Ultrasaur Blog

Keeping track of exciting new threats to your digital records.

Archive for the ‘worldnews’ Category

US Army hacked by Turkey

Friday, May 29th, 2009

Another reminder that everyone is susceptible to hacking:

The hackers, who collectively go by the name “m0sted” and are based in Turkey, penetrated servers at the Army’s McAlester Ammunition Plant in McAlester, Okla., and at the U.S. Army Corps of Engineers’ Transatlantic Center in Winchester, Va.

The hacks are troubling in that they appear to have rendered useless supposedly sophisticated Defense Department tools and procedures designed to prevent such breaches. The department and its branches spend millions of dollars each year on pricey security and antivirus software and employ legions of experts to deploy and manage the tools.

Authentication: expensive, difficult and rare

Friday, April 24th, 2009

Another reminder that authentication is expensive, difficult and rare.

Expensive: Review of grants costs more than the grants themselves

the $40,000 (Canadian) cost of preparation for a grant application and rejection by peer review in 2007 exceeded that of giving every qualified investigator a direct baseline discovery grant of $30,000 (average grant)

Difficult: Baseball Fights Fakery With an Army of Authenticators

“No one touch it until the authenticator gets there,” a Yankees official instructed.

Authenticators carry rolls of high-tech hologram stickers. A bullet-shaped one is placed on the object. Removing it leaves polka dots of the decal attached and renders the removed sticker unusable. A second sticker, with a matching number and a bar code, is scanned by a hand-held unit, instantly recording the item into M.L.B. computers. The authenticator types in details — who hit the ball and when, for example.

Rare: Ebay leads to more fake antiques:

Our greatest fear was that the Internet would democratize antiquities trafficking and lead to widespread looting… It appears that electronic buying and selling has actually hurt the antiquities trade.

risk of arrest–is also removed by eBay fakes, since you can’t be arrested for importing forgeries. Should you import what you think is an illegal antiquity but it turns out to be a fake, you run little risk of prosecution

those dealers that provide private sales are some of the forgers’ best customers, knowingly or otherwise. In fact, the workshops reserve their “finest” pieces for collectors using the same backdoor channels

Google: Changing paper mills into data centers

Thursday, February 12th, 2009

A sign that the “paperless office” is actually coming: Google plans data centre at old Finnish paper mill

$9 million ATM scam

Saturday, February 7th, 2009

Regarding the recent multi-person ATM scam one line stuck out as especially scary from a data integrity perspective:

Somehow the group managed to remove the daily withdrawal limits usually imposed on the cards and accounts, allowing for multiple large withdrawals to be made.

Meaning that the team that managed to hack the system, were able to change more than just the data but also the rules of the system. If they were able to do that, it’s safe to assume they may have been able to tamper with records and safety audits to cover their tracks. There may be no way to determine which records in the system are legitimate clues and which have been altered.

Records Altered in Brazil

Thursday, December 18th, 2008

Technical details are scarce, but Greenpeace UK claims records were altered concerning logging permits.

Source: The Register via Schneier on Security

McArdle on the Madoff Fraud

Wednesday, December 17th, 2008

Regarding the Bernie Madoff scandal, Megan McArdle raises two interesting points:

Major Fraud is easier than Minor Fraud

Because “The SEC is looking for people pushing the envelope.” rather than completely making numbers up, it may be easier in many ways to get away with brazenly making numbers up than to inflate the real numbers by 10%.

But more importantly…

Documents Do Get Changed

One of the investors pulled in by the scam, Nicola Horlick quietly removed the following text from her website: “Robust and thorough due diligence is at the heart of our firm’s investment process. Our detailed manager monitoring programme ensures that our clients’ investments are subject to on-going and effective governance.”

An updated version of the text has since been replaced, but the disappearance was widely noted and suspicions tend towards a cover-up. The internet is a lousy place to keep secrets, but it’s tempting to think that every time this happens in the public eye it happens many more times in private. We’re left to wonder how many documents on enterprise content management systems have been altered to correct them in hindsight.