<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Boing Boing &#187; security</title>
	<atom:link href="http://boingboing.net/tag/security/feed" rel="self" type="application/rss+xml" />
	<link>http://boingboing.net</link>
	<description>Brain candy for Happy Mutants</description>
	<lastBuildDate>Sat, 25 May 2013 23:21:12 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.4.1</generator>
		<item>
		<title>Kickstarting a detailed plan to rob five banks&#160;simultaneously</title>
		<link>http://boingboing.net/2013/05/25/kickstarting-a-detailed-plan-t.html</link>
		<comments>http://boingboing.net/2013/05/25/kickstarting-a-detailed-plan-t.html#comments</comments>
		<pubDate>Sat, 25 May 2013 15:50:11 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[art]]></category>
		<category><![CDATA[banks]]></category>
		<category><![CDATA[crime]]></category>
		<category><![CDATA[crowdfunding]]></category>
		<category><![CDATA[kickstarter]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=232434</guid>
		<description><![CDATA[<!--http://www.kickstarter.com/projects/1591139000/under-black-carpets-kickstart-a-bank-heist--><iframe frameborder="0" height="360" src="http://www.kickstarter.com/projects/1591139000/under-black-carpets-kickstart-a-bank-heist/widget/video.html" width="480" border="0" scrolling="no"></iframe>

<p>
Artist Ilona Gaynor produced a piece called "Under Black Carpets" that took the form of detailed plans for robbing five banks near LA's One Wilshire building, simultaneously. Gaynor worked with the LAPD and the FBI to produce a collection of fictional forensic evidence from these robberies, which were then exhibited.</p>]]></description>
			<content:encoded><![CDATA[
<!--http://www.kickstarter.com/projects/1591139000/under-black-carpets-kickstart-a-bank-heist--><iframe frameborder="0" height="360" src="http://www.kickstarter.com/projects/1591139000/under-black-carpets-kickstart-a-bank-heist/widget/video.html" width="480" border="0" scrolling="no"></iframe>

<P>
Artist Ilona Gaynor produced a piece called "Under Black Carpets" that took the form of detailed plans for robbing five banks near LA's One Wilshire building, simultaneously. Gaynor worked with the LAPD and the FBI to produce a collection of fictional forensic evidence from these robberies, which were then exhibited. Now, Gaynor's trying to raise &pound;20,000 to take the exhibit to tour the show. &pound;30 gets you a cool-looking book, and &pound;40 gets you the book and a tee. 

<blockquote>
<P>



WAIT, ARE YOU REALLY GOING TO ROB THESE BANKS?
<p>
No. This is strictly a design / art project.
<p>
The exhibition of the work will be presented to the audience as a police investigation, detailing the remaining evidential material after the event has taken place, something that could be argued or challenged as material (evidence) in a court of law. The work itself will take form as sculptures, architectural models, technical drawings, films and photography. It will open as a solo exhibition (Special Project)  at the Lisbon Architecture Triennale opening from Sep 12th - Dec 15th 2013.
</blockquote>


<P>
<a href="http://www.kickstarter.com/projects/1591139000/under-black-carpets-kickstart-a-bank-heist"> Under Black Carpets, kickstart a bank heist. </a>


(<i>via <a href="http://blog.wired.com/sterling/">Beyond the Beyond</a></i>)



]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/05/25/kickstarting-a-detailed-plan-t.html/feed</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Book review: information security for&#160;lawyers</title>
		<link>http://boingboing.net/2013/05/21/book-review-information-secur.html</link>
		<comments>http://boingboing.net/2013/05/21/book-review-information-secur.html#comments</comments>
		<pubDate>Tue, 21 May 2013 18:00:30 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[books]]></category>
		<category><![CDATA[law]]></category>
		<category><![CDATA[Reviews]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=231393</guid>
		<description><![CDATA[<p>
On Slashdot, a reader called benrothke reviews a book called <a href="http://www.amazon.com/exec/obidos/ASIN/1614383642/downandoutint-20">Locked Down: Information Security For Lawyers</a>. This sounds like a vital book -- my experience of lawyers (and accountants, doctors and other professions that deal with sensitive information) is that they really don't get information security, routinely transmitting potentially compromising documents in the clear as email attachments.</p>]]></description>
			<content:encoded><![CDATA[

<p>
On Slashdot, a reader called benrothke reviews a book called <a href="http://www.amazon.com/exec/obidos/ASIN/1614383642/downandoutint-20">Locked Down: Information Security For Lawyers</a>. This sounds like a vital book -- my experience of lawyers (and accountants, doctors and other professions that deal with sensitive information) is that they really don't get information security, routinely transmitting potentially compromising documents in the clear as email attachments. Not only don't they understand PGP -- they think it's good security to attach an encrypted ZIP archive to one email and follow it up with another email containing the password to decrypt it (facepalm). Anything that gets this sort of profession thinking well about security is most welcome.

<blockquote>
<p>
<a href="http://www.amazon.com/exec/obidos/ASIN/1614383642/downandoutint-20"><img src="http://boingboing.net/wp-content/uploads/2013/05/locked-down-information-security-for-lawyers2.jpg" class="bordered" align="right"></a>


The book quotes an ABA 2011 technology survey in which 21% of large law firms reported that their firm had experiences some sort of security breach, and 15% of all firms reported that they suffered a security breach. It is figures like those which show that attorneys really need to read this book and take the information to heart.
<p>
The books 17 chapters are in a readable 150 pages, with an additional 120 pages of appendices. Written in an easily understandable style and non-technical for the technologically challenge lawyer.
<p>
When it comes to the security of client data, in chapter 4 the authors write that encryption is a topic that most attorneys don't want to touch with a ten-foot pole. But it has reached a point where attorneys must understand how and when encryption should be used. Just as important, they need to know about key managements, and what good encryption is. The chapter provides a high-level detail on what needs to be done regarding encryption.
<p>
Chapter 13 is on secure disposal, is an important topic to everyone, and not just lawyers. Digital media needs to be effectively disposed of; and for many lawyers, they often think that means reformatting a hard drive or simply erasing files. The chapter effectively details the issues and offers numerous valuable hardware and software-based solutions. 
</blockquote>


<P>
<a href="http://books.slashdot.org/story/13/05/20/1313205/book-review-locked-down-information-security-for-lawyers?utm_source=rss1.0mainlinkanon&#038;utm_medium=feed"> Book Review: Locked Down: Information Security For Lawyers </a>
<p>
<a href="http://www.amazon.com/exec/obidos/ASIN/1614383642/downandoutint-20">Locked Down: Information Security For Lawyers</a> [Amazon]

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/05/21/book-review-information-secur.html/feed</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Black Code: how spies, cops and crims are making cyberspace unfit for human&#160;habitation</title>
		<link>http://boingboing.net/2013/05/18/black-code-how-spies.html</link>
		<comments>http://boingboing.net/2013/05/18/black-code-how-spies.html#comments</comments>
		<pubDate>Sat, 18 May 2013 15:15:46 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Review]]></category>
		<category><![CDATA[books]]></category>
		<category><![CDATA[canada]]></category>
		<category><![CDATA[cyberwar]]></category>
		<category><![CDATA[gift guide]]></category>
		<category><![CDATA[happy mutants]]></category>
		<category><![CDATA[lawful interception]]></category>
		<category><![CDATA[military]]></category>
		<category><![CDATA[Reviews]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[sextortion]]></category>
		<category><![CDATA[toronto]]></category>
		<category><![CDATA[war on general purpose computers]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=230976</guid>
		<description><![CDATA[<p>
<img src="http://boingboing.net/wp-content/uploads/2013/05/914o-9H61iL._SL1500_1.jpg" class="bordered"/><br />
I reviewed Ronald Diebert's new book <a href="http://www.amazon.com/exec/obidos/ASIN/0771025335/downandoutint-20">Black Code</a> in this weekend's edition of the <em>Globe and Mail</em>. Diebert runs the <a href="https://citizenlab.org/">Citizen Lab</a> at the University of Toronto and has been instrumental in several high-profile reports that outed government spying (like Chinese hackers who compromised the Dalai Lama's computer and turned it into a covert CCTV) and massive criminal hacks (like the Koobface extortion racket).</p>]]></description>
			<content:encoded><![CDATA[
<p>
<img src="http://boingboing.net/wp-content/uploads/2013/05/914o-9H61iL._SL1500_1.jpg" class="bordered"><br />
I reviewed Ronald Diebert's new book <a href="http://www.amazon.com/exec/obidos/ASIN/0771025335/downandoutint-20">Black Code</a> in this weekend's edition of the <em>Globe and Mail</em>. Diebert runs the <a href="https://citizenlab.org/">Citizen Lab</a> at the University of Toronto and has been instrumental in several high-profile reports that outed government spying (like Chinese hackers who compromised the Dalai Lama's computer and turned it into a covert CCTV) and massive criminal hacks (like the Koobface extortion racket). His book is an amazing account of how cops, spies and crooks all treat the Internet as the same kind of thing: a tool for getting information out of people without their knowledge or consent, and how they end up in a kind of emergent conspiracy to erode the net's security to further their own ends. It's an absolutely brilliant and important book:

<blockquote>
<p>
Ronald Deibert’s new book, Black Code, is a gripping and absolutely terrifying blow-by-blow account of the way that companies, governments, cops and crooks have entered into an accidental conspiracy to poison our collective digital water supply in ways small and large, treating the Internet as a way to make a quick and dirty buck or as a snoopy spy’s best friend. The book is so thoroughly disheartening for its first 14 chapters that I found myself growing impatient with it, worrying that it was a mere counsel of despair.
<p>
But the final chapter of Black Code is an incandescent call to arms demanding that states and their agents cease their depraved indifference to the unintended consequences of their online war games and join with civil society groups that work to make the networked society into a freer, better place than the world it has overwritten.
<p>
Deibert is the founder and director of The Citizen Lab, a unique institution at the University of Toronto’s Munk School of Global Affairs. It is one part X-Files hacker clubhouse, one part computer science lab and one part international relations observatory. The Citizen Lab’s researchers have scored a string of international coups: Uncovering GhostNet, the group of Chinese hackers taking over sensitive diplomatic computers around the world and eavesdropping on the private lives of governments; cracking Koobface, a group of Russian petty crooks who extorted millions from random people on the Internet, a few hundred dollars at a time; exposing another Chinese attack directed at the Tibetan government in exile and the Dalai Lama. Each of these exploits is beautifully recounted in Black Code and used to frame a larger, vivid narrative of a network that is global, vital and terribly fragile.
<p>
Yes, fragile. The value of the Internet to us as a species is incalculable, but there are plenty of parties for whom the Internet’s value increases when it is selectively broken.
</blockquote>

<P>
<a href="http://www.theglobeandmail.com/arts/books-and-media/book-reviews/how-to-make-cyberspace-safe-for-human-habitation/article11990902/"> How to make cyberspace safe for human habitation </a>
<p>
<a href="http://www.amazon.com/exec/obidos/ASIN/0771025335/downandoutint-20">Black Code: Inside the Battle for Cyberspace</a> 




]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/05/18/black-code-how-spies.html/feed</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>Denial-of-Service attacker tells Brian Krebs he&#039;s working for the&#160;FBI</title>
		<link>http://boingboing.net/2013/05/16/denial-of-service-attacker-tel.html</link>
		<comments>http://boingboing.net/2013/05/16/denial-of-service-attacker-tel.html#comments</comments>
		<pubDate>Fri, 17 May 2013 00:23:33 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[crime]]></category>
		<category><![CDATA[dos]]></category>
		<category><![CDATA[fbi]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=230653</guid>
		<description><![CDATA[<p>
Last week, I <a href="http://boingboing.net/2013/05/13/inside-the-world-of-booters.html">blogged</a> Brian Krebs's amazing piece on AsylumBooter, a cheesy denial-of-service-for-hire site apparently run by a 17-year-old Chicago-area honor-roll student named Chandler Downs, whose PayPal account was flush with more than $30,000 paid by people who'd launched more than 10,000 online attacks.</p>]]></description>
			<content:encoded><![CDATA[
<p>
Last week, I <a href="http://boingboing.net/2013/05/13/inside-the-world-of-booters.html">blogged</a> Brian Krebs's amazing piece on AsylumBooter, a cheesy denial-of-service-for-hire site apparently run by a 17-year-old Chicago-area honor-roll student named Chandler Downs, whose PayPal account was flush with more than $30,000 paid by people who'd launched more than 10,000 online attacks.
<p>
Now, Krebs has uncovered an even weirder booter story: Ragebooter is another DoS company, but this one is run by a guy who claims to be working part time for the FBI, and who says that the FBI has its own login to his site, and review all the IP addresses and other traffic data it logs. 

