Centennial Man: 2015-05-17

Saturday, May 23, 2015

If I could see it was a bad deal, why didn't they?

http://www.businessinsider.com/target-and-mastercard-just-scrapped-a-19-million-deal-to-settle-data-breach-claims-2015-5

Target and MasterCard just scrapped a $19 million deal to settle data breach claims

A $19 million deal between Target and MasterCard to settle lawsuits stemming from the retailer's massive pre-Christmas 2013 data breach has been scrapped, because it failed to get enough support from the affected banks and credit unions.

… Lawyers for banks that had sued Target over breach-related losses called the settlement an attempt by Target to "extinguish pending legal claims for pennies-on-the-dollar."

… Target shares rose 2 cents to $79.41 in afternoon trading, while MasterCard shares rose 8 cents to $92.98.

How do you tell vandals from terrorists? Wait for another attack? More likely, wait for someone to claim responsibility in the name of ISIS. I've never heard of an inflatable dam but apparently they have been around for at least 40 years.

http://www.mercurynews.com/drought/ci_28174594/vandals-damage-dam-nearly-50-million-gallons-water

Vandals damage dam, nearly 50 million gallons of water pours into Bay

The loss of 49 million gallons of water began sometime Thursday morning, when an inflatable dam on Alameda Creek was destroyed. Alameda County Water District, which maintains the dam, reported it to police at 11:30 a.m.

… Police said the felony vandalism was an intentional act, but as of Friday afternoon had no suspects and were not exactly sure how it was damaged.

Because of its age, the district was already working to replace the dam, officials said. It was built in 1971 and is one of two dams ACWD controls.

Let's hope this is not the last word.

http://thehill.com/policy/transportation/242995-doj-releases-privacy-policy-for-us-drones

DOJ releases privacy policy for US drones

The Justice Department on Friday released guidelines that would explicitly bar the agency from using drones solely to monitor activity protected by the First Amendment, like peaceful protests.

… The Justice Department said it would adhere to constitutional principles that requires law enforcement to obtain a warrant when conducting surveillance or other activity in which people have a "reasonable expectation of privacy." Law enforcement would also be barred from using drones to engage in discrimination. [Someone will have to explain how you can use a drone to discriminate. Bob]..

The guidance builds off a presidential memorandum released in February that outlined general privacy and civil rights principles related to drones, and required all federal agencies to adopt their own procedures on how to collect and use information collected from domestic drones.

… The agency would be forced to keep logs of the purpose and number of flights, including those in which other agencies like the Homeland Security Department conducted the flight.

… In a footnote, the Justice Department noted that the guidelines are not legally enforceable and are "intended only to improve the internal management" at the agency.

[The guidelines: http://thehill.com/sites/default/files/dojdronememo.pdf

Is this really a big problem?

Connecticut Enacts Employee Online Privacy Law

Eric L. Sussman, Daniel L. Schwartz, and James M. Leva of Day Pitney LLP writes:

On May 19, Gov. Dannel P. Malloy signed into law Public Act No. 15-6, titled “An Act Concerning Employee Online Privacy” (the act). The act applies to both employees and job applicants and prohibits employers from requiring or requesting employees or applicants to (1) provide the employer with a user name, password, or other means to access the employee’s or applicant’s personal online account (such as e-mail, social media and retail-based Internet websites); (2) authenticate or access a personal online account in the presence of the employer’s representative; or (3) invite, or accept an invitation from, the employer to join a group affiliated with any personal online account. The act is effective October 1.

Friday, May 22, 2015

Lonely and breached.

http://www.businessinsider.com/adult-friendfinder-hacked-3-9-million-user-details-leaked-channel-4-news-report-2015-5?google_editors_picks=true

An adult dating website got hacked and millions of people's sensitive details have been leaked

… With 63 million global users, Adult FriendFinder is one of the largest dating and casual encounter networks online. (For reference, there were an estimated 50 million Tinder users in late 2014.) But 3.9 million users' accounts have allegedly been leaked online, and are circulating in spreadsheets on forums.

The details leaked include:

Sexual preferences
Email addresses
Sexual orientation
Dates of birth
Addresses
Usernames
Whether users are "seeking extramarital affairs"

… The leak is also highly embarrassing for Adult FriendFinder in another way. Channel 4 News analysed the data and found that almost no women actually use the adult social network. "Among the 26,939 users with a UK email address," technology producer Geoff White writes, "there are just 1,596 who identified as female: a ratio of one woman to every 16 men."

For my Computer Security students. Perhaps we should just aggregate our “Best Practices?”

