Mariposa Botnet Shut Down
The Spanish police arrested three people in connection with the 13-million-computer Mariposa botnet.
Entries Tagged "crime"
Page 14 of 39
Another Debit Card Skimmer
This one is installed inside gas pumps. There’s nothing the customer can detect.
EDITED TO ADD (3/5): Pictures.
LVMPD found that one of these skimmers can be installed in eight minutes flat.
More Surveillance in the UK
This seems like a bad idea:
Police in the UK are planning to use unmanned spy drones, controversially deployed in Afghanistan, for the “routine” monitoring of antisocial motorists, protesters, agricultural thieves and fly-tippers, in a significant expansion of covert state surveillance.
Once again, laws and technologies deployed against terrorism are used against much more mundane crimes.
A Useful Side-Effect of Misplaced Fear
A study in the British Journal of Criminology makes the point that drink-spiking date-raping is basically an urban legend:
Abstract. There is a stark contrast between heightened perceptions of risk associated with drug-facilitated sexual assault (DFSA) and a lack of evidence that this is a widespread threat. Through surveys and interviews with university students in the United Kingdom and United States, we explore knowledge and beliefs about drink-spiking and the linked threat of sexual assault. University students in both locations are not only widely sensitized to the issue, but substantial segments claim first- or second-hand experience of particular incidents. We explore students’ understanding of the DFSA threat in relationship to their attitudes concerning alcohol, binge-drinking, and responsibility for personal safety. We suggest that the drink-spiking narrative has a functional appeal in relation to the contemporary experience of young women’s public drinking.
In an article on the study in The Telegraph, the authors said:
Among young people, drink spiking stories have attractive features that could “help explain” their disproportionate loss of control after drinking alcohol, the study found.
Dr Burgess said: “Our findings suggest guarding against drink spiking has also become a way for women to negotiate how to watch out for each other in an environment where they might well lose control from alcohol consumption.”
[…]
“As Dr Burgess observes, it is not scientific evidence which keeps the drug rape myth alive but the fact that it serves so many useful functions.”
Basically, the hypothesis is that perpetuating the fear of drug-rape allows parents and friends to warn young women off excessive drinking without criticizing their personal choices. The fake bogeyman lets people avoid talking about the real issues.
Hacking the Brazil Power Grid
We’ve seen lots of rumors about attacks against the power grid, both in the U.S. and elsewhere, of people hacking the power grid. President Obama mentioned it in his May cybersecurity speech: “In other countries cyberattacks have plunged entire cities into darkness.” Seems like the source of these rumors has been Brazil:
Several prominent intelligence sources confirmed that there were a series of cyber attacks in Brazil: one north of Rio de Janeiro in January 2005 that affected three cities and tens of thousands of people, and another, much larger event beginning on Sept. 26, 2007.
That one in the state of Espirito Santo affected more than three million people in dozens of cities over a two-day period, causing major disruptions. In Vitoria, the world’s largest iron ore producer had seven plants knocked offline, costing the company $7 million. It is not clear who did it or what the motive was.
60 Minutes called me during the research of this story. They had a lot more unsubstantiated information than they’re provided here: names of groups that were involved, allegations of extortion, government coverups, and so on. It would be nice to know what really happened.
EDITED TO ADD (11/11): Wired says that the attacks were caused by sooty insulators. The counterargument, of course, is that sooty insulators are just the cover story because the whole hacker thing is secret.
Wired also mentions that, in an interview last month, Richard Clarke named Brazil as a victim of these attacks.
Thieves Prefer Stealing Black Luggage
It’s obvious why if you think about it:
Thieves prefer to steal black luggage because so much of it looks alike. If the thief is caught red-handed by the bag’s owner, he only has to say sorry, it looks just like mine. And he’s out of there. Scott free.
Read the news story that prompted this blog post. I had no idea luggage theft could be so profitable.
The Problems with Unscientific Security
From the Open Access Journal of Forensic Psychology, by a whole list of authors: “A Call for Evidence-Based Security Tools“:
Abstract: Since the 2001 attacks on the twin towers, policies on security have changed drastically, bringing about an increased need for tools that allow for the detection of deception. Many of the solutions offered today, however, lack scientific underpinning.
