Page 374
TSA Not Detecting Weapons at Security Checkpoints
This isn’t good:
An internal investigation of the Transportation Security Administration revealed security failures at dozens of the nation’s busiest airports, where undercover investigators were able to smuggle mock explosives or banned weapons through checkpoints in 95 percent of trials, ABC News has learned.
The series of tests were conducted by Homeland Security Red Teams who pose as passengers, setting out to beat the system.
According to officials briefed on the results of a recent Homeland Security Inspector General’s report, TSA agents failed 67 out of 70 tests, with Red Team members repeatedly able to get potential weapons through checkpoints.
The Acting Director of the TSA has been reassigned:
Homeland Security Secretary Jeh Johnson said in a statement Monday that Melvin Carraway would be moved to the Office of State and Local Law Enforcement at DHS headquarters “effective immediately.”
This is bad. I have often made the point that airport security doesn’t have to be 100% effective in detecting guns and bombs. Here I am in 2008:
If you’re caught at airport security with a bomb or a gun, the screeners aren’t just going to take it away from you. They’re going to call the police, and you’re going to be stuck for a few hours answering a lot of awkward questions. You may be arrested, and you’ll almost certainly miss your flight. At best, you’re going to have a very unpleasant day.
This is why articles about how screeners don’t catch every—or even a majority—of guns and bombs that go through the checkpoints don’t bother me. The screeners don’t have to be perfect; they just have to be good enough. No terrorist is going to base his plot on getting a gun through airport security if there’s a decent chance of getting caught, because the consequences of getting caught are too great.
A 95% failure rate is bad, because you can build a plot around sneaking something past the TSA.
I don’t know the details, or what failed. Was it the procedures or training? Was it the technology? Was it the PreCheck program? I hope we’ll learn details, and this won’t be swallowed in the great maw of government secrecy.
EDITED TO ADD: Quip:
David Burge @iowahawkblog
At $8 billion per year, the TSA is the most expensive theatrical production in history.
Fun NSA Surveillance Quizzes
Okay, maybe not so fun.
Quiz 1: “Just How Kafkaesque is the Court that Oversees NSA Spying?”
Quiz 2: “Can You Tell the Difference Between Bush and Obama on the Patriot Act?”
It’s been fourteen hours since a few provisions of the Patriot Act have expired, and the world hasn’t come to an end—at least so far.
US Also Tried Stuxnet Against North Korea
According to a Reuters article, the US military tried to launch Stuxnet against North Korea in addition to Iran:
According to one U.S. intelligence source, Stuxnet’s developers produced a related virus that would be activated when it encountered Korean-language settings on an infected machine.
But U.S. agents could not access the core machines that ran Pyongyang’s nuclear weapons program, said another source, a former high-ranking intelligence official who was briefed on the program.
The official said the National Security Agency-led campaign was stymied by North Korea’s utter secrecy, as well as the extreme isolation of its communications systems.
Friday Squid Blogging: Nutty Conspiracy Theory Involving Both the NSA and SQUID
It’s almost as if they wrote it for me.
These devices, which are known as super conducting quantum interference devices (SQUIDS for short), can be attached to NSA signals intelligence satellites and used to track the electromagnetic fields which surround each of our bodies.
These devices make it possible for agencies like the NSA (National Security Agency) to track any person via signals intelligence satellite 24 hours a day, while using *EEG Heterodyning technology to synchronize these satellites with the unique EMF brainwave print of each American citizen.
Definitely tin-foil-hat territory. I don’t recommend reading it all.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
And apologies for this being late. I forgot to schedule the post.
UN Report on the Value of Encryption to Freedom Worldwide
The United Nation’s Office of the High Commissioner released a report on the value of encryption and anonymity to the world:
Summary: In the present report, submitted in accordance with Human Rights Council resolution 25/2, the Special Rapporteur addresses the use of encryption and anonymity in digital communications. Drawing from research on international and national norms and jurisprudence, and the input of States and civil society, the report concludes that encryption and anonymity enable individuals to exercise their rights to freedom of opinion and expression in the digital age and, as such, deserve strong protection.