<blockquote>
<p>


Ragebooter.net’s registration records are hidden behind WHOIS privacy protection services. But according to a historic WHOIS lookup at domaintools.com, that veil of secrecy briefly fell away when the site was moved behind Cloudflare.com, a content distribution network that also protects sites against DDoS attacks like the ones Ragebooter and its ilk help to create (as I noted in Monday’s story, some of the biggest targets of booter services are in fact other booter services). For a brief period in Oct. 2012, the WHOIS records showed that ragebooter.net was registered by a Justin Poland in Memphis...
<p>
...

“I also work for the FBI on Tuesdays at 1pm in memphis, tn,” Poland wrote. “They allow me to continue this business and have full access. The FBI also use the site so that they can moniter [sic] the activitys [sic] of online users.. They even added a nice IP logger that logs the users IP when they login.”
<p>
When I asked Poland to provide more information that I might use to verify his claims that he was working for the FBI, the conversation turned combative, and he informed me that I wasn’t allowed to use any of the information he’d already shared with me. I replied that I hadn’t and wouldn’t agree that any of our discussion was to be off the record, and he in turn promised to sue me if I ran this story. That was more or less the end of that conversation.
</blockquote
,<p>
Poland gave Krebs the working personal number of an FBI agent identified as "Agent Lies," who put him onto the FBI's press contact, who stonewalled. Meanwhile, Ragebooter leaks a lot of info and there's some reason to believe that the FBI really does have its own back door. 
<P>
<a href="http://krebsonsecurity.com/2013/05/ragebooter-legit-ddos-service-or-fed-backdoor/?utm_source=feedburner&#038;utm_medium=feed&#038;utm_campaign=Feed%3A+KrebsOnSecurity+%28Krebs+on+Security%29">Ragebooter: ‘Legit’ DDoS Service, or Fed Backdoor?</a>

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/05/16/denial-of-service-attacker-tel.html/feed</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>Inside the world of &quot;booters&quot; -- cheesy DoS-for-hire&#160;sites</title>
		<link>http://boingboing.net/2013/05/13/inside-the-world-of-booters.html</link>
		<comments>http://boingboing.net/2013/05/13/inside-the-world-of-booters.html#comments</comments>
		<pubDate>Mon, 13 May 2013 23:10:55 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[Business]]></category>
		<category><![CDATA[christ what an asshole]]></category>
		<category><![CDATA[dos]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[videos]]></category>
		<category><![CDATA[youtube]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=229813</guid>
		<description><![CDATA[<!--http://www.youtube.com/watch?v=9odypM6OgY0--><div class="video-container"><iframe width="600" height="338" src="http://www.youtube.com/embed/9odypM6OgY0?showinfo=0" frameborder="0" allowfullscreen></iframe></div>

<p>

Brian Krebs delves into the world of "booter" services, low-level, amateurish denial-of-service websites where you can use PayPal to have your video-game enemies' computers knocked off the Internet by floods of traffic. Many booter services run off the same buggy codebase, and Krebs was apparently able to get inside the administrative interfaces for them and get some insight into their business.</p>]]></description>
			<content:encoded><![CDATA[
<!--http://www.youtube.com/watch?v=9odypM6OgY0--><div class="video-container"><iframe width="600" height="338" src="http://www.youtube.com/embed/9odypM6OgY0?showinfo=0" frameborder="0" allowfullscreen></iframe></div>

<p>

Brian Krebs delves into the world of "booter" services, low-level, amateurish denial-of-service websites where you can use PayPal to have your video-game enemies' computers knocked off the Internet by floods of traffic. Many booter services run off the same buggy codebase, and Krebs was apparently able to get inside the administrative interfaces for them and get some insight into their business. 
<p>
One such is "Asylum," which appears to be run by Chandler Downs, a 17-year-old Chicago-area honor-roll student who reportedly made $35,000 in PayPal payments in exchange for denial-of-service attacks. Asylum even has an ad (narrated by an actor hired through the casual labor exchange site Fiverr) where, for $18/month, you can launch unlimited DoSes against "skids on Xbox live." 
<p>
Young Mr Downs claimed that his service was not used to attack people, but only for legitimate stress-testing, then he changed his story and said he was only managing the service for someone else, and "You are able to block any of the 'attacks' as you say with rather basic networking knowledge. If you're unable to do such a thing you probably shouldn't be running a website in the first place."

<blockquote>
<p>


Nixon noted that all of the packets incoming from the traffic she ordered to her test machines appeared to have been sent from spoofed IP addresses. However, when she used the “Down or Not?” host checker function on Asylum, the site responded from what appears to be the real Internet address of one of the servers that are used to launch the attacks: 93.114.42.28. She noted that a booter service that appears to be a clone of Asylum – vastresser.ru – is hosted on the same server.
<p>
Asylum, like most other booter services, is hidden behind Cloudflare, a content distribution network that helps sites block attacks that services like Asylum are designed to launch. Apparently, getting attacked is something of an occupational hazard for those running a booter services. Behind the Cloudflare proxy, Nixon found that the secret IP for the Asylum stresser Web frontend was 93.114.42.205.
<p>
Both IP addresses map back to Voxility, a hosting facility in Romania that has a solid reputation in the cybercrime underground for providing so-called “bulletproof hosting” services, or those that generally turn a deaf ear to abuse complaints and requests from law enforcement officials. In January 2013, I profiled one data center at this ISP called Powerhost.ro that was being used as the home base of operations for the organized cybercrime gang that is currently facing charges of developing and distributing the Gozi Banking Trojan.
</blockquote>
<p>
According to Krebs, "Between the week of Mar. 17, 2013 and Mar. 23, 2013, asylumstresser.com was used to launch more than 10,000 online attacks."

<P>
<a href="http://krebsonsecurity.com/2013/05/ddos-services-advertise-openly-take-paypal/?utm_source=feedburner&#038;utm_medium=feed&#038;utm_campaign=Feed%3A+KrebsOnSecurity+%28Krebs+on+Security%29">DDoS Services Advertise Openly, Take PayPal</a>

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/05/13/inside-the-world-of-booters.html/feed</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Apple can decrypt iPhones for cops; Google can remotely &quot;reset password&quot; for Android&#160;devices</title>
		<link>http://boingboing.net/2013/05/12/apple-can-decrypt-iphones-for.html</link>
		<comments>http://boingboing.net/2013/05/12/apple-can-decrypt-iphones-for.html#comments</comments>
		<pubDate>Sun, 12 May 2013 15:49:04 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[apple]]></category>
		<category><![CDATA[crypto]]></category>
		<category><![CDATA[lawful interception]]></category>
		<category><![CDATA[mobile]]></category>
		<category><![CDATA[police]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=229751</guid>
		<description><![CDATA[<p>

Apple apparently has the power to decrypt iPhone storage in response to law-enforcement requests, though they won't say how. Google can remotely "reset the password" for a phone for cops, too:

<blockquote>
<p>


Last year, leaked training materials prepared by the Sacramento sheriff's office included a form that would require Apple to "assist law enforcement agents" with "bypassing the cell phone user's passcode so that the agents may search the iPhone." Google takes a more privacy-protective approach: it "resets the password and further provides the reset password to law enforcement," the materials say, which has the side effect of notifying the user that his or her cell phone has been compromised.</p></blockquote></p>]]></description>
			<content:encoded><![CDATA[
<p>

Apple apparently has the power to decrypt iPhone storage in response to law-enforcement requests, though they won't say how. Google can remotely "reset the password" for a phone for cops, too:

<blockquote>
<p>


Last year, leaked training materials prepared by the Sacramento sheriff's office included a form that would require Apple to "assist law enforcement agents" with "bypassing the cell phone user's passcode so that the agents may search the iPhone." Google takes a more privacy-protective approach: it "resets the password and further provides the reset password to law enforcement," the materials say, which has the side effect of notifying the user that his or her cell phone has been compromised.
<p>
Ginger Colbrun, ATF's public affairs chief, told CNET that "ATF cannot discuss specifics of ongoing investigations or litigation. ATF follows federal law and DOJ/department-wide policy on access to all communication devices."
<p>
...The ATF's Maynard said in an affidavit for the Kentucky case that Apple "has the capabilities to bypass the security software" and "download the contents of the phone to an external memory device." Chang, the Apple legal specialist, told him that "once the Apple analyst bypasses the passcode, the data will be downloaded onto a USB external drive" and delivered to the ATF.
<p>
It's not clear whether that means Apple has created a backdoor for police -- which has been the topic of speculation in the past -- whether the company has custom hardware that's faster at decryption, or whether it simply is more skilled at using the same procedures available to the government. Apple declined to discuss its law enforcement policies when contacted this week by CNET. 
</blockquote>

<p>
It's not clear to me from the above whether Google "resetting the password" for Android devices merely bypasses the lock-screen or actually decrypts the mass storage on the phone if it has been encrypted.
<p>
I also wonder if the "decryption" Apple undertakes relies on people habitually using short passwords for their phones -- the alternative being a lot of screen-typing in order to place a call.

<P>
<a href="http://news.cnet.com/8301-13578_3-57583843-38/apple-deluged-by-police-demands-to-decrypt-iphones/">Apple deluged by police demands to decrypt iPhones</a> [Declan McCullagh/CNet]
<p>
(<i>via <a href="http://slashdot.org">/.</a></i>)

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/05/12/apple-can-decrypt-iphones-for.html/feed</wfw:commentRss>
		<slash:comments>68</slash:comments>
		</item>
		<item>
		<title>Anatomy of a state-sponsored phishing attack: how the Syrian Electronic Army hacked The&#160;Onion</title>
		<link>http://boingboing.net/2013/05/10/anatomy-of-a-state-sponsored-p.html</link>
		<comments>http://boingboing.net/2013/05/10/anatomy-of-a-state-sponsored-p.html#comments</comments>
		<pubDate>Fri, 10 May 2013 20:06:57 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[syria]]></category>
		<category><![CDATA[twitter]]></category>
		<category><![CDATA[web theory]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=229441</guid>
		<description><![CDATA[<p>
As I <a href="http://boingboing.net/2013/05/07/onion-gets-hacked-by-syrian-pr.html">blogged</a> earlier this week, the Syrian Electronic Army hacked The Onion's Twitter account and used it to post a bunch of dumb messages attacking Israel, the US, and the UN. Now, the Onion's IT administrators have posted a detailed account of how Syrian hackers used a series of staged and careful phishing attacks to escalate from a single naive user's email credentials to the password for the Onion's social media accounts.</p>]]></description>
			<content:encoded><![CDATA[
<p>
As I <a href="http://boingboing.net/2013/05/07/onion-gets-hacked-by-syrian-pr.html">blogged</a> earlier this week, the Syrian Electronic Army hacked The Onion's Twitter account and used it to post a bunch of dumb messages attacking Israel, the US, and the UN. Now, the Onion's IT administrators have posted a detailed account of how Syrian hackers used a series of staged and careful phishing attacks to escalate from a single naive user's email credentials to the password for the Onion's social media accounts.


