Apple's recent developer preview announcement for 10.7 notes that it will include:
"the all new FileVault, that provides high performance full disk encryption for local and external drives, and the ability to wipe data from your Mac instantaneously"
This means that both Windows (BitLocker) and MacOS (FileVault) will have free, OS integrated full disk encryption.
Jalopnik links to The Atlantic's Marc Ambinder's great article on how the Secret Service handles a significant event, including details of how the motorcade is organized and run. For those who think about physical security, this is an interesting read including a diagram of each vehicle and its role.
I find that I often check Google's cache of sites that have been taken down, either as part of an incident investigation or to verify that data has been removed. One of the nicer ways to do this is using a tool like Jeffrey To's Google Cache Continue script.
This joins my toolbox of existing Firefox plugins such as:
A recent take-down notice (which was of course sent to the wrong address) contained what has to be one of the best typos I've ever seen in such a missive:
"Hereby we inform you that the material listed hereunder are of Phonographic nature and are deemed harmful to minors by many governments and non-governmental organizations."We all knew the Internet was full of phonographic material, right?
WMUR in New Hampshire reports what is one of the first large-scale burglary cases based on Facebook status messages that I'm aware of. For those of us who need to communicate about Facebook and social network security concerns to varied populations, this is a great example to cite. According to the article, "Investigators said the suspects used social networking sites such as Facebook to identify victims who posted online that they would not be home at a certain time."
The article mentions $100,000-200,000 of stolen property that was recovered, and that the case was solved due to an officer who noticed that fireworks of the same brand reported stolen in a burglary were being shot off and investigated on orders to check out any fireworks they heard being fired.
The story of Dr. Gemma Meadows, as reported by MSNBC is an intriguing one. Like many victims of identity theft, she was contacted by her bank and informed of fraudulent activity. What happened next though, is a bit off the normal path for identity theft victims.
Various packages with a wide range of values started to show up, and have continued to show up. Now, Dr. Meadows spends time tracking and returning packages, as well as fielding calls from various vendors from whom the items are ordered.
Why? According to the article, and what she has been able to determine, the identity thieves are using her information to test validation scripts on e-commerce websites. Her valid address, phone, and other details are being used to make transactions appear valid.
Interestingly, the scripts seem to work in some cases, flagging the transactions as possible fraudlent. The article mentions that some sites note that the item is to be shipped thousands of kilometers away from the order location, and that others call to verify that she is the one placing the order. Many others, however, don't do as well, and the stream of packages continues.
The article is well worth a read. We're used to seeing lives disrupted by identity theft and the credit and financial issues that can go with it. Receiving packages when criminals use your identity to support their crimes in a different way is an entirely different event, and appears to be one that law enforcement and our database driven society isn't geared to handle.
Security blogs and websites are all buzzing with the news of Barnaby Jack's Blackhat demonstration of ATM insecurity. Wired has coverage, our favorite security monkey has a video, and others including Tony Bradley from PC World covers the important lessons from the talk.
So does the hack tell us something truly new? I don't really think so. For years, many ATMs have been poorly embedded systems, often running commodity operating systems that rely more on physical security provided by locked boxes than on heavily secured operating systems with appropriate security controls. I've written about the insecurity of some ATM uplinks before, and accessing their network connection is often very simple in public locations.
What the exploit does do is serve to point out vulnerabilities in the specific ATMs, both of which were running Windows CE. It also serves as a reminder that any operating system that can be remotely accessed, or that allows its filesystem to be written, or to mount USB devices is vulnerable. Since many ATMs run Windows XP, or even Windows NT, they make attractive targets to those who have pre-written malware that works on Windows systems.
It should also remind us to review what devices we rely on that have embedded PC platforms in them. Windows CE, NT, XP, and various flavors of Linux appear throughout our IT infrastructure, and while we're used to locking down network access, often embedded devices don't provide strong local security. I've run into everything from AV controllers and music players to embedded systems running animal feeding systems for research. Most of the time, my only ability to secure them is to lock them away, limit access to the room they live in, and to ensure that they're on a secured network.
How do you secure your embedded systems? Have you gone so far as to modify appliances that manufacturers don't want changed?
