Centennial Man: 2018-11-11

Saturday, November 17, 2018

It doesn’t have to be a hack, poor management is enough.

https://www.cnn.com/2018/11/16/investing/nordstrom-earnings-stock/index.html

Nordstrom shares slide over credit card screw-up

During its third quarter earnings call Thursday, Nordstrom said it had to refund $72 million to some credit card users because it accidentally charged them a higher interest rate. The admission sparked a sell-off Friday, sending the stock down more than 12%.

… Nordstrom's quarterly profit fell 42% because of the credit card refunds. The company said if it wasn't for the screw-up, its earnings would have been "slightly ahead" of its expectations. Sales grew 3%.

The Seattle-based company's recent shift into digital is still paying off. Digital sales grew 20% year-to-date and its website now makes up 30% of its overall business.

Another example of the use of GDPR to force companies into compliance, short of a 4% or revenue fine. “You did it wrong, now do it over!”

CNIL imposes GDPR-consent in online advertising space

Kristof Van Quathem and Anna Oberschelp de Meneses of Covington & Burling write:

On November 9, 2018, the French Supervisory Authority for Data Protection (known as the “CNIL”) announced that it issued a formal warning (available here) ordering the company Vectaury to change its consent experience for customers and purge all data collected on the basis of invalid consent previously obtained.

Vectaury is an advertising network that buys online advertising space on behalf of its customers (advertisers). The company also offers a software tool that advertisers can integrate into their apps to collect geolocation data and information on the device and browser of users.

Friday, November 16, 2018

This is changing. The GDPR is only the first of many laws and regulations that will make breaches much more expensive. (Even “material” in the accounting sense.)

Massive Data Leaks Keep Happening Because Big Companies Can Afford to Lose Your Data

Erik Sherman reports:

If you live in the United States, there’s almost a 50 percent chance your personal data was lost in the giant Equifax data breach a year ago of 143 million records. Google had its own data breach in October this year that exposed data on as many as 500,000 accounts. Or the most recent Facebook breach of data from 29 million users. Or, over the last five years alone, major breaches at Anthem, eBay, JPMorgan Chase, Home Depot, Yahoo, Target, Adobe … but you get the point. If it’s day that ends in “day,” there must have been another major data breach that keeps criminal hackers gainfully employed by selling your information.

Bad guys keep getting smarter, experts say. Why not corporations? The short answer is, because it’s not worth their trouble.

Thursday, November 15, 2018

Legacy systems get a break, show that you are working to comply and they go easy. My problem is trying to teach students to build systems that are fully compliant from the start.

European Regulators Are Intensifying GDPR Enforcement

Ezra Steinhardt of Covington & Burling writes:

Earlier this year, in the run-up to the General Data Protection Regulation’s (“GDPR”) May 25, 2018 date of application, a major question for stakeholders was how zealously the GDPR would be enforced. Now, as the GDPR approaches its six-month birthday, an answer to that question is rapidly emerging. Enforcement appears to be ramping up significantly. In this post, we set out some of the most prominent regulatory enforcement developments so far — but bear in mind other investigations are also proceeding.

Read more on TechCrunch.

Great new locks installed on the wrong door?

https://www.schneier.com/blog/archives/2018/11/chip_cards_fail.html

Chip Cards Fail to Reduce Credit Card Fraud in the US

A new study finds that credit card fraud has not declined since the introduction of chip cards in the US. The majority of stolen card information comes from hacked point-of-sale terminals.

The reasons seem to be twofold. One, the US uses chip-and-signature instead of chip-and-PIN, obviating the most critical security benefit of the chip. And two, US merchants still accept magnetic stripe cards, meaning that thieves can steal credentials from a chip card and create a working cloned mag stripe card.

Boing Boing post.

For Users: Makes signing into a new site very simple. For Hackers: Makes hacking the logon process very desirable.

Do you login to merchant sites using your FB or Google credentials? The Annex Cloud breach may have affected you.

Hmm. This one could result in big numbers.

