Michael Mongold's Technology Security

I see you’re gangsta – tattoos, biometrics, and the police

A gangster's main method of creativity and self-expression is becoming increasingly detrimental to their freedom.

Law enforcement agencies have long used any means of verifiable markings to link a suspect to eyewitness accounts of crimes. As a fairly permanent and distinct marker in identifying an individual, tattoos have been an invaluable tool in pursuing “persons of interest” over the years.

                       

Now, science has brought us a tool to help the process of searching through databases of thousands of tattoos to find that special someone, that much easier and quicker.

Enter Tattoo-ID.

Anil Jain and Jung-Eun Lee of Michigan State University’s Department of Computer Science and Engineering have developed a new methodology to categorizing and identifying scars, marks, and tattoos (SMTs). They have labeled the new process Tattoo-ID and believe that it will help law enforcement agencies more accurately and quickly link an SMT with the individual they are interested in.

Currently, law enforcement agencies use the standards for SMT classification as stated by ANSI/NIST-ITL 1-2007. Which, according to Mr. Jain and Mr. Lee, is subjective, time-consuming, and is not scalable to meet the rapid growth in tattoo design.

With Tattoo-ID, the researchers believe their method can meet the needs of SMT identification as the needs of law enforcement grows.

Our approach is one of content-based image retrieval using features (e.g., color, shape, and texture), instead of labels or keywords, to compute the similarity between two images.

Currently the program is seeing 835 out of 1000 images correctly identified with the first attempt out of a database of 64,000.

Although blurred images and low quality image sources create lower success rates, Mr. Jain and Mr. Lee feel that by tweaking their current process and with the addition of new algorithms in their software, the tool will be able to resolve a larger number of SMTs quicker and more accurately, with even larger image databases.

Michael Mongold

Technorati Tags: Gangster,tattoo,police,law enforcement,agencies,michael mongold,SMT,michigan state university,anil jain,jung-eun lee,scar,mark,biometric,identification,suspect,victim,ANSI,NIST,ITL,1-2007

Lxlabs head commits suicide

Sadly, the CTO and founder of Lxlabs was discovered dead in his home in Bangalore Monday morning, from an apparent suicide. As reported in The Times of India, K T Ligesh,32, was found by a friend, hanging in his room.

As I discussed yesterday, up to 100,000 websites had been erased due to a vulnerability in Lxlabs’ software at webhost provider, VAServ.

According to various reports, Mr. Ligesh was deeply agitated over recently losing a project to another company, as well as living with the loss of both his sister and mother a few years ago to suicide by hanging.

Despite what other contributing factors may be at play in Mr. Ligesh’s decision to take his own life, it cannot be clearer that the actions of the hackers that attacked VAServ’s websites played a significant role in this tragedy.

I assume the criminals that infiltrated VAServ’s infrastructure and destroyed the efforts of so many; that created so much anxiety and distress and then caused untold financial damages – that they never really MEANT for someone to die either directly or indirectly from their actions. But it doesn’t really matter, the results of unintended consequences are always just as bad as as the results of those that are intended. They are still a product of someone’s actions or inactions and they are still responsible (if even just partially).

Unfortunately, knowing how often hackers are brought to justice, we can also assume that this wrong will never be righted. RIP K T Ligesh

Webhost hacked – VM vulnerability blamed

According to the Register, a hacker attacked a Webhosting company’s virtual server infrastructure on Sunday and erased up to 100,000 sites.

Vaserv.com was hit by a calculated attack on its virtualization application which left roughly half of Vaserv’s customer without a website.

Rus Foster, a director at Vaserv, stated that LXLabs’s HyperVM had been compromised during a zero-day exploit. They are currently trying to reach LXLabs to find a solution.

Visiting Vaserv’s website show’s an organization in full triage/crisis mode.

At the time of this writing, Vaserv’s site is just a text document showing the status of their server recovery progress (or lack thereof).

Pretty tough times as an administrator (both for a system and web admin).

A very thin but important silver lining is the encryption Vaserv implemented that allowed them to keep the actual data from being usable by the hacker(s).

Ultimately, this shows me two things:

1) How organizations’ reliances on VMs have created a keystone in the arch where a hacker can pinpoint their attacks to reach maximum destructiveness. If a hacker wants to access data for the sake of profit, they go after the database. Alternatively, if they want to go for destructiveness, they can vector in on the VM infrastructure.

VMs are a business reality for large organizations which must rely on fewer physical machines that hold far more virtual servers running many more services. Ultimately this allows enterprises to leverage their rack space more efficiently, but creates a more appealing and concentrated target for people bent on mayhem. Thus, as this VM-reality matures in the TecSec community, the strength and security of the VM infrastructure itself becomes exponentially more important.

