You’ve registered for how many credit cards at this point in your life. Worked for how many different employers. Had accounts at how many different banks since the first one that was ever opened for you. All of these entities had or have systems that contained your PII, and likely, answers to security questions that you provided.

The problem with “security questions” is that they’re actually a worse practice than using the same password across every site on the internet.

They’re worse because — like in the screen below — the answers to the questions are immutable truths. Site-to-site, they never change if you answer honestly, and you likely use the same ones no matter what site is asking for them.

This is an ancient practice and needs to stop. It’s no secret how to provide yourself some relief from this security trap:

give bogus answers.

Ugh, I can’t believe I misspelled Seagal.

You’re going to lose some convenience here. You won’t remember the answers when you need them, and you’ll have to write them down or print them out and store them away safely. That’s actually a practice that is orders of magnitude safer than using soft, easy to guess answers or worse — using truthful answers that can be leveraged against every single account on the planet with your name on it.

Be smart, don’t fall for bad security. Think outside of the dropdown.

-cp

Being an infosec guy isn’t easy. Like most IT positions, you’re always in the way of progress and innovation, you’re the bad cop, the “no” guy, the pain in the ass, the guy people would rather not talk to and just go about their business, until their business requires your involvement, at which time you suddenly become embraced as a welcome and trusted partner who will help make things whole again. When you’re not everyone’s friend, you’re usually just saying something that no one wants to hear, and it’s hard to keep your head up. It isn’t easy.

Infosec is about culture. The organizational culture either gets it, or they don’t. Those that don’t tread this sort of middle ground where they know enough to consider and implement out-of-the box practices — password strength, least privilege, maybe even basic multi-factor authentication — but not enough to take things any further and think critically about why information security is important, which stunts the organization’s overall security posture and in turn makes them vulnerable.

“Why would anyone want to hack us”

I hear this a lot.

Maybe you have something of value — that one is easy. You have stuff to protect by default. Money, health records, government secrets. In a lot of cases, regulatory requirements steer your infosec strategy for you. It’s easy. And in general, you don’t need a lot of convincing.

Maybe you’re a gateway to something of value — that one is harder. Maybe you have systems that have access to accounts with large amounts of capital. Maybe you personally don’t hold a lot of money, but have high net worth customers who do; their personally identifiable information is a goldmine. You have to think more critically here. It’s not necessarily about what you have; it’s what you as an organization have access to. Those pathways to things worth protecting are just as important as having custody of the things themselves.

Maybe you’re vulnerable. The reality is that many organizations who are hacked or otherwise compromised never started as victims of directed attacks. Hackers and scammers use a shotgun approach, scanning the entire universe for systems with security holes that can be exploited. It won’t be because someone was out looking for you personally, and you can’t even call the fact that they found you bad luck. Insecure systems aren’t bad luck; they’re negligence. The same goes for employees who lack proper training — they’re insecure systems too.

You have disgruntled employees. You have them, whether they still work for you or not. If you’ve rubbed someone the wrong way (whether you know you did or not!) the insider threat is a potent attack vector who already knows the blueprint — even a basic one — to your security model, and where it is the weakest. And if they don’t act on it personally, nothing says they won’t tell someone else about it.

“If they got this information/if we get hacked, it doesn’t matter”

It absolutely will matter. Your organization exists because on some level, it exhibits a level of trust. Otherwise, no one would do business with you!

It’s not necessarily about what hackers will do with the information they take from you; it’s the simple fact that it was taken. No one will keep eating at a restaurant that continually mishandles a customer’s credit card. No one will order wholesale product from a vendor whose order history ends up on the internet for competitors to see. And no one will make a charitable contribution to an organization who had its donations siphoned off to a hacker’s Bitcoin wallet. There’s always somewhere else to do business, and if they’re not doing it with you, you don’t have a job.

But remove the connotation of data loss from the equation. What about the simple notion of being down and unable to perform business? Indefinitely? Try to envision the level of frustration in your organization when no one can access a critical system. Or a core desktop app used to run the business simply won’t operate. Or your enterprise multi-factor mechanism stops operating. Or no one can get on the internet. Now scale that frustration from individuals, to entire departments, to your entire organization. Nothing was stolen and you haven’t lost anything, except the ability to do your job.

