Tag Archive for Cybersecurity

School Kids’ Data at Risk

School Kids' Data at RiskIn the Huffington Post article, “In Push For Data, Schools Expose Students To Identity Theft” author Gerry Smith writes about the growing risk of school kids data being stolen across the country. Data thieves want this information to commit identity theft. The author cites several recent cases:

Child identity theftThe article says these incidents highlight the growing risk of school kids’ vulnerability to identity theft. Across the country, schools have become conduits for children’s pristine Social Security numbers, which are increasingly falling into the hands of credit-hungry identity thieves. The frequent data breaches have prompted calls for schools to stop collecting sensitive student data and have angered parents like Art Staehling, whose 14-year-old daughter was among 18,000 Nashville students who had their Social Security numbers accidentally exposed online for three months in 2009.

“They left the gate wide open,” Staehling told The Huffington Post. “It’s clumsiness. There’s no excuse for it. If schools want that information, there should be some sort of penalty paid if they don’t guard it with their lives. I haven’t found a reason why they honestly need it.”

Socail security numberSchools collect students’ Social Security numbers as part of a campaign to more precisely track their progress. But privacy experts told Huff Post there are less risky ways to identify students, accusing schools of needlessly exposing children to identity theft by gathering their Social Security numbers in central databases with lackluster security.

The push for collecting student data began under the federal No Child Left Behind Act. Financial incentives in the 2009 stimulus package, including Race to the Top‘s $250 million in competitive grants drove schools to collect student social security number, according to Reidenberg.

Electronic school recordsThe U.S. Department of Education has warned schools not to use students’ Social Security numbers in their databases. The Huff Post says the Feds urge schools to create other unique identifiers. Social Security numbers are “the single most misused piece of information by criminals perpetrating identity thefts,” according to a technical brief issued last fall by the National Center for Education Statistics.

Despite the warnings, the collection and use of students’ Social Security numbers in K-12 schools remains “widespread.” An audit last year by Patrick O’Carroll, the Social Security Administration‘s inspector general found students’ Social Security numbers printed on transcripts, tests and athletic education forms. According to the article, The audit concluded that schools were using the numbers “as a matter of convenience.” O’Carroll found there have been at least 40 data breaches of confidential student information at K-12 schools since 2005.

“We believe the unnecessary collection and use of Social Security numbers is a significant vulnerability for this young population,” O’Carroll wrote. “Each time a student provides his or her Social Security number, the potential for a dishonest individual to unlawfully gain access to, and misuse, the number increases.”

Read Part 2 here:

rb-

Consumers Unions points out that Michigan law restricts how Social Security numbers can be used. In Michigan, SSNs cannot be printed on ID cards, intentionally communicated to the public and/or publicly displayed or mailed within an envelope.

 

 

ITU Regs Bad for Cybersecurity

UN tries to control the InternetEmma Llansó at the Center for Democracy & Technology writes that the International Telecommunication Union is ill-suited to regulate cybersecurity. The United Nations backed ITU will meet in December to try to expand its control over the Internet. The CDT believes that the issue of cybersecurity perfectly illustrates why the ITU should not be given expanded regulatory authority to include matters of Internet governance.

Center for Democracy & TechnologyThe UN body is holding the World Conference on International Telecommunications (WCIT) this December in Dubai, UAE to renegotiate the International Telecommunication Regulations (ITRs), the UN’s core telecommunications treaty. The ITRs were in 1988 and sets forth general principles for the operation of international telephony systems. The CDT reports that some Member States of the ITU want to use the WCIT to expand these regulations to Internet matters by amending the ITRs. The CDT and others have warned of the risks to online freedom and innovation if the UN is allowed to regulate the Internet. The CDT has released a paper (PDF) that examines in detail some of the proposals pending before the ITU relating to cybercrime and cybersecurity.

The CDT states that, cybersecurity is undeniably a critical issue for the future of telecommunications and indeed for global commerce, development, and human rights. On the other hand, it is ill-suited to the kind of centralized, government-dominated policymaking that the ITU represents.

The U.N. Threat to Internet FreedomCybersecurity requires agility: Given the pace of technological change, governmental bodies are not likely to be the source of effective technical solutions. The CDT predicts, those solutions will emerge from multi-stakeholder efforts, involving ICT companies, technologists, academics, and civil society advocates, as well as governments.

