NoticeBored blog

As if to mark the release of our latest security awareness module on cryptography*, Stephen Murdoch and Ross Anderson of Cambridge University have released a highly critical report into the security of the Veri fed by Visa and MasterCard SecureCode authentication systems. True to one of the central messages in the awareness materials, their main complaints revolve not around the cryptography, per se, but rather the implementation. It seems the banks, credit card companies, merchants and service providers have failed to pay sufficient attention to the poor human beings who use the system. Human factors significantly weaken a design that probably looks great on paper.

* Not so, of course, it was purely a coincidence.

Labels: Authentication, Awareness, Crypto

Well here's a new take on an old scam - well possibly two old scams in one as it has elements of both 419 advance fee fraud and phishing about it (click on the email screenshot to see it in its full glory - I added the red highlighting).

I must say I have never before had scammers offering to send me my own "account online log in and password". What's the betting there is a small charge to release the information?

Labels: Authentication, Email, Fraud, Social engineering

The drip-feed of news about the Terry Childs case continues. [Quick recap: Childs held the City Government of San Francisco to ransom by refusing to divulge the city's network admin passwords that were under his sole control.] The Washington Post tells us:

"Childs compromised more than 1,100 devices and created unauthorized network doorways, allowing him unfettered and undetectable access. He collected pages of user names and passwords, including his supervisor's, to use their network log-ons. And he downloaded thousands of gigabytes of city data -- possibly privileged information, such as police reports and e-mails -- to a personal encrypted storage device. Experts still aren't sure what data the device contains."

'Thousands of gigabytes'? That's an impressive capacity for a personal storage device.
The Post also says Childs had a criminal record:

"Childs, as it turns out, carried a list of convictions, including aggravated burglary, aggravated robbery and theft, according to court documents. He also served four years in the Kansas state prison. Childs kept this from his employment application, court documents note. Vinson said San Francisco will probably expand its employee background checks to cross state lines."

Good idea!
Still, I agree with the thrust of the article that SF management's failings extend well beyond checking Childs' references. Childs was a privileged insider placed in a position of great responsibility and trust by management. It appears that management recognized the risk but failed to address it adequately. Dawn Capelli's comments about the insider threat are very apt. I'd call this a governance failure.

September update: San Francisco city's Department of Telecommunications and Information Services (DTIS) has spent just under $200k already, investigating what Childs has done to the network and hunting for a terminal server providing him a back-door.  The full cost is estimated to be around $1m.

Labels: Authentication, Confidentiality, Governance, Network, Risk, Trust

The Information Card Foundation is a trade body representing "a group of thoughtful designers, architects, and companies who want to make the digital world easier for you by building better products that help you get control of your personal information", and promoting the concept of "Information Cards". There are some big- and not-so-big-name backers.

Billed as "the digital version of the cards in your wallet" and "the new way to control your personal data and identity on the web", Information Cards (also known as InfoCards or I-Cards) are stored in an identity selector ("selector" or "digital wallet") on your desktop, browser or mobile device. Websites that accept Information Cards access the stored card, retrieving user identity and authentication information automatically without the user having to login in the conventional way. Other information such as your shipping address can also be retrieved automagically.

So far, this sounds reminiscent of cookies (oh no!) but presumably those 'thoughtful designers and architects' have been beavering away on the security and privacy aspects. The Information Cards Forum website doesn't actually say much about the technology, unfortunately. Perhaps they've thought through the use of powerful encryption algorithms, long keys and solid protocols. Maybe they've considered shared and public PCs, cross-site issues and more. Perhaps this time they'll get it right.

If you change your address, you only have to update it in your personal data store, and all the relationships you have established with your Information Card will be updated automatically.

OR

'If a hacker changes your address, they only need to update it in your personal data store and all the sites that use your I-Card will use the hacked version'. I wonder if the automation will be such that the user never even notices that his bank statements and goods ordered online are now being delivered to a strange PO box address half way across the country?

