You are here

Security

Observations on information security.

More puzzles from the Puzzle Palace

A reader pointed me to an apparently dull collection of NSA documents recently posted by that useful source, GovernmentAttic.org. One of the hidden gems is a "CMI Newsletter" containing a eight pages of crypto puzzles.

I've taken the liberty of posting the CMI Newsletter separately (PDF, click this link), but kudos go to GovernmentAttic for dredging up this diamond in the rough. If you work out answers, feel free to post them here, or at least provide a pingback so interested people can find them.

Post category: 

More on the Internet Kill Switch

OK, I've calmed down and looked at recent news reports. First, I'm relieved to see that the Obama administration is not in fact behind this nonsense - it's a cadre of clueless US Senators. Second, the Administration is not supporting this nonsense.

Post category: 

The Internet "Kill Switch" is Nonsense

ARE THEY KIDDING ME? DON'T THEY HAVE ANY REMOTELY INTELLIGENT ADVISORS IN THE WHITE HOUSE THESE DAYS? I THOUGHT PRESIDENT OBAMA WAS TECH SAVVY!

Okay, I got that off my chest. [see later post]

For those who came late to the party, here's how to think of the "Internet Kill Switch." Substitute "Internet" for any of these:

  • National highway system
  • National airspace
  • Nationwide broadcast system
  • Starbucks
You can't have an "Internet Kill Switch" for the same reason you can't have a "Starbucks Kill Switch." The things being controlled are thoroughly distributed and they operate independently.

Yes, the President can always declare a "Starbucks Emergency" and demand shutdown of all Starbucks (and Caribou and Dunn Brothers and other caffiene chains, to be fair). But there's no real control over such things. Someone won't get the word, or they'll ignore it.

Wordpress tag: 
Post category: 

The challenge of employee monitoring

Tam Harbert has posted a fairly even-handed discussion of employee monitoring in Computerworld. This is a difficult topic to address, since it treads on the fine line between employee privacy and a company's obligation to ensure efficient use of their resources. When Secure Computing bought Webster Webtrack, a web filtering product, back in the 1990s, the developers said that they'd see drops of 70% in web traffic when users knew they were being monitored.

It's a well known fact - people are more likely to behave if they think they're being watched. And it's easy to waste time surfing the web.

Post category: 

Spreadsheet CPU

Back when I was teaching full-time, I constructed a CPU simulation in Excel. Originally I used it to teach non-majors about CPU instruction cycles, an obscure topic included in an obsolete list of the course's required topics.
Post category: 

A Memoir of Secure Computing Corporation

Now that Secure Computing Corporation is a memory, having been acquired by McAfee, I'm going to write up a few memories of my own experiences. At one point I posted much of this in the appropriate Wikipedia entry, but that's actually not kosher. Since much of it is based on personal recollection, these words fall in line with what they call "original research." So I'm posting it here.

scclock-sm

I joined Secure Computing about a year after it came into existence. It was called "Secure Computing Technology Corporation" at the time. By the time I left, they'd gone through three more company presidents, 4 corporate logos, several mergers, and bounced the corporate headquarters from Minnesota to Silicon Valley.

Data Disclosure by Copy Machines

When Joanne emailed me this video a few days ago, I responded with "Yes, yes, of course. Copiers are digital. They save stuff." But then I watched the video. THIS IS BAD:

This is why all hard drives should have built-in encryption.

Post category: 

Graphic of Facebook Privacy

One Matt McKeon of IBM has created a terrific graphical timeline of privacy erosion on Facebook. It's pretty alarming.

A pundit at Wired suggests the development of an open-systems alternative. It's an interesting idea.

Post category: 

Parameter substitution attack on antivirus software

Researchers at matousec.com have found a parameter substitution attack on antivirus software.

One effective antivirus strategy is to watch how a program uses the operating system. Malicious software may tell the system to do suspicious things, like loading an invalid kernel mode driver. The antivirus software checks the parameters passed to system functions to detect and block such things.

However, the antivirus software performs the checks on user mode data. Thus, a subverted user mode program can swap a "safe" parameter for a subverted one after the antivirus check takes place. This is especially true when you have multiple cores.

Post category: 

9-year-old hacks the school superintendent

Jeremy Epstein reported this terrific report to Peter Neumann's Risks List: a school kid logged in as superintendent of schools. This was in Fairfax County, where I grew up. They use Blackboard, just like the college where I teach.

And yes, we're talking about a nine-year-old. It turned out to be a security policy problem. A teacher can add a student to a class, and a teacher has the power to change a student's password.

The kid found out his teacher's Blackboard password. They don't say how in the news, but it may have been written on a post-it, or some other piece of paper, or it may be the same as a password the kid watched the teacher use somewhere else, or it could just be an easy-to-guess choice.

Wordpress tag: 
Post category: 

Pages

Theme by Danetsoft and Danang Probo Sayekti inspired by Maksimer