Decode Transmission

Sony Pictures Hack: The North Korea Connection, or Lack Thereof

2014-12-26T19:45:00.000-05:00

On November 28th, 2014 website re/code wrote an article that speculates that North Korea might be behind the Sony Pictures hack because of the impending release of the movie "The Interview." A few days later Federal Bureau of Investigation Director James Comey states that the FBI isn't prepared to make any claims of who is responsible for the compromise of the company [Source: NBC 12/2014]

An ABC affiliate reports on December 19th that the FBI officially announces that North Korea is responsible.

It is also around this time that CNN speculates that North Korea has engaged in cyberwar.

So, exactly what evidence is there that links North Korea to hacking Sony Pictures?

The FBI Evidence
When the FBI made it's announcement linking North Korea to Sony Pictures, it released a statement discussing the evidence.

The following is the purported evidence:

"As a result of our investigation, and in close collaboration with other U.S. government departments and agencies, the FBI now has enough information to conclude that the North Korean government is responsible for these actions. While the need to protect sensitive sources and methods precludes us from sharing all of this information, our conclusion is based, in part, on the following:
Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.
The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack.
Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea." [Source: fbi.gov]

According to Steve Ragan of CSO's Salted Hash column, he questions the FBI's conclusions. To summarize Ragan, code can be recycled, the tools used could be employed by anyone and lastly, IP addresses can be spoofed. [Source: CSO 12/2014] The New York Times also has an interesting article citing the lack proof by the US Government to back up their claims that anyone reading this should check out.

Security guru Bruce Schneier also echos the same sentiment that the amount of evidence released is minimal and not particularity solid.

Even Rachel Madow has posed the question of what if North Korea isn't behind this?

So, if North Korea isn't behind the hack, then who is? In order to answer that question, we need to learn who the Guardians of Peace are, or, is?

More questions
Where is Japan's involvement in this ordeal? Sony is a Japanese company and Sony Pictures Entertainment is one of it's divisions. With that being said, how is the Sony Pictures hack a matter of US national security if it is owned by Japan? (Granted this hack has shown how vulnerable organizations are, but still...)

What are your theories and questions? Drop a comment. You can also send email to dcde [dot] transmission [at] gmail [dot] com

Related articles
Sony Pictures: Timeline of the 2014 Hack
Sony Pictures Hack: The Malware
Sony Pictures Hack: The FBI Investigation

Sony Pictures Hack: The FBI Investigation

2014-12-14T15:50:00.001-05:00

On December 2nd, 2014, the Federal Bureau of Investigation launched its investigation into the Sony Pictures hack. The FBI also issued a flash alert the day before warning organizations of malware that has the ability to destroy data.

The following Friday, December 5th, 2014, the FBI is called in to examine threatening emails that Sony Pictures employees, and their families, received . [Source: CNET 12/2014]. The full email from #GOP, found at Variety, says:

"I am the head of GOP who made you worry.

Removing Sony Pictures on earth is a very tiny work for our group which is a worldwide organization. And what we have done so far is only a small part of our further plan. It’s your false if you think this crisis will be over after some time. All hope will leave you and Sony Pictures will collapse. This situation is only due to Sony Pictures. Sony Pictures is responsible for whatever the result is. Sony Pictures clings to what is good to nobody from the beginning. It’s silly to expect in Sony Pictures to take off us. Sony Pictures makes only useless efforts. One beside you can be our member.

Many things beyond imagination will happen at many places of the world. Our agents find themselves act in necessary places. Please sign your name to object the false of the company at the email address below if you don’t want to suffer damage. If you don’t, not only you but your family will be in danger.

Nobody can prevent us, but the only way is to follow our demand. If you want to prevent us, make your company behave wisely."

To add to the severity of this compromise, the FBI released a statement Saturday the 6th,regarding the malware used. The Bureau said "This incident appears to have been conducted using techniques that went undetected by industry standard antivirus software."[Source: USA Today 12/2014]

As of December 9th, FBI Director James Comey stated that the Bureau still has not identified who is responsible for the Sony Pictures compromise. [Source NBC 12/2014 ] This was amid speculations that North Korea was involved with the hack in retaliation to the upcoming release of the movie "The Interview."

The ongoing investigation led assistant director of the Federal Bureau of Investigation's cyberdivision Joe Demarest to say

"[T]he malware that was used would have gotten past 90 percent of the Net defenses that are out there today in private industry and [would have been] likely to challenge even state government," [Source CNET 12/2014]

It still remains uncertain who is responsible for this hack.

Update #1
On December 19th, 2014, the FBI officially concludes that North Korea is indeed responsible for the attack on Sony Pictures that occurred almost a month ago However, Steve Ragan of CSO's column Salted Hash offers up some interesting commentary and critique on the Federal Bureau of Investigation's probe into the attack. To briefly summarize Ragan's view, he states that while the FBI says that code found in the malware used for the attack, criminals often recycle code, so this shouldn't be a sole indicator that North Korea is responsible. [CSO 12/2014] The FBI saying that the IPs used are also indicative of North Korea's involvement, according to Ragan is also no smoking gun, as attackers can use proxies or other means to mask where they're really coming from [Source CSO 12/2014]

The truth of the matter is that for us laypeople we aren't privy to the investigation and can only speculate what is happening until authoritative sources reveal what is happening.

[Check back for updates]

Have something to say about the investigation or have updates to this article? Feel free to comment. Corrections to inaccuracies are welcome too. You may also email dcde[dot]transmission[at]gmail[dot]com

Related articles
Sony Pictures hack time line
Sony Pictures Hack: The Malware

Sony Pictures Hack: The North Korea Connection, or Lack Thereof

Sony Pictures Hack: The Malware

2014-12-07T15:08:00.000-05:00

The Sony Pictures hack that surfaced on November 24th, 2014, has several fascinating aspects to it. This entry will look at the malware associated with the attack.

The malware class associated with the Sony Pictures hack would be classified as a wiper. This type of malware destroys data and itself, according to Wikipedia.

Destover, the wiper malware analyzed by Kaspersky, as well as Symantec, executes in three stages

Overwrite the Master Boot Record (MBR)
Overwrite data
Connect to command and control web server which loads the now infamous skeleton image


Source

For those wanting a more technical look at the malware, visit the Kaspersky and Symantec analysis.

Regarding this malware, things get interesting, according to darkreading.

"Security researchers have discovered that the wiper malware -- called Destover by some, WIPALL by others -- contained hard-coded names of servers inside Sony's network and the credentials to access them. Further, the attackers themselves released a new set of 11,000 files last night that include, as one reporter explained it, "everything needed to manage the day-to-day [IT] operations at Sony."

USA Today also has a good article on the discovered malware. According to Kevin Mandia, CEO of Mandiant, "the malware was undetectable by industry standard antivirus software and was damaging and unique enough to cause the FBI to release a flash alert to warn other organizations of this critical threat." [Source: USA Today, 12/2014]

Poking around, this appears to be the FBI flash alert that was released http://www.scribd.com/doc/249069192/DHS-NCIC-spread-of-FBI-Flash-warning

In the FBI flash alert it details the technical aspects of the threat Mandia speaks of. It includes MD5 hashes of the files as well as Snort signatures for detection. Snort is an open source IPS (Intrusion Prevention System)

Mandia continues to say "this was an unparalleled and well planned crime, carried out by an organized group, for which neither SPE nor other companies could have been fully prepared."

The USA Today also received comment from a former NSA employee who states, to paraphrase, that this attack/malware is a game changing event. [Source: USA Today, 12/2014]

In the article, Tom Kellermann, CSO of Trend Micro mentions "This is totally different, this is literally the equivalent of burning the building down — it's a wake-up call about how bad it can get"

Felt this best summed things up. Source: Flickr

Update December 8th, 2014
In the most recent leak reported by arstechnica, along with sensitive files

"...download pages for .torrent files and full .rar downloads on sites such as FileNuke and TurboBit hosted a number of other things as well. They were laden with a variety of “malvertising”—including an ad from a Swedish “adrotator” that attempted to download malware and a variety of layered frames over buttons that were positioned to fool visitors into launching hordes of fraudulent advertising pages."

Update December 9th, 2014
arstechnica adds a new piece to the malware story. Kaspersky Labs has found another variant of Destover that is using a valid cert stolen from Sony Pictures [Source: arstechnica 12/2014]. It was signed on December 5th and attempts to connect to two C&C servers in Thailand and Champlain, New York [Source: arstechnica 12/2014].

