2009

The future of news as shown by the 2008 election

business, history, politics, tech in changing society / /

From Steven Berlin Johnson’s “Old Growth Media And The Future Of News” (StevenBerlinJohnson.com: 14 March 2009):

The first Presidential election that I followed in an obsessive way was the 1992 election that Clinton won. I was as compulsive a news junkie about that campaign as I was about the Mac in college: every day the Times would have a handful of stories about the campaign stops or debates or latest polls. Every night I would dutifully tune into Crossfire to hear what the punditocracy had to say about the day’s events. I read Newsweek and Time and the New Republic, and scoured the New Yorker for its occasional political pieces. When the debates aired, I’d watch religiously and stay up late soaking in the commentary from the assembled experts.

That was hardly a desert, to be sure. But compare it to the information channels that were available to me following the 2008 election. Everything I relied on in 1992 was still around of course – except for the late, lamented Crossfire – but it was now part of a vast new forest of news, data, opinion, satire – and perhaps most importantly, direct experience. Sites like Talking Points Memo and Politico did extensive direct reporting. Daily Kos provided in-depth surveys and field reports on state races that the Times would never have had the ink to cover. Individual bloggers like Andrew Sullivan responded to each twist in the news cycle; HuffPo culled the most provocative opinion pieces from the rest of the blogosphere. Nate Silver at fivethirtyeight.com did meta-analysis of polling that blew away anything William Schneider dreamed of doing on CNN in 1992. When the economy imploded in September, I followed economist bloggers like Brad DeLong to get their expert take the candidates’ responses to the crisis. (Yochai Benchler talks about this phenomenon of academics engaging with the news cycle in a smart response here.) I watched the debates with a thousand virtual friends live-Twittering alongside me on the couch. All this was filtered and remixed through the extraordinary political satire of John Stewart and Stephen Colbert, which I watched via viral clips on the Web as much as I watched on TV.

What’s more: the ecosystem of political news also included information coming directly from the candidates. Think about the Philadelphia race speech, arguably one of the two or three most important events in the whole campaign. Eight million people watched it on YouTube alone. Now, what would have happened to that speech had it been delivered in 1992? Would any of the networks have aired it in its entirety? Certainly not. It would have been reduced to a minute-long soundbite on the evening news. CNN probably would have aired it live, which might have meant that 500,000 people caught it. Fox News and MSNBC? They didn’t exist yet. A few serious newspaper might have reprinted it in its entirety, which might have added another million to the audience. Online perhaps someone would have uploaded a transcript to Compuserve or The Well, but that’s about the most we could have hoped for.

There is no question in mind my mind that the political news ecosystem of 2008 was far superior to that of 1992: I had more information about the state of the race, the tactics of both campaigns, the issues they were wrestling with, the mind of the electorate in different regions of the country. And I had more immediate access to the candidates themselves: their speeches and unscripted exchanges; their body language and position papers.

The old line on this new diversity was that it was fundamentally parasitic: bloggers were interesting, sure, but if the traditional news organizations went away, the bloggers would have nothing to write about, since most of what they did was link to professionally reported stories. Let me be clear: traditional news organizations were an important part of the 2008 ecosystem, no doubt about it. … But no reasonable observer of the political news ecosystem could describe all the new species as parasites on the traditional media. Imagine how many barrels of ink were purchased to print newspaper commentary on Obama’s San Francisco gaffe about people “clinging to their guns and religion.” But the original reporting on that quote didn’t come from the Times or the Journal; it came from a “citizen reporter” named Mayhill Fowler, part of the Off The Bus project sponsored by Jay Rosen’s Newassignment.net and The Huffington Post.

The future of news as shown by the 2008 election Read More »

Cell phone viruses

business, security, tech in changing society / /

From Jim Giles’ “The inside story of the Conficker worm” (New Scientist: 12 June 2009):

Earlier this year, smartphone users in China started to get messages promising a “sexy view” if they clicked on a link. The link led to a download. That download was a spam generator which, once installed, sent identical “sexy view” messages to everyone in the owner’s contacts list.

That was the first virus known to travel by text message. It was chiefly an annoyance, but there is great potential harm from mobile viruses, especially as technologies such as Bluetooth provide new ways for viruses to spread. But there has never yet been a cellphone threat as serious as Conficker is to PCs.

There are two reasons for that, says Albert-László Barabási of Northeastern University in Boston. He and his colleagues used billing data to model the spread of a mobile virus. They found that Bluetooth is an inefficient way of transmitting a virus as it can only jump between users who are within 30 metres of each other. A better option would be for the virus to disguise itself as a picture message. But that could still only infect handsets running the same operating system. As the mobile market is fragmented, says Barabási, no one virus can gain a foothold.

Cell phone viruses Read More »

How security experts defended against Conficker

business, history, security, tech in changing society / /

From Jim Giles’ “The inside story of the Conficker worm” (New Scientist: 12 June 2009):

23 October 2008 … The dry, technical language of Microsoft’s October update did not indicate anything particularly untoward. A security flaw in a port that Windows-based PCs use to send and receive network signals, it said, might be used to create a “wormable exploit”. Worms are pieces of software that spread unseen between machines, mainly – but not exclusively – via the internet (see “Cell spam”). Once they have installed themselves, they do the bidding of whoever created them.

