Videos

Who knows you better than your peers?

It seems that there was a contest for university students to create videos to increase awareness of computer security among university students.

The contest was conducted by the EDUCAUSE/Internet2 Computer and Network Security Task Force, the National Cyber Security Alliance, and ResearchChannel.

Even though the intended audience is college and university students the videods are entertaining and educational for other audiences. I suggest you check the out the videos here.

Enemy of the State RFID Style?

The Plot

Back in November of 1998 the movie Enemy of the State was released starring Will Smith as the harassed citizen that was tracked with every asset the government had including satellites. While I do not claim to have access to any details of what the theses satellites can do I can make a few statements safely.

1. No one casually moves satellites between orbits. Simply put they have a limited amount of fuel and once it is used there are no satellite fuel stations that you can stop by for a refill.
2. There would have to be a compelling reason to track on person with satellites. As I understand it they are constantly in use and the scheduled activities are not casually changed especially on a moments notice.
   

Now to look at current technology and trends could currently deployed and developing technology and how it could be abused. While I want to "set the stage" a little bit I will be directly discussing RFID and its ability to be used/abused.

Video Surveillance

Lets start with the most obvious.The UK with its attempt to monitor everything via camera. While I'm not a UK citizen I have been "watching" this from the sidelines. First as far as I can tell there are no laws covering the who can view/use the videos captured, how long they are retained, or how they are disposed of. While this may not seem to be a big deal with evolving technology, and apparent lack of controls.

Imagine, if you will, someone digitally changes a video to put you, or a now well known political, in compromising situation. With out proper defined controls this could ruin a political career. If I am correct that there are no laws controlling the videos captured this should be addressed.

Tagging History & Evolution

Radio Frequency Identification (RFID) is all the rage. It is being used everywhere and for many purposes. The first "killer application" was for inventory. Simply tag all the inventory and using simple equipment get a fast accurate inventory with minimal costs. Virtually 100% accurate virtually 100% of the time.

Anyone that works with inventory knows that there are always inconsistencies like who forgot to remove the RFID tag from the do nit inventory (DNI) items.

Once this became ubiquitous it was a "no-brainer" to use it for anti theft. Once an item is sold it is marked as "clear to pass" the anti-theft devices at the doors, of that store. then you go into the next store and their anti-theft goes off. The tag wasn't cleared in the next store's system. Apparently unknown tags alert in case items have not been inventoried yet. This creates many false positives, AKA "The Boy that Cried Wolf." In summary a shoplifter could make one "token" purchase at the mall then not worry about any anti-theft devices after that.

Tag You're it

Now if it works so wee for tracking things what about people? The US and UK government think it is great. You can embed encrypted information including a digital picture of the person in the passport and you have decreased the problems with fake passports. At what costs to the average citizen?

The University of Washington demonstrated using the Nike+iPod Sport Kit's RFID can be used to track people and that doesn't have any personal data on it. All RFID tags have unique information and no two match unless they are cloned the is, but more on that later.

If a simple RFID tag can be used to track you how simple would it be to track someone with an RFID passport?

Wait isn't there a limited range to read the ones in a passport?

Yes and no. While the RFID tags have limited power there are two other ways to increase the rang the tag can be read from.

• Using a bigger antenna
  
• Using a directional antenna
  

What about the encryption?

...but the information is encrypted. Yes and nothing prevents the encrypted data from being cloned. The first documented attempt took the hacker 2 weeks and and it only takes about $200 in equipment.

So what you say. Well if a standard RFID can be used to track you then the cloned RFID information can be used to track you, and know that it is you. Eventually the dark side will learn to break the encryption and be able to create their own fake passports.

RFID and CCTV

Tie RFID tracking in with surveillance cameras and you can be tracked and monitored easily...

The Dark Side

Now that I talked about the Internet culture in general in Out of the Mists of Antiquity... I will discuss the inevitable dark side,

In the beginning there trust and sharing, but alas this was not paradise, just another place for humans to interact.

