some thoughts on Memorial Day

For most of us, Memorial Day is the unofficial start to summer, or a day off, or a shopping day.¬† But let’s take a moment to remember what the day is really about – the men and women who have given their lives to protect America and the freedoms it stands for.¬† While you are at the beach, barbecuing in the backyard or shopping at the mall, take a moment to reflect on their sacrifices as well as on the thousands of Americans who are in harm’s way in foreign lands.¬† Thank you all…

some thoughts on Memorial Day

is your browser going to rat you out?

Your browser is a dirty stinkin rat.¬† There… I said it.¬† According to research conducted by the Electronic Frontier Foundation (EFF), most browsers have telltale fingerprints which can be used by web site owners to uniquely identify visitors to their sites even if cookies are disabled, or the visitor is coming from behind a NATting firewall.¬†¬†¬†

The Panopticlick software developed by the EFF researchers looks at a wide variety of information which a web site can gather from any visiting client.  By combining a number of these seemingly innocuous pieces of information, a client fingerprint can be calculated:

Browser and plugin versions

Configuration options

ACCEPT headers

Screen resolution


Time Zones

MIME types

The EFF collected its data via a website which it set up and publicized, so we can assume that the data they collected came from people who are interested in their privacy.  Despite this self selected sample, the findings do not bode well for privacy on the Internet:

  • Overall, the browsers of 83.6% of all visitors to the test site had unique fingerprints.


  • If a browser has Adobe Flash or the Java Virtual Machine enabled, there¬†was a 94.2% chance that its fingerprint¬†was unique.


  • Since the fingerprints are based on browser configuration settings, they can change rapidly.¬† However, the researchers were able to detect changed fingerprints and tie them back to the original fingerprint in 99.1% of cases via an algorithm.


  • Some good news for mobile device users – iPhone and Android based browsers had more uniform fingerprints and were harder to differentiate from one another due to the lack of plugins and options available.¬† However, as mobile browsers become more sophisticated, this technique may become applicable to these browsers on the go.¬† Also, it is important to note that the mobile browsers do not have good ways to control cookies, leaving them open to cookie based fingerprinting.

In related work, researchers from an Australian university have found that they were able to identify by name many users of Xing, a social networking site in Germany.  The researchers first collected information on 6500 groups and their 1.8 million members.  By simply analyzing the overlaps in group memberships, they were able to discern the identities of 42% of the users.  They next created a web site which, when visited, examined the browser history of the visitor.  Of the 26 test subjects they enlisted, the identities of 15% were revealed simply by visiting the site.  Xing has updated their software to protect against these types of attacks, but other sites may still be vulnerable.

So… what does this all mean?¬† Well, first of all, marketers and site owners have a new tool to track visitors, including those who have disabled cookies (in order to avoid such tracking).¬†¬† Second of all, these techniques provide scammers and malware authors with a way to track their victims’ web activity without leaving telltale traces.¬† On the bright side, these fingerprinting techniques could also be used for good purposes, such as providing an additional level of authentication for banking and other sensitive web sites (and there is evidence that this is already being done, although mostly using cookies).¬† Law enforcement could use these techniques during investigations, although given the politics of many nations, this could be a really bad thing as well.¬† The EFF wants policymakers to expand their definition of personnally identifiable information to include fingerprintable records – I think that this is a topic worthy of discussion.¬† I also think that browser designers need to work on this problem from a technical point of view.

Want to cover your tracks?  Well, you could block Javascript Рthis provides pretty good protection against the techniques EFF used, but at a cost in terms of web site usability and functionality.  You could start using TorButton to route your web traffic via anonymizing proxies.  You could use your iPhone or Android phone to do all your web surfing.  None of these solutions is ideal.

So… another nail in the coffin of privacy…

is your browser going to rat you out?

terabits (and risks) under the sea

Satellites get all the glamor with their showy rocket liftoffs and space shuttle missions, but in reality, over 99% of intercontinental data traffic travels via undersea cables which crisscross the planet’s briny depths.¬† These vital telephone and Internet links are exposed to a number of dangers ranging from seismic activity to misplaced ships’ anchors and fishing gear, to pirates and cable thieves, and when one of these links is broken, the effects can span countries or continents.¬† Upping the risk level is the fact than a large number of cables converge at a small number of geographic choke points such as the Suez Canal, and the Malacca and Luzon Straits.¬† When cables in these areas are damaged, there is a domino effect as traffic has to be rerouted to avoid the break.

In April of this year, the SeaMeWe-4 cable, which carries 89% of the traffic between the Middle East and Europe, was cut, severly impacting Internet and telephone communications between the two areas.  In 2008, a series of cable cuts in the Middle East disrupted network access and spawned a number of conspiracy theories due to the fact that neither Iraq or Israel were affected.  Back in 2006, a major earthquake cut the APCN2 cable connecting China, Hong Kong and other Asian countries bringing online commerce to a halt for days and resulting in network performance disruptions for months.