If every Windows user had downloaded the security patch Microsoft supplied, all would have been well. Not all home users regularly do so, however, and large companies often take weeks to install a patch. That provides windows of opportunity for criminals.

…

The new worm soon ran into a listening device, a “network telescope”, housed by the San Diego Supercomputing Center at the University of California. The telescope is a collection of millions of dummy internet addresses, all of which route to a single computer. It is a useful monitor of the online underground: because there is no reason for legitimate users to reach out to these addresses, mostly only suspicious software is likely to get in touch.

The telescope’s logs show the worm spreading in a flash flood. For most of 20 November, about 3000 infected computers attempted to infiltrate the telescope’s vulnerable ports every hour – only slightly above the background noise generated by older malicious code still at large. At 6 pm, the number began to rise. By 9 am the following day, it was 115,000 an hour. Conficker was already out of control.

That same day, the worm also appeared in “honeypots” – collections of computers connected to the internet and deliberately unprotected to attract criminal software for analysis. It was soon clear that this was an extremely sophisticated worm. After installing itself, for example, it placed its own patch over the vulnerable port so that other malicious code could not use it to sneak in. As Brandon Enright, a network security analyst at the University of California, San Diego, puts it, smart burglars close the window they enter by.

Conficker also had an ingenious way of communicating with its creators. Every day, the worm came up with 250 meaningless strings of letters and attached a top-level domain name – a .com, .net, .org, .info or .biz – to the end of each to create a series of internet addresses, or URLs. Then the worm contacted these URLs. The worm’s creators knew what each day’s URLs would be, so they could register any one of them as a website at any time and leave new instructions for the worm there.

It was a smart trick. The worm hunters would only ever spot the illicit address when the infected computers were making contact and the update was being downloaded – too late to do anything. For the next day’s set of instructions, the creators would have a different list of 250 to work with. The security community had no way of keeping up.

No way, that is, until Phil Porras got involved. He and his computer security team at SRI International in Menlo Park, California, began to tease apart the Conficker code. It was slow going: the worm was hidden within two shells of encryption that defeated the tools that Porras usually applied. By about a week before Christmas, however, his team and others – including the Russian security firm Kaspersky Labs, based in Moscow – had exposed the worm’s inner workings, and had found a list of all the URLs it would contact.

…

[Rick Wesson of Support Intelligence] has years of experience with the organisations that handle domain registration, and within days of getting Porras’s list he had set up a system to remove the tainted URLs, using his own money to buy them up.

It seemed like a major win, but the hackers were quick to bounce back: on 29 December, they started again from scratch by releasing an upgraded version of the worm that exploited the same security loophole.

This new worm had an impressive array of new tricks. Some were simple. As well as propagating via the internet, the worm hopped on to USB drives plugged into an infected computer. When those drives were later connected to a different machine, it hopped off again. The worm also blocked access to some security websites: when an infected user tried to go online and download the Microsoft patch against it, they got a “site not found” message.

Other innovations revealed the sophistication of Conficker’s creators. If the encryption used for the previous strain was tough, that of the new version seemed virtually bullet-proof. It was based on code little known outside academia that had been released just three months earlier by researchers at the Massachusetts Institute of Technology.

…

Indeed, worse was to come. On 15 March, Conficker presented the security experts with a new problem. It reached out to a URL called rmpezrx.org. It was on the list that Porras had produced, but – those involved decline to say why – it had not been blocked. One site was all that the hackers needed. A new version was waiting there to be downloaded by all the already infected computers, complete with another new box of tricks.

Now the cat-and-mouse game became clear. Conficker’s authors had discerned Porras and Wesson’s strategy and so from 1 April, the code of the new worm soon revealed, it would be able to start scanning for updates on 500 URLs selected at random from a list of 50,000 that were encoded in it. The range of suffixes would increase to 116 and include many country codes, such as .kz for Kazakhstan and .ie for Ireland. Each country-level suffix belongs to a different national authority, each of which sets its own registration procedures. Blocking the previous set of domains had been exhausting. It would soon become nigh-on impossible – even if the new version of the worm could be fully decrypted.

Luckily, Porras quickly repeated his feat and extracted the crucial list of URLs. Immediately, Wesson and others contacted the Internet Corporation for Assigned Names and Numbers (ICANN), an umbrella body that coordinates country suffixes.

…

From the second version onwards, Conficker had come with a much more efficient option: peer-to-peer (P2P) communication. This technology, widely used to trade pirated copies of software and films, allows software to reach out and exchange signals with copies of itself.

Six days after the 1 April deadline, Conficker’s authors let loose a new version of the worm via P2P. With no central release point to target, security experts had no means of stopping it spreading through the worm’s network. The URL scam seems to have been little more than a wonderful way to waste the anti-hackers’ time and resources. “They said: you’ll have to look at 50,000 domains. But they never intended to use them,” says Joe Stewart of SecureWorks in Atlanta, Georgia. “They used peer-to-peer instead. They misdirected us.”

The latest worm release had a few tweaks, such as blocking the action of software designed to scan for its presence. But piggybacking on it was something more significant: the worm’s first moneymaking schemes. These were a spam program called Waledac and a fake antivirus package named Spyware Protect 2009.

