Risk. Intelligence.

The PAN you are calling is busy, please hold

2011-02-17T13:27:00.001Z

I read with interest that several mobile telecoms companies are applying for money broker licenses, and I hear that a couple of them are planning to expand their "value-add" payment services to include more and more
off-network products.

As we know, there are lots of premium rate services available, used for telephone phone-ins (for example premium rate support, or tv shows), specific content (for those of you who play Mafia Wars on Facebook, you know what I am referring to), and more. Some of these are paid for by calling a premium rate number, others are paid for by receving texts from a premium rate line. Phone companies quite like the money from these services, but don't like the fact that there is an extremely high rate of chargebacks, customer complaints, and so on. Regulation of all this premium rate stuff is performed by PhonepayPlus, formerly known as ICSTIS.

In recent years, mobile telcos have tried to get away from the idea of this billing method, and are moving to services such as Pay4it - this tries to make a bit more sense of it all by putting charges on your phone bill as discrete items, rather than a sequence of rather high-priced text messages.

Now apparently an idea has been floated around that instead of using my VISA card to pay for a purchase at say, Amazon, I can use my mobile phone. Sounds good, I just enter my mobile phone number and respond "yes" to the confirmation message and my latest XBOX game is winging its way to me.

But.

There are two tensions at work here. For my phone number to be useful, I want as many people as possible to know it and if they need to call me, they can (its at the top of the page, for example). For a payment purchase, I would like to give my card number to the merchant, and then for them to forget it (or at least, store a token that is not recoverable but that they can use next time I want to make a purchase). In fact, PCI DSS is all about making sure that merchants don't just chuck card numbers into a database.

How will phone companies handle chargebacks? How will they control the use of a phone number when effectively, anyone can have it? What happens when scammers just pick phone numbers that are unallocated (as they do right now with premium rate text fraud)?

I watch... with interest.

He said Captain! I said wot

2011-02-17T12:47:00.001Z

I have been rolling up a new log management service recently and in addition to spotting attacks on my machines dotted around the internet (and even at home), it has sent me some bad news from my laptop:

Received From: (samurai) x.y.z.10->WinEvtLog

Rule: 18154 fired (level 10) -> "Multiple Windows error events."

Portion of the log(s):

WinEvtLog: System: ERROR(36888): Schannel: SYSTEM: NT AUTHORITY: Samurai: The following fatal alert was generated: 10. The internal error state is 10.  

WinEvtLog: System: ERROR(36888): Schannel: SYSTEM: NT AUTHORITY: Samurai: The following fatal alert was generated: 10. The internal error state is 10.  

WinEvtLog: System: ERROR(11): Disk: (no user): no domain: Samurai: The driver detected a controller error on \Device\Harddisk3\DR3.  

WinEvtLog: System: ERROR(11): Disk: (no user): no domain: Samurai: The driver detected a controller error on \Device\Harddisk2\DR2.  

WinEvtLog: System: ERROR(11): Disk: (no user): no domain: Samurai: The driver detected a controller error on \Device\Harddisk1\DR1.  

WinEvtLog: System: ERROR(11): Disk: (no user): no domain: Samurai: The driver detected a controller error on \Device\Harddisk5\DR5.  

WinEvtLog: System: ERROR(11): Disk: (no user): no domain: Samurai: The driver detected a controller error on \Device\Harddisk4\DR4.  

Good logging is no longer a nice to have, its an essential. Mind you, looking at this, so is a new laptop.

One of the nice things....

2011-02-01T01:58:00.000Z

The Security geek community is a widespread one, and I've not talked with Vaughn Cordero, the author of the frankly awesome Mobile Sync Browser before. If you are trying to recover data from a bust iPhone backup, this is probably the only thing you need.

Vaughn is a thoroughly nice guy, and when he got my email out of the blue asking a forensic question, he responded as follows:

I usually have a look-see at individuals before dispensing these licenses, but anyone who listens to ELO can't be half-bad, right? :)

Many thanks for your help, this one's for you.

Google, let me PGP my emails please

2011-01-31T09:49:00.000Z

I use Google Apps quite a bit. It works for most things pretty seamlessly, and allows me to get a nearly-as-good-as-exchange workgroup using GASMO (Google App Sync for Microsoft Outlook). It also syncs nicely with my iPhone, and in general takes the hassle out of dealing with 100's of emails a day that come in. They even provide a nice Python-in-the-cloud service using the Google App engine. Since Lacunae is a no-servers organisation, this is all handy and appreciated.

