Category Archives: Security

De-coded Note — Hitler Was Fooled

Interesting revelation from Bletchley Park — Britain’s army of code-breakers were able to confirm in advance of D-Day that the Nazis had been successfully fooled. Hitler believed the invasion would happen at Pas de Calais instead of Normandy, as shown in this document:

DONNY, DICK AND DORICK

These are the names of three entirely fictious spies for Germany who, Pujol writes, have told him that large numbers of Allied troops remain gathered in southern England. This, Pujol says, means the initial D Day landings were just a “red herring”. Of course, this is disinformation.

PAS DE CALAIS

Pujol writes that the “critical attacks” are still to come, most likely to be focused on Pas de Calais in northern France. In truth, this is a bluff on Pujol’s part, intended to keep German forces away from the rearguard of the actual invasion sites in Normandy.

AMY

Here Pujol quotes AMY, another fictitious agent, telling him that there were 75 divisions in England before the France landings – meaning more were still to come. The Germans have no idea that this is untrue.

Analysis of the Zuckerberg Fan Page Hack

Facebook has a reputation for weak security but now Mark Zuckerberg’s own fan page has been hacked.

The Guardian has posted a detailed look at the trail left behind. You could read the whole thing but I recommend scrolling right to the end where you will find comments like this one:

Might I interest The Guardian in exclusive rights to coverage of this fresh coat of gloss emulsion I’ve just applied to my kitchen wall?

Triclosan Ban

A movement to ban Triclosan from consumer products has gained momentum after a report in 2007 said it created risks but no benefit to health.

Antibacterial soaps show no health benefits over plain soaps and, in fact, may render some common antibiotics less effective, says a University of Michigan public health professor.

It costs money to include Triclosan as an ingredient. The market, if functioning properly and recognizing the absence of benefit to the ingredient, should eliminate it. Why then, does Triclosan continue to appear in products like lipstick, deodorant, soap, shampoo…?

The Food and Drug Administration (FDA) gives no explanation.

At this time, the agency does not have evidence that triclosan in antibacterial soaps and body washes provides any benefit over washing with regular soap and water.

Nonetheless, it has taken a wait-and-see approach — regardless of the lack of benefit, they do not yet see enough evidence of harm.

FDA does not have sufficient safety evidence to recommend changing consumer use of products that contain triclosan at this time.

Does this mean proof of benefit is not necessary but proof of harm must be overwhelming? It reminds me of the regulatory approach taken with leaded fuel:

The Public Health Service created a committee [in 1925] which reviewed a government-sponsored study of workers and an Ethyl lab test, and concluded that while leaded gasoline should not be banned, it should continue to be investigated. The low concentrations present in gasoline and exhaust were not perceived as immediately dangerous. A U.S. Surgeon General committee issued a report in 1926 that concluded there was no real evidence that the sale of TEL was hazardous to human health but urged further study. In the years that followed, research was heavily funded by the lead industry…

Despite rapid health deterioration and even the death of workers exposed to TEL, industry managed to get the regulators to wait and call for more studies.

Imagine if leaded fuel had been banned in 1925 when it was first obvious that it was highly toxic. It would have not only prevented harm but also forced innovation in safer fuels and more efficient engines (even for airplanes), instead of waiting another fifty years.

In February 1923, a Dayton filling station sold the first tankful of leaded gasoline. A few GM engineers witnessed this big moment, but Midgeley did not, because he was in bed with severe lead poisoning. He recovered; however, in April 1924, lead poisoning killed two of his unluckier colleagues, and in October, five workers at a Standard Oil lead plant died too, after what one reporter called “wrenching fits of violent insanity.” (Almost 40 of the plant’s workers suffered severe neurological symptoms like hallucinations and seizures.)

Still, for decades auto and oil companies denied that lead posed any health risks. Finally, in the 1970s, the Environmental Protection Agency required that carmakers phase out lead-compatible engines in the cars they sold in the United States. Today, leaded gasoline is still in use in some parts of Eastern Europe, South America and the Middle East.

While the need to reduce our exposure to lead is now overwhelmingly obvious, some industry leaders continue to dispute and cast doubt on its regulation. With no known benefit in so many products, will they also fight for Triclosan?

2011 BSidesSF: Dr. Stuxlove

I will be presenting at the 2011 BSidesSanFrancisco conference:

“Dr. Stuxlove or: How I Learned to Stop Worrying and Love the Worm”

When: 4pm, Tuesday, February 15, 2011
Where: Zeum, 221 Fourth Street, San Francisco
Cost: Free (as always!)
RSVP: http://bsidessf.eventbrite.com

Has our “Human Reliability Program” improved since Stanley Kubrick’s 1964 dark comedy film? What has 44 years of international security, leadership and incident response plans taught us? This presentation gives a look at trends in information security breaches and what really has been changing in order to offer several predictions of how best to prepare for what may be ahead. It then sorts out and clarifies the technical details from the most common and most damaging security breaches. Convergence from the trend data and the technical analysis are then wrapped (and if there is a DJ perhaps also rapped) into a conclusion that might surprise you. As Dr. Stuxlove would say: “the whole point of the Doomsday Malware is lost if you keep it a secret”. Grab your hat, open the bay doors and enjoy the ride.

Copy of Presentation: DrStuxlove.PDF