Category Archives: Security

Police Fail to See Flaws in iPhone

CIO has a sweet-sounding report about The Policeman’s New Partner: iPhone. They fawn over a concept that they call “one of the coolest apps never to appear on the App Store”.

Not in the store? That suggests to the reader a kind of exclusiveness. Should we want it more now? On the other hand, it also suggests a lack of market validation such as feedback. My guess is that CIO wants to imply the former rather than the latter. Take this quote, for example:

During his three-decade police career, [retired assistant chief] Bostic wore many hats at the LAPD, including overseeing some IT functions and communications. “In police work, we’re probably 20 years behind in technological capability,” he says. “We’re using the same handheld radio that costs many thousands of dollars but has a thousand times less capability than the cell phone that I have on my hip.”

Define capability. If we are talking about availability, such as sending/receiving messages when required, than that handheld radio has the iPhone beat by a mile. If we are talking about availability in terms of resistance to physical damage and failure, then that handheld radio has the iPhone beat by two miles.

I suppose if being a Police officer only involved wearing cashmere turtlenecks and nobby slippers while driving around tucked safely into calfskin Porsche seats then the iPhone would be an excellent option. The first little bump in the road or distance from cell tower, however, and the venerable radio would be the more capable choice. It seems clear (pun not intended) that a glass-faced touch-screen loosely cabled in an unsealed box does not meet the basic level of capability.

Another clue to bias in the CIO article is this quote

Imagine undercover officers milling around with an iPhone or Droid (One Force Tracker also has a Droid version) and earbuds, while secretly communicating with each other and knowing the locations of other officers. “Everyone has an iPhone so you don’t stick out,” Bostic says.

Everyone has an iPhone? Last time I checked Android, BlackBerry and Symbian all were far more popular and by a large margin. The iPhone only sold more phones than Microsoft. Granted, a cell-phone is less obvious than a police radio for communication, but this is not a reason to develop a specialized application for an iPhone. An application developed for police that runs only on iPhone will actually increase the ability to spot them, just like having a specialized radio.

The reasons for a Police iPhone do not stack up for me. This article could have been written from a far more realistic (i.e. tax-payer) perspective instead of Apple marketing. Perhaps something like “Smart phones found capable for police work” would make the most sense given all the examples of Sprint and Android already in use.

Secret US Gov kill command for Cloud

The Daily Cloud reports on a controversial takedown action initiated by the US government related to reported IP abuse

After complying with a secret order from U.S. authorities, hosting provider BurstNet shut down Blogetery.com with no warning and no way to get the blog provider’s servers back up and running. According to Blogetery, BurstNet is under a gag order, so Blogetery has no way of knowing the specifics of the complaint, the basis for legal action, or even whether the order was legal.

On a blog forum, Blogetery further complained that BurstNet would not even specify which agency or government authority ordered the shutdown.

The secrecy of the action and response is what distinguishes it the most from in-house hosting takedown disputes.

Losing Poker Player Sentenced to Play Poker

Here is a strange story from ABC that says a man in New Mexico who has a gambling problem has been sentenced to…gamble. New Mexico man sentenced to playing poker in order to avoid prison

He allegedly owes more than $400,000.

Prosecutors say the deal is not a get out of jail free card.

McMaster’s sentencing will be delayed for six months while he participates in tournaments.

He must make payments of $7,500 a month.

If he misses two payments he will face immediate sentencing of up to 12 years in prison.

He stole from his clients to support his gambling habit before. One can only presume he now has even more motive to try extreme and illegal measures — take big gambles, if you will — to support the payment plan rather than go to jail.

Malicious Advertisements Steal $1 Million

When I worked for Yahoo! there often was discussion about the security filters and controls for an advertisement system (e.g. making ad banners safe for web pages).

Unfortunately this attack vector still poses a problem today. A CNet story explains how a Zeus Trojan steals $1 million from U.K. bank accounts

A computer user is compromised by either visiting a legitimate Web site that is secretly hosting the malware, or a site designed to host the malware, or a legitimate site hosting the malware in an advertisement. The primary attack came through malicious advertisements, including ads delivered by Yahoo’s Yieldmanager.com, the report said.

The malware redirects a Web surfer to an exploit kit, either the Eleonore Exploit Toolkit or the Phoenix Exploit Toolkit, that then exploits a vulnerability on the surfer’s computer and drops the Trojan on the machine. The Eleonore Exploit Toolkit includes exploits for vulnerabilities in Adobe Reader, Java, and Internet Explorer, among others.

Filtering code allowed into an advertisement is a solution that is tempting to pursue. Consider, however, that after decades of research there are still 4% detection rates (yes, 4%, as I wrote about a couple years ago) for some anti-virus software. An investment in “black list” filtering for code is expensive yet still may not end up with the necessary protection.

Thinking about the other extreme — “white list” filtering — brings a bigger issue into focus. Why are financial institutions are allowing third-party code, let alone advertisements, onto sites that manage bank accounts? Do banks need advertising dollars more than they need safe web sites? Perhaps someone missed the memo on secure code and the weaknesses in trust domains.