Last post for today

HAPPY HOLIDAYS

Vigilante hacker

The following link is to the details of a case in which a hacker using a trojan, retrieved a lot of sensitive information on people in a newgroup but instead of abusing it, selling it or for whatever kicks they want, the hacker instead gave the information to the police, under a different name of course, he kept on feeding information to the police and eventually two kiddie abusers were sentenced with the evidence provided convicting them.

ARTICLE LINK

Because the hacker done a good deed his crime was overlooked, however this case echos the case in which the placement of encryption can work against you as evidence of guilt, now information stolen from your computer can be used as evidence against you, anything you do online or on any device even in your privacy of your home can work against you. Scarey.
Though was good to hear one for the good guys, even though the hacker was commiting a crime, the saying goes

'its not how you start something, its how you end it that counts'

and in the end the hacker done a good deed and as an FBI agent said to the hacker "...you have helped to save at least two lives in the U.S. and (you) should be proud of that fact."

A well known scam still

The nigerian email scam known as the 'The Nigerian Advance Fee Scheme', I joke about, and include a slightly amuzing page

http://j-walk.com/other/conf/index.htm

However if followed through its quite a dangerous scam to full victim of. As it usually requires meeting criminals in discrete locations, even in other countries with cash in hand, alot of cash. Not good. The article I've included talks about this type of scam in more indepth.

http://www.scambusters.org/NigerianFee.html

The article also states the scale of this scam. its attracts more victims than I thought. Especially as its such well known as a online scam.

Ipod worms

Ipods now have every assessory going, but a worm? , well they do now, this case is a clear security flaw.

Basically the case involves worms transfered to ipods by an effected computer, which were sold to customers which later had their pcs effected as they attached their ipods to their pc. What a nice early christmas present.

ARTICLE LINK

The second link is apples stand on the case. They make a jibe at windows putting some blame on them, I quote 'As you might imagine, we are upset at Windows for not being more hardy against such viruses'.

APPLE COMMENTS LINK

What is apple jibing about, windows autorun feature maybe? I hate that feature, I find it annoying however it is bad, as it opens the door. Not good. Though I'm told it will be a feature soon just in memory as the latest windows -vista lacks this feature.

This flaw also applies to other storage devices, portable usb drives, printers now have huge storage, what next?.

Can encryption make you look guilty?

Encryption has become standard on the average computer, appart from whats included, its easy to download encryption software to protect your computer in general and specific encription applications for email and files. But can such actions undertacken by you be used as evidence of you trying to hide something?

I didnt believe so, but upon looking into encryption further I came across this article that made me rethink what I thought.

LINK

'the existence of an encryption program on his computer was at least somewhat relevant to the state's case against him," Judge R.A. Randall a comment from the article on a case in which the placement of encription on the defendents computer was used as evidence of guilt against him.


Though the defendent in this case was a kiddie fiddler in the making is irelivant to the point, once such a ruling is made to allow the placement of encription as evidence then it can be used in other cases with companys/ defendents who arent such people.

not good, as the use of encription will only increase. Besides encription is spose to be a safeguard not work as the opposite.

Web cramming

I came across the term web cramming only recently, web cramming involves a scam in which a person or small business accepts an offer for a free website or internet service only to be subsequently charged a monthly fee on their phone bill.

For example a 30 day free website trial, and upon when the customer goes to cancel after the 30 days, they made it impossible to cancel.

Not so much a financial burdon, as a stressfull inconvience to the victim, I can imagine its similar to trying to cancel membership at a gym, they don't say no but they try and charge you extra and actually make it impossible to cut any connection with them.

The first two links are cases of web cramming that went to court. The third link being a article on the US action towards web cramming and other internet scams.

LINK1

LINK2

LINK3

I hate spam but it makes me laugh

Its true, I hate spam like anyone does, but sometimes it makes me smile, spammers never give up and the different tactics they try, it fasinates me to watch and yes I smile when i come across some bizarre / clever / plain dumb spam. But I hate it as much as to say its one more chore to do.

I remember saying not long ago, I dont get too many spam emails, a few to my junk email box daily, but I use outlook express, so the majority of emails are blocked before getting to outlook express inbox/junkmail box. It wasn't long after that I took it back, as I went on my internet email account and found a mass of spam emails in my junk box. I seem to always forget about this bulk of emails, I'm not one for deleting junk mail, I let it mount up then when it gets to extremes then I delete, I don't touch my online internet account much, its hassel and a chore I don't like.

Check out the number of emails in my junk email box and thats not as much as usual.