<blockquote>
<p>
Once the attackers had access to one Onion employee’s account, they used that account to send the same email to more Onion staff at about 2:30 AM on Monday, May 6. Coming from a trusted address, many staff members clicked the link, but most refrained from entering their login credentials. Two staff members did enter their credentials, one of whom had access to all of our social media accounts.
<p>
After discovering that at least one account had been compromised, we sent a company-wide email to change email passwords immediately. The attacker used their access to a different, undiscovered compromised account to send a duplicate email which included a link to the phishing page disguised as a password-reset link. This dupe email was not sent to any member of the tech or IT teams, so it went undetected. This third and final phishing attack compromised at least 2 more accounts. One of these accounts was used to continue owning our Twitter account.
<p>
At this point the editorial staff began publishing articles inspired by the attack. The second article, Syrian Electronic Army Has A Little Fun Before Inevitable Upcoming Deaths At Hands Of Rebels, angered the attacker who then began posting editorial emails on their Twitter account. Once we discovered this, we decided that we could not know for sure which accounts had been compromised and forced a password reset on every staff member’s Google Apps account.
</blockquote>
<p>
I'm impressed by the cleverness of triggering a "password reset" message from the IT team, then sending out fake password-reset messages to users who <em>aren't</em> on the IT team to get them to click on yet another link. Most of the recommendations the IT team make are pretty bland ("educate your users"), but these two reccos are good:


<span id="more-229441"></span>
<blockquote>
<p>


The email addresses for your twitter accounts should be on a system that is isolated from your organization’s normal email. This will make your Twitter accounts virtually invulnerable to phishing (providing that you’re using unique, strong passwords for every account).
</blockquote>
<p>
and

<blockquote>
<p>
If possible, have a way to reach out to all of your users outside of their organizational email. In the case of the Guardian hack, the SEA posted screenshots of multiple internal security emails, probably from a compromised email address that was overlooked.
</blockquote>



<p>
<a href="http://theonion.github.io/blog/2013/05/08/how-the-syrian-electronic-army-hacked-the-onion/">How the Syrian Electronic Army Hacked The Onion</a>

(<i>via <a href="http://slashdot.org">/.</a></i>)

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/05/10/anatomy-of-a-state-sponsored-p.html/feed</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>HOWTO fix security after the Boston&#160;bombing</title>
		<link>http://boingboing.net/2013/05/09/howto-fix-security-after-the-b.html</link>
		<comments>http://boingboing.net/2013/05/09/howto-fix-security-after-the-b.html#comments</comments>
		<pubDate>Fri, 10 May 2013 00:22:54 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[boston bombing]]></category>
		<category><![CDATA[rule of law]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[security theater]]></category>
		<category><![CDATA[transparency]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=229293</guid>
		<description><![CDATA[<p>
As we think about the postmortem on security procedures following from the Boston Marathon attack and plan on new procedures, Bruce Schneier has some crucial security design advice: don't forget transparency and accountability. Without these two crucial elements, security can't work:

<blockquote>
<p> Long ago, we realized that simply trusting people and government agencies to always do the right thing doesn't work, so we need to check up on them.</p></blockquote></p>]]></description>
			<content:encoded><![CDATA[

<p>
As we think about the postmortem on security procedures following from the Boston Marathon attack and plan on new procedures, Bruce Schneier has some crucial security design advice: don't forget transparency and accountability. Without these two crucial elements, security can't work:

<blockquote>
<p> Long ago, we realized that simply trusting people and government agencies to always do the right thing doesn't work, so we need to check up on them. In a democracy, transparency and accountability are how we do that. It's how we ensure that we get both effective and cost-effective government. It's how we prevent those we trust from abusing that trust, and protect ourselves when they do. And it's especially important when security is concerned.
<p>
First, we need to ensure that the stuff we're paying money for actually works and has a measureable impact. Law-enforcement organizations regularly invest in technologies that don't make us any safer. The TSA, for example, could devote an entire museum to expensive but ineffective systems: puffer machines, body scanners, FAST behavioral screening, and so on. Local police departments have been wasting lots of post-9/11 money on unnecessary high-tech weaponry and equipment. The occasional high-profile success aside, police surveillance cameras have been shown to be a largely ineffective police tool.
<p>
Sometimes honest mistakes led organizations to invest in these technologies. Sometimes there's self-deception and mismanagement -- and far too often lobbyists are involved. Given the enormous amount of security money post-9/11, you inevitably end up with an enormous amount of waste. Transparency and accountability are how we keep all of this in check.
<p>
Second, we need to ensure that law enforcement does what we expect it to do and nothing more. Police powers are invariably abused. Mission creep is inevitable, and it results in laws designed to combat one particular type of crime being used for an ever-widening array of crimes. Transparency is the only way we have of knowing when this is going on. 
</blockquote>

<p>
<a href="http://www.theatlantic.com/politics/archive/2013/05/transparency-and-accountability-dont-hurt-security-theyre-crucial-to-it/275662/">Transparency and Accountability Don't Hurt Security—They're Crucial to It</a>

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/05/09/howto-fix-security-after-the-b.html/feed</wfw:commentRss>
		<slash:comments>25</slash:comments>
		</item>
		<item>
		<title>Dan Kaminsky on&#160;BitCoin</title>
		<link>http://boingboing.net/2013/05/04/dan-kaminski-on-bitcoin.html</link>
		<comments>http://boingboing.net/2013/05/04/dan-kaminski-on-bitcoin.html#comments</comments>
		<pubDate>Sat, 04 May 2013 18:54:25 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[bitcoin]]></category>
		<category><![CDATA[finance]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=228454</guid>
		<description><![CDATA[<p>
Ever since BitCoin appeared, I've been waiting for two security experts to venture detailed opinions on it: Dan Kaminsky and Ben Laurie. Dan has now weighed in, with a long, thoughtful piece on the merits and demerits of BitCoin as a currency and as a phenomenon.</p>]]></description>
			<content:encoded><![CDATA[
<p>
Ever since BitCoin appeared, I've been waiting for two security experts to venture detailed opinions on it: Dan Kaminsky and Ben Laurie. Dan has now weighed in, with a long, thoughtful piece on the merits and demerits of BitCoin as a currency and as a phenomenon.

<blockquote>
<p>


Bitcoin’s fundamental principle of fraud management is one of denial. If we drop our wallet on the street, the U.S. government is not going to compensate us for our lost cash. Bitcoin attempts to make the same deal, to the point where it calls its stores of keys, “wallets.” If we drop our wallet on the street — heck, if someone picks it out of our pockets — the money’s gone.
<p>
There have been bitcoin thefts. A few years ago, I tried to break Bitcoin, and failed quite gloriously. The system and framework itself is preternaturally sound. But it too is built on the foundation of buggy technologies we call the internet, and so Bitcoin must experience failures from the code around it. Hackers don’t care whose code they broke on their way to bitcoin, any more than pickpockets care that they’re exploiting the manufacturer of one’s jeans or leather wallet. So they break the server below the money, or the web interface above it. They still win.
<p>
At least, that’s the theory. Reality is more complicated. Of all the millions of dollars of purloined bitcoin that’s floating around out there, not one Satoshi of it has been spent. That’s because while most other stolen property becomes relatively indistinguishable from its legitimate brethren, everybody knows the identity of this particular stolen wealth, and can track it until the end of time.
</blockquote>


<p>
<a href="http://www.wired.com/opinion/2013/05/lets-cut-through-the-bitcoin-hype/">Bitcoin Is Not as Secure, Unregulated, or Lucrative as You Might Think</a>

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/05/04/dan-kaminski-on-bitcoin.html/feed</wfw:commentRss>
		<slash:comments>51</slash:comments>
		</item>
		<item>
		<title>Why &quot;connecting the dots&quot; is the wrong way to think about stopping&#160;terrorism</title>
		<link>http://boingboing.net/2013/05/03/why-connecting-the-dots-is.html</link>
		<comments>http://boingboing.net/2013/05/03/why-connecting-the-dots-is.html#comments</comments>
		<pubDate>Fri, 03 May 2013 23:13:57 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[boston bombing]]></category>
		<category><![CDATA[cogsci]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[surveillance]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=228354</guid>
		<description><![CDATA[<p><img src="http://boingboing.net/wp-content/uploads/2013/05/4269947837_e4c42abed6_z.jpg"/><br />
Bruce Schneier has a great op-ed on CNN on why it's stupid to talk about whether the FBI should have "connected the dots" on the Boston bomber. As Bruce points out, it's only in hindsight that there's a neat trail of dots to connect, a narrative we can make sense of.</p>]]></description>
			<content:encoded><![CDATA[<p><img src="http://boingboing.net/wp-content/uploads/2013/05/4269947837_e4c42abed6_z.jpg"><br />
Bruce Schneier has a great op-ed on CNN on why it's stupid to talk about whether the FBI should have "connected the dots" on the Boston bomber. As Bruce points out, it's only in hindsight that there's a neat trail of dots to connect, a narrative we can make sense of. Before the fact, it's a hairy, swirling hotchpotch of mostly irrelevancies, and it's only the "narrative fallacy" that makes it seem like a neat story in retrospect. The risk here is that intelligence agencies and the press will push this fallacy as grounds for taking away more rights and more privacy in order to "connect the dots" next time.

<blockqoute>
<p>


Rather than thinking of intelligence as a simple connect-the-dots picture, think of it as a million unnumbered pictures superimposed on top of each other. Or a random-dot stereogram. Is it a sailboat, a puppy, two guys with pressure-cooker bombs or just an unintelligible mess of dots? You try to figure it out.
<p>
It's not a matter of not enough data, either.
<p>
Piling more data onto the mix makes it harder, not easier. The best way to think of it is a needle-in-a-haystack problem; the last thing you want to do is increase the amount of hay you have to search through.
<p>
The television show "Person of Interest" is fiction, not fact.
<p>
There's a name for this sort of logical fallacy: hindsight bias.
</blockqoute>


<P>
<a href="http://edition.cnn.com/2013/05/02/opinion/schneier-boston-bombing/index.html">Why FBI and CIA didn't connect the dots</a>

(<i>Thanks, <a href="https://www.schneier.com/">Bruce</a>!</i>)

<p>
(<i>Image: <a href="http://www.flickr.com/photos/whitneywaller/4269947837/">connect-the-dots</a>, a Creative Commons <a href="http://creativecommons.org/licenses/by-sa/2.0/deed.en">Attribution Share-Alike (2.0)</a> image from whitneywaller's photostream</i>)]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/05/03/why-connecting-the-dots-is.html/feed</wfw:commentRss>
		<slash:comments>73</slash:comments>
		</item>
		<item>
		<title>Rumored Statue of Liberty face-recognition supplier harasses and threatens&#160;journalist</title>
		<link>http://boingboing.net/2013/04/30/rumored-statue-of-liberty-face.html</link>
		<comments>http://boingboing.net/2013/04/30/rumored-statue-of-liberty-face.html#comments</comments>
		<pubDate>Tue, 30 Apr 2013 22:38:13 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[bullying]]></category>
		<category><![CDATA[christ what an asshole]]></category>
		<category><![CDATA[corruption]]></category>
		<category><![CDATA[nyc]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[security theater]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=227556</guid>
		<description><![CDATA[<p>
Slate's Ryan Gallagher caught wind of a new face recognition software being rolled out at the Statue of Liberty. He interviewed a rep from Total Recall, who were reported to be representing Cognitec, the German company whose product, FaceVACS was going in on Liberty Island.</p>]]></description>
			<content:encoded><![CDATA[
<p>
Slate's Ryan Gallagher caught wind of a new face recognition software being rolled out at the Statue of Liberty. He interviewed a rep from Total Recall, who were reported to be representing Cognitec, the German company whose product, FaceVACS was going in on Liberty Island. Halfway through the interview, Total Recall's director of business development Peter Millius terminated the call, saying that the project was on hold, or possibly cancelled, "vetoed" by the Park Police.
<p>
Then it got weird. Cognitec and its lawyers began to barrage Gallagher with emails and letters warning him that if he wrote about this, they'd sue him. When he asked Total Recall for clarification, they threatened to sue him, personally, for harassment. The National Park Service didn't have much to say about the bid, saying "I'm not going to show my hand as far as what security technologies we have." Go, security-through-obscurity! Hurrah for spending tax dollars without any transparency!
<p>
Gallagher reported the whole story, including the threats. Whatever merits or demerits Total Recall and Cognitec have as companies, turning into weird, opaque legal-threat-generating machines in the middle of an interview and harassing and intimidating journalists sounds like the kind of thing that should disqualify them from getting any of the American public's money.