…

The same goes for fake software: when the accounts of a Russian company behind an antivirus scam became public last year, it appeared that one criminal had earned more than $145,000 from it in just 10 days.

How security experts defended against Conficker Read More »

David Foster Wallace on postmodernism & waiting for the parents to come home

art, history, language & literature, on writing / /

From Larry McCaffery’s “Conversation with David Foster Wallace” (Dalkey Archive Press at the University of Illinois: Summer 1993):

For me, the last few years of the postmodern era have seemed a bit like the way you feel when you’re in high school and your parents go on a trip, and you throw a party. You get all your friends over and throw this wild disgusting fabulous party. For a while it’s great, free and freeing, parental authority gone and overthrown, a cat’s-away-let’s-play Dionysian revel. But then time passes and the party gets louder and louder, and you run out of drugs, and nobody’s got any money for more drugs, and things get broken and spilled, and there’s a cigarette burn on the couch, and you’re the host and it’s your house too, and you gradually start wishing your parents would come back and restore some fucking order in your house. It’s not a perfect analogy, but the sense I get of my generation of writers and intellectuals or whatever is that it’s 3:00 A.M. and the couch has several burn-holes and somebody’s thrown up in the umbrella stand and we’re wishing the revel would end. The postmodern founders’ patricidal work was great, but patricide produces orphans, and no amount of revelry can make up for the fact that writers my age have been literary orphans throughout our formative years. We’re kind of wishing some parents would come back. And of course we’re uneasy about the fact that we wish they’d come back—I mean, what’s wrong with us? Are we total pussies? Is there something about authority and limits we actually need? And then the uneasiest feeling of all, as we start gradually to realize that parents in fact aren’t ever coming back—which means we’re going to have to be the parents.

David Foster Wallace on postmodernism & waiting for the parents to come home Read More »

David Foster Wallace on the importance of writing within formal constraints

art, history, language & literature, on writing / /

From Larry McCaffery’s “Conversation with David Foster Wallace” (Dalkey Archive Press at the University of Illinois: Summer 1993):

You’re probably right about appreciating limits. The sixties’ movement in poetry to radical free verse, in fiction to radically experimental recursive forms—their legacy to my generation of would-be artists is at least an incentive to ask very seriously where literary art’s true relation to limits should be. We’ve seen that you can break any or all of the rules without getting laughed out of town, but we’ve also seen the toxicity that anarchy for its own sake can yield. It’s often useful to dispense with standard formulas, of course, but it’s just as often valuable and brave to see what can be done within a set of rules—which is why formal poetry’s so much more interesting to me than free verse. Maybe our touchstone now should be G. M. Hopkins, who made up his “own” set of formal constraints and then blew everyone’s footwear off from inside them. There’s something about free play within an ordered and disciplined structure that resonates for readers. And there’s something about complete caprice and flux that’s deadening.

David Foster Wallace on the importance of writing within formal constraints Read More »

David Foster Wallace on the problems with postmodern irony

art, history, language & literature, on writing / /

From Larry McCaffery’s “Conversation with David Foster Wallace” (Dalkey Archive Press at the University of Illinois: Summer 1993):

Irony and cynicism were just what the U.S. hypocrisy of the fifties and sixties called for. That’s what made the early postmodernists great artists. The great thing about irony is that it splits things apart, gets up above them so we can see the flaws and hypocrisies and duplicates. The virtuous always triumph? Ward Cleaver is the prototypical fifties father? “Sure.” Sarcasm, parody, absurdism and irony are great ways to strip off stuff’s mask and show the unpleasant reality behind it. The problem is that once the rules of art are debunked, and once the unpleasant realities the irony diagnoses are revealed and diagnosed, “then” what do we do? Irony’s useful for debunking illusions, but most of the illusion-debunking in the U.S. has now been done and redone. Once everybody knows that equality of opportunity is bunk and Mike Brady’s bunk and Just Say No is bunk, now what do we do? All we seem to want to do is keep ridiculing the stuff. Postmodern irony and cynicism’s become an end in itself, a measure of hip sophistication and literary savvy. Few artists dare to try to talk about ways of working toward redeeming what’s wrong, because they’ll look sentimental and naive to all the weary ironists. Irony’s gone from liberating to enslaving. There’s some great essay somewhere that has a line about irony being the song of the prisoner who’s come to love his cage.

…

The problem is that, however misprised it’s been, what’s been passed down from the postmodern heyday is sarcasm, cynicism, a manic ennui, suspicion of all authority, suspicion of all constraints on conduct, and a terrible penchant for ironic diagnosis of unpleasantness instead of an ambition not just to diagnose and ridicule but to redeem. You’ve got to understand that this stuff has permeated the culture. It’s become our language; we’re so in it we don’t even see that it’s one perspective, one among many possible ways of seeing. Postmodern irony’s become our environment.

