Little Data, Big Problem

As a computer scientist, I think about data a lot.

And as someone who is a fairly private person, I'm particularly interested in personal data. Not only my own, but everyone's. I gape at fellow customers at the store who give their phone number and zip code to the cashier without a thought. I am appalled at friends who post private information publicly - photos, geolocation data, their polical affiliation, their religion, their "likes". Everything from restaurant checkins to where they delivered their baby.

I am shocked that people purchase devices that track their physiological data 24/7, data which is automatically uploaded and shared publicly. I am stunned that people voluntarily give samples of their DNA to 23andme.

The shocking thing is when I mention something about this to someone, I receive one of three responses:
1) "I don't care, I have nothing to hide".
2) "Bah. I'm honestly not that interesting."
Or:
3) "Well, I know X is evil, but it's just so darn convenient. And anyway, all my friends use X. I can't stop using it now."

Never does someone say, "Wow, FCS, you're right - this data deluge is terrifying! And that anyone with cash can buy all our data willy nilly! Yikes! We should lobby the government to regulate the personal information brokering industry."

Never. Yet one word of the NSA spying snafu and POOF - people freaking out. But I think they're freaking out about the wrong thing.

My security friends talk about threat models. "What's the threat model?". I don't think it's the government. The government is far too monolithic, tech-unsavvy, and sequestered to pull off what we see in the Borne movies. And there's no Machine, sitting in a warehouse in Iowa continually monitoring, processing, and understanding the content of every phone call and surveillance camera feed. That's NP hard.

The threat model is - we have no clue. Right now, any person with the means can purchase a large lot of your private data. If you use a credit card, cell phone, or ATM, ever, you're toast.

When people say, "I don't care, I have nothing to hide." I want to whack them with a #firstworldproblems foam bat. It's not the #FWP people I'm worried about. It's the most vulnerable of our society: those who are abused, those who are stalked. Those who are bullied. Those who simply are not technologically savvy enough to realize they have not only hung their dirty laundry out on their closeline, but their entire existence.

I know what Scott McNealy said. But it still pains me. I think about data a lot.

Merry Hackmas (not really)

While most technologists were busy yesterday drinking eggnog and trying out their new gadgets, others were busy hacking Stratfor, an intelligence news organization.  All the news outlets reported it was 'Anonymous', but now people are saying it was (apparently) Sabu from LulzSec.

(Frankly, I can't blame the news outlets for the error - I can't keep up with the drama of who's who any more. It's like a soap opera, really.)

Anyway, whomever it was, they hack into Stratfor, steal a bunch of credit card numbers of people who subscribe to the company's intelligence briefings, then a) post them on the internet and b) use the credit cards to make donations to charitable organizations.

I'm not really sure what the point of this is. Any of these donations will be returned, and all the credit card numbers will be canceled. Really this will just cost the credit card companies lots of money, which will just result in the average Joe/Joann having to pay higher fees. Exactly what people need in this economy.

I wish these hackers would do something useful with their time. Solve some problems on challenge.gov. Teach math and computer science to children. Help local governments have more up to date computer systems in order to help empower communities.

Anything, really. This is just a sad waste of tech brains.

Burn after reading

I received an unencrypted email yesterday which had in the title "CONFIDENTIAL AND PRIVATE". It also had instructions that if I were to print out its PDF attachment, I must shred it immediately after reading it.

Clearly we Computer Scientists are doing a bad job with public outreach here. So, hey, chance to educate.

Email is hardly ever secure. I say 'hardly ever' because it is possible to encrypt email, and it is also possible to send email on secure, closed networks, free from the pull of the internet sea.

But most of the average email your average person is sending is being sent in the clear, unencrypted. This is a lot like walking down the street holding a big sign with the contents of your email. Which is recorded by a camera. And a lot of people can watch the video at any point in the future. Also, the video is archived in a library 4ever*.

The metaphor of a paper postal letter may have made sense about 15-20 years ago, but it's no longer valid. A letter sent by physical mail is much harder for lots and lots of people to read, unless someone tampers with the mail, makes a photocopy, etc. It also had ephemerality - you really could burn it after reading.

I pretty much operate under the assumption that any determined person can read my email and all unencrypted files on my computer. I also assume any emails I send could end up being forwarded to others, printed out, or posted on some blog somewhere.  Err on the side of caution, and all.