PCI council gives up, dumbs down PCI DSS for small business

Darren Pauli reports:

The Payment Card Industry Security Standards Council has created a taskforce charged with improving security among small businesses.

The prodigious task will be tackled by encouraging small businesses to adopt security best practice and simplified Payment Card Industry Data Security Standards (PCI DSS).

Barclaycard payment security manager and taskforce chair Phil Jones says the Small Merchant Taskforce will focus on the most vulnerable business vertical.

Thursday, May 21, 2015

At least they encrypted the passwords. Another wise practice: The article also suggests they brought in a third party to double check their security because the industry was being increasingly targeted. Good on ya, CareFirst!

CareFirst BlueCross BlueShield discloses that hack in June 2014 affected 1.1 million members

From CareFirst BlueCross BlueShield:

On May 20, 2015, CareFirst BlueCross BlueShield (CareFirst) announced that the company has been the target of a sophisticated cyberattack.

The attackers gained limited, unauthorized access to a single CareFirst database. This was discovered as a part of the company’s ongoing Information Technology (IT) security efforts in the wake of recent cyberattacks on health insurers. CareFirst engaged Mandiant – one of the world’s leading cybersecurity firms – to conduct an end-to-end examination of its IT environment. This review included multiple, comprehensive scans of the CareFirst’s IT systems for any evidence of a cyberattack.

The review determined that in June 2014 cyberattackers gained access to a single database in which CareFirst stores data that members and other individuals enter to access CareFirst’s websites and online services. Mandiant completed its review and found no indication of any other prior or subsequent attack or evidence that other personal information was accessed.

Evidence suggests the attackers could have potentially acquired member-created user names created by individuals to access CareFirst’s website, as well as members’ names, birth dates, email addresses and subscriber identification number.

However, CareFirst user names must be used in conjunction with a member-created password to gain access to underlying member data through CareFirst’s website. The database in question did not include these passwords because they are fully encrypted and stored in a separate system as a safeguard against such attacks. The database accessed by attackers contained no member Social Security numbers, medical claims, employment, credit card, or financial information.

… Approximately 1.1 million current and former CareFirst members and individuals who do business with CareFirst online who registered to use CareFirst’s websites prior to June 20, 2014 are affected by this event. All affected members will receive a letter from CareFirst offering two free years of credit monitoring and identity theft protection. The letters will contain an activation code and you must have the letter to enroll in the offered protections. Out of an abundance of caution, CareFirst has blocked member access to these accounts and will request that members create new user names and passwords.

Note that CareFirst says they did detect the attack at the time, but did not fully appreciate its scope. In an FAQ on the incident, they write:

CareFirst did detect the initial attack and took immediate action to contain the attack. At the time CareFirst believed that we had contained the attack and prevented any actual access to member information. The evidence that data was accessed was found as part of a comprehensive assessment conducted as part of CareFirst’s ongoing information security efforts in the wake of cyberattacks on other health care companies.

Another downside of being clueless?

http://thehill.com/policy/technology/242703-ftc-looks-favorably-on-firms-that-report-data-breach

FTC looks 'favorably’ on firms that report data breach

The Federal Trade Commission advised companies Wednesday that it looks positively on cooperation when conducting investigations into data security breaches.

The agency said it would view a company that had reported a breach on its own and cooperated with law enforcement “more favorably” than one that had not.

… The warning was made in a blog post describing what private companies can expect when “the FTC comes to call” about an investigation, which could later lead to enforcement action.

… According to an FTC report released last year, the agency has brought about 50 data security cases in a little more than a decade. Last year alone, the FTC touted action against Snapchat, Fandango, Credit Karma, Verizon and others.

A “heads up!” for my students.

http://www.foxbusiness.com/industries/2015/05/20/using-debit-cards-at-atms-can-be-pricey-proposition/?cmpid=edpick&google_editors_picks=true

ATM Debit Card Theft Spikes to 20-Year High

… According to FICO (a credit-scoring and analytics company), from January to April 9, 2015, the number of attacks on debit cards used at ATMs reached the highest level for that period in at least 20 years. "We have periodically seen spikes in fraud but not at this level," said FICO's John Buzzard on FOX Business Network.

… Buzzard added that debit-card compromises at ATMs located on bank property were "pretty significant" jumping 174% from Jan. 1 to April 9, compared with the same period last year, while successful attacks at nonbank machines soared by 317%.