<blockquote>
<p>
<img src="http://boingboing.net/wp-content/uploads/2013/04/4037070291_16ebe5dd61_z.jpg" class="bordered" align="right">
 “We do work with Cognitec, but right now because of what happened with Sandy it put a lot of different pilots that we are doing on hold,” Peter Millius, Total Recall’s director of business development, said in a phone call. “It’s still months away, and the facial recognition right now is not going to be part of this phase.” Then, he put me hold and came back a few minutes later with a different position—insisting that the face-recognition project had in fact been “vetoed” by the Park Police and adding that I was “not authorized” to write about it.
<p>
That was weird, but it soon got weirder. About an hour after I spoke with Total Recall, an email from Cognitec landed in my inbox. It was from the company’s marketing manager, Elke Oberg, who had just one day earlier told me in a phone interview that “yes, they are going to try out our technology there” in response to questions about a face-recognition pilot at the statue. Now, Oberg had sent a letter ordering me to “refrain from publishing any information about the use of face recognition at the Statue of Liberty.” It said that I had “false information,” that the project had been “cancelled,” and that if I wrote about it, there would be “legal action.” Total Recall then separately sent me an almost identical letter—warning me not to write “any information about Total Recall and the Statue of Liberty or the use of face recognition at the Statue of Liberty.” Both companies declined further requests for comment, and Millius at Total Recall even threatened to take legal action against me personally if I continued to “harass” him with additional questions.

</blockquote>

<P>
<a href="http://www.slate.com/articles/technology/future_tense/2013/04/statue_of_liberty_to_get_new_surveillance_tech_but_don_t_mention_face_recognition.html">Lady Liberty’s Watching You</a>

(<i>via <a href="http://reddit.com">Reddit</a></i>)
<p>
(<i>Image: <a href="http://www.flickr.com/photos/francehousehunt/4037070291/">Statue of Liberty Paris</a>, a Creative Commons <a href="http://creativecommons.org/licenses/by/2.0/deed.en">Attribution (2.0)</a> image from francehousehunt's photostream</i>)

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/04/30/rumored-statue-of-liberty-face.html/feed</wfw:commentRss>
		<slash:comments>23</slash:comments>
		</item>
		<item>
		<title>If you see something, say something: Liveblogging from a lecture about terrorism, security, and visual&#160;narratives</title>
		<link>http://boingboing.net/2013/04/16/if-you-see-something-should-y.html</link>
		<comments>http://boingboing.net/2013/04/16/if-you-see-something-should-y.html#comments</comments>
		<pubDate>Tue, 16 Apr 2013 20:07:37 +0000</pubDate>
		<dc:creator>Maggie Koerth-Baker</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[academia]]></category>
		<category><![CDATA[media]]></category>
		<category><![CDATA[News]]></category>
		<category><![CDATA[public]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[terrorism]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=224689</guid>
		<description><![CDATA[<p><a href="http://boingboing.net/wp-content/uploads/2013/04/see-something.jpg"><img src="http://boingboing.net/wp-content/uploads/2013/04/see-something-600x462.jpg" alt="" title="see something" width="600" height="462" class="alignnone size-medium wp-image-224692" /></a></p>

<p>When bombs explode in a crowded city street, individuals and governments naturally ask themselves, "Could we have prevented this if we had been paying better attention to people and things that were out of place?" Trouble is, that question leads to a whole cascade of other questions &#8212; covering everything from personal privacy to racism.</p>]]></description>
			<content:encoded><![CDATA[<p><a href="http://boingboing.net/wp-content/uploads/2013/04/see-something.jpg"><img src="http://boingboing.net/wp-content/uploads/2013/04/see-something-600x462.jpg" alt="" title="see something" width="600" height="462" class="alignnone size-medium wp-image-224692" /></a></p>

<p>When bombs explode in a crowded city street, individuals and governments naturally ask themselves, "Could we have prevented this if we had been paying better attention to people and things that were out of place?" Trouble is, that question leads to a whole cascade of other questions &mdash; covering everything from personal privacy to racism.</p>

<p>M. Neelika Jayawardane is associate professor of English at SUNY-Oswego. She's giving a talk this afternoon on "If you see something, say something" and other campaigns aimed at getting average people involved in public security. I happened to be here on campus for a separate speaking engagement and thought this was something that BoingBoing readers would be interested in "sitting in" on, given the recent tragedy in Boston.</p> 

<p>I'll be liveblogging this, updating regularly with key points and ideas from Jayawardane's talk. It's worth noting that her perspective is not the only way to think about these issues. I'm posting this in hopes that it will present some interesting information and spark good conversations. If you're interested in engaging with Jayawardane afterwards, she said that you can <a href="https://twitter.com/Sugarintheplum">reach her via Twitter</a>. In the meantime, I'm looking forward to seeing what she has to say &mdash; and what you all have to say about that.</p>

<span id="more-224689"></span>

<strong><p>The Talk</p> </strong>

<p>First thing worth noting: The actual title of this talk &mdash; "Extraordinary renditions: imaging, mapping, and immobilizing the lives of others."</p>

<p>"I was trained in literary studies, but I'm really interested in how we read our environments as well as books"</p>

<p>She's particularly interested in the ways that race, ethnicity, and culture play into those readings. Jayawardane is Sri Lankan, but grew up in South Africa. She's never been a part of a dominant culture. Talks about the strange experience of visiting Sri Lanka for the first time as an adult and being, suddenly, the privileged ethnic group.</p> 

<p>Advertisements and media make marginal societies more visible. In the wake of 9/11 media created a new fact for terror and gave us all physical signals that we now associate with our own fear of bodily injury.</p>

<p>The image of the "classic terrorist" now means that people monitor their environments for people who fit that image &mdash; an action that affects how the people who, inadvertently, look like "terrorists" can move around and engage in their own communities.</p>

<p>Jayawardane sees an increase in "oriental" stereotypes and security-inspired images in fashion magazines happening at the same time. She's showing a <em>Vogue</em> spread that shows a model stripping out of her skirt in front of the TSA. </p>

<p>The images of terror and terrorism have become saturated throughout Western media since 9/11, even in places where you don't expect them, life fashion. Another fashion spread shows riot police groping models who have been thrown up against a cop car in stress positions.</p>

<p>She believes these images have been crucial to incorporating us (the public) into the discourse and process of security and terror post-9/11.</p>

<p>The use of this imagery highlights and encourages our fears and normalizes oppressive levels of security routine.</p> 

<p>After 9/11, friends of Jayawardane encouraged her to look "less threatening" in airports, by wearing big hoop earrings and trying to "look more like you're Puerto Rican."</p>

<p>Moustafa Hassan Nasr was abducted by the CIA off the streets of Milan in February 2003. He reports being tortured and was eventually released when the CIA realized he wasn't actually a bad guy. Americans were tried for this crime in absentia in Italy in 2007. Rarely did American newspapers report on this and similar incidents, Jayawardane says.</p> 

<p>Visual arts do a better job of shaping our ideas and building propaganda than language does, she says. Human beings are very savvy readers of images. We're being sent these visual signals about who is dangerous, and who is the other. And that ends up controlling the mobility and lives of people the West considers "threatening".</p>

<p>You see a picture of Nasr now, and you create a narrative for him that doesn't necessarily fit with what really happened to him.</p>

<p>The idea of putting a photo on an identity document began with methods of tracking criminals, and cataloging people into ethnic groups for the purpose of apartheid, Jayawardane says. </p>

<p>The more your body is considered "threatening" the more mapping and documenting of your body happens to you as you enter and leave and move about countries. The more you are under public surveillance. </p>

<p>But, at the same time, threatening bodies are "disappeared" into a symbolic, rather than individual existence. Think of the parade of hooded figures in Guantanamo. Those individuals becomes representations of threats to the state, or proof that the state is making you safe, or symbolic representations of the failures and excesses of the security apparatus. Either way, their private selves get erased, she says.</p>

<p>Individual characteristics are lost as they merge into this this strange, threatening, brownish man. "My partner, on a certain day and certain look, could look like one of the 9/11 bombers. And we now conflate that look with danger," Jayawardane says.</p>

<p>Photography and image banks of wanted posters are our sort of medieval stained glass, giving us symbolic understandings of what we should fear and who we should think of as "out of place".</p>

<p>Which brings us to campaigns like "If you see something, say something" that turn up in transport hubs like bus stations, trains, and airports. These turn up more in bus stations and trains than in airports, she says.</p>

<p>Posters encourage you to ask "What's wrong with this picture". They ask you to seek out what you might think of as threatening. To be a good citizen, you have to be a part of surveillance.</p> 

<p>None of these things ever tell you what you should be on alert for. So what do we fall back on? What becomes "threatening" to us? Not the big guy with a gun patrolling the Amtrak station, she says. That's the cop. And we've been taught to not fear him. Instead, we revert to the visual training we've been getting from the media for the last decade.</p> 

<p>Very similar messages were disseminated in South Africa during apartheid, she says. And it's nothing new in the United States, either. "I got interested because so much of these rules and images affect my mobility and how my identity shifts and changes in the minds of other people."</p>

<p><strong>Now a response from Craig Warkentin, political science professor.</strong></p>

<p>His question: So what? Well, he says, we become unwitting participants in a surveillance state. It does matter, even if you aren't the subject of the othering.</p>

<p>This idea of framing a topic &mdash; how we discuss a topic or conceptualize it for ourselves &mdash; isn't something outside the norm for political science. People have used framing to help make political change, the same way the visual framing is training us to think of certain people as threatening, but in different ways. For instance, using media and images and story telling to start getting people to think about land mines as things that violate human rights, rather than things that make us safe.</p>

<p>The downside of effective framing: If you can get people to think in a certain way it becomes normal after a while. At that point it becomes something we think of as "natural" and we take it for granted. And people stop questioning it.</p>

<p>To create change, you have to do more than point out that this isn't normal. You have to get people to be willing to accept that it's not normal. "The extent to which othering certain bodies and accepting security state is normal is the degree to which I am concerned about it," he says.</p>

<p>People who are aware this isn't normal will use the people who think this is normal to implement their goals. As long as we believe it's natural, we'll go along with it.</p> 

<p>"Be aware of why you do the things you do. Why you think the way you think. That will help you avoid being manipulated."</p>

<p><strong>And now the Q&#038;A.</strong></p> 

<p>It is now 4:56 p.m. Eastern, if you have questions about this, post them, and I'll ask for you in the Q&#038;A session.</p> 

<p>Jayawardane says she doesn't blame people who look at her and partner in an airport and express fear. They're responding to what they have learned. Interestingly, strangers ask them kind of obtrusive questions about their relationship, and gender roles.</p> 

<p><strong>Comment from the audience:</strong> "Craig, you're making an assumption I don't think I can accept. Whoever it is who is arranging PR campaign is aware of the fact that it isn't normal. I don't think you can safely say that we are being manipulated." 

<p><strong>Warkentin replies:</strong> In the case of the land mines for example, we had historical legacy for how those devices were talked about. It was a case of private citizens organizing and intentionally changing the way we talk about it. Political leaders do have an idea of what normal should be &mdash; i.e., what normal will help them reach their objectives. There's different interpretations of the war on terror. Normal way to respond to terror before 9/11 was to treat it as a criminal act. You arrest somebody, you put them on trial. U.S. chose to address it in a different way and got us to start talking about it in terms of a war. And that has lots of other baggage that goes along with it. But historically we KNOW that's not the only way to talk about. There can be more than one normal and leaders can choose which normal they push to make their point. </p>

<p>That said, he says, those leaders do sometimes genuinely believe that the "normal" they want us to believe in is the <em>actual</em> "normal".</p>

<p><strong>Question:</strong> "I kind of want to flip your normal. As the talk has been going, I've been thinking that it's more an abnormal discourse than anything. We're being shamed into loving our safety. We're told it's abnormal to not be afraid of these people. War was framed as an extreme act of love. Rather than thinking in terms of normalizing, if what goes out is an abnormalizing, is it that much more powerful?"</p> 

<p><strong>Warkentin:</strong> There are multiple layers to this. Part of the framing thing is that it only works if it doesn't ring true with people. Land mind thing wouldn't have worked if it wasn't something people believed in. You have to use things that connect to people's experience and predispositions. </p>

<p><strong>Jayawardane asks: </strong>As you walk through our modern American landscape, how do <em>you</em> experience this? Is it normal for you? Do you question?</p> 

<p><strong>Audience question:</strong> "I struggle with wondering how people can believe in something that looks so doubtful. Is it not part of the packaging of democracy that you must trust ... even things that become empty? To me, coming from a Soviet background, it's more natural not to trust anything. Marx had the idea that ideology becomes naturalized and that's why you don't question. It's packaged as something sweet and trustworthy the way it is."</p> 