Source

This new variant, according to ars, is a more generic version that might be part of a botnet kit used to spread the malware and "be installed without being stopped by corporate system management measures such as application whitelisting—especially if it was intended to re-target Sony Pictures’ network for another attack." [Source: arstechnica 12/2014]

For a more technical look, visit the Kaspersky analysis. Pertaining to the new variant of Destover, the MD5 is e904bf93403c0fb08b9683a9e858c73e and, again, visit the analysis for the IP addresses for the C&C servers

Update on Kaspersky analysis
The digitally signed malware was a joke between security researchers. The new malware variant has not been seen in the wild. Kaspersky does say "However, the existence of this sample demonstrated that the private key was in the public domain.

Update
On December 19th, according to Bloomberg, the company Trend Micro has also analyzed the malware involved with the Sony Pictures hack. Trend's findings indicate that the Guardians Of Peace were in Sony Pictures' networks for months. During the minutes leading up to the breach, the attacker's payload had a ten minute timer and once it hit zero, the payload executed its instructions. [Source: Bloomberg 12/2014] This is what is called a time bomb.

It is unknown if the other major anti-virus vendors Kaspersky, Symantec and McAfee have also verified Trend Micro's claims.

[Stay tuned for more updates]

It's going to be interesting to see how this all plays out.

If anyone has more information on the, or any, malware used, or if you see inaccuracies, or if you want to share your thoughts of what's going on, drop a comment. You can also send email to
dcde [dot] transmission [at] gmail [dot] com

Also check out the time line of the Sony Pictures attack if you need catching up or are curious as to what's going on. You can find it here

Stay tuned!

Related articles
Sony Pictures: Timeline of the 2014 Hack
Sony Pictures Hack: The FBI Investigation
Sony Pictures Hack: The North Korea Connection, or Lack Thereof

Sony Pictures: Timeline of the 2014 hack

2014-12-06T02:03:00.000-05:00

It's certainly been a while since the last post, but the Sony Pictures hack has brought the blog to life because this compromise is absolutely fascinating. This entry will recap the ongoing events of the breach. There is so much happening with this, it's like a new surprise everyday. It's the hack that keeps on giving. Future posts on this topic will hopefully be a little more in depth and focused, but for now, to bring everyone up to speed, who hasn't been following this incredible hack, here is the quick and dirty of the events that have transpired.

November 24th, 2014
On November 24th, 2014, Steve Ragan of CSO's Salted Hash column reported that Sony Pictures was in the "middle of a security incident" (Regan, 11/2014). One of the alleged hackers of the group calling themselves #GOP or (Guardians of Peace) claimed responsibility and the following image appeared on Sony Pictures employees' monitors.

Source core0.staticworld.net

The group alleges that, as a result of their attack, Sony Pictures brought down their corporate network. #GOP also released a threat that if their demands weren't met by 11PM GMT on November 24th, they would release the data they were in possession of. The deadline passed and the group did not make good on their threat.

Mean while, the members of r/hacking on reddit were trying to piece together and make sense of the preview of the trove #GOP had. You can follow the r/hacking thread here, which still appears to have some activity.

Ragan then released another update stating that "After notification, employees were told to turn their computers off, disable Wi-Fi on their mobile devices, and to refrain from accessing the corporate VPN" (Ragan, 11/2014). He was unable to confirm, at the time, but there were claims that some employees were sent home for the day, while others were told to sit tight (Ragan 11/2014)

Still yet another update, Ragan said that Sony Pictures issued a statement stating "We are investigating an IT matter."

Another plot thickening moment is when several twitter feeds were allegedly hijacked by #GOP calling out CEO of Sony Pictures Entertainment Michael Lynton as a criminal. This was reported by business2community.com

November 25th, 2014
Steve Ragan drops a bombshell that takes the Sony Pictures hack to a whole other level.

While there still isn't verifiable evidence at this point in the time line of the compromise, Ragan, as well as Jacob Kastrenakes and Russell Brandom at The Verge report of someone calling themselves "lena" as saying "I've already contacted the UK register with details," wrote 'Lena' – the name associated with the GOP account that responded to Salted Hash on Tuesday morning.
"However I'll tell you this. We don't want money. We want equality. Sony left their doors unlocked, and it bit them. They don't do physical security anymore." (Ragan 11/2014)

November 26th, 2014
Ars technica reports that Sony Pictures corporate network is still down. The tech site also gives a rundown of the purported treasure trove of data in #GOP's possession thanks to the analysis of those at r/hacking. Some of the files that #GOP claimed to have were passports of stars Jonah Hill and Cameron Diaz, among others. The leak also has documents containing passwords, Outlook .pst files and other sensitive data.

November 27th, 2014
Website re/code mentions that North Korea may be responsible for the hack in retaliation to Sony Pictures upcoming release "The Interview" which stars actors Seth Rogan and James Franco. The duo play characters who are approached by the CIA to assassinate Kim Jong-Un. [Arik Hesseldahl re/code 11/2014]. As of this date, the North Korean connection is unsubstantiated.

November 28th, 2014
Reporter James Dean from The Times (London) posts image on Twitter of a notice from Sony Pictures telling employees to not connect to the network or WiFi

Source @JamesDeansTimes

November 29th, 2014
Several sources are still speculating if North Korea is the culprit of the attack. Also several movies, including "Annie", which isn't in theatres yet and "Fury" which stars Brad Pitt were found available online.

The hits kept coming as Ragan of CSO reported that sales and contract information was published by #GOP. This appears to be when the hacker(s) made good on their threat to release data.

November 30th, 2014 - December 1st, 2014
Sony Pictures hires Mandiant to investigate and the FBI begins their probe into the compromise

Deadline reports that information on executive salaries are leaked online by #GOP

FBI releases flash alert warning of malware discovered that may be linked to Sony Pictures compromise. The malware has the potential to wipe data from drives.

December 2nd, 2014
Brian Krebs mentions that employee healthcare and salary data was leaked by #GOP. This could lead to a very interesting discussion on HIPAA and PII in the wake of the hack.

Again, Ragan has a very thought provoking article discussing issues related to the breach. In it he states that the Guardians of Peace were in Sony Pictures for a year gathering data.

December 3rd, 2014
The Wall Street Journal reports that top executives at Sony Pictures confirm that salary information leaked to the internet is authentic.

December 4th, 2014
Internal IT infrastructure is leaked online, further adding to the difficulties of managing the breach.

CNET writes that "An analysis of 33,000 leaked Sony Pictures documents by data security software firm Identity Finder showed that the leaked files included the personal information, salaries and home addresses for employees and freelancers who worked at the studio." The article mentions that 47,000 Social Security Numbers were among the items leaked.

December 5th, 2014
CNET and Variety report that Sony Pictures employees are receiving threatening emails and that the FBI is investigating. A snippet of the email says

"Many things beyond imagination will happen at many places of the world... Please sign your name to object the false of the company at the email address below if you don't want to suffer damage. If you don't, not only you but your family will be in danger."

Time line update #1
December 7th, 2014
Bloomberg reports that Sony Pictures has traced the source of the leaks to the St. Regis hotel in Bangkok. There are still no leads as to who is the responsible party is and the reason for the attack.

Time line update #2
December 8th, 2014
#GOP posts demands on github Wants Sony Pictures to not release "The Interview." #GOP claims the were not responsible for the threatening e-mails that Sony Pictures employees received. Malware is also served up in the latest leak.

Time line update #3
December 9th, 2014
The FBI investigation that is under way has not yet identified anyone who is responsible for the Sony Pictures hack.

December 10th, 2014
Kaspersky labs finds Destover malware digitally signed with stolen Sony Pictures certificate. It was later discovered that is was part of joke between a some security researchers who uploaded their find to virustotal

December 11th, 2014
TheWrap reports that the #GOP sent another message on the computer screens of employees. If anyone reading this happened to snag a picture of it please send it to the email at the bottom of this post.

December 12th, 2014
It's alleged that Sony Pictures is suspending movie shoots because it can't process payments.

Time line update #4
December 13th, 2014
re/code reports that the latest leaks are of Sony Pictures' asset Crackle and that the #GOP is preparing a Christmas gift

December 14th, 2014
Sony Pictures begins taking legal action against media organizations demanding that the delete "stolen" data. [Source: New York Times, 2/2014]

December 16th, 2014
The #GOP releases the first part of their "Christmas Present" It includes a a terror threat to those considering going to see "The Interview" on Christmas Day.

Sony Pictures employees are now filing lawsuits for failing to protect their data. [Source: TheVerge 12/2014]

Time line update #5
December 17th, 2014
Sony Pictures caves in "The Interview" Theaters will not be showing the movie this Christmas. [Source: CBS 12/2014]

According to the New York Times, US officials have "concluded that North Korea ordered the attacks on Sony Pictures’s computers" [Source New York TImes, 12/2014] The Times also states "It is not clear how the United States came to its determination that the North Korean regime played a central role in the Sony attacks" [Source New York TImes, 12/2014] If anyone happens to find more details on this part of the Sony Pictures saga, please drop a comment or send an email.