But.

It doesn't support PGP desktop.

Let me repeat that again. It doesn't support PGP on the desktop.

Now we all know how important PGP is, it is one of the only ways one can not only assure that unfriendly eyes are not reading your emails by encrypting it, but by signing your emails you can prove that you sent a particular version of an email (or not), and that no one else did. There are services like HushMail that will provide this a a web/cloud/somewhere-over-there service. But there's nothing like from-the-desktop assurance.

Conspiracy theorists may shout that Google wants to be able to index and spider your email. Grumblers will point out how this shows that Google is "not ready for the enterprise". Naysayers will say Nay.

C'mon Google, get into the 90's. Let me secure my email, please!

Bulgarian update - CryptoRights we need you

2011-01-17T18:59:00.001Z

After my previous post on this topic, I received the following update:

See

http://www.microsofttranslator.com/bv.aspx?&lo=TB&from=&to=en&a=http%3A%2F%2Fwww.dnevnik.bg%2Ftehnologii%2F2011%2F01%2F17%2F1026425_ekspertut_po_it_sigurnost_dancho_danchev_e_nastanen_v%2F

This translates (roughly) and it apppears that Dancho Danchev is in a psychiatric hospital. I hope he gets well, the cynic in me notes that its extremely difficult to remove someone from such a place, and all that's usually needed to get one interred is the signature of a doctor.

Title: IT security expert Dancho Danchev is placed in a psychiatric hospital

Source: Hacker News

Date Published: 17th January 2011

Excerpt:

'.... According to bulgarian newspaper Dnevnik

(http://www.dnevnik.bg/tehnologii/2011/01/17/1026425_ekspertut_po_it_sigurnost_dancho_danchev_e_nastanen_v/)

IT security expert Dancho Danchev is placed in a psychiatric hospital.

Dancho Danchev, an expert on cybersecurity, is placed in a psychiatric hospital in Bulgaria. The information was confirmed by two sources of "Dnevnik", although from the hospital refused comment......'

To read the complete article see:

http://news.ycombinator.com/item?id=2112135

The erstwhile CryptoRights foundation had the motto "Security for Human Rights workers and Human Rights for Security Workers".

DDT, we need you back!

Putting the word out

2011-01-15T17:21:00.000Z

Courtesy of Dragon News Bytes. Computer crime appears to have not only real criminals but also state sponsorship. Research is risky business these days.

Title: We need help with the strange disappearance of Dancho Danchev

Author: Ryan Naraine

Source: ZDNet

Date Published: 14th January 2011

Excerpt:

'....Zero Day blogger and malware researcher Dancho Danchev (right) has gone missing since August last year and we have some troubling information that suggests he may have been harmed in his native Bulgaria.

Dancho, who was relentless in his pursuit of cyber-criminals, last blogged here on August 18. His personal blog has not been updated since September 11, 2010.

At ZDNet, we made multiple attempts to contact him, to no avail.

Telephone numbers are going to Bulgarian language voicemails and our attempts to reach him via a snail mail address also came up empty.

Over the last few months, we have contacted the Bulgarian CERT authorities and used anti-virus contacts there to help us figure out Dancho’s disappearance. No one can figure out what happened to Dancho......'

To read the complete article see:

http://www.zdnet.com/blog/security/we-need-help-with-the-strange-disappearance-of-dancho-danchev/7897

My SSH Key

2011-01-15T16:49:00.000Z

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAnXCoxQvyGhyTb/cr87RI7LFlkFez6MiRDNR60BL7h0w4ytCjs/fs9G5l/PiUoLL1d/yKfxQcQ6llGp1K+HO8hsF5egRWY2nvU7UmdGLHR8W6DY2S4wNltmqrkW48LSmctN+J4kjMzM27QM0y/RlHkkEGhb6lxKsCO2zthjbkHRM= rsa-key-20101208

Our favourite korean

2011-01-14T14:32:00.000Z

So one day I noticed a couple of things on my log summary:

--------------------- pam_unix Begin ------------------------

sshd:

Authentication Failures:

root (58.180.53.51): 145 Time(s)

unknown (58.180.53.51): 3 Time(s)
Invalid Users:

Unknown Account: 10 Time(s)

---------------------- pam_unix End -------------------------

--------------------- SSHD Begin ------------------------

Failed logins from:

58.180.53.51: 148 times

Illegal users from:

58.180.53.51: 3 times

---------------------- SSHD End -------------------------

#Querying server whois.geektools.com:43 (58.180.53.51)

GeekTools Whois Proxy v5.0.5 Ready.

