The UltraTech Zone

March 2008 - Posts

• Church's Pastor Is an ID Thief

  The more trusted a thief is, the harder he is to catch.... Share Post: Read More... Posted Monday, March 31, 2008 3:07 PM from Schneier on Security | (Comments Off)

• Another take on opening PCs, or not

  Another correspondent weighs in on the lock-or-not-lock debate - BobDear Bob ...I'm not sure that workers downloading "stuff" on their PCs is really the place that innovation should come from. The reward that something might happen there of value is far out weighed by the risk the corporation faces of Read More... Posted Monday, March 31, 2008 9:29 AM from Advice Line | Bob Lewis | (Comments Off)

• N-DEx National Intelligence System

  An article from The Washington Post: Federal authorities hope N-DEx will become what one called a "one-stop shop" enabling federal law enforcement, counterterrorism and intelligence analysts to automatically examine the enormous caches of local and state records for the first time. [...] The expanding police systems illustrate the prominent roles that private companies play in homeland security and Read More... Posted Monday, March 31, 2008 8:13 AM from Schneier on Security | (Comments Off)

• Getting some process going

  Dear Bob ...We work with a software vendor whose app we host. They are small (20-ish employees), we have to cover a lot of customers and pretty close to 24/7. We are, unfortunately, their largest install, certainly larger than they designed for.There have been scaling problems.My problem is in figuring Read More... Posted Friday, March 28, 2008 10:10 PM from Advice Line | Bob Lewis | (Comments Off)

• Friday Squid Blogging: Plastinated Squid

  In Paris: France's National Museum of Natural History on Tuesday unveiled the world's first "plastinated" squid -- a 6.5-metre-long (21.25-feet) deep-sea beast donated by New Zealand and named in honour of a creature featuring in Maori legend. Plastination entails replacing the animal's water, fat and other liquids with a polymer that hardens. It means the specimen can be appreciated in... Share Post Read More... Posted Friday, March 28, 2008 6:29 PM from Schneier on Security | (Comments Off)

• Interviews and Podcasts

  I was interviewed on (print and audio) science and secrecy, the (print and podcast) future of the security industry, and (podcast only) the psychology of security.... Share Post: Read More... Posted Friday, March 28, 2008 4:06 PM from Schneier on Security | (Comments Off)

• Speeding Tickets and Agenda

  If you ever need an example to demonstrate that security is a function of agenda, use this story about speed cameras. Cities that have installed speed cameras are discovering motorists are driving slower, which is decreasing revenues from fines. So they're turning the cameras off. Perhaps a better solution would be to raise the fines to the remaining speeders to... Share Post: Read More... Posted Friday, March 28, 2008 3:42 PM from Schneier on Security | (Comments Off)

• Ten Security Land Mines

  Good list of common corporate security pitfalls.... Share Post: Read More... Posted Friday, March 28, 2008 7:55 AM from Schneier on Security | (Comments Off)

• Web Entrapment

  Frightening sting operation by the FBI. They posted links to supposed child porn videos on boards frequented by those types, and obtained search warrants based on access attempts. This seems like incredibly flimsy evidence. Someone could post the link as an embedded image, or send out e-mail with the link embedded, and completely mess with the FBI's data -- and... Share Post: Read More... Posted Thursday, March 27, 2008 4:46 PM from Schneier on Security | (Comments Off)

• Science Fiction Writers Offer Homeland Security Advice

  This is embarrassing.... Share Post: Read More... Posted Thursday, March 27, 2008 2:53 PM from Schneier on Security | (Comments Off)

• Malware Targeted Against Pro-Tibet Groups

  My guess is that it's the Chinese government.... Share Post: Read More... Posted Thursday, March 27, 2008 8:04 AM from Schneier on Security | (Comments Off)

• New Cyber-Security Czar

  The U.S. has a new cyber-security czar, Rod A. Beckstrom, who has no cyber-security experience.... Share Post: Read More... Posted Wednesday, March 26, 2008 4:18 PM from Schneier on Security | (Comments Off)

• Hypnotist Thief in Italy

  Okay, this is weird: Police in Italy have issued footage of a man who is suspected of hypnotising supermarket checkout staff to hand over money from their cash registers. In every case, the last thing staff reportedly remember is the... Share Post: Read More... Posted Wednesday, March 26, 2008 12:30 PM from Schneier on Security | (Comments Off)