The good news is that notice is being taken – the IEEE held a “Global Summit on the Reliability of Global Underseas Communication Cable Infrstructure”¬† (ROGUCCI for those in the know) in Dubai in October 2009 where experts came from all over the world to discuss how to keep our undersea cables safe and secure.¬† I took a look at the report from this conference¬†and learned some other interesting facts about undersea cables:

  • Undersea cables are one of the rare places here on Earth that we get to see the effects of the speed of light.¬† As data or voice traffic takes its journey through cables, there can be a delay of up to a tenth of a second, which can be heard by humans and interfere with time sensitive data communications.¬† Satellite latency is even larger – this is one reason why all that intercontinental traffic can’t be rerouted via the heavens.


  • Every second, the planet’s undersea cables carry 30 terabytes of information from continent to continent – and more data is added to this torrent every day.¬† (I think that 28T of that traffic is porn…)


  • When there is a cable failure, traffic must be rerouted by other cables, making the path taken by the data much longer, increasing latency and adding traffic to links which may already be congested.¬† There is no Plan B for the undersea cable network.


  • Cable ships and their crews are a shared resource – the number of simultaneous repairs that can be performed is limited.¬† Time to repair is also extended due to some countries’ bureaucratic permit processes which the repair ships must complete before entering their territorial waters to get to work.¬†¬† Cable ships are also a potential target for pirates – cable operators worry that pirates could take over a cable ship and demand a hefty ransom for its release, delaying repairs further.¬† Pirates have already caused problems for cable laying off the coast of Africa.


Undersea cable security needs to be on all of our agendas… the Internet links that allow me to post this blog entry from my hotel room in London are also the ones which major financial institutions use for moving money around the world and which an increasing amount of commerce depends on.¬†¬†¬† Governernments need to safeguard cables and cable repair¬†ships and most importantly, build the redundant links which will allow our planetary nervous system to recover from damage.

terabits (and risks) under the sea

it’s (not always) nice to share…

Now that Facebook has made their privacy settings just a bit less complex than, say, the US Tax Code or particle physics, now would be a really good time to check your privacy settings and make sure that you are not sharing more personal information with the world (or at least to the Internet connected portion thereof)  than you intended to.

The new settings default to sharing quite a bit of information – you may be (unpleasantly) surprised about what Facebook is telling the world about you.

This website provides a browser bookmarklet which will scan your privacy settings and let you know what you might want to change. ¬† Take five minutes to protect your online privacy…

it’s (not always) nice to share…

i (helped to) discover a new asteroid!

Over the past few days, I have been on Mount Lemmon in Arizona attending Astronomy Camp. ¬†I’ll give you a couple of seconds to stop giggling now. ¬†Done? ¬†OK, I’ll wait a few more seconds…

During the camp, I and 15 other nerdlingers had the opportunity to take advantage of Arizona’s dark, dry and clear skies as well as a number of large telescopes used by astronomers from the University of Arizona and around the world. ¬†For me, the highlight of participating in the program was spending a few hours with the Catalina Sky Survey, who are responsible for keeping a watch out for Near Earth Objects (NEOs) which might collide with the Earth. ¬† CSS, along with a worldwide network of observers, looks for unidentified moving objects in the night sky using (in this case) a 60″ telescope on Mount Lemmon, as well as sophisticated computer software. ¬†Luckily for me, I was a “guest observer” with CSS when a new Near Earth Object called 2010-KE came into view, and thus got my name recorded as one of the discoverers of this object.

OK, so I had a couple of disappointments – first, I would have named this object “Al’s Hurtling Rock of Doom,” but the Minor Planet Center (who makes naming decisions) came up with 2010-KE instead. ¬†If you ask me, I think anti semitism was involved here. ¬†Secondly, 2010-KE is not projected to actually hit the Earth, only to pass close by. ¬†I would have really liked to have my name on “the big one” or at least one that would hit my neighbor’s car which is parked on the street rather than in his driveway… not that I carry a grudge, Bob… ¬†Other than these quibbles, being a NEO discoverer was really cool. ¬†I shall now be (even more) insufferable.

Here’s an animated GIF showing 2010-KE streaking across the sky…

And here is a diagram showing just how close 2010-KE was to Earth when these shots were taken…

And here is the official bulletin from the Minor Planet Center announcing the discovery of 2010-KE…

NEO 2010-KE DIscovery Bulletin

i (helped to) discover a new asteroid!

i’m invincible! (you’re a looney!)

We security professionals tend to underestimate our own vulnerability to threats like phishing. Here is a really good article by Cory Doctorow, who is most definitely not an Internet novice explaining how all of the wrong stars came into alignment to make him fall for a phishing attempt. Worth reading, especially if you think you are “smart enough” to recognize and avoid phishers’ bait.

– Posted using BlogPress from my iPad

i’m invincible! (you’re a looney!)

NerdCation 1 – Titan Missile Silo Museum

As a child of the cold war, nuclear armageddon was one of the major boogeymen which haunted my dreams.