Moreover, the cybersecurity issue inevitably leads straight into questions of human rights and governmental power: surveillance, privacy, and free expression. None of these are issues the ITU has any expertise in or any ability to assess and balance. The CDT suggests, rather than adopting vague wording that could be used by governments as justification for repressive measures, the ITU should endorse existing standards initiatives such as those underway at the IETF and continue to serve as one forum among many for the development of consensus based, private sector-led efforts.

According to the CDT briefing, the Arab States regional group has offered a proposal to amend the ITRs to require Member States to “undertake appropriate measures” to address issues relating to “Confidence and Security of telecommunications/ICTs,” including “… online crime; controlling and countering unsolicited electronic communication (e.g Spam); and protection of information and personal data (e.g. phishing).” The governments of the middle-east have a history of manipulating the Internet to silence dissent.

Another example on why the UN should not control the Internet comes from the African Member States cybersecurity proposal which deals with data retention. The CDT reports the requirement will force communications companies to retain data about customers and communications for the benefit of the government rather that for business purposes.

UN against US ConstitutionAnalysis by CDT says that this requirement goes against American criminal laws. This data retention law turns the presumption of innocence on its head, since these cybersecurity data retention laws apply to every citizen regardless of whether they have committed a crime. Further, because data retention laws require service providers to store information that identifies individuals online, they threaten anonymity online, implicating the rights to both privacy and free expression.

The CDT writes that several cybersecurity proposals to amend the ITRs refer to the routing of communications. One proposal from the Arab States regional group would amend the ITRs to specify that “A Member State has the right to know how its traffic is routed.”

National securityThe proposal is justified on the grounds of security, according to the CDT which some Member States clearly interpret to mean national security. In its comments, Egypt argued, “…  Member States must be able to know the routes used … to maintain national security. If the [Member State] does [not] have the right to know or select the route in certain circumstances (e.g. for Security reasons), then the only alternative left is to block traffic from such destinations…”

The brief explains that Internet protocol (IP) networks transmit communications and interconnect entirely differently than traditional telephone networks; in that context the Arab States proposal to “know how traffic is routed” simply would not work and could fundamentally disrupt the operation of the Internet. If the Arab States proposal were applied to all Internet communications, the requirement that countries be able to “know” how every IP packet is routed to its destination would necessitate extensive network engineering changes, not only creating huge new costs, but also threatening the performance benefits and network efficiency of the current system.

The brief goes on to explain that the Arab States proposal could also serve to legitimize governmental efforts to establish controls on Internet traffic, by enshrining in an international treaty. Changes to IP routing procedures to implement the Arab States cybersecurity proposal could give Member States additional technical tools to use to block traffic to and from certain websites or nations. The regulations on routing that the Arab States proposal condones could take a variety of forms, from prohibiting certain IP addresses from being received inside a country to tracking users by IP addresses and blocking specific individuals from sending or receiving certain communications. “Knowledge” of IP routing could also encompass countries keeping track of what websites their citizens visit or with whom they email – all in the name of national security.
These types of regulations, which could be legitimized if the Arab States proposal is adopted, could threaten user rights to privacy and freedom of expression on the Internet.

rb-

The UN must not be allowed to expand its control over the Internet.  ITU regulation will be bad for cybersecurity.

 

Internet of Things

Help – My Thermostat is Calling Home to China!

ThermostatPhil Neray of Q1 Labs, an IBM (IBM) company posted that in the recent Chinese hack of the U.S. Chamber of Commerce’s network, one attack vector was a thermostat. The thermostat at a Chamber town house on Capitol Hill which was communicating with an Internet address in China and a printer spontaneously started printing pages with Chinese characters (rb- I wrote about securing printers here).

The blog says that the hackers were in the network for more than a year before being detected is not unusual. Mr. Neray cites the 2011 Data Breach Investigations Report, more than 60% of breaches remain undiscovered for months or longer (versus days or weeks).

rb-

This is one of the risks of the Internet of Things. Security is in the era of IoT will have to use machines to monitor the machines.

CIA Chief: We’ll Spy on You Through Your Dishwasher

Dishwasher Spencer Ackerman at Wired points out that more personal and household devices are connecting to the internet, forming the Internet of Things and U.S.CIA Director General David Petraeus cannot wait to spy on you through them.

General Petraeus recently spoke about the “Internet of Things” at a summit for In-Q-Tel, the CIA’s venture capital firm. “‘Transformational’ is an overused word, but I do believe it properly applies to these technologies particularly to their effect on clandestine tradecraft” the blog recounts.

