Wrap-up of this year’s WEIS

This year’s Workshop on the Economics of Information Security (WEIS2010) enlightened us about Identity, privacy, and the insecurity of the financial payment system, just to name a few presentaitons.

Every year I attend a conference called the Workshop on Economics of Information Security (WEIS), and every year I learn quite a bit from the experience. This year was no exception. The conference represents an interdisciplinary approach to Cybersecurity that includes economists, government researchers, industry, and of course computer scientists. Run by friend and luminary Bruce Schneier, Professor Ross Anderson from Cambridge University, and this year with chairs Drs. Tyler Moore and Allan Friedman, the conference includes an eclectic mix of work on topics such as the cyber-insurance (usually including papers from field leader Professor Rainer Böhme, soon of University of Münster), privacy protection, user behavior, and understanding of the underground economy, this year’s conference had a number of interesting pieces of work. Here are a few samples:

Guns, Privacy, and Crime, by Allesandro Acquisti (CMU) and Catherine Tucker (MIT), provides an insight into how addresses of gun permit applicants posted on a Tennessee website does not really impact their security one way or another, contrary to arguments made by politicians.
Is the Internet for Porn? An Insight Into the Online Adult Industry – Gilbert Wondracek, Thorsten Holz, Christian Platzer, Engin Kirda and Christopher Kruegel provides a detailed explanation of the technology used to support the Internet Porn industry, in which it claims provides over $3,000 a second in revenue.
The password thicket: technical and market failures in human authentication on the web – Joseph Bonneau and Sören Preibusch (Cambridge) talks about just how poorly many websites manage all of those passwords we reuse.
A panel on the credit card payment system, together with a presentation that demonstrated that even credit cards with chips and pins are not secure. One of the key messages from the presentation was that open standards are critically important to security.
On the Security Economics of Electricity Metering – Ross Anderson and Shailendra Fuloria (Cambridge) discussed the various actors in the Smart Grid, their motivations, and some recommendations on the regulatory front.

The papers are mostly available at the web site, as are the presentations. This stuff is important. It informs industry as to what behaviors are both rewarding and provide for the social good, as well as where we see gaps or need of improvement in our public policies, especially where technology is well ahead of policy makers’ thinking.

Is Facebook deceiving you?

Here is a really good article from the Electronic Frontier Foundation (EFF) about deceptive user interface practices. The funny thing about all of this is that people are missing the most offensive and dangerous part of Facebook’s warning:

So in other words, they’re going to violate your privacy no matter what you do, because your friends are going to divulge your information. Put another way, you may end up divulging your friends information. What can you do about this? Don’t share that much information with your friends. But you say, “They’re my friends!” Of course they are, and they probably already know most of the information you would share, anyway.

How to do this? Go to the following part of the site:

Privacy Settings -> Personal Information and Posts

as well as

Privacy Settings -> Friends, Tags and Connections

Then consider each category. Here comes another wingdinger: in order to keep something to yourself, either you must remove it entirely, or select “Customize” and then “Only Me.” You can’t just pull down “Only Me.”

I’m seriously considering being through with Facebook over all of this.

What are your thoughts? Take the OfcourseImRight poll.

Loading ...

Beware Facebook Scams! Protect yourself!

As Facebook now has more accounts than there are people in the United States, it should come as no surprise that it is possible to break into some of those 300 accounts. This happens. Well, what happens next when an attacker breaks into a Facebook account? Several things are likely. First, the attacker will retrieve as much information about the individual and his or her friends as possible. There are several key pieces of information that prove valuable:

Birthday and Hometown are enough information for an attacker to reliably predict social security numbers of people born after 1989. You can hide this information from your profile by going to your profile, clicking on the little box in the upper right of the Information tab, and deselecting birthday and home town.
Email address is useful to feed into a phishing/spam engine.
Telephone # and IM account information is enough to either use or sell to other scammers.

Next, an attacker may try to directly contact friends to scam money out of them. While such attacks are unlikely to take the form of a 419 scam where the attacker tries to play on greed, they will more likely play on peoples’ sympathies.

