This confiscated criminal video posted by the European ATM Security Team demonstrates a common attack and effective countermeasures for shielding a PIN when using an ATM:
Category Archives: Security
Iran Prepares for CyberWar
When I read the report in Shahrzad News called “250,000 female Basijis to receive military training” the first thing that comes to mind is PC repair.
Up to a quarter of a million female members of Iran’s Basij militia are to receive special military and civil-defence training “to prepare them for battle in the cyber war, and against other threats from the enemy abroad.”
IT management probably just started to grasp the cost of infection and downtime. They realize they have an abundant supply of idle and cheap labor and at the same time are short-staffed to clean PCs and reinstall operating systems. So they are now preparing for “battle in the cyber war”. That sounds great and noble; much easier to recruit for special training for cyberwar than for routine military IT repair. Perhaps next we will see an announcement for special forces who train on lavatory threats.
National Auto Dealers Association Fail
Ed Tonkin is President of the National Auto Dealers Association, a lobbying group for car dealers. An article in AOL points out why America’s car industry needs new leadership and should ignore the NADA.
Tonkin advanced the argument that, presently, consumers do not place a high value on fuel economy. “The American consumer buys products that are convenient, predictable and affordable,” he said, and right now, “the most important factors for a car buyer are overall price and monthly payment.”
I see consumers who value fuel economy. He is wrong right from the start. I would argue the Prius has been a success because of high value placed on short-term fuel economy (we know American consumers dislike figuring out long-term cost/benefit calculations). It does not have much else going for it and yet it has a huge consumer following.
What does he mean by “high value”?
Overall price and monthly payment are influenced by the efficiency of fuel, right? Then, by his own argument, there is demand for a drop in cost and that can easily come from better fuel efficiency. We just need to know the right number to get to “high value”. I do not know what the size of the monthly drop needs to be for most consumers reach this point in the short-term (recoup costs within 12 months?), but I could guess that if you can get a vehicle to “conveniently and predictably” reduce their monthly spend 50% we would see immediate significant interest.
The problem with my guess, of course, is that I mean a real 50% drop. I do not mean a drop of 50% with a 20% charge added back in as a premium to raise margins for dealers. That sounds like a vehicle that gets 50 mpg with the same features and for the same cost as the 25 mpg model today.
Anecdotally, I ran into a guy on my street the other day who drove a new Jetta VW TDI Sport Wagon. This diesel car, which now represents more than 80% of VW Jetta sales in America, gets great gas mileage. More to the point I said “nice car” and the guy said “yeah, I go to the pump half the time now so I can be with my family more”. His wife smiled at me.
Hey Ed, please tell me that you are calculating time at the pump in your estimate of what American’s value. When you take the famous American road trip a fuel efficient engine can literally add hours to your day.
Tonkin postulated that car buyers only care about fuel economy when gas prices rise sharply, like they did in the summer of 2008, when prices spiked up above the $4-per-gallon range. “Consumers today are not buying cars based on fuel economy. We may wish it were different. But that doesn’t change anything. And good public policy can’t be based on wishful thinking,” he said.
Oh, hey. Now we have a number. That contradicts your point above. Consumers place a high value on fuel efficiency but your argument is that we are $0.50 low at the pump this month so forget it?
What do you want public policy be based on? This kind of bad math? Good math says NADA should be behind higher mpg — dealers will sell more cars because consumers can actually hit a high value target as you admit with a $4 calculation. The number at the pump can easily be lowered; consumers will move at $3 when you understand what is really in their way. You.
I think the NADA is the one doing wishful thinking about keeping mpg low so they can continue to unload inventory. They want to work in high margins for cheap junk made today on consumers unaware that better options are available. Bill Ford probably said this best when he admitted that the Ford Escort in America was substandard and cheaply made compared to the one sold in Europe. Once gasoline prices went up the American Escort was made to be more on par with the European model. The mileage numbers did not change; Ford realized that selling cheap and unreliable cars was a barrier to demand for higher mpg. The demand grows for a car with good mileage if that means also buying a well-made car.
Of importance to regulators, we find [in a 2004 study of automobile buyer decisions] that good fuel economy is widely considered an attribute of cheap cars; many of our households expressed greater regard for fuel efficiency, a term free from a cheap image and more closely associated to ideas of resource conservation, advanced engineering, and high technology and quality.
Pushing old and unreliable inventory with high margins is the kind of sleazy sales strategy you might expect from a stereotypical car dealer but to see it come from Ed, the national president of their association, is disappointing. Good public policy can be based on better logic than fleecing consumers with engines that devalue sharply, do more damage to health and the environment, and that reduce productivity. Ed should forget the $4-per-gallon nonsense and give the market what it wants — technology that makes lives better (more efficient, fun and with less waste) and improves national security.
Look at it this way: NADA’s policy is for you to spend time at a gas station instead of home with your family. Which do you value more?
Finally, let me just say that NADA is opposed to 60 mpg as a target for 2017 and Ed calls it wishful thinking but anyone watching the industry knows that production cars already hit that number. You probably could buy one in America if guys like Ed were not standing in the way, polyester jacket arms crossed and puffing on a cigar, trying to dump his old inventory on you.
Wake up Ed! The 1980s called, they want their calculator back.
The ultra-fun stock European VW Golf TDI BlueMotion I drove last month used only 3.8 liters per 100 km (62 miles per gallon). I did not need a time machine to 2017, just a plane ticket to Europe in 2010. Green Car Reports wrote an article about it in 2009 with the very annoying title “The 62-MPG 2010 Volkswagen Golf TDI We Won’t Get In the U.S.”
Real-world Hypervisor Exploits
A bone of contention that keeps appearing in discussion of hypervisor compliance, especially in terms of the new PCI DSS 2.0 and NIST SP 800-37 risk-based methodologies, is that there are few real-world hypervisor exploit examples.
I have thus been compiling both quantitative and qualitative data.
Here is one of the more interesting cases I ran across: allegedly the researcher was not happy with the vendor response and so demonstrated the exploit at the 23rd Chaois Communication Congress (23C3) in late 2006.
However, the system was patched only six days after the demonstration, which suggests a fix was already underway by the time the exploit was public.
The SecurityFocus bulletin gives details on the flaw.
Unprivileged code interacts with the hypervisor via the “sc” (“syscall”) instruction, which causes the machine to enter hypervisor mode. The vulnerability is a result of incomplete checking of the parameters passed to the syscall dispatcher, as illustrated below.
The simple attack explanation is that the system inconsistently used “secure mode”. The exploit was to access untrusted memory and then push the hypervisor to access the same area as trusted.
As it is not possible to directly overwrite even non-priviledged code, existing code needs to be tricked into calling the hypervisor syscall with the desired register set. This can be done by setting up a stack frame and forcing a context switch to this stack frame.
Giving access to trusted space from untrusted paths is a good example of multi-tenant risk and a real-world hypervisor exploit.
In other words, this is like a highly secure castle that has rents out 32 of 64 inside bedrooms on weekends and holidays. The first 32 rooms are accounted for all year but there is a good chance the other bedrooms will become occupied by hostile residents who may attack when approached.

I will speak to this and related issues in tomorrow morning’s presentation sponsored by Cisco, Savvis, HyTrust, VMWare and CoalFire:
Title: PCI-Compliant Virtualization Reference Architecture Webinar
Date and time: Wednesday, November 10, 2010 10:00 am Pacific Standard Time (San Francisco, GMT-08:00)
Program: HyTrust Webcast Series
Duration: 1 hour