Mr. Ackerman predicts that people will be sending tagged, geolocated data that a spy agency can intercept in real-time when they open their Sears (SHLD) Craftsman garage door with an app on an Apple (AAPL) iPhone. “Items of interest will be located, identified, monitored, and remotely controlled through technologies such as radio-frequency identification, sensor networks, tiny embedded servers, and energy harvesters — all connected to the next-generation internet using abundant, low-cost, and high-power computing,” Petraeus said, “the latter now going to cloud computing, in many areas greater and greater supercomputing, and, ultimately, heading to quantum computing.”

Wired says the CIA has a lot of legal restrictions against spying on American citizens. But collecting ambient geolocation data from devices is a grayer area, especially after the 2008 carve-outs to the Foreign Intelligence Surveillance Act. Hardware manufacturers, it turns out, store a trove of geolocation data; and some legislators have grown alarmed at how easy it is for the government to track you through your Apple iPhone or Sony (SNE) PlayStation.

rb-

The implications of the “Internet of Things” is profound when linked the transformational nature of the connected home network. The CIA sees great opportunity in wired home devices. Any home gadget with RFID, sensor networks, embedded servers, or energy harvesters is ripe for interception by spy agencies.

Koubachi Wi-Fi Plant Sensor Gives Your Plant a Voice

Koubachi Wi-Fi Plant Sensor Gives Your Plant a Voice Koubachi, the Swiss start-up company behind the popular iPhone plant care assistant presented its newest innovation at CeBIT 2012 in Hannover: the Koubachi Wi-Fi Plant Sensor according to ITnewsLink.

Building on the success of its popular interactive plant care assistant, Koubachi launched a Wi-Fi Plant Sensor that integrates into the Koubachi system to literally gives your plant a voice.

The Wi-Fi Plant Sensor measures soil moisture, light intensity and temperature. Using Wi-Fi, the data is sent to the Koubachi cloud, where it is analyzed by the Koubachi Plant Care Engine. The plant owner gets a detailed care instructions on watering, fertilizing, misting, temperature and light through push notifications or email. “The Koubachi Wi-Fi Plant Sensor is the first device ever that enables real-time monitoring of the plant’s vitality” says Philipp Bolliger, CEO of Koubachi, “It’s a truly unique product in the field of “Internet of Things” and bringing state-of-the-art technology to plant care.”

Smart Gadgets are Like Sleeper Cells in Your Kitchen

Smart meterManufacturers are “future-proofing” their appliances with “Internet of Things” capabilities that are latent for now. Christopher Mims at MIT’s Technology Review asserts that major appliances bought in the last three years probably contain a Zigbee capable wireless radio that can send out information about a device’s status and energy use and receive commands that alter its behavior.

Many appliance makers don’t announce these capabilities, Mike Beyerle, an engineer at GE (GE) whom Mr. Mims interviewed about GE‘s Nucleus home energy management system. “We want to build up a base before we make a big deal out of it,” says Mr. Beyerle.

The author says that manufacturers aren’t telling consumers what their devices are capable of because, in part, those abilities are useless without an energy management hub like GE’s Nucleus or a utility company‘s smart meter. In both cases, smart appliances must be “bound” to a hub to communicate with the outside world.

Once a device is hooked up to an energy management system and become part of the IoT, it get interesting. Mr. Mims says that users who signed up for a “demand response” program with their utility to get a lower bill, enable the utility to control their appliances. For example a refrigerator’s ice maker’s defrost cycle or the elements in a clothes dryer can be manipulated to drive down power use during times of peak demand.

rb-

Most people do not realize that installing a new smart meter can activate a technological sleeper cell in their HDTV, kitchen or laundry room. All of these “smart” devices will be part of the “Internet of Things.” They will have an IP address (probably an IPv6 address) and will be broadcast via a Zigbee wireless network. This is why the CIA says it can spy on people through their dishwasher.

Connected Kitchen

Connected KitchenEngadget says the Samsung RF3289 fridge is designed to let users access Pandora or tweet while grabbing a snack. Samsung touts it as the first to feature integrated WiFi. The Wi-Fi also offers the ability to view Google calendars, check the weather, download recipes from Epicurious, or leave digital notes

Engadet also reports LG’s Thinq line of connected appliances includes vacuum, oven, refrigerator, and washer / dryer. They support Wi-Fi and ZigBee to communicate with each other, the smart meter, smartphones and tablets.  That’s a pretty strong foundation to build the Internet of Things especially if the home is already equipped with ZigBee devices. CNET says the line can be troubleshot remotely; tech support can log in to the device see what’s wrong and fix it. Kenmore has a similar product line.