Scott Granneman: A Hard Lesson in Privacy
455249
A Hard Lesson in Privacy &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
129868
The Psiphon network frustrates censors by using trusted friends.
331759
Lies, damn lies... Comment Scott Granneman looks at the use of fear in computer security, from misleading media reports and gross exaggeration by industry leaders to the use of fear in order to sell new computers and software.â¦
458947
(InfoWorld) - The biggest threat to your personal and professional security may be the information that your computer is already transmitting to the world around you. Data leakage might be a hot topic, given the list of high-profile incidents reported by businesses such as TJX Companies -- through which reams of detailed consumer records have been exposed -- but most people are already broadcasting enough information from their laptops to allow hackers to aim targeted attacks at their devices and corporate networks, according to security researchers. In a presentation at the ongoing Black Hat DC 2007 conference being held in Washington, DC, from Feb. 28 to Mar. 1, experts with Atlanta-based services provider Errata Security outlined a trend they've labeled as "data seepage." The concept is based on the idea that people using Wi-Fi systems to connect their computers to the Web in public settings such as airport lounges or coffee shops are handing out enough personal clues to give attackers plenty of ammunition to make them the target of their malware or hacks. Using a software application they have designed dubbed Ferret, Errata chief executive Robert Graham and chief technology officer Dave Maynor demonstrated how easy it is to intercept seemingly innocuous information from people's devices as they connect to the Internet. They can then take that data to create a detailed profile of the individual, their Web usage, and even their employers' IT networks. During the course of their presentation, the security experts were even able to use Ferret to intercept an e-mail sent to a reporter working in another conference session that included one of her applications' passwords. Whenever a user connects to the Web via Wi-Fi, or even if their laptop's wireless systems are merely left turned on, someone using such a so-called sniffing tool can garner data about where the user has traveled, what type of operating system or applications they use, and who they may work for, Graham said. For instance, the expert said that while sitting in airlines' business customer lounges it's not hard to look at details offered up freely by the machines of other travelers using Wi-Fi. In doing so, Ferret can detect what hotspots the person has been through, giving an idea of their physical location; determine what e-mail servers or IM systems they attempt to access, lending an idea of their software and potentially their employer; and even scoop their IM contacts to determine who they communicate with. "With seepage, we're talking about the distribution information that you actually mean to broadcast but which hackers can take and exploit for their own needs," Graham said. "All you have to do is turn on your computer and we can tell a lot about you." For instance, computers made by Apple offer up details of what operating system someone is using when they turn their machines on or access Wi-Fi. If captured by a hacker, this could allow them to target specific malware attacks at the individual based on any known vulnerabilities in their version of the OS. In addition to data related to Web connectivity or operating systems, such tools can be used to detect what types of anti-virus applications users are running when the software programs attempt to automatically download updates. With the wide number of known vulnerabilities existing in anti-virus programs, a hacker could easily take that information and use it to craft a targeted attack, the experts said. The tools can even be used to garner similar data from smartphones and other data-centric handhelds, according to the researchers. The experts contend that when the U.S. government was piecing together information about suspected terrorists after the Sept. 11 attacks, investigators likely relied on the same types of data to figure out where various people had traveled, who they communicated with, and what they might have been looking at on the Internet. Consumers may be upset about retailers who collect and expose sensitive information or unchecked government wiretaps, but they are unknowingly handing over a range of data that could be used to track their movements, steal their money, or penetrate their employers' networks. "Just by going to a lounge in an airport with a sniffer like this, you can easily develop a profile that can be used to exploit any weaknesses," Graham said. "You can move from [intercepting] a low-level MAC address to capturing high-level information in a very short amount of time." To help people understand just how much information can be gathered using sniffers like Ferret, Errata is posting the source code for the tool on its Web site so that developers can try it for themselves. The best advice that the security experts offered to end-users to protect themselves is to use personal firewalls and VPNs to cloak as much of their information and activity as possible. "It's not single pieces of information that we're warning about, it's the collection of pieces of data that offer detailed information about who you are," Maynor said. "If the government were collecting this information people would be up in arms, but as it is, they are already giving it away without a second thought."
86959
An inside look at the elaborate secrecy campaign around the biggest book of all time
509744
Letter: Setting the record straight on network location awareness and Vista Group Policy.