David Foster Wallace on the problems with postmodern irony Read More »

David Foster Wallace on being a tourist

commonplace book, politics / /

From David Foster Wallace’s “Consider the Lobster” (Gourmet: ):

As I see it, it probably really is good for the soul to be a tourist, even if it’s only once in a while. Not good for the soul in a refreshing or enlivening way, though, but rather in a grim, steely-eyed, let’s-look-honestly-at-the-facts-and-find-some-way-to-deal-with-them way. My personal experience has not been that traveling around the country is broadening or relaxing, or that radical changes in place and context have a salutary effect, but rather that intranational tourism is radically constricting, and humbling in the hardest way—hostile to my fantasy of being a real individual, of living somehow outside and above it all. (Coming up is the part that my companions find especially unhappy and repellent, a sure way to spoil the fun of vacation travel:) To be a mass tourist, for me, is to become a pure late-date American: alien, ignorant, greedy for something you cannot ever have, disappointed in a way you can never admit. It is to spoil, by way of sheer ontology, the very unspoiledness you are there to experience. It is to impose yourself on places that in all noneconomic ways would be better, realer, without you. It is, in lines and gridlock and transaction after transaction, to confront a dimension of yourself that is as inescapable as it is painful: As a tourist, you become economically significant but existentially loathsome, an insect on a dead thing.

David Foster Wallace on being a tourist Read More »

All about freezing to death

education, science / /

Ice mask, C.T. Madigan / photograph by Frank Hurley
Creative Commons License photo credit: State Library of New South Wales collection

From Peter Stark’s “As Freezing Persons Recollect the Snow–First Chill–Then Stupor–Then the Letting Go” (Outside: January 1997):

There is no precise core temperature at which the human body perishes from cold. At Dachau’s cold-water immersion baths, Nazi doctors calculated death to arrive at around 77 degrees Fahrenheit. The lowest recorded core temperature in a surviving adult is 60.8 degrees. For a child it’s lower: In 1994, a two-year-old girl in Saskatchewan wandered out of her house into a minus-40 night. She was found near her doorstep the next morning, limbs frozen solid, her core temperature 57 degrees. She lived.

…

The cold remains a mystery, more prone to fell men than women, more lethal to the thin and well muscled than to those with avoirdupois, and least forgiving to the arrogant and the unaware.

…

Were you a Norwegian fisherman or Inuit hunter, both of whom frequently work gloveless in the cold, your chilled hands would open their surface capillaries periodically to allow surges of warm blood to pass into them and maintain their flexibility. This phenomenon, known as the hunter’s response, can elevate a 35-degree skin temperature to 50 degrees within seven or eight minutes.

Other human adaptations to the cold are more mysterious. Tibetan Buddhist monks can raise the skin temperature of their hands and feet by 15 degrees through meditation. Australian aborigines, who once slept on the ground, unclothed, on near-freezing nights, would slip into a light hypothermic state, suppressing shivering until the rising sun rewarmed them.

…

The exertion that warmed you on the way uphill now works against you: Your exercise-dilated capillaries carry the excess heat of your core to your skin, and your wet clothing dispels it rapidly into the night. The lack of insulating fat over your muscles allows the cold to creep that much closer to your warm blood.

Your temperature begins to plummet. Within 17 minutes it reaches the normal 98.6. Then it slips below.

At 97 degrees, hunched over in your slow search, the muscles along your neck and shoulders tighten in what’s known as pre-shivering muscle tone. Sensors have signaled the temperature control center in your hypothalamus, which in turn has ordered the constriction of the entire web of surface capillaries. Your hands and feet begin to ache with cold.

…

At 95, you’ve entered the zone of mild hypothermia. You’re now trembling violently as your body attains its maximum shivering response, an involuntary condition in which your muscles contract rapidly to generate additional body heat.

…

And after this long stop, the skiing itself has become more difficult. By the time you push off downhill, your muscles have cooled and tightened so dramatically that they no longer contract easily, and once contracted, they won’t relax. You’re locked into an ungainly, spread-armed, weak-kneed snowplow.

…

As you sink back into the snow, shaken, your heat begins to drain away at an alarming rate, your head alone accounting for 50 percent of the loss. The pain of the cold soon pierces your ears so sharply that you root about in the snow until you find your hat and mash it back onto your head.

But even that little activity has been exhausting. You know you should find your glove as well, and yet you’re becoming too weary to feel any urgency. You decide to have a short rest before going on.

An hour passes. at one point, a stray thought says you should start being scared, but fear is a concept that floats somewhere beyond your immediate reach, like that numb hand lying naked in the snow. You’ve slid into the temperature range at which cold renders the enzymes in your brain less efficient. With every one-degree drop in body temperature below 95, your cerebral metabolic rate falls off by 3 to 5 percent. When your core temperature reaches 93, amnesia nibbles at your consciousness.

…

In the minus-35-degree air, your core temperature falls about one degree every 30 to 40 minutes, your body heat leaching out into the soft, enveloping snow. Apathy at 91 degrees. Stupor at 90.

You’ve now crossed the boundary into profound hypothermia. By the time your core temperature has fallen to 88 degrees, your body has abandoned the urge to warm itself by shivering. Your blood is thickening like crankcase oil in a cold engine. Your oxygen consumption, a measure of your metabolic rate, has fallen by more than a quarter. Your kidneys, however, work overtime to process the fluid overload that occurred when the blood vessels in your extremities constricted and squeezed fluids toward your center. You feel a powerful urge to urinate, the only thing you feel at all.

By 87 degrees you’ve lost the ability to recognize a familiar face, should one suddenly appear from the woods.