Here is an example:

0Wn3d Friend: Hey
0Wn3d Friend: How are you doin?
Target: good evening, Friend!
Target: i’m doing well, and you and your family?!
0Wn3d Friend: Not too good
Target: oh?
0Wn3d Friend: We are in a very deep mess
0Wn3d Friend: Glad you are here
Target: what happened?
0Wn3d Friend: We are stranded in London England
Target: WHAT?! how so?
Target: where?
Target: (in london)?
0Wn3d Friend: Kentish Town
0Wn3d Friend: We got mugged on our way back to the hotel at a gun point
Target: oh geez
Target: have you gone to the police?
Target: do you have a phone?
0Wn3d Friend: Yes,We were able to file a report to the cops and that is been Investigated
0Wn3d Friend: They made way with all we got here
0Wn3d Friend: Cash,bank cards and also the cell phone
Target: ok.
Target: i have a few friends outside of london. are you in a hotel?
0Wn3d Friend: Yes
Target: do you still have your passports?
0Wn3d Friend: Yes,I’m still safe with the Passport
Target: ok. how long are you supposed to be in London?
0Wn3d Friend: That has been the problem
0Wn3d Friend: I seriously need your urgent help getting back home
Target: what hotel are you in?
0Wn3d Friend: Sector Hotel
0Wn3d Friend: I have a flight back home in the next 3hrs but the hotel management won’t let go
Target: do you have the hotel’s address & phone #?
0Wn3d Friend: I don,t have the #
Target: i’ll need an address
0Wn3d Friend: 151 Kentish Town Road, London, NW5 2CG
0Wn3d Friend: I’m having problem with the hotel on the bills

What happens next is that the attacker asks for a credit card.

So how do you know it’s a scam? First, Amazingly, Google is your friend. If you enter just a few details from this example, you’ll see that Kentish Town and the Sector Hotel show up as a scam. The other odd thing about this exchange is that the person claims to have been mugged at gun point in London. I’m not saying it doesn’t happen, but it’s rare.

More importantly, ask yourself why this friend is contact you, and not calling a relative for help. To be sure, if this person really is a friend, you should already have a phone number for that person. Call him or her, but do not rely on contact information from the attacker. Calling a number they give you can cause you to lose a lot of money. If they answer the phone and have no idea what you’re talking about, you know it’s a scam. If they don’t answer, call a relative of theirs or ask for more details. In this case the person said they filed a police report. Get the report number from the person, name of an officer who took the report, and independently call the police. Do not rely on anything in the facebook profile of the friend. You should assume the attacker has already manipulated all of that information.

Most importantly, never send credit card information over the network in such circumstances.

Ok, so you’ve figured out it’s a scam. Congratulations! What do you do next? Report it, and fast. Facebook is pretty responsive when it comes to shutting down accounts. In one case I’ve reported, they reacted within 10 minutes. To report abuse on facebook, click on Help at the bottom of the page, and right at the top you will find the following:

Hacked accounts and spam

Click on that text, and it will help you report the information. You will need the URL of the profile of the friend who you are reporting. To get this, type the friend’s name in the search bar.

Don’t feel bad that you are reporting a friend, either. This is a case where your friend is being maliciously used, and you are doing your part to putting an end to it.

How Much Do You Value Privacy?

People in my company travel a lot, and they like to have their itineraries easily accessible. My wife wants to know when and where I will be, and that’s not at all unreasonable. So, how best to process and share that information? There are now several services that attempt to help you manage it. One of those services, TripIt.Com, will take an email message as input, organize your itinerary, generate appropriate calendar events, and share that information with those you authorize.

The service is based in the U.S., and might actually share information with those you do not authorize, to market something to you- or worse. If the information is stolen, as was the case with travel information from a hotel we discussed recently, it can be resold to burglars who know when you’re way. That can be particularly nasty if in fact only you are away, and the rest of your family is not.