Nothing new?

http://www.bespacific.com/americans-attitudes-about-privacy-security-and-surveillance/

Americans’ Attitudes About Privacy, Security and Surveillance

by Sabrina I. Pacifici on May 20, 2015

“Two new Pew Research Center surveys explore [the issues of privacy and surveillance] and place them in the wider context of the tracking and profiling that occurs in commercial arenas. The surveys find that Americans feel privacy is important in their daily lives in a number of essential ways. Yet, they have a pervasive sense that they are under surveillance when in public and very few feel they have a great deal of control over the data that is collected about them and how it is used. Adding to earlier Pew Research reports that have documented low levels of trust in sectors that Americans associate with data collection and monitoring, the new findings show Americans also have exceedingly low levels of confidence in the privacy and security of the records that are maintained by a variety of institutions in the digital age. While some Americans have taken modest steps to stem the tide of data collection, few have adopted advanced privacy-enhancing measures. However, majorities of Americans expect that a wide array of organizations should have limits on the length of time that they can retain records of their activities and communications. At the same time, Americans continue to express the belief that there should be greater limits on government surveillance programs. Additionally, they say it is important to preserve the ability to be anonymous for certain online activities.”

More fine grained definition. How would you write a warrant for an unnamed file found in a private search?

Sixth Circuit creates circuit split on private search doctrine for computers

Orin Kerr writes:

The Sixth Circuit handed down a new decision on computer search and seizure that may be the next computer search issue to make it to the Supreme Court. The issue: How does the private search reconstruction doctrine apply to computers? The new decision creates an apparent circuit split with the Fifth and Seventh Circuits.

Read more on The Volokh Conspiracy.

[From the article:

In 2012, the Seventh Circuit joined the Fifth Circuit by adopting the unit of the device. And last month, a cert petition was filed at the Supreme Court on this issue in Gunter v. United States. But I hadn’t thought there was a particularly clear split. At least until this morning.

This morning, the Sixth Circuit handed down a new case, United States v. Lichtenberger, that adopts the proper unit as data or a file instead of the physical device.

Perspective. Big drones carry Maverick missiles, perhaps these little buggers will carry firecrackers?

http://inhomelandsecurity.com/cicada-the-mini-drone-swarming-to-a-terrorist-near-you/?google_editors_picks=true

‘Cicada’ the Mini-Drone: Swarming to a Terrorist Near You

… The mini-drones can be launched as a swarm by aircraft or other aerial platform. The new model developed by the Naval Research Laboratory is called the Cicada (Close-In Covert Autonomous Disposable Aircraft). The program has been under exploratory development since 2006.

The Cicada is presently little more than a paper airplane glider with GPS. The silent killers can soar at 47 MPH. They have already been tested at 57,000 plus feet three years ago in Yuma, Ariz. But right now they are envisioned for non-lethal roles that might include lacing targets or target areas. According to the Navy, 18 of these vehicles can fit in a six inch cube.

Here's the problem with inflating your military capabilities: Even when we doubt you word we can't simply ignore the possibility.

http://www.thehindu.com/news/international/us-disputes-north-korea-s-capacity-to-miniaturise-nuke-weapons/article7231166.ece

U.S. doubts N Korea’s claim on nuke weapons

The United States on Wednesday cast doubt on Pyongyang’s claimed capacity to miniaturise and diversify its stockpiled nuclear weapons.

“Regarding that specific claim of miniaturisation, we do not think they have that capacity,” State Department spokesperson Marie Harf told reporters, Xinhua reported.

North Korea said earlier in the day that it has entered the phase of miniaturisation and diversification of its nuclear weapons for quite some time, with the successful test-firing of a strategic ballistic missile from a submarine on May 8.

(Related) ...and when we know you have the capability, things can get rather tense. How far can China push and how firm can our response be? Something bad will happen when the limits are exceeded – and they will be.

China Warns US Plane Eight Times Above South China Sea; US-China War Imminent

On Wednesday, the Chinese navy issued warnings eight times for a U.S. surveillance plane to leave an area near man-made islands that Beijing has built to establish influence in the South China Sea, reported CNN.

… "This is the Chinese navy [...] This is the Chinese navy [...] Please go away," said a voice through the radio of the aircraft

During that one mission, the Chinese navy ordered the P8 to go out of the airspace eight times, and every time, the P8 pilot would calmly tell the Chinese radio operator that the P8 is flying through international airspace.

At one point, in exasperation, the Chinese voice told the American pilot, "This is the Chinese navy [...] You go!"

… The source of the Chinese voice heard through the radio of the P8 is a Chinese-made island some 600 miles from the country's coastline. The Wednesday confrontation occurred over Fiery Cross Reef, an island complete with military barracks and a runway.

