Risks Digest 27.39

[RISKS List Owner <risko () csl sri com>]

RISKS-LIST: Risks-Forum Digest  Monday 29 July 2013  Volume 27 : Issue 39

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
  <http://catless.ncl.ac.uk/Risks/27.39.html>
The current issue can be found at
  <http://www.csl.sri.com/users/risko/risks.txt>

  Contents:
First-hand report from Philadelphia Airport shutdown (Dave Farber)
Jurors jailed for contempt of court over Internet use (George Ross)
And now, from the country that brought you INCIS and Novopay...
  (Richard A. O'Keefe)
Information is Beautiful: relative sizes of data losses (Nico Chart)
"Information Consumerism: The Price of Hypocrisy" (Evgeny Morozov via
  Prashanth Mundkur)
"Scientist banned from revealing codes used to start luxury cars"
  (Lisa O'Carroll via Gene Wirchenko)
"What else can Congress bungle? Their passwords, for starters"
  (Robert X. Cringely via Gene Wirchenko)
Is your computer spying on you? (Henry Baker)
Is Your Cable Box Spying On You? (Christopher Zara via Henry Baker)
"Feds Indict 5 in Largest Hacking, Data Theft Ring in U.S. History"
  (ABC via Gene Wirchenko)
"U.S. agents 'got lucky' pursuing accused Russia master hackers"
  (Gene Wirchenko)
"Apple's developer site overhaul continues following breach" (Jeremy Kirk
  via Gene Wirchenko)
If you have a rooted Android device, don't rush to install 4.3
  (Lauren Weinstein)
NASDAQ's Sloppy, After-hack, Phishing-like password reset message
  (Lauren Weinstein)
Abridged info on RISKS (comp.risks)

----------------------------------------------------------------------

Date: Sun, 28 Jul 2013 18:01:04 -0400
From: Dave Farber <dave () farber net>
Subject: First-hand report from Philadelphia Airport shutdown

Philadelphia Airport without power -- went out courtesy of too much rain.
Can't get to the planes.   The computers are down.  Everything's out.

------------------------------

Date: Mon, 29 Jul 2013 17:08:00 +0100
From: George Ross <gdmr () inf ed ac uk>
Subject: Jurors jailed for contempt of court over Internet use

Following up on previous RISKS items:

"Two jurors have each been jailed for two months for contempt of court after
one posted Facebook comments and the other researched the case on the web.
..."
//www.bbc.co.uk/news/uk-23495785>.

George D M Ross MSc PhD CEng MBCS CITP, University of Edinburgh,
School of Informatics, 10 Crichton Street, Edinburgh, Scotland, EH8 9AB

------------------------------

Date: Mon, 29 Jul 2013 10:26:45 +1200
From: "Richard A. O'Keefe" <ok () cs otago ac nz>
Subject: And now, from the country that brought you INCIS and Novopay...

Summary: NZ's new "Electronic Operating Model" for courts is late and
over budget; staff appear to have been mismanaged; and the government
has already closed some courts in anticipation of benefits from a
system that may not operate until next year.

Justice Minister Judith Collins announced in 2011 that the NZ Government was
"amending criminal procedure to bring [the justice system] up to date with
[the] 21st century... Within the District Sourts, around 60% of criminal
procedures will be new or changed.  Where old law required paper records,
the Act allows use of technology to exchange information ..."  The
"Electronic Operating Model" was to be introduced "later in 2013", replacing
the current paper-based court record.  It was then estimated that charges
would be processed up to 70% faster and that the Ministry of Justice and
Police would be saved "around 93,000 hours a year".  -- Extracted from
  http://my.lawsociety.org.nz/news/electronic-operating-model-outlined

I'm not sure when work started, but the "2010/11 estimates examination;
responses to the additional questions: Vote Courts" document, which is
missing from its home but still in Google's cache, suggests that it was
already in the 2010 budget, as part of a "Criminal Procedure Simplification
programme" that appears to have included paperwork streamlining as well as
computerisation.  This would be the Criminal Procedure Act 2011, described
as the "biggest reform of criminal procedure in 50 years", and "enabled an
electronic operating model:.

The same document says
 - the first phase will involve the electronic filing, management, and
   disposal of an estimated 270,000 charges/year from the Police; this would
   take about 2 years with the first charges processed by mid-2012.

 - costs were expected to be NZD 11.2 million capital and NZD 7.8 million
   operating expenses between 2010/11 and 2013/14.

 - benefits were expected to equal costs for the first phase.

 - the first phase was to "start establishing the platform for a wholly
   electronic criminal summary operating model", but was not yet to _be_
   that model.

