Security & privacy

This article provides a good illustration of a drive-by Trojan attack. Somehow, a bunch of web sites in Italy have become infected with the attack. Visitors to those sites are getting infected automatically if they have a browser that is not up-to-date. Once infected, the vistors are redirected to other sites where they are further infected. By the end of it, an unknowing visitor is infected with a proxy server that allows a remote bad guy to access the Internet using the victim’s computer (great for sending spam), and a key logger than can be used to record usernames and passwords. Nasty stuff.

TrendLabs | Malware Blog – by Trend Micro

Since early Saturday morning (June 16, 2007), Trend Micro has been receiving several reports of a new batch of hacked Italian Web sites that trigger a series of malware downloads once a user visits them.

Technorati Tags: security, torjan, virus, iframe, browser, javascript

Within the past week, both Paypal and E*Trade have offered me a new security key. These keys, based on the SecurID by RSA, generate a unique number every 30 seconds or so. To use the key, I will have to enter my username and password as usual, as well as the number that is displayed on the key. Since the number is unique and ever-changing, if someone has obtained my password they still can’t use my account since they don’t have the key.

These keys do offer some level of protection. If your password has been stolen and is being traded around in the Internet underworld, these tokens can help.

There are some problems with these keys. First, they keys do not protect against man-in-the-middle attacks, where bad guys are able to wait for you to login and then hijack your session to conduct fraudulent transactions. These attacks are a big problem because of the huge number of Trojan programs that are circulating on the Internet. If a computer is compromised by a Trojan, then they keys offer no protection. The threats are real.

Second, they keys must be synchronized with the server so that the system can tell if the right numbers are being entered. In my experience using the keys a long time ago, the keys and the servers can get out of sync. When this happened I had to make a call to a call center and get the systems re-synched by telling an operator the current number showing on the key. I hope that they have improved the synchronization.

Third, they keys can be lost, stolen, broken, or simply forgotten at home. Because of this, the systems have to offer an alternative method to access your account. This might involve some other form of authentication that might not be as strong as using the keys. So, the bad guys might have a work-around.

The Paypal key is going to cost me U$5.00. The E*Trade key will be C$30 unless I have C$50K of combined assets. And I am going to need a bigger key ring.

When you buy sex toys, do you worry about your privacy? Would you pay more at Internet stores that displayed clear privacy information that addressed your concerns?

Here is a report from a recent study that had Pittsburgh people shopping for sex toys with different amounts of privacy information. The actual scientific paper is available at the web site for the Workshop on the Economics of Information Security.

Shoppers willing to pay extra for privacy confidence, study finds – Network World

Privacy costs extra – and online shoppers are willing to pay a premium to protect their personal information, a new study by Carnegie Mellon University finds. Study participants who were asked to go on the Web to purchase two items – a package of batteries and a vibrating sex toy – were more likely to buy from sellers with good privacy policies. On average, they were willing to pay about 60 cents extra on a $15 purchase when they were satisfied with the seller’s privacy policy.

Technorati Tags: privacy, Internet shopping, P3P, sex toys, security

This article provides an example of the risks posed by key logger infections. Here the bad guys were able to get bank account information for a city treasury and transfer out hundreds of thousands of dollars. Internet banking is getting very dangerous, and our major public and private systems are relying on it.

Computer hackers steal Carson funds – Los Angeles Times

If Carson Treasurer Karen Avilla had had a nagging feeling she was being watched whenever she got on her laptop computer, she would have been right.

Cyber-thieves were able to shift nearly $450,000 from the city’s general fund last week by using a program that was able to mimic the computer strokes made by Carson’s financial officer. Each time Avilla logged on to her city-provided laptop in the morning, someone was — virtually — looking over her shoulder, recording every single keystroke.

Armed with the spyware program, the hackers obtained bank passwords. They wired $90,000 to a “Diego Smith” in North Carolina. One day later, on May 24, the thieves got bolder and wired $358,000 from the city’s bank account to a bank in Kalamazoo, Mich.