Final results obtained from whois.apnic.net.

Results:

% [whois.apnic.net node-2]

% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 58.180.0.0 - 58.180.255.255

netname: SHINBIRO

descr: ONSE Telecom Co.

descr: 192-2, Kumi-dong, Bundang-ku, Sungnam-si, Seoul, 100-192

descr: ************************************************

descr: Allocated to KRNIC Member.

descr: If you would like to find assignment

descr: information in detail please refer to

descr: the KRNIC Whois Database at:

descr: "http://whois.nic.or.kr/english/index.html"

descr: ************************************************

country: KR

admin-c: IM268-AP

tech-c: IM268-AP

remarks: www.shinbiro.co.kr

status: ALLOCATED PORTABLE

mnt-by: MNT-KRNIC-AP

mnt-lower: MNT-KRNIC-AP

changed: hm-changed@apnic.net 20050615

source: APNIC

person: IP Manager

nic-hdl: IM268-AP

e-mail: onse-ip@matrix.shinbiro.com

address: 192-2, Kumi-dong, Bundang-ku, Sungnam-si, Seoul, 142-075

phone: +82-31-738-6421

fax-no: +82-31-738-6430

country: KR

changed: hostmaster@nida.or.kr 20050614

mnt-by: MNT-KRNIC-AP

source: APNIC

inetnum: 58.180.0.0 - 58.180.255.255

netname: SHINBIRO-KR

descr: ONSE Telecom

country: KR

admin-c: IA10-KR

tech-c: IM10-KR

status: ALLOCATED PORTABLE

mnt-by: MNT-KRNIC-AP

remarks: This information has been partially mirrored by APNIC from

remarks: KRNIC. To obtain more specific information, please use the

remarks: KRNIC whois server at whois.krnic.net.

changed: hostmaster@nic.or.kr

source: KRNIC

$ nmap 58.180.53.51

Starting Nmap 5.21 ( http://nmap.org ) at 2011-01-14 14:09 GMT

Nmap scan report for 58.180.53.51

Host is up (0.36s latency).

Not shown: 992 closed ports

PORT STATE SERVICE

22/tcp open ssh

111/tcp open rpcbind

135/tcp filtered msrpc

139/tcp filtered netbios-ssn

445/tcp filtered microsoft-ds

593/tcp filtered http-rpc-epmap

3306/tcp open mysql

4444/tcp filtered krb524

Persistent, aren't you?

Follow the money! (And the PAN)

2010-10-02T16:01:00.000+01:00

Linked In is proving to be a valuable and interesting tool. I get fascinating comments in my inbox (but not on the iPhone App - why not?) from clever and insightful people. Yesterday Iain Omrod asked how his company stands when they make a sale through Amazon.

At first look you think "Hey, this is my sale, my customer is buying something from me and so Amazon are my service provider!". This is then followed by flurries of web searches that turn up articles that are wrong and then contacting Amazon to say "You're my service provider, so how's your compliance?"

Let's look a little closer at what's going on here. From a PCI perspective, one of the defining parts of a transaction is who is the merchant. If the merchant number used is yours then its you, and you are responsible for the security of the transaction in the normal PCI way. If it belongs to Amazon and they process the payment and then remit you, then as far as PCI is concerned they are the merchant, not you. You are effectively acting as a sales and fulfilment agent for Amazon and PCI DSS is not relevant to you unless you process, store or transmit a PAN.

Remember, the defining issue in PCI DSS compliance issues is always the PAN. If you don't see it, then you aren't responsible for securing it.