Junk emails I have recieved, are all spam, alot of possible scams if taken further, phishing, snooping, trojan, viruses etc, the threats go on and on ( well if I was foolish enough to open or respond).

Heres a few


A possible trojan, worm, virus in an email which is disquised as a security report from the elusive 'customer support service'. These make me laugh, no legit security updates are by email. Though I can understand how people fool for this type of spam, and open the file.













Congratulations youve won, 'but I dont remember entering any competition' , if you don't remember entering anything then the obviously its a scam. You dont get cash for nothing. Come on, even the legit national lottery you have to buy a ticket and a lifetimes amount of tickets/ There is no excuses to fool for this, this is like the scams sent to the elderly, but I'm guessing its not the elderly who fool for this type of email. The spelling is worse than mine, on this blog, the spelling is a major giveaway.





I love this scam email, money transferring but surprisingly not from nigeria, infact its from london or they say it is at least. Targeting those with foreign accounts, foreigners. Im no foreigner neither do I have a foreign account. This just illustates how automated spam sending is, though I wonder on what listings they got my email, it didnt work this time, I dont come close to being the right target for this scam.



Even as I write this post, watchdog is talking scams, online and off.
3 billion is conned out of UK residents a year by scams.
1 -15 people are victims of scams.
And the main age group who fool for scams are 33-45 years old- I can believe that. And thats on watchdog at 7.18 pm.

Ebay fool scam

I came across one of ebays latest scams, the playstation scam. Well its not really anything new actually. Similar scams that misprint items for sale have been going for a very long time, even before ebay and the internet, market traders use similar scams. This scam involved selling the idea of the latest playstation 3, but instead the buyer recieved 3 playstations, the scam was in the title ' 3 playstations' instead of 'playstation 3'.














Though I must say my first thought was 'what fool would buy this scam?' , but many do. And this is just one scam, there are various scams that use the ebay brand for example this one in the link provided.

LINK

Email scam posing as an email from ebay , sent to the loser in a ebay bid to offer a second chance and redirect them to scam their credit card details from them.

I've never been scammed and infact Ive had a good relationship with ebay, Ive never really had a problem, maybe I'm just too observant. However how on earth do people get conned into buying a box instead of a product in the box. Just to eager to purchase, caught up in the rush from bidding maybe, I don't know. What I know is ebay and bidding sites are prime targets by scammers, thousands of people already looking for a deal/ bargain/ something for nothing, they have already opened themselves up to the scams around.

Its like the fortune teller, and people who get sucked in and even go back for more. They say afterwords im not gullible, I was not very closed but she/he said all this stuff that is true. What a scam, the moment they go to a fortune teller , they become targets, they are already willing to believe, they go looking for answers why else would they go, and the scammer gives them exacally what they want to hear . People who dont believe dont go to fortune tellers. The fortune teller has a person whos open, so its easy. The perfect target for scammers.

There will always be scams, that won't change though education is needed to illustrate some of the obvious scams to users, even if they are blind to them and only see shiny things.

Is chip and pin safe?

I like cash, well everyone likes cash, but what I mean is I prefer to handle transactions in cash. Yes its not safe or reliable as such, but is using a card any safer? How about chip and pin?

One senario Ive seen time and time ago is during a store purchase a customer places their card on the till desk, while the cashier is packaging goods or still swiping them and the customer gets distracted or turns away. Not safe.

I saw this the other weekend, a busy shopping day at christmas, a couple were at the till the cashier was wrapping goods the women always destracted by shiny things walked a drift, the man had a call on his mobile, placing his card on the till desk, making a note with the cashier that its for his wife to pay, while he dashed off to answer the call, the cashier fished wrapping and asked the wife for payment, the wife going to the husband, he came back saying 'but I gave it to you?' the husband under pressure with a que building, paid by cash and they left without a second thought. Appart from the fact the cashier was a thief and noone said anything, the couple were clearly working professionals and competent, but they let it happen, they walked away.

It didn't matter that the card was chip and pin, what other risks are there with chip and pin?


They use a 4 digit number , the encryption is smaller than online shopping in which you use your full card number, the encryption is more open to attack?

The pin is a number, but many people find it difficult to remember their number, they write it down or change their card pin to birthday or lucky numbers, not safe, quite predictable?

If your card is abused, it happens, its impossible to prove it, as a digit pin has been typed in, how can you prove it wasn't you, with a signeture this was easier to prove your innocence, but with the chip and pin you are guilty untill you prove other.

Once people feel more safe by them, they will become less careful, its still often easy to see what a person types in to the keypad, especially in pushy ques.