At 86 degrees, your heart, its electrical impulses hampered by chilled nerve tissues, becomes arrhythmic. It now pumps less than two-thirds the normal amount of blood. The lack of oxygen and the slowing metabolism of your brain, meanwhile, begin to trigger visual and auditory hallucinations.

…

At 85 degrees, those freezing to death, in a strange, anguished paroxysm, often rip off their clothes. This phenomenon, known as paradoxical undressing, is common enough that urban hypothermia victims are sometimes initially diagnosed as victims of sexual assault. Though researchers are uncertain of the cause, the most logical explanation is that shortly before loss of consciousness, the constricted blood vessels near the body’s surface suddenly dilate and produce a sensation of extreme heat against the skin.

…

There’s an adage about hypothermia: “You aren’t dead until you’re warm and dead.”

At about 6:00 the next morning, his friends, having discovered the stalled Jeep, find him, still huddled inches from the buried log, his gloveless hand shoved into his armpit. The flesh of his limbs is waxy and stiff as old putty, his pulse nonexistent, his pupils unresponsive to light. Dead.

But those who understand cold know that even as it deadens, it offers perverse salvation. Heat is a presence: the rapid vibrating of molecules. Cold is an absence: the damping of the vibrations. At absolute zero, minus 459.67 degrees Fahrenheit, molecular motion ceases altogether. It is this slowing that converts gases to liquids, liquids to solids, and renders solids harder. It slows bacterial growth and chemical reactions. In the human body, cold shuts down metabolism. The lungs take in less oxygen, the heart pumps less blood. Under normal temperatures, this would produce brain damage. But the chilled brain, having slowed its own metabolism, needs far less oxygen-rich blood and can, under the right circumstances, survive intact.

Setting her ear to his chest, one of his rescuers listens intently. Seconds pass. Then, faintly, she hears a tiny sound–a single thump, so slight that it might be the sound of her own blood. She presses her ear harder to the cold flesh. Another faint thump, then another.

The slowing that accompanies freezing is, in its way, so beneficial that it is even induced at times. Cardiologists today often use deep chilling to slow a patient’s metabolism in preparation for heart or brain surgery. In this state of near suspension, the patient’s blood flows slowly, his heart rarely beats–or in the case of those on heart-lung machines, doesn’t beat at all; death seems near. But carefully monitored, a patient can remain in this cold stasis, undamaged, for hours.

…

In fact, many hypothermia victims die each year in the process of being rescued. In “rewarming shock,” the constricted capillaries reopen almost all at once, causing a sudden drop in blood pressure. The slightest movement can send a victim’s heart muscle into wild spasms of ventricular fibrillation. In 1980, 16 shipwrecked Danish fishermen were hauled to safety after an hour and a half in the frigid North Sea. They then walked across the deck of the rescue ship, stepped below for a hot drink, and dropped dead, all 16 of them.

…

The doctor rapidly issues orders to his staff: intravenous administration of warm saline, the bag first heated in the microwave to 110 degrees. Elevating the core temperature of an average-size male one degree requires adding about 60 kilocalories of heat. A kilocalorie is the amount of heat needed to raise the temperature of one liter of water one degree Celsius. Since a quart of hot soup at 140 degrees offers about 30 kilocalories, the patient curled on the table would need to consume 40 quarts of chicken broth to push his core temperature up to normal. Even the warm saline, infused directly into his blood, will add only 30 kilocalories.

Ideally, the doctor would have access to a cardiopulmonary bypass machine, with which he could pump out the victim’s blood, rewarm and oxygenate it, and pump it back in again, safely raising the core temperature as much as one degree every three minutes. But such machines are rarely available outside major urban hospitals.

…

You’d nod if you could. But you can’t move. All you can feel is throbbing discomfort everywhere. Glancing down to where the pain is most biting, you notice blisters filled with clear fluid dotting your fingers, once gloveless in the snow. During the long, cold hours the tissue froze and ice crystals formed in the tiny spaces between your cells, sucking water from them, blocking the blood supply. You stare at them absently.

“I think they’ll be fine,” a voice from overhead says. “The damage looks superficial. We expect that the blisters will break in a week or so, and the tissue should revive after that.”

If not, you know that your fingers will eventually turn black, the color of bloodless, dead tissue. And then they will be amputated.

…

You’ve seen that in the infinite reaches of the universe, heat is as glorious and ephemeral as the light of the stars. Heat exists only where matter exists, where particles can vibrate and jump. In the infinite winter of space, heat is tiny; it is the cold that is huge.

All about freezing to death Read More »

Stolen credit card data is cheaper than ever in the Underground

business, law, security, tech in changing society / /

From Brian Krebs’ “Glut of Stolen Banking Data Trims Profits for Thieves” (The Washington Post: 15 April 2009):

A massive glut in the number of credit and debit cards stolen in data breaches at financial institutions last year has flooded criminal underground markets that trade in this material, driving prices for the illicit goods to the lowest levels seen in years, experts have found.

For a glimpse of just how many financial records were lost to hackers last year, consider the stats released this week by Verizon Business. The company said it responded to at least 90 confirmed data breaches last year involving roughly 285 million consumer records, a number that exceeded the combined total number of breached records from cases the company investigated from 2004 to 2007. Breaches at banks and financial institutions were responsible for 93 percent of all such records compromised last year, Verizon found.