Reflections on trusting trust in virtual worlds

2010-09-09T21:28:00.000+01:00

It transpires that Emerald, the preferred open source viewer for the virtual world Second Life is now blocked from accessing the world of the giant talking lobster[1]. Always curious I read through a couple of message streams and observed the following:

Linden Labs are not the custodians of a democracy. They are the legal owners of fact and law to a mass of digital content hosted on servers owned and managed by them. If you think that's not the case, you're wrong
Open Source does not equal security. Most people couldn't analyse a source code tree for vulnerabilities if their lives depended upon it[2] Open Source doesn't automatically equal "good", "secure" or "free". More bells and whistles[4] just means "more stuff that fewer people will understand". Ken Ritchie first wrote about this in Reflections on Trusting Trust.
When programmers walk off a project saying "Guess what I found in this library!" then look. Do not assume just because the suspicious output is now a apparently random data (instead of nicely formatted username:password pairs, for example) that the problem has gone away. Chances are that the "Fox in the henhouse" will have just implemented a copy of the AES cryptography.
Never believe your own PR[5]
Code matters. Breaking trust by inserting spyware will end up with you not getting invited to picnics. People care about their privacy[6].
People are stupid enough to cling to beliefs in the face of overwhelming evidence. Bright people are just as likely to be stupid. You are the most likely to be stupid out of everyone you know. [7]
Linden Labs are the virtual equivalent of Disney. The mouse has no heart.
Background checks are a good, good idea even for free projects.

[1] Trust me, you want those things to be lobsters. Freudian nightmares aren't in it.
[2] Why else do you think systems have so many holes. Of course, there are some lazy programmers, but most of them just don't know how to code securely. I once reversed a very popular browser that used system("/bin/rm -f %s"); When asked why, the programmer replied that that was the most portable way[3]!
[3] ANSI Standard unlink() Tell your friends.
[4] Or in the case of emerald, virtual jiggling boobs. I kid you not. (and it makes the lobsters look tame)
[5] And by corollary, never believe anyone else's!
[6] Not enough.
[7] And you don't believe that.

Places to find interesting people #4: COSAC

2010-08-29T22:33:00.000+01:00

Over here in Europe, many conferences are dominated by vendors, which can leave one feeling a little jaded. Fortunately there is a striking alternative. COSAC, run by the security guru, guitar hero, and well-deserving-of-his-own-wikipedia page David Lynas.

This year, I'm honoured that I've been invited to speak. And even more pleased that I'll be able to listen.

If you're in the InfoSec industry, and have realised that there's more to your job than the latest vendor bling, then I'll see you there.

Society of Payment Security Professionals

2010-07-19T20:55:00.000+01:00

For about a week now I've noticed that the Society of Payment Security Professionals has lost its homepage. (see below).

Then the following post on pcianswers.com seems to indicate that its game over, insert coin for this organisation.

After nearly 4 years we have decided to end of life the PCIAnswers Blog and Forum. While there will be no further posts we will leave the existing posts available for people to access. Thanks for your support!

That's a real shame. Comments are closed there so I can't add words of support, but I guess the pressure of day jobs got too much for a bunch of great guys with good ideas.

In Europe, (as some of you reading will know) the activity in PCI DSS is mounting and we are constantly getting questions from customers as to what they need to do to be compliant. My advice follows:

Get a real QSA. There are lots of consultants offering services which are "almost as good" as the real thing. But if compliance is important to you (and if its not, ask yourself why not) then you owe it to your career, and your company to get real advice
Find one you can work with. Does your QSA just work on technical issues, or processes, or the mixture that your organisation needs to get compliant? Do they understand when to help you compromise? Do they help interface with your acquiring bank(s), service providers, developers and partners?
Are they based on real experience? At a training recently, a couple of my guys met someone who had a vocal opinion on everything - having it based on experience would help, or else you are in danger of waving. Ahem.
Do they help you run a structured programme which ensures your company ends up in a position to manage its own compliance? A simple "Yes" here should suffice - anything else, no.

PCI Compliance is not rocket science, and depending on your industry, a lot of it should be very familiar. If you are making careful plans around ICO governance or ISO27002, you may even get a lot of it as part of those programmes. But remember, its the baseline, or in other words, its a floor, not a ceiling. Being PCI compliant won't stop you getting hacked, won't prevent your employees defraudning you and won't stop your website getting in the hall of shame. It might just limit the damage and stop you being the weakest link.

Copiers contain hard drives, hard drives contain data, data is the lifeblood of your business

2010-07-18T11:36:00.000+01:00

In the News of the World today, there's an article on office copiers. These devices are getting smarter and smarter - if they made cappuchino they'd be great.