A notification from Title Nine about Annex Cloud. Annex Cloud is a service provider that you may never have heard of but may have used many times. The notification explains:

Annex Cloud provides a service that enables individuals to use their user name and password from social media and other websites, like Facebook and Google, to login to merchants’ websites, including www.titlenine.com. Annex Cloud recently informed Title Nine that they had detected and removed unauthorized code that had been inserted into Annex Cloud’s systems that operate its login application. In its report, Annex Cloud identified four periods of time when the unauthorized code was present and could have captured information entered during the checkout process on our website. We removed Annex Cloud’s code from our website and mailed letters to those customers to let them know what occurred.

Despite its first report that only identified four time periods, Annex Cloud informed Title Nine that they had identified additional time periods between December 28, 2017 and July 9, 2018 when the unauthorized code was or could have been present. If present, the unauthorized code could have captured information entered during the checkout process on our website. Through October 25, 2018, Title Nine sought additional information from Annex Cloud to determine the transactions that might be involved, and Annex Cloud supplied additional information about their analysis regarding these periods, including their belief that there are certain times inside these additional periods when it cannot be determined if the unauthorized code was present. Thus, we are notifying you because you entered information during the checkout process during a time period when it is possible the unauthorized code may have been present.

What Information Was Involved

The information entered during the checkout process that the code may have been accessed includes name, address, payment card number, expiration date, and card security code (CVV).

So then today, I saw saw this notification from Stein Mart.

I wonder how many more notifications we will see linked to Annex Cloud.

As an old guy, I can remember working with many senior managers who had never touched a computer. That will never be true for anyone starting out today. You have to ask: Did they hire him to program or manage?

https://www.bbc.com/news/technology-46222026

Japan's cyber-security minister has 'never used a computer'

Japan's new cyber-security minister has dumbfounded his country by saying he has never used a computer.

Yoshitaka Sakurada made the admission to a committee of lawmakers.

"Since I was 25 years old and independent I have instructed my staff and secretaries. I have never used a computer in my life," he said, according to a translation by the Kyodo news agency.

The 68-year-old was appointed to his post last month.

… But Mr Sakurada responded that other officials had the necessary experience and he was confident there would not be a problem.

However, his struggle to answer a follow-up question about whether USB drives were in use at the country's nuclear power stations caused further concern.

The disclosure has been much discussed on social media where the reaction has been a mix of astonishment and hilarity, with some noting that at least it should mean Mr Sakurada would be hard to hack.

I wonder if this asks all the required questions? Still, it’s a start.

https://techcrunch.com/2018/11/14/mozilla-ranks-dozens-of-popular-smart-gift-ideas-on-creepiness-and-security/

Mozilla ranks dozens of popular ‘smart’ gift ideas on creepiness and security

If you’re planning on picking up some cool new smart device for a loved one this holiday season, it might be worth your while to check whether it’s one of the good ones or not. Not just in the quality of the camera or step tracking, but the security and privacy practices of the companies that will collect (and sell) the data it produces. Mozilla has produced a handy resource ranking 70 of the latest items, from Amazon Echos to smart teddy bears.

I’m going to look at this carefully before I comment. I had a brief vision of TSA Agents standing next to every computer controlled device in the country. Shudder!

https://www.securityweek.com/congress-passes-bill-creating-cybersecurity-agency-dhs

Congress Passes Bill Creating Cybersecurity Agency at DHS

The U.S. House of Representatives this week passed a bill that creates a new cybersecurity agency at the Department of Homeland Security (DHS).

The Cybersecurity and Infrastructure Security Agency (CISA) Act, which passed Senate in October, is headed to the president to be signed into law. Congress passed the legislation unanimously.

The bill reorganizes the National Protection and Programs Directorate (NPPD) into the Cybersecurity and Infrastructure Security Agency (CISA), and puts it in charge of cyber and physical infrastructure security.

Finding a balance must be hard. Facebook is missing some content they should take down and taking down some they should not.

https://boingboing.net/2018/11/14/transparency-and-fairness.html

70 of the world's leading human rights groups ask Mark Zuckerberg to create due process for censored content

Pam Cowburn from Article 19 sez, "Over 70 civil society groups have written to Mark Zuckerberg asking for Facebook to review its content removal processes and give all users the opportunity to appeal against content takedowns that they think have been made in error."