… In 2013, China started constructing the man-made islands, creating land at the sea surface by repurposing sand [Interesting phrase Bob] at the area's 300-foot-deep waters. Over the past two years, China has built 2,000 acres of artificial land in the disputed area, according to the International Business Times.

… If China does not stop at establishing their military presence in the area, former CIA deputy director Michael Morell warned that a war between China and the United States will occur.

… A freedom of navigation exercise is being planned by the United States in which more U.S. ships or aircraft would be hovering within 12 nautical miles of Beijing-claimed territory, reported The Australian. The plan to emphasize freedom of navigation and freedom of the air aims to make it known that the United States does not approve of Beijing's construction over the disputed waters.

Targeted advertising. (Digest Item #6)

http://www.makeuseof.com/tag/trust-privacy-security-spotify-video-tech-news-digest/

How to Advertise Beer to Women

The video: https://www.youtube.com/watch?v=PZKgAuk6kLM

And finally, in an effort to persuade more women that beer is actually rather tasty, German brand Astra advertised directly to the female half of the population. For directly, read exclusively, as these automated billboards only started up when there was a woman in the vicinity.

A small camera attached to the billboard uses facial recognition software to detect gender and age. And if a female is walking past, one of 70 videos starring German comedian Uke Bosse starts playing. And if it’s a guy? He’s told to keep on walking past. Possibly to buy some beer.

An interesting article for my Data Management students. I don't agree with it, but it does raise a few points for discussion.

https://hbr.org/2015/05/4-business-models-for-the-data-age

4 Business Models for the Data Age

Data is invading every nook and cranny of every sector, every company therein, every department, and every job. As it does, it’s flexing its strategic muscles, and four ways to compete with data are starting to emerge.

The first involves cost reduction through improved data quality.

Improved data quality also lies at the root of the second strategy, which I call “content is king.”

“Building a better data mousetrap” — or data-driven innovation — is the third way to pursue competitive advantage through data.

Finally, the fourth strategy is to become increasingly data-driven, in everything one does.

My answer is that as population increases the numbers of people (not the percentage) at either end of the normal curve increase. Therefore we have more idiots, serial killers and useless politicians than ever before – with no change in the statistical probabilities.

http://www.makeuseof.com/tag/getting-dumber-stupidity-just-visible-online/

Are We Getting Dumber? Or Is Stupidity Just More Visible Online?

Interesting. Gives you a mosaic of similar searches to help you cover all the angles.

http://www.freetech4teachers.com/2015/05/athenir-search-engine-with.html#.VV3cCVIsr4Q

Athenir - A Search Engine With Visualizations of Related Terms

This afternoon I had a nice Skype conversation with a Stanford student named Nick Hershey who has built a nice search tool called Athenir. Nick has lots of neat things planned to add to Athenir this summer, but for now it is a search tool. When you enter a search term on Athenir you will get results from Yahoo along with a graphic of related search terms. In that regard it reminded me of Google's, now defunct, Wonder Wheel tool.

Applications for Education

Athenir could be useful to students who are struggling to see connections between search terms and or are need of assistance in changing their search terms.

...and we thought Artificial Intelligence was the problem. Dilbert reveals a far darker future.

http://dilbert.com/strip/2015-05-21

Wednesday, May 20, 2015

This sounds ominous. I would be looking for a few heads to roll.

Telstra-owned Pacnet hit by major data breach

David Ramli reports:

Australia’s leading cyber-spies have joined the hunt for hackers who broke into Telstra’s Asian subsidiary Pacnet in an attack affecting thousands of customers including The Australian Federal Police, Department of Foreign Affairs and Trade and other government agencies.

Telstra on Wednesday revealed that an unknown third-party had gained complete access to Pacnet’s corporate network including emails and other administrative systems in early April 2015.

Tuesday, May 19, 2015

A more reasoned voice. One not selling consulting services? (Perhaps this explains why the FBI can't find enough evidence to arrest this guy.)

Airplane hacking panic! Why it’s a surely a storm in a teacup

There has been much media coverage of Chris Robert’s alleged claims about controlling an airplane in-flight. I haven’t bothered to link to them as they generally just re-hash what is already known and not known. But Iain Thomson got a more detailed response from those who are skeptical about Roberts’ claims:

At last year’s DEFCON hacker’s meeting Dr Phil Polstra, professor of digital forensics at Bloomberg University (and a qualified commercial pilot and flight instructor), delivered a lecture on the feasibility of in-flight aircraft hacking. It turns out it’s a lot more difficult than you might think.