Time line update #6
December 18th, 2014
Anonymous kicks off #OpRIPNK

December 19th, 2014
The FBI "formally accused North Korea of attacking Sony Pictures" [Source: CSO 12/2014]

President Obama vows a response to the alleged North Korean cyber attack against Sony Pictures [Source: Yahoo! News 12/2014] The US President is quoted as saying "We'll respond proportionally, and we'll respond in a place and time and manner that we choose." [Source: Yahoo! News 12/2014]

December 20th, 2014
The 2600 is attempting to coordinate with Sony Pictures to stream The Interview on their site on Christmas Day. The link http://www.2600.com/?q=content%2Foffer-sony-2600

Time line update #7
December 22nd, 2014
Sony Pictures lawyers threaten Twitter and its users for publishing leaked emails and "stolen information" [Source: Buzzfeed 12/2014]

Time line update #8
February 5th, 2015
Amy Pascal "steps down" as co-chair of Sony Pictures.

[More updates coming soon. Check back for more information]

This breach seems so massive, that it might just well be the worst cyber attacks on US soil. As the fallout continues, it will be interesting to see how things unfold.

If you see anything inaccurate about the events in the time line, post in the comment section and I can update the entry. Also if you have something to say about the breach, or have more information to add, drop a comment.

You can also send email to dcde [dot] transmission [at] gmail [dot] com.

Related Articles
Sony Pictures Hack: The Malware
Sony Pictures Hack: The FBI Investigation
Sony Pictures Hack: The North Korea Connection, or Lack Thereof

What about Competition? The Case of AT&T vs the US Justice Department

2011-10-15T15:31:00.000-04:00

Hello everyone! It's been a while since I posted, so I thought I'd share a paper I wrote a few weeks ago about AT&T's bid to buy out T-Mobile.

Earlier this past week the US Justice Department sued the telecommunications giant AT&T in an effort to block their purchase of T-Mobile USA, which is currently owned by parent company Deutsche Telekom.[1]AT&T’s plan to buy T-Mobile raises interesting questions that must be examined; the biggest one being would this buyout cause a loss of competition with only three mobile carriers instead of four?

Currently the four largest mobile carriers in the United States are AT&T, Verizon, T-Mobile and Sprint.[2] Had the Justice Department not blocked AT&T’s bid for T-Mobile, the elimination of a competitor would potentially harm consumers and other interested parties, such as developers and VoIP carriers. The Justice Department argues that “…the proposed deal, which would join the nation’s second- and fourth-largest wireless phone carriers, would result in higher prices and give consumers fewer innovative products.”[3] Consumer advocacy groups also echoed the argument by saying that because of T-Mobile’s low cost strategy, they are the key to keeping affordable mobile packages across the board.[4] By taking T-Mobile out of competition, says the consumer advocacy groups, AT&T will cause prices to rise and provide customers with fewer choices[5]and “thereby turn the cellular market into a duopoly controlled by AT&T and Verizon.”[6]

In an analysis of AT&T’s proposal to buy T-Mobile, Yankee Group backs the Justice Department’s argument that the buyout does indeed hurt consumers. The group states that “in several major markets AT&T’s share of overall subscribers would exceed 50%, creating concentration levels among the remaining providers that would drive prices higher for all consumers.”[7] As a result of this higher market concentration, Yankee Group says there “would be an increase in the average bill in many major markets, in some cases in excess of $5 a month by 2015.”[8]

To answer the question if competition is good for the customer, the evidence is pointing to an answer of yes. It appears that the more competition there is in the market, the better the price and choice that are available for customers. AT&T’s plans bring up another interesting point about how their purchase would affect third party developers and VoIP providers.

To put things in perspective, James Stewart, of the New York Times, examined AT&T’s market share across major markets using the Herfindahl-Hirschman Index (HHI).[9] This index is “derived from the common-sense principle that the more competitors in a market, the lower the prices and the greater the innovation. In short, more competitors means more competition, which benefits consumers.”[10] With this being said, Stewart found that AT&T would have close to, if not more, than the majority of the markets in their grasp; Seattle being a 53.2 percent concentration for the company.[11]

With AT&T having the potential to further dominate the market, they could theoretically develop new technology in-house or acquire third party developers. This would, again, limit consumers and businesses with choices. One could argue that third party developers would have to comply with AT&T standards when developing new technologies. If third parties have to implement AT&T standards for their technologies, compatibility issues could force T-Mobile customers into buying new mobile devices, or services, at higher prices. Since AT&T also provides internet services, pricing, again, will increase, but an even more important issue arises and it’s that of net neutrality, which could affect not only customers, but VoIP providers as well.

According to PC Magazine, net neutrality is a “level playing field for Internet transport. It refers to the absence of restrictions or priorities placed on the type of content carried over the Internet by the carriers and ISPs that run the major backbones. It states that all traffic be treated equally; that packets are delivered on a first-come, first-served basis regardless from where they originated or to where they are destined.”[12] With AT&T eliminating T-Mobile as a competitor, T-Mobile would not have a chance to further develop its internet services. Currently, if you look at AT&T’s website, att.com, and T-Mobile’s website, t-mobile.com, their internet offerings appear to be in various stages of development. AT&T’s UVerse offers high speed internet, cable and voice[13] while T-Mobile’s internet package is fairly non-existent with the exception of their Wi-Fi network.[14] What this means for AT&T is that they have the potential to further erode net neutrality with one less competitor to worry about. This sentiment is mirrored by Erik Sherman of BNET when he states, “…carriers have already effectively killed the idea of net neutrality by getting the FCC to agree that it shouldn’t apply to wireless because it was a growing industry.”[15] This leads to VoIP carriers.

VoIP, or Voice over IP, converts “analog audio signals, like the kind you hear when you talk on the phone, and turning them into digital data that can be transmitted over the Internet.”[16] By using VoIP, a person can effectively make free phone calls using the internet and cut telecommunication companies, like AT&T, out of the loop.[17] Now, if AT&T bought T-Mobile, they would have the ability to further compete with VoIP carriers, such as Vonage. The interesting twist to this is, with fewer competitors in the market, AT&T could impose restrictions on their internet framework by decreasing the access speed to VoIP providers, forcing customers to switch over if they want better quality VoIP services at higher prices.

In closing, the Justice Department made the correct choice of blocking AT&T’s plan to buy T-Mobile.

References

Going deep on AT&T-T-Mobile merger: How will it really impact wireless competition? (2011). TMCnet.com. Retrieved September 13, 2011 from http://www.tmcnet.com/usubmit/2011/08/22/5722088.htm

Net Neutrality. (2011). PCMAG.com. Retrieved September 13, 2011 from http://www.pcmag.com/encyclopedia_term/0,2542,t=Net+neutrality&i=55962,00.asp

Stewart, J. (2011). Antitrust Suit Is Simple Calculus. New York Times. Retrieved September 13, 2011 from http://www.nytimes.com/2011/09/10/business/att-and-t-mobile-merger-is-a-textbook-case.html?_r=2&pagewanted=1&t&sq=at&st=cse&scp=5

UVerse High Speed Internet. (2011) AT&T.com. Retrieved September 13, 2011 from http://www.att.com/shop/internet/#fbid=vpI-Lb-cdIc

Sherman, E. (2011). AT&T Wants Ma Bell Back, but It’s Not Happening… and That’s a Good Thing. BNET.com.Retrieved September 13, 2011 from http://www.bnet.com/blog/technology-business/at-t-wants-ma-bell-back-but-its-not-happening-8230-and-thats-a-good-thing/12616

T-Mobile Hot Spot. (2011). T-Mobile.com. Retrieved September 13, 2011 from http://www.tmobile.com/shop/addons/services/information.aspx?PAsset=InternetEmail&tp=Svc_Tab_HotSpot

United States v AT&T INC., T-Mobile USA INC., and Deutsche Telekom AG Case 1:11-cv-01560 August 31, 2011

Valdez, R. & Roos D. (2001). How VoIP Works. How Stuff Works. Retrieved September 13, 2011 from http://communication.howstuffworks.com/ip-telephony.htm

Wyatt, R. (2011). U.S. Moves to Block Merger Between AT&T and T-Mobile. New York Times. Retrieved September 13, 2011 from http://www.nytimes.com/2011/09/01/technology/us-moves-to-block-merger-between-att-and-t-mobile.html?pagewanted=1&t&sq=at&st=cse&scp=9