Here’s the bottom line:
60. States should not restrict encryption and anonymity, which facilitate and often enable the rights to freedom of opinion and expression. Blanket prohibitions fail to be necessary and proportionate. States should avoid all measures that weaken the security that individuals may enjoy online, such as backdoors, weak encryption standards and key escrows. In addition, States should refrain from making the identification of users a condition for access to digital communications and online services and requiring SIM card registration for mobile users. Corporate actors should likewise consider their own policies that restrict encryption and anonymity (including through the use of pseudonyms). Court-ordered decryption, subject to domestic and international law, may only be permissible when it results from transparent and publicly accessible laws applied solely on a targeted, case-by-case basis to individuals (i.e., not to a mass of people) and subject to judicial warrant and the protection of due process rights of individuals.
One news report called this “wishy-washy when it came to government-mandated backdoors to undermine encryption,” but I don’t see that. Government mandated backdoors, key escrow, and weak encryption are all bad. Corporations should offer their users strong encryption and anonymity. Any systems that still leave corporations with the keys and/or the data—and there are going to be lots of them—should only give them up to the government in the face of an individual and lawful court order.
I think the principles are reasonable.
Ransomware as a Service
Tox is an outsourced ransomware platform that everyone can use.
MOOC on Cybersecurity
The University of Adelaide is offering a new MOOC on “Cyberwar, Surveillance and Security.” Here’s a teaser video. I was interviewed for the class, and make a brief appearance in the teaser.
Terrorist Risks by City, According to Actual Data
I don’t know enough about the methodology to judge it, but it’s interesting:
In total, 64 cities are categorised as ‘extreme risk’ in Verisk Maplecroft’s new Global Alerts Dashboard (GAD), an online mapping and data portal that logs and analyses every reported terrorism incident down to levels of 100m² worldwide. Based on the intensity and frequency of attacks in the 12 months following February 2014, combined with the number and severity of incidents in the previous five years, six cities in Iraq top the ranking. Over this period, the country’s capital, Baghdad, suffered 380 terrorist attacks resulting in 1141 deaths and 3654 wounded, making it the world’s highest risk urban centre, followed by Mosul, Al Ramadi, Ba’qubah, Kirkuk and Al Hillah.
Outside of Iraq, other capital cities rated ‘extreme risk’ include Kabul, Afghanistan (13th most at risk), Mogadishu, Somalia (14th), Sana’a, Yemen (19th) and Tripoli, Libya (48th). However, with investment limited in conflict and post-conflict locations, it is the risk posed by terrorism in the primary cities of strategic economies, such as Egypt, Israel, Kenya, Nigeria and Pakistan that has the potential to threaten business and supply chain continuity.
A news article:
According to the index, which ranks world cities by the likelihood of a terror attack based on historic trends, 64 cities around the world are at “extreme risk” of a terror attack.
Of these, the majority are in the Middle East (27) or Asia (19).
Some 14 are in Africa, where the rise of Boko Haram and al-Shabaab as well as political instability have increased risk.Three are in Europe—Luhansk (46) and Donetsk (56) in Ukraine, and Grozy (54) in Russia—while Colombia’s Cali (59) is the only South American city on the list.
No US city makes the list.
Race Condition Exploit in Starbucks Gift Cards
A researcher was able to steal money from Starbucks by exploiting a race condition in its gift card value-transfer protocol. Basically, by initiating two identical web transfers at once, he was able to trick the system into recording them both. Normally, you could take a $5 gift card and move that money to another $5 gift card, leaving you with an empty gift card and a $10 gift card. He was able to duplicate the transfer, giving him an empty gift card and a $15 gift card.
Race-condition attacks are unreliable and it took him a bunch of tries to get it right, but there’s no reason to believe that he couldn’t have kept doing this forever.
Unfortunately, there was really no one at Starbucks he could tell this to:
The hardest part—responsible disclosure. Support guy honestly answered there’s absolutely no way to get in touch with technical department and he’s sorry I feel this way. Emailing InformationSecurityServices@starbucks.com on March 23 was futile (and it only was answered on Apr 29). After trying really hard to find anyone who cares, I managed to get this bug fixed in like 10 days.
The unpleasant part is a guy from Starbucks calling me with nothing like “thanks” but mentioning “fraud” and “malicious actions” instead. Sweet!
A little more from BBC News:
A spokeswoman for Starbucks told BBC News: “After this individual reported he was able to commit fraudulent activity against Starbucks, we put safeguards in place to prevent replication.”
The company did not answer questions about its response to Mr Homakov.
More info.
Sidebar photo of Bruce Schneier by Joe MacInnis.