-- Extracted from
http://webcache.googleusercontent.com/search?q=cache:hoquQTJVMaIJ:www.parliament.nz/NR/rdonlyres/5264E59A-204D-400B-A71D-450064F8CD4C/148485/49SCJE_EVI_00DBSCH_EST_9923_1_A56701_MinisterofCou.pdf+%22Electronic+Operating+Model%22+New+Zealand+Justice&cd=5&hl=en&ct=clnk&gl=nz&client=safari

If I'm reading the "Briefing for the Incoming Minister" correctly, that was
in the context of a total Vote Courts budget of NZD 438 million,

Quoting that document:

    The court system is one of the few examples of a significant national
    service delivery model that still relies predominantly on paper.  Given
    the technology available, a paper-based court record is resource
    intensive, cumbersome and inefficient.  The system is also open to error
    from manual transcription into other administration systems, and at risk
    of loss, damage or misuse.

    The EOM project addresses these issues by reducing, simplifying, and
    automating a number of steps in handling and processing of the court
    record.  This will improve and better control access to official court
    records regardless of location, and reduce the risk of misuse or loss of
    information.  Having a single authoritative record will also increase
    the quality of information available to justice agencies.

  
http://www.justice.govt.nz/publications/global-publications/b/briefings-to-incoming-ministers-2011/documents/VOTE%20COURTS%202011%20BIM%20FOR%20RELEASE.pdf

The concern to reduce error is praiseworthy.

Phase 1 was supposed to begin operation in March this year.

However,

    From 1 July 2013, implementation of the justice sector's Electronic
    Operating Model will begin with the electronic filing of Police charges.
    We asked why the implementation of the electronic filing of judicial
    decisions has been delayed until 2014.  We heard that an audit of the
    Ministry of Justice project found the programming to be more complicated
    than expected.  Some processes have already been tested, but real-time
    live trials of the system will also be conducted before the progressive
    implementation at courts next year.  The technology will reduce the time
    involved in handling documents and make them more easily accessible.  We
    will follow the implementation of the Electronic Operating Model
    closely.  -- Extracted from http://www.parliament.nz/resource/0001682426

The system is now being described as costing "$30 million".

> From an article printed on page 6 of the Friday July 26 issue of *The Otago
Daily Times*, reprinted from *The New Zealand Herald*:

  - The project was flagged at risk and getting worse in November 2012
  - "the project was reporting that these technical matters would be
    sorted out"
  - Staff "were compelled to work evenings and weekends"
  - under "three extraordinarily high work streams"
  - resulting in "key resignations amid prolonged work periods",
    also described as "a wave of resignations"
  - During all this high pressure, "staff were moved to a
    different floor of the national headquarters, which had seating
    for only 45 of the 48 staff, and more were hired".

Sounds to me like some manager at the Ministry of Justice (possibly
Crazy Eddie from the Mote) had never read 1 Kings 12.

The thing is that on the 3rd of October last year,
it was announced that
    31 jobs would be lost at 13 courts
    4 courts would be closed
    9 would have their hours slashed
    2 of those 9 would be reconsidered for closure in 2013
    and "two tiers of management [would] have to reapply".
    a net reduction of 68 staff

-- extracted from
http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10838100

The changes duly took place this year, in anticipation of the
benefits of the new system...

I wonder if any of the decision-makers had heard of "counting your
chickens before they're hatched"?

------------------------------

Date: Mon, 29 Jul 2013 07:21:02 +0000
From: Nico Chart <Nico.Chart () pdgm com>
Subject: Information is Beautiful: relative sizes of data losses

David McCandless of the "Information is Beautiful" website has produced a
nice graphic illustrating the relative sizes of famous data losses
http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/.

Nicholas Chart, Senior Technical Consultant (Epos Infrastructure), Paradigm,
Dukes Court, Duke Street, Woking, Surrey, GU21 5BH, +44 (0)1483 758146

------------------------------

Date: Sun, 28 Jul 2013 16:17:11 -0700
From: Prashanth Mundkur <prashanth.mundkur () gmail com>
Subject: "Information Consumerism: The Price of Hypocrisy"

Evgeny Morozov, Frankfurter Allgemeine Zeitung, 24 July 2013.