Aircraft IT systems are built around non-TCP/IP protocols called ARINC, or AFDX on Airbus equipment. One of the key differences with this protocol is that it allows unidirectional data and will lock out a non-standard sending signal.

With regards to Roberts’ claims, Dr Polstra said that they were interesting and that he looked forward to discussing them with the researcher at a future DEFCON conference “assuming he is not in jail.” But the method of hacking seems unlikely.

IFE systems do receive some information from the emergency information crew alert system (EICAS), chiefly the aircraft’s location and speed for those little progress maps, but this data comes through a unidirectional Network Extension Device (NED).

Monday, May 18, 2015

With everything else they did wrong, why would anyone expect Sony to have their insurance ducks in a row?

Where Does Sony Settlement Leave CGL Insurance for Data Breaches?

What does your CGL policy mean by “publication in any manner?”

Jana Landon reports:

It was reported recently that the parties in the closely watched data breach case of Zurich American Insurance v. Sony Corp. of America (N.Y. Sup. Ct. Feb. 21, 2014) settled while Sony’s appeal of an unfavorable trial court opinion was pending. That opinion found that no coverage was available to Sony for a massive data breach under its commercial general liability (CGL) policy. This settlement leaves open questions regarding claims by insureds regarding data hacks in existing data breach cases, especially in light of recent changes to the CGL forms.

Read more on The Legal Intelligencer. [Registration required Bob]

[From the article:

A standard CGL policy usually contains a section titled "Coverage B—Personal and Advertising Liability Injury." The current Insurance Services Office Inc. (ISO) form for Coverage B typically provides coverage for "those sums that the insured becomes legally obligated to pay as damages because of 'personal and advertising injury' to which this insurance applies." "Personal and advertising injury" is defined as an "oral or written publication, in any matter, of material that violates a person's right of privacy."

After Sony's data breach, Zurich American Insurance denied Sony's coverage claim and filed suit in July 2011. The insurer argued that, under Coverage B, the language "publication in any manner" described only the type of disclosure, not the identity of the disclosing party. Zurich contended that coverage would only extend to the publication of information by Sony, not third parties such as hackers, even though there were no such limitations in the policy language. Therefore, it argued, the data breach did not fall under the CGL policy.

For my Computer Security students. I can not redundantly repeat this reiteration enough!

http://www.bespacific.com/wham-bam-thank-you-spam-dont-click-on-the-link/

Wham, Bam, Thank You Spam! Don’t Click on the Link!

by Sabrina I. Pacifici on May 17, 2015

Harvard Law School Forum on Corporate Governance and Financial Regulation – Posted by Paul A. Ferrillo, Weil, Gotshal & Manges LLP, May 17, 2015.

“It seems that just like in old times (in cyberspace that means last year) the existence of “snake-oil” salesmen on the Internet is getting worse, not better. Rather than selling something medicinal or at the very least useful, these snake-oil salesmen of today have one intent only: to steal your personal information or worse, to distribute malware to your computer. One recent report issued by Symantec in April 2015 literally details scores of scams all designed to steal information and potentially ruin your computer (and others’ as well) and steal your personal information. We detail them not out of morbid curiosity of the utter gall of the snake-oil salesmen, but to hopefully inform and prevent the inadvertent “click on the link” circumstances which you and your company would rather avoid. We also point to other recently issued reports noting that other scams like phishing and spear phishing continue to be a bothersome and dangerous component of company emails. At the end of the day, continuous employee training and awareness of these sorts of scams is truly a strong part of the Holy Grail of Cybersecurity, along with certain network hardware components that can help stop “bad” emails before they get to your employees’ desktops…”

Low(er) tax rates apparently gives Ireland lots of power when it comes to Privacy. So it must be worth it, right?

Irish data commissioner taking charge of policing Twitter privacy from today

RTÉ reports:

The Office of the Data Protection Commissioner will today assume responsibility for ensuring the privacy and data of around 300 million people outside the US who use Twitter each month is adequately respected.

Last month the microblogging site told users that from 18 May, “Twitter International Company will be responsible for handling your account information under Irish privacy and data protection law.”

The move means all of the social network’s users outside of the US will come under the European Union’s Data Protection Directive.

Centennial Man

Saturday, May 23, 2015

Friday, May 22, 2015

Thursday, May 21, 2015

Wednesday, May 20, 2015

Drivers are making video chats, taking selfies behind the wheel

Tuesday, May 19, 2015

Monday, May 18, 2015

Search This Blog

Followers

Blog Archive

Links

About Me