Technorati Tags: Internet, security, banking, fraud, key loggers

The results of the latest round of biometric testing are out, and face recognition systems have improved a lot. This is important because face recognition can be used for a variety of applications, including matching against ID photos on driver’s licenses and passports. Automatic face recognition can also be done covertly, at a distance, which has important privacy concerns.

Technology Review: Better Face-Recognition Software

For scientists and engineers involved with face-recognition technology,the recently released results of the Face Recognition Grand Challenge–more fully, the Face Recognition Vendor Test (FRVT) 2006 and the Iris Challenge Evaluation (ICE) 2006–have been a quiet triumph. Sponsored by the National Institute of Standards and Technology (NIST), the match up of face-recognition algorithms showed that machine recognition of human individuals has improved tenfold since 2002 and a hundredfold since 1995. Indeed, the best face-recognition algorithms now perform more accurately than most humans can manage. Overall, facial-recognition technology is advancing rapidly.

Technorati Tags: face recognition, biometrics, faces, security, privacy, NIST, face-recognition

Here is an interesting review of new authentication methods, including cognitive passwords, Pass Faces, and various biometric techniques. Although these techniques can improve on traditional password authentication, they do not protect against modern threats from Trojans and man-in-the-middle attacks.

Adventures in authentication

You feel like checking your bank account online.

You go to your bank Web site, enter your user name and password, and then are asked, via a dropdown menu, several questions relating to the most memorable family dinner of your life.

Who was there? How old were you? What type of food was served? If you answer correctly to this set of questions, you’re authenticated. Next, to demonstrate that you’re not on a phish site, the bank’s authentication software displays a special phrase that you preselected, such as chicken-fried steak or mom’s apple pie.

According to a start-up called Cogneto, this type of software-based authentication is far more user friendly and cost effective than hardware-based authentication methods.

Technorati Tags: security, passwords, biometrics, authentication

Earlier this month, the country of Estonia experienced a large-scale and devasting cyber attack. This is important because it demonstrates how effective a large-scale attack can be in shutting down an entire country. It also may be an example of one country attacking another through cyber channels, or it may represent an organized effort within one country doing the attack. What would happen to North American networks should they be attacked in such a way?

Estonian Attacks Raise Concern Over Cyber ‘Nuclear Winter’ — Estonia — InformationWeek

The cyberattacks against Estonia, mainly in the form of Distributed Denial of Service (DDoS) attacks, primarily targeted the Estonian government, banking, media, and police sites. “Private sector banking and online media were also heavily targeted and the attacks affected the functioning of the rest of the network infrastructure in Estonia,” the European Network and Information Security Agency, or ENISA, reported Thursday on its Web site. As a result, the targeted sites were inaccessible outside of Estonia for extended periods in order to subdue the attacks and to maintain services within the country.
…
A major hurdle that nations face in defending their critical infrastructures is working with the entities that actually own their countries’ telecommunications networks, electrical grids, and transportation systems. This is a major issue in the United States, given that the private sector owns more than 85% of the critical infrastructure and doesn’t take kindly to government demands that shareholder money be invested in protection rather than expansion.

Technorati Tags: Estonia, security, DDoS, Russia

This is an interesting article about fraud schemes that target the elderly. It describes data brokers who collect information about who might be the most vulnerable targets. And it reviews the role of the banks in allowing very weak authentication, unsigned cheques, for financial transactions that drain the victims’ accounts. It is a good example of the link between economics and security — there is lots of money to be made by the data brokers in selling lists to fraud artists, and by the banks in collecting fees for each fraudulent transaction.

Bilking the Elderly, With a Corporate Assist – New York Times

Telemarketing fraud, once limited to small-time thieves, has become a global criminal enterprise preying upon millions of elderly and other Americans every year, authorities say. Vast databases of names and personal information, sold to thieves by large publicly traded companies, have put almost anyone within reach of fraudulent telemarketers. And major banks have made it possible for criminals to dip into victims’ accounts without their authorization, according to court records.