• Selling a more open environment to management

  Dear Bob ...I actually agree with your position [on opening up PCs, see for example "The feasibility of unlocked desktops," Keep the Joint Running, 3/24/2008] and I try to advocate policies that only "punish the guilty", but this is a very hard sell in the boardroom. Directors will not make decisions Read More... Posted Wednesday, March 26, 2008 11:25 AM from Advice Line | Bob Lewis | (Comments Off)

• NSA's Domestic Spying

  This article from The Wall Street Journal outlines how the NSA is increasingly engaging in domestic surveillance, data collection, and data mining. The result is essentially the same as Total Information Awareness. According to current and former intelligence officials, the... Share Post: Read More... Posted Wednesday, March 26, 2008 8:02 AM from Schneier on Security | (Comments Off)

• Craigslist Scam

  This is a weird story: someone posts a hoax Craigslist ad saying that the owner of a home had to leave suddenly, and this his belongings were free for the taking. People believed the ad and starting coming by and... Share Post: Read More... Posted Tuesday, March 25, 2008 9:33 PM from Schneier on Security | (Comments Off)

• Martin Hellman on the Invention of Public-Key Cryptography

  At the DISI conference last December, Martin Hellman gave a lecure on the invention of public-key cryptography. A video is online (it's hard to find, search for his name), along with PowerPoint slides. (Unfortunately, the video isn't set up for... Share Post: Read More... Posted Tuesday, March 25, 2008 3:21 PM from Schneier on Security | (Comments Off)

• The Security Mindset

  Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled... Share Post: Read More... Posted Tuesday, March 25, 2008 7:27 AM from Schneier on Security | (Comments Off)

• Running an effective meeting

  Dear Bob ...I need some meeting tools, to keep order, steer content on point and so on.I find that often, meetings up here take on a life of their own and the moderator cannot take them back without banging on the table.Also, my boss is very articulate. In the last two tech meetings which he asked me Read More... Posted Monday, March 24, 2008 9:53 PM from Advice Line | Bob Lewis | (Comments Off)

• Paper Enigma Machine

  Build your own paper Enigma machine.... Share Post: Read More... Posted Monday, March 24, 2008 2:44 PM from Schneier on Security | (Comments Off)

• Security Perception: Fear vs Anger

  If you're fearful, you think you're more at risk than if you're angry: In the aftermath of September 11th, we realized that, tragically, we were presented with an opportunity to find out whether our lab research could predict how the... Share Post: Read More... Posted Sunday, March 23, 2008 2:42 PM from Schneier on Security | (Comments Off)

• Quantum Computing: Hype vs. Reality

  Really good blog post on the future potential of quantum computing and its effects on cryptography: To factor a 4096-bit number, you need 72*4096^3 or 4,947,802,324,992 quantum gates. Lets just round that up to an even 5 trillion. Five trillion... Share Post: Read More... Posted Sunday, March 23, 2008 8:29 AM from Schneier on Security | (Comments Off)

• Friday Squid Blogging: Video of Vampire Squid

  Definitely worth watching, especially the squid's security countermeasures near the end of the video.... Share Post: Read More... Posted Friday, March 21, 2008 6:59 PM from Schneier on Security | (Comments Off)

• MC Frontalot Raps About Encryption

  Music. Lyrics.... Share Post: Read More... Posted Friday, March 21, 2008 3:23 PM from Schneier on Security | (Comments Off)

• Fraud Due to a Credit Card Breach

  This sort of story is nothing new: Hannaford said credit and debit card numbers were stolen during the card authorization process and about 4.2 million unique account numbers were exposed. But it's rare that we see statistics about the actual... Share Post: Read More... Posted Friday, March 21, 2008 8:39 AM from Schneier on Security | (Comments Off)

• Wacky Airplane Security Idea

  Force everyone to wear a bracelet that, when remotely activated, gives the person a debilitating shock. No, really. A company is trying to commercialize this idea. The mind boggles.... Share Post: Read More... Posted Thursday, March 20, 2008 4:21 PM from Schneier on Security | (Comments Off)

• Licensing rules for virtual machines

  More about the legalities of running multiple virtual machines on the desktop:I did some research on Microsoft's website. The language seems quite clear: OS licenses are tied to physical machines, not virtual machines.In the current EULA for Windows XP Professional Edition Service Pack 2, the relevant Read More... Posted Thursday, March 20, 2008 9:54 AM from Advice Line | Bob Lewis | (Comments Off)

• Detecting Gunshots

  Minneapolis -- the city I live in -- has an acoustic system that automatically detects and locates gunshots. It's been in place for a year and a half. The main system being considered by Minneapolis is called SpotShotter. It could... Share Post: Read More... Posted Thursday, March 20, 2008 9:27 AM from Schneier on Security | (Comments Off)