As a result, the stolen identities and credit and debit cards for sale in the underground markets is outpacing demand for the product, said Bryan Sartin, director of investigative response at Verizon Business.

Verizon found that profit margins associated with selling stolen credit card data have dropped from $10 to $16 per record in mid-2007 to less than $0.50 per record today.

According to a study released last week by Symantec Corp., the price for each card can be sold for as low as 6 cents when they are purchased in bulk.

…

Lawrence Baldwin, a security consultant in Alpharetta, Ga., has been working with several financial institutions to help infiltrate illegal card-checking services. Baldwin estimates that at least 25,000 credit and debit cards are checked each day at three separate illegal card-checking Web sites he is monitoring. That translates to about 800,000 cards per month or nearly 10 million cards each year.

…

Baldwin said the checker sites take advantage of authentication weaknesses in the card processing system that allow merchants to conduct so-called “pre-authorization requests,” which merchants use to place a temporary charge on the account to make sure that the cardholder has sufficient funds to pay for the promised goods or services.

Pre-authorization requests are quite common. When a waiter at a restaurant swipes a customer’s card and brings the receipt to the table so the customer can add a tip, for example, that initial charge is essentially a pre-authorization.

With these card-checking services, however, in most cases the charge initiated by the pre-authorization check is never consummated. As a result, unless a consumer is monitoring their accounts online in real-time, they may never notice a pre-authorization initiated by a card-checking site against their card number, because that query won’t show up as a charge on the customer’s monthly statement.

…

The crooks have designed their card-checking sites so that each check is submitted into the card processing network using a legitimate, hijacked merchant account number combined with a completely unrelated merchant name, Baldwin discovered.

One of the many innocent companies caught up in one of these card-checking services is Wild Birds Unlimited, a franchise pet store outside of Buffalo, N.Y. Baldwin said a fraudulent card-checking service is running pre-authorization requests using Wild Bird’s store name and phone number in combination with another merchant’s ID number.

Danielle Pecoraro, the store’s manager, said the bogus charges started in January 2008. Since then, she said, her store has received an average of three to four phone calls each day from people who had never shopped there, wondering why small, $1-$10 charges from her store were showing up on their monthly statements. Some of the charges were for as little as 24 cents, and a few were for as much as $1,900.

Stolen credit card data is cheaper than ever in the Underground Read More »

80% of all spam from botnets

business, security / /

From Jacqui Cheng’s “Report: botnets sent over 80% of all June spam” (Ars Technica: 29 June 2009):

A new report (PDF) from Symantec’s MessageLabs says that more than 80 percent of all spam sent today comes from botnets, despite several recent shut-downs.

According to MessageLabs’ June report, spam accounted for 90.4 percent of all e-mail sent in the month of June—this was roughly unchanged since May. Botnets, however, sent about 83.2 percent of that spam, with the largest spam-wielding botnet being Cutwail. Cutwail is described as “one of the largest and most active botnets” and has doubled its size and output per bot since March of this year. As a result, it is now responsible for 45 percent of all spam, with others like Mega-D, Xarvester, Donbot, Grum, and Rustock making up much of the difference

80% of all spam from botnets Read More »

The light bulb con job

business, security / /

From Bruce Schneier’s “The Psychology of Con Men” (Crypto-Gram: 15 November 2008):

Great story: “My all-time favourite [short con] only makes the con artist a few dollars every time he does it, but I absolutely love it. These guys used to go door-to-door in the 1970s selling lightbulbs and they would offer to replace every single lightbulb in your house, so all your old lightbulbs would be replaced with a brand new lightbulb, and it would cost you, say $5, so a fraction of the cost of what new lightbulbs would cost. So the man comes in, he replaces each lightbulb, every single one in the house, and does it, you can check, and they all work, and then he takes all the lightbulbs that he’s just taken from the person’s house, goes next door and then sells them the same lightbulbs again. So it’s really just moving lightbulbs from one house to another and charging people a fee to do it.”

http://www.abc.net.au/rn/lawreport/stories/2008/2376933.htm

The light bulb con job Read More »

Storm made $7000 each day from spam

business, law, security / /

From Bruce Schneier’s “The Economics of Spam” (Crypto-Gram: 15 November 2008):

Researchers infiltrated the Storm worm and monitored its doings.

“After 26 days, and almost 350 million e-mail messages, only 28 sales resulted — a conversion rate of well under 0.00001%. Of these, all but one were for male-enhancement products and the average purchase price was close to $100. Taken together, these conversions would have resulted in revenues of $2,731.88 — a bit over $100 a day for the measurement period or $140 per day for periods when the campaign was active. However, our study interposed on only a small fraction of the overall Storm network — we estimate roughly 1.5 percent based on the fraction of worker bots we proxy. Thus, the total daily revenue attributable to Storm’s pharmacy campaign is likely closer to $7000 (or $9500 during periods of campaign activity). By the same logic, we estimate that Storm self-propagation campaigns can produce between 3500 and 8500 new bots per day.

“Under the assumption that our measurements are representative over time (an admittedly dangerous assumption when dealing with such small samples), we can extrapolate that, were it sent continuously at the same rate, Storm-generated pharmaceutical spam would produce roughly 3.5 million dollars of revenue in a year. This number could be even higher if spam-advertised pharmacies experience repeat business. A bit less than “millions of dollars every day,” but certainly a healthy enterprise.”