They'd also be great if they automatically deleted the information that they cache. But this is the traditional old story, do you care more about confidentiality, integrity or availability? The manufacturers have focused on availability and integrity of information, leaving their customers to manage the confidentiality issues themselves.

The morales of this story is that you are responsible for your own data. Don't leave it to the repo firm, the WEEE disposal company or the leasing shop.

And we're back!

2010-07-04T13:01:00.000+01:00

Finally! After much technical to-ing and fro-ing, we're back with a fairly stable and functional new blogging system! Hopefully it will look like the old functional one (pretty much) but keep your eyes peeled for some spiffy new features.

Lots of exciting stuff in the wings, including a breakdown of some interesting talks that have happened of late, updates to the 800lb gorilla of operational risk, PCI DSS, and the new kid on the block, the Information Commissioner's Office. (Well informed readers will tell me that ICO has been around for a lot longer than the PCI Council, but it is only recently that its got its boots on).

With the proposed cuts in UK.Gov (currently believed to be between 25% and 40% per department) there's going to be a clear call to ensure that information is safeguarded even better than before, and also that any methods used demonstrate clear cost-effectiveness. One concern we are all expecting is how to use professional advise in a concise, cost-effective manner. The best way to use consultants is to carefully define the scope of what you are asking for.

For example - should you hire a consultant to run your compliance programme for you? Well, of course the answer is it depends - consultants are great for knowledge transfer, for giving a programme initial impetus, and of course, if you identify something that you don't really care about but have to have done, then outsourcing this task makes sense - for example, most organisations get contract cleaners in.

Compliance might look like one of those hygiene must-do's, but look at the bigger picture. At some point, your consultant will have applied their awesome subject matter expertise, banged the drums, and you will be the proud possessor of a freshly inked compliance certificate (don't smudge it!)

But then what? Your choices will then be to either keep the consultant to maintain your compliance programme, or to hope that in the last days, months and years that a magical form of osmosis has happened and that you'll be able to maintain compliance and fly solo.

If you structure your compliance programme correctly, you will have your consultants advising you on the programme structure and governance, and each project will be headed up by a employee of yours, giving you the knowledge transfer "for free" - situational learning gained by transforming the non-compliant areas into a state of compliance.

Sounds easy, doesn't it.

Anatomy of a card fraud

2010-02-25T20:12:00.000Z

This one is pretty slick since they provide YOU with all the information, except the one piece they want. Note, the callers do not ask for your card number; they already have it. This information is worth reading. By understanding how the VISA & MasterCard Telephone Credit Card Scam works, you'll be better prepared to protect yourself.. One of our employees was called on Wednesday from "VISA", and I was called on Thursday from "MasterCard". The scam works like this: Person calling says, "This is (name), and I'm calling from the Security and Fraud Department at VISA. My badge number is 12460. Your card has been flagged for an unusual purchase pattern, and I'm calling to verify. This would be on your VISA card which was issued by (name of bank) did you purchase an Anti-Telemarketing Device for £497.99 from a Marketing company based in London ?" When you say "No", the caller continues with, "Then we will be issuing a credit to your account. This is a company we have been watching and the charges range from £297 to £497, just under the £500 purchase pattern that flags most cards. Before your next statement, the credit will be sent to (gives you your address), is that correct?" You say "yes". The caller continues - "I will be starting a fraud investigation. If you have any questions, you should call the 0800 number listed on the back of your card (0800-VISA) and ask for Security. You will need to refer to this Control Number. The caller then gives you a 6 digit number. "Do you need me to read it again?"

Here's the IMPORTANT part on how the scam works the caller then says, "I need to verify you are in possession of your card." He'll ask you to "turn your card over and look for some numbers." There are 7 numbers; the first 4 are part of your card number, the next 3 are the security numbers that verify you are the possessor of the card. These are the numbers you sometimes use to make Internet purchases to prove you have the card. The caller will ask you to read the 3 numbers to him. After you tell the caller the 3 numbers, he'll say, "That is correct, I just needed to verify that the card has not been lost or stolen, and that you still have your card. Do you have any other questions?" After you say, "No," the caller then thanks you and states, "Don't hesitate to call back if you do", and hangs up. You actually say very little, and they never ask for or tell you the Card number.

