Ultrasaur Blog

Keeping track of exciting new threats to your digital records.

Posts Tagged ‘stub’

From the not-really-secret-files

Tuesday, July 7th, 2009

Using a Social Security Number as a password is fairly common in the US for reasons I can’t understand.

Of course this password is nowhere near random, different states get different prefixes and now:

With just two attempts, the researchers correctly guessed the first five digits of SSNs for 60 percent of deceased Americans born between 1989 and 2003.

Oddly, the solution is the old (and wrongheaded):

The new findings remind consumers that they should use caution when sharing data online

Which is a little strange considering that all that was involved in this attack is knowing the victim’s date of birth — the kind of information that has been published in old fashioned local newspapers for a lot longer than the internet has been around.

File Mix-ups in the News

Monday, July 6th, 2009

Why do we know that the chief of MI-6 (yes that MI-6) is friends with David Irving? Well, someone let out too much info on Facebook. Sooner or later, any information you give a third party can eventually leak out (that’s why we don’t collect any), it’s just too easy to make it sooner.

And a California teacher accidently put pornography on a DVD for her class. And yes:

The person in the video turned out to be Isabelle Jackson Elementary fifth grade teacher Crystal Defanti.

Physical Locks Break Too

Friday, June 19th, 2009

We don’t regularly follow physical security, but I enjoyed the article (thanks Bruce Schneier). It’s interesting to note that “high security” locks mean that they can stand up for 10 minutes — and according to Marc Weber Tobias, none last more than a few seconds reliably.

But the parallel that I find most interesting is how, as I’m prepping our next demo (where I hack a SharePoint server), is how little original work I had to do. Smarter people than me had already done the legwork, just like regular crooks who use Tobias’ work to bump the lock on your bike. You don’t have to protect your doors & servers against what you can do, but what the sum of the smartest hackers can do.

Side note, I want to buy this laptop just to have the big guy’s computer :)

(more) kNeu Icons

Monday, June 8th, 2009

We’re using the fantastic kNeu icon set in the application, and we’ve expanded on a couple of them. In the spirit of the original set, these are also available under the GPL:

doc.pngdocs.png
(more…)

US Army hacked by Turkey

Friday, May 29th, 2009

Another reminder that everyone is susceptible to hacking:

The hackers, who collectively go by the name “m0sted” and are based in Turkey, penetrated servers at the Army’s McAlester Ammunition Plant in McAlester, Okla., and at the U.S. Army Corps of Engineers’ Transatlantic Center in Winchester, Va.

The hacks are troubling in that they appear to have rendered useless supposedly sophisticated Defense Department tools and procedures designed to prevent such breaches. The department and its branches spend millions of dollars each year on pricey security and antivirus software and employ legions of experts to deploy and manage the tools.

Fingerprints fade from cancer treatment

Friday, May 29th, 2009

We often assume that everyone will have fingerprints (as in the literal prints made from people’s fingers), bu from Reuters

A Singapore cancer patient was held for four hours by immigration officials in the United States when they could not detect his fingerprints — which had apparently disappeared because of a drug he was taking.

Although 4 hours is not exactly an impressive delay from an American airport and capecitabine is not a common drug, it raises interesting issues. Namely that when a simple process works in 99% of cases, we really aren’t prepared for that 1% of outliers. In this case, I’m curious what the Americans With Disabilities Act says about treatment of finger/hand/arm amputees in fingerprinting situations.

Oh noes — backups on live server?

Friday, May 15th, 2009

Hackers ‘destroy’ flight sim site:

Yes, we dutifully backed up our servers every day. Unfortunately, we backed up the servers between our two servers.

Backups: different medium, different location.

TSA: “really stupid”?

Friday, May 8th, 2009

Representative Peter DeFazio: “I helped create the TSA.”

Rep. Peter DeFazio actually dealing with the TSA: “This is really stupid.”

Source: Washington Post

Reporters rely on Wikipedia

Wednesday, May 6th, 2009

It’s not surprising, but it is interesting to see a concrete case of reporters reporting straight from Wikipedia without independent verification:
Student’s Wikipedia hoax quote used worldwide in newspaper obituaries. It’s from The Irish Times, but they probably just read about it in Wikipedia.

Proof of a financial transaction

Wednesday, May 6th, 2009

Apparently many bank card transactions are also fingerprinted:

The idea with the transaction certificate (TC) is that the card signs off on the correct completion of the protocol, having received the response from the bank and accepted it. The resulting TC is supposed to be a sort of “proof of transaction”