[1] Wyatt, R. (2011). U.S. Moves to Block Merger Between AT&T and T-Mobile. New York Times. Retrieved September 13, 2011 from http://www.nytimes.com/2011/09/01/technology/us-moves-to-block-merger-between-att-and-t-mobile.html?pagewanted=1&t&sq=at&st=cse&scp=9

[2] United States v AT&T INC., T-Mobile USA INC., and Deutsche Telekom AG Case 1:11-cv-01560 August 31, 2011, P.3

[3] Wyatt, R. (2011). U.S. Moves to Block Merger Between AT&T and T-Mobile. New York Times. Retrieved September 13, 2011 from http://www.nytimes.com/2011/09/01/technology/us-moves-to-block-merger-between-att-and-t-mobile.html?pagewanted=1&t&sq=at&st=cse&scp=9

[4]Ibid

[5]Ibid

[6]Ibid

[7]Going deep on AT&T-T-Mobile merger: How will it really impact wireless competition? (2011). TMCnet.com. Retrieved September 13, 2011 from http://www.tmcnet.com/usubmit/2011/08/22/5722088.htm

[8] Going deep on AT&T-T-Mobile merger: How will it really impact wireless competition? (2011). TMCnet.com. Retrieved September 13, 2011 from http://www.tmcnet.com/usubmit/2011/08/22/5722088.htm

[9]Stewart, J. (2011). Antitrust Suit Is Simple Calculus. New York Times. Retrieved September 13, 2011 from http://www.nytimes.com/2011/09/10/business/att-and-t-mobile-merger-is-a-textbook-case.html?_r=2&pagewanted=1&t&sq=at&st=cse&scp=5

[10]Ibid

[11]Ibid

[12] Net Neutrality. (2011). PCMAG.com. Retrieved September 13, 2011 from http://www.pcmag.com/encyclopedia_term/0,2542,t=Net+neutrality&i=55962,00.asp

[13] UVerse High Speed Internet. (2011) AT&T.com. Retrieved September 13, 2011 from http://www.att.com/shop/internet/#fbid=vpI-Lb-cdIc

[14] T-Mobile Hot Spot. (2011). T-Mobile.com. Retrieved September 13, 2011 from http://www.tmobile.com/shop/addons/services/information.aspx?PAsset=InternetEmail&tp=Svc_Tab_HotS

[15] Sherman, E. (2011). AT&T Wants Ma Bell Back, but It’s Not Happening… and That’s a Good Thing. BNET.com. Retrieved September 13, 2011 from http://www.bnet.com/blog/technology-business/at-t-wants-ma-bell-back-but-its-not-happening-8230-and-thats-a-good-thing/12616

[16] Valdez, R. & Roos D. (2001). How VoIP Works. How Stuff Works. Retrieved September 13, 2011 from http://communication.howstuffworks.com/ip-telephony.htm

[17]Ibid

Who Really Owns Your Mortgage?

2011-09-03T23:48:00.001-04:00

After hearing the news the other day about the Federal Housing Finance Agency preparing lawsuits against some of the country's largest banks, which you can read here and here. I was perusing the interwebs and came across this segment on YouTube about a family who was foreclosed on, evicted, and then broke into their house as a result of the practices of mortgage lenders/originators. Below is the video and it makes me really wonder, who really owns your home? With what is discussed in the clip, could this also hold true for other types of loans? What's your two cents?

What I'm Currently Listening To: end.user "Keep Telling"

2011-08-19T15:49:00.000-04:00

I first came across end.user a few months ago and have been a fan ever since. When I first started to get into the electronica scene there have been an extremely small amount of artists that have wow'd and influenced me. Those being Massive Attack, DJ Krush, The Starseeds, Thievery Corporation, and Scorn (another recent favorite). And if you're wondering, yes I'm a downtempo/trip-hop fan.

Name dropping aside, the artists just mentioned are those that I just can't stop listening to. They're unique and, for the most part, keep raising the bar. This is how I also feel about end.user. His music is so diverse that I can't wait for the next song to come along just so I can hear what he's created. I really dislike having to pigeonhole what genre an artist is, but the only way I can describe end.user's sound is a mix of d'n'b, jungle, dubstep, and downtempo all with an industrial flavor added here and there. It's engaging stuff and the track I can't stop listening to at the moment is "Keep Telling" off of the release "Form without Function"

For more end.user goodies, check out these links:
http://sonicterror.pressplatform.com/
http://www.facebook.com/sonicterror
http://www.last.fm/music/enduser
http://www.myspace.com/enduser

If you like it, pass it along and help support end.user.

Don't forget to bookmark, subscribe and follow.

Until next post...

What you Might Not Know About Your Copying Machine.

2011-08-01T20:15:00.000-04:00

OK, I'm going to admit, I'm about a year late on this, but thanks to a friend that shared this clip on copying machines, my interest is piqued. Rule of thumb, if you're getting rid of any technology, make sure hard drives are wiped, removed and destroyed before selling/donating/junking.

I'm curious as to what the free forensic software is that's mentioned in the video. Anyone out there know?

Playing around with iNudge

2011-07-08T02:15:00.002-04:00

The other day a friend posted a link to iNudge saying that it was a pretty good music creation tool. I was instantly interested and started to play around with the application and here are my impressions.

iNudge is super easy to use. It reminds me of a combination of an extremely stripped down old version of Fruity Loops, where song programming was more or less done in a step sequencer, and a monome in a 16x16 grid layout.

The way the interface is broken down is pretty self explanatory. On the very far right is a column of 8 tabs which are your available instruments. They consist of 7 various keyboard/synths and the very bottom tab is the drum section. With the exception of the drums, the instruments have no "note" indication. The drums contain, from top to bottom: Crash Cymbal (CR), Timbales (TI), Bongos (BO), Tom High(TH), Tom Middle 2 (TM2), Tom Middle 1 (TM1), Tom Low (TL), High Hat Open (HO), High Hat Closed 2 (HC2), High Hat Closed 1 (HC1), Clap (CL), Snare 3 (SN3), Snare 2 (SN2), Snare 1 (SN1), Bass Drum 2 (BD2), Bass Drum 1 (BD1).

In the very bottom right corner of the iNudge interface are two buttons: play/pause and volume. Everything mentioned up to this point is the very basic look and feel of the application. This is perfect for just playing around and, speaking in general, is geared toward those with zero music background.

Now, if you want to get a little more our of iNudge, there's a button at the bottom of the interface that says "MORE." By clicking the button it opens up a few other options.

To the right you'll see a big "+." Click on the plus sign if you want another bar of music. If you do, you'll see "-" under the plus sign. Click on the minus sign if you'd like make your song a bar shorter. Tip: When you click on the plus sign it copies everything from the previous bar, so if you want to create a new melody, or drum beat, you have to clear the patterns out of the newly added bar and then go from there.

Speaking of copying, at the top of the interface, you'll see clear/copy/cut/paste commands and right below that you have a little button that allows you to copy "ALL" or "SELECTED" (which is the section of music).

Below the step sequencer is your timeline of your song and there's a rectangle that you click and drag to bring you to a section you would like to view. There is also a position marker that you can also click and drag to a specific point in your song.

Beneath the timeline is the "LESS" button which brings you back to the simple interface that you originally started out with. Next to that button is the volume for the instrument so you can adjust how loud it is in the mix. There's also a mute button for the instrument. It's a little dot right below the volume "knob." Next to the instrument volume know is the pan knob. This allows you to shift the sound of the instrument left or right in the stereo field. Next to that is the instrument name, then the CLR button, which clears the current pattern. Finally at the bottom right is the tempo button, the volume knob for the entire song and the play/pause button. To use the tempo button, click and drag your mouse up and down to change the tempo of the song. The minimum tempo is 60 beats per minute (bmp) and the make is 180 bpm. That's everything you need to know about iNudge.

Overall, this is a cool little toy to play with if you're not very musically inclined. If you do have a background in music, it's very limiting.

iNudge is limiting in the following ways:

You're stuck in a 16th note only step sequencer. There is no way to play anything beyond 8th note patterns. No support for quarter notes, triplets, sub 16th note divisions, or the ability to tie notes.
There is no way to stop the song from looping.
The drum instruments are a bit flat and weak. If you want your bass drum to have a little punch, layer it with the low tom (TL). Snare drums aren't the greatest either.
You can't compose anything slower than 60 bpm or faster than 180bpm, so you won't be making that super slow downtempo tune and you won't be making any speedcore either.

Things I would like to see:

A couple of basic effects such as reverb and delay to add a bit of depth to the song
An EQ that's basic and easy to use. A bass and treble knob would do the trick
The ability to use more notes such as quarter notes, triples, etc.
Better drum samples.
A way to save the music as .mp3 or .WAV files

I understand that iNudge is geared toward easy music creation and I think a little bit of the the above additions couple make things more interesting.