You can get away with insecurity for a really long time. But will your business be able to recover? Will you reflect positively on your decision to invest in cleanup, rather than prevention? Will management feel the same way?

Ask yourself why you consider information security a path of resistance, and not what it really is: fundamental insurance for business continuity.

You can’t rationalize away the need for infosec. As security practitioners, we can quantify the cost of a solution. What we can never truly quantify is the cost of a breach, or the cost of downtime. We can estimate those costs, but brand and reputation damages are immeasurable. If you’re serious enough to be in business, be serious about staying in business. There’s no sense in locking your office doors when the ones that really matter — the ones to your data — have no locks.

Take the next steps. Digital signatures. 2-factor tokens. Data-at-rest encryption.

If you can’t get there on your own,

enlist someone to help.

But get there.

Let’s waste zero time and get right to the point — go to the following URL, which will require you to log into your Verizon Wireless account:

https://nbillpay.verizonwireless.com/vzw/secure/setPrivacy.action

Set the following options and click Save Changes:

I recommend you do this immediately, and tell your friends.

-cp

Security-minded and driven by a sense of responsibility to others and the community, Chris Plummer is an (ISC)2 Certified Information Systems Security Professional (CISSP) with a background in systems and information security, having devoted over a decade of support to the Department of Defense. More at: https://www.linkedin.com/in/cplummerc

But in the eyes of your Strava peers, the effort was worthless.

If we could only pat ourselves on the back.

Strava won’t allow it. All manner of clicking your own Kudos button yields the same result:

nothing.

But with Firefox, we can overcome this tragedy of non-recognition.

Inspect the attributes of the Kudos indicator for your activity as it appears in the Activity Feed.

Take note of the name/value pair for the data-entry attribute of button class btn-kudo. Blah blah blah the line above shaded in grey. Copy the number after “Activity”.

Now paste that number into the same element of the Kudos indicator of someone directly below you in the Activity Feed using the Element Inspector.

Go back to the Activity Feed, and press your own Kudos button.

Element Inspector is super useful, and yet has such stomach turning possibilities. Use it for good, and not for evil.

-cp

Connected cars make plenty of headlines these days; the fact that they’re able to be remotely compromised is by no means a surprise. As cars become one with the Internet Of Things (IoT), this was a foregone conclusion.

One needs to strongly consider why they require a vehicle that exposes itself to a worldwide public network; a network through which a malicious third-party can compromise personal safety.

It’s actually a paradigm never seen before. Where before IoT an attacker could “only” quite seriously mess up your personal and financial well-being, now there is the threat of actual bodily harm. This may be a moment where we might want to assess the trajectory of technological progress.

But say you have one of those old-fashioned dumb cars, built after January 1, 1996 — the line in the sand after which every single car and truck in the US was required to be equipped with an OBD-II interface.

The ubiquitous ELM 327 — there are similar such dongles available — provides wireless access to said interface. I chose the 327 for this example because my iPhone will talk to it.

Once plugged in, the ELM 327 broadcasts an access point which requires no authentication. Any iPhone on Earth, within range (admittedly, a quite limited range), can connect to it.

And of course by virtue of iPhone I having access to the App Store, where I can select any one of a number of free OBD-II scanning applications. Alternatively if I am particularly talented, I write my own application.

Let’s presume the application is crudely written, or written in a manner that is designed to overwhelm the CAN bus in a vehicle — effectively, the car’s integrated neural network.

Pretend you have installed an ELM 327 in your own car, and you leave it installed, because you enjoy monitoring the parameters of your car. Perhaps you drive a mechanically interesting vehicle, such as a Subaru WRX, and keep tabs on the components of your forced induction powerplant.

Now pretend I am a bad actor, stuck with you and hundreds of others in the death-and-taxes gridlock of the 405.

Sitting there, going nowhere just like everyone else, I simply scan for available wireless access points; surely in the sea of cars around me there are a few.

And when I’ve found a dongle, I initiate the application on my iPhone. I connect to each one I find, and I relentlessly query the vehicle. I don’t tell the vehicle to do anything — I merely keep asking it for information over and over until it loses its mind.