Use "I-Cards" to:

- login to websites with a single click

- create relationships with those you want to do business with

- manage your personal data in one place that only you and those you allow have access.

- wield the claims that other people and institutions say about you.

- prove that you are who you say you are without revealing details using trusted identity providers.

The first bullet - single click website logins - and several others on the list can be achieved already with all manner of browser-integrated password vaults.

I have no idea what bullet 4 means by "wielding claims". I understand you can wield an ax but not a claim.

The last bullet presumably implies the use of digital certificates and PKI. So that's alright then. No issues there.

I'll be interested to see how this initiative pans out. So far, it looks suspiciously like a vendor-backed "solution" looking for a market demand. Claims to the effect that the ICF will develop vendor-independent standards (for interoperability among, presumably, the ICF members) hint at the real objective here. Get something to market (or rather, 'launch the concept') and start building the I-Card brand before some idiot has the temerity to point out the flaws.

Labels: Authentication, Fraud, Hacking, ID theft, Integrity, Privacy, Risk, Secrecy, Trust

At last! Indiana has seen the light!

A new Indiana state law comes into effect on July 1st mandating disclosure of breaches involving loss or theft of laptops containing personal data, even if the data are 'protected by a simple password' (such as a normal Windows or Linux login password, presumably).

"Public Law 136 (House Enrolled Act 1197) requires businesses to notify consumers when any of their personal information is contained on a laptop that has been lost or stolen unless that information is encrypted," Pierce said. Current law does not require consumers to be notified about a lost or stolen laptop if personal information about them on the laptop is protected by a simple password.

The article goes on to explain that 'a simple password' can be compromised by brute force attack, which is often true but is not really the point. A hacker with unrestrained physical access to a laptop could remove the unencrypted hard drive, install it on another system and access all the data. Or they could run one of the 'retrieve lost admin password' utilities, typically booting the laptop from an external boot drive or compromising the system's Firewire connection etc.

Unfortunately, the article doesn't make it clear that brute force attacks might also work against the password/passphrase commonly used to secure encryption keys. Multifactor authentication, for example using biometrics or token in addition to the usual user password/passphrase, would make a significant difference, along with tamper-resistant hardware protection for the keys themselves (e.g. the "Trusted Platform Module" or cryptographic smart card). And even then, there are potential attacks if the attacker has sufficient resources, skills and experience.

I haven't read the statute but I'm curious about how it defines 'encrypted'. For example, does it mandate AES with a 256 bit key or would DES with a 56 bit key, or even a Caesar cypher with key of 5, be considered good enough? Defining such things in law would be tricky since the state of the art is moving along constantly. Caesar's cypher was considered good enough 2 millennia ago.

Continuing this line of thinking leads to the inevitable conclusion that personal data cannot be totally secured on a laptop or other device to which an attacker has unrestrained physical access. So, perhaps businesses that lose encrypted laptops containing personal data should come clean anyway since they can still rightfully state that the data were protected by encryption.

Previous posts on this topic: Password protected =/= hacker proof and "Password protected" again

Labels: Authentication, Governance, ID theft, Law, Privacy, Secrecy

ICANN's Security and Stability Committee has released a 12-page advisory on 'registrar impersonation phishing attacks' - in other words, phishing attacks targeting domain name owners ("registrants" in ICANN-speak). Owners' contact details are usually published and can be interrogated for free through WHOIS. Putting the target person's contact details together with the fact that they have registered a domain name provides the phishing hook. Owners are invited to 'login and update their contact details', whereupon the phisher steals the login credentials and, presumably, manipulates the DNS entries for their own nefarious purposes.

