Page 497

Webmail as Dead Drop

I noticed this amongst the details of the Petraeus scandal:

Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email traffic, one of the law enforcement officials said.

Rather than transmitting emails to the other’s inbox, they composed at least some messages and instead of transmitting them, left them in a draft folder or in an electronic “dropbox,” the official said. Then the other person could log onto the same account and read the draft emails there. This avoids creating an email trail that is easier to trace.

I remember that the 9/11 terrorists did this.

Tags: ,

Posted on November 14, 2012 at 12:28 PM • View Comments

Keys to the Crown Jewels Stolen?

At least, that’s the story:

The locks at the Tower of London, home to the Crown Jewels, had to be
changed after a burglar broke in and stole keys.

The intruder scaled gates and took the keys from a sentry post.

Guards spotted him but couldn’t give chase as they are not allowed to leave their posts.

But the story has been removed from the Mirror’s website. This is the only other link I have. Anyone have any idea if this story is true or not?

ETA (11/14): According to this BBC article, keys for a restaurant, conference rooms, and an internal lock to the drawbridges were on the stolen key set, but the Crown Jewels were never at risk.

Tags: , ,

Posted on November 14, 2012 at 5:57 AM • View Comments

Fairy Wren Passwords

Mother fairy wrens teach their chicks passwords while they’re still in their eggs to tell them from cuckoo impostors:

She kept 15 nests under constant audio surveillance, and discovered that fairy-wrens call to their unhatched chicks, using a two-second trill with 19 separate elements to it. They call once every four minutes while sitting on their eggs, starting on the 9th day of incubation and carrying on for a week until the eggs hatch.

When Colombelli-Negrel recorded the chicks after they hatched, she heard that their begging call included a single unique note lifted from mum’s incubation call. This note varies a lot between different fairy-wren broods. It’s their version of a surname, a signature of identity that unites a family. The females even teach these calls to their partners, by using them in their own begging calls when the males return to the nest with food.

These signature calls aren’t innate. The chicks’ calls more precisely matched those of their mother if she sang more frequently while she was incubating. And when Colombelli-Negrel swapped some eggs between different clutches, she found that the chicks made signature calls that matches those of their foster parents rather than those of their biological ones. It’s something they learn while still in their eggs.

It’s worth noting that this is primarily of use to the chicks’ parents, so they know not to expend time and energy on the impostor cuckoo chick. Cuckoo chicks, as part of their evolutionary adaptation, kick the real chicks out of the nest, so they’re lost in any case. It’s the fact that the signal allows the parents to identify impostors and start a new brood that’s of evolutionary advantage.

Additional articles.

Tags: ,

Posted on November 12, 2012 at 1:03 PM • View Comments

Encryption in Cloud Computing

This article makes the important argument that encryption—where the user and not the cloud provider holds the keys—is critical to protect cloud data. The problem is, it upsets cloud providers’ business models:

In part it is because encryption with customer controlled keys is inconsistent with portions of their business model. This architecture limits a cloud provider’s ability to data mine or otherwise exploit the users’ data. If a provider does not have access to the keys, they lose access to the data for their own use. While a cloud provider may agree to keep the data confidential (i.e., they won’t show it to anyone else) that promise does not prevent their own use of the data to improve search results or deliver ads. Of course, this kind of access to the data has huge value to some cloud providers and they believe that data access in exchange for providing below-cost cloud services is a fair trade.

Also, providing onsite encryption at rest options might require some providers to significantly modify their existing software systems, which could require a substantial capital investment.

That second reason is actually very important, too. A lot of cloud providers don’t just store client data, they do things with that data. If the user encrypts the data, it’s an opaque blob to the cloud provider—and a lot of cloud services would be impossible.

Lots of companies are trying really hard to solve parts of this problem, but a truly optimal solution still eludes us.

Tags: ,

Posted on November 12, 2012 at 5:47 AM • View Comments

How To Tell if Your Hotel Guest Is a Terrorist

From the Department of Homeland Security, a handy list of 19 suspicious behaviors that could indicate that a hotel guest is actually a terrorist.

I myself have done several of these.

More generally, this is another example of why all the “see something say something” campaigns fail: “If you ask amateurs to act as front-line security personnel, you shouldn’t be surprised when you get amateur security.“

Tags: ,

Posted on November 9, 2012 at 1:32 PM • View Comments

How Terrorist Groups Disband

Interesting research from RAND:

Abstract: How do terrorist groups end? The evidence since 1968 indicates that terrorist groups rarely cease to exist as a result of winning or losing a military campaign. Rather, most groups end because of operations carried out by local police or intelligence agencies or because they join the political process. This suggests that the United States should pursue a counterterrorism strategy against al Qa’ida that emphasizes policing and intelligence gathering rather than a “war on terrorism” approach that relies heavily on military force.

This, of course, should surprise no one. Remember the work of Max Abrahms.

Tags: ,

Posted on November 9, 2012 at 6:41 AM • View Comments

Gary McGraw on National Cybersecurity

Good essay, making the point that cyberattack and counterattack aren’t very useful—actual cyberdefense is what’s wanted.

Creating a cyber-rock is cheap. Buying a cyber-rock is even cheaper since zero-day attacks exist on the open market for sale to the highest bidder. In fact, if the bad guy is willing to invest time rather than dollars and become an insider, cyber-rocks may in fact be free of charge, but that is a topic for another time.

Given these price tags, it is safe to assume that some nations have already developed a collection of cyber-rocks, and that many other nations will develop a handful of specialized cyber-rocks (e.g., as an extension of many-year-old regional conflicts). If we follow the advice of Hayden and Chabinsky, we may even distribute cyber-rocks to private corporations.

Obviously, active defense is folly if all it means is unleashing the cyber-rocks from inside of our glass houses since everyone can or will have cyber-rocks. Even worse, unlike very high explosives, or nuclear materials, or other easily trackable munitions (part of whose deterrence value lies in others knowing about them), no one will ever know just how many or what kind of cyber-rocks a particular group actually has.

Now that we have established that cyber-offense is relatively easy and can be accomplished on the cheap, we can see why reliance on offense alone is inadvisable. What are we going to do to stop cyberwar from starting in the first place? The good news is that war has both defensive and offensive aspects, and understanding this fundamental dynamic is central to understanding cyberwar and deterrence.

The kind of defense I advocate (called “passive defense” or “protection” above) involves security engineering—building security in as we create our systems, knowing full well that they will be attacked in the future. One of the problems to overcome is that exploits are sexy and engineering is, well, not so sexy.

Tags: ,

Posted on November 8, 2012 at 1:24 PM • View Comments

Micromorts

Here’s a great concept: a micromort:

Shopping for coffee you would not ask for 0.00025 tons (unless you were naturally irritating), you would ask for 250 grams. In the same way, talking about a 1/125,000 or 0.000008 risk of death associated with a hang-gliding flight is rather awkward. With that in mind. Howard coined the term “microprobability” (μp) to refer to an event with a chance of 1 in 1 million and a 1 in 1 million chance of death he calls a “micromort” (μmt). We can now describe the risk of hang-gliding as 8 micromorts and you would have to drive around 3,000km in a car before accumulating a risk of 8 μmt, which helps compare these two remote risks.

There’s a related term, microlife, for things that reduce your lifespan. A microlife is 30 minutes off your life expectancy. So smoking two cigarettes has a cost of one microlife.

Tags:

Posted on November 8, 2012 at 6:57 AM • View Comments

← Earlier EntriesLater Entries →

Sidebar photo of Bruce Schneier by Joe MacInnis.