Just for fun, here's something simple I threw together. I think you might even be able to play around with it too.

What I'm Currently Listening To: Defeated Sanity "Chapters of Repugnance"

2011-07-02T01:22:00.000-04:00

Time for another dose of what's been polluting the airwaves at the Decode Transmission super secret hideout.

The band making waves over here is Defeated Sanity. Metal heads will probably eat this band up, but if you're not a metal fan or an eclectic music fan venturing out listening to new things, this won't be your cup of tea.

I was bored one evening and decided to look through Williowtip Record's site for some interesting bands and decided to give Defeated Sanity a spin. Result with my first outing with the band: It felt like being hit in the chest with a sledgehammer and I enjoyed every second of their album "Chapters of Repugnance." With all the technical death metal bands out there, it's great to hear some straight up brutal death metal thrown into the mix. Vo-kill duties on this release is A.J. Magana and you can hear him channeling Frank Mullen of Suffocation, only more guttural. The sound of this album is just so dense that you can feel it. Riffs are top notch as well as the drumming. Germany certainly has created a monster. Fans of Suffocation, Internal Bleeding, Pyrexia and the rest of the NY Death Metal scene should check these guys out because it has that flavor. Fans of slam might also like. On that note, I shall leave you with the song I'm hooked on called Engulfed in Excruciation.

If this satisfied your metal craving, pass it along to your friends.

More Defeated Sanity links
http://www.myspace.com/defeatedsanity
http://www.facebook.com/DefeatedSanity
http://www.metal-archives.com/bands/Defeated_Sanity/11052
http://www.last.fm/music/Defeated+Sanity

Why Should you Care About the Cloud?

2011-06-24T21:56:00.002-04:00

Call it a hipster mentality, but I'm going to forego an image of a cloud. It's the equivalent of iceberg pictures in a powerpoint presentation where someone has to illustrate the point of this part of the presentation as "but this is just the tip of the iceberg." Anyway, I'm not here to rant about how powerpoint/open office/"your-choice-of presentation" tool should look like. Today I'm going to talk about my slow adaptation to the cloud and the issues related with it.

For those saying "What the heck is the cloud?" let's get started with a definition of what it is.

Cloud computing, for sake of argument, is using the interwebs to access tools, such as word processing applications, and to also store stuff. This is a very generic explanation of what the cloud is.

My slow adaptation to the cloud has started out with using e-mail to serve as a back up to saving documents and then as a means of collaborating with a group using said documents. In the crudest form this could be considered cloud-like. If you upload and share photos on social networks, websites, this could also be use of the cloud because you're uploading your files to the website's server for storage.

It was probably two months ago that I was exposed to cloud services, so I'll talk about each service then get into some of the security issues.

Google Docs is extremely easy to use and offers a word processor, spreadsheet, presentation application, as well as an application akin to MS Paint. The layout is user friendly and there are templates that you can use for things such as resumes and letterheads. While the Google docs applications are easy to use the functionality is very stripped down and limited. You're not going to get all the bells and whistles that you might be familiar with if you use the applications from the Microsoft Office suite. If you look at the screen shot below, this is your basic look of Google docs. The blacking out of sections of the screenshot is intentional.

As a stand alone application, it get's the job done. One really neat thing is if you're collaborating on a document with other people you can see them typing whatever it is they're working on. As a collaboration tool this means that everyone is working on the same document so issues of versioning are pretty much eliminated. What that means is that there aren't dozens of versions of the same file floating around therefore reducing the headaches of hunting down the most recent updated fail. If you look at the screenshot, you'll see I have a red arrow pointing to "Discussions." Discussions allows you to chat with fellow collaborators. It helped my research partner and I quickly break down our project and resolve any issues on the spot. Now, if you look at the "Anyone with the link" that I have circled, this is the permission that my partner set this document to. It means that anyone that has the link to the document can view it. To the left is a screen shot of the sharing permissions.

With the basics of some of Google's cloud applications laid out, let's talk about a couple of the information security issues that you should care about.

If you have a document that's sensitive, whether it's for personal use or if it's for your employer, a decision should be made if you want those files sitting on Google's servers or not. This leads to the sharing settings for Google docs.

If you look above at the screenshot of the document I have circled in red the URL address bar. This is the link to the document. My partner had set it up so that anyone with the link (which is blacked out) can view the document. The risk I can see associated this is that of session hijacking. This means that if I left my computer to see a fellow co-worker, someone could sit themselves down, copy the link and be able to view it. If the document were along the lines of a company trade secret and a malicious insider at the company copied the link s/he could send it to a competitor. Also if anyone is allowed to edit the document, you're inviting trouble there too because you won't know what the person's intentions are. It could be something as innocent as an accidental slip of the backspace key that causes an issue with the document.

Another thing that you should think about when it comes to getting involved with Google's cloud, as well as any other organization that provides cloud services (i.e. Amazon and Microsoft ) is where the servers are located, how they're protected and who as access to them.

Aside from Google docs I have also tried out dropbox and looked into box.net, so let's take a look at those two cloud applications.

Drop box allows you to store your documents, files, photos, music or whatever else can be stored online. This allows for easy sharing and collaboration. You can sync dropbox to your pc so that when a file is updated it also updates online so that the most current version of a document/file is available. If you're working on a project with a group of people, you set up who can share the project file and whenever someone accesses it, their changes are updated once they save it. Like Google docs it helps reduce the issues related to versioning. There are some other neat things you can do with dropbox as found in this video from CNET:

The security issues related with dropbox and box.net are several. Third party applications are cause for concern because you really don't know how well they are coded, or who coded them for that matter. This means that if an organization is using dropbox or box.net for collaboration purposes and a third party application is installed that's corrupt, then everyone who is using that tool have just brought risk into the organization. Like third party apps, corrupted files would spread like wildfire through an organization depending on how many people have access to it and the extent of the damage the the files do. It could be accidental, or someone could modify a file with malicious code.

As stated with Google docs, you don't know where or who has access to the servers or how they are secured. Another concerns that I have with dropbox and box.net are the collection of personally identifiable information. Here are the links to their terms and privacy policy so that you can take a look so that you know what you're getting into: http://www.dropbox.com/terms#terms, http://www.dropbox.com/terms#privacy, http://www.dropbox.com/terms#dmca, http://www.dropbox.com/terms#security and here's box.net http://www.box.net/static/html/terms.html, http://www.box.net/static/html/privacy.html

In short, I'm not a big fan of the cloud and I'll be using it in a very limited capacity. And then you can get into crazy theories such as this one that I concocted a while ago concerning ransomware.

If you're for or against the cloud pop your thoughts in the comment section and let us know why.

Don't forget to share, subscribe and bookmark.

See you all next post!

Note: If you made it this far in the post, thanks. I'm having one of those "I can barely put a thought together" kind of days and it's kind of showing up in this article.

Hey! It's a Movie Review: Super 8

2011-06-12T21:38:00.000-04:00

Hey everyone, it's been a long while since I went to see a movie, so last night a friend and I headed on over to a nearby theater to catch J.J. Abrams new flick Super 8.

The story revolves around a group of kids who are making a super 8 film during the 1970's. While filming one scene at a train station they witness and capture on film a horrific train wreck the unleashes a monster that is slowly revealed as the movie progresses (Think Cloverfield in that respect). With the US Air Force taking over the town, the kids decide to find out what's really going on.

This was a fun movie, but I was a little disappointed when it turned out to be a ripoff of E.T. The group of kids in this movie were great and reminded me of Stand By Me and Goonies (Says my friend). There are some great scares, jokes and action sequences, but the best part of the movie is during the credits , so make sure you stay until the very end. While the move wasn't anything new, you'll be entertained and I give it a 2.5-3 out of 5.

Possible Fraud Incitement For Goldman Sachs in the near Future?

2011-06-03T00:39:00.000-04:00

The following video is from the Washington Post/Bloomberg regarding a US Senate report laying out findings that could potentially bring, at minimum, civil fraud charges against investment bank Goldman Sachs for allegedly having a hand in the recent financial crisis. What's your opinion on this issue?

Harold Camping Should be Charged With Fraud At the Very Least

2011-05-21T23:15:00.000-04:00

Well, Judgement Day has been an absolute flop. Speaking for myself, the whole situation is laughable. Seeing that Harold Camping predicted the End of Days in the 90's with the same results should raise some red flags. On the other hand, I feel deeply disturbed and terrible for those people who donated money to Camping's non-profit organization Family Radio International.

As reported by CBS news, people were having farewell meals with their families. And then there are those donating to Camping's nonprofit.