Labels: Authentication, Fraud, ID theft, Network

Ross Anderson's team at Cambridge University has demonstrated physical security vulnerabilities in two of the devices commonly used to validate chin-and-PIN cards in the UK. The vulnerabilities would enable an attacker with sufficient physical access to the devices and some manual dexterity with a needle or bent paper clip to hack them, exposing PIN codes. With PIN codes plus data from the magnetic stripes, card hackers could create fake cloned cards that work in non chip-and-PIN validators (which are becoming uncommon in the UK now, but less so abroad), or in chip-and-PIN validators that fallback to the magstrips if card chips don't work.

This ably demonstrates the difference between "tamper resistance" and "tamper proofing". The chip-and-PIN security mechanism, like many others, was designed to resist certain attacks not to prevent them. Compromises inevitably had to be made during the chip-n-PIN design specification prosess for the sake of cost, usability etc., including the decision to retain magstripes on chipped-cards (as the team puts it, "Essentially, the vulnerabilities we exploit are not just a matter of hardware design, but also of the options many banks chose as they implemented EMV"). Hackers, as a breed, feed on such security compromises. There is no shortage of fodder. We've already seen miniature CCTV cameras plus magstripe readers used in the wild to capture PINs and card data on ATM skimmers, and chip-n-PIN device tampering in frauds at Shell service stations in the UK in 2006.

The team draws out some general lessons in the paper, aspects such as:
- the complexity of the EMV specifications (leading to local interpretations and the introduction of further unintended flaws)
- obvious conflicts of interest that result from equipment vendors selecting and paying security labs to assess their products against Common Criteria - something economists call "moral hazard" apparently - plus the commercial pressure on labs to issue pass slips like confetti (same with ISO/IEC 27001 certifications!)
- further issues that arise when product assessments and certifications are clouded in secrecy, thanks to the whole banking industry closing ranks and lax controls by the UK's Common Criteria certification body (apparently, anyone can claim to have had their product Common Criterial Evaluated, whereas they must have actually passed the tests to claim Common Criteria Certified ...)
- the potential applicability of this kind of hack to other tamper-resistant mechanisms such as on electronic voting terminals. The same class of attack would probably succeed against devices using biometric mechanisms (fingerprints, iris scans, whatever) for user validation: if the codes sent by a biometric reader can be captured in the clear en route to the encryption/validation guts, they can probably be replayed or used for other attacks. Blog-reading designers of dual-interlock atomic missile launch fire biometric authorization mechanisms please take note. Tamper resistance has its limits.

The paper is well written and thought provoking for hackers and security professionals alike, even those with only fleeting interest in chip-n-PIN while paying for stuff.

Labels: Authentication, Physical

Authentication of users is one of our core security awareness modules, updated and re-released annually. Last year, the module focused on identity theft. This time around, we concentrate on multifactor authentication using security tokens and biometrics. We still provide basic advice on choosing good passwords and keeping them secret, naturally, but we think it's time for management and IT, in particular, to look seriously at upgrading the old username/password systems.

Failure to authenticate and thus distinguish genuine from bogus users can potentially cause devastating impacts on business critical systems, especially for privileged users and those with access to key transactions. On most systems today, the only real barrier to hackers, industrial spies, malicious insiders and fraudsters with access to the login prompt is the time and effort it takes them to guess the correct combinations of username and password: with automated password crackers, that control is barely even a speedbump on the information superhighway.

Cryptographic smart cards, digital certificates, syncrhonized pseudo-random password generators, fingerprint readers, iris scanners and so forth are certainly not perfect at authenticating users but, like the only house on the street with a burglar alarm, there's a reasonable hope that most hackers will move along to easier targets. If your organization isn't already using multifactor authentication, you're putting yourself in the firing line.

Labels: Authentication, Awareness

Dongles are cryptographic hardware devices with which the PC communicates, firstly to establish that the device is present and secondly that the device is authentic. They are commonly used as copy-protection devices to unlock protected software but one vendor is selling a dongle for Internet banking. It communicates with the PC via the headset jack, rather than say USB.

