January 6, 2009
No Fun
Stooges guitarist Ron Asheton, dead at 60.
Bookmark this post:
ITRC Year End Report for 2008
Reports of data breaches increased dramatically in 2008. The Identity Theft Resource Center’s 2008 breach report reached 656 reported breaches at the end of 2008, reflecting an increase of 47% over last year’s total of 446.Dissent of PogoWasRight has some analysis. I'll take a look at the full report shortly.
Bookmark this post:
Maine Breach Study
The [Maine] Bureau of Financial Institutions has issued a report on the costs of data security breaches to Maine banks and credit unions. The study found that of the 75 financial institutions that responded, 71 were affected by a data breach since Jan. 1, 2007, incurring combined expenses totaling more than $2 million, according to a state press release.So let's see..71 of 75 institutions in Maine were affected, although 53 of those were the Hannaford incident. (pdf page 19, printed page 13) One in three breaches resulted in fraudulent transfers. The Maine Data Breach Study can be found here. The report includes a clear summary of the state of the law in Maine, and comparisons with elsewhere. There's really interesting data analysis, along with a copy of the survey used. I'm going to have to study this more.Together, the breaches resulted in unauthorized or fraudulent transfers at 25 institutions, including 265 accounts and $75,000 at one institution. (" State: Data breaches tally $2M," Mainebiz)
It also includes (pdf 24, printed 18) an interesting cost summary, with 243,000 accounts impacted by Hannaford having an estimated cost of $1.6MM, or about $6.50 per customer. The highest cost per person/card/account is the TJX incident at roughly $9 per card. Which is a stark contrast to the generally used $187 number from Ponnemon surveys.
Does anyone have a count of how many states are embracing the New School model of breach reporting and analysis?
Via PogoWasRight
Bookmark this post:
January 5, 2009
Cryptol Language for Cryptography
Cryptol is a domain specific language for the design, implementation and verification of cryptographic algorithms, developed over the past decade by Galois for the United States National Security Agency. It has been used successfully in a number of projects, and is also in use at Rockwell Collins, Inc.The trial version & docs are here.... Cryptol allows a cryptographer to:
- Create a reference specification and associated formal model.
- Quickly refine the specification, in Cryptol, to one or more implementations, trading off space, time, and other performance metrics.
- Compile the implementation for multiple targets, including: C/C++, Haskell, and VHDL/Verilog.
- Equivalence check an implementation against the reference specification, including implementations not produced by Cryptol.
First, I think this is really cool. I like domain specific languages, and crypto is hard. I really like equivalence checking between models and code. I had some questions, which I'm not yet able to answer, because the trial version doesn't include the code generation bits, and in part because I'm trying to vacation a little.
My main question came from the manual, which First off the manual states: "Cryptol has a very flexible notion of the size of data." (page number 11, section 2.5) I'd paste a longer quote, but the PDF doesn't seem to encode spaces well. Which is ironic, because what I was interested in is "does the generated code defend against stack overflows well?" In light of the ability to "[trade] off space, time [etc]" I worry that there are a set of options which translate, transparently, into something bad in C.
I worry about this because as important as crypto is, cryptographers have a lot to consider as they design algorithms and systems. As Michael Howard pointed out, the Tokeneer system shipped with a library that may be from 2001, with 23 possible vulns. It was secure for a set of requirements, and if the requirements for Cryptol don't contain "resist bad input," then a lot of systems will be in trouble.
Bookmark this post:
January 4, 2009
The Identity Divide and the Identity Archepelago
Peter Swire and Cassandra Butts have a fascinating new article, "The ID Divide." It contains a tremendous amount of interesting information that I wasn't aware of, about how infused with non-driving purposes the drivers license is. I mean, I know that the ID infrastructure, is, in essence and aim, an infrastructure of control. Even so, I didn't realize how far it had gone as a tool of compliance enforcement.
