photography | mac | lego | open source | sap | gadgets
Security
Automated targeting – you’re the target
You’d think something with a name like ATS or Automated Targeting System is a fire-and-forget military weapon. Instead, the implications of ATS are quite sinister and somewhat scary, especially if you are leaving for, or have traveled to, the land of the free: the USA.
According to the Federal Register Volume 71, Number 212, the ATS is designed to collect and evaluate PNR (Passenger Name Record) information. Briefly, ATS collects and number-crunches such items as:
PNR record locator code,
Date of reservation,
Date(s) of intended travel,
Name,
Other names on PNR,
Number of travelers on PNR,
Seat information,
Address,
All forms of payment information,
Billing address,
Contact telephone numbers,
All travel itinerary for specific PNR,
Frequent flyer information,
Travel agency,
Travel agent,
Code share PNR information,
Travel status of passenger,
Split/Divided PNR information,
Identifiers for free tickets,
One-way tickets,
E-mail address,
Ticketing field information,
Automated Ticketing Fare Quote (ATFQ) fields,
General remarks,
Ticket number,
Seat number,
Date of ticket issuance,
Any collected APIS information,
No show history,
Number of bags,
Bag tag numbers,
Go show information,
Number of bags on each segment,
Other Supplementary information (OSI),
Special Services information (SSI),
Special Services Request (SSR),
Voluntary/involuntary upgrades,
Received from information, and
All historical changes to the PNR
At least they’re modest in their information requirements! Data is collected and evaluated by a computer to assign a risk assessment per passenger to US border officials. Once they have your fingerprints, photographs and answers to their tedious questions, they may then elect to continue with further screening based on the outcome of the evaluation.
The US also insists on retaining the data for 40 years and that you, as the data owner, may never see what they’re collecting. That just makes for a real warm, fuzzy feeling…
NORAD transcripts of 9/11
This is quite a fascinating read and listen, if you have the time. Vanity Fair (not my usual stop on the World Wide Web) has managed to get its hands on audio recordings from the NORAD (North American Aerospace Defense Command) headquarters detailing the events of 11 September. There are apparently more than 30 hours of recordings that have been made available to investigate the hijackings. The 30 hours represent roughly six hours of real time, mixing the chatter of fighter pilots with the confused voices in NORAD headquarters.
USPS security DVD’s
Unbelievable but true: my shipment of free DVD’s arrived from the United States Postal Service. What’s crazy about this sentence? Two things: free DVD’s from the USA and the fact that they arrived in my postbox without South African Post Office employees intercepting them.
Before anyone gets too excited, the DVD’s contain short movies relating to security issues, such as identity theft, Internet fraud and telemarketing scams.
The runtime of each is roughly 15 minutes, yet they provide an interesting angle on current issues and may be valuable for small companies to entertain and educate their employees.
February 3 – virus time!
Numerous reports (here and here) are indicating that a malicious virus may strike computers tomorrow, 3 February. The Nyxem virus is a mass-mailing worm that attempts to disable security settings and software in addition to deleting certain file types. A number of anti-virus software vendors have released fixes and recommendations.
The usual rules apply: don’t open mail you don’t trust, don’t run applications or attachments you don’t trust and don’t panic! If your anti virus software is up to date, there should be little to worry about.
As a final word of advice: if you haven’t switched to Firefox yet, I’d suggest you look into it now.
Compromised credit card
I don’t like banks. But once in a while, they do something right. Just had a call from ABSA’s credit card division. Seems some maladjusted human gained access to my credit card number and did some shopping on the Internet. Thankfully no large amounts! ABSA picked it up and immediately informed me. Sure: I need to get a new card and fill out some paperwork, but at least they showed some initiative!
WMF vulnerability patch
Microsoft has released a patch for the WMF vulnerability sooner than expected. Initially, the patch was to be released only next week, but it has been made available due to tests having been completed sooner than expected. Growing pressure from media and user groups? Anyway, get it here.
Watch those pictures!
A serious vulnerability has been discovered in M$ Windows, allowing damaging code to be included in image files. Since the code sits within the image itself, care should be taken when opening such items in E-mail applications and instant messaging software. Microsoft has been criticized for taking some time to release a fix, and the official update from Microsoft will be released only on 10 January.
One way of reducing the vulnerability is to unregister the DLL shimgvw.dll. Since few computer users know how to do this, it’s hardly a practical response from Microsoft. If you want to try it at your own risk, do the following:
- open a command prompt
- run the command regsvr32 -u %windir%\system32\shimgvw.dll
The result is that the fax and image viewer won’t be launched – to re-instate that functionality, register the DLL again:
- open a command prompt
- run the command regsvr32 %windir%\system32\shimgvw.dll
Sony BMG’s problems continue
So Sony decided to add rootkit software to some of their audio CDs. When users discovered the security holes opened by the installation, they immediately took action. Sony BMG’s initial response: “most users don’t even know what a rootkit is.” That didn’t help its image and certainly didn’t endear it to those affected. Almost certain court action to reclaim damages was the result.
Now, the lawsuit in Texas has been expanded to include the fact that the rootkit software would be installed even if the software installation is aborted or declined by the user. This means even those who don’t normally install this kind of software may have been affected.
via Spiegel Online
DRM circumvented by sticky tape
The mess Sony BMG has created for itself by adding DRM software to certain audio CD’s is far from over. PC owners are threatening to sue the company for damages.
The most amusing aspect is the fact that the copy protection scheme can be broken by applying a small piece of adhesive tape to the outside of the CD. According to Gartner: what makes the Sony BMG incident even more unfortunate is that the DRM technology can be defeated easily. Gartner has identified one simple technique: The user simply applies a fingernail-sized piece of opaque tape to the outer edge of the disc, rendering session 2 — which contains the self-loading DRM software — unreadable. The PC then treats the CD as an ordinary single-session music CD, and the commonly used CD “rip” programs continue to work as usual.
Recent Comments