As found on CBS News' site

"As May 21 drew nearer, followers say donations grew, allowing Family Radio to spend millions of dollars on more than 5,000 billboards and 20 RVs plastered with the doomsday message. In 2009, the nonprofit reported in IRS filings that it received $18.3 million in donations, and had assets of more than $104 million, including $34 million in stocks or other publicly traded securities."

To accept donations for the end of the world is deplorable and heinous, at the very least. Who knows how many people gave up their life savings, or a good chunk, expecting that they would be saved only to find out it's not happening. How will these people cope in the aftermath?

I'm not here to judge what someone believes in, but instilling fear in a person that Judgement Day is around the corner and making them believe that based on blind faith is monstrous. Camping's assets should be seized and frozen. Not only that, but the funds should be given back to those who gave. And what about those who left jobs? I just don't know what to make of this whole situation. Here's the link to the CBS article http://www.cbsnews.com/stories/2011/05/21/national/main20064974.shtml?tag=stack and below is a clip from CNN.

What do you think of this whole situation?

Tales From the Hacked: Sony PS3 Data Breach Debacle

2011-05-11T02:06:00.000-04:00

Woohoo! It's been a long while, but here is a new "Tales from the Hacked."

A friend of mine has had her Sony PS3 PlayStation account hacked. This is her story. Some information has been changed to protect her privacy, everything else is unedited and unfiltered.

Image via CrunchBase

"Okay, here goes.
Mid-April I saw an article on CNN.com about Sony's PlayStation Network being hacked and all of the information of it's customers had been compromised. I figured, like any other individual, that I wouldn't have any problems since there are so many millions of people with PlayStation accounts that the chances of my information getting into the wrong hands would be silly. I received an email a few days later informing me of the issue. Keep in mind that the PlayStation network had been "shut down for maintenance" for nearly two weeks before this, and nobody had been notified till much later. The PlayStation network is STILL offline and I can't get in so I guess they're still having problems.

Anyway, I had some issues back in February with my credit card, and thought I was done for the year. As many people know, Epsilon, a huge company that does email for zillions of different companies was also hacked at the beginning of the year. When I saw two charges for Playboy magazine and Sports Illustrated I chalked it up to that, or, I had been ripped off. When they started ending up in my mail box I was surprised because I figured somebody else would have wanted the magazines. Either way, I don't know what happened, but right now I am still receiving both magazines that I didn't subscribe for - yes, even Playboy. It is now May 9th and I just got a letter in the mail today saying I wasn't responsible for the charges. Thank god, because it was slightly embarrassing telling the Indian guy that I had not subscribed to Playboy.

Last night I went online to check my bank account to see how much money I had in there. I had $5.05. WHAT did I spend it on, I thought. So I looked at the pending transactions and there were two: one for $60.01 for www.zazzle.com and another for $0.00 for Netflix (perhaps somebody tried to open an account but was too late since they had already deduced my account to five bucks and were probably denied since I don't allow over drafts to my debit card). Zazzle is this craptacular website that customizes tee-shirts and other crap that no decent person really needs - just scum who would rip off innocent debit card numbers from poor, unemployed elementary school teachers. So I called XYZ Bank [Note: Real bank name changed], they processed the claim and I was able to go to the bank and get a new card printed immediately. However, it will still take them ten business days to refund the money.

All in all I am unsure if Sony is 100% responsible, or if Epsilon is either. I've never had my card numbers stolen before, and I hardly ever use my debit card so I don't really know where either issue would have come up."

Perhaps Sony should update their PS3 slogan to "It only does data breaches."

I would like to thank my friend again for sharing and I hope that maybe this has helped. If you want to tell your tale of being hacked, or defrauded, e-mail me at decodetransmission@hotmail.com for more information. Include "Tales from the Hacked" in the subject heading.

Feel free to share this as well as subscribe, bookmark and follow Decode Transmission. See you all next post.

Is There a Rotten Apple Amongst Us?

2011-04-28T23:02:00.001-04:00

From zdnet

Last year the EFF (Electronic Frontier Foundation for those unfamiliar) reported that Apple had a patent quietly in the works that has the ability to collect information secretly about it's users. Apparently, according to Gawker, Apple's patent has been filed and is causing major concern among privacy advocates and lawmakers. In Gawker's report, here's a little taste of what's in store:

"The patent application, for example, envisions a searchable map plotting the owner's location history; tying location to financial transactions; transmitting location data over the internet to remote servers; and many other uses."

With the recent data breach of Epsilon, the databases involved in Apple's project not only poses privacy concerns, but I can hear the blackhat hackers hearts skip a beat because of the wealth of information that they will contain. With that said, here's the Gawker article, which includes the filed patent.

What's your opinion on this?

Spread the word and don't forget to bookmark and subscribe.

The Epsilon Data Breach and Unica an IBM Company

2011-04-23T02:07:00.000-04:00

To start off this post, I would like to say that the Epsilon Data breach that made headlines at the beginning of the month has been interesting. While Epsilon, a subsidiary of Alliance Data, stated that the only information compromised was customer names and e-mails, I have to say I don't 100% believe what they are saying. As a project for a class I'm taking, we decided to delve into things and explore Epsilon. Since this class project is still in effect, I'm going to stick with my findings.

For those who don't know about Epsilon, they are the marketing arm of Alliance Data. One of the services Epsilon provides is permission based e-mails from clients. This means that a client, such as Best Buy (who was affected by the breach), would use Epsilon's services to send out e-mails to customers with various promotions. By giving Best Buy your name and e-mail, you have given them permission to send you e-mails.

So, when we started looking into the breach, all of us were only looking at news from pretty much anyone reporting it. The next class we had, everyone one of us were schooled big time and I have to admit it was an eye opening experience. Here are a few things learned that have stuck with me:

I used to think financial reports were totally boring. So much so that just looking at the first page I would say "Screw this, it's boring." While these reports are dry, I now have a new respect for them because they contain tons of information about a company that really shouldn't be disclosed, but legally, publicly traded companies have the obligation to do so in order to be transparent.
Job boards/sites like Monster and indeed as well as LinkedIn (more on that in a second), can help give a hacker, social engineer or malicious insider an insight to the technical layout of an organization.
LinkedIn is now pretty interesting to me. Companies, in my opinion, need to recognize that employees with technical expertise, as learned in my class, will post technical stuff such as programming languages, hardware, databases and whatever else they are competent with in order to attract employers. Employers also need to be aware of technical jobs they post because this leads to people you don't want putting two and two together gathering information that shouldn't really be public.

Taking what I just said, this was how I was able to figure out that Epsilon uses Unica. I found a job posting on LinkedIn that was advertising a position that needed a Unica Campaign manager. That job is now inactive, but here's another one (active at time of posting).

Up until I was digging around, I had no idea who, or what Unica was, or what it, or they did. So, I googled them, found their site and watched a video on the application they put out. There's no embeddable video, so here's a link of their demo.

This particular application leads me to believe that Epsilon is hardly telling the full truth of their breach. With Unica, Epsilon is able to gather behavioral and demographic data on customers among other things, such as geolocation of "anonymous prospects." So, what's behavioral data? Here's a definition from businessdictionary.com:

"Information employed in marketing for designing promotional campaigns based on consumers' buying habits,brand preferences, and product usage. See also attitudinal data and demographic data."

And according to Wikipedia, there is a definition of demographic data:

"Demographics or demographic data are the characteristics of a human population. These types of data are used widely in sociology, public policy, and marketing. Commonly used demographics include gender, race, age, income, disabilities, mobility (in terms of travel time to work or number of vehicles available), educational attainment, home ownership, employment status, and even location."

So, this means that Epsilon allegedly has information about your buying habits, brand preferences, and product usage, as well as your gender, race, age, income, and any other demographic data they collect. This means, theoretically, that somewhere lies a database that stores this information and if someone managed to break in, they would have a wealth of information about you that's tied to your name and e-mail address. With this information the intruders could carry out spear phishing attacks. This means they could specifically target an attack designed just for you. So, if you start getting e-mails from companies that use, or used, Epsilon start scrutinizing them. If it seems odd to you contact the company, but don't use the information contained in the e-mail. This breach I hope is a wakeup call for companies that collect information about a person. This information should be segregated, if it isn't in order to make it more secure. Either that or have the data well encrypted.

This is just a little theory of mine and there hasn't been any hardcore evidence that points to Epsilon having more than just customer names and e-mails stolen. The possibility is there though and only time will tell.

Out of curiosity, for those still hanging with me, did you A) receive notification by an Epsilon client notifying you about the breach? B) Did you receive any (spear) phishing e-mails from companies affected by the breach and C) do you think Epsilon is lying or not about the information that was stolen? What's your evidence? Post your thoughts in the comment section.