A lengthy take on surveillance, online culture and Silicon Valley, with
interesting links to examples of the current 'smart' bubble, like 'smart
forks', 'smart toothbrushes', 'smart umbrellas', and 'smart shoes' (patented
by Apple!).

http://www.faz.net/aktuell/feuilleton/debatten/ueberwachung/information-consumerism-the-price-of-hypocrisy-12292374.html

------------------------------

Date: Sat, 27 Jul 2013 14:58:49 -0700
From: Gene Wirchenko <genew () telus net>
Subject: "Scientist banned from revealing codes used to start luxury cars"
  (Lisa O'Carroll)

Lisa O'Carroll, *The Guardian*, 26 Jul 2013
High court imposes injunction on Flavio Garcia, who has cracked
security system of cars including Porsches and Bentleys
http://www.guardian.co.uk/technology/2013/jul/26/scientist-banned-revealing-codes-cars

------------------------------

Date: Mon, 22 Jul 2013 13:21:24 -0700
From: Gene Wirchenko <genew () telus net>
Subject: "What else can Congress bungle? Their passwords, for starters"
  (Robert X. Cringely)

Robert X. Cringely, InfoWorld, 19 Jul 2013
Data leak proves yet again that DC politicos are even less tech savvy
than your grandma (no offense to grandmas)
http://www.infoworld.com/t/cringely/what-else-can-congress-bungle-their-passwords-starters-223078

------------------------------

Date: Fri, 26 Jul 2013 06:42:33 -0700
From: Henry Baker <hbaker1 () pipeline com>
Subject: Is your computer spying on you?

I did an experiment on my Windows 7 machine yesterday.

I right-clicked on the wireless connection in my system tray to Open Network
and Sharing Center.

I then clicked on Access type: Internet Connections: Wireless Network
Connection in order to get the Wireless Connection Status panel to display
(it's much easier to do this in Windows XP).

This Wireless Connection Status panel displays the number of bytes sent &
received on the wireless connection since the last time it was reset.

(This wireless connection is the only connection this particular computer
has with the outside world.)

I then turned off every background task on this machine that I could find
that didn't seem relevant to simply running my local Windows machine.

I then left the machine alone for several hours.

Even though the machine is doing *nothing* (no browser, no e-mail, no file
server, no music serving, etc.), there is still some residual amount of
network traffic that runs to megabytes over several hours.

Interestingly, there was almost 3x the traffic being *sent* as being
*received*.

I then tried the same experiment with my Windows XP machine.  Simply
right-click on the wireless icon in the system tray and click on 'status'.

The result: much less traffic -- essentially zero.

Perhaps someone on this list has an explanation for this phenomenon.

------------------------------

Date: Sun, 28 Jul 2013 04:48:21 -0700
From: Henry Baker <hbaker1 () pipeline com>
Subject: Is Your Cable Box Spying On You? (Christopher Zara)

FYI -- What could possibly go wrong here?

Christopher Zara, *IB Times*, 26 Jul 2013
Is Your Cable Box Spying On You?  Behavior-Detecting Devices From Verizon, Microsoft And Others Worry Privacy Advocates
http://www.ibtimes.com/your-cable-box-spying-you-behavior-detecting-devices-verizon-microsoft-others-worry-privacy-1361587

Pay-TV providers like Verizon and tech giants like Microsoft are developing
devices that can monitor our behaviors as we watch TV and play games.
Reuters

``Watching the watchers'' is taking on a whole new meaning.

News that Google Inc. may be developing a television set-top box with a
motion sensor and video camera has rekindled the debate over technology that
can record so-called ambient action. Should a TV-mounted box have the
ability to track our movements, record our voices and monitor our behaviors?
Should cable providers and tech companies be allowed to collect such
information without our consent?

Lawmakers and privacy advocates are asking such questions as companies
continue to experiment with data collection that will extend beyond our
gadgets and into our living rooms and bedrooms. On Thursday, the Wall Street
Journal reported that Google privately showed off a prototype device at the
Consumer Electronics Show in Las Vegas last January. The company is one of
many tech players looking to compete with pay-TV providers, who themselves
have been exploring new ways to capture information about viewers' behavior.

In November, Verizon Communications Inc. filed a patent application for a
set-top box that delivers advertisements based on users' behaviors.  For
instance, two people cuddling on sofa watching TV might see a commercial for
a romantic Disney cruise, while an arguing couple might see a pitch for
couples' therapy. The device would use a combination of motion and audio
sensors to collect information about what viewers are doing as they watch
TV.

Creeped out yet? You're not alone. News of Verizon's plans brought countless
headlines about the potential for Orwellian cable boxes and digital video
recorders, spying on us during our most intimate moments. And legislators
have been quick to respond. Last month, two U.S. congressmen, a Democrat and
a Republican, introduced a bill that would require such devices to be
opt-in, meaning consumers would have to grant explicit consent before
companies could collect data on ambient action. The bill -- dubbed the We
Are Watching You Act of 2013 -- would also require that devices flash
on-screen warnings whenever they are recording such information.