It’s a people problem.

https://www.bespacific.com/billions-spent-on-armored-school-doors-bulletproof-whiteboards-and-secret-snipers/

Billions spent on armored school doors, bulletproof whiteboards and secret snipers

Washington Post: “Although school security has grown into a $2.7 billion market — an estimate that does not account for the billions more spent on armed campus police officers — little research has been done on which safety measures do and do not protect students from gun violence. Earlier this fall, The Washington Post sent surveys to every school in its database that had endured a shooting of some kind since the 2012 killings of 20 first-graders in Newtown, Conn., which prompted a surge of security spending by districts across the country. Of the 79 schools contacted, 34 provided answers, including Sandy Hook Elementary. Their responses to questions about what they learned — some brief but many rich in detail — provide valuable insight from administrators in urban, suburban and rural districts who, as a group, have faced the full spectrum of campus gun violence: targeted, indiscriminate, accidental and self-inflicted.

When asked what, if anything, could have prevented the shootings at their schools, nearly half replied that there was nothing they could have done. Several, however, emphasized the critical importance of their staffs developing deep, trusting relationships with students, who often hear about threats before teachers do. Only one school suggested that any kind of safety technology might have made a difference. Many had robust security plans already in place but still couldn’t stop the incidents…”

My students were adamant that no one could compete with Amazon.

https://venturebeat.com/2018/11/15/amazon-go-competitor-standard-cognition-raises-40-million-to-expand-its-cashierless-store-solution/

Amazon Go competitor Standard Cognition raises $40 million to expand its cashierless store solution

Cashierless shopping feels a little bit like magic. There’s something indescribably awesome about being able to grab something from a shelf, stuff it in a coat pocket, and waltz away without having to contend with long lines or busted self-checkout machines. That “coolness” factor — along with the significant cost savings cashierless experiences promise — have given rise to a cottage industry of solutions led by standard-bearer Amazon and its Amazon Go chain.

The space’s startups have been mostly retailer-agnostic so far, and it’s no wonder why — brick-and-mortar space is expensive. San Francisco-based Standard Cognition this summer announced a partnership with Paltac in Japan that will see its autonomous checkout solution deployed in 3,000 stores, along with unnamed retailers in North America and Europe — and it’s impressed investors with its progress.

Perspective. My students have been looking at the wider economic impacts.

http://knowledge.wharton.upenn.edu/article/burns-book-driverless-car/

How Autonomous Vehicles Will Upend Transportation

… Knowledge@Wharton: How will it change the trucking industry?

Burns: When you look at an over-the-road tractor, ask yourself: What parts are on that tractor because there’s a driver in it? The windshield, the doors, the seats, the steering controls, the brakes — you begin to get the picture. In fact, the parts you can take off of that tractor will likely cost more than the parts you’re going to add to make it autonomous.

… After this DARPA Urban Challenge, the only company that really stepped up for public road use application of this was Google. Larry Page and Sergey Brin challenged a small team of the participants in that DARPA challenge to come up with a vehicle that could go on public roads and prove the concept out.

The auto industry was in denial for five or six years. We re-create that in Autonomy. We tell the story of how Google got started into this area, and then how some of the engineers on Google’s team reached out to the auto industry and had the door slammed in their face.

The squeaky wheel(My students would agree.)

https://dilbert.com/strip/2018-11-15

Wednesday, November 14, 2018

The best hacks always try to look like an innocent mistake. Sometimes mistakes look like they aren’t so innocent.

https://www.wired.com/story/google-internet-traffic-china-russia-rerouted/

Google Internet Traffic Wasn't Hijacked, But It Was Out of Control

For two hours Monday, internet traffic that was supposed to route through Google's Cloud Platform instead found itself in quite unexpected places, including Russia and China. But while the haphazard routing invoked claims of traffic hijacking—a real threat, given that nation states could use the technique to spy on web users or censor services—the incident turned out to be a simple mistake with outsized impacts.

Google noted that almost all traffic to its services is encrypted, and wasn't exposed during the incident no matter what. As traffic pinballed across ISPs, though, some observers, including the monitoring firm ThousandEyes, saw signs of malicious BGP hijacking—a technique that manipulates the web's Border Gateway Protocol, which helps ISPs automatically collaborate to route traffic seamlessly across the web.