More authentication and IPR resources

Labels: Authentication, IPR

A well-researched and well-written article about online banking user authentication discusses the range of authentication methods being used or trialled at a number of primarily US banks. Whereas the FFIEC regulations were anticipated to force US banks into using tokens for user authentication by the end of this year, banking customers are proving resistant to the technology and want an easier way to authenticate to the bank [the problem of the bank authenticating to the user merits a brief mention too]. User authentication is crucial to the issue of accountability: a customer cannot be held totally accountable for dubious transactions on his bank account if the bank cannot prove that the customer, rather than 'someone else' (normally a fraudster), logged in and submitted or authorized the transactions. The article discusses device as well as user authentication, in other words 'fingerprinting' the users' PCs to identify their normal machines. Not surprisingly, it barely touches on the back-end anti-fraud systems the banks are using to identify unusual customer activities that might be symptomatic of a fraud in progress: these details are proprietary to each bank (which limits the amount of information sharing between banks) and a closely guarded secret (to avoid tipping-off the very fraudsters they are designed to trap).

More accountability and authentication links

Labels: Accountability, Authentication, Fraud

The Washington Post reports that over 1,100 laptops have gone missing from the US Commerce Department since 2001. Congress was told that "1,137 laptops had been stolen, lost or otherwise vanished since 2001, mostly from the Census Bureau and the National Oceanic and Atmospheric Administration. Of these, 249 contained personally identifiable information, nearly all from the Census Bureau. All were password-protected, a low-level safeguard. Only 107 of the computers were fully encrypted." So if the Census Bureau or other parts of the Commerce Department has sensitive data about you on its laptops, you'd better hope it is on the one-in-ten encrypted systems.
More laptop security links

Labels: Authentication, Mobile

The Federal Financial Institutions Examination Council (FFIEC) has released an FAQ about their requirement for US banks to improve user authentication for Internet banking customers. The “guidance” to banks issued in 2001 and updated in October 2005, and the impending deadline is evidently causing some consternation in the US banking world. The FAQ ‘clarifies’ issues such as multifactor authentication and tokens. These are not absolutely required but there are certain very limited circumstances under which they might not be needed. “An institution’s risk assessment may conclude that existing controls are appropriate. However, such a conclusion would not be justified if the institution’s electronic banking systems use single-factor authentication as their only control for high-risk transactions involving access to customer information or the movement of funds to other parties.” There you go, clear as mud.
More identity theft and user authentication resources

Labels: Authentication, ID theft

A Beaumont Hospital Home Care laptop was stolen from the car of a home care nurse, reports Metro Detroit. The nurse, a new employee, "broke hospital policy by leaving her access code and password with the computer". Doh! Data on more than 28,000 present and former patients have been compromised. "The best protection is to train and educate people who use this information as part of their jobs, to have an awareness of the things they need to do to keep this protected," said Michael Friedman, an attorney in Detroit who has handled several HIPAA cases. "It's not a sophisticated technological solution." Having covered identity theft in this month's NoticeBored security awareness module, we'll be moving on to mobile/portable IT and teleworking next month ... what more can we do to encourage organizations to invest proactively in security awareness?
More identity theft links

Labels: Authentication, Awareness, ID theft, Mobile, Risk

A news item in Computer World reports that Unisys (in conjuction with the Veterans Administration and FBI) is offering a $50,000 reward for information leading to the return of a missing desktop computer containing personal data on 38,000 vets. The machine went missing from a Unisys office.
The same article notes the theft from an unnamed accountancy firm of a portable PC containing personal details on an unknown number of Chevron employees. Another report on the Chevron incident says the firm notified employees that "a laptop computer was stolen from an employee of an independent public accounting firm who was auditing our employee savings, health and disability plans". The data included names and Social Security Numbers (at least), and was protected 'by a password'. The absence of a clear statement re the use of encryption is worrying but is all too common. Wake up!
More identity theft info