Well, yesterday, I got a chance to enter the world of the men and women with the keys, codes and buttons that could launch doomsday at the Titan Missile Museum near Tucson. The museum is a decommissioned Titan II missile silo, complete with missile (but sans warhead). The massive silo doors have been concreted hallway open and a hole cut in the nose-cone to allow Russian satellites to see that the missile is no longer a threat.

Every so often, the museum runs special “Top to Bottom” tours that provide you with access to pretty much the entire complex… I went on one of these, which was guided by two retired Air Force guys who had spent a lot of time in silos like this one. We climbed ladders, squeezed into some small spaces (one of which was home to a resident Black Widow spider, whom I got to meet up close and personally) and saw all of the electronics and engineering that went into defending America’s freedom.

Most importantly, though, I got to sit in the actual missile commander’s chair and press a button on the console as I imagined an extremely surgical strike on my neighbor’s car, which he insists on parking on the street rather than in his driveway. Take that, Bob!

Some observations:

1. The launch complex does not look like much from above ground (other than the 760 ton silo door), but it is huge, extending 8 levels down. The parts of the complex dedicated to human habitation are relatively small (the control room, a very spartan bunk area and a kitchen) – mist of the space is taken up by the missile and the incredible machinery required to keep it ready to reduce Moscow (or my neighbor’s car) into radioactive dust.

2. I was surprised at the scope and complexity of the mechanical systems needed to keep the missile ready to go. Moving a 760 ton silo door requires some serious hydraulics and there are multiple water tanks and systems (crew comfort, fire fighting, and water to damp the noise and flame from a launch).

3. I was really surprised to find out that the silos were supplied with electrical power from the regular commercial power grid. There were backup generators, but these only powered safety and crew comfort systems. Our guides told a story of a crew who was woken up at 3:30 AM by a call from the main gate from someone claiming to be the meter reader. Yeah, right. They called the security police, who held the man at gunpoint. Only… he was the meter reader. The crew on duty did not usually work in this silo. The meter reader had an arrangement with the normal crew to always show up at the same time on the same day of the month to read the meter. Security has come a long way since those days…

4. While power redundancy was a problem, communications were much better protected against loss… the silo had multiple radio antennas, some of which are retractable and hardened against EMP. There were backups to the backup systems – various types of radio ranging from shortwave to UHF (for communications with the “Looking Glass” airborne command post) as well as antennas to receive very low frequency radio broadcasts through the earth’s crust. As a last resort, SAC could launch command missiles whose job it was to broadcast launch orders to their silo bound brethren.

5. The arrangements for keeping the codes and keys in the silo’s command center were surprisingly low tech. As you can see, what looks like a hefty file cabinet with a couple of padlocks holds the keys to doomsday.

Actually, those locks are really only the last layer in a very complex system, which includes specially coded fuel valves which will not allow the engines to get fuel unless a code (delivered to the crew only at launch time) is entered into the launch console. The site itself is surrounded by a high fence and is equipped with doppler radar intrusion detectors called “Tipsies.” Should the Tipsie indicate an intruder, the crew would stay in the silo and call the Air Force Security Police to respond. Our guides told of one site where a local mountain lion enjoyed sunning himself on top of the silo door – and bringing the cops running when he was detected by the Tipsies. I just like saying Tipsie.

I could go on for pages here… the tour was fantastic and it made me appreciate the scale of technology and expenditure that the Cold War took to win, as well as what the missile crews had to put up with to keep us safe… thanks, guys (and gals)!

More photos from the tour can be found on my Flickr Photostream… I have posted some, but will be adding more as I sort through them.

– Posted using BlogPress from my iPad

Location:E 22nd St,Tucson,United States

NerdCation 1 – Titan Missile Silo Museum

massachusetts kicks data protection butt!

Data protection... Massachusetts style

Now I have two things which I really like about Massachussets – The Friendly Toast in Cambridge (mmm… Caribbean waffles) and their new data protection law.¬† As of March 1, any organization which holds personnally identifiable information (PII) about residents of the Commonwealth must attest that they have a written information security plan designed to protect that information.¬† And that PII maust be encrypted both when it travels over the wire and when it is stored in systems.¬† Penalties for violation are quite hefty – $5,000 per violation and per record lost.

The law also requires businesses handling MA residents’ PII to¬†take a number of steps that they should already be doing – having someone responsible for the infosec program, identifying risks, training personnel, preventing terminated employees from accessing the PII, secure authentication and the like.¬†¬†¬† You can read the entire text of the law here…

It is about time and I hope that other states (and the federal government – call me a socialist) follow Massachusetts’ lead.¬† Requiring businesses to take some very basic and inexpensive steps to protect our information from unauthorized access is quite reasonable.¬†¬†¬† It seems to me that complying with the encryption requirements can be accomplished via an SSL cert, laptop encryption software (such as BitLocker, included with Windows 7 or FileVault on Macs), and use of database encryption features are just common sense, as is having an information security plan.

Bravo, MA!

massachusetts kicks data protection butt!