<strong><p>I then asked about how we balance that need for skepticism with the black hole of conspiracy theories that we can fall into as we realize that we can't trust without question.</p> </strong>

<p><strong>Jayawardane:</strong> I started reading a book about how conspiracy theories come about and it has to do with knowing that there are things you're not privy to. But you don't know it. But you know something is wrong. That general sense of feeling unbalanced leads people to create platforms on which you can feel like you are stable. Even if it's a false platform, it feels more stable than the place where you know things aren't stable.</p> 

<p>There is a place in a classroom to be able to have these conversations. To be able to voice your fears and debate them. To be able to talk about and educate each other on things that could be seen as racist. There are places where you can have productive conversations. But, on the other hand, I don't want to do that job at a faculty picnic or with a stranger in the airport.</p> 

<p><strong>Audience member makes an interesting point:</strong> When you indoctrinate people to see themselves as an arm of the law or a part of the security state, you create situations like what happened in the Trayvon Martin case.</p>

<strong><p>It is now 5:31 and we've run out of time. Thanks for following along, folks.</p></strong>

<p>&bull; If you'd like to see Jayawardane's slides, including samples of the fashion shoots she discussed in her talk, you can <a href="https://docs.google.com/file/d/0BwfD9m0Ad1NdSW5kOHZtdDVrbnM/edit?usp=sharing">view her PowerPoint through Google Docs.</a>
<br />&bull; You can also <a href="https://docs.google.com/file/d/0BwfD9m0Ad1NddHlLd0ViRWtqLWc/edit?usp=sharing">read the full notes from her talk</a>.</br></p> 

<em><p>Image: <a href="http://www.flickr.com/photos/carbonnyc/2036270863/">MTA: Off by a Factor of at Least 10^3</a>, a Creative Commons <a href="http://creativecommons.org/licenses/by/2.0/deed.en">Attribution (2.0)</a> image from carbonnyc's photostream</p></em>]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/04/16/if-you-see-something-should-y.html/feed</wfw:commentRss>
		<slash:comments>46</slash:comments>
		</item>
		<item>
		<title>Don&#039;t let the Boston Marathon bombing terrorize you, or the bombers&#160;win</title>
		<link>http://boingboing.net/2013/04/16/dont-let-the-boston-marathon.html</link>
		<comments>http://boingboing.net/2013/04/16/dont-let-the-boston-marathon.html#comments</comments>
		<pubDate>Tue, 16 Apr 2013 19:05:00 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[boston]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=224571</guid>
		<description><![CDATA[<p>
Bruce Schneier's terrific <em>Atlantic</em> essay on the Boston Marathon bombings is a must-read. As he points out, the terrorists win only if we let this sort of thing scare us. By being empathic toward the victims and indomitable and fearless toward the criminals, we can create a climate where politicians can get away with telling us the truth -- there's no such thing as perfect security -- instead of politically expedient lies that lead to an out-of-control security state that takes away our freedoms, diverts our education, unemployment and health money to security theater, and leaves us no safer.</p>]]></description>
			<content:encoded><![CDATA[
<p>
Bruce Schneier's terrific <em>Atlantic</em> essay on the Boston Marathon bombings is a must-read. As he points out, the terrorists win only if we let this sort of thing scare us. By being empathic toward the victims and indomitable and fearless toward the criminals, we can create a climate where politicians can get away with telling us the truth -- there's no such thing as perfect security -- instead of politically expedient lies that lead to an out-of-control security state that takes away our freedoms, diverts our education, unemployment and health money to security theater, and leaves us no safer. 
 
<blockquote>
<p>

How well this attack succeeds depends much less on what happened in Boston than by our reactions in the coming weeks and months. Terrorism isn't primarily a crime against people or property. It's a crime against our minds, using the deaths of innocents and destruction of property as accomplices. When we react from fear, when we change our laws and policies to make our country less open, the terrorists succeed, even if their attacks fail. But when we refuse to be terrorized, when we're indomitable in the face of terror, the terrorists fail, even if their attacks succeed. 
<p>
Don't glorify the terrorists and their actions by calling this part of a "war on terror." Wars involve two legitimate sides. There's only one legitimate side here; those on the other are criminals. They should be found, arrested, and punished. But we need to be vigilant not to weaken the very freedoms and liberties that make this country great, meanwhile, just because we're scared. 
<p>
Empathize, but refuse to be terrorized. Instead, be indomitable -- and support leaders who are as well. That's how to defeat terrorists.
</blockquote>

<p>
<a href="http://www.theatlantic.com/national/archive/2013/04/the-boston-marathon-bombing-keep-calm-and-carry-on/275014/">The Boston Marathon Bombing: Keep Calm and Carry On</a>

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/04/16/dont-let-the-boston-marathon.html/feed</wfw:commentRss>
		<slash:comments>86</slash:comments>
		</item>
		<item>
		<title>Google adds a &quot;dead-man&#039;s switch&quot; -- uses cases from torture-resistance to digital&#160;wills</title>
		<link>http://boingboing.net/2013/04/13/google-adds-a-dead-mans-sw.html</link>
		<comments>http://boingboing.net/2013/04/13/google-adds-a-dead-mans-sw.html#comments</comments>
		<pubDate>Sun, 14 Apr 2013 03:12:55 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[death]]></category>
		<category><![CDATA[rubber hose crypto]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[web theory]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=224232</guid>
		<description><![CDATA[<p>
<a href="http://googlepublicpolicy.blogspot.com/2013/04/plan-your-digital-afterlife-with.html">Google's rolled out an "Inactive Account Manager"</a> -- a dead-man's switch for your Google accounts. If you set it, Google will watch your account for protracted inactivity. After a set period, you can tell it to either squawk ("Email Amnesty International and tell them I'm in jail," or "Email my kids and tell them I'm dead and give them instructions for probating my estate") and/or delete all your accounts.</p>]]></description>
			<content:encoded><![CDATA[

<p>
<a href="http://googlepublicpolicy.blogspot.com/2013/04/plan-your-digital-afterlife-with.html">Google's rolled out an "Inactive Account Manager"</a> -- a dead-man's switch for your Google accounts. If you set it, Google will watch your account for protracted inactivity. After a set period, you can tell it to either squawk ("Email Amnesty International and tell them I'm in jail," or "Email my kids and tell them I'm dead and give them instructions for probating my estate") and/or delete all your accounts. This has a <em>lot</em> of use-cases, from preventing your secrets from being tortured out of you (before you go to a protest, you could set your dead-man's switch to a couple hours -- if you end up in jail and out of contact, all your stuff would be deleted before you were even processed by the local law) to easing the transition of your digital "estate." 

<blockquote>
<p>


No one wants to think about their own death, but not thinking about it has a zero percent chance of preventing it. The Inactive Account Manager (great euphemism) can send your data from many Google services to your digital heirs, alert your contacts, delete the accounts, or do all or none of the above. It affects Blogger, Contacts/Circles (in Google+) Drive, Gmail, Google+ profiles, Pages and Streams, Picasa albums, Google Voice, and YouTube.
<p>
It also serves as a useful self-destruct button. Don’t want anyone watching your stupid YouTube videos after you’ve long forgotten that you had an account? Don’t want your kids to find your password notebook years after you’re gone and read your dirty chat sessions with their dad? You can have your account auto-destruct after trying to reach you using other e-mail addresses and by text message. You know, in case you just get tired of Gmail and wander off somewhere else. 
</blockquote>



<p>
<a href="http://consumerist.com/2013/04/12/google-introduces-dead-mans-switch-for-your-accounts/">Google Introduces Dead Man’s Switch For Your Accounts</a>

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/04/13/google-adds-a-dead-mans-sw.html/feed</wfw:commentRss>
		<slash:comments>21</slash:comments>
		</item>
		<item>
		<title>How cognitive blind-spots compromise security&#160;systems</title>
		<link>http://boingboing.net/2013/04/10/how-cognitive-blind-spots-comp.html</link>
		<comments>http://boingboing.net/2013/04/10/how-cognitive-blind-spots-comp.html#comments</comments>
		<pubDate>Wed, 10 Apr 2013 17:25:14 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[crypto]]></category>
		<category><![CDATA[psychology]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=223796</guid>
		<description><![CDATA[<p>
Tanya Khovanova has a fascinating and illuminating story about the blind-spots that can leave security systems vulnerable. She describes a clever one-way function using real-world tools:

<blockquote>
<p>
 Silvio Micali taught me cryptography. To explain one-way functions, he gave the following example of encryption.</p></blockquote></p>]]></description>
			<content:encoded><![CDATA[
<p>
Tanya Khovanova has a fascinating and illuminating story about the blind-spots that can leave security systems vulnerable. She describes a clever one-way function using real-world tools:

<blockquote>
<p>
 Silvio Micali taught me cryptography. To explain one-way functions, he gave the following example of encryption. Alice and Bob procure the same edition of the white pages book for a particular town, say Cambridge. For each letter Alice wants to encrypt, she finds a person in the book whose last name starts with this letter and uses his/her phone number as the encryption of that letter.
<p>
To decrypt the message Bob has to read through the whole book to find all the numbers. The decryption will take a lot more time than the encryption. If the book increases in size the time it takes Alice to do the encryption almost doesn’t increase, but the decryption process becomes more and more draining.
<p>
This example is very good for teaching one-way functions to non-mathematicians. Unfortunately, the technology changes and the example that Micali taught me fifteen years ago isn’t so cute anymore. Indeed you can do a reverse look-up online of every phone number in the white pages.
</blockquote>

<p>
Then she explains how a student pointed out her own blind-spot that made the system trivial to defeat:

<blockquote>
<p>
I still use this example, with an assumption that there is no reverse look-up. I recently taught it to my AMSA students. And one of my 8th graders said, “If I were Bob, I would just call all the phone numbers and ask their last names.”
<p>
In the fifteen years since I’ve been using this example, this idea never occurred to me. I am very shy so it would never enter my mind to call a stranger and ask for their last name. My student made me realize that my own personality affected my mathematical inventiveness.
</blockquote>

As Bruce Schneier points out, the young student is demonstrating "security mindset," imagining an attack on a security system that works on the weakest flank.

<p>
<a href="http://blog.tanyakhovanova.com/?p=277">One-Way Functions</a>

(<i>via <a href="https://www.schneier.com/">Schneier</a></i>)

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/04/10/how-cognitive-blind-spots-comp.html/feed</wfw:commentRss>
		<slash:comments>16</slash:comments>
		</item>
		<item>
		<title>ISPs and creepy ad company injecting traffic into secure Web&#160;sessions</title>
		<link>http://boingboing.net/2013/04/07/isps-and-creepy-ad-company-inj.html</link>
		<comments>http://boingboing.net/2013/04/07/isps-and-creepy-ad-company-inj.html#comments</comments>
		<pubDate>Mon, 08 Apr 2013 06:11:26 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[ads]]></category>
		<category><![CDATA[Business]]></category>
		<category><![CDATA[privacy]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[short]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=223315</guid>
		<description><![CDATA[A company called RT66 <a href="http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/#image-4">appears to be injecting code</a> into secure Web-sessions, possibly with collusion from ISPs like CMA Communications. No one's sure how they're doing this, neither RT66 or CMA are answering questions, and it's bad news all around.]]></description>
			<content:encoded><![CDATA[

A company called RT66 <a href="http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/#image-4">appears to be injecting code</a> into secure Web-sessions, possibly with collusion from ISPs like CMA Communications. No one's sure how they're doing this, neither RT66 or CMA are answering questions, and it's bad news all around.