Labels: Authentication, ID theft, Incidents, Mobile

If, like me, you saw the news items lately about a Cardiff University researcher revealing flaws in the Internet banking user authentication process used by the UK part of HSBC, you have probably been wondering about the details. The journalists refer somewhat vaguely to the exploit involving the use of keyloggers on customers' PCs, which is a significant vulnerability in the first place although unfortunately not uncommon these days. They say capturing details from just 9 logins or less provides sufficient information to complete the exploit - this presumably points to the hacker needing to capture the user's complete password even though only parts are requested each time. Various amateur researchers have been analysing the mathematics involved in the login process, but while there are flaws, they cannot analyse their way directly to being able to capture the complete password in "nine tries or less, typically 5" as mentioned in some of the original news aticles. At least one article referred specifically to a flaw in the web scripting which perhaps hints at a weakness in the exchange of information between the bank and the logging-in customer: my guess would be a vulnerability in the algorithm that "randomly" selects which digits are required. Perhaps it is not truly random, maybe a simple sequence or at least a predictable sequence, due to an implementation flaw I suspect. If so, it wouldn't be the first encryption scheme to fail through supposedly random numbers in fact having predictable patterns.
More identity theft links

Labels: Authentication, ID theft

Although it is evidently intended to be an exam manual or study guide, the Federal Financial Institution Examination Council's IT Examination Handbook on Information Security could easily be mistaken as an information security manual. It bears more than a passing resemblance to ISO 17799, NIST, COBIT and SAS70 (amongst others) which are acknowledged as reference sources. There are "action summaries" containing key points from each section, such as this one for authentication: "Financial institutions should use effective authentication methods appropriate to the level of risk. Steps include: Selecting authentication mechanisms based on the risk associated with the particular application or services; Considering whether multi-factor authentication is appropriate for each application, taking into account that multifactor authentication is increasingly necessary for many forms of electronic banking and electronic payment activities; and Encrypting the transmission and storage of authenticators (e.g., passwords, personal identification numbers (PINs), digital certificates, and biometric templates)." A free 138 page infosec manual is not to be sneezed at.
More authentication and identity theft resources

Labels: Authentication, ISO27000, Risk

If you like news stories with a pinch of drama and intrigue, Martha Baer's piece on identity theft will grip you. Starting with the description of a police raid on an identity thief's home, the story focuses on a particularly successful e-crimes unit dealing with everything from lone drug pushers to gangs of assorted criminals actively exploiting identity theft to scrape their sordid living. Their success stems from selectively checking-up on fraudsters released on parole. Strangely enough, they find a significant proportion of former offenders re-offend.
More authentication links

Labels: Authentication

An identity theft kit from the Australian Government's National Crime Prevention Programme goes beyond the usual brief fact sheet approach. The 28 page goody pack provides well-written guidance and includes some proforma victim reporting sheets and a checklist.
More ID theft and related links

Labels: Authentication, ID theft

The Seattle Times reports yet another security breach involving the potential compromise of thousands of confidential personal details. "The laptop was grabbed from a Boeing human-resources employee at an airport," said company spokesman Tim Neale. "The laptop was password-protected and was turned off," he said. But the file containing the names, Social Security numbers and in some cases, addresses and phone numbers for 3,600 current and former employees was evidently not encrypted, despite a directive issued five months ago to remove or encrypt all sensitive information on laptops.
Whereas a few years ago it would have been infeasible for anyone to carry 3,600 personnel records without a large trolley for the filing cabinets, all modern laptops have sufficient hard disk space for the data and a whole lot more. They also have the CPU capacity to apply strong encryption. Boeing is certainly not alone in failing to apply suitable security measures to protect senstive data on vulnerable hardware.
More confidentiality resources.