But after we were called on Wednesday, we called back within 20 minutes to ask a question. Are we glad we did! The REAL VISA Security Department told us it was a scam and in the last 15 minutes a new purchase of £497.99 was charged to our card. Long story - short - we made a real fraud report and closed the VISA account. VISA is reissuing us a new number. What the scammers want is the 3-digit PIN number on the back of the card. Don't give it to them. Instead, tell them you'll call VISA or MasterCard directly for verification of their conversation. The real VISA told us that they will never ask for anything on the card as they already know the information since they issued the card! If you give the scammers your 3 Digit PIN Number, you think you're receiving a credit. However, by the time you get your statement you'll see charges for purchases you didn't make, and by then it's almost too late and/or more difficult to actually file a fraud report.

What makes this more remarkable is that on Thursday, I got a call from a "Jason Richardson of MasterCard" with a word-for-word repeat of the VISA scam. This time I didn't let him finish. I hung up! We filed a police report, as instructed by VISA. The police said they are taking several of these reports daily! They also urged us to tell everybody we know that this scam is happening.

Grande Frere Regardez Vous

2010-02-07T11:55:00.006Z

So, it turns out that the EU have quietly run a project known as the Schengen Information System which can be accessed fairly widely.

The Guardian reports that

"500,000 EU computers can access private British data
Giant Schengen database holds a host of personal details that could be of use to criminal gangs
Privacy campaigners expressed shock last night after it emerged that large amounts of confidential personal information held about British citizens on a giant computer network spanning the European Union could be accessed by more than 500,000 terminals"

Information is very hard to secure. The more people know, the less likely it is to be private. There's probably a really good reason for this information to be held, and for all the various offices of the EU Government. to access it. The Guardian reports of officials in Belgium who have been selling this information - no surprise, it ends up in the hands of some very undesirable people indeed. It's entirely possible that this was a false flag recruitment.

Some countries in the EU are terribly concerned about the loss of privacy, and with good reason. The legacy of totalitarian government is a recent one, and history shows the dangers of this road.

Make a little birdhouse in your soul, folks.

We don't believe in PCI!

2009-06-16T15:00:00.003+01:00

At a conference recently, I was approached and asked what happens when one acquires a company in a european country. Is PCI really a global standard, or is it one of those things that only applies to the USA.

Well, while your newly acquired French subsidiary is crying Mais Non!, and tells you it doesn't believe in PCI, its worth remembering that PCI believes in you.

A Lawyer's analysis of PCI

2008-03-25T09:15:00.003Z

PCI-DSS - the Payment Card Industry Data Security Standard, has attracted some interesting views to it. The latest one is here. The writer describes it operating "like a court" - I don't quite agree, it operates under contract law, and I've been involved in at least one case where the issuing brand failed to have a recovery clause in the contract allowing them to seek reparation from the retailer-in-breach.

However, the interesting thing is that its not just a good idea to be compliant with PCI if you are "storing, processing or transmitting" credit card numbers. If you want to take payment with credit cards, then your bank (urged by VISA and MasterCard) will require you to sign up for PCI, with contractual caveats that any PCI breaches and costs thereof are born by .. erm, you.

In other news, my friend Branden has a spiffy blog online. Go check it out. The link is to his "All QSA's are not created equal" post, which given the legal post above, is worth considering. Not only do you get what you pay for, but selection of a high quality QSA over a bucket shop could save a hell of a lot of money in PCI reparation costs.

Sir Tim and I agree

2008-03-17T15:37:00.004Z

In a previous post, I recommended you write to your MP, cancel your phone service, and call Jeremy Vine (from someone else's phone) if your ISP started using Phorm.

Well, Sir Tim Berners-Lee says:

The creator of the web has said consumers need to be protected
against systems which can track their activity on the internet.

Sir Tim Berners-Lee told BBC News he would change his internet
provider if it introduced such a system.

Plans by leading internet providers to use Phorm, a company
which tracks web activity to create personalised adverts, have
sparked controversy.

Sir Tim said he did not want his ISP to track which websites
he visited.

"I want to know if I look up a whole lot of books about some form
of cancer that that's not going to get to my insurance company
and I'm going to find my insurance premium is going to go up by 5%
because they've figured I'm looking at those books," he said.

Sir Tim said his data and web history belonged to him.

