Category Archives: Security

Computer Generated Text Woos Venture Money

The NYT has proof that news about the weather and sports needs no human touch, if all the reader wants is a list of facts loosely strung together

The company’s software takes data, like that from sports statistics, company financial reports and housing starts and sales, and turns it into articles. For years, programmers have experimented with software that wrote such articles, typically for sports events, but these efforts had a formulaic, fill-in-the-blank style. They read as if a machine wrote them.

Computers writing prose and poetry and news have been around for as long as the Internet itself. Have you tried the Elizabethan insult generator or the random prose generator?

The important shift in this story is that people who want to make a high return on their investment are getting interested in pushing to make a sizable profit from the automation of language. The issue thus becomes whether pressure to build this new market will bleed straight into phishers and spammers who have already proven they know how to use automation to turn the news into easy money.

The NYT shamefully gives no credit to attackers who have been successfully composing text from automation for years, nor do they mention the risks from blindly accepting computer-generated text as worthy of consumption.

The few sports writers I read have a specific style and sense of humor. I’m not interested in the data on the game, since I could get that anywhere, but rather how they interpret and present the information based on their particular/unique view of the world.

Update: And in the end a computer that has a particular view of the world will still be just a shallow reflection of the person who programmed it. My presentation at BSidesLV 2011 (2011: A Cloud Odyssey) addressed this issue in great depth. I’ve been asked a lot lately to post the slides from that talk so I’ll upload them soon.

Warrants Rejected for GPS Location Data

A US federal judge has denied a warrant request for GPS data when “not to collect evidence of a crime, but solely to locate a charged defendant”.

The warrant asked for “unlimited location data at any time on demand during a 30-day period”. The defense attorney argued that a search warrant requires proof of “a fair probability that contraband or evidence of a crime will be found in a particular place.” A suspect, in other words, does not automatically lose the right to privacy — unless there is a flight risk the data on all movement by a suspect is not sufficient on its own to justify a warrant.

The NYT reports that the US Supreme Court also is about to hear similar arguments for using GPS data to track a suspect.

In April, Judge Diane P. Wood of the federal appeals court in Chicago wrote that surveillance using global positioning system devices would “make the system that George Orwell depicted in his famous novel, ‘1984,’ seem clumsy.” In a similar case last year, Chief Judge Alex Kozinski of the federal appeals court in San Francisco wrote that “1984 may have come a bit later than predicted, but it’s here at last.”

Last month, Judge Nicholas G. Garaufis of the Federal District Court in Brooklyn turned down a government request for 113 days of location data from cellphone towers, citing “Orwellian intrusion” and saying the courts must “begin to address whether revolutionary changes in technology require changes to existing Fourth Amendment doctrine.”

The Supreme Court is about to do just that. In November, it will hear arguments in United States v. Jones, No. 10-1259, the most important Fourth Amendment case in a decade. The justices will address a question that has divided the lower courts: Do the police need a warrant to attach a GPS device to a suspect’s car and track its movements for weeks at a time?

[…]

The Jones case will address not only whether the placement of a space-age tracking device on the outside of a vehicle without a warrant qualifies as a search, but also whether the intensive monitoring it allows is different in kind from conventional surveillance by police officers who stake out suspects and tail their cars.

The ruling could also affect how warrants are applied to other location-aware technology used by large service providers. I will discuss it Tuesday in my presentation on “Trends in Cloud Forensics” at the High Technology Crime Investigation Association International Conference. Hope to see you there.

Apple New Product Security

Apparently impersonating police officers, searching homes without a warrant, and threatening immigrants has not worked very well for the giant media/technology company:

Calderón told us that six badge-wearing visitors came to his home in July to inquire about the phone. Calderón said none of them acknowledged being employed by Apple, and one of them offered him $300, and a promise that the owner of the phone would not press charges, if he would return the device.

The visitors also allegedly threatened him and his family, asking questions about their immigration status. “One of the officers is like, ‘Is everyone in this house an American citizen?’ They said we were all going to get into trouble,” Calderón said.

One of the officers left a phone number with him, which SF Weekly traced to Anthony Colon, an [ex San Jose police officer and] investigator employed at Apple, who declined to comment when we reached him.