These are the risks I can think of, however the following articles go on further:

LINK (Comments of Bruce schneiers blog).
Some really interesting responses regarding chip and pin and changable pin numbers.

LINK2(Article on chip and pin from the bbc).
The part of this article which is worth making a point of is how banks are avoiding liability for fraud by making the customer liable.

LINK3(An article on the flaw in the system that allows insiders to guess pin numbers).
Intresting, but it also the point is in regards to any bank you have dealings with not just your own bank.

LINK4(Everything on chip and pin).
A pdf document on chip and pin Advantages/ disadvantages , casestudies, a real good resource to know chip and pin from every side.

On a more positive note:

LINK5
Chip and pin has brought card fraud down stated in this article, even if its still possible, it has slowed it down. A big positive.

Chip and pin logically has brought card fraud down, its understandable even from me a critic, however, criminals always find another way and using only four numbers instead of a signature maynot be better in my opinion.

Progress

Im swamped in articles but I'm managing only a couple of posts at a time, this is not good, not nearly fast enough. I need to get a lot more posts done.

epassports and encryption

e passports - a concept which has been in circles from idea to product back to idea again. The concept consists of a passport with a chip inside, a RFID (radio frequency identification chip), which will hold identifing information on a person, digital image and the usual information held on a passport and a digital signeture. Its aim is to make authorisation and security checks at borders faster and safer? and to fall in line with americas new agendas regarding the nesessery implimentation of epassports for all 27 countries who dont need visas to enter america.

Like I said at the start the concept has been in cycle for some time. The biggest hold back is ironically the unsecure nature of the epassport. Of all 27 countries, experts from all have issued warnings and concerns regarding security.

In a nutshell the problem is that scanners to read such information, can be easily replicated to read the information on the chip, so those willing to abuse such information can do so. This is ontop of the chip itself being easily replicable, and still works, though with the amount of other securitys the passport will have may mean that people won't be able to create phoney epassports. The first threat, the threat to your sensitive information is still big.

The following articles are on such concerns with the e passports. The second regarding cloning however the attitude from the homeoffice is interesting.

LINK (No Encryption for E-Passports).

LINK ( ePassports 'at risk' from cloning).

The epassports will have various security guards but no encryption. It appears that encryption is being left behind in order to get the concept through to final production. The comments A spokesman said from the Home Office: "It is hard to see why anyone would want to access the information on the chip.
"Other than the photograph, which could be obtained easily by other means, they would gain no information that they did not already have - so the whole exercise would be pointless: the only information stored on the ePassport chip is the basic information you can see on the personal details page.

Well they would have your digital photo, your name, address, phone number, contacts (their names, addresses and numbers), your digital signeture. What if finger prints are included in the design and later on other biometric identifiers. We all should know how bad it is for someone to have so much sensitive information, IDENTITY THEFT to start with.

Encrytion could be used to protect this information on the chip. However it would have to be the most secure encryption as it would be a high pofile encryption, asking to be cracked. Even with so much security within the passport to check you are who you say you are and you have the right to cross the border, but I haven't heard anymention of what protects this information.

Piracy

Upon looking further into piracy I came across two main documents. The first is produced by The Congressional International Anti Piracy Caucus, titled '2006 Country watch List'. Basically the countrys the US has their eyes on ( and proberly lobbying for a change of law) regarding piracy effecting the US.

The two main countrys focused on within the document, are China and russia. China seems to be in the news alot recently for piracy. Although they are costing the US millions due to piracy, China seems to be feeling the effects in house. The US seem to put everything down to the governments envolved weak action towards piracy but China makes more losses due to piracy, Is it down to weak action on the governments part?, well I think I would have to do more than just skim the surface to answer. The second link is an article on the problems technology companies face in china due to piracy.

FIRST LINK (2006 Country watch list).

SECOND LINK (article on chinas piracy problems).

The 2006 country watch list is a summery of all the countrys that effect the US in regards to priracy.

The main second document is a global study report into piracy (may 2006) for BSA and IDC global software.

SECOND MAIN LINK (global study report).

Really worth a read, recommended.
The report gives a global picture of the state of piracy. With some really illustrating graphs and a mass of figures with key observations and conclusions. Really I still recommend.

After looking back into piracy, not much seems to have changed, america is still mad at everyone else and blaming it on governments lack of action and the rising piracy in developing countries is nothing new. There does seem to be quite a drop in piracy in other countries including the uk since I last looked at the subject. The second document really illustrates this.

