Partial Recall » IT Security

Afraid of Google Earth

Back in May I discussed the potential misuse of a powerful mapping tool like Google Earth. Today, the New York Times reports that international governments are afraid of the potential for misuse of this technology. Since the New York Times will eventually make the link to their article obsolete (unless you pay for a subscription), I felt compelled to include some of the more interesting tidbits…

From the Dec 20, 2005 edition of the New York Times, “Governments Tremble at Google’s Bird’s-Eye View”

“Lt. Gen. Leonid Sazhin, an analyst for the Federal Security Service, the Russian security agency that succeeded the K.G.B., was quoted by Itar-Tass as saying: “Terrorists don’t need to reconnoiter their target. Now an American company is working for them.”
…
“India, whose laws sharply restrict satellite and aerial photography, has been particularly outspoken. “It could severely compromise a country’s security,” V. S. Ramamurthy, secretary in India’s federal Department of Science and Technology, said of Google Earth. And India’s surveyor general, Maj. Gen. M. Gopal Rao, said, “They ought to have asked us.”
…
“Andrew McLaughlin, a senior policy counsel at Google, said the company had entered discussions with several countries over the last few months, including Thailand, South Korea and, most recently, India.”
…
“When you have multiple eyes in the sky, what you’re doing is creating a transparent globe where anyone can get basic information about anyone else,” said Mr. Gupta, the Sandia analyst. His recommendation to the Indian government, he said, would be to accept the new reality: “Times are changing, and the best thing to do is adapt to the advances in technology.”

Tags: [memory maps, Google Earth, satellite, security, information security, national security, terrorism, map, gps]

Phishing for a Sucker

This is the second phishing attack I’ve received in the last 2 months. For those of you unfamiliar with the term, Webster defines phishing as

“The practice of luring unsuspecting Internet users to a fake Web site by using authentic-looking email with the real organization’s logo, in an attempt to steal passwords, financial or personal information, or introduce a virus attack; the creation of a Web site replica for fooling unsuspecting Internet users into submitting personal or financial information or passwords.”

Notice the email I received. It looks authentic, doesn’t it? However, when I click on any of the three links in the message, the address that displays does not match the address in the email. Instead, it links me to a very different address.

PayPal must go through incredible pains to fight off these malicious people. They have a great “protect yourself” page that offers some good advice for users.

This social engineering almost suckered me, and I would consider myself rather savvy. This type of scam is generally successful because it played on my fears that someone had broken into my account. I react with feeling before I think it through. Fortunately, once I got to the page that asked for my personal financial details, I realized that I better slow down. That’s when I looked at the web site address and noticed that it was not, in fact, PayPal.

It may not be PayPal. It might be an email from a bank, or some other seemingly reputable establishment. Or it might be the great African money laundering too-good-to-be-true scenario I’m sure you’ve seen. If you haven’t yet been the fortunate recipient of these emails, here’s the scenario as described by my buddy here and here.

Be vigilant, my friends, and sorry to say, but we must be skeptical and distrustful in this Internet age.

Scam Home Page

Notice the address line. Also, notice under “what’s new” that these malicious persons have a link for “PayPal introduces new homepage” to cover their tails in case the real PayPal site were to change their look and feel. You can type any made up username and password to move to the next “verification” screen…

They Want Your Credit Card and Bank Information!

Update

A worthwhile video shows the scam in action.

Tags: [phishing, PayPal, scam, security, fraud]

The World Just Got Smaller…

Chatting with my father-in-law

My father-in-law and I recently purchased a small video camera (iSight) that can be mounted onto the top of our Apple computers. The purpose of the camera is so that we can both see and hear each other remotely using a combination of the camera and “instant messenger” chatting software that most of us have already used. We had a great time – both video and audio were really good – not choppy like I anticipated it might be. The video was a little fuzzy, but only when I had it fill the entire screen. Nonetheless, it was amazing! I felt like we were sitting across the table from each other. In fact, during another “chat” I put the camera on my laptop, and leveraging the wireless connection in my home, I was able to take my laptop around the house so my father-in-law could see home improvements, etc. from his home hundreds of miles away. Amazing!

Chatting with my father-in-law

Anyway, I was hoping to lure friends and family into getting one of these. There are a few hurdles – you need a high speed internet connection (no dialup) and your computer must be relatively new (you do not have to have an Apple Macintosh). Think of all the long distance costs you will save because chatting this way is free – only the cost of the high speed internet service (and the camera)!

This has been done in the business community for a while now for holding remote conference calls. For instance, CNN recently decided to use Apple’s technology to aid them in their efforts for real time remote reporting.

The psychotherapy profession should really start embracing the use of this technology in order to provide alternative services. For instance, what if a psychotherapist needs to see a family, yet one of the parents happens to be away for business during a planned session. Typically, the appointment would either be cancelled or it might be missing an important viewpoint if the psychotherapist decided to see the reminder of the family anyway. A certain number of counselors already do therapy by telephone or by email, but I think there are 2 limitations with these laternatives. First, doing email “therapy” tends to lend itself more to helping one individual, not many at once. Second, it is common knowledge that a majority of communication occurs nonverbally, so much is lost using the mediums I mentioned. However, using relatively inexpensive webcam technology could be something the profession needs to consider. The major concerns would involve the legal (insurance), confidentiality, security, and archiving issues, but I think these could be reasonably resolved.

