Category Archives: Security

Citibank admits breach of debit card server

Wired tells a sad tale of bank security in America:

A computer intrusion into a Citibank server that processes ATM withdrawals led to two Brooklyn men making hundreds of fraudulent withdrawals from New York City cash machines in February, pocketing at least $750,000 in cash, according to federal prosecutors.

The ATM crime spree is apparently the first to be publicly linked to the breach of a major U.S. bank’s systems, experts say.

“We’ve never heard of PINs coming out of the bank environment,” says Dan Clements, CEO of the fraud watchdog company CardCops, who monitors crime forums for stolen information.

They say this is a new page in security risks. However, when you read the Citibank brief there was a breach of a server that was most likely exposed to a partner’s security (7-Eleven). Accessing systems peripheral and partnered to the bank’s network is definitely a classic move. The rising number of interconnected systems (Wired points to this as real cyber-crime instead of traditional social engineering and physical attacks) means this risk is ever more present. Perhaps what is new is that the same guys who in the past might have just been satisfied to attack individual users now know how to target larger assets.

Encrypted Voice Breaks When Compressed

A security log entry by Schneier on eavesdropping compelled me to write a haiku:

Compress your bitrate
And expose the key to sound;
VoIP flows insecure.

I really like the attack vector he points us to. In short, when you compress voice on phone systems it creates a predictable key of sounds that can be used to unlock the encryption. In other words, sounds have patterns that the encryption does not hide. Even though the sounds themselves might be encrypted, they still have the appearance of known words and can therefore be guessed. For example “cow” will appear different, due to the length of the word when spoken, compared with “cat”. It might look something like ASDFADSFADSF versus ASDF.

Ok, second attempt:

Compress your bitrate
Hear the keys to sound exposed;
VoIP flows insecure.

McCain Drilled on Oil Money

Ha ha ha. This is a funny (or perhaps sad, but I’ll go with funny for now) commentary on Senator McCain’s position on energy reform. The Wall Street Journal blog exposes a serious concern for voters:

As McCain was talking about his energy plans, a protester in the audience at Missouri State University yelled out that McCain had accepted a half million dollars this year from “big oil.”

“That’s more than any other senator!” he yelled. “How can you be trusted?”

After the event, McCain was asked in a news conference if that were true, though the questioner mistakenly quoted the protestor as saying McCain took in a half billion dollars.

“I don’t know what he’s talking about. So I can’t respond,” he said.

Indeed, McCain does lead all other senators, and all others who ran for president, in contributions from the oil and gas industry, according to the Center for Responsive Politics’ analysis of federal data in the 2007-08 election cycle. McCain collected $724,000 through May.

This is more than double the amount his competitor has collected. It is little surprise that the energy industry lobbies candidates and pays heavily for government protection. The problem is McCain claims to be ignorant of his relationship with oil, and yet is aggressively calling for expanded drilling. When it comes to security, pro-BigOil policies usually mean bad news for America, so I expect a candidate to take a stand on energy reform that puts oil in perspective. This news shows McCain could decide to undermine his own country for personal financial gain.

Updated to add (June 20, 2008), an article by US News has California Republican Governor explaining the issue nicely:

“We are in this situation because of our dependence on traditional petroleum-based oil,” Schwarzenegger said. “The direction our nation needs to go in, and where California is already headed, is toward greater innovation in new technologies and new fuel choices for consumers. That is the way we will ultimately reduce fuel costs and also protect our environment.”

Barack Obama, the presumptive Democratic presidential nominee, has also declared his opposition to lifting the moratorium on offshore drilling.

Kudos to Schwarzenegger for being so clear on this issue and advising how to manage the risks from a more balanced perspective.

Is education the key to peace and security?

The Deutsche Welle reports that Germany is having a tough time figuring out a security strategy in Afghanistan:

In a country where residents have little access to running water and only sporadic electricity, you might think the construction of schools would take a backseat to the development of infrastructure. Education, after all, seems a luxury when your house goes unheated.

But in Afghanistan, where just 28 percent of the 32 million residents are literate, those schools are the key to lasting peace.

“Well-educated people can be responsible for the wider reconstruction of their country,” said a representative of the Afghanischer Frauenverein (AFV), a German NGO that supports initiatives for women and children in Afghanistan.

Hard not to compare this strategy to America, where education and literacy are in decline.

Americans barely reach the international literacy average set by advanced democracies, according to a report issued by the Educational Testing Service after looking at the International Adult Literacy Survey (IALS). Unlike the math and science surveys, the IALS was given to a cross section of adults aged 16 to 65. Despite the high expenditures on education in the United States—and the large numbers of students enrolled in colleges and universities—the United States ranked 12th on the test.

The United States is living on its past. Among the oldest group in the study (those aged 56–65), U.S. prose skills rose to second place. For those attending school in the 1950s, SAT scores reached an all-time high.

As the years go by, the United States slips down the list. Americans educated in the sixties captured a Bronze Medal in literacy, those schooled in the seventies got 5th place in the race. But those schooled in the nineties ranked 14th.

[…]

All signs point to a deterioration in the quality of American schools. Europeans and Asians alike have rapidly expanded their educational systems over the last fifty years. In the United States stagnation if not decline has been apparent at least since the seventies. Even our high school graduation rates are lower today than they were a decade ago.

Schools funded and configured properly in Afghanistan, eh? If you look at California alone, Governor Schwarzenegger’s proposed budget for next year significantly reduces spending on students. The state was already $2,000 behind the national annual average and $5,000 less per student than New York; these cuts will remove another $750/yr per student in spending.