Category Archives: Security

Cars banned in Somalia

In a move to reduce the risk of suicide bombing, cars are prohibited from driving to Baidoa from Mogadishu, according to the BBC:

Government officials say the ban will come into effect on Tuesday.

“I think taking such a decision is the only solution to boost our security,” Baidoa official Ahmed Maddey Issak told the AFP news agency.

The 250km Mogadishu-Baidoa road is peppered with checkpoints amid fears of a war involving neighbouring Ethiopia.

Addressing the symptoms could make sense here. But there is a curious caveat to the new rule:

The BBC’s Mohammed Olad Hassan in Mogadishu says the move is unlikely to affect trade as other vehicles will still be able to travel between the two cities.

So a truck full of explosives would still be allowed? Or are we talking handcarts and bicycles?

Word Remote Code Execution (929433)

A Word buffer overflow was just disclosed to the public by Microsoft. The advisory tries to put things in perspective so users know whether they are at risk, and what to do:

In order for this attack to be carried out, a user must first open a malicious Word file attached to an e-mail or otherwise provided to them by an attacker.

As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources.

Extreme caution? That must be just above high caution. Would that be a red, or maybe orange warning level? Good general advice, but not very confidence building. Imagine telling the driver of a car “use extreme caution while operating the vehicle as we have found something very wrong with the design of your brakes”…

What percentage of attachments are unsolicited? Probably a vast majority of them, I would say, with very little out-of-band confirmation as normal process. And there is no word (pun not intended) on how to reliably identify “malicious” Word files or “attackers” as a normal procedure either. If you scroll down to the more detailed “workaround” advice, you get the same update, worded only slightly different:

Do not open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources. This vulnerability could be exploited when a user opens a specially crafted Word file.

Maybe this could be rephrased into “only open or save Word files after confirming from trusted sources that they are safe”? Whitelisting seems easier to me than a fuzzy blacklist, but let’s just hope Microsoft has a patch soon.

Famous primates

The 10 Famous Monkeys* in Science page is hilarious. It also has some neat insights, including the description of a risk management approach by the US government in the 1950s:

Never send a man to do a female monkey’s job. That was the logic of the U.s. Army’s Medical Research and Development Department in 1959 when they wanted to gauge the body’s physical response to space travel. Instead of relying on fit, able-bodied Americans, researchers there turned to two highly patriotic gals named Baker (a squirrel monkey) and Able (a rhesus monkey). On May 28, the monkeys steeled their nerves, entered the nose cone of a Jupiter AM-18 missile, and embarked on a suborbital mission into space. It would take two more years before a human male, cosmonaut Yuri Gagarin, had the guts to attempt the same thing.

I also thought the Koko and Nim Chimpsky entries were funny, but you have to read number 10. Power supplies are such a drain…