Storm made $7000 each day from spam Read More »

Quanta Crypto: cool but useless

business, security / /

From Bruce Schneier’s “Quantum Cryptography” (Crypto-Gram: 15 November 2008):

Quantum cryptography is back in the news, and the basic idea is still unbelievably cool, in theory, and nearly useless in real life.

The idea behind quantum crypto is that two people communicating using a quantum channel can be absolutely sure no one is eavesdropping. Heisenberg’s uncertainty principle requires anyone measuring a quantum system to disturb it, and that disturbance alerts legitimate users as to the eavesdropper’s presence. No disturbance, no eavesdropper — period.

…

While I like the science of quantum cryptography — my undergraduate degree was in physics — I don’t see any commercial value in it. I don’t believe it solves any security problem that needs solving. I don’t believe that it’s worth paying for, and I can’t imagine anyone but a few technophiles buying and deploying it. Systems that use it don’t magically become unbreakable, because the quantum part doesn’t address the weak points of the system.

Security is a chain; it’s as strong as the weakest link. Mathematical cryptography, as bad as it sometimes is, is the strongest link in most security chains. Our symmetric and public-key algorithms are pretty good, even though they’re not based on much rigorous mathematical theory. The real problems are elsewhere: computer security, network security, user interface and so on.

Cryptography is the one area of security that we can get right. We already have good encryption algorithms, good authentication algorithms and good key-agreement protocols.

Quanta Crypto: cool but useless Read More »

Famous “Laws” of Business & Technology

business, commonplace book, science, technology / /

These come from a variety of sources; just Google the law to find out more about it.

Parkinson’s Law

“Work expands so as to fill the time available for its completion.”

Source: Cyril Northcote Parkinson in The Economist (1955)

The Peter Principle

“In a hierarchy every employee tends to rise to his level of incompetence.”

Source: Dr. Laurence J. Peter and Raymond Hull in The Peter Principle (1968)

The Dilbert Principle

“Leadership is nature’s way of removing morons from the productive flow.”

Source: Scott Adams’ Dilbert (February 5, 1995)

Hofstadter’s Law

“It always takes longer than you expect, even when you take into account Hofstadter’s Law.”

Source: Douglas Hofstadter’s Gödel, Escher, Bach: An Eternal Golden Braid (1979)

Amara’s Law

“We tend to overestimate the effect of a technology in the short run and underestimate the effect in the long run.”

Source: Roy Amara.

Brooks’ Law

Adding manpower to a late software project makes it later.

Source: Fred Brooks’ The Mythical Man-Month (1975)

Clarke’s 3 Laws

  1. First law: When a distinguished but elderly scientist states that something is possible, he is almost certainly right. When he states that something is impossible, he is very probably wrong.
  2. Second law: The only way of discovering the limits of the possible is to venture a little way past them into the impossible.
  3. Third law: Any sufficiently advanced technology is indistinguishable from magic.

Source: Arthur C. Clarke’s “Hazards of Prophecy: The Failure of Imagination” in Profiles of the Future (1962)

Conway’s Law

“Any piece of software reflects the organizational structure that produced it.”

Source: Melvin Conway (1968)

Gall’s Law

“A complex system that works is invariably found to have evolved from a simple system that worked. The inverse proposition also appears to be true: A complex system designed from scratch never works and cannot be made to work.”

Source: John Gall’s Systemantics: How Systems Really Work and How They Fail (1978)

Godwin’s Law

“As an online discussion grows longer, the probability of a comparison involving Nazis or Hitler approaches one.”

Source: Mike Godwin (1990)

Hanlon’s Razor

“Never attribute to malice that which can be adequately explained by stupidity.”

Herblock’s Law

“If it’s good, they’ll stop making it.”

Source: Herbert Lawrence Block

Kranzberg’s 6 Laws of Technology

  1. Technology is neither good nor bad; nor is it neutral.
  2. Invention is the mother of necessity.
  3. Technology comes in packages, big and small.
  4. Although technology might be a prime element in many public issues, nontechnical factors take precedence in technology-policy decisions.
  5. All history is relevant, but the history of technology is the most relevant.
  6. Technology is a very human activity – and so is the history of technology.

Source: Melvin Kranzberg’s “Kranzberg’s Laws” Technology and Culture, Vol. 27, No. 3 (1986): 544-560

Linus’s Law

“Given enough eyeballs, all bugs are shallow.”

Source: Linus Torvalds

Schneier’s Law

“Any person can invent a security system so clever that she or he can’t think of how to break it.”

Source: Cory Doctorow’s “Microsoft Research DRM talk” (17 June 2004)

Sturgeon’s Revelation

“90 percent of everything is crap.”

Source: Theodore Sturgeon (1951)

Wirth’s Law

“Software is getting slower more rapidly than hardware becomes faster.”

Source: Niklaus Wirth (1995)

Zawinski’s Law

“Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can.”