ThousandEyes saw Google traffic rerouting over the Russian ISP TransTelecom, to China Telecom, toward the Nigerian ISP Main One. "Russia, China, and Nigeria ISPs and 150-plus [IP address] prefixes—this is obviously very suspicious," says Alex Henthorne-Iwane, vice-president of product marketing at ThousandEyes. "It doesn’t look like a mistake."

… In this case, it appears that the Russian and Chinese ISPs, and perhaps others as well, offered a path to the Google traffic because they hadn't implemented protective configurations. [Think of it as keeping a door open for anything you can grab. Bob]

Think of this as a guide to social engineering of senior management.

NL: Internet con men ripped off Pathe NL for €19m in business email compromise

Heads rolled in this one, when executives did not spot or prevent business email compromise. As reported by DutchNews.nl:

The Dutch operation of the Pathé cinema group was ripped off by internet con men to the tune of over €19m, court documents published on Friday show.

The con cost both the chief executive and financial director of the Dutch operation their jobs, and it is unclear if any of the money has been recovered.

The court documents, which cover the unfair dismissal case brought by sacked finance chief Edwin Slutter, show in detail how the thieves went about scamming Pathé Nederland earlier this year.

Tuesday, November 13, 2018

The question is: can my Ethical Hackers do the same? (Can we try it on your VW?)

https://www.engadget.com/2018/11/12/volkswagen-siri-shortcuts-car-net/

Volkswagen owners can use Siri Shortcuts to unlock their car

Obviously it’s a variation of the old “these are not the droids you are looking for” Jedi mind trick. No evidence of attack means no budget for defense. Remember, it’s the President they’re worried about.

https://www.wsj.com/articles/russian-hackers-largely-skipped-the-midterms-and-no-one-really-knows-why-1542054493

Russian Hackers Largely Skipped the Midterms, and No One Really Knows Why

After unleashing widespread cyberattacks and disinformation warfare on the U.S. during the 2016 presidential election, Russia’s trolls and hackers mostly appeared to have sat on the sidelines during the campaign ahead of last week’s midterm elections.

No one is sure why.

Another concern for developers.

https://www.schneier.com/blog/archives/2018/11/new_iot_securit.html

New IoT Security Regulations

… It falls upon lawmakers to create laws that protect consumers. While the US government is largely absent in this area of consumer protection, the state of California has recently stepped in and started regulating the Internet of Things, or "IoT" devices sold in the state and the effects will soon be felt worldwide.

California's new SB 327 law, which will take effect in January 2020, requires all "connected devices" to have a "reasonable security feature." The good news is that the term "connected devices" is broadly defined to include just about everything connected to the internet. The not-so-good news is that "reasonable security" remains defined such that companies trying to avoid compliance can argue that the law is unenforceable.

Sound familiar?

https://hotforsecurity.bitdefender.com/blog/whatsapp-overwhelmed-by-volume-of-fake-news-spread-in-india-through-group-messaging-researchers-find-20563.html

WhatsApp overwhelmed by volume of fake news spread in India...

A lack of trust in the mainstream media has led to dissemination of a large amount of false digital information on social networks, but in India it appears things have taken a turn for the worst, according to BBC researchers.

… WhatsApp is having a hard time ending or controlling disinformation, found the BBC World Service. The practice is linked to growing Hindu nationalism and the dropping price of mobile phone data, as well as strong encryption behind WhatsApp communication. It’s not uncommon for Indians to put more faith in what an acquaintance says, than in the traditional media.

… Research leader Dr Santanu Chakrabarti says the current Indian prime-minister, known for validating Hindu nationalism, has created the belief that it is their duty to spread the information through the group-messaging app, as they assume it has already been checked and confirmed.

“They are effectively looking for validation of their belief systems,” he said. “On these platforms, then, validation of identity trumps verification of the fact.”