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/04/07/isps-and-creepy-ad-company-inj.html/feed</wfw:commentRss>
		<slash:comments>43</slash:comments>
		</item>
		<item>
		<title>Lethal weapons from duty-free&#160;stores</title>
		<link>http://boingboing.net/2013/04/07/lethal-weapons-from-duty-free.html</link>
		<comments>http://boingboing.net/2013/04/07/lethal-weapons-from-duty-free.html#comments</comments>
		<pubDate>Sun, 07 Apr 2013 17:48:42 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[aviation]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[security theater]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=223277</guid>
		<description><![CDATA[Here's a writeup of Evan Booth's Hack the Box conference presentation on making lethal weapons out of items bought in airport duty-free shops.]]></description>
			<content:encoded><![CDATA[
<!--http://www.youtube.com/watch?v=Uo8xUsYo8IE--><div class="video-container"><iframe width="600" height="338" src="http://www.youtube.com/embed/Uo8xUsYo8IE?showinfo=0" frameborder="0" allowfullscreen></iframe></div>

<p>
Here's a writeup of Evan Booth's Hack the Box conference presentation on making lethal weapons out of items bought in airport duty-free shops. It's pretty ingenious stuff (the video above is from a related presentation at CarolinaCon 2013).
<p>
The problem here is that legitimate purpose of airport security is not protecting passengers and flight attendants from harm. In reality, there's no way to accomplish that goal against a determined attacker. The real and legitimate purpose of airport security is to protect airplanes and cockpits from harm -- to stop people from hijacking and/or crashing airplanes (this is why the TSA correctly relaxed its rules about carrying small knives onto planes -- and why so many of their other rules are pointless and stupid). So long as none of these lethal weapons can crash an airplane or beat an armored, bolted cockpit door, they embody no new incremental threat to aviation -- on the other hand, the improvised battery-bombs are a real threat.

<blockquote>
<p>


Besides a bomb knew Booth also easy to make a bow and arrow of stuff he had bought in a shop in an airport. For this he used an umbrella, hair dryer, socks, a leather belt and condoms. Too obvious things like a lighter and deodorant as alternative gas burner he did not elaborate.
<p>
Booth also made a crossbow of an umbrella, floss, grab a toy, a rolkoffertje, a straw and tape. With a straw, cotton and a piece of metal from a remote controlled helicopter he was able to make a blow gun for firing arrows.
<p>
Remarkable is also a club that he made a gift, what magazines, floss, a leather strap and tape. In a test showed that so firmly, that he with a single blow a coconut in several parts stores. 
</blockquote>
<p>
<a href="http://www.nu.nl/algemeen/3391356/onderzoeker-maakt-bom-van-artikelen-luchthavenwinkels.html">Onderzoeker maakt bom van artikelen luchthavenwinkels</a> [Dutch, Nu.nl]
<p>
<a href="http://translate.google.com/translate?sl=nl&#038;tl=en&#038;js=n&#038;prev=_t&#038;hl=en&#038;ie=UTF-8&#038;eotf=1&#038;u=http%3A%2F%2Fwww.nu.nl%2Falgemeen%2F3391356%2Fonderzoeker-maakt-bom-van-artikelen-luchthavenwinkels.html"> Researcher makes bomb Articles airport shops </a> [Google Translate]
<p>
(<i>via <a href="http://slashdot.org">/.</a></i>)



]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/04/07/lethal-weapons-from-duty-free.html/feed</wfw:commentRss>
		<slash:comments>29</slash:comments>
		</item>
		<item>
		<title>Mid-Century Modern housing designs vs&#160;children</title>
		<link>http://boingboing.net/2013/04/07/mid-century-modern-housing-des.html</link>
		<comments>http://boingboing.net/2013/04/07/mid-century-modern-housing-des.html#comments</comments>
		<pubDate>Sun, 07 Apr 2013 15:18:38 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[architecture]]></category>
		<category><![CDATA[design]]></category>
		<category><![CDATA[free range kids]]></category>
		<category><![CDATA[Funny]]></category>
		<category><![CDATA[Kids]]></category>
		<category><![CDATA[parenting]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=223235</guid>
		<description><![CDATA[<p>
<img src="http://boingboing.net/wp-content/uploads/2013/04/ledge5redarrow-e13619337165911.jpg" class="bordered"/><br />
Projectophile's Clare has a funny post about the hazards presented by beautiful mid-century modern home designs to children. My grandparents had a proper split-level MCM when I was a kid, and it's a wonder we survived. As Clare says, "I love open, flowing space as much as the next modern girl.</p>]]></description>
			<content:encoded><![CDATA[
<p>
<img src="http://boingboing.net/wp-content/uploads/2013/04/ledge5redarrow-e13619337165911.jpg" class="bordered"><br />
Projectophile's Clare has a funny post about the hazards presented by beautiful mid-century modern home designs to children. My grandparents had a proper split-level MCM when I was a kid, and it's a wonder we survived. As Clare says, "I love open, flowing space as much as the next modern girl. But I know it would only be a matter of minutes before my kid flings himself off one of these deadly ledges..."

<p>
<a href="http://projectophile.wordpress.com/2013/02/27/mid-century-modern-dream-homes-that-will-kill-your-children/">15 Mid-Century Modern Dream Homes that will Kill Your Children</a>

(<i>via <a href="http://metafilter.com">MeFi</a></i>)

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/04/07/mid-century-modern-housing-des.html/feed</wfw:commentRss>
		<slash:comments>99</slash:comments>
		</item>
		<item>
		<title>Apple&#039;s security&#160;problems</title>
		<link>http://boingboing.net/2013/03/29/apples-security-problems.html</link>
		<comments>http://boingboing.net/2013/03/29/apples-security-problems.html#comments</comments>
		<pubDate>Fri, 29 Mar 2013 17:02:34 +0000</pubDate>
		<dc:creator>Rob Beschizza</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[tech]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=222196</guid>
		<description><![CDATA[<p>At <em>The Verge</em>, Tim Carmody reports on <a href="http://www.theverge.com/2013/3/29/4158594/password-denied-when-will-apple-get-serious-about-security">Apple's seeming inability to get to grips with account security.</a>

<blockquote><p>"The conventional wisdom is that this was a run-of-the-mill software security issue. ... No. It isn’t. It’s a troubling symptom that suggests Apple’s self-admittedly bumpy transition from a maker of beautiful devices to a fully-fledged cloud services provider still isn’t going smoothly.</p></blockquote></p>]]></description>
			<content:encoded><![CDATA[<p>At <em>The Verge</em>, Tim Carmody reports on <a href="http://www.theverge.com/2013/3/29/4158594/password-denied-when-will-apple-get-serious-about-security">Apple's seeming inability to get to grips with account security.</a>

<blockquote><p>"The conventional wisdom is that this was a run-of-the-mill software security issue. ... No. It isn’t. It’s a troubling symptom that suggests Apple’s self-admittedly bumpy transition from a maker of beautiful devices to a fully-fledged cloud services provider still isn’t going smoothly. Meanwhile, your Apple ID password has come a long way from the short string of characters you tap to update apps on your iPhone. It now offers access to Apple’s entire ecosystem of devices, stores, software, and services."</blockquote>
]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/29/apples-security-problems.html/feed</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Why security awareness training is a waste of&#160;time</title>
		<link>http://boingboing.net/2013/03/27/why-security-awareness-trainin.html</link>
		<comments>http://boingboing.net/2013/03/27/why-security-awareness-trainin.html#comments</comments>
		<pubDate>Thu, 28 Mar 2013 04:28:04 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[web theory]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=221450</guid>
		<description><![CDATA[<p>
Bruce Schneier presents a very cogent and convincing argument that "security awareness training" is a waste of money -- specifically, because the benefits of "security" are intangible, while the benefits of getting your work done are apparent.

<blockquote>
<p>


To those who think that training users in security is a good idea, I want to ask: "Have you ever met an actual user?" They're not experts, and we can't expect them to become experts.</p></blockquote></p>]]></description>
			<content:encoded><![CDATA[

<p>
Bruce Schneier presents a very cogent and convincing argument that "security awareness training" is a waste of money -- specifically, because the benefits of "security" are intangible, while the benefits of getting your work done are apparent.

<blockquote>
<p>


To those who think that training users in security is a good idea, I want to ask: "Have you ever met an actual user?" They're not experts, and we can't expect them to become experts. The threats change constantly, the likelihood of failure is low, and there is enough complexity that it's hard for people to understand how to connect their behavior to eventual outcomes. So they turn to folk remedies that, while simple, don't really address the threats.
<p>
Even if we could invent an effective computer security training program, there's one last problem. HIV prevention training works because affecting what the average person does is valuable. Even if only half the population practices safe sex, those actions dramatically reduce the spread of HIV. But computer security is often only as strong as the weakest link. If four-fifths of company employees learn to choose better passwords, or not to click on dodgy links, one-fifth still get it wrong and the bad guys still get in. As long as we build systems that are vulnerable to the worst case, raising the average case won't make them more secure.
<p>
The whole concept of security awareness training demonstrates how the computer industry has failed. We should be designing systems that won't let users choose lousy passwords and don't care what links a user clicks on. We should be designing systems that conform to their folk beliefs of security, rather than forcing them to learn new ones. Microsoft has a great rule about system messages that require the user to make a decision. They should be NEAT: necessary, explained, actionable, and tested. That's how we should be designing security interfaces. And we should be spending money on security training for developers. These are people who can be taught expertise in a fast-changing environment, and this is a situation where raising the average behavior increases the security of the overall system.
</blockquote>

<p>
<a href="http://www.schneier.com/blog/archives/2013/03/security_awaren_1.html">Security Awareness Training</a>

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/27/why-security-awareness-trainin.html/feed</wfw:commentRss>
		<slash:comments>14</slash:comments>
		</item>
		<item>
		<title>Back issues of the NSA&#039;s secret, in-house&#160;mag</title>
		<link>http://boingboing.net/2013/03/27/back-issues-of-the-nsas-secr.html</link>
		<comments>http://boingboing.net/2013/03/27/back-issues-of-the-nsas-secr.html#comments</comments>
		<pubDate>Wed, 27 Mar 2013 14:40:41 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[Old school]]></category>
		<category><![CDATA[secrecy]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=221263</guid>
		<description><![CDATA[<p>
<img src="http://craphound.com/images/cryptolog_01.pdf-pages.jpg" class="bordered"/><br />
The National Security Agency has released an archive of back issues of <em>Cryptolog</em>, its secret, in-house magazine, in a repository spanning 1974 to 1997. The issues are heavily redacted in places, but still look like a promising source of interesting and curious facts.</p>]]></description>
			<content:encoded><![CDATA[
<p>
<img src="http://craphound.com/images/cryptolog_01.pdf-pages.jpg" class="bordered"><br />
The National Security Agency has released an archive of back issues of <em>Cryptolog</em>, its secret, in-house magazine, in a repository spanning 1974 to 1997. The issues are heavily redacted in places, but still look like a promising source of interesting and curious facts. 
<p>
<a href="http://www.nsa.gov/public_info/declass/cryptologs.shtml">Cryptologs</a>
<p>
<a href="http://www.nsa.gov/public_info/_files/cryptologs/cryptolog_01.pdf">Mirror</a>
<p>
(<i>via <a href="https://www.schneier.com/">Schneier</a></i>)

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/27/back-issues-of-the-nsas-secr.html/feed</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>DDoS storm breaks records at 300&#160;Gbps</title>
		<link>http://boingboing.net/2013/03/27/ddos-storm-breaks-records-at-3.html</link>
		<comments>http://boingboing.net/2013/03/27/ddos-storm-breaks-records-at-3.html#comments</comments>
		<pubDate>Wed, 27 Mar 2013 13:22:00 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[ddos]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[web theory]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=221260</guid>
		<description><![CDATA[<p>
The Internet has been groaning under the weight of a massive distributed denial of service (DDoS) attack on the Domain Name Service, apparently aimed at anti-spam vigilantes Spamhaus, in retaliation for their blacklisting of Dutch free speech hosting provider Cyberbunker. At 300 mbps, the DDoS is the worst in public Internet history.</p>]]></description>
			<content:encoded><![CDATA[<p>
The Internet has been groaning under the weight of a massive distributed denial of service (DDoS) attack on the Domain Name Service, apparently aimed at anti-spam vigilantes Spamhaus, in retaliation for their blacklisting of Dutch free speech hosting provider Cyberbunker. At 300 mbps, the DDoS is the worst in public Internet history.