And when it does, the car goes into a famous failsafe mode — “limp home mode” — where the car has greatly reduced power, rendering it useless on the highway.

So what though. We’re all stuck in traffic, crawling along at 10mph.

Let’s say we’re not. Let’s say we’re at highway speed, flying along some stretch of highway that is not the 405, that actually moves.

That’s how you make traffic, crawling along at 10mph.

Alternatively, pretend I don’t like you very much. And I have access to your car. And I plug a Wi-Fi dongle into your car, and for good measure I tape over the LEDs. You’re unlikely to notice it’s even there.

I’m going to make you really, really unhappy at a time of my choosing.

It’s great time for the bad guys. Let’s not make it easy for them. Be judicious in your use of these wireless scan tools. Think long and hard about your need for an internet connected mode of transportation.

And don’t give your enemies your car keys.

Super Mario Brothers 3

How I was ever able to negotiate for example, the later airship sequences — who knows. The very end wasn’t so hard; it was getting to the very end.

Metroid

I remember that summer, tactically chipping away at the map. Like many before me, I got through Tourian by the skin of my teeth with nervous, laser focus.

Ninja Gaiden

This is a game I have revisited in my adulthood, and even with save states, I can’t get through the final boss sequences. Any kid that beat this game was on another level.

Batman

The music made Batman such a beautiful game. To have beaten this game without the innovation of turbo seems impossible.

Mega Man 2

I can see how was able to get to the Dr. Wiley stages. I just can’t see how I ever got through them.

Zelda 2

Another labor of love, I even wrote my own strategy guide as a result. Ganon kicked my ass so many times before I finally had my moment.

Teenage Mutant Ninja Turtles

Getting to the Technodrome, and then getting through the total chaos inside, and then defeating Shredder. How.

I loathe this show. It is quintessential “reality show” bad acting, the entire show is staged, the homes they view are never actually homes they are choosing between, or even homes that are for sale in some instances. It’s all a setup, and yet…sigh. We watch.

I pay sparse attention to this particular episode, and ultimately fall asleep.

The next morning I decided I would challenge myself. How much could I gather from the internet about last night’s show, based on what little I could remember?

• I remembered that the house they bought was located in “Storrs Mansfield, Connecticut”
• The house was yellow
• I loosely remembered house much the house was worth; it was under [redacted]
• I sort of remembered what the couple looked like; [redacted]
• I might remember one or two rooms of the house if I saw a photo of them

At this point, it’s a trivial matter to go down a social media rabbithole, and unearth Twitter, Facebook, Pinterest, and similar profiles, if they exist. It’s not something I did, but one could of course go posting all matter of information found from these sources.

At this point however, I stopped. I stopped because the research I performed took a very interesting turn. There are a few websites I will not post screenshots from, because they took a direction I did not expect: they disclosed [redacted]’s complete date of birth.

Before I discuss DOB, here is a recap of the personally identifiable information I currently have for [redacted], all of which was obtained freely on the internet in a minimal amount of time:

1. Full name
2. Home address
3. Occupation
4. Employer
5. Date of birth
6. Voter ID number
7. Work phone

In aggregate, this is very dangerous. This is now a jumping off point for any number of social engineering schemes, based on combinations of these pieces of data. The date of birth in particular is such a disappointing thing to have found, for two reasons:

[A] Individuals are increasingly averse to providing their social security numbers over the phone. Similarly, those who request social security numbers over the phone are not unfamiliar with the scenario of someone not willing to disclose their SSN. Where years ago this aversion may have come across as suspicious, its viewed today as more of an accepted, protective consumer tact. One simply needs to assert that they are unwilling to provide a social, then divulge a waterfall of other private information — and assert DOB in lieu of social — and they are likely to gain confidence with someone, somewhere. A public utility, a town hall, a DMV.

Then by inducing that organization to email or fax some piece of documentation, it’s a matter of time before the identity thief receives something that should have been redacted; some record that should have been undisclosed. Ultimately the identity thief will succeed, because the human element is the easiest measure to defeat, and it always will be.

[B] Everything I wrote in [A] was pure theory until I saw it in practice firsthand. Recently I was in a bicycle accident and suffered some injuries. As a result, I was required to make a number of phone calls to various doctors in an effort to receive records and place appointments. In every single instance, I was never requested to provide anything more than my full name and date of birth.