That pretty much wraps this post up. If you found this interesting or informative please share, follow, bookmark and subscribe.

Thanks for stopping by and I'll see you all next post.

Old School Scam Hits Banks

2011-04-02T21:14:00.000-04:00

In an article from Bankinfosecurity.com an old, low tech, cash advance fraud hit several bank until a teller managed to figure out what was going on. This leads me to a question that I'm curious and maybe someone out there has an answer. Ok. Here it goes. As technology advances do you think scammers, ID thieves and the usual suspects will resort to old school tricks of the trade to beat the banks, or do you think that technology has closed those gaps? Post your thoughts in the comment section and don't forget to bookmark, subscribe and follow!

See you all next post

Rebecca Black - Friday [Cough Syrup Remix] - DrSuperSparkle

2011-03-25T17:52:00.001-04:00

So it's Friday and that must mean everybody in the world is posting something Rebecca Black related. The other day I jumped on the bandwagon and did a post on her and the argument that she was being cyber-bullied. In that post, I included the death metal version of the song, which, up to that point was my favorite, but now I have a new one. It's a glitch-hop version by DrSuperSparkle and I just can't stop listening to it. The beat not only makes my head nod, but my neck is on the verge of snapping off. The video is also glitched out to make the whole experience super fucked up in a good way.

"Friday - Rebecca Black - Cough Syrup Remix by DrSuperSparkle" (DrSuperSparkle) / CC BY-NC 3.0

What do you all think about this one? Post your comments in the...err..comment section.

If you dig this, click one of the share buttons below and also show DrSuperSparkle some loving at http://soundcloud.com/drsupersparkle

Van Eck Phreaking

2011-03-25T00:04:00.000-04:00

Ever since I learned about Van Eck phreaking last year in school, it makes me wish I had a background in electrical engineering because it's really neat. While the concept has been around for decades, it's still very interesting. For those who don't know what it is, the short answer is that with the proper equipment you can pick up the electromagnetic radiation coming from someone's monitor and see what they're seeing. Below is an old, yet interesting clip from a show called Screensavers where they get into Van Eck Phreaking.

Feel free to pass this around and don't forget to subscribe, follow, and bookmark.

See you all next post.

Rebecca Black and Cyber-bullying?

2011-03-21T23:57:00.000-04:00

So, I'm torn about the argument for Rebecca Black's song "Friday." People are saying that she is being cyber bullied, while others argue that she's released a work that's open to critique and negative comments are to be expected. I have to admit that the song is one of the worst I've heard in a while, but where is the distinction between scathing criticism and that of being cyberbullied. I would like to know what you all think. What is the point where you say it's cyber-bullying? Post your thoughts in the comment section.

Here's a link to the original and below is one of my favorite parodies:

It's sure been a long while and I could sure use a beer.

2011-03-20T01:15:00.001-04:00

Hello everyone. It feels like I've been away for forever. The truth of the matter is that I've been super busy getting my learn on. I've been drowning in a sea of text and papers that seems like there's no end in sight. Now that I have a chance for a tiny little breather I just wanted to let you all know that I'm still breathing over here. Over the next week, I'll attempt to squeeze in a post or two. If anyone reading this has any topics they would like me to cover or things they'd like to learn about in the world of information security, or fraud, pop them in the comment section.

Well, I'm going to wrap this one up. For the beer drinkers out there, what's your favorite? Post them in the comment section as well.

I'll see you all next post.

Time For A Rant About Sony

2011-02-06T14:54:00.000-05:00

Image via Wikipedia

So, the other day I went over to see what was interesting at Rootsecure.net and came across an article from cnet about Sony allegedly adding a rootkit to the PS3. The rootkit could be potentially used to search your system files and look for modifications that you made to your system. To read the entire article, click here.

OK, first off, I don't own a gaming system, so I don't know the ins and outs of their capabilities, but here's what has me fired up.

If what is being said is true that Sony has installed a rootkit on the PS3 to look for user modifications, they are wrong to do so. It's one thing to to reverse engineer a companies product, duplicate the findings and then sell it as your own, or use what you find to disrupt other systems, etc. That sort of thinking makes perfectly good sense to me. What's killing me is, from what I can gather in the article, is that people are modding their PS3's to work in ways Sony never intended. So, if I went and bought a PS3 and changed it to run better, or have it do something that it shouldn't be capable of doing, Sony could sue me for violating the Digital Millennium Copyright Act, as the cnet article says. I say, if you purchase a gaming system, or computer, or anything that you can modify to improve, or make better, then I think you should go ahead and do it. So, what's next? Is Ford going to say that because you took out the old engine from one of their cars and put a different and better one in, that they're going to sue you for improving the performance of your vehicle? To me that's what it's starting to feel like with corporations these days. That they're stifling creativity, innovation and progress all because of preserving their profits. I'm not saying all companies are like this, it's just those like Sony who are not seeking mutually beneficial ways to solve issues.

What do you have to say about this? Pop your thoughts in the comment section.

If you found this post interesting then follow and subscribe to Decode Transmission. Don't forget to share and bookmark too.

I'll see you all next post.

Hey! It's a Book Review: The Girl Who Kicked the Hornet's Nest

2011-01-23T22:03:00.000-05:00

Cover of The Girl Who Kicked the Hornet's Nest

I just finished reading The Girl Who Kicked the Hornet's Nest which is the last installment of Stieg Larsson's Millennium trilogy about journalist Mikael Blomkvist and troubled hacker Lisbeth Salander.

The novel picks up right where The Girl Who Played With Fire left off with Lisbeth in critical condition at a hospital. With Salander charged with attempted murder, Blomkvist, along with the staff at the magazine Millennium and some police officers who have their doubts, they try to dig up what really happened. They discover a conspiracy that reaches the darkest corners of the Swedish government. The question is how do they make the connections to prove Lisbeth's innocence?

I have to admit that I enjoyed this novel much more the The Girl With the Dragon Tattoo and The Girl Who Played With Fire. It was more intriguing to me because there's much more interesting stuff in the lines of hacking and espionage happening in this novel. There was also more suspenseful moments in this novel, but like the first two books, everything starts off with a slow build, but by the time you're about halfway through, the pace really picks up. It's intelligently written and completely breaks the mold of suspense thrillers. I also think Larsson has created my favorite villain, Dr. Teleborian. He's one sick psychiatrist who's hellbent on having Salander committed.

Very good read, but you need to pick up the other two novels in order to understand what's going on.

That wraps this post up. I'll see you all later.

10 Questions (plus a couple extra) With Don Douglass: Got Mods?

2011-01-17T00:22:00.001-05:00

Courtesy of Don Douglas/Daredevil Modz

I met Don Douglass through miio.com, a fledgling social network, over the summer and the both of us hit it off. I decided to talk to him about modding because it's something I'm not familiar with. I hope you all find this interesting, as we also discussed inspirations for projects, Mark Twain and of course security related stuff.

1. So, what's the scoop on Don Douglass? Tell us a little about yourself.

Well I got into computers when I was a kid. My parents bought me a Commodore 64SX when I was in 6^th grade or so. They couldn’t afford to buy me a modem or any software to go with it so I was stuck teaching myself how to program Basic. I really can’t say that was a thrilling moment in my life but I did get bit with the computer bug

It wasn’t until 1998 that I bought my first PC. That is when I learned you could upgrade hardware yourself with a few jumper settings and some rather expensive upgrades. I taught myself how to tweak Windows and did the best I could with what I had to make the PC go faster and run smoother. Always in the back of my mind I kept thinking how much I hated Beige! ’98 was the year I started helping other people with their computer problems as well. I think that helped out my learning curve a lot but you have to remember. I had very few resources to learn from then so 99% of what I did was trial and error.

In 2000 I built my first PC from the ground up. I added LED fans, RAID, and whatever else I could get my hands on. Back then modding a PC was adding a fan where there wasn’t a hole to put one and painting your case a different color then Beige. Maybe installing a Plexiglas window in the side or something. This was around the time that I started getting into Linux too but that’s a different story.

Now a days when I am not busy with my family I help friends with simple mods or general computer help. Then I find time to work on Daredevil.Modz, Writing Zeros and my build log blog, The Hive.

I started Daredevil.Modz with a good friend of mine as a way to show some of the projects that we had worked on as well as support the Modding Community. After all there are MANY other modders and builders out there that we look up to and admire their work. DDM was to feature Hardware related stuff while Writing Zeros headed up the Software, Internet, and Security stuff. Now both blogs cover some Gaming News also.

I started doing reviews and posting tech news as a “filler” in between projects and a way for me to keep up on things too. But I still want to build PC rigs and have fun modding. I rather get my hands busy and dirty then sit behind a desk. It’s always a money and time factor that dictates what gets done and when.