Apple must have finally tasted some of the pickle they are in or maybe it’s just a coincidence that they now are hiring a security manager to oversee new products. Note the tone of the qualifications in the “proven record” of their “ideal candidate”.

Simultaneously working with multiple constituencies, balancing disparate priorities, problem solving in high-demand situations, defining and establishing attainable measures of success, and regularly achieving positive outcomes in large-scale business environments.

Translation: You will be responsible for convincing others who probably do not even get along with each other, and who see you as an impediment to their success, to follow what you say. Also known as experience marketing a very low bar as success because advocating too high a bar would just make everyone align even more against security.

Accurately assessing physical and logical security implementations and making actionable risk management recommendations that consider impact on corporate culture, business operations, system architectures, manufacturing processes, and employee workflows.

Translation: Experience not getting in they way; knowledge of how to let the business make the final decision on the amount of risk they will run while leaving the responsibility of risk (e.g. your reputation as a security “manager”) on you.

Formulating, and successfully implementing, a variety of security technologies utilizing industry-recommended practices and/or risk frameworks.

Translation: Experience buying and implementing security controls three or four years after they already should have been in place.

Looks like an excellent opportunity and a much-needed role. The question is how effective it can be if they are constantly emphasizing in the job spec that they want someone who will not push them too much too soon. Apple could see a significant turnaround if they find the right person, but a manager-level role could be argued as too little too late to alter course from where they appear to be headed.

It reminds me of the patient who will only work with a doctor under certain conditions. The patient, for example, might accept advice but disallow being told what to do and forbid any intervention, even to save their life. The medical profession seems to call this the “difficult” patient problem.

Doctors report that about one in six patients is “difficult.” […] The data suggest that some doctors may simply have a shorter fuse when it comes to dealing with a challenging patient. The researchers noted that older, more experienced practitioners are likely better at dealing with unhappy patients and may be less likely to view patient visits as difficult, even when they’re not perfect. […] An editorial suggested…doctors need better training to cope with the psychological challenges of caring for patients…doctors are advised to rise to the challenge of working with a difficult patient.

Who will rise to the challenge of working with Apple?

Wiener against bare bottoms in SF

This story can’t be real. It sounds like, at least for Mr. Wiener, the issue with being naked is about safety

Public nudity, he explains, is legal in San Francisco and in recent years a group known informally as Naked Guys have shown unbridled enthusiasm for appearing in the nude.

“I see it pretty regularly, and unfortunately there are nudists who are not doing what they should,” Wiener told Reuters.

The nudists, who expose themselves most often in the city’s famous gay neighborhood, the Castro District, have got Wiener and others worrying about public health.

“I’m not a health expert, but I believe sitting nude in a public place is not sanitary,” he said. “Would you want to sit on a seat where someone had been sitting naked? I think most people would say, ‘No.'”

Wiener, who represents the Castro neighborhood, said he hears from merchants who fear the public displays may drive away customers, hurting the business’ bottom lines.

The argument that public displays in the Castro will drive away customers is like saying Disney should get rid of Mickey because some people are afraid of mice. Wiener must realize at least a little that “displays” are why the “famous gay neighborhood” has so many customers.

So let’s look instead at his argument on safety. Business is booming in other neighborhoods where safety is a very serious problem. I’m talking about three homicides in the Mission in just one week, including a cook. The last one was a block from the police station. And if Weiner is really worried just about seat cleanliness then maybe he should instead focus his worry on BART upholstery since it clearly brings many more dirty bottoms into the Castro:

Fecal and skin-borne bacteria resistant to antibiotics were found in a seat on a train headed from Daly City to Dublin/Pleasanton. Further testing on the skin-borne bacteria showed characteristics of methicillin-resistant staphylococcus aureus, or MRSA, the drug-resistant bacterium that causes potentially lethal infections, although Franklin cautioned that the MRSA findings were preliminary.

High concentrations of at least nine bacteria strains and several types of mold were found on the seat. Even after Franklin cleaned the cushion with an alcohol wipe, potentially harmful bacteria were found growing in the fabric.

If only they could get rid of that disgusting fabric…

dirty bart