Labels: Authentication, Incidents, Mobile, Secrecy

Microsoft's advice on Strong passwords: How to create and use them recommends "Do not type passwords on computers that you do not control. Computers such as those in Internet cafes, computer labs, shared systems, kiosk systems, conferences, and airport lounges should be considered unsafe for any personal use other than anonymous Internet browsing. Do not use these computers to check online e-mail, chat rooms, bank balances, business mail, or any other account that requires a user name and password. Criminals can purchase keystroke logging devices for very little money and they take only a few moments to install. These devices let malicious users harvest all the information typed on a computer from across the Internet - your passwords and pass phrases are worth as much as the information that they protect."
Sound advice. You need to balance the convenience of web access whilst waiting for your coffee, plane or train, against the inconvenience of having your identity stolen and your bank accounts cleaned out.
More links on keeping secrets

Labels: Authentication, Privacy, Secrecy

CastleCops and Sunbelt Software have launched PIRT (Phishing Incident Reporting and Termination squad - an initiative to receive and analyze phishing reports and to help get the phishing sites taken offline as soon as possible. Whether they can do any better than the professional organizations already doing this (at a cost) remains to be seen.
More authentication resources

Labels: Authentication, ID theft, Incidents

After briefly debunking some dubious advice about how to avoid phishing sites, an article on HexView makes just three recommendations to avoid phishing.
More user authentication links here

Labels: Authentication, ID theft

Phishing has been described in several NoticeBored modules. It is still hot news. Spear phishing - the targeting of specific individuals such as executives of a particular organization using hand-crafted email lures - remains a serious threat. Read Keeping Up with the Phishers for an excellent description of the problem.
More malware and authentication resources

Labels: Authentication, Email, ID theft, Malware

The US Treasury's identity theft resource page is offering a free DVD about identity theft including a piece from Howard Schmidt, and a whole stack of other papers and information on this topic.
More authentication resources

Labels: Authentication, ID theft

If you ever wondered why information security experts recommend not clicking on the 'remember my login details' or similar options, then check out Protected Storage Explorer. This free Windows tool decrypts and displays usernames and passwords stored in so-called (but clearly not) protected storage.
More authentication resources

Labels: Authentication

Finnish antivirus vendor F-Secure has published an advisory about fake emails sent out in its name that contain malware. The emails contain the line: "I have enclosed a screen capture of the problem so your team can get it fixed if you deem it an issue." The attachment (presumably) contains not a screenshot but a new variant of the Breplibot worm. This is essentially the same phishing technique often used to send keylogging Trojans to bank customers. The email uses social engineering techniques to fool recipients into doing something silly, in this case opening the attachment.
More malware, social engineering and authentication links

Labels: Authentication, Email, ID theft, Malware, Social engineering

A backdoor in a mainstream security product could certainly be considered a bug. The product is Cisco Security Monitoring, Analysis and Response System (CS-MARS) (CS-MARS) up to version 4.1.2 and the backdoor is an undocumented user ID with a default password giving access to the root fully-privileged administrator ID. Doh! The access was deliberately inserted allegedly for “advanced debugging purposes” - fair enough maybe but why on Earth did it end up in shipped code, and in a security product at that?!
More links on Bugs!

Labels: Authentication, Bugs

Several organizations have started using (simulated) phishing attacks against their own employees as a security awareness activity. The New York State Office of Cyber Security and Critical Infrastructure Coordination, for example, sent staff an internal email asking them to enter their passwords into a ‘password checker’. 17% of their 10,000 users succumbed and were given additional education. When the exercise was repeated a month later, the phishing email phooled just 7% who were presumably given stronger, more explicit advice and encouragement by management regarding their future career prospects.
More authentication resources

Labels: Authentication, Awareness, Email, ID theft, Infosec

The Information Technology Laboratory Biometrics Resource Center offers research papers, standards and other resources on biometrics, with the high quality we have come to expect of NIST.
More authentication resources

Labels: Authentication

OECD countries have signed-up to cooperate on the investigation of cross-border frauds. OECD Guidelines for Protecting Consumers from Fraudulent and Deceptive Commercial Practices Across Borders (2003) is a high-level paper defining guiding principles.
More authentication and IT fraud resources