<blockquote>
<p>
 “These things are essentially like nuclear bombs,” said Matthew Prince, chief executive of Cloudflare. “It’s so easy to cause so much damage.”
<p>
The so-called distributed denial of service, or DDoS, attacks have reached previously unknown magnitudes, growing to a data stream of 300 billion bits per second.
<p>
“It is a real number,” Mr. Gilmore said. “It is the largest publicly announced DDoS attack in the history of the Internet.”
<p>
Spamhaus, one of the most prominent groups tracking spammers on the Internet, uses volunteers to identify spammers and has been described as an online vigilante group.
<p>
In the past, blacklisted sites have retaliated against Spamhaus with denial-of-service attacks, in which they flood Spamhaus with traffic requests from personal computers until its servers become unreachable. But in recent weeks, the attackers hit back with a far more powerful strike that exploited the Internet’s core infrastructure, called the Domain Name System, or DNS. 
</blockquote>

<p>
As bad as this is, it could be a <em>lot</em> worse. An anonymous paper called <a href="http://internetcensus2012.bitbucket.org/paper.html">Internet Census 2012: Port scanning /0 using insecure embedded devices</a> reports on a researcher's project to scan every IPv4 address for publicly available machines that will accept a telnet connection and yield up a root login to a default password. The researcher reports that 1.2 million such devices are available online (s/he compromised many of these machines in order to run the census). These machines are things like printers and routers with badly secured firmware, visible on the public net. They are often running an old version of GNU/Linux and can be hijacked to form part of a staggeringly large botnet that would be virtually unkillable, since the owners of these devices are vanishingly unlikely to notice that they are silently running attackware, and the devices themselves are completely unregarded.

<p>
<a href="http://www.nytimes.com/2013/03/27/technology/internet/online-dispute-becomes-internet-snarling-attack.html?pagewanted=all&#038;_r=0">Firm Is Accused of Sending Spam, and Fight Jams Internet</a> [NYT/John Markoff &#038; Nicole Perlroth]
<p>
(<i>via <a href="https://news.ycombinator.com/">Hacker News</a></i>)

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/27/ddos-storm-breaks-records-at-3.html/feed</wfw:commentRss>
		<slash:comments>30</slash:comments>
		</item>
		<item>
		<title>Nuts-and-bolts look at password&#160;cracking</title>
		<link>http://boingboing.net/2013/03/26/nuts-and-bolts-look-at-passwor.html</link>
		<comments>http://boingboing.net/2013/03/26/nuts-and-bolts-look-at-passwor.html#comments</comments>
		<pubDate>Wed, 27 Mar 2013 03:05:04 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[passwords]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[web theory]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=220697</guid>
		<description><![CDATA[<p>
<img src="http://boingboing.net/wp-content/uploads/2013/03/cracking2-640x480.png2.jpg" class="bordered"/><br />
Ars Technica's Nate Anderson decided to try cracking passwords (from a leaked file of MD5 hashes), to see how difficult it was. After a very long false start (he forgot to decompress the word-list file) that's covered in a little too much detail, Anderson settles down to cracking hashes in earnest, and provides some good data on the nuts and bolts of password security:


<blockquote>
<p>
By this point I had puzzled out how Hashcat worked, so I dumped the GUI and switched back to the command-line version running on my much faster MacBook Air.</p></blockquote></p>]]></description>
			<content:encoded><![CDATA[

<p>
<img src="http://boingboing.net/wp-content/uploads/2013/03/cracking2-640x480.png2.jpg" class="bordered"><Br>
Ars Technica's Nate Anderson decided to try cracking passwords (from a leaked file of MD5 hashes), to see how difficult it was. After a very long false start (he forgot to decompress the word-list file) that's covered in a little too much detail, Anderson settles down to cracking hashes in earnest, and provides some good data on the nuts and bolts of password security:


<blockquote>
<p>
By this point I had puzzled out how Hashcat worked, so I dumped the GUI and switched back to the command-line version running on my much faster MacBook Air. My goal was to figure out how many hashes I could crack in, say, under 30 minutes, as well as which attacks were most efficient. I began again on my 17,000-hash file, this time having Hashcat remove each hash from the file once it was cracked. This way I knew exactly how many hashes each attack solved.
<p>


This set of attacks brought the number of uncracked MD5 hashes down from 17,000 to 8,790, but clearly the best "bang for the buck" came from running the RockYou list with the best64.rule iterations. In just 90 seconds, this attack would uncover 45 percent of the hashed passwords; additional attacks did little more, even those that took 16 minutes to run.
<p>
Cracking a significant number of the remaining passwords would take some much more serious effort. Applying the complex d3ad0ne.rule file to the massive RockYou dictionary, for instance, would require more than two hours of fan-spinning number-crunching. And brute force attacks using 6-character passwords only picked up a few additional results.

</blockquote>
<p>
The point, really, is that if you want to understand the relative security of different password-generation techniques, you need to understand what's involved in state-of-the-art password cracking techniques.
<p>
<a href="http://arstechnica.com/security/2013/03/how-i-became-a-password-cracker/">How I became a password cracker</a>

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/26/nuts-and-bolts-look-at-passwor.html/feed</wfw:commentRss>
		<slash:comments>22</slash:comments>
		</item>
		<item>
		<title>Abandoned cake-box at airport turns into inadvertent Portal-themed security&#160;worry</title>
		<link>http://boingboing.net/2013/03/26/abandoned-cake-box-at-airport.html</link>
		<comments>http://boingboing.net/2013/03/26/abandoned-cake-box-at-airport.html#comments</comments>
		<pubDate>Wed, 27 Mar 2013 00:32:38 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[aviation]]></category>
		<category><![CDATA[cake]]></category>
		<category><![CDATA[Funny]]></category>
		<category><![CDATA[Games]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=220988</guid>
		<description><![CDATA[<p>
<img src="http://boingboing.net/wp-content/uploads/2013/03/cake-box-at-airport2.jpg" class="bordered"/><br />
An empty cake-shipping box abandoned at the Tampa airport reportedly freaked out passengers and Portal players: "My visit to Tampa has drawn to a close, and The Lady just dropped me off at the airport. Right by the Air Canada entrance, this styrofoam box marked “CAKE” has been unnerving passengers.</p>]]></description>
			<content:encoded><![CDATA[
<p>
<img src="http://boingboing.net/wp-content/uploads/2013/03/cake-box-at-airport2.jpg" class="bordered"><br />
An empty cake-shipping box abandoned at the Tampa airport reportedly freaked out passengers and Portal players: "My visit to Tampa has drawn to a close, and The Lady just dropped me off at the airport. Right by the Air Canada entrance, this styrofoam box marked “CAKE” has been unnerving passengers. It’s empty — it probably held cake for transport but was too big to fit into the car that picked it up — but I let some airport staff know that it was beginning to worry some people. Namely, the security-conscious and Portal players."

<p>
<a href="http://www.joeydevilla.com/2013/03/25/unnerving-people-at-the-airport-or-the-cake-is-a-lie/">Unnerving People at the Airport (or: The Cake is a Lie!)</a>

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/26/abandoned-cake-box-at-airport.html/feed</wfw:commentRss>
		<slash:comments>16</slash:comments>
		</item>
		<item>
		<title>Your WiFi-enabled camera might be spying on&#160;you</title>
		<link>http://boingboing.net/2013/03/26/your-wifi-enabled-camera-might.html</link>
		<comments>http://boingboing.net/2013/03/26/your-wifi-enabled-camera-might.html#comments</comments>
		<pubDate>Tue, 26 Mar 2013 16:45:04 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[web theory]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=220952</guid>
		<description><![CDATA[Every networked sensor package in your immediate vicinity can be used to spy on you unless it is well-designed and transparent to you and the wide community of security researchers.]]></description>
			<content:encoded><![CDATA[
<!--http://www.youtube.com/watch?v=u7RjJNLnWF8--><div class="video-container"><iframe width="600" height="338" src="http://www.youtube.com/embed/u7RjJNLnWF8?showinfo=0" frameborder="0" allowfullscreen></iframe></div>

<p>
Every networked sensor package in your immediate vicinity can be used to spy on you unless it is well-designed and transparent to you and the wide community of security researchers. If that sounds paranoid, check out the video above, wherein some security researchers show that they can covertly operate WiFi-enabled personal cameras and turn them into bugs. 

<blockquote>
<p>

But, as proven by Daniel Mende and Pascal Turbing, security researchers with German-based IT consulting firm ERNW, these capabilities also have security flaws that can be easily exploited for turning these cameras into spying devices.
<p>
Mende and Turbing chose to compromise Canon's EOS-1D X DSLR camera an exploit each of the four ways it can communicate with a network. Not only have they been able to hijack the information sent from the camera, but have also managed to gain complete control of it.
<p>
In this presentation from Shmoocon 2013, they explained in detail how they managed to mount the attacks, and have also offered advice for users on how to secure their cameras and connections against these and similar attacks.
</blockquote>
<p>
Stuff like this is why DRM and EULAs are so insidious. The existence of devices that attack their owners affects us all. It is a public health problem. Any time we pass a law that makes it illegal or legally perilous to point out flaws in technology, we make it harder to solve the public health problem, and we're all at risk.


<p>
<a href="http://www.net-security.org/secworld.php?id=14651">
Digital cameras easily turned into spying devices, researchers prove</a>

(<i>via <a href="http://slashdot.org">/.</a></i>)






]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/26/your-wifi-enabled-camera-might.html/feed</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Skype&#039;s IP-leaking security bug creates denial-of-service cottage&#160;industry</title>
		<link>http://boingboing.net/2013/03/22/skypes-ip-leaking-security-b.html</link>
		<comments>http://boingboing.net/2013/03/22/skypes-ip-leaking-security-b.html#comments</comments>
		<pubDate>Sat, 23 Mar 2013 01:04:14 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[ddos]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[skype]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=220291</guid>
		<description><![CDATA[<p>
<img src="http://boingboing.net/wp-content/uploads/2013/03/anonyresolver.png1.jpg" class="bordered"/><br />
It's been more than a year since the <em>WSJ</em> reported that Skype leaks its users' IP addresses and locations. Microsoft has done nothing to fix this since, and as Brian Krebs reports, the past year has seen the rise of several tools that let you figure out someone's IP address by searching for him on Skype, then automate launching denial-of-service attacks on that person's home.</p>]]></description>
			<content:encoded><![CDATA[

<p>
<img src="http://boingboing.net/wp-content/uploads/2013/03/anonyresolver.png1.jpg" class="bordered"><br />
It's been more than a year since the <em>WSJ</eM> reported that Skype leaks its users' IP addresses and locations. Microsoft has done nothing to fix this since, and as Brian Krebs reports, the past year has seen the rise of several tools that let you figure out someone's IP address by searching for him on Skype, then automate launching denial-of-service attacks on that person's home.

<blockquote>
<p>


In the above screen shot, we can see one such service being used to display the IP address most recently used by the Skype account “mailen_support” (this particular account belongs to the tech support contact for Mailien, a Russian pharmacy spam affiliate program by the same name).