• Border Security: the Weakest Link

  Despite "heartbeat sensors, CO2 probes to detect exhaled breath and "passive millimetre wave" scanners which can 'see through vehicles," it's easy to sneak into the UK from Calais due to inadequate fencing.... Share Post: Read More... Posted Wednesday, March 19, 2008 3:00 PM from Schneier on Security | (Comments Off)

• The ROI of metrics

  Dear Bob ...I have long been a skeptic of metrics in IT. So many problems -- measuring the right thing, the reliability and sensitivity of the measures, creating perverse incentives, and gaming the measurement systems for starters. As a CIO, the only thing that really matters to me is how well the services Read More... Posted Wednesday, March 19, 2008 9:43 AM from Advice Line | Bob Lewis | (Comments Off)

• More Threat Modeling at Microsoft

  This is another excellent series of posts on threat modeling, this time from Microsoft's Adam Shostack. (I already blogged this series by Larry Osterman.)... Share Post: Read More... Posted Wednesday, March 19, 2008 8:47 AM from Schneier on Security | (Comments Off)

• The Continuing Slide Towards Thoughtcrime

  A suggestion from the UK of putting primary-school children in a DNA database "exhibit behaviour indicating they may become criminals in later life." Pugh's call for the government to consider options such as placing primary school children who have not... Share Post: Read More... Posted Tuesday, March 18, 2008 4:12 PM from Schneier on Security | (Comments Off)

• Bomb Squad Defuses Turnip

  Props to the writer who came up with the first sentence of the story: A raw turnip was at the root of a bomb scare that last for hours at a law office. And a follow-up.... Share Post: Read More... Posted Tuesday, March 18, 2008 1:30 PM from Schneier on Security | (Comments Off)

• Risk and the Brain

  New research on how the brain estimates risk: Using functional imaging in a simple gambling task in which risk was constantly changed, the researchers discovered that an early activation of the anterior insula of the brain was associated with mistakes... Share Post: Read More... Posted Tuesday, March 18, 2008 8:51 AM from Schneier on Security | (Comments Off)

• Security in Montana

  Three items. The first is about the difficulty of implementing REAL ID in areas so remote they don't have a permanent DMV. The second is about airport security at airports so remote they average only two passengers per flight. The... Share Post: Read More... Posted Monday, March 17, 2008 3:17 PM from Schneier on Security | (Comments Off)

• Camera that Sees Under Clothes

  Interesting: A British company has developed a camera that can detect weapons, drugs or explosives hidden under people's clothes from up to 25 meters away in what could be a breakthrough for the security industry. The T5000 camera, created by... Share Post: Read More... Posted Monday, March 17, 2008 8:30 AM from Schneier on Security | (Comments Off)

• Legal challenges to virtual machines

  Dear Bob ...I talked with our PC support group about the topic you've been discussing the past few weeks [see for example "Getting to 21st century IT," Keep the Joint Running, 3/3/2008 - Bob].The overriding concern voiced is the liability for improperly licensed software. From the company's point of Read More... Posted Saturday, March 15, 2008 5:03 PM from Advice Line | Bob Lewis | (Comments Off)

• Friday Squid Blogging: Squid Craft Projects

  How to knit and felt a squid. Knit your own squid amigurumi. A squid scarf. And a crocheted squid cat toy.... Share Post: Read More... Posted Friday, March 14, 2008 6:15 PM from Schneier on Security | (Comments Off)

• Are weekly status reports a good idea?

  Dear Bob ...What do you think of weekly status reports for developers?As an IT manager with a number of direct reports, I find it hard to keep track of work being done so I know when to assist some developers. More to the point, some developers tend to spin their wheels on work and need direction from Read More... Posted Friday, March 14, 2008 4:13 PM from Advice Line | Bob Lewis | (Comments Off)

• Surveillance Cameras

  Interesting article from Popular Mechanics on surveillance cameras -- I'm quoted in several places. And this about watching back.... Share Post: Read More... Posted Friday, March 14, 2008 2:31 PM from Schneier on Security | (Comments Off)

• London Tube Smartcard Cracked

  Looks like lousy cryptography. Details here. When will people learn not to invent their own crypto? Note that this is the same card -- maybe a different version -- that was used in the Dutch transit system, and was hacked... Share Post: Read More... Posted Friday, March 14, 2008 9:27 AM from Schneier on Security | (Comments Off)