708171
That plastic card, the one with the lousy photo that's jammed into your wallet or purse, isn't just a license to drive. It's the green light to buy a drink, the ticket to federal benefits, the must-have document to get aboard airplanes. Now it's also the flash point for an argument about how best to balance America's security needs with worries that personal privacy could be swept away.
465274
Several incidents highlight the dangers life online presents to preserving your privacy.
367071
Restrictive hardware and convoluted rights management crimp consumer choices.
257408
MINNEAPOLIS -- It must say something about our times that Bruce Schneier, a geeky computer encryption specialist turned all-purpose security guru, occasionally gets recognized in public.
363471
By MICHAEL LIEDTKE  SAN FRANCISCO -- Google Inc.'s privacy practices are the worst among the Internet's top destinations, according to a watchdog group seeking to intensify the recent focus on how the online search leader handles personal information about its users.
605168
Security researcher Christopher Soghoian reflects on the hard work that comes after finding a vulnerability.
38640
If G.P.S. made it harder to get lost, new cellphone services that track whereabouts are now making it harder to hide.
694522
It takes effort and intelligence to keep personal information out of the hands of people and governments bent on misusing the data.
79867
Networld World's Scott Bradner has gotten a good look at the Personal Data Privacy and Security Act Of 2007. He's much, much less than impressed.
259195
Country with world's biggest network of surveillance cameras has worst record for the protection of privacy
647033
There's a fascinating debate today going on about Scoble and his Facebook data. Here's the story so far. Plaxo, on behalf of Scoble, ran a screen scraper on his Facebook account to download information about at least some of his Facebook friends. Facebook detected the scraper and turned off his account, with an email explaining that he had violated their terms of service. The debate: Who is right -- Scoble or Facebook? While there are certainly arguments that Facebook has some rightness, most of it, imho, is with Scoble. Sure, some of the data may "belong" to his friends, like their birthday and mail address. Technically of course the data doesn't belong to anyone, it's data about them, and many organizations have this data. Are bloggers really saying that organizations have more rights than people? Isn't blogging all about a level playing field? My bank knows my birthday and my email address. Why shouldn't Scoble? (Maybe he shouldn't.) Scoble called a few minutes ago. I asked what the consensus was. He said it was about 70 percent in his favor, 30 percent in Facebook's. I think we can win over the 30 percent by saying that there should be a system whereby people can decide how much information they want to share with Scoble, or people like Scoble, or me, or people like me, or BofA or the DEA, KGB or CIA. Further, that system is not Facebook, unless they change.  Now, I think there's a pretty good chance that Facebook will change and give Scoble his data and turn his account back on. I think Facebook wants to give us access to our data, but if they just turned the feature on, there would be a shitstorm, kind of like the one that's raging right now. Except this time Facebook has defenders, which they must find refreshing, because every time there's been a shitstorm around Facebook they've always been seen as 100 percent evil by most people. (Not by me, btw.) Maybe they're getting smart there over at Facebook. Maybe they will relent, kind of admit they were wrong, and secretly be happy that they got to open their network up some more.  However, if Facebook doesn't open up and allow people a system to say who can access what information, we still have to create that system somehow. Google could have done it, but they didn't. Same with Yahoo or Microsoft. These companies don't want to empower the users, but if they studied history, they'd see that the evolution of computers always comes in fits and starts. A period when the technology is new and people are snowed by the companies and let them have full control. Gradually people understand what's going on, and figure out they're being screwed but they accept it. And then explosively the whole thing disintegrates in a new layer of technology.  It's a big effin loop we're in. One of these times around one of the companies that feels (incorrectly) that they have a lock on their users, will voluntarily give it up and be a leader in Generation N+1. I've never seen it happen, but in theory I think it could.  In other words, Apple and Microsoft could have invented the web instead of TBL. DEC and Data General could have invented the personal computer instead of Apple and Microsoft (I know this is a simplification, there were lots of individuals and small companies that did it.) And IBM could have invented the minicomputer instead of DEC and Data General. And btw, the NY Times and CNN could have invented blogging and RSS.  So Facebook has the opportunity to be a crossover company, part of the next generation -- or a last gasp of the generation that's about to run out of gas. It's their choice. And it's fitting somehow that Scoble is the poster child for users in this cycle.