Reps. Michael E. Capuano, D-Mass., and Walter Jones, R-N.C., who sponsored
the bill, called such technology an ``invasion of privacy.'' In a statement,
Jones even acknowledged the data collected through such devices could be
potentially abused by the government itself. ``When the government has an
unfortunate history of secretly collecting private citizens' information
from technology providers, we must ensure that safeguards are in place to
protect Americans' rights,'' he said.

The extent to which Google's set-top box would collect ambient information
is unclear. In its report, the Journal cited only ``people briefed on the
device,'' and a Google representative has not yet responded to a request for
more information. However, the company has reportedly been experimenting
with such technology for several years. As Gizmodo reported in 2007, Google
filed for a patent for an interactive TV that would include an image-capture
device capable of measuring ``how many viewers are watching or listening to
a broadcast.''

And Google and Verizon are by no means lone players. In November, the
Microsoft Corp. (NASDAQ:MSFT) also filed a patent application for a system
that would use its Kinect camera to monitor users' behavior. Kinect will
come attached to Microsoft's forthcoming Xbox One game consoles. Its
always-on sensors can read body behavior, track eye movements and listen for
commands. It even knows how many people are in the room. As Polygon
reported, the device has raised numerous concerns among privacy advocates,
particularly in light of Microsoft's reported compliance with the National
Security Agency's PRISM program.

If it makes you feel any better, Microsoft has vowed to ``aggressively
challenge'' any government attempt to spy on its customers using Kinect
sensors. ``Absent a new law, we don't believe the government has the legal
authority to compel us or any other company that makes products with cameras
and microphones to start collecting voice and video data,'' a company
representative told the Verge this month.

If that doesn't allay your fears, you can visit Microsoft's Xbox One privacy
page.

------------------------------

Date: Sat, 27 Jul 2013 14:50:31 -0700
From: Gene Wirchenko <genew () telus net>
Subject: "Feds Indict 5 in Largest Hacking, Data Theft Ring in U.S. History"

Feds Indict 5 in Largest Hacking, Data Theft Ring in U.S. History
http://abcnews.go.com/US/feds-indict-largest-hacking-data-theft-ring-us/story?id=19772118

------------------------------

Date: Sat, 27 Jul 2013 14:56:44 -0700
From: Gene Wirchenko <genew () telus net>
Subject: "U.S. agents 'got lucky' pursuing accused Russia master hackers"

http://www.reuters.com/article/2013/07/26/us-usa-hackers-creditcards-arrests-idUSBRE96P02Z20130726

------------------------------

Date: Fri, 26 Jul 2013 11:57:22 -0700
From: Gene Wirchenko <genew () telus net>
Subject: "Apple's developer site overhaul continues following breach"
  (Jeremy Kirk)

Jeremy Kirk, InfoWorld, 25 Jul 2013
Apple created a status page showing its progress in rebuilding its
systems following last week's intrusion
http://images.infoworld.com/d/application-development/apples-developer-site-overhaul-continues-following-breach-223429

------------------------------

Date: Sat, 27 Jul 2013 16:41:16 -0700
From: Lauren Weinstein <lauren () vortex com>
Subject: If you have a rooted Android device, don't rush to install 4.3

If you have a rooted Android device, I recommend against rushing to install
Android 4.3 for now. It appears that 4.3's new protection model may require
re-rooting devices in various situations (and require a new, rather kludgy
workaround, for now at least), and unless you have some reason to push
through 4.3 quickly (which is a relatively minor update in most other
respects) I would suggest holding off until best practice procedures have
been developed and promulgated. If you don't root your devices, you won't
care about this, and you can jump to 4.3 immediately and happily.

http://j.mp/1789QjV  (This message on Google+ via NNSquad)

------------------------------

Date: Sat, 27 Jul 2013 07:52:40 -0700
From: Lauren Weinstein <lauren () vortex com>
Subject: NASDAQ's Sloppy, After-hack, Phishing-like password reset message

NASDAQ's Sloppy, Phishing-like password reset message after being hacked?
http://j.mp/14k5Niq  (This message on Google+ via NNSquad)

[name withheld]

NASDAQ wrote the other week that they were hacked badly. They closed the
site for some days. Now I got this email:

  Dear Community Members:
  We are pleased to inform you that your "My NASDAQ" account is again online
  and available. We invite you back to enjoy all the features you have come
  to rely upon, including your portfolio tracker, stock ratings and social
  features. To regain access to your account, please set a new password by
  going to http://community.nasdaq.com/reset-password.aspx, entering your
  email address, and clicking on the "Reset Password" button. You will be
  sent a verification email which contains a link. You can then use that
  link to reset your password.