I'm a student so for me, although piracy is a problem and costs a lot of people profit, I'm an individual and as one in my opinion if software wasn't so expensive then maybe more people will buy software from the manufacturer. Software is so expensive and quite unrealistic for the individual, hardware seems to be getting cheaper, soon we will have the 100 pound computer, a half decent one!, but for me this is no good. The individual was named as the person of the year by TIME magazine, maybe its the individuals time, though this doesnot do well for piracy, privacy, security, and industry but its good for the individual.

Splogs

Within the very long winded article 'spam + blogs = trouble'. I came across in the september 06 edition of Wired magazine. The topic of splogs is raised. Splogs = spam blogs and their tricky nature. The spammers or named sploggers who create splogs, sportals, link farms which are all mentioned are described as weeds. "The sploggers always adjust" (pg114) And are of a fast growing problem. They have become one of the features of networked communications. Commonplace!

They as in sploggers dont just create sblogs full of jumbled words, ads and sportals that are soley of one click ads and host to a mass of popular searched keywords. Sploggers also take over abandoned blogs and flood real blogs with bogus comments leading back to their sblogs (the later Ive experience just the other day).

Indeed weeds, but very fast, the splogosphere amounting to 900,000 posts a day compared to the blogsophere amounting to only a third of that figure. It was enevitable but will the internet be smoothered by splogs, I wonder. How do you get rid of a weed. There seems to be many hardwork solutions, stated within the article though many which are doomed to failure I predict.

As I don't think its possible to stop splogs, the answer maybe to aim to reduce the number and the figure of growth. Checking unused blogs and a more powerful filter for the placement of listings in search engines.





























































Hopefully the pages are readable, though a heavy read if they are.

Assignment 2 idea to date

My idea for the second assignment in brief is a report with risk assessment on my learning environment security.

For me this is in two locations, university and at home. It will not solely involve my online security, I hope to cover any risks to the hardware itself as well. An example to include is the risks using portable USB disk drives.

Asthis is new’ish to me the following might be included but will definitely be researched further upon.

My wireless network.
My email accounts.
My website account.
My external hard drive.
My uninsured notebook.
Others on my wireless network – whether wanted or not – risks they pose, disruption to internet speed.
Password security.
Windows updates – why do they always crash my notebook when I update, but my notebook runs well with out them being updated?
Risk from downloading?
Finding a balance, for example wanting some internet add ons but not all add ons, how do I get what I want?

The outline would follow, reporting on the risks, what security I have in place? Is it adequate? How can I get the cover from these risks, what do I need to put in place, the cost, alternatives?

My reason towards this report is that it would be a practical and productive report, as it will be used to allow me to make informative decisions towards my learning environment security.

As its report based I’m not sure how I would present it, as it’s a must for a ten minute presentation, I’m not sure how I can do this, I haven’t presented a report before, well not one that isn’t of poor standard.
The presentation might be more of a problem than I thought before, as I recently had a 10 minute presentation on a subject I know inside out and I because I was especially fatigued I struggled to remember the content and well its was one of the Poor ones, One possibility is to do a presentation prerecorded on video with audio commentry , though I would still attend for questions, feasible?

In response to fridays sesson

Due to this coming fridays sesson being held on biometrics, I decided to do some further reading into it, for better understanding. I think I've seen way too many movies of folk having their hands cut off and eyes sliced out for biometric locks, true, though on a more serious note, the concept just really seems foulable to me. Come on, no doubt there are in did ways to get around them and I'm not talking whats shown in the movies, mostly fiction. However I found several sources on the flaws in fingerprint biometrics recognition.

The first being from the trusty bbc website dated 2002 and talks on the findings of a report, which is my second link.

BBC ARTICLE LINK

BIOMETRICAL FINGERPRINT RECOGNITION- DONT GET YOUR FINGERS BURNT -REPORT LINK

The report is interesting it seems to cover so many variables in fingerprint biometrics, the point under the heartbeat title was that systems that are designed to recognise your heartbeat are flawed as regular sport enthusiasts have a slower heart rate that can be impossible to detect in the scan of the person finger. Though the main aspect of the report is showing ways around the system. Worth a read.

My favourite link comes from the MythBusters, I love this show, I'm always watching when I see its on, but I missed this episode, they show how to fool the biometric finger print scanner, one in which the manafacturer said has never been fooled. Its only a short clip though usally they show how they done it and the hard work gone in before hand oh and the science. And it doesn't usually has the intense voice commentating. But real good clip to watch, better to find the full episide though.

MYTHBUSTERS FINGERPRINT FOOL LINK

And to a nice definition of biometric tech at the following link which covers all biometrics not just the fingerprint.

FOR A GOOD UNDERSTANDING OF BIOMETRICS LINK