Archive for September, 2007

Bullet Points v2

* BOSTON - Dominated by home-cleaning gadgets, the consumer robotics market is expanding with the arrival of ‘bots that can spy inside your home when you’re away or arrange virtual meetings of family or friends.

* TOKYO, Japan (AP) — Orderly, pornography-free and safe for children, “meet-me,” an online interactive virtual Tokyo, is Japan’s answer to “Second Life.”

* WASHINGTON (CNN) — Using a Facebook profile, police arrested a suspect in an attack on the Georgetown University campus.

* SAN MIGUEL, Philippines - It’s Thursday, so 18-year-old Dennis Tiangco is off to a bank to collect his weekly allowance, zapped by his mother — who’s working in Hong Kong — to his electronic wallet: his cell phone.

* SAN FRANCISCO - A thief stole a laptop computer containing unencrypted personal information of 800,000 people who applied for jobs at Gap Inc., the clothing retailer announced Friday.

* TOKYO (AFP) - A research group will be set up in Japan to develop optical technology that will replace the Internet Protocol as the global standard in communications, a report said Sunday.

* (As noted by Wendy below) SEATTLE - Microsoft Corp.’s Excel 2007 spreadsheet program is going to have to relearn part of its multiplication table.

* (It’s not just the UK): FBI’s cybercrime efforts lagging: The growing problem of cybercrimes used by both scofflaws and hostile governments was given the No. 3 priority status by the FBI, but the Washington Post reports that few dollars and agents are assigned to its prevention.

* An online malware measuring tool has unexpectedly rated U.K. PCs as having the lowest level of infection in Europe.

Good Net, Bad Net

Posted by wendyg in AnonymitY, Data breaches, culture, security services, threats at September 29th, 2007

Three stories this week that I think together highlight both the good and bad sides of having the Internet around and the challenge it poses.

The good, user vigilance division: I saw a posting a few days ago on a community board I frequent that eBay was in the middle of being hacked. This eBay forum thread discusses the hack, though I don’t know how long the link will be valid. The story also got Slashdotted and YouTubed (someone made a video of the hack in progress, which involved posting user IDs along with contact and cc information, though eBay said the latter was not associated with the IDs). Someone else logged a list of posted IDs. It’s worth pointing out that this community effort warned people before eBay made an official response - by all accounts it took eBay an hour to an hour and a half to realise what was going on and shut down the Trust and Safety forum, where the information was being posted. How long would it take a government department on a weekend? eBay is, of course, a very big target; large government projects will be even bigger ones.

The good, keeping companies honest division: the comments, here on this week’s Excel bug were, I thought, rather interesting. The MS guy was trying to reassure them by saying that the underlying calculations are correct even though Excel is displaying the wrong values in the spreadsheet. But as the comments point out, this isn’t much comfort. People copy and paste values, and they read aloud and copy from printouts of spreadsheets - an error like this can find its way into all sorts of places. The machines are fine as long as they only talk to each other - it’s crossing the machine/human barrier that’s dangerous. Through the lens of the nanotech conference one might ask whether at some point the machines might decide we’re too risky to talk to. Interesting to speculate what the surfaces of computer programs would look like without the need for human display. (eg, Internet addresses would all be numbers, and there would be no domain name system).

The bad, enabling anonymous distribution of performance-enhancing drugs. This week saw a huge DEA action in the US that took out more than 50 labs churning out steroid pills from powders sourced from China and more than 120 arrests. The pills, which the DEA says were made up in bathtubs and sinks in unsanitary conditions (as much like scare tactics as that sounds - it’s probably true, but it’s not clear how big a risk it is compared to ingesting the steroids themselves), were largely sold over the Internet through Web sites and chat boards to folks like amateur bodybuilders and high school kids, if I’m reading this right. Illegal drug smuggling is of course nothing new, but as much as we make fun of the oft-invoked Four Horsement of the Infocalypse (organised crime, drug dealers, terrorists, and pedophiles) a DEA report from 2003 talks about the setup they’ve since spent two years investigating, and one of the points they make is the difficulty posed to them by services like Hushmail. It dismays me quite a lot that the general answer to this problem overall (and I think if kids are taking steroids to make the football team it *is* a problem) is rampant drug testing with all the privacy invasiveness and presumption of guilt that involves. Going after the distribution network seems to me a better idea, though I doubt long-term it will make much odds. Since WADA’s testing regime began drug use has done little but escalate among athletes at all levels, AFAICT. The Net didn’t make this happen, and correct enforcement is not to shut down privacy-enhancing services or Web forums but to investigate in the physical world. I don’t think, though, that morality plays like last week’s sententious posturing over Floyd Landis’s suspension from cycling, help at all. If anything, they serve to highlight the notion that winners take drugs…