In the past, we’ve had to worry about the OS and the applications within it but now we must be concerned with the layer that manages the operating systems themselves. No doubt all webhosting companies are going to re-evaluate their VM security posture as news of this spreads. As for the TecSec community at large, we will need to pay closer attention to what risks VMs pose from motivated individuals.

and 2) How incredibly malicious hackers can be. At one time, there was the idea that someone would deface a site to make a statement or to show a webmaster his site was vulnerable. Wiping out 100,000 websites, however, is beyond explanation.

Michael Mongold

del.icio.us Tags: Rus Foster,LXLabs,HyperVM,webhosting,hacker,attack,virtual machine,vm,tecsec,michael mongold,website,Register

Technorati Tags: Rus Foster,LXLabs,HyperVM,webhosting,hacker,attack,virtual machine,vm,tecsec,michael mongold,website,Register

Virginia Patients at Risk

                     

Known: a hacker gained access to the Virginia Prescription Monitoring Program and then asked for a ransom of $10 million. According to The Virginian-Pilot, the following is also known:

The database contains records of more than 35 million prescriptions dispensed since 2006 for certain federally controlled drugs with a high potential for abuse, such as OxyContin, Vicodin and Xanax.

The records include patients' name, address and date of birth, the name and quantity of the drug prescribed, and identifying numbers for the doctor and pharmacist.

What is unknown, is if the hacker gained access to the customer’s social security numbers which were placed along side many of the customer’s pharmacy records. Throw in 1,400 or so doctors and pharmacists that entered their social security numbers and you have the potential for a real mess.

Also, unknown is if the database was encrypted. The hacker stated that he had copied the database and deleted the commonwealth’s backups of the database although Virginia claims to still have access to its backups

One thing is for certain, some administrator is hating their life right now while they have to explain why 530,000 patients must now watch their credit report and bank accounts more diligently than ever.

Finally, there is the irony where the Roanoke Times reports that:

…lawmakers were told that the VDHP ranked in the top 5 percent of state agencies in an audit of information security.

Not the most confidence-inspiring statement the state could make.

Databases are ultimately one of the great prizes for hackers. In one fell swoop they can acquire more data than if they stole 100,000 laptops. This is an excellent example why database security and encryption should be paramount for any organization that stores sensitive information. Way to learn one the hard way, Virginia.

Michael Mongold

del.icio.us Tags: Virginia Department of Health Professions,hacker,Virginia Prescription Monitoring Program,Michael Mongold,theft,data,encryption,database

Technorati Tags: Virginia Department of Health Professions,hacker,Virginia Prescription Monitoring Program,Michael Mongold,theft,data,encryption,database

Security enhancement for iPhone = Find My iPhone

For those who have been pushing their company to adopt the iPhone as a business device, at least now you can present the security argument as a little stronger.

                                       

A few minutes ago, Apple unveiled at WWDC a remote wipe feature through its new ‘Find My iPhone” application.

In addition to allowing you to remotely erase your iPhone (something available on other devices for some time now), you can also view where your iPhone is on a map, make your iPhone beep so that you can locate it (even if it is in ‘silent mode’), AND display a message to the person who stole found your phone. Perhaps something like “I know you have my iPhone, I know where you’re at – I’m coming to get it”.

The catch? You must subscribe to Apple’s MobileMe service to have access to the ‘Find My iPhone” features. Still, for companies who have potentially sensitive data stored on their iPhone, this becomes a no-brainer.

Michael Mongold

del.icio.us Tags: Apple,iPhone,Find My iPhone,MobileMe,Michael Mongold,WWDC,application,remote wipe

Technorati Tags: Apple,iPhone,Find My iPhone,MobileMe,Michael Mongold,WWDC,application,remote wipe

Worst ISP in the US = Pricewert

Well, that’s according to the FTC who shut their connectivity off late last week. And if their claims are accurate, I believe they have a pretty good case for giving Pricewert the title.

                    

According to the FTC’s press release, Pricewert (AKA 3FN, APS Telecom, among others), knowingly hosted child pornography, malware, and spam servers which were responsible for depositing trojan horses, viruses, spyware, phishing attacks, botnet cnc servers, as well as numerous additional web sites with illegal material on them.

If you have ever wondered why a website can exist that can do so much damage or why spam servers can clog your e-mail with so much time/money wasting data or where the truly bad/sick people on the web go for their disease, this is it.

The claim states that by ignoring security groups’ notices to disconnect the offending sites and by frequently changing the source IP address of the servers, Pricewert was able to provide criminals a safe haven on the web.

If the allegations are true, let’s hope that the government doesn’t wait so long next time to find organizations like this on the web and shut down this conduit of crime and filth.

Michael Mongold

Technorati Tags: FTC,Pricewert,3FN,APS Telecom,IPS,trojan,viruses,botnet,phishing,spyware,illegal,Federal Trade Commission,Michael Mongold

del.icio.us Tags: FTC,Pricewert,3FN,APS Telecom,IPS,trojan,viruses,botnet,phishing,spyware,illegal,Federal Trade Commission,Michael Mongold

Smart Cards are not rocket science

NASA may have to reissue more than 70,000 smart cards that have been provided to NASA employees over the past three years due to security concerns.

