Embedding Iris Watermarking in Photos
Canon has filed a patent on embedding an iris scan of the photographer in the metadata of photographs, presumably secured with a digital signature.
Entries Tagged "authentication"
Page 19 of 28
Cloned Trucks
Criminals are using cloned trucks to bypass security:
Savvy criminals are using some of the country’s most credible logos, including FedEx, Wal-Mart, DirecTV and the U.S. Border Patrol, to create fake trucks to smuggle drugs, money and illegal aliens across the border, according to a report by the Florida Department of Law Enforcement.
[…]
In August 2006, the Texas Department of Public Safety, on a routine traffic stop, found 3,058 pounds of marijuana and 204 kilograms of cocaine in a “cloned” Wal-Mart semi-trailer, driven by a man wearing a Wal-Mart uniform.
In another case, a truck painted with DirecTV and other markings was pulled over in a routine traffic stop in Mississippi and discovered to be carrying 786 pounds of cocaine.
This is the same problem as fake uniforms, and the more general problem of fake credentials. It’s very hard to solve.
EDITED TO ADD (2/6): Here’s someone who puts on a red shirt and predends to be a Target employee so he can steal stuff:
Police in North Miami Beach are looking for a man they say likes to pose as a Target employee while stealing pricey iPods, and the man allegedly knows so much about the store, he’s even helped customers who thought he was a real employee.
[…]
Investigators say McKenzie simply walks into the stores, wearing a red polo shirt, and pretends he works there. North Miami Beach police officials say he has extensive knowledge of Target procedures and has even assisted customers.
SmartWater Works
Almost three years ago I blogged about SmartWater: liquid imbued with a uniquely identifiable DNA-style code. In my post I made the snarky comment:
The idea is for me to paint this stuff on my valuables as proof of ownership. I think a better idea would be for me to paint it on your valuables, and then call the police.
That remark aside, a new university study concludes that it works:
The study of over 100 criminals revealed that simply displaying signs that goods and premises were protected by SmartWater was sufficient to put off most of the criminals the team interviewed.
Professor Gill said: “According to our sample, SmartWater provided a strong projected deterrent value in that 74 per cent of the offenders interviewed reported that they would in the future be put off from breaking into a building with a SmartWater poster/sign displayed.
“Overall, the findings indicate that crime reduction strategies using SmartWater products have a strong deterrent effect. In particular, one notable finding of the study was that whilst ‘property marking’ in general acts as a reasonable deterrent, the combination of forensic products which SmartWater uses in its holistic approach increases the deterrent factor substantially.”
When scored out of ten by respondents in regard to deterrent value, SmartWater was awarded the highest average score (8.3 out of a score of 10) compared to a range of other crime deterrents. CCTV scored 6.2, Burglar Alarms scored 6.0 and security guards scored 4.9.
Of course, we don’t know if the study was sponsored by SmartWater the company, and we don’t know the methodology—interviewing criminals about what deters them is fraught with potential biases—but it’s still interesting.
Also note that SmartWater is not only sprayed on valuables, but also sprayed on burglars and criminals—tying them to the crime scene.
"Responsible Behavior"
This one is pretty funny, too.
"Security Question"
Short fiction by Ramon Rozas III.
Defeating Captchas
Interesting blog post.
EDITED TO ADD (12/14): These guys are the best at breaking captchas.
Security by Letterhead
This otherwise amusing story has some serious lessons:
John: Yes, I’m calling to find out why request number 48931258 to transfer somedomain.com was rejected.
ISP: Oh, it was rejected because the request wasn’t submitted on company letterhead.
John: Oh… sure… but… uh, just so we’re on the same page, can you define exactly what you mean by ‘company letterhead?’
ISP: Well, you know, it has the company’s logo, maybe a phone number and web site address… that sort of thing. I mean, your fax looks like it could’ve been typed by anyone!
John: So you know what my company letterhead looks like?