wg

Has Single Sign-On Arrived?

Posted by Tom Fuller in Blindside project, e-ID, people and passwords at September 27th, 2007

Portsmouth’s Queen Alexandra Hospital, the Whittington Hospital NHS Trust and Notts Police have all recently adopted single sign-on systems. Has this become an accepted methodology for users?

Bullet Points

Posted by Tom Fuller in AnonymitY, Blindside project, e-ID, people and passwords, security services, threats at September 26th, 2007

I’m referring to the format, hopefully not the effect.

* The US Department of Homeland Security, which sets the benchmark for IT security practice in America, suffered more than 840 IT security lapses in 2005 and 2006, despite spending $332m on IT security this year.

* Unisys has dismissed reports in the Washington Post that it was to blame for data breaches at the US Department for Homeland Security last year. Unisys said, “The allegation that Unisys did not properly install essential security systems is incorrect. In addition, we routinely follow prescribed security protocols and have properly reported incidents to the customer in accordance with those protocols.”

* Attackers have set their sights on two Microsoft flaws — an unpatched DirectX Media vulnerability and the XML Core Services flaw the software maker patched last week in its MS07-042 security update. Antivirus company Symantec has issued alerts for both exploits in emails to customers of its DeepSight threat management service. The security company said it had raised its ThreatCon to level 2 in response to the threats.

* Hackers managed to steal information from the US Department of Transportation and several firms by using fake job listings for employees, reports Reuters. It is believed information was stolen from around 1,000 corporate PCs. The FBI is now investigating the reported breaches.

* Newham Borough Council has delayed a major desktop roll-out after hitting a barrier in its 10-year strategic relationship with Microsoft and Hewlett-Packard. The council has put back the deployment of Windows Vista in its new 1,500-desktop corporate head office by 12 months, because of a lack of Vista-certified applications from its third-party suppliers. As a result, Newham will incur the cost of deploying XP in the new office, only to have to upgrade the machines to Vista at a later date. The council will now roll out Windows XP in March 2008 instead of Vista as originally planned.

* Reliance on ID systems can take you to some strange places (via Ideal Government): Supermarket staff refused to sell alcohol to a white-haired 72-year-old man - because he would not confirm he was over 21.”

* (Via Light Blue Touchpaper): “When it rains, it pours. Following the fuss over the Storm worm impersonating Tor, today Wired and The Register are covering the story of a Dan Egerstad, who intercepted embassy email account passwords by setting up 5 Tor exit nodes, then published the results online. People have been sniffing passwords on Tor before, and one even published a live feed. However, the sensitivity of embassies as targets and initial mystery over how the passwords were snooped, helped drum up media interest.”

* (Via Bruce Schneier) “Copper cable has been known as the easily tapped physical transmission medium for years. Conscientious network and security managers either provided tight physical security for cabling or used fiber as an alternative. Many network managers considered fiber relatively safe due to the perceived challenges associated with tapping into an optical cable run. However, fiber is no safer than copper. For less than $1,000, an attacker can purchase the hardware necessary to tap into a fiber run. The tap consists of bending the fiber to the point that it leaks light.”