One of the earliest, and well know, examples of the dark side is the flame war. This is the term given when two or more parties disagree on a topic and the "discussion" becomes heated. Per Goodwin's Law a lengthy flame ware will end up with at least one Nazi. A few factors seem to be a major cause of these wars:

1. Anonymity - when no one knows who you really are some people will say things that would not in a face-to-face situation.
2. Lack of body language can cause misunderstandings. Somewhere I read an article on a study that boiled down to about 80% of the time we assume we know the "tone" of written communication, but in reality we are only right about 10% of the time.
3. Until recently with digital recording devices something spoken virtually disappeared once it was spoken, but once something is typed it is, or can be, saved word for word. Hence the old adage of don't e-mail or send a message that you wouldn't want printed in the newspaper.

Now on to what everyone thinks of as the real dark side hackers. In the early days a hacker was someone of great skill and ability a hacker could create a short powerful script or program in a short time and get something useful done with it. One of the most famous, and politically active, of these is Richard M. Stallman. Many would consider him eccentric, but consider his article originally written in 1997 titled The Right to Read where there is no such thing as a library and scholars require government reading grants to be able to afford the fees for research... talk about derailing scientific discovery.

The natural curiosity of these hackers lead to exploring systems they where not granted access to. Thus the cracker was born.

NOTE: To the purest calling a cracker a hacker is like calling a sniper a marksman.

Some of the people breaking into systems began leaving began signs that they had been there by destroying or damaging files and the most visible of these being web site defacement. The hey I'm cool look what I did phase. Web site defacement while still done is not where the dark side is concentrating the motivation has changed from fame to financial gain.

One of the easiest, most entertaining, ways to understand this is through the "Stealing the Network" Series by Syngress. This series contains fictional short stories written by well known security experts that are technically accurate unlike the depictions shown in movies.

Stealing the network: How to Own the Box shows the "cottage industry" stage of the early crimes for profit.

The subsequent titles move in to the more sinister organized crime stage that we are currently experiencing, while still staying technically accurate. The books, in order, are: Stealing the Network: How to Own a Continent, Stealing the Network: How to Own an Identity and Stealing the Network: How to Own a Shadow.

I personally recommend the entire Stealing the Network series.

Out of the Mists of Antiquity...

The only way to really understand something is to go back to the beginning, and the dark side of the Internet is no different. Without light there can be no dark so that is where I'll start.

In the beginning there was ARPANET (Advanced Research Projects Agency Network) which begat the Internet.

First understand that in sharp contrast to the standard mainframe centric standard of the day (1960s) one of the main requirements was that it should be able to sustain 80% failure and the remaining portion or portions had to continue to function. The original project was designed by university students, and in order to document standards, but not offend the professors, the new standards became know as RFCs or Request For Comment.

From these humble origins sprang Richard Stallman, Open Source, VoIP, peer-to-peer (P2P) networks, and the Internet we know and love.

Much of the culture remains a mystery to the majority of the world, even those that participate in it.

There are a few books that help understand the culture.

One of these is The Wisdom of Crowds by James Surowiecki. This book gives evidence that averaging the responses of a group of average people can be more accurate that a single or small group of experts. While this concept is counter intuitive, an least to me it was, Mr Surwiecki provides evidence to back theory.

Another is The Starfish and the Spider: The Unstoppable Power of Leaderless Organizations by Ori Brafman and Rod Beckstrom. Here the authors show how decentralized organizations can overwhelm centralized entities. As an example take Napster and it's descendants...

And this last one may be surprising, but I submit Blink: The Power of Thinking Without Thinking by Malcolm Gladwell as well. Anyone that has ever know something without knowing why has experienced this. I submit with the anonymity of the Internet more people are following their "instincts" with out fear of ridicule.

Next I'll use the light provided here to explore the dark side