Technorati Tags: security, fraud, banks, privacy, identity theft, databases

NOTE: post updated Jan 3 2008

In all likelihood, you, or someone close to you, has a computer that is infected with a Trojan horse program. Current estimates are that at least 50% of home computers running Microsoft Windows are infected. These programs, such as the Gozi Trojan I described here, are being used to steal identity information, such as bank account numbers and passwords. And, the bad guys are getting very good at using that information to create forged bank cards and to conduct fraudulent transactions with your money.

Even careful Internet users are at risk. When a new computer is connected to the Internet, it will be attacked by active scanners within 5 minutes and any vulnerabilities will be exploited. Newer Trojans can also infect users when they simply visit compromised web sites, without the knowledge of the web site owner or the end user. Anti-virus software is not completely effective in detecting these bad programs, and new Trojans are launched every day.

So, how can we continue to do financial transactions, such as Internet banking, in the face of these threats? The problem is that the personal computer is a general purpose machine that is good for banking, but it also can be used for lots of other things at the same time, such as running Trojan programs. What we need is a computer that will only do Internet banking when we are doing financial transactions.

One practical solution is to reconfigure your computer for financial transactions so that there is less likelihood that it will be running bad programs during your banking session. This is where “boot CDs” (also called Live CDs) come in. By starting the computer with a boot CD, we can configure it in a way that is safer for financial transactions. We can start a fresh operating system and a clean Internet browser and, since CDs are read-only devices, the CD can never get infected and will always be clean. At least one bank is starting to distribute Live CDs to their customers.

I am currently looking for Live CDs that are suitable for Internet banking. I don’t know of any Live CDs that provide a Windows environment, and Windows computers can be infected very quickly, so I am looking at Linux. Most of the major Linux distributions will boot and run from the CD. These Live CDs tend to start a complete, full-featured Linux environment in order to show off all the features of the distribution, and to support a full install on the hard drive. This slows down the boot time and makes for a complicated, unfamiliar user interface. What we need is a minimalistic Live CD that only starts the programs we need to do our Internet banking.

Over the past few weeks I have acquired a collection of Live CDs, and quickly developed a list of requirements:

• easy enough to use so that I can give them away and not receive phone calls when things go wrong
• quick boot up
• automatic configuration of the network
• automatic launch of the browser, or at least obvious to find
• a familiar browser, such as Firefox 2
• should have browser extensions installed, at least Flash and PDF

When trying Live CDs with these characteristics, I have also uncovered a number of problems areas:

• doesn’t work on all machines. I use both brand new Dell computers and old, generic ones. Some of the Live CDs don’t work on all the computers I try them on, most notable the Dells
• low screen resolutions, sometimes as low as 640 X 480, with now way to make changes. Resolution should be at least 1024 X 768 and, ideally, be easily adjusted by the user at boot time, or once the system is started
• monitor refresh rates greater than 60 Hz. Many distributions only support a 60 Hz refresh rate, which works on LCD screens but looks terrible on older CRT monitors.
• bad browser fonts. The default fonts used within Firefox often look terrible in Linux distributions until the user configures the computer and browser. The Live CD should come with a good set of fonts.
• support for wireless networks. Most Live CDs can automatically detect and configured a wired network, but I have yet to find one that will work with a wireless network. This is crucial for people using laptops.

Here are the Live CDs I have found so far, with some comments. I group them into small, special purpose offerings, and large Linux distributions. I am updating the list and the comments as I learn more.