Transferring this to my research case, having theoretically authenticated on name and birth date, one could easily and without suspicion request for records to be faxed to phony specialists. There would be a challenge to locate a launchpad provider, but not much of one, as most individuals have been seen by their local hospital system at least once. In time, a SSN would be obtained, which would lead to all manner of predictable chaos.

***

It’s a disappointing state of affairs in the United States that personally identifiable information is so easily and freely obtained, and divulged. And of course, it’s hard to lobby for change when individuals are so willing to provide PII in the first place. We have, in essence, a culture of “privacy apathy”, fueled by a system of relatively weak consequences and no real will on the part of individuals to protect themselves. My suspicion is that only a small percentage of individuals truly take the matter seriously, and I suspect the larger percentage of that small percentage are only invested because they have been a victim of fraud.

The fundamental issue is one of awareness. We lack the culture of privacy required in order to influence the direction of PII handling in this country, and I hope this research piece serves as a catalyst for at least one person who can influence the direction of their organization. Or it simply induces you on an individual level to enroll in credit monitoring, or identity protection, or to enroll in two-factor authentication, or for you to simply buy a decent paper shredder and use it.

-cp

Security-minded and driven by a sense of responsibility to others and the community, Chris Plummer is an (ISC)2 Certified Information Systems Security Professional (CISSP) with a background in systems and information security, having devoted over a decade of support to the Department of Defense. More at: https://www.linkedin.com/in/cplummerc

It’s hard to argue that one of the fundamental goals of digitizing print media is usability innovation. In 2015, it’s no longer enough to simply make something available — acceptable twenty years ago, today that’s a weak aspiration. You must deliver an experience — something unique to the medium — or you’ve all but wasted your time.

This is precisely the challenge faced by ebooks, for example. Where digital books lack the tactile warmth provided by bound media, they offer strengths that a stack of books cannot contend with. Convenience, durability, ability to search, possibly form factor — all compelling pieces of the ebook value proposition.

As I “thumb” through the online flyer, I experience several usability issues that positively sink my level of endorsement for the Target’s particular implementation:

Poor navigation

Remember how one uses a printed flyer. It’s not a piece of material that is patiently read. One tends to “fly” through it, scanning content, flipping pages every few seconds. To this end, Target has employed basic forward/back arrows that facilitate linear page changes, and a slider that presumes to move the user through the pages at speed.

Sadly, the slider’s performance is pitiful. It behaves unpredictably, rarely moving in the intended direction, responding erratically. Where the user of a printed flyer may need to rapidly advance or return to a particular section, this action is rendered all but futile. The experience is maddening.

No apparent way to zoom

A known shortcoming of digital media is that unlike the printed page, you can’t necessarily just pull the whole thing closer to your face. An intermediary function is required — a zoom function. Nearly everyone has control-plus’d in a web browser (try it now!); those under the age of 30 by accident, those over the age of 30 out of necessity.

Try as I might, I could not zoom the Target flyer. I spent an inordinate amount of time trying to solve this, as there were very small details I truly could not read clearly. I then gave up, grew angry, and wrote this summary of my experience.

Don’t Forget Chrome

It’s plausible that these issues are isolated to Google Chrome, and that under some other browser, the online flyer I’ve been viewing works as intended. In fact, it is slightly better in IE, leading me to believe that Google’s browser was forsaken by the team at Target, based on some unknown heuristic.

The fundamental flaw in reasoning here is that it makes no sense not to fully consider Chrome in your usability testing. Where the absolute browser market share figures vary between Netmarketshare, StatCounter, W3Counter — there is undeniable relativity — Chrome is trending positive. In fact, not only is Chrome consistently positive, but it grows at a similar rate that Internet Explorer tracks downward.

Some metrics have IE on top, some have Chrome on top, but the common thread is the same — if Chrome isn’t already #1, it’s on a trajectory to be there. For any web based effort, it is a prime consideration.

While the fight for innovation, usability, and interoperability marches on, please keep printing flyers. It’s been a cold winter, and I struggle to start a fire without them.

-cp

I passed a woman who was merging on the highway yesterday while she was texting behind the wheel of a Honda Pilot.

