Category Archives: Security

Malware attacks on virtual world greater than on real world

MetaSecurity’s latest post cites McAfee:

McAfee now sees more malware programmed to steal passwords for World of Warcraft now than trojans aiming for banking information, said Craig Schumager of the McAfee research labs.

This is highly misleading, I say. Banking is not just a brick-and-mortar building with furniture from the 1980s, bad art, and air-conditioning in overdrive. The exchange of funds in the virtual world, in online forums, etc. is now reaching proportions that it rivals or even replaces more traditional forms of access. Call it a back-door to the same assets, if you will. MetaSecurity hints at this perspective in the same post:

In talks with Erik Larkin at PCWorld.com, he outlined why fake game gold is more attractive than real money. Primarily, there’s less risk of getting caught and easier punishments for hacking World of Warcraft than Bank of America, but the gold is still easily commutable to real-world dollars and cents.

It goes deeper than that, as they point out in terms of a “secondary” market:

As Brock Pierce of Affinity Media (formerly IGE), put it “Fraud in the secondary market is rampant. On eBay, secondary sales were resulting in 10 percent fraud at one point I think. Someone in Russia could login through a proxy to a server in the US and make a purchase with a stolen card, turn around and resell it on the secondary market, and sell it for 75 percent in a matter of minutes. Organized crime is involved, and it’s anonymous.“

Or as Raph Koster put it: “I described this years ago at a social policy conference. And they [the government representatives] said, ‘Well it’s not drug money, but it is terrorist money.’ The government will get interested.�

Good for Koster.

I see the core of the story as malware aimed at finance is shifting to the newer less regulated methods of banking. This is not really about a move from banking to non-banking, but a move from attacking bank A to bank B, and that is a big difference in security perspective if you are a bank.

I remember arguing in political science classes about what the lifetime would be for the nation-state and its boundaries (as introduced by the medieval Italians). Will virtual worlds be dragged back into the constructs that we use today (real-world banks operating virtual-world branches) in order for us to make sense of how to regulate them, or is a whole new paradigm needed (real-world banks displaced by virtual-world challengers)?

The Pain of Fixing Code

I’ve been dealing with bugs galore lately; memory leaks, overflows, etc. and it has brought forward some discussion about the difficulty in finding developers who are able to recognize flawed code, let alone make the time to repair it. I was looking for some data on quantifying the source of the problem (yes, metrics) and found this insightful article from a 1998 IEEE journal:

In the first study on the subject, Sackman, Erikson, and Grant found differences of more than 20 to 1 in the time required by different developers to debug the same problem (“Exploratory Experimental Studies Comparing Online and Offline Programming Performance.” Communications of the ACM, January 1968). This was among a group of programmers who each had at least 7 years of professional experience.

Productivity issues are certainly a concern. Managers often time-box release of code to the point where beta is production. In fact, companies like Google make beta sound so good you have to wonder if people care anymore about the concept of “finished” products. To their credit, and from a historical perspective, IBM had a similar approach and used to include an engineer with their high-end processing platforms to monitor and resolve issues on the fly (e.g. the systems were too complex for anyone to try and manage without pre-qualified professional help). I was always surprised by this and wondered if someone had investigated how to pack an engineer in the crate so she/he would just pop out and start working on the system as soon as it was plugged in. Similarly, the big V12 power-plants of the luxury cars perhaps were not really expensive because of the quality of the build, but because the things never truly had independence from the mechanics (go for a drive, go get a tuning…repeat).

Tom DeMarco and Timothy Lister conducted a coding war game in which 166 programmers were tasked to complete the same assignment (“Programmer Performance and the Effects of the Workplace,” in Proceedings of the 8th International Conference on Software Engineering, August 1985). They found that the different programmers exhibited differences in productivity of about 5 to 1 on the same small project. From a problem employee point of view, the most interesting result of the study is that 13 of the 166 programmers didn’t finish the project at all—that’s almost 10 percent of the programmers in the sample.

So maybe this is a stupid question, but do humans really classify dependability and repeatability as value/benefit worthy of expense? I think the answer is that we spend when we are confident in the return, and we only look for quality when we are in fear of the unknown. Fast food restaurants, for example, can spend on infrastructure because it is the obvious way to reduce cost for a volume of deployed meals that covers that investment. Ford thought this way, as did Edison. People look for the symbols of the industrialized product not for dependability or quality in an absolute sense, but only in relative terms to the other options (that depend on their point of reference). I could continue down this line of reasoning, but in a nutshell I guess my point is that I am finding it is reasonable to expect improvements in code quality only in development environments that understand defect tracking and resolution; the same as expecting quality of life in governments that understand justice and liberty.

Elderly Ex-Paratrooper Disarms American Terrorist

Sensational title? Well, this is a sensational story. Apparently an incarcerated member of the Aryan Nation terrorist group, based in the US, was armed and on the loose today.

At about 7:45 a.m. Monday, an inmate accompanied by a corrections officer arrived at the center to for medical treatment. While they were in an exam room, some type of altercation took place and the suspect was able to get the officer’s gun.

Officer Stephen Anderson, 60, was shot and died from his injuries.

There are some obvious lingering questions about why a terrorist called Utah’s “public enemy #1” was essentially left unguarded. After shooting the corrections officer in the head he carjacked a vehicle. Police gave chase but it ended when the inmate climbed through a drive-in window of a fast food restaurant and tried to attack the people inside:

At least one shot was fired inside Arby’s and if not for the quick action of a former military paratrooper who happened to be inside the restaurant, there could have been more shots fired.

A 59-year-old Salt Lake City resident named Eric is credited with getting the gun away from the armed suspect. He says the gunman threatened others inside the restaurant.

“He was going to kill that guy and I wasn’t going to let him kill him,” he said.

Eric would seem to be a true hero, having intercepted a terrorist and disarmed him before he could do further harm. I wonder if the attack on civilians will be labeled as a terrorist act. Or more to the point I wonder how this will reflect on the national security debate as police departments unable to recruit new hires and the guard are said to be missing essential equipment?

History of the PIN

The BBC has a cute story about the man who supposedly invented the ATM, and the reason for a 4-digit PIN:

One by-product of inventing the first cash machine was the concept of the Pin number.

Mr Shepherd-Barron came up with the idea when he realised that he could remember his six-figure army number. But he decided to check that with his wife, Caroline.

“Over the kitchen table, she said she could only remember four figures, so because of her, four figures became the world standard,” he laughs.

Could only remember four figures? Is that not grounds for divorce?

But seriously, I find it strange the reporter wrote “Pin number”. I read that as the personal identification number number, which makes me suspicious of the research that went into the story.

So the PIN came first, or later? Would be interesting to know what event actually prompted the need for a PIN.