But before we panic and refuse to let any of this information out, one should ask just how secure that information is. As it happens, travel itineraries are some of the least secure pieces of information you can possibly have. All a thief really needs is an old ticket stub that has one’s frequent flyer number, and we’re off to the races. In one case, it was shown that with this information a thief could even book a ticket for someone else.

So how, then, do we evaluate the risk of using a service like TripIt? First of all, TripIt does not use any form of encryption or certificate trust chain to verify their identity. That means that all of your itinerary details go over the network in the clear. But as it turns out, you’ve probably already transmitted all of your details in the clear to them by sending the itinerary in email. Having had a quick look at their mail servers, they do not in fact verify their server identities through the use of STARTTLS, not that you as a user can easily determine this in advance.

Some people might have stopped now, but others have more tolerance for risk.

Perhaps a bigger problem with TripIt is that neither its password change page nor its login page make use of SSL. That means that when enter your your password, the text of that password goes over the network in the clear, for all to see. It also means that you cannot be sure that the server on the other end is actually that of TripIt. To me this is a remarkable oversight.

For all of these concerns, you still get the ability to generate an iCal calendar subscription as well as the ability to share all of this information with friends and family. Is it worth it? One answer is that it depends on whether you actually want to enter the information yourself, whether you care about security concerns, and whether you like using calendaring clients. It also depends on what other services are available.

Another service that is available is Dopplr. It also attempts to be a social networking site, not unlike Linked In. Dopplr allows you to share you itineraries with other people, tells you about their upcoming trips (if they’re sharing with you), and it lets you create an iCal subscription.

Dopplr also has some security problems, in that they do not use SSL to protect your password. They also do not use SSL for their main pages. They do, however, support OpenId, an attempt to do away with site passwords entirely. I’ll say more about OpenId in the future, but for now I’ll state simply that just because something is new does not make it better. It may be better or worse.

And so there you have it. Two services, both with very similar offerings, and both with almost the same privacy risks. One of them, by the way, could distinguish themselves by improving their privacy offering. That would certainly win more of my business.

No Evidence That Data Breach Privacy Laws Work

Have you ever received a notice that your data privacy has been breached? What the heck does that mean anyway? Most of the time what it means is that some piece of information that you wouldn’t normally disclose to others, like a credit card or your social security number, has been released unintentionally, and perhaps maliciously (e.g., stolen). About five years ago states began passing data breach privacy laws that required authorized possessors of such information to report to victims when a breach occurred. There were basically two goals for such laws:

Provide individuals warning that they may have suffered identity theft, so that they can take some steps to prevent it, like blocking a credit card or monitoring their credit reports; and
Provide a more general deterrent by embarrassing companies into behaving better. “Sunlight as a disinfectant,” as Justice Brandeis wrote.[1]

A study conducted by Sasha Romanosky, Rahul Telang, and Alessandro Acquisti at CMU found that as of yet there can be no correlation found between these laws and identity theft rates. This could be for many reasons why the correlation isn’t there. First, actual usage of the stolen information seems to be only a small percentage. Second, it may be that just because a light has been shined doesn’t mean that there is anything the consumer will be capable or willing to do. For instance, suppose you buy something at your-local-favorite-website.com. They use a credit card or billing aggregation service that has its data stolen, and so that service reports to you that your data has been stolen. You might not even understand what that service has to do with you. Even if you do, what are the chances that you would be willing to not use your-local-favorite-website.com again? And if you hear about such a break-in from someone else, would it matter to you? Economists call that last one rational ignorance. In other words, hear no evil, see no evil.

Add to all of this that some people have said that there are huge loopholes in some of the laws. At WEIS and elsewhere several not-so-innovative approaches were discussed about how some firms are getting around the need to disclose.

This paper is not the final word on the subject, but clearly work needs to be done to improve these laws so that they have more impact. As longitudinal studies go, this one isn’t very long. It’s possible we’ll see benefits further down the road.

[1] The Brandeis quote could be found in the paper I cited (which is why I used it).