--------
(*) Ok, except a library is a bad metaphor because it's not necessarily easy for people to find this video. (aka. "security through obscurity"). Nor is it necessarily around for ever, but it could be.

Secure your networks, this time with feeling!

I know I've said that my research area is not security, but you'd think I was lying with all my recent posts on these topics.

The IMF has now been hacked. (Apparently by a foreign government). I read this in the NY Times article -

Because the fund has been at the center of economic bailout programs for Portugal, Greece and Ireland — and possesses sensitive data on other countries that may be on the brink of crisis — its database contains potentially market-moving information. It also includes communications with national leaders as they negotiate, often behind the scenes, on the terms of international bailouts. Those agreements are, in the words of one fund official, “political dynamite in many countries.” It was unclear what information the attackers were able to access.

- and had two immediate thoughts:

1) How could it be unclear what information the attackers were able to access? Don't they have logs? And if the logs were vaporized, don't they have clever digital forensics experts who can figure out what happened?  This is the IMF for pete's sake.

2) All the data stored in these databases was encrypted with strong encryption, right? Oh, and all the traffic from client computers to the database was encrypted, right? And they keep a tight access control list, right? Right?

If you follow good practice to begin with, you don't have to worry quite as much when you're hacked. But so few organizations do, which is really depressing.

I used to bemoan the lack of good practice to friends who do work in this field, and they would chuckle and said, "Look, FCS, if you want to protect your data, write it on a slip of paper, burn the paper, dig a hole 10 feet deep, and put the ashes in the hole. Or better yet, don't write it down in the first place."

Yeah.

Female Computer Scientists FTW

In other security news this week, Google is claiming China orchestrated some major attacks against gmail users. No shock, but what I found interesting is that they were discovered by blogger and fellow female computer scientist Mila Parkour.

Kudos, Mila!

And this just in - apparently Sony! Soni! Soné! has been hacked again. With script kiddie SQL injection attacks. The PC World article says, "Sony seems to ignore compliance requirements and basic security best practices".

For shame, Soné, for shame. You should totally hire Mila to fix you up. After China I suspect a gaming network will be child's play.

And so it begins*

Remember I blogged a few months ago about RSA getting hacked? We are now seeing the first major repercussions of this - Lockheed Martin's attack last week is assumed to be due to this.

According to AP, "Lockheed Martin said in a statement that it detected the May 21 attack 'almost immediately' and took countermeasures. As a result, 'our systems remain secure; no customer, program or employee personal data has been compromised.'"

Color me unconvinced.

To be honest, I'm really shocked RSA didn't do a massive recall of all its fobs after it was attacked. It was negligent not to.

(*) There's your B5 reference, Scott!

Sony! Soni! Soné!

I am very disappointed in you.

You get hacked, have 77 million credit and debit card numbers stolen but wait one week before telling your customers. And now you face a class action lawsuit, a senator demanding answers, and possibly lots of "angry mums". (Watch out for those angry mums! Like Bob! Or is he a daisy?)

And, given your track record on security (i.e., installing rootkits on customer's machines), you're not really in a good place right now.

The right thing to have done would have been come clean initially. Be honest with your customers from the start - "We stored information we shouldn't have, we didn't encrypt your data, and it's all been stolen. Call your bank and change your debit and credit card numbers."

Other companies, please take note. Only store the data you need to. Tighten your existing controls.  Do not think yourself invulnerable, or something's gonna getcha, little Walter.

RSA hack - Trouble with a capital T

It seems RSA was hacked today. This means, if you use one of those nice little SecureID fobs to connect to your corporate server or bank, it may have been compromised.

This is a big deal. Using two-factor authentication is an industry gold standard, and RSA is one of the most prolific manufacturers of such fobs.

Securious has a nice write up of the fact vs. fiction surrounding the attack, including a note that this was an APT attack, not some random script kiddie in Germany.

I'm not trying to stir up panic here, but if you work with sensitive data, this might be a good time to add another layer of encryption on it*. There are lots of free solutions, like True Crypt, or if you're on a Mac the easiest thing to do is create a password protected disk image. Remember not to use the same password for your encrypted disk partition that you use for anything else (logging in, email, etc.). But also don't lose this password - if you do then your data is "irrevocably lost". Whee!

* Obviously all the "check with your (IT) doctor" disclaimers apply here.