Source: Jamie Zawinski

Granneman’s Law of Operating System Usage

“To mess up a Linux box, you need to work at it; to mess up your Windows box, you just need to work on it. ”

Source: Scott Granneman’s “Linux vs. Windows Viruses” in SecurityFocus (10 February 2003)

Famous “Laws” of Business & Technology Read More »

What it takes to get people to comply with security policies

security / /

From Bruce Schneier’s “Second SHB Workshop Liveblogging (5)” (Schneier on Security: 11 June 2009):

Angela Sasse, University College London …, has been working on usable security for over a dozen years. As part of a project called “Trust Economics,” she looked at whether people comply with security policies and why they either do or do not. She found that there is a limit to the amount of effort people will make to comply — this is less actual cost and more perceived cost. Strict and simple policies will be complied with more than permissive but complex policies. Compliance detection, and reward or punishment, also affect compliance. People justify noncompliance by “frequently made excuses.”

What it takes to get people to comply with security policies Read More »

Small charges on your credit card – why?

business, law, security / /

Too Much Credit
Creative Commons License photo credit: Andres Rueda

From Brian Kreb’s “An Odyssey of Fraud” (The Washington Post: 17 June 2009):

Andy Kordopatis is the proprietor of Odyssey Bar, a modest watering hole in Pocatello, Idaho, a few blocks away from Idaho State University. Most of his customers pay for their drinks with cash, but about three times a day he receives a phone call from someone he’s never served — in most cases someone who’s never even been to Idaho — asking why their credit or debit card has been charged a small amount by his establishment.

Kordopatis says he can usually tell what’s coming next when the caller immediately asks to speak with the manager or owner.

“That’s when I start telling them that I know why they’re calling, and about the Russian hackers who are using my business,” Kordopatis said.

The Odyssey Bar is but one of dozens of small establishments throughout the United States seemingly picked at random by organized cyber criminals to serve as unwitting pawns in a high-stakes game of chess against the U.S. financial system. This daily pattern of phone calls and complaints has been going on for more than a year now. Kordopatis said he has talked to the company that processes his bar’s credit card payments about fixing the problem, but says they can’t do anything because he hasn’t actually lost any money from the scam.

The Odyssey Bar’s merchant account is being abused by online services that cyber thieves built to help other crooks check the balances and limits on stolen credit and debit card account numbers.

Small charges on your credit card – why? Read More »

Outline for an Unpublished Linux Textbook

on writing, personal, security / /

Back in 2004 or so, I was asked to write an outline for a college textbook that would be used in courses on Linux. I happily complied, producing the outline you can see on my website. The editor on the project loved the outline & showed it several professors to get their reactions, which were uniformly positive, with one prof reporting back that (& I’m paraphrasing here) “It was like this author read my mind, as this is exactly the book I’d like to use in my course!” Sadly, the book was never written, because the editor’s boss didn’t like the fact that I didn’t have a PhD in Computer Science. I thought that to be a silly reason then, & I think it’s a silly reason to reject the book now.

However, their loss is your gain. Here’s the outline for the book. Yes, it’s sadly outdated. Yes, it focuses quite a bit on SUSE, but that was what the publisher wanted. Yes, Linux has come a LONG way since I wrote this outline. But I still think it’s a damn good job, and you may find it interesting for historical reasons. So, enjoy!

Outline for an Unpublished Linux Textbook Read More »

Mine fires that burn for 400 years

business, history, science / /

Centralia - Where there's smoke..
Creative Commons License photo credit: C. Young Photography

From Joshua Foer’s “Giant Burning Holes of the World” (Boing Boing: 16 June 2009):

… these sorts of mine fires can stay lit for a very long time. One burned in the city of Zwickau, Germany from 1476 to 1860. Another coal fire in Germany, at a place called Brennender Berg (Burning Mountain), has been smoking continually since 1688!

Mine fires that burn for 400 years Read More »

7 tools of propaganda

history, language & literature, on writing, politics / /

From Roger Ebert’s “The O’Reilly Procedure” (Roger Ebert’s Journal: 14 June 2009):

The seven propaganda devices include:

  • Name calling — giving something a bad label to make the audience reject it without examining the evidence;
  • Glittering generalities — the opposite of name calling;
  • Card stacking — the selective use of facts and half-truths;
  • Bandwagon — appeals to the desire, common to most of us, to follow the crowd;
  • Plain folks — an attempt to convince an audience that they, and their ideas, are “of the people”;
  • Transfer — carries over the authority, sanction and prestige of something we respect or dispute to something the speaker would want us to accept; and
  • Testimonials — involving a respected (or disrespected) person endorsing or rejecting an idea or person.

7 tools of propaganda Read More »

How to deal with the fact that users can’t learn much about security

security / /

From Bruce Schneier’s “Second SHB Workshop Liveblogging (4)” (Schneier on Security: 11 June 2009):

Diana Smetters, Palo Alto Research Center …, started with these premises: you can teach users, but you can’t teach them very much, so you’d better carefully design systems so that you 1) minimize what they have to learn, 2) make it easier for them to learn it, and 3) maximize the benefit from what they learn. Too often, security is at odds with getting the job done. “As long as configuration errors (false alarms) are common, any technology that requires users to observe security indicators and react to them will fail as attacks can simply masquerade as errors, and users will rationally ignore them.” She recommends meeting the user halfway by building new security models that actually fit the users’ needs.

How to deal with the fact that users can’t learn much about security Read More »