Small Environments

• Webconverger 2.14 (http://webconverger.com/) is my current favorite. It boots quickly and restricts the user to a Firefox browser. It seems to do a good job at setting the monitor to the maximum resolution and refresh rate. In fact, on one test machine I would have preferred 1024 x 768 on the cheap monitor instead of the 1280 x 1024 that was chosen, but the display was good. (On another new Dell machine, however, the resolution was set to 640 x 480 instead of the 1280 x 1024 that the LCD can display.) Flash, PDFs, and sound seem to work. My only complaints are that some of the familiar shortcut keys don’t work in the browser: CTRL-+ and CTRL– for controlling the font size, CTRL-T and CTRL-W for creating and closing tabs, and CTRL-K to get to the search form, and CTRL-L for moving to the address bar.

  UPDATE: Webconverger 2.36 tried on Jan 3 2008: I just tried out this boot CD on a number of machines and it worked great. It did a good job of selecting a video resolution and frame rate on different types of monitors. I did run into a problem booting an HP Compaq desktop machine, but a quick Google search showed that this model has problems with all Linux distributions until you add acpi=off to the boot parameters. This is now easy to do in Webconverger.

• cl33n (http://cl33n.com/) boots quickly and launches Firefox automatically. In fact, it will only run Firefox. This environment works well, but it will not refresh the screen faster than 60 Hz and so does not handle CRT monitors. Also, sound does not work for me and Flash is not installed, but it can be.
• Damn Small Linux (http://www.damnsmalllinux.org/) did not work on my newest Dell machines and suffers from the 60 Hz problem
• KioskCD (http://www.kioskcd.com/) have not tried it yet
• Hospitality Machine Kiosk 1.0 (http://www.hospitalitymachine.co.uk/HospitalityMachineKiosk.htm) had problems on both machines I tested it on. On one machine it could not do a DHCP configuration on the network, similar to the SLAX offering. Most other environments do work on this machine. On the second machine the software would not boot, complaining that it could not find the Knoppix file system. (Note: I ran into the same problems with version 1.1.)
• SLAX 5.1.81.1 (http://www.slax.org) boots into text mode and requires the user to login as root. The user then runs xconf and startx to bringup the graphical environment, which does result in a good resolution and refresh rate. The browser is Konqueror, which is rather unfamiliar. On one of my test systems, the network was not configured using DHCP.

Complete Distributions

• Dreamlinux 2.2 RC3 (http://www.dreamlinux.com.br/english/index.html) is good at handling screen resolutions and refresh rates. During the boot process, the user is asked to choose the resolution and the refresh rate is automatically set correctly for LCD and CRT monitors. This is a complete Linux environment so the interface is a bit complex, but the Firefox browser is easy to find, the fonts are OK, Flash is installed, and sound works. It appears that a PDF viewer is not configured in Firefox by default, however. If you can handle choosing the resolution at boot time and a full Linux interface, I recommend this one.
• Knoppix (http://www.knoppix.org/) is a full Linux environment with a large collection of system and network tools designed for advanced users. I was able to set screen resolutions that I like and the system works well.
• Adiosweb 7.3 (http://os.cqu.edu.au/adios/adiosweb.html) is very close to a full Linux environment. The user has to make two rounds of decisions at boot time, and then login using a obscure password. The screen resolution was OK at startup and is configurable through the GUI interface. The fonts used within the web browser were not ideal, but this might be a good choice.

If you have any comments on these solutions or you know of other boot CDs to try, please let me know.

Continuing with the theme of watching people at a distance, here is a story about a new device that can track eye gazes. The device can tell when it is being looked at by using infra-red light to detect the pupils of the eye. This has interesting applications in areas such as advertising, but also interesting privacy implications.

Tracking billboards could give you the eyeball

A camera that monitors eye movements from up to 10 metres away makes it possible for smart billboards that track the attention of passers-by. The developers behind the technology – dubbed Eyebox2 – believe it could have a range of possible applications, but should particularly interest advertisers. This is because it allows billboards to track people’s attention and perhaps respond when it wanes.

There is also a Slashdot discussion going on.

Technorati Tags: eye tracking, privacy, advertising, attention