Control-Alt-Hack is a tremendously fun, hacker-themed strategy card game that uses the mechanic of the classic Steve Jackson Ninja Burger game. It comes out of the University of Washington Computer Security and Privacy Research Lab, and features extremely entertaining and funny computer-security-themed scenarios, buffs, attacks and characters.
The gameplay is very well-thought-through (here's a PDF of the rules). Three of us sat down to play it this weekend with only a cursory glance at the rules beforehand. By following the quickstart instructions, we were able to jump straight into play, and within a few turns, we really had the rhythm and were busily sabotaging one another and cursing at the dice when they rolled against our favor.
Based on my play session, I'm really impressed. Though one player led the game early on, there were several reversals, wherein the leading and trailing players traded places -- always the mark of a great game. There was a good mix of skill, strategy and luck, and things were just complicated enough that it absorbed our full attention, without lagging or flagging.
A full game takes about an hour, and between three and six people can play at once. We played it after Sunday brunch and it was a great digestive aid. All three of us loved the geeky, info-sec-y references, the funny scenarios (everything from devising a cryptographic protocol for implanted medical devices to pranking a labmate with a gag WiFi keystroke-inserter), and the grace-notes (like a scenario that is encoded as a cryptogram). There were moments of unlikely hail-mary-heroism, crushing defeat, and lots of laughs. We'll play this one again.
Control-Alt-Hack: White Hat Hacking for Fun and Profit
Control-Alt-Hack [Publisher's site]
Brian Krebs reports on the takedown of the command-and-control servers for Rustock, the largest and most successful spam botnet. The botnet's output has fallen from thousands of spams per second to one or two spams per second:
It may yet be too soon to celebrate the takedown of the world's largest spam botnet. For one thing, PCs that were infected with Rustock prior to this action remain infected, only they are now somewhat lost, like sheep without a shepherd. In previous takedowns, such as those executed against the Srizbi botnet, the botmasters have been able to regain control over their herds of infected PCs using a complex algorithm built into the malware that generates a random but unique Web site domain name that the bots would be instructed to check for new instructions and software updates from its authors. Using such a system, the botmaster needs only to register one of these Web site names in order to resume sending updates to and controlling the herd of infected computers.
Rustock Botnet Flatlined, Spam Volumes Plummet
Stewart said that whoever is responsible for this takedown clearly has done their homework, and that the backup domains hard-coded into Rustock appear to also have been taken offline. But, he said, Rustock also appears to have a mechanism for randomly generating and seeking out new Web site names that could be registered by the botmaster to regain control over the pool of still-infected PCs. Stewart said Rustock-infected machines routinely reach out to a variety of popular Web sites, such as Wikipedia, Mozilla, Slashdot, MSN and others, and that it is possible that Rustock may be configured to use the news headlines or other topical information from these sites as the random seed for generating new command and control domains.
(Image: Spam wall, a Creative Commons Attribution Share-Alike (2.0) image from 63056612@N00's photostream)
I am delighted to welcome author and journalist Joseph Menn (web / Twitter / Facebook) to Boing Boing as guestblogger. His most recent book, Fatal System Error: The Hunt for the New Crime Lords Who are Bringing Down the Internet, was published this January in the US and comes out today in an updated paperback form.
From his bio:
Menn has spoken at major security conferences including RSA, Black Hat DC and DefCon on his findings, which include hard evidence that the governments of Russia and China are protecting and directing the behavior of some of the world's worst cyber-criminals. He also has given invited talks at meetings convened by the US Secret Service and Federal Deposit Insurance Corp.
"Fatal System Error accurately reveals the secretive global cyber cartels and their hidden multibillion-dollar business, proving cybercrime does pay and pays well," said Richard A. Clarke, special advisor to President George W. Bush for cyber security. The New Yorker magazine said it was "riveted" by the tale, comparing it to the novels of Stieg Larsson, while Business Week called it "a fascinating high-tech whodunit." Fatal System Error has been placed on the official reading list of the US Strategic Command and is being translated into Chinese, Japanese and Korean.
Menn has reported on technology for more than a decade at the Financial Times and the Los Angeles Times, mostly from his current base in San Francisco. His coverage areas for the FT include technology security and privacy, digital media, and Apple and the PC industry.
Read the rest
Your office's high-end photocopier probably has a hard-drive used to store copies of documents that are scanned from the glass. Harvesting scanned documents from discarded office copiers (often returned at the end of a lease) yields a treasure-trove of fascinating corporate secrets.
Of the dozens of multi-purpose copiers Beitner has cleaned out in the past two years, he has seen hundreds of scanned documents that would be considered confidential. As a personal policy, he never reads them, but can easily tell where they are by the file names and sizes.
High-tech copy machines a gold mine for data thieves
"In almost all the machines I have seen, the files, phone numbers, fax numbers and email addresses are left there as if it was still in the office," said Beitner. "There are files from insurance companies, medical facilities, pharmaceutical and regular office-type documents," he said...
And, as a few Google searches will show you, you don't even need to leave the comfort of your home. The activity of photocopiers linked to an unsecure network can be seen and tracked online. With a few clicks of a mouse, and no knowledge of how to hack, we could see the latest activity of a photocopier in Korea, which included copies of invoices and employee expenses.
(Image: keypad photocopier, a Creative Commons Attribution image from Mr Thinktank's photostream)
"Understanding scam victims: seven principles for systems security" by Cambridge University's Frank Stajano and Paul Wilson is an excellent look at the principles involved in "short cons" (confidence games that only take a few minutes to "play") and how they can be applied to information security. The authors examine the mechanics of scams demonstrated in the BBC show "The Real Hustle" and then extract the principles that drive them and show how they are also used in online ripoffs:
Understanding scam victims: seven principles for systems security
This illustrates something important. Many people feel that they are wise to certain scams or take
steps to protect their property; but, often, these steps don't go far enough. A con artist can easily answer
people's concerns or provide all sorts of proof to put minds at ease. In order to protect oneself, it's
essential to remove all possibility of compromise. There's no point parking your own car if you then
give the valet your keys. Despite this, the mark felt more secure when, in actual fact, he had made the
hustler's job easier....
...Much of systems security boils down to "allowing certain principals to perform certain actions on
the system while disallowing anyone else from doing them"; as such, it relies implicitly on some form
of authentication--recognizing which principals should be authorized and which ones shouldn't. The
lesson for the security engineer is that the security of the whole system often relies on the users also
performing some authentication, and that they may be deceived too, in ways that are qualitatively differ-
ent from those in which computer systems can be deceived. In online banking, for example, the role of
verifier is not just for the web site (which clearly must authenticate its customers): to some extent, the
customers themselves should also authenticate the web site before entering their credentials, otherwise
they might be phished. However it is not enough just to make it "technically possible"18 : it must also be
humanly doable by non-techies. How many banking customers check (or even understand the meaning
of) the https padlock?19