There's more to say than I can get into this blog post. Short form: go read it. Slightly longer form:
There are lots of details that are just great. For examples:
"The More ID checks in society, the more ID theft matters." (page 11)My copy of this report is covered in markup, about "the computer is always right," about linkability, about data shadows. In fact, about the only thing I don't like is the title. I don't think this is a divide, I think that identity has become an archepelago, a la the Soviet Gulag system.In a discussion of a 2005 deficit reduction act attempt to reduce medicaid fraud: "A GAO study instead found that the major effects of the program were higher administrative costs ...and denial of medical benefits to eligible US citizens" (page 14)
"In addition, some state will not issue a state ID until a person has caught up on all outstanding payments due the staet, including traffic fines and child support payments. As ID requirements spread, persons who cannot afford to make all such payments may be denied the right to vote, to receive health insurance, or to become lawfully employed." (page 16)
"...independent reviews of the E-Verify program have found that employers engage in prohibited employment practices..." (page 18)
In the preface to The Gulag Archepelago, Solzhenitsyn wrote:
And this archipelago crisscrossed and patterned that other country within which it was located, like a giant patchwork, cutting into its cities, hovering over its streets. Yet there were many who did not even guess at its presence, and many, many others who had heard something vague.I think the argipelago is a better metaphor than a divide. A divide exists, and most of us exist on one side of it. But the identity archipelago! At a moments notice, we can be thrust onto its other side. A phone call, a letter, and our identity's connection to the machine is broken. Our data shadow has sinned, and we are cast into the archipelago, forced to learn its ways.
In conversation, Peter has said that the Gulag analogy is too over-used, which is a shame. Maybe identity is more like an accident--you're driving along and 35 and boom, you wake up in the hospital. Maybe it's more like a vase, dropped and you're cutting yourself picking up the shards. What's the right description for the fragile system we have where people get violently yanked into the nightmares?
Bookmark this post:
January 3, 2009
Choose your own prescription (glasses)
Silver has devised a pair of glasses which rely on the principle that the fatter a lens the more powerful it becomes. Inside the device's tough plastic lenses are two clear circular sacs filled with fluid, each of which is connected to a small syringe attached to either arm of the spectacles.What's most interesting to me is how well Professor Silver actually went out and understood a problem. Most of us see no need for adjusting our own glasses. But in the developing world, there aren't nearly as many opticians. Getting a prescription can be impossible. The essence of great product management is to understand a real problem people face, and give them a complete solution in which they're willing to invest their time and money.The wearer adjusts a dial on the syringe to add or reduce amount of fluid in the membrane, thus changing the power of the lens. When the wearer is happy with the strength of each lens the membrane is sealed by twisting a small screw, and the syringes removed. The principle is so simple, the team has discovered, that with very little guidance people are perfectly capable of creating glasses to their own prescription. (The Guardian)
Silver didn't just solve the academic problem of "could it be done," he also set up a company, "Adaptive Eyecare Ltd."
Bookmark this post:
January 2, 2009
Security through obscurity
...or, antique car collectors are an honest lot.
According to the Times (of London, dear chap), a recently-deceased British surgeon has left his heirs a rather significant bequest: a super-rare, super-fast, antique Bugatti which hasn't been driven since 1960 and is expected to fetch several million at auction.
This is the fabled "Imagine their surprise, when in the back of the barn they found a..." story. Except, well, records are kept of motor cars, and aging recluses tend not to move much:
James Knight, the international head of Bonhams' motoring department, was one of those who knew where the example, chassis number 57502, was hiding.“I have known of this Bugatti for a number of years and, like a select group of others, hadn't dared divulge its whereabouts to anyone.
The article also quotes the late doctor's nephew:
People must have known because he got letters from all over the country. He got notes pushed through his door. People travelled to try and convince him to sell the car.”
Fascinating.
Bookmark this post:
Biometric Fail reported
A South Korean woman entered Japan on a fake passport in April 2008 by slipping through a state-of-the-art biometric immigration control system using special tape on her fingers to alter her fingerprints, it was learned Wednesday...So reports the Yomiuri Shimbun, "S. Korean woman 'tricked' airport fingerprint scan." The story doesn't mention a name, but if anyone has more details, I'd love to know more.During questioning, the woman allegedly told the immigration bureau that she had bought a forged passport from a South Korean broker who told her to purchase an air ticket for Aomori Airport.
The woman also was quoted as saying that the broker gave her the special tape with someone else's fingerprints on, and that she slipped past the biometric recognition system by holding her taped index fingers over the scanner.
[Update: DanT has some interesting speculation in the comments about both operational aspects of the entry being an inside job, and that the bureaucracy in question would re-assign the insider rather than prosecute.]
Bookmark this post:
December 31, 2008
Happy New Year!
Incidentally, this post is scheduled to go live at 2008-12-31 23:59:60. Let's see what happens!
Update: Movable Type complained when I tried to save the post: "Invalid date '2008-12-31 23:59:60'; authored on dates should be real dates." There goes my sense of wonder. Acceptance, however, remains.
Bookmark this post:
