Nanny-in-the-Middle Attack

Posted onAuthornetjeffLeave a comment

"Man-in-the-Middle" attack's occur in the "real" world, not just in computer security. In this case, it was a Nanny-in-the-Middle…
Security Notes from All Over: Man-in-the-Middle Attack

(from http://www.schneier.com/crypto-gram-0404.html#6)

The phrase "man-in-the-middle attack" is used to describe a computer attack
where the adversary sits in the middle of a communications channel
between two people, fooling them both. It is an important attack, and
causes all sorts of design considerations in communications protocols.

But it's a real-life attack, too. Here's a story of a woman who posts an ad
requesting a nanny. When a potential nanny responds, she asks for
references for a background check. Then she places another ad, using
the reference material as a fake identity. She gets a job with the good
references — they're real, although for another person — and then
robs the family who hires her. And then she repeats the process.

Look what's going on here. She inserts herself in the middle of a
communication between the real nanny and the real employer, pretending
to be one to the other. The nanny sends her references to someone she
assumes to be a potential employer, not realizing that it is a
criminal. The employer receives the references and checks them, not
realizing that they don't actually belong to the person who is sending
them.

It's a nasty piece of crime.

The San Francisco Chronicle carried the full story.

Spreadsheets: 25 Years in a Cell

Posted onAuthornetjeffLeave a comment

An interesting article on how people delude themselves using spreadsheets for planning/estimating.

Spreadsheets: 25 Years in a Cell
(http://news.yahoo.com/news?tmpl=story&u=/zd/20040323/tc_zd/121973)
Tue Mar 23, 4:24 PM ET
Peter Coffee – eWEEKIn this 25th anniversary year of the PC spreadsheet, we can be proud of the progress we've made in decision technology. We can also be appalled by the stagnation of our decision-making practices. The things we learned to do badly in 1979, upon the debut of VisiCalc, we mostly continue to do wrong today.

IT observer Stan Kelly-Bootle described in 1995 the impact of VisiCalc and its descendants: "The PC soon blossomed as the Uzi of creative corporate accounting," he wrote. "The What-If moved to Why-Not, indicting the spreadsheet as the chief culprit in the 1980s S&L scandal."

Kelly-Bootle was talking about the ease with which we slide our assumptions toward their optimistic limits, inching good numbers up and bad numbers down until we get the result we want — failing to admit that the result is based on multiplying a series of less-than-even chances.

Read More …

Clever credit card scam (on the phone)

Posted onAuthornetjeffLeave a comment

From the Bruce Schneier's Crypto-Gram newsletter:

(http://www.schneier.com/crypto-gram-0401.html#10)

This one is clever.

You receive a telephone call from someone purporting to be from your credit
card company. They claim to be from something like the security and
fraud department, and question you about a fake purchase for some
amount close to $500.

When you say that the purchase wasn't
yours, they tell you that they're tracking the fraudsters and that you
will receive a credit. They tell you that the fraudsters are making
fake purchases on cards for amounts just under $500, and that they're
on the case.

They know your account number. They know your name
and address. They continue to spin the story, and eventually get you to
reveal the three extra numbers on the back of your card.

That's all they need. They thenstart charging your card for amounts just
under $500. When you get your bill, you're unlikely to call the credit
card company because you already know that they're on the case and that
you'll receive a credit.

It's a really clever social engineering
attack. They have to hit a lot of cards fast and then disappear,
because otherwise they can be tracked, but I bet they've made a lot of
money so far.

Speed variance kills (not simply speed)

Posted onAuthornetjeffLeave a comment

For a given road and conditions, it's not how fast you drive, it's how much faster (or slower) you drive relative to the rest of traffic.

Of course, if you are on a road by yourself with no other traffic, then at a certain point too high of a speed will kill you because you'll run off of the road. But since most of us drive on roads with other traffic, it's the relative speed that is most important.

Below are some excerpts from various studies to support this basic fact (from a Dec 2 2000 posting in the Yahoo Groups forum for "Corbin Sparrow Electric Vehicle Driver's").

Read More …

Combine two movie poster into one

Posted onAuthornetjeff1 Comment

Fark.com has competitions for the best fake images for a particular category. This category was: Mate-a-movie. Combine two or more movies into one.

The movie posters are fantastic. They are for movies like:

Dirty Harry Potter
Hulk Fiction
Finding Neo (starring Keaneu Reeves)
Gandhi in 60 Seconds

http://forums.fark.com/cgi/fark/comments.pl?IDLink=715072&mode=voteresults

The page takes a long time to load cause of all the images. But it's worth it!

Electronic voting MUST have paper receipts

Posted onAuthornetjeffLeave a comment

Most of the e-voting systems sold and used in the latest round of electronics produce no verifiable paper trail.

Without a verifiable paper trail:

  • You can never do re-counts if the machines have a problem
  • You can never verify that the machines haven't been tampered with (by the company that makes the machine, or by local officials)

You should demand a paper trail if you use voting machine

http://www.verifiedvoting.org/

FTC says the patent system needs to be changed

Posted onAuthornetjeffLeave a comment

For Release: October 28, 2003FTC Issues Report on How to Promote Innovation Through Balancing Competition with Patent Law and Policy

The Federal Trade Commission today issued its report on how to promote innovation by finding the proper balance of competition and patent law and policy. Although both competition in markets and patents for inventors can work together to foster innovation, the report states that each policy requires a proper balance with the other to do so. "Consumers and innovators win when patents and competition policy are aligned in the proper balance. Although questionable patents can harm competition and innovation, valid patents work well with competition to promote innovation. This Report analyzes and makes recommendations for the patent system to maintain the proper balance with competition," said Timothy J. Muris, FTC Chairman.

Today's report – which makes recommendations for the patent system – is the first of two reports about how to maintain that balance. A forthcoming second report by the FTC and the Antitrust Division of the Department of Justice (DOJ) will make similar recommendations for antitrust law.

Among the ten recommendations of today's report, the FTC proposes legislative and regulatory changes to improve patent quality. Patents of questionable validity can slow further innovation and raise costs to consumers. Specifically, the report recommends:

  • Creating a new administrative procedure that will make it easier for firms to challenge a patent's validity at the U.S. Patent and Trademark Office (PTO), without having to raise an expensive and time-consuming federal court challenge; and
  • Allowing courts to find patents invalid based on the preponderance of the evidence, without having to find that clear and convincing evidence compels that result. The current standard of "clear and convincing evidence" undermines courts' ability to weed
    out questionable patents. This is especially troubling, since certain PTO procedures and rules tend to favor the issuance of patents.

Read More …