We recommend two important changes to improve the (cost) effectiveness of security policy. To begin with, the emphasis of deception research should shift from technological to behavioural sciences. Secondly, the burden of proof should lie with the manufacturers of the security tools. Governments should not rely on security tools that have not passed scientific scrutiny, and should only employ those methods that have been proven effective. After all, the use of tools that do not work will only get us further from the truth.
One excerpt:
In absence of systematic research, users will base their evaluation on data generated by field use. Because people tend to follow heuristics rather than the rules of probability theory, perceived effectiveness can substantially differ from true effectiveness (Tversky & Kahneman, 1973). For example, one well-known problem associated with field studies is that of selective feedback. Investigative authorities are unlikely to receive feedback from liars who are erroneously considered truthful. They will occasionally receive feedback when correctly detecting deception, for example through confessions (Patrick & Iacono, 1991; Vrij, 2008). The perceived effectiveness that follows from this can be further reinforced through confirmation bias: Evidence confirming one’s preconception is weighted more heavily than evidence contradicting it (Lord, Ross, & Lepper, 1979). As a result, even techniques that perform at chance level may be perceived as highly effective (Iacono, 1991). This unwarranted confidence can have profound effects on citizens’ safety and civil liberty: Criminals may escape detection while innocents may be falsely accused. The Innocence Project (Unvalidated or improper science, no date) demonstrates that unvalidated or improper forensic science can indeed lead to wrongful convictions (see also Saks & Koehler, 2005).
Article on the paper.
Helpful Hint for Fugitives: Don't Update Your Location on Facebook
“Fugitive caught after updating his status on Facebook.”
Investigators scoured social networking sites such as Facebook and MySpace but initially could find no trace of him and were unable to pin down his location in Mexico.
Several months later, a secret service agent, Seth Reeg, checked Facebook again and up popped MaxiSopo. His photo showed him partying in front of a backdrop featuring logos of BMW and Courvoisier cognac, sporting a black jacket adorned with a not-so-subtle white lion.
Although Sopo’s profile was set to private, his list of friends was not. Scoville started combing through it and was surprised to see that one friend listed an affiliation with the justice department. He sent a message requesting a phone call.
“We figured this was a person we could probably trust to keep our inquiry discreet,” Scoville said.
Proving the 2.0 adage that a friend on Facebook is rarely a friend indeed, the former official said he had met Sopo in Cancun’s nightclubs a few times, but did not really know him and had no idea he was a fugitive. The official learned where Sopo was living and passed that information back to Scoville, who provided it to Mexican authorities. They arrested Sopo last month.
It’s easy to say “so dumb,” and it would be true, but what’s interesting is how people just don’t think through the privacy implications of putting their information on the Internet. Facebook is how we interact with friends, and we think of it in the frame of interacting with friends. We don’t think that our employers might be looking—they’re not our friends!—that the information will be around forever, or that it might be abused. Privacy isn’t salient; chatting with friends is.
David Dittrich on Criminal Malware
Good essay: “Malware to crimeware: How far have they gone, and how do we catch up?” ;login:, August 2009:
I have surveyed over a decade of advances in delivery of malware. Over this period, attackers have shifted to using complex, multi-phase attacks based on
subtle social engineering tactics, advanced cyptographic techniques to defeat takeover and analysis, and highly targeted attacks that are intended to fly below the radar of
current technical defenses. I will show how malicious technology combined with social manipulation is used against us and conclude that this understanding might even help us design our own combination of technical and social mechanisms to better protect us.
Don't Let Hacker Inmates Reprogram Prison Computers
You’d think this would be obvious:
Douglas Havard, 27, serving six years for stealing up to £6.5million using forged credit cards over the internet, was approached after governors wanted to create an internal TV station but needed a special computer program written.
He was left unguarded and hacked into the system’s hard drive at Ranby Prison, near Retford, Notts. Then he set up a series of passwords so no one else could get into the system.
And you shouldn’t give a prisoner who is a lockpicking expert access to the prison’s keys, either. No, wait:
The blunder emerged a week after the Sunday Mirror revealed how an inmate at the same jail managed to get a key cut that opened every door.
Next week: inmate sharpshooters in charge of prison’s gun locker.
Sidebar photo of Bruce Schneier by Joe MacInnis.