Category Archives: Security

The New Security of Columbia

The BBC has an interesting look at how Columbia has changed to a safe and prosperous country. They call it “Colombian rebel comes in from the jungle”

You may have heard of [Medellin] as one of the most dangerous cities in the world, the former stronghold of the notorious drugs lord Pablo Escobar.

But Pablo Escobar was shot dead by police back in 1993, and that was when the tide of violence began to turn.

Today, Medellin is a very different place.

It is a bustling city, with a population of 2.5 million and it is now said to be one of the safest cities anywhere in Latin America.

Seventeen years is a whole new generation. With opportunities and even equality comes a good life in the city, which makes it hard for rebels and terrorists to recruit into a high risk and tough life in the mountains.

Bulletproof Wheels for the Bloodhound

The problem with a jet that has no wings is that it has to be in contact with a rough surface. Even the flat, smooth lake bed for speed trials is extremely rough compared with debris in the air. Taking the Bloodhound car up to 1,000mph means the car will need impervious wheels

The 97kg aluminium discs that will act as its wheels will have to resist being blasted by a stream of grit thrown up from underneath the vehicle as it races across a dry lake bed at over 1,000mph.

Researchers are trying to identify the best alloy for the task.

This has resulted in them firing pieces of grit at samples of metal using a gas gun at Cambridge University.

Or they could attach wings, get a little lift to retract the main wheels and just use one little wheel dragging along to say it was still on the ground…

Stuxnet Finally Cracked

Symantec is calling recent help with their Stuxnet analysis, from a Dutch Profibus expert, a breakthrough

The new information confirmed that Stuxnet is looking for very specific types of industrial control systems to modify. More importantly it revealed that the code would very carefully check to see if it was on the right type of device and then alter speeds over an extended period by slightly changing output frequencies.

Once operation at those frequencies occurs for a period of time, Stuxnet then hijacks the PLC code and begins modifying the behavior of the frequency converter drives. In addition to other parameters, over a period of months, Stuxnet changes the output frequency for short periods of time to 1410Hz and then to 2Hz and then to 1064Hz. Modification of the output frequency essentially sabotages the automation system from operating properly. Other parameter changes may also cause unexpected effects.

This sounds very much like an attempt to cause quality control failures or even process disruption. Uranium enrichment is mentioned again. Given the effort to create Stuxnet the target would have to be something that would be seriously affected by minor changes over several months time.

I know nothing about uranium enrichment other than anecdotal bits from the Manhattan Project. Assuming the target actually was Iran, this does seem to fit the bill. Wikipedia describes a process most likely to be used in the Iranian plants as a long and very careful one.

The gas centrifugation process utilizes a unique design that allows gas to constantly flow in and out of the centrifuge. Unlike most centrifuges which rely on batch processing, the gas centrifuge utilizes continuous processing, allowing cascading, in which multiple identical processes occur in succession. The gas centrifuge consists of a cylindrical rotor, a casing, an electric motor, and three lines for material to travel.

Would the PLC changes introduced by Stuxnet be subtle enough to run without detection when such a system has to run with very low tolerance? Did someone know that the quality monitoring was so poor it would not pick up the changes, even over several months time? It sounds more and more like an inside job like the Maroochy Shire sewage control failure.

The Maroochydore District Court heard that 49-year-old Vitek Boden had conducted a series of electronic attacks on the Maroochy Shire sewage control system after a job application he had made was rejected by the area’s Council. At the time he was employed by the company that had installed the system. Boden made at least 46 attempts to take control of the sewage system during March and April 2000.

Utilities can not say they have been unaware of this threat type. Boden used remote access to modify controls but the more important point is that he knew where and how to make changes that would not be detected in time to prevent a failure.

NYT top 10 iPhone apps fail test

I could write a giant post about fad and fashion overcoming reason and logic, or try to show how Steve Jobs has been a social engineer more than a technical one — he wants to touch the same parts of your brain that Gucci or D&G can excite and stay away from formalized requests for information. I do not mean that as a criticism, just an observation, since fad and fashion clearly are valued. My point is to be wary of false selection criteria when feeling passionate about technology.

Writers focused on the iPhone make it easier for me to explain by way of example what I mean:

The venerable New York Times has a Business Day Personal Tech story called “Top 10 Must-Have Apps for the iPhone, and Some Runners-Up

The author begins with a strict rule.

You won’t see Twitter, Slacker or Facebook, among others, on this list. Although I find them indispensable, the services aren’t unique to a mobile phone. To make my Top 10, an app must deliver an experience you couldn’t find on your computer — something, in other words, that exemplifies the smartphone at its best.

Right away I detected something awry with this requirement. I would have called the iPhone Twitter app an experience you couldn’t find on your computer.

What is so unique about the smartphone compared to a computer, let alone the iPhone, if it is not the things that make the Twitter app unique? What apps are designed to be so unique to a mobile phone when users must bounce from phone to PC to laptop to kiosk browser?

Take the sixth application in the list, Urban Spoon, for example.

Not sure what to eat, or where? Spin Urbanspoon’s slot machine and it will dial up a suggestion.

Great idea! You can do it right here, right now, on your screen.

New York restaurants on Urbanspoon

I think Twitter gives a more unique experience because of how it is used compared with Urbanspoon. I use Twitter differently on a smartphone than a computer, but Urbanspoon I use the same way.

Maybe you are on your desktop PC, making a call and talking on your microphone right now? Or does your laptop have a touchscreen? Where does the line get drawn for this unique experience?

Perhaps it was not fair to start all the way down with #6. Was that below the belt? Google apps is at the top of the list. Even Google voice is offered on a computer but there is a better case for exception with Google. I find the experience worse on the smartphone not better. They offer browser-based applications, so they work on any device but Google mail really needs a larger screen to be useful, in my experience. Their maps are almost impossible to use on the iPhone — bad directions and no easy way to double/triple-check, unlike a full computer browser. I stopped using Google apps on my smartphone because of reasons like these and just interface other apps with their servers now.

The #4 app is Evernote. The product site says “Evernote works with nearly every computer, phone and mobile device out there.” That is pretty much the opposite of saying you will find “an experience you couldn’t find on your computer”.

The author gives a photo retouch app as #3 called Hipstamatic. Photo retouch is definitely not unique and does not exemplify smartphone apps for me. The Polaroid GENERATOR is just one of the Hipstamatic effects already possible with Photoshop, the mother of photo retouch applications on the computer (Photoshop has an iPhone app too).

The author’s rule is unclear. Smartphone apps are smaller, they give fewer options, run slower…there are things he could have pointed to as unique. Instead I find myself noticing that what he calls a “must-have app” for an iPhone can be run anywhere. My best guess is what he means to say is that this is the list of apps he enjoys spending the most time with when trying to find things to do with his smartphone.

The sensation of excitement around changes in technology should not be underestimated, or undervalued, but it also should be kept in perspective. I look forward to reading lists of top ten applications that can not be experienced anywhere other than the smartphone. This list did not make that list.