The revision of the auto industry or a whole new ballgame?

https://www.bloomberg.com/news/articles/2018-11-13/waymo-to-start-first-driverless-car-service-next-month

Waymo to Start First Driverless Car Service Next Month

… Waymo, the secretive subsidiary of Google’s parent company, Alphabet Inc., is planning to launch the world’s first commercial driverless car service in early December, according to a person familiar with the plans. It will operate under a new brand and compete directly with Uber and Lyft.

Waymo is keeping the new name a closely guarded secret until the formal announcement, said the person, who asked not to be identified because the plans haven’t been made public.

… When Waymo starts its commercial program, there will be backup drivers in some cars to help ease customers into the service and to take over if necessary, according to the person familiar with the plans. The fleet of heavily modified Chrysler Pacifica minivans will drive themselves more than 99.9 percent of the time, based on data from Waymo’s test program submitted to California regulators.

An interesting (if somewhat comic book formatted) article to encourage my Architecture students to consider the difficulties of playing catch-up.

https://markets.businessinsider.com/news/stocks/walmart-changes-to-compete-with-amazon-2018-11-1027717527#jet-offers-walmart-access-to-urban-customers-and-the-fact-that-it-s-a-digitally-native-brand-means-walmart-can-expand-its-online-reach-further-10

Walmart has apparently been worried about Amazon for more than 15 years — here are all of the changes it has made to keep up in the online-shopping battle

Confusion by over-thinking? Trying to control every uncontrollable thing?

The Potential Unintended Consequences of Article 13

… Take the global music hit “Despacito”. This video contains multiple copyrights, ranging from sound recording to publishing rights. Although YouTube has agreements with multiple entities to license and pay for the video, some of the rights holders remain unknown. That uncertainty means we might have to block videos like this to avoid liability under article 13. Multiply that risk with the scale of YouTube, where more than 400 hours of video are uploaded every minute, and the potential liabilities could be so large that no company could take on such a financial risk.

No longer approximate.

https://www.npr.org/2018/11/13/666310991/say-au-revoir-to-that-hunk-of-metal-in-france-that-has-defined-the-kilogram

Say Au Revoir To That Hunk Of Metal In France That Has Defined The Kilogram

… Now, after researchers spent years creating an elaborate new kind of weighing machine called a Kibble balance, it's finally the kilogram's turn.

I wonder how many of my students already have this App.

https://www.droid-life.com/2018/11/12/cloudflares-1-1-1-1-app-makes-your-phones-internet-faster-and-private/

Cloudflare’s 1.1.1.1 App Makes Your Phone’s Internet Faster and Private

… With 1.1.1.1, Cloudflare is letting your phone use their 1.1.1.1 DNS resolver to connect to the internet. That’s where the faster and privacy parts come in. Cloudflare expects you to get a faster connection to 1.1.1.1, which should lead to faster connections to websites or apps or whatever your internet connection is trying to do.

I’ve never heard of such a thing, but I want to look it over.

https://www.politico.com/magazine/story/2018/11/11/intellectual-dark-web-quillette-claire-lehmann-221917

The Voice of the ‘Intellectual Dark Web’

Claire Lehmann’s online magazine, Quillette, prides itself on publishing ‘dangerous’ ideas other outlets won’t touch. How far is it willing to go?

https://quillette.com/

Monday, November 12, 2018

An article worth reading. Social engineering at the wholesale level? Let’s define “good.”

https://www.wired.com/story/sue-gordon-us-intelligence-public-private-google-amazon/

Top US Intelligence Official Sue Gordon Wants Silicon Valley on Her Side

… On a recent trip to Silicon Valley, Gordon sat down with WIRED to talk about how much government needs Silicon Valley to join the fight to keep the US safe. She was in town to speak at conference at Stanford, but also to convince tech industry leaders industry that despite increasing employee concerns, the government and tech have a lot of shared goals.

“I had a meeting with Google where my opening bid was: ‘We're in the same business’. And they're like ‘What?’ And I said: ‘Using information for good,’” Gordon says.

That’s a hard sell in Silicon Valley, especially in the post-Snowden years. After Snowden’s leaks, tech companies and tech workers didn’t want to be seen as complicit with a government that spied on its own people—a fact Gordon disputes, saying that any collection of citizen’s information was incidental and purged by their systems. This led to a much-publicized disconnect between the two power centers, one that has only grown more entrenched and public in 2018, as Silicon Valley has undergone something of an ethical awakening.