Let 10,000 Flowers Bloom

Posted by Tom Fuller in Blindside project, Data breaches, Humanity nature and activity, people and passwords at September 26th, 2007

Via Computer Weekly, Gordon Brown’s announcement that 10,000 mobile computers will be given to police to cut down on their paperwork by filing reports online. (Sigh.) I almost hate what’s going to happen next. Expect to see (not necessarily in this order):

1. Belated realisation that there are 144,000 police and that sharing may not be practical on this scale.
2. That training for effective usage may come in at 3 hours per head, which is more than 15 man-years
3. That security for laptops requires planning, practice and execution, and it will not be flawless at first.
4. That police cars, and hence their contents, do go missing
5. That the (mostly male) police force with online access in an often boring and isolated environment may find their thoughts turning to porn
6. That wireless coverage for online work is not universal
7. That laptops break–often at inconvenient times
8. That wireless forms transmitted will probably need to be encrypted

Shoot. I was hoping for 10 top-of-mind reservations–help me out here.

Making mobile technology available to public servants in the field is a really, really good thing and I think the Prime Minister is on to a good thing. But to avoid being blindsided, I hope they prepare a bit in advance. The military might be a good place to start.

Actually, I just thought of numbers 9 and 10–That the media will criticize the cost of the programme and belittle its effectiveness in the early days before it takes hold and police officers will write their usernames and passwords inside their hats.

The Great Sedgefield Mash-up

Posted by Tom Fuller in Blindside project, Humanity nature and activity, Radically different stuff at September 25th, 2007

I’m glad to see that one of the aspects of Web 2.0 (the cheap and easy combining of data from more than one source and aggregating it in one location for user benefits) has come to Sedgefield. Although it hasn’t quite achieved the functionality of UpMyStreet, it is a worthy effort and will doubtless improve. (I really think it’s a great idea–looking at what I wrote, I hope it doesn’t sound patronizing or superior.)

One area that might help Sedgefield improve its offering (and would be welcome as well on UpMyStreet) is context. If I were to show you the number of car break-ins in your neighbourhood per year, would you be able to digest the raw number? Let’s say it’s 12. When you see the number 12, do you say, ‘Hmm. One a month in this neighbourhood. That’s not too bad,’ or do you think to yourself ‘Omigod it’s time to move!’

But if I show you the number 12 and also tell you the national average is 28, with the lowest being 6 in the Isle of Wight and the highest being 46 in Westminster, and that the neighbourhoods around you average between 10 and 19, wouldn’t that give you enough information to actually react to the number? (All numbers made up on the spur of the moment.)

Politicians and the mainstream media have a tendency to show you just enough of the picture to reinforce the point they’re making. One of the characteristics of Web 2.0 is that we don’t have to fall into that trap. It takes more work to track down and link to the data that gives context, but it’s well worth it.

Why provide half a service?

Yet another security issue: key management

Posted by wendyg in People and IT, people and passwords, security services at September 24th, 2007

What with one thing and another, I forgot about this piece until just now, when I went to update the Web page for that column series (www.pelicancrossing.net/hpkcols.htm - it’s the interviews column I do for the Inquirer). In it, Nicko van Someren, founder and CTO of nCipher, talks about the problem of key management: as crypto systems proliferate, dealing with keys is becoming a major issue.Natiurally, nCipher has a solution it would be happy to sell people, but that’s not the point: the point is more that every new security system we adopt comes with a complex management cost. This is true at all levels, from the major corporation that has a server tied up for a day just changing keys at all its sites throughout the world to the individual at home who locked down their Airport so tightly they now can’t remember how to open a connection for a guest who wants to use the Internet. These costs are part of why humans, who prefer easy lives, bypass security or turn it off rather than be hassled…

wg

More On The Pace Of Change

Posted by Tom Fuller in Blindside project, Radically different stuff at September 24th, 2007

For those who can’t get enough after Wendy’s piece, there’s more available here. TED (Technology, Entertainment and Design) is actually putting these speeches online, available for free and for fun. Their technology talks are pretty potent stuff. None more so than Ray Kurzweil’s machine-gun delivery on the machine-gun pace of technology change.