Tags: [iChat, Apple, iSight, webcam, im, instant messaging, security, counseling, aamft, psychotherapy, marriage therapy, family therapy]

Effective Culture Change in the FBI

I recently read a CIO Magazine article that discusses some of problems the FBI has faced while attempting to implement technical solutions. Although technology projects have been successfully implemented, there still exists a culture that mimimizes the importance of these solutions. The article states

Azmi [FBI CIO] is aware of the mountain that faces him—not to mention the consequences if he fails to deliver the support systems the agents need to fight against high-tech crime and terrorism. “Looking at the mission of the FBI and how critical it is, I will tell you that we are at war,” he says. “And the best tool we have is information, and if information doesn’t get to agents on the street in time, then we haven’t done our job properly.”

Last year I wrote a paper entitled, “Effective Culture Change.” The paper was written as part of a graduate school team experience for the Department of Justice’s Library Services division. Although the paper was targeted to a specific audience within the DoJ’s Justice Management Division, I feel the paper could be used to address some of the culture problems within the FBI and the DoJ as a whole.

First, let me define organizational culture. Claver, et al. (2001, p.248) define organizational culture as:

“A set of values, symbols and rituals shared by the members of a specific firm, which describes the way things are done in an organization in order to solve both internal management problems and those related to customers, suppliers and the environment.”

This culture manifests itself at both a visible level (age, ethnicity, gender, dress, organizational structure, symbols, slogans, etc.) and an invisible level (time, motivation, stability vs. change, orientation towards work, individualism vs. collaboration, control, how management views IT, etc.).

I believe the primary reason for failed IT projects and a revolving door of CIOs at the FBI is primarily due to the agency’s culture, not failed technologies or poor CIO leadership. Let me elaborate…

(more…)

Armchair Reconnaissance

One of my interests is information culture – are people generally willing or unwilling to share information? In a corporate or military setting, reasons for hoarding information might be perfectly justified. Corporations do not want to make public information that might be used by competitors. The military may not want its adversaries to know of its capabilities and strategies.

Internet and software-savvy persons (e.g., social software users, open source software developers) tend to advocate information sharing. Indeed, an information sharing culture often breeds knowledge and innovation. Nonetheless, some people refuse to share information, for one reason or another. Some people feel that their job security rests on being seen as an expert. If the information they possess is shared, then perhaps their job won’t be seen as necessary.

Although I understand the validity of both the need for information security and information sharing, I feel we need to be ever so careful with how we use the proliferation of social software that has grown in the last few years.

For example, I absolutely love the Flickr service. I use it mostly to share pictures with friends and family. However, if I so choose, I can share pictures with virtual strangers from all over the world. Consider the following picture:

U.S. Secret Service Training Facility, MD

There’s been a recent fascination with Memory Mapping, the process of identifying satellite photos of places one is familiar with, and then identifying specific landmarks with notations.

What makes this photo interesting is that it is a screen capture of a U.S. Secret Service training facility in Maryland. I used a publically available satellite imaging service, in this case Google Maps (see also Terraserver & Microsoft Terraserver USA), to locate the site I was familiar with.

I assume that if the images are provided by the USGS, then they can be used freely by anyone. However, now that GPS devices are readily available and image services offer coordinates for specific locations, how much easier might it be for armchair vigilantes to perform malicious acts? I’m sure some of the images are sanitized or scrubbed, but what if some classified locations are missed?

Information sharing is the cornerstone of the social software scene and is essential in open source development. However, these persons who follow the “information sharing” credo must be careful to understand the local and federal laws they abide by, and understand that sharing isn’t always a good thing.

Tags: [memory maps, Google maps, satellite, security, information security, social software, Flickr]

Fair Access, Security, and Innovation

I came across a blog posting today with the title, “Federal Government Discriminates against Mac Users.” The author, a federally funded research professor, was finding difficulty applying for federal funding because he had to use the PureEdge Viewer to submit his application for grant funding to the Grants.gov site. His problem is that he is a Mac user and Macs are only supported if you don’t mind using a pc simulation program such as Virtual PC. I’ve used VPC, but IMHO it has not proven to be a viable solution for Mac users, particularly for something as important as conducting business with the federal government. Some Mac users have previously voiced their concerns at places such as the Federal Demonstration Partnership (FDP).

So, the question is, why does this federal site, which has the authority for consolidating the business of grant funding among a majority of federal agencies, have the authority to mandate a technology that can only be used by users of one operating system? There are federal mandates such as Section 508 that provide for equal access to web applications for handicapped individuals. Shouldn’t there be an equal access technology policy too?
(more…)

Rob Fay is a user experience architect making sense of an information age. He is passionate about the “I” in IT and strives to evangelize that information is a resource on equal footing with an organization’s human, financial, and physical resources.

Afraid of Google Earth

Phishing for a Sucker

Scam Home Page

They Want Your Credit Card and Bank Information!

Update

The World Just Got Smaller…

Effective Culture Change in the FBI

Armchair Reconnaissance

U.S. Secret Service Training Facility, MD

Fair Access, Security, and Innovation

Categories

Archives

Search

Syndication

Noteworthy Posts

Contact Me

Newsworthy Links

Shared Favs

Feed Yourself

Organizations

Suggested Reading

People I Know

WWW Colleagues

People I Do Not Know

Meta

Recent Tunes