… Artificial intelligence, she says, presents a huge opportunity for the government and the private sector, but the risks of its being abused, biased, or deployed by foreign adversaries is so real that the government and tech companies should be collaborate to secure it.

Perspective.

https://www.cnbc.com/2018/11/11/alibaba-singles-day-2018-record-sales-on-largest-shopping-event-day.html

Alibaba sets new Singles Day record with more than $30.8 billion in sales in 24 hours

… Gross merchandise value (GMV), a figure that shows sales across the Chinese e-commerce giant's various shopping platforms, surpassed last year's $25.3 billion record at around 5:34 p.m. SIN/HK (4:34 a.m. ET) on Sunday, and kept marching higher through the rest of the day.

Perspective. Younger than most of my Grad students.

https://twitter.com/MIT_CSAIL/status/1061637673536770048

MIT CSAIL

25 years ago today the first major web browser was released: Mosaic 1.0.

An extremely accurate inertial navigation system, for when the hackers take down the GPS system.

https://www.theregister.co.uk/2018/11/11/brit_boffins_quantum_compass/

Brit boffins build quantum compass, say goodbye to GPS

… The compass is a quantum accelerometer that is capable of measuring tiny shifts in supercooled atoms and so calculate how far and how fast the device has moved. Stuck on a boat, it would mean that the captain knows exactly where his ship was without having to rely on orbiting satellites.

… The system could be of particular benefit to the UK's military after Europe made it clear that following Brexit, the UK would no longer gain secure access to Europe's new Galileo GPS system despite years of assisting in the system's development and deployment.

But this is not something you're going to find in your smartphone: the prototype system shown off this week in London is about three-feet wide and high and it is incredibly expensive.

Because: Kulture!

https://www.bespacific.com/52438-high-definition-images-of-artworks-into-the-public-domain/

52,438 High-Definition Images of Artworks Into the Public Domain

Kottke: “The Art Institute of Chicago has placed high-definition images of 52,438 public-domain artworks onto its website (with magnification tools) under a CC0 license (no rights reserved), including The Great Wave, A Sunday on La Grand Jette (unfortunately not magnifiable to this extent), Nighthawks, Van Gogh’s Self-Portrait, Warhol’s Mao, and Two Sisters on the Terrace…”

A guide to useful tools.

The Essential Ebook Converter Guide

Sunday, November 11, 2018

...and why not? A good cyberattack gives all the satisfaction of a missile attack but with no risk of it spreading to conventional weapons. Yet.

https://www.cnn.com/2018/11/09/tech/iran-sanctions-us-banks-cyber-hack-invs/index.html

US banks prepare for Iranian cyberattacks as retaliation for sanctions

New York (CNN)As the United States reinstated economic sanctions on Iran on Monday, American banks were gearing up for retaliatory Iranian cyberattacks.

Bank executives believe Iranian hackers could attempt to disrupt financial services, perhaps as they did between 2011 and 2013 – with denial-of-service attacks that interrupted bank websites and other internet financial services.

… "Iran, while more limited (than some other countries) in the sophistication of their cyber capabilities, (has) demonstrated a greater willingness to conduct destructive cyberattacks that are well beyond the norms of state behavior in peacetime," Lt. Col. Audricia Harris told CNN in an email.

Because we’d be upset if the CIA or NSA did it?

National biometric database could be on the way (and in private hands)

Greg Nichols reports:

When a national fingerprinting company joins forces with a startup that authenticates identity using AI-based facial recognition and behavioral prediction in natural settings, the future of human identification tech starts to look an awful lot like sci fi. That’s the the new reality as SureID, a biometrics and fingerprinting firm, partners with Robbie.AI, a Boston-based startup, on R&D that could result in the United States’ first nationwide biometrics gathering system.

Centennial Man

Saturday, November 17, 2018

Friday, November 16, 2018

Thursday, November 15, 2018

Wednesday, November 14, 2018

Tuesday, November 13, 2018

Monday, November 12, 2018

Sunday, November 11, 2018

Search This Blog

Followers

Blog Archive

Links

About Me