unlike Hulu, Fancast includes programming from CBS.

Is this the business model that saves the publishing industry? Somehow, I doubt it.

http://news.slashdot.org/story/10/10/27/0048235/Free-E-Books-With-a-Catch-mdash-Advertising?from=rss

Free E-Books, With a Catch — Advertising

Posted by timothy on Tuesday October 26, @10:48PM

"Barnes & Noble may kick off a fresh price war today for digital book readers, with its new Nook news. But the real news in digital publishing is a novel approach to the e-books themselves: Free books — with advertising. The basic idea is to offer publishers another way to reach readers and to give readers the chance to try more books — books that perhaps they wouldn't normally peruse if they had to pay more for them. Initially, Wowio specialized in offering digital versions of comic books and graphic novels, usually formatted as Adobe PDFs. So it was a natural step for the company to offer graphic ads that are inserted in e-books. 'We think we're creating a broader audience for some of these titles,' Wowio's CEO Brian Altounian told me. 'I think folks are going to download more books because they're saving the costs' of having to drive to the store or pay more for them. Would ads stop you from reading?"

The new color Nook goes for $249, and comes with a browser, games, Quickoffice, streaming music via Pandora, and an SDK; reader itwbennett links to an analysis of how well it stacks up as a tablet.

Interesting. Nothing in the article to explain why a second device is required.

http://mobile.slashdot.org/story/10/10/27/015223/Some-Aussie-High-Schools-Moving-To-Two-Devices-Per-Child?from=rss

Some Aussie High Schools Moving To Two Devices Per Child

Posted by timothy on Wednesday October 27, @01:55AM

"One laptop per child is so last year. Private secondary schools in New South Wales, Australia are in discussions to upgrade their wireless networks so they can handle the strain of supporting a two-to-one ratio — a laptop and tablet for every student."

Centennial Man

Saturday, October 30, 2010

Friday, October 29, 2010

Thursday, October 28, 2010

Wednesday, October 27, 2010

Search This Blog

Followers

Blog Archive

Links

About Me