He said: "It's mine - you can't have it. If you want to use it for
something, then you have to negotiate with me. I have to agree,
I have to understand what I'm getting in return."

Seriously folks, imagine how you'd feel if the Royal Mail said "hey, we opened your post and saw that you had a letter from the bank warning you about your overdraft, can we interest you in a low-price loan"? Or if your phone company rang you up and said "You've had a call from the hospital, would you like some low-price funeral expenses insurance?" I could hope that this will encourage more people to use encryption such as PGP, but that's not likely. People have never really understood why encyrption is important in reducing their internet footprint.

More to the point, it would be illegal. Has the law not caught up with the fact that we conduct sensitive and private communications over the Internet, not just by phone and letter?

I wonder if Sir Tim will get an invite from Phorm's PR company to a business briefing as well?

Saying no, the third way

2008-03-17T13:46:00.003Z

My favourite line in The Vicar of Dibley is:

GERALDINE: There are two answers to your question, the long one and the short one. The short answer is "No", and the long answer is "Noooooooooooooooooooooo".

I signed the petition to form a national e-crime unit recently. The gub'mint have found a Third Way:
Thank you for the e-petition, asking for the Government to give priority to the creation of an e-crime unit as proposed by the Metropolitan Police Service and ACPO.

The Government takes seriously all forms of crime, and has passed legislation to support the prosecution of those who steal data and attack IT systems, or who create the technical mechanisms to support such attacks

The Government is currently in receipt of the proposal by the Metropolitan Police Service and ACPO and are actively considering the issues it has raised and the value of creating such a unit.

Government has allocated £29 million over 3 years to implement the recommendations of the Fraud Review. This includes the creation of a National Fraud Strategic Authority (NFSA) which will drive forward a comprehensive strategy for tackling fraud, bringing together the Government, criminal justice practitioners, business and the public. It also includes a new national lead force role for the City of London Police and National Fraud Reporting Centre (NFRC) which will collect and analyse data on all types of fraud (including online fraud), equip law enforcement agencies with a powerful intelligence tool and help form the basis of better prevention advice and alerts to fraud threats for business and the public.

Both the Child Exploitation Online Protection Centre (CEOP) and the Internet Watch Foundation (IWF) have 24 hour reporting mechanisms aimed at members of the public to report instances of child abuse or websites containing child abuse images.

The National Hi Tech Crime Unit (NHTCU) was originally part of the National Crime Squad (NCS), and moved into SOCA along with the rest of NCS in 2006. The name was changed to SOCA e-crime to reflect the new organisation. SOCA e-crime has more resources than the NHCTU and greater international reach via SOCA's international liaison network. The e-crime unit brings together experts from different organisations under one roof and has already developed a national e-Crime strategy with key partners. This aims to improve links with industry and to develop ways for educating businesses and the public about e-crime.

The Government is committed to providing adequate responses to this area of crime in a unified way without duplicating the work carried out by other organisations.

There is of course the fourth way, or "Internet Dating" method of saying no, which is simply to disappear and never be heard from again. But I guess we'd miss Gordon if he did that one.

Deep into Sleep (July-August 2005)

2008-03-13T21:50:00.001Z

Deep into Sleep (July-August 2005)

What does this have to do with security?
Well, apparently we all have messed up sleep patterns (your author included), and this means our decision making skills are impaired.

Hence, security lapses.

Musing: differences between the US and the UK

2008-03-07T19:34:00.002Z

US: "If everyone is a speeder, the cops won't arrest everyone"
UK: "If everyone is a speeder, then put automated cameras to catch them"

Inspired by Cringely.

Facebook users set stupidity tests

2008-03-07T12:44:00.002Z

I see these on FaceBook:

So, for those who don't know - Alt-F4 closes your current window. Its a stupidity test, don't fall for it.

In other news, a grateful "thank you" to Gaggia, who sent me an upgraded coffee machine after I returned the first one to them, worn out. Espresso powered computer security is here once more.

Why we love PaperGhost

2008-03-07T12:38:00.000Z

Just because.

SUR in English

2008-03-07T09:03:00.000Z

SUR in English: "Having survived a complicated divorce and secured custody of the children the thought of moving to another country and reducing contact with an ex husband or wife becomes attractive. What many parents don’t realise, however, is that taking a child out of their country of origin without authorisation from their former partner violates international law."