                   

Prior to the Homeland Security Presidential Directive 12 (HSPD-12) mandate for a Personal Identity Verification (PIV) card, NASA was in the process of deploying their own common badging and access control system (CBACS) - as were a number of other agencies. However, according to a report filed by NASA’s Inspector General, they did not follow federal guidelines for insuring the proper transition and oversight from their own card implementation to the new PIV standards.

Although the Inspector General’s office did not find that any cards had been distributed to individuals with inappropriate access, it leaves the door open for that possibility.

At the heart of the issue is this:

“While NASA properly assessed the PIV card issuer for satisfaction of Federal requirements at both organization and facility levels, found deficiencies, and developed a corrective action plan in accordance with Federal guidance, the Agency did not monitor corrective actions to ensure that identified deficiencies were corrected nor initiate timely reassessment. If the reassessment of the PIV card issuer reveals that significant deficiencies continue to exist and those deficiencies affect the integrity of the PIV cards, NASA could be required to discontinue PIV card issuer operations and reissue its PIV cards, which we estimate could cost a minimum of $1 million.”

Ouch. And the audit did not even include Jet Propulsion Laboratories due to their own PIV issues.

Ultimately, if the Inspector General’s office is able to confirm that the credential provider’s failings persisted after NASA’s knowledge of them AND if it resulted in any inappropriate issuance – 98% of NASA’s employees will have to undergo the badging process again.

For the Inspector General’s full report, click here

Michael Mongold

del.icio.us Tags: NASA,PIV,HSPD-12,JPL,Inspector General,Michael Mongold,CBAC,Homeland Security Presidential Directive,Personal Identity Verification

Technorati Tags: NASA,PIV,HSPD-12,JPL,Inspector General,CBAC,Michael Mongold,Homeland Security Presidential Directive,Personal Identity Verification

Congress set to impose biometric competition in airports

If it isn’t broke, don’t fix it – even if it could possibly save money. That’s what the airports are saying to congress now that legislation is before the House to revamp the biometric technology selection process at airports

                    

around the country. I feel for the airports, since they seem to have a system in place that they like and on the face of it, is relatively inexpensive. However, I’m sure there is a number of access solution providers that are eager to take a stab at winning the business. Here’s the whole story… {via Washington Technology}

Technorati Tags: tsa,airport,biometric,technology,michael mongold

Clean Security Bill of Health?

What if a doctor told you that you had a clean bill of health, only to find that he missed a dangerous growth which later caused significant damage because it was not treated earlier?

This is basically the gist of a lawsuit that Merrick Bank has brought against Savvis in a federal complaint.

The short-term affects of this lawsuit will no doubt have a chilling effect on the compliance-service industry as they recognize their own vulnerability in signing off on an audit.

It has always been critical that if you are giving someone a stamp of approval, that they truly meet the standard that has been defined. It’s important that your beef has been properly approved by the USDA and it’s important that your compliance with a security standard (Visa’s Cardholder Information Security Program or CISP, in this case) has been thoroughly vetted and approved.

No doubt, there have been security “stamps of approval” that have been given out to organizations in the past that might not have been deserving and we’ll never hear about them. And this might not be one of those times since we’ll have to wait until Savvis has had an opportunity defend itself and we hear the ruling by the court. However, it is inevitable that we would see a lawsuit occur at some point.

If you tell me, or rather, guarantee me that I am compliant with a regulation or meet a certain standard or criteria and then I am fined a significant amount of money ($16 million in this case) because I am not, you can rest assured I will come to you for some answers and some compensation.

What can be done to avoid this? This certainly invokes a number of questions. After all, companies are paying these auditors to insure they can bypass this whole mess. Ultimately, it will require more transparency of the actions performed by the auditing organization and the certifications of each individual auditor. If an auditor has passed a certification and his actions (or inactions) lead to a failure like this, should his certification be revoked? For my two cents, I believe this moves us a step closer to requiring a license-like structure for data security auditors that could have a better mechanism for granting and revoking its credentials. Ultimately, passing a test and receiving a certificate has limited if any accountability on an individual level.

However, the question that will be addressed first is what culpability an auditing organization has when damages occur to a customer they have certified as compliant. For this, we will have to stay tuned to how the court rules. One thing we know for sure, companies that perform audits will take another look at how their contracts are worded and review carefully how they perform their contracts.

 

Michael Mongold

del.icio.us Tags: savvus,Merrick,Visa,CISP,Cardholder Information Security Program,CardSystems,pay by touch,Michael Mongold,audit,security,technology,compliance

Technorati Tags: savvus,Merrick,Visa,CISP,Cardholder Information Security Program,CardSystems,pay by touch,Michael Mongold,audit,security,technology,compliance