Category Archives: Security

FBI Hunt for Spokane Bomber

KXLY gives extensive details on the FBI hunt for a person who tried to bomb the MLK holiday parade in Spokane:

From north to Colville, to the top of the Parkade in downtown Spokane and down south to Lewiston, federal agents cast a wide net as they chased down clues in the wake of the attempted bombing of the Unity March last Monday.

The way they describe the bomb reminds me of improvised explosives that a friend of mine in the U.S. Army used to tell stories about — part of his training for NATO operations in the 1980s.

Not far away the same news team found a receipt from a Lewiston sporting goods store. The FBI was notified, and they felt the receipt was a significant find because at the store a person could purchase black powder which could be used to power a bomb. That same store also sells ball bearings that could have been used as shrapnel to make that bomb even more lethal.

Because the bomb did not explode, it becomes a wealth of clues for the investigation.

A surveillance system could have helped, but it was offline at the time.

Members of the JTTF hoped the Parkade’s surveillance system may have picked up images of the drivers who used the garage Monday morning. Unfortunately, the security department was switching between servers at the time and the video not recorded.

I suspect they will be re-engineering that system with some redundancy now so that it does not go offline when they switch servers.

Columbian Cocaine Pigeon Foiled

Police found the pigeon wandering around outside a prison with a suspicious-looking bag attached.

The bird was flying towards a jail in the north-eastern city of Bucaramanga when it was discovered nearby by officers with a bag strapped to its back.

Police recovered 40g of marijuana and 5g of a paste containing cocaine and believe the package was too heavy for the bird to clear the prison walls.

The Telegraph story also points out other cases of trained birds used in Columbia for security and transportation. A parrot was taught to say “run” when police approached.

The 45g of drugs is approximately 1.6 oz. It does not seem like a lot for a pigeon, since they weigh 10-16 oz themselves and are trained to fly with up to 70g (depending on distance and weather). I wonder how high the wall is.

Although the police called it ingenuity, it seems to me the parrot should have been taught a code word — anything less obvious than “run” — and the pigeons should have been sent more often with smaller amounts and in a flock. A single pigeon is an unusual sight, let alone with a backpack.

This reminds me of the case in Brazil where the pigeon was caught while it rested on a wire. Its backpack not only had parts for a cell phone, but also a note with the name of the intended recipient inside the jail. Not ingenious.

Safe-Cracking Robot

Some curious students have built a robot that mechanically cracks electronic safes.

It is worth noting that the standard lock for classified documents has since been upgraded to an even more advanced electronic lock, so our machine is not a national security threat. I’m going to be describing our process under the assumption that the lock really is “manipulation-proof” and that the only way to open the safe is to try every possible combination.

Combination space optimization is the key. By exploiting of the mechanical tolerances of the lock and certain combination “forbidden zones”, we reduced the number of possible combinations by about an order of magnitude. Again, read the paper mentioned above for details. Grant implemented our algorithm in Java and was able to test it far before we started constructing the dialer.

They say their “auto dialer” robot, run by a laptop, successfully opened the safe in only a couple hours.

Cloud Security Not Roadblock for Majority of C-Level

The fourth edition of the ITGI Global Survey Results has been posted by ISACA.

A total of 834 surveys were completed, of which 704 were received through the online survey and 130 were gathered by telephone. The surveys were conducted in the native language of the interviewees, and included Chinese, Czech, Dutch, French, German, Japanese, Polish, Portuguese, Russian and Spanish.

Cloud is a murky term, but here are some highlights I found in the report.

Service providers already run, or will soon have, mission-critical technology for almost half of the executives surveyed:

60 percent use or are planning to use cloud computing for non-mission-critical IT services, and more than 40 percent use or are planning to use it for mission-critical IT services. For companies that do not have plans to use cloud computing the main reasons are data privacy and security concerns.

A whopping two-thirds do not see legacy infrastructure as an obstacle.

More than one-third of the survey respondents reported significant legacy infrastructure investments that are inhibiting their cloud computing plans

On the other hand, there are still areas of concern. Some applications are considered too risky by four-fifths of executives!

The use of Facebook or Twitter at work is not highly prized; only one out of five respondents believes that the benefits of employees using social networking outweigh the risks.

The report also differentiates responses by size of company.

Cloud computing-related concerns about security, data privacy and legacy infrastructure investments are generally higher in large enterprises than in small ones.

Although large enterprise concern about cloud are higher than in small, the survey also shows that IT “innovation” is more likely in a large enterprise.

Slightly more than half of large enterprises have implemented or plan to implement initiatives to promote IT innovation, compared with 40.3 percent of small enterprises.

Infrastructure and Platform (IaaS and PaaS) seem to be getting the green light, but Software (SaaS) services such as social networking still has not overcome privacy concerns for the vast majority of executives — more red than yellow. That makes sense to me. SaaS is the least transparent of the three levels and has a history of mistakes.