<p>
Typically, these Skype resolvers are offered in tandem with “booter” or “stresser” services, online attack tools-for-hire than can be rented to launch denial-of-service attacks (one of these services was used in an attack on this Web site, and on that of Ars Technica last week). The idea being that if you want to knock someone offline but you don’t know their Internet address, you can simply search on Skype to see if they have an account. The resolvers work regardless of any privacy settings the target user may have selected within the Skype program’s configuration panel.
<p>
Beyond exposing one’s Internet connection to annoying and disruptive attacks, this vulnerability could allow stalkers or corporate rivals to track the movement of individuals and executives as they travel between cities and states.
</blockquote>

<p>
<a href="http://krebsonsecurity.com/2013/03/privacy-101-skype-leaks-your-location/">Privacy 101: Skype Leaks Your Location</a>

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/22/skypes-ip-leaking-security-b.html/feed</wfw:commentRss>
		<slash:comments>23</slash:comments>
		</item>
		<item>
		<title>Brian Krebs talks to hacker who may have SWATted him and attacked Wired&#039;s Mat&#160;Honan</title>
		<link>http://boingboing.net/2013/03/19/brian-krebs-talks-to-hacker-wh.html</link>
		<comments>http://boingboing.net/2013/03/19/brian-krebs-talks-to-hacker-wh.html#comments</comments>
		<pubDate>Tue, 19 Mar 2013 22:07:46 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[christ what an asshole]]></category>
		<category><![CDATA[petard]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[videos]]></category>
		<category><![CDATA[youtube]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=219567</guid>
		<description><![CDATA[<!--http://www.youtube.com/watch?v=EB2BkYbeACI--><div class="video-container"><iframe width="600" height="338" src="http://www.youtube.com/embed/EB2BkYbeACI?showinfo=0" frameborder="0" allowfullscreen></iframe></div>

<p>

Last week, Brian Krebs (a respected security researcher and journalist who often publishes details about high-tech crime) was <a href="http://boingboing.net/2013/03/15/internet-security-writer-ddos.html">SWATted</a> -- that is, someone defrauded his local police department into sending a SWAT team to his house, resulting in his getting confronted by gun-wielding, hair-trigger cops who had him lie on the ground and cuffed him before it was all sorted out.</p>]]></description>
			<content:encoded><![CDATA[
<!--http://www.youtube.com/watch?v=EB2BkYbeACI--><div class="video-container"><iframe width="600" height="338" src="http://www.youtube.com/embed/EB2BkYbeACI?showinfo=0" frameborder="0" allowfullscreen></iframe></div>

<p>

Last week, Brian Krebs (a respected security researcher and journalist who often publishes details about high-tech crime) was <a href="http://boingboing.net/2013/03/15/internet-security-writer-ddos.html">SWATted</a> -- that is, someone defrauded his local police department into sending a SWAT team to his house, resulting in his getting confronted by gun-wielding, hair-trigger cops who had him lie on the ground and cuffed him before it was all sorted out.
<p>
Krebs, being a talented investigator, is hot on the trail of the people or person responsible for this. And a variety of sources point to a 20-year-old hacker who goes by "Phobia," and whose real name, according to Krebs, is Ryan Stevenson. Phobia was implicated in the <a href="http://boingboing.net/2012/08/06/mat-honan-on-being-hacked.html">attack on Wired reporter Mat Honan</a>, wherein his laptop drive and online backup were deleted, including irreplaceable photos of his child's first year, and eight years' worth of email.
<p>
Krebs phoned "Phobia" up and ended up speaking to Phobia and his father. Phobia denied attacking Krebs and insisted that he had nothing to do with the gamer/fraudster clan behind it (though Krebs pointed out that Phobia can be heard speaking in the group's YouTube videos, which document their attacks), but admitted that he had been the culprit in hacking Honan (his father then came onto the line to deny this). The transcript is the most interesting part of the piece:

<blockquote>
<p>


BK: Uh huh. And is Honan referring to you in this article?
<p>
RS: Yeah.
<p>
BK Yes?
<p>
RS: Uh huh.
<p>
BK: Did anything bad ever happen to you because of this?
<p>
RS: No.
<p>
BK: So, this was your doing with the Mat Honan hack, but you say you would never use a site like a stresser or…
<p>
RS: Yeah, I would never do that. That’s stupid.
<p>
BK: …or hack a reporter’s account or launch a denial of service attack against a reporter, or SWAT his house….
<p>
RS: <extended silence>
<p>
BK: So what’s the point of hacking a reporter’s iCloud account? Why’d you do that?
<p>
RS: Just to prove a point that, like…the security is breachable.
</blockquote>


<p>
<a href="http://krebsonsecurity.com/2013/03/the-obscurest-epoch-is-today/">The Obscurest Epoch is Today</a>

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/19/brian-krebs-talks-to-hacker-wh.html/feed</wfw:commentRss>
		<slash:comments>14</slash:comments>
		</item>
		<item>
		<title>Casino cheats used house CCTVs to score&#160;$32M</title>
		<link>http://boingboing.net/2013/03/18/the-cameras-at-crown-are-state.html</link>
		<comments>http://boingboing.net/2013/03/18/the-cameras-at-crown-are-state.html#comments</comments>
		<pubDate>Tue, 19 Mar 2013 03:12:24 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[australia]]></category>
		<category><![CDATA[cctv]]></category>
		<category><![CDATA[crime]]></category>
		<category><![CDATA[gambling]]></category>
		<category><![CDATA[petard]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=219357</guid>
		<description><![CDATA[<p>
<iframe src ="http://video.heraldsun.com.au/embed/2344441648/Crown-Casino-in-high-tech-scam?player=narrow" width="330" height="365" frameborder="0" marginheight="0" marginwidth="0" scrolling="no"></iframe>
</p><p>
A rich, high-stakes gambler was dragged out of his opulent comp suite at the  Crown Towers casino in Melbourne, accused of participating in a $32M scam that made use of the casino's own CCTV cameras to cheat. 
</p><p>


<blockquote>
<p>
The Herald Sun understands remote access to the venue's security system was given to an unauthorised person.</p></blockquote></p>]]></description>
			<content:encoded><![CDATA[<p>
<iframe src ="http://video.heraldsun.com.au/embed/2344441648/Crown-Casino-in-high-tech-scam?player=narrow" width="330" height="365" frameborder="0" marginheight="0" marginwidth="0" scrolling="no"></iframe>
<p>
A rich, high-stakes gambler was dragged out of his opulent comp suite at the  Crown Towers casino in Melbourne, accused of participating in a $32M scam that made use of the casino's own CCTV cameras to cheat. 
<p>


<blockquote>
<p>
The Herald Sun understands remote access to the venue's security system was given to an unauthorised person.
<p>
Images relayed from cameras were then used to spy on a top-level gaming area where the high roller was playing.
<p>
Signals were given to him on how he should bet based on the advice of someone viewing the camera feeds. Sources said the total stolen was $32 million.
<p>

<p>
They are capable of transmitting the most intricate detail of goings-on inside the building.
</blockquote>
<p>
Casinos were the world leaders in CCTV use, and really represent ground zero for the panopticon theory of security. What is rarely mentioned is that "security" measures can be turned against defenders if attackers can hijack them. This is as true when a mugger uses his victim's gun against him as it is when a casino's own CCTVs are used to defeat its own anti-cheating measures. This is the high-stakes gambling version of all those IP-based CCTVs that leak sensitive footage of the inside of peoples' houses onto the public Internet.

<P>
<a href="http://www.heraldsun.com.au/news/law-order/crown-casino-hi-tech-scam-nets-32-million/story-fnat79vb-1226597666337">Crown casino hi-tech scam nets $32 million</a> [Mark Buttler/Herald Sun]

<p>
(<i>via <a href="http://slashdot.org">/.</a></i>)

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/18/the-cameras-at-crown-are-state.html/feed</wfw:commentRss>
		<slash:comments>31</slash:comments>
		</item>
		<item>
		<title>Control-Alt-Hack: delightful strategy card game about white-hat&#160;hacking</title>
		<link>http://boingboing.net/2013/03/18/control-alt-hack-delightful-s.html</link>
		<comments>http://boingboing.net/2013/03/18/control-alt-hack-delightful-s.html#comments</comments>
		<pubDate>Mon, 18 Mar 2013 13:17:48 +0000</pubDate>
		<dc:creator>Cory Doctorow</dc:creator>
				<category><![CDATA[Review]]></category>
		<category><![CDATA[Games]]></category>
		<category><![CDATA[gift guide]]></category>
		<category><![CDATA[happy mutants]]></category>
		<category><![CDATA[infosec]]></category>
		<category><![CDATA[Reviews]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=219304</guid>
		<description><![CDATA[<p>
<img src="http://boingboing.net/wp-content/uploads/2013/03/boxcontents.png1.jpg" class="bordered"/><br />
<a href="http://www.amazon.com/exec/obidos/ASIN/B008HIX5KO/downandoutint-20">Control-Alt-Hack</a> is a tremendously fun, hacker-themed strategy card game that uses the mechanic of the classic Steve Jackson <a href="http://www.sjgames.com/ninjaburger/">Ninja Burger</a> game. It comes out of the <a href="http://seclab.cs.washington.edu/">University of Washington Computer Security and Privacy Research Lab</a>, and features extremely entertaining and funny computer-security-themed scenarios, buffs, attacks and characters.</p>]]></description>
			<content:encoded><![CDATA[
<p>
<img src="http://boingboing.net/wp-content/uploads/2013/03/boxcontents.png1.jpg" class="bordered"><br />
<a href="http://www.amazon.com/exec/obidos/ASIN/B008HIX5KO/downandoutint-20">Control-Alt-Hack</a> is a tremendously fun, hacker-themed strategy card game that uses the mechanic of the classic Steve Jackson <a href="http://www.sjgames.com/ninjaburger/">Ninja Burger</a> game. It comes out of the <a href="http://seclab.cs.washington.edu/">University of Washington Computer Security and Privacy Research Lab</a>, and features extremely entertaining and funny computer-security-themed scenarios, buffs, attacks and characters.
<p>
The gameplay is very well-thought-through  (<a href="http://www.controlalthack.com/downloadrules.php">here's a PDF of the rules</a>). Three of us sat down to play it this weekend with only a cursory glance at the rules beforehand. By following the quickstart instructions, we were able to jump straight into play, and within a few turns, we really had the rhythm and were busily sabotaging one another and cursing at the dice when they rolled against our favor.
<p>
Based on my play session, I'm really impressed. Though one player led the game early on, there were several reversals, wherein the leading and trailing players traded places -- always the mark of a great game. There was a good mix of skill, strategy and luck, and things were just complicated enough that it absorbed our full attention, without lagging or flagging.
<p>
A full game takes about an hour, and between three and six people can play at once. We played it after Sunday brunch and it was a great digestive aid. All three of us loved the geeky, info-sec-y references, the funny scenarios (everything from devising a cryptographic protocol for implanted medical devices to pranking a labmate with a gag WiFi keystroke-inserter), and the grace-notes (like a scenario that is encoded as a cryptogram). There were moments of unlikely hail-mary-heroism, crushing defeat, and lots of laughs. We'll play this one again.
<p>
<a href="http://www.amazon.com/exec/obidos/ASIN/B008HIX5KO/downandoutint-20">Control-Alt-Hack: White Hat Hacking for Fun and Profit </a>
<p>
<a href="http://www.controlalthack.com/">Control-Alt-Hack</a> [Publisher's site]

]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/18/control-alt-hack-delightful-s.html/feed</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>MD used &quot;silicone fingers&quot; to trick biometric time clock on colleagues&#039;&#160;behalf</title>
		<link>http://boingboing.net/2013/03/13/md-used-silicon-fingers-to.html</link>
		<comments>http://boingboing.net/2013/03/13/md-used-silicon-fingers-to.html#comments</comments>
		<pubDate>Wed, 13 Mar 2013 19:01:00 +0000</pubDate>
		<dc:creator>David Pescovitz</dc:creator>
				<category><![CDATA[Post]]></category>
		<category><![CDATA[biometrics]]></category>
		<category><![CDATA[crime]]></category>
		<category><![CDATA[prosthetics]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[Weird]]></category>

		<guid isPermaLink="false">http://boingboing.net/?p=218534</guid>
		<description><![CDATA[<img src="http://boingboing.net/wp-content/uploads/2013/03/NewImage45.png" alt="NewImage" title="NewImage.png" border="0" width="304" height="171" class="alignright" />Brazilian doctor Thaune Nunes Ferreira, 29, was arrested for fraud for allegedly covering up her colleagues' absence from work by using prosthetic fingers to sign them in on a biometric time clock at the hospital near Sao Paulo. According to the BBC, "police said she had six silicone fingers with her at the time of her arrest, three of which have already been identified as bearing the fingerprints of co-workers." Ferreira's attorney claims "she was forced into the fraud as she faced losing her job." <em>(<a href="http://www.bbc.co.uk/news/world-latin-america-21756709">BBC News</a>)</em>]]></description>
			<content:encoded><![CDATA[<img src="http://boingboing.net/wp-content/uploads/2013/03/NewImage45.png" alt="NewImage" title="NewImage.png" border="0" width="304" height="171" class="alignright" />Brazilian doctor Thaune Nunes Ferreira, 29, was arrested for fraud for allegedly covering up her colleagues' absence from work by using prosthetic fingers to sign them in on a biometric time clock at the hospital near Sao Paulo. According to the BBC, "police said she had six silicone fingers with her at the time of her arrest, three of which have already been identified as bearing the fingerprints of co-workers." Ferreira's attorney claims "she was forced into the fraud as she faced losing her job." <em>(<a href="http://www.bbc.co.uk/news/world-latin-america-21756709">BBC News</a>)</em>]]></content:encoded>
			<wfw:commentRss>http://boingboing.net/2013/03/13/md-used-silicon-fingers-to.html/feed</wfw:commentRss>
		<slash:comments>20</slash:comments>
		</item>
	</channel>
</rss>