An occasional Pilot driver myself, I thought about how completely stupid one would need to be to feel like this was worth doing. At 4,600 pounds, the Pilot is a lot of truck for most people, and it’s capable of putting a serious hurt on whatever or whoever it runs into. It’s hardly a safe practice to distract yourself while driving anything, but the stakes are exponentially higher as the size of the vehicle grows.

I then wondered if our “smart” phones could be engineered with enough “smart” to warn the user that they are doing something like this — something patently unsafe.

My VW, for example, will not allow the driver to enter numbers or letters on its touchscreen without first acknowledging that doing so while driving is unsafe.

There really wasn't any consumer backlash about that — VW just did it. It wasn't something drawn out in the court of public opinion, where good intentions go to die. It was a unilateral decision by a manufacturer to introduce functionality to foster a consciousness of safe driving.

Why then could the phone’s firmware not perform the same function.

Not an app that must be installed or otherwise initiated, but the operating system of the phone itself. It would have an awareness of the speed at which the phone travels through space. If the phone was being used at a predetermined speed, it could render a simple reminder. Not an overbearing warning per se, but something that requires the user to acknowledge that they’re operating in a safe manner (for example, they are a passenger). And of course the corollary — that they are driving, and they can click through the message, fully cognizant of their own dangerous behavior.

We’re not trying to create an enforcement mechanism. Heavy handed enforcement comes with subversion. In truth, perhaps the user could disable this messaging altogether through perfectly legitimate means, like a control panel.

But at least ship the phone in such a default state, with the messaging in place. Such a mobile operating system would then outwardly demonstrate the kind of power it has: to not only improve the workflow of daily life, but to help preserve that life.

Auto manufacturers have introduced unprecedented technological improvements — lane guidance, blind spot/rear bumper/quarter panel monitoring, accident detection, object recognition, fully automatic cruise control — all of which are designed to mitigate driver error. We have given up on creating a better driver. We are catering to their distractions. The precedent is set.

Handsets, they must now do their part.

A 2000 Lexus RX300 loaner car with 345,137 miles

My loaner car. An ode to this worn-out mule of an automobile.

A Lexus RX300; 2000 vintage. 345,137 miles. Around the time this very vehicle was minted, I lusted for it. I was drawn to its electroluminescent gauges. Something about them seemed exclusive, and I wanted them. Thirteen years later, they glow before me. They’re alright.

When I turn the wheel at low speed, the steering column emits a sound like an aggravated housecat. It’s incredibly consistent.

The sound system is remarkable, not just for a car of this age, but any car. No worse for wear. Except the radio antenna makes an unnerving crunch each time the system powers off and on. If I were a nicer, well-meaning guy, I’d replace it.

This car has excellent visibility. Certainly more space than my Forester. It’s nice.

It’s quite easy to get into. Less a driver’s seat, more a captain’s seat. The folding armrest is always in the way when I buckle in. This seems tragically designed, but I survive.

The trip computer, like many, appears more complicated than it really is. I grow comfortable with it after a short time. The fuel economy and trip time are labelled “Cruise Information”.

How appropriate. This thing handles like BOAT. It goes down the highway really well, in the sense that once you let off the accelerator, the car holds some momentum. The brakes are terrific. But this thing doesn’t change lanes, it swims. And in heavy turns, you strongly sense she wouldn't take much to capsize.

The interior is trimmed with several woods; the panel around the window switches almost certainly having been replaced at some point as these doors have been opened and interacted with, what, maybe ten thousand times.

The directional and wiper stalks were raided from the same parts bin as every Subaru I’ve ever owned. How weird.

The heated seats are superb. I long to have these again. Such a difference.

Blemished, scratched, worn. A hard life, but not too hard. It’s still here.

The shift into overdrive is occasionally rugged; I expected worse.

Her motor has sack, although I’m not always sure where that’s going to be.

Altogether I’m thrilled at how well it has held up, naive to the maintenance involved to get it here. But at once I feel a solidarity with the worked over Grand Cherokee that passes me with impatience as I bring this thing to the highway for the first time. A bond with the nicked-up early model A8 I soon overtake. With the beat up M-Class, and the improbable Wagoneer. May all of us live forever.