• Stealing from Bookstores

  Fascinating: There's an underground economy of boosted books. These values are commonly understood and roundly agreed upon through word of mouth, and the values always seem to be true. Once, a scruffy, large man approached me, holding a folded-up piece... Share Post: Read More... Posted Thursday, March 13, 2008 3:06 PM from Schneier on Security | (Comments Off)

• Physically Hacking Windows Computers via FireWire

  This is impressive: With Winlockpwn, the attacker connects a Linux machine to the Firewire port on the victim's machine. The attacker then gets full read-and-write memory access and the tool deactivates Windows's password protection that resides in local memory. Then... Share Post: Read More... Posted Thursday, March 13, 2008 1:54 PM from Schneier on Security | (Comments Off)

• ENISA Report on Security and Economics

  Ross Anderson, Rainer Böhme, Richard Clayton, and Tyler Moore have published a major report on security and economics: "Security, Economics, and the Internal Market," published by the European Network and Information Security Agency (ENISA). It's 114 pages long, and I... Share Post: Read More... Posted Thursday, March 13, 2008 8:05 AM from Schneier on Security | (Comments Off)

• Chip and PIN Vulnerable

  This both is and isn't news. In the security world, we knew that replacing credit card signatures with chip and PIN created new vulnerabilities. In this paper (see also the press release and FAQ), researchers demonstrated some pretty basic attacks... Share Post: Read More... Posted Wednesday, March 12, 2008 4:12 PM from Schneier on Security | (Comments Off)

• Hacking Medical Devices

  Okay, so this could be big news: But a team of computer security researchers plans to report Wednesday that it had been able to gain wireless access to a combination heart defibrillator and pacemaker. They were able to reprogram it... Share Post: Read More... Posted Wednesday, March 12, 2008 12:39 PM from Schneier on Security | (Comments Off)

• German Courts Rule on Spying in Cyberspace

  Good ruling: The Federal Constitutional Court in Karlsruhe said cyber spying violated individuals' right to privacy and could be used only in exceptional cases. More info: Germany's Federal Constitutional Court has rejected provisions adopted by the State of North Rhine-Westphalia... Share Post: Read More... Posted Wednesday, March 12, 2008 8:18 AM from Schneier on Security | (Comments Off)

• Searching for Terrorists in World of Warcraft

  So, you're sitting around the house with your buddies, playing World of Warcraft. One of you wonders: "How can we get paid for doing this?" Another says: "I know; let's pretend we're fighting terrorism, and then get a government grant."... Share Post: Read More... Posted Tuesday, March 11, 2008 4:42 PM from Schneier on Security | (Comments Off)

• FAA Badges Missing

  I don't know how big a deal this really is, but it is amusing nonetheless: According to the investigation, 122 Federal Aviation Administration safety inspector badges have been stolen or lost in the past five years. The credentials are one... Share Post: Read More... Posted Tuesday, March 11, 2008 1:14 PM from Schneier on Security | (Comments Off)

• Privacy and Power

  When I write and speak about privacy, I am regularly confronted with the mutual disclosure argument. Explained in books like David Brin's The Transparent Society, the argument goes something like this: In a world of ubiquitous surveillance, you'll know all... Share Post: Read More... Posted Tuesday, March 11, 2008 8:09 AM from Schneier on Security | (Comments Off)

• Israel Implementing IFF System for Commercial Aircraft

  Israel is implementing an IFF (identification, friend or foe) system for commercial aircraft, designed to differentiate legitimate planes from terrorist-controlled planes. The news article implies that it's a basic challenge-and-response system. Ground control issues some kind of alphanumeric challenge to... Share Post: Read More... Posted Monday, March 10, 2008 2:24 PM from Schneier on Security | (Comments Off)

• Security Products: Suites vs. Best-of-Breed

  We know what we don't like about buying consolidated product suites: one great product and a bunch of mediocre ones. And we know what we don't like about buying best-of-breed: multiple vendors, multiple interfaces, and multiple products that don't work... Share Post: Read More... Posted Monday, March 10, 2008 8:33 AM from Schneier on Security | (Comments Off)

• More on whether or not to open up PCs

  Dear Bob ...I've read your recent article concerning the PC at work viz-a-viz the PC at home ("The portal," Keep the Joint Running, 2/25/2008).Needless to say as a support technician dealing with the users in a corporate environment, the idea of the PC as a portal is not only a bad one, it merely throws Read More... Posted Saturday, March 08, 2008 4:07 PM from Advice Line | Bob Lewis | (Comments Off)

• Friday Squid Blogging: Squid T-Shirts

  Nice. Not as good.... Share Post: Read More... Posted Friday, March 07, 2008 4:19 PM from Schneier on Security | (Comments Off)