2. I'm not very familiar with modding, and as far as overclocking goes I have no idea. Could you shed some light on both topics as to what they are and how did you fall into doing this stuff?

Modding and Overclocking is at the root essentially the same thing. Breaking your warrantee! PC modding is only one type of modding. You can mod video games or any piece of hardware on the planet. Both are really for enthusiast and people who are performance hounds.

I like to think PC modding as something a Hot Rodder would do to his car. In a nutshell you are changing the outward appearance and/or improving the overall performance of your PC. Just as a Hot Rodder would do to his ’32 Ford. Strip and paint the chassis and panels. Cut vents or blow holes to improve airflow. Add LEDs or Cold Cathodes for some glowing effects. Etch a side panel or install a window. Even water cooling your CPU, and GPUs. In then end you can go from an everyday PC to a highly polished Trailer Queen that you take to LAN parties to show off. All this leads up to Overclocking.

Overclocking is great for taking a cheaper CPU or GPU and bumping up the voltage and other specs to make it perform at higher clock speeds like a much more expensive part. That was the whole deal with it in the first place. To take what you had a try to get more life, and performance out of an old outdated CPU.

Nowadays it has evolved into so much more. World records and big money prizes are abound for getting the highest recorded, and stable, CPU Overclock. Me personally, I Overclock just to extend the life of a CPU and help my rig. Period. Someday when I have more expendable income again I won’t worry about toasting some hardware to shoot for a world record.

3. What skills does someone need get into modding and for a person trying it out for the very first time, what advices do you have for them?

Well if you can use paint cans, use a power tool like a Dremel and a Drill, read a ruler, then you can do the simplest of mods. Like I mentioned before most of the modding done is either for looks or performance. Just make sure you have some time on hand and you can do without the PC for a period of time.

From there it only gets as complicated as you want it to. Having an artistic flare helps too. There is too much to cover here in one conversation but it is really to the limit of your imagination that will determine your skill set limits. Don’t forget that you can farm out a lot of work you don’t know how to do as well if you don’t feel comfortable painting or wiring up a custom LED scheme. I have a section on my new blog, The Hive that covers a fair amount of DIY projects you can do at home with little to no experience.

Just start small with a PC case you won’t be upset about screwing up on. Just grab an old Dell for example. Rip the guts out of it. Map out what you would like to do. Do a mockup with cardboard if you need to. And get to work. Start with a blow hole or two and go from there. Just be patient and take your time.

4. Are there any resources (websites, shows, tutorials, books) you can direct people to that will help them out?

Oh man where isn’t a resource?!? YouTube is where I got a big taste of PC modding and scratch builds from all around the world. Here is my short list:

MNPCTECH is my number one place to go for tutorials from painting to installing a window.

MonsterMawd Channel on YT is from the same guy, Bill Owen. Tutorials up the wazoo!

www.milliondollarpc.com for jaw dropping inspiration.

LAZYMAN’S YT Channel!!! A must see for newbie modders!!! Just search Westcoast Mods

Google Pc Modding and you will get an eye full of what people are doing from around the world.

Lastly. Be a member of a website like Modnation, The ModBrothers, Modders Inc., or even other sites geared more towards Overclocking, and join in their Forums. You will learn and meet a lot of great people who are more than willing to help you mod you own rig.

Don’t forget The Ben Heck Show on Revision 3 and element14. Talk about super talented and smart modding for gaming consoles.

If you are looking for that extra cool fan or fan controller then head to www.performance-pcs.com or www.crazypc.com and shop around.

5. How do you get your ideas for mods you may do?

I like to look at what the top modders are doing. That is 90% of my inspiration really. The other 10% is me trying to do something different then what I tried the last time. Also look at the world around you. Cars, planes, industrial and commercial design, Sci fi movies are a huge inspiration to try and mimic.

Right now I am focused on getting Project Zero going. The main thing is to pick out what you want to do and see it through to the end. I have always wanted to try some nickel plating and laser etching. Out sourced, of course. Mostly I have a strong desire to build a quite cool running rig that I can stand to have on the desk that I can show off to everyone. This build is out of necessity but I don’t want the ordinary. So it won’t be a heavily modded machine but it will be a more old school with some modern touches.

6. Of the projects that you have done, which one are you most proud of?

My Zero rig will be my first “Public Mod”. Everything else I have done has been for friends and family. Honestly I never thought of taking pictures and sharing what I have done until last year. Mostly because I never did a full case mod before. In the end if they were happy, I was happy. That is all that I ever cared about. I never want to hear someone is not happy with the work I have done for them. It is bad enough I am already my own worst critic.

7. What's one tool you can't leave home without when working on a mod?

Hmmmmmmmmmmm…….. Good question! It depends on what needs to be done really but I would have to say a Dremel.

8. Any movies inspire you to say "Yeah that would be a pretty cool project to do?" If so, what were they?

Like I said before Sci-Fi movies are the best! Star Wars, Star Trek, Alien, anything high tech and out in space is awesome! I would love to build an all-in-one desk PC like the on the villain had in The Incredibles. I know it is a Pixar movie but that’s a great idea! Very cool.

9. When it comes to music, what artist is a guilty pleasure of yours to listen to?

That depends on my mood that day or task at hand. I love the Blues and Jazz if I am trying to focus on something or planning something out. If I have my sleeves rolled up then there is a good chance Motorhead will be blasting or some Metal band just to keep my work flow going forward.

10. In the news recently there's been a debate on removing and replacing the "N" word as well as "injun" in Mark Twain's Huckleberry Finn. What's your opinion on altering works of important authors?

I will try to be as blunt and as over opinionated as possible answering this question. If you don’t like it, don’t read it! People are so worried about being offended these days it makes me sick. Everyone wants to erase history just to satisfy them, like it never happened. Well it still happened! Can’t anyone man-up anymore and let it be? Mark Twain wrote in the vernacular of his time or the language of the time period of the story that was written in. Suck it up and leave it alone!

11. Time for the information security and fraud question. What has been the most eye opening thing for you that you may have either read about or personally experienced?

Many years ago someone figured out how to buy something off of eBay with my account. Thankfully eBay asked me if I bought an Xbox, which I didn’t of course.

That was an eye opener for me. Now whether or not the individual was a Computer Hacker or it was just me not paying attention to the little punks going in and out of my place at the time as to be determined. It did teach me to rethink how I used my PC at home and made me more aware of what was on my PC as well.

Mostly it came down to me. I changed my habits online for one thing. That made a huge difference in my life. I can honestly say my PC has been virus free for 8 years all because I changed my surfing habits. Secondly I learned what was in my computer and made sure that I always knew what was in there. I am definitely more aware since then.

Lastly I don’t let anyone us my User account on my PC. Ever!

12. Where can people learn more about you, what you do and how can they get in touch?

Just log on to www.daredevil-modz.blogspot.com or www.writingzeros.blogspot.com and look for the Contact info, or DaredevilModz on Miio and Twitter, or Daredevil.Modz on Facebook.

I would like to thank Don for taking the time to for the interview. Definitely stop on over to Daredevil Modz and say hello.

Decode Transmission

Sony Pictures Hack: The North Korea Connection, or Lack Thereof

Sony Pictures Hack: The FBI Investigation

Sony Pictures Hack: The Malware

Sony Pictures: Timeline of the 2014 hack

What about Competition? The Case of AT&T vs the US Justice Department

Who Really Owns Your Mortgage?

What I'm Currently Listening To: end.user "Keep Telling"

What you Might Not Know About Your Copying Machine.

Playing around with iNudge

Here is the link to the application: http://www.inudge.net/

Play around with iNudge and I would love to hear what you think as well as what your tips and tricks are. Post them in the comment section.

Related articles

What I'm Currently Listening To: Defeated Sanity "Chapters of Repugnance"

Why Should you Care About the Cloud?

Related articles

Hey! It's a Movie Review: Super 8

Possible Fraud Incitement For Goldman Sachs in the near Future?

Related articles

Harold Camping Should be Charged With Fraud At the Very Least

Tales From the Hacked: Sony PS3 Data Breach Debacle

Related articles

Is There a Rotten Apple Amongst Us?

The Epsilon Data Breach and Unica an IBM Company

Epsilon reads for your brain

Old School Scam Hits Banks

Related articles

Rebecca Black - Friday [Cough Syrup Remix] - DrSuperSparkle

Van Eck Phreaking

Related articles

Rebecca Black and Cyber-bullying?

Related articles

It's sure been a long while and I could sure use a beer.

Time For A Rant About Sony

Hey! It's a Book Review: The Girl Who Kicked the Hornet's Nest

10 Questions (plus a couple extra) With Don Douglass: Got Mods?