  Thank you for your patience. You are a valued member of our audience and
  your security is paramount to us.

  Sincerely,   Bruce Hashim,   www.nasdaq.com

The trouble I see is, the URL given is in an HTML mail, and it doesn't
actually go to what is being displayed. Rather, it goes to (numbers munged):
http://www.mmsend10.com/link.cfm?r=[xxxxxxxx]&sid=[xxxxxx]&m=[xxxxx]&u=NASDAQ_OI
S&j=[xxxxxx]&s=http://community.nasdaq.com/reset-password.aspx

Now, I'm not saying it's not legit, mind; I don't know. But mmsend10.com is
owned as follows:

   Registered through: GoDaddy.com, LLC (http://www.godaddy.com)
   Domain Name: MMSEND10.COM
      Created on: 04-Jan-08
      Expires on: 04-Jan-15
      Last Updated on: 02-Jan-13

   Registrant:
   Real Magnet LLC
   4853 Cordell Ave
   PH-11
   Bethesda, Maryland 20814
   United States

   Administrative Contact:
      Pines, Tom  domain-admin () realmagnet com
      Real Magnet LLC
      4853 Cordell Ave
      PH-11
      Bethesda, Maryland 20814
      United States
      +1.3016524025

   Technical Contact:
      Pines, Tom  domain-admin () realmagnet com
      Real Magnet LLC
      4853 Cordell Ave
      PH-11
      Bethesda, Maryland 20814
      United States
      +1.3016524025

   Domain servers in listed order:
      NS1V.DATAPIPE.NET
      NS2V.DATAPIPE.NET

[That does not exactly foster trust on my first take.  LW]

------------------------------

Date: Sun, 7 Oct 2012 20:20:16 -0900
From: RISKS-request () csl sri com
Subject: Abridged info on RISKS (comp.risks)

 The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is
 comp.risks, the feed for which is donated by panix.com as of June 2011.
=> SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent)
 if possible and convenient for you.  The mailman Web interface can
 be used directly to subscribe and unsubscribe:
   http://lists.csl.sri.com/mailman/listinfo/risks
 Alternatively, to subscribe or unsubscribe via e-mail to mailman
 your FROM: address, send a message to
   risks-request () csl sri com
 containing only the one-word text subscribe or unsubscribe.  You may
 also specify a different receiving address: subscribe address= ... .
 You may short-circuit that process by sending directly to either
   risks-subscribe () csl sri com or risks-unsubscribe () csl sri com
 depending on which action is to be taken.

 Subscription and unsubscription requests require that you reply to a
 confirmation message sent to the subscribing mail address.  Instructions
 are included in the confirmation message.  Each issue of RISKS that you
 receive contains information on how to post, unsubscribe, etc.

=> The complete INFO file (submissions, default disclaimers, archive sites,
 copyright policy, etc.) is online.
   <http://www.CSL.sri.com/risksinfo.html>
 *** Contributors are assumed to have read the full info file for guidelines.

=> .UK users may contact <Lindsay.Marshall () newcastle ac uk>.
=> SPAM challenge-responses will not be honored.  Instead, use an alternative
 address from which you NEVER send mail!
=> SUBMISSIONS: to risks () CSL sri com with meaningful SUBJECT: line.
 *** NOTE: Including the string "notsp" at the beginning or end of the subject
 *** line will be very helpful in separating real contributions from spam.
 *** This attention-string may change, so watch this space now and then.
=> ARCHIVES: ftp://ftp.sri.com/risks for current volume
     or ftp://ftp.sri.com/VL/risks for previous VoLume
 http://www.risks.org takes you to Lindsay Marshall's searchable archive at
 newcastle: http://catless.ncl.ac.uk/Risks/VL.IS.html gets you VoLume, ISsue.
   Lindsay has also added to the Newcastle catless site a palmtop version
   of the most recent RISKS issue and a WAP version that works for many but
   not all telephones: http://catless.ncl.ac.uk/w/r
 <http://the.wiretapped.net/security/info/textfiles/risks-digest/> .
==> PGN's comprehensive historical Illustrative Risks summary of one liners:
    <http://www.csl.sri.com/illustrative.html> for browsing,
    <http://www.csl.sri.com/illustrative.pdf> or .ps for printing
  is no longer maintained up-to-date except for recent election problems.
 *** NOTE: If a cited URL fails, we do not try to update them.  Try
  browsing on the keywords in the subject line or cited article leads.
==> Special Offer to Join ACM for readers of the ACM RISKS Forum:
    <http://www.acm.org/joinacm1>

------------------------------

End of RISKS-FORUM Digest 27.39
************************