ISP: Ye… no. Not specifically. But, like, we’d know it if we saw it.
John: And what if we don’t have letterhead? What if we’re a startup? What if we’re redesigning our logo?
ISP: Well, you’d have to speak to customer—John (clicking and typing): I could probably just pick out a semi-professional-looking MS Word template and paste my request in that and resubmit it, right?
ISP: Look, our policy—John: Oh, it’s ok, I just sent the request back in on letterhead.
Ha ha. The idiot ISP guy doesn’t realize how easy it for anyone with a word processor and a laser printer to fake a letterhead. But what this story really shows is how hard it is for people to change their security intuition. Security-by-letterhead was fairly robust when printing was hard, and faking a letterhead was real work. Today it’s easy, but people—especially people who grew up under the older paradigm—don’t act as if it is. They would if they thought about it, but most of the time our security runs on intuition and not on explicit thought.
This kind of thing bites us all the time. Mother’s maiden name is no longer a good password. An impressive-looking storefront on the Internet is not the same as an impressive-looking storefront in the real world. The headers on an e-mail are not a good authenticator of its origin. It’s an effect of technology moving faster than our ability to develop a good intuition about that technology.
And, as technology changes ever increasingly faster, this will only get worse.
Detecting Restaurant Credit Card Fraud with Checksums
Clever technique to put a checksum into the bill total when you add a tip at a restaurant.
I don’t know how common tip fraud is. This thread implies that it’s pretty common, but I use my credit card in restaurants all the time all over the world and I’ve never been the victim of this sort of fraud. On the other hand, I’m not a lousy tipper. And maybe I don’t frequent the right sort of restaurants.
Security Risks of Online Political Contributing
Security researcher Christopher Soghoian gave a presentation this month warning of the potential phishing risk caused by online political donation sites. The Threat Level blog reported:
The presidential campaigns’ tactic of relying on impulsive giving spurred by controversial news events and hyped-up deadlines, combined with a number of other factors such as inconsistent Web addresses and a muddle of payment mechanisms creates a conducive environment for fraud, says Soghoian.
“Basically, the problem here is that banks are doing their best to promote safe online behavior, but the political campaigns are taking advantage of the exact opposite,” he says. “They send out one million e-mails to people designed to encourage impulsive behavior.”
He characterizes the current state of security of the presidential campaigns’ online payment systems as a “mess.”
“It’s a disaster waiting to happen,” he says.
Fraudsters could easily send out e-mails and establish Web sites that mimic the official campaigns’ sites and similarly send out such e-mails that would encourage people to “donate” money without checking for the authenticity of the site.
He has a point, but it’s not new to online contributions. Fake charities and political organizations have long been problems. When you get a solicitation in the mail for “Concerned Citizens for a More Perfect Country”—insert whatever personal definition you have for “more perfect” and “country”—you don’t know if the money is going to your cause or into someone’s pocket. When you give money on the street to someone soliciting contributions for this cause or that one, you have no idea what will happen to the money at the end of the day.
In the end, contributing money requires trust. While the Internet certainly makes frauds like this easier—anyone can set up a webpage that accepts PayPal and send out a zillion e-mails—it’s nothing new.
Photo ID Required to Buy Police Uniforms
In California, if you want to buy a police uniform, you’ll need to prove you’re a policeman:
Assembly Bill 1448 by Assemblyman Roger Niello, R-Fair Oaks, makes it a misdemeanor punishable by up to a $1,000 fine for vendors who do not verify the identification of those purchasing law enforcement uniforms. Previous law made it illegal to impersonate police but did not require an ID check at the point of purchase. The measure takes effect Jan. 1.
Niello said AB 1448 is necessary because many law enforcement agencies require officers to purchase uniforms through outside retailers rather than their own departments.
I’ve written a lot about the problem of authenticating uniforms. This isn’t going to solve that problem. But it’s probably a good idea all the same.
Sidebar photo of Bruce Schneier by Joe MacInnis.