• Me in the News

  I had an op-ed published in the Minneapolis Star Tribune on national ID, and they also ran a small Q&A.... Share Post: Read More... Posted Friday, March 07, 2008 3:47 PM from Schneier on Security | (Comments Off)

• My Talk on "Dual Use Technologies"

  This is video from my talk at CPSR's Technology in Wartime conference.... Share Post: Read More... Posted Friday, March 07, 2008 3:16 PM from Schneier on Security | (Comments Off)

• TSA's Ideal Laptop Bag

  This seems not to be a joke. The Transportation Security Administration is interested in evaluating -- and eventually approving –- the design of certain laptop bags, so travelers would be permitted to pass through security checkpoints without having to remove... Share Post: Read More... Posted Friday, March 07, 2008 11:42 AM from Schneier on Security | (Comments Off)

• Progress

  A whole article about a bomb in Times Square without ever mentioning the "t" word. Along with this, maybe we're turning a corner. Probably not....... Share Post: Read More... Posted Friday, March 07, 2008 7:37 AM from Schneier on Security | (Comments Off)

• And now, time for some self-indulgence

  I use a Treo 700P. Not the newest technology, but certainly not obsolete.I don't travel to Europe very much, but I do have a trip next week, so I called my cellular provider to activate international roaming.I waited in the various queues, was only transferred once, and then was told, "to activate international Read More... Posted Thursday, March 06, 2008 6:09 PM from Advice Line | Bob Lewis | (Comments Off)

• TSA Gangstaz

  Wow.... Share Post: Read More... Posted Thursday, March 06, 2008 2:56 PM from Schneier on Security | (Comments Off)

• Risk of Knowing Too Much About Risk

  Interesting: Dread is a powerful force. The problem with dread is that it leads to terrible decision-making. Slovic says all of this results from how our brains process risk, which is in two ways. The first is intuitive, emotional and... Share Post: Read More... Posted Thursday, March 06, 2008 7:24 AM from Schneier on Security | (Comments Off)

• SurveillanceSaver

  SurveillanceSaver: SurveillanceSaver is a screensaver for OS X and Windows that shows live images of over 400 network surveillance cameras worldwide.... Share Post: Read More... Posted Wednesday, March 05, 2008 3:23 PM from Schneier on Security | (Comments Off)

• More on PC lockdown policies

  Dear Bob ...I found it ironic, that just as you are suggesting a new way of looking at the PC (in "The portal," Keep the Joint Running, 2/25/2008), Microsoft is making it even easier to look at it the old way.I received from InfoWorld a letter: A long, long look at Windows Server 2008. This is Tom Yager's Read More... Posted Wednesday, March 05, 2008 8:36 AM from Advice Line | Bob Lewis | (Comments Off)

• Creating and Entrapping Terrorists

  When I wrote this essay -- "Portrait of the Modern Terrorist as an Idiot" -- I thought a lot about the government inventing terrorist plotters and entrapping them, to make the world seem scarier. Since then, it's been on my... Share Post: Read More... Posted Wednesday, March 05, 2008 7:25 AM from Schneier on Security | (Comments Off)

• Google Vulnerability Scanner

  We've all known for years that you can use Google to scan for vulnerabilities. Well, now the process has been automated. Presenting: Goolag Scanner from the Cult of the Dead Cow. I've seen a lot of pre-release scanning results from... Share Post: Read More... Posted Tuesday, March 04, 2008 1:12 PM from Schneier on Security | (Comments Off)

• Getting to 21st century IT - User-owned PCs?

  In this week's Keep the Joint Running, ("Getting to 21st century IT," 3/3/2008), I mentioned a radical approach:Correspondent Richard Resnick provided the most extreme suggestion: No corporate-owned PCs at all. Let employees buy their own -- whatever they think they need to do their jobs. It's Nicholas Read More... Posted Tuesday, March 04, 2008 8:45 AM from Advice Line | Bob Lewis | (Comments Off)

• TrueCrypt 5.0

  There's a new version of TrueCrypt, the free open-source disk encryption software.... Share Post: Read More... Posted Tuesday, March 04, 2008 7:35 AM from Schneier on Security | (Comments Off)

• InfoWorld Article About Me

  Kind of an interview.... Share Post: Read More... Posted Monday, March 03, 2008 2:24 PM from Schneier on Security | (Comments Off)

• Good Uses for RFID Chips

  To automatically inventory the tools a truck is carrying. To find misrouted luggage at an airport.... Share Post: Read More... Posted Monday, March 03, 2008 7:45 AM from Schneier on Security | (Comments Off)