A little context about Ray Kurzweil, for those who aren’t familiar with him. He’s …all … over … the …net, so you can find more easily. I bumped into his work about a year and a half ago, grabbing a copy of ‘The Singularity Is Near’. The talk I linked to above is a 20 minute compression of three of the chapters in that book.

Nanotechnology is coming at us like a freight train, as is the rest of technology. Talking to my wife last night, I said that I thought that the next 25 years would hold more change than the last 125. She looked at me indulgently, as might some of you, (she’s a bit smarter and a lot more skeptical than I, and muttered something like ‘I see, more change than since the era of the telegraph’) and I may be wrong in the sense that it might be 30 rather than 25. But if you look at what’s being worked on right now in laboratories, shops and R&D facilities, I don’t think you’ll come away with anything other than a sense of wonder at the world we’ll be living in soon.

It’s important to note that you have to keep a bit of a critical eye when reading through some of the literature of futurology. A lot of writing about The Singularity and keeping senescence at bay is as much science fiction as it is science. But even keeping to the straight and narrow path of extrapolating from present progress can leave one a bit breathless. As was Kurzweil at the end of the speech linked to above.

And I may have mentioned this before (but not more than 100 times), but it is clear to me that governments everywhere will have to keep a close eye on this change. Well, that is what they’re asking us to do here at Blindside… Governments will be charged with delivering new services, regulating new technologies, managing a transition that is likely to be as disruptive as the change from agriculture to industry, and cope with the social effects of a new way of organising the lives of individuals and organisations. Whether it is in fact 25 years out (or 30 or even 50) it will make the challenges facing UK government today look like a golden age of tranquility.

Read Wendy’s piece linked to in the previous post. Watch Ray Kurzweil’s talk. Let me know if you think I’m exaggerating.

Nanotechnology (again)

Posted by wendyg in Radically different stuff at September 23rd, 2007

Are humans going to be in charge or AIs, after humans have been successful at transferring themselves into an artificial substrate?

Will we need to work? If we don’t, will we be retired – or unemployed? (”I’ve asked that for years,” says Phoenix.)

Will families and value systems disintegrate because, no longer human, those things won’t matter to us any more? (Yes, said Josh Storrs Hall, because “We will build it to care.”)

How will we define what it means to be a person?

Should we replace photosynthesis? If, that is, we’re able to develop better functionality. Do we build a planet-wide immune system? Surely, we’ll need to be able to adapt quickly to newly developing viruses, just so no one person can wipe out the entire world.

How do we back up the ecology of present-day earth as we know it? And should we bother?

In fact, wouldn’t it be better to move the entire thing off-planet for the final development stages? For safety’s sake? Doug Mulhall, author of Our Molecular Future and an environmentalist with experience building water recycling and flood control facilities in Brazil and China, rounded out this idea by estimating that the asteroid belt could be deconstructed to provide 1,800 backup copies of Earth, each of which could become a different experimental biosphere. “And then if we break apart Jupiter and Saturn…”

The rest of the write-up of last week’s conference from the Center for Responsible Nanotechnology.

wg

Could Be Very Good

Posted by Tom Fuller in AnonymitY, Blindside project, data mining, databases, psychology at September 23rd, 2007

Via Computer Weekly, we see that “The London Borough of Brent is working on a project to provide a single view of residents’ data which will allow the council to improve customer service and the overall accuracy of council records. When complete in November, the project will allow Brent to conduct customer profiling in order to improve council services and offer additional services to residents. It will also help Brent comply with the Data Protection Act, which requires that information stored on an individual should be accurate.”

This could be very good. “The project has involved mapping out which systems hold the most accurate information. Customer data is extracted from the nine core council systems each night. The Initiate tool then matches customer records from each of these systems and links them together to form a master index of all customer information called the Client Index. Aside from building the master customer record the project also includes identifying change of circumstances eg change of address that have been recorded on council systems. All changes are passed back to council departments to ensure their systems are kept up to date. ”

Does anyone else notice that UK local governments have been leading the way for a couple of years?