Labels: Authentication, Fraud

Microsoft is reportedly on the verge of releasing an optional utility to track the websites users visit and compare them against a blacklist of phisher sites. Maybe this would work if the blacklist is reliable (no false positives and few false negatives), but the downside is that (for some reason I can’t quite fathom) Microsoft plans to gather details of users’ surfing habits, raising privacy concerns.
More authentication resources

Labels: Authentication, ID theft, Privacy, Secrecy

Applications that are not securely written and configured can open security vulnerabilities that affect the whole system. A 2001 posting by Pete Finnegan, for instance, explains how, under the right (wrong!) circumstances, someone can reveal Oracle user passwords in clear text. Pete has published a fascinating set of papers on Oracle (in)security on his website.
More authentication resources here

Labels: Authentication, Database

Reporting on a study of 1,000 US users of online banking by a market research firm, ZDNet UK News said "many consumers were worried that their personal information could either be stolen by hackers and phishers or sold to third parties by banks. Nearly 83 percent of those who conduct banking online reported such concerns, while 73 percent of respondents said personal information theft is a deterrent for them." By neglecting to mention the threat of ID theft from offline bank users, ZDnet implies that online banking is especially risky, although other studies have indicated the opposite (e.g. see last Friday's blog entry).
More authentication resources

Labels: Authentication, ID theft, Risk

Golly! New technology such as chip-and-PIN will not solve the problem of identity theft. According to Emily Finch, a social scientist from the University of East Anglia, quoted in Computerworld, criminals will find ways around the new technical controls, such as 'snatching credit card application forms and getting new cards and numbers', apparently. Emily also points out that new technology may lead people to be even less vigilant than before.
More resources for authentication

Labels: Authentication, ID theft

The Better Business Bureau's identity theft survey noted that theft of sensitive paperwork is more likely to lead to identity theft than online data compromises. Often, the perpetrator turns out to be someone close to the victim - a family member or friend with access to the victim's personal effects.
More authentication links

Labels: Authentication, ID theft

We have released our next security awareness module on authentication today. Authentication is one of the core topics in information security, covering aspects such as the system login process and access control. Please visit the NoticeBored website or contact us for more details.

Labels: Authentication, Awareness

Data security and backups can be a pain for roving users using portable PCs but SecureTrieve is an attractive option. The system protects data stored on the PC using AES encryption and makes off-site backups through the web. Without the user's password, a thief can't easily see the encrypted files, and even if he can get at them, AES protects them. Meanwhile, the user can retrieve his valuable data from the off-site backup onto another machine. Combining this with PC Phone Home might even give the user a fighting chance of finding the stolen PC when it connects to the web.
More mobile and teleworking security resources

Labels: Authentication, Mobile

The European and Pacific Stars & Stripes reports that an airman based in Japan has been convicted by a court martial for trying to hack PC files on the base using a password cracker program he downloaded from the Internet. It seems the man also uploaded a password file from the base to a personal web server through the Internet, with the risk of third party interception en route.
More anti-hacking resources

Labels: Authentication, Hacking, Risk

Next time you install a new device, load an operating system or install an application, don't forget to change the default installation username and password before you connect it to the network. Over 1700 are published at Virus.Org.
More anti-hacking resources

Labels: Authentication, Hacking, Network

Verisign have found that the majority of people asked were willing to reveal their passwords for a $3 Starbucks coffee token. "According to the company, one executive who was too busy to respond to questions but still wanted a gift card sent his administrative assistant back to complete the survey. The assistant promptly revealed both the executive's password and her own." The survey team have no obvious/legal way to verify the passwords (which is presumably why this was labelled a "light-hearted and unscientific survey") but the take-home message in terms of a general disregard for information security is pretty clear.

Labels: Authentication