Blog of a Long Distance Worker Tech

The blog about mobile tech

Blog of a Long Distance Worker Tech - The blog about mobile tech

Category Archives: Security

Passport (un)control

We all are now acquiring RFID based ‘secure’ passports which are supposed to increase the security of our flying experience. Others have gone on about how these passports have actually given a false sense of security and in some respects have reduced the security of getting into and out of the country but this post is not about that.

I have now transitioned to one of these through an extremely annoying and overly expensive experience with the modern ‘passport office’ which has given me a chance to use one of the automated passport checking services on one of my regular trips. To be precise, I have used it twice. The first use simply failed to work at all despite multiple retries over a three minute period before I was ushered through the normal manual method. As I was travelling with a colleague with an old style passport, I came through to find him waiting after passing through the long queue on the old style person at a desk method. I put that down to a one off event.

The next time was also when travelling with a colleague so we could measure the effectiveness and efficiency again. This time I can say it worked without retries, although it still took almost 2 minutes to get through the face recognition and passport reading process, and still my colleague was found waiting for me at the other side despite there being a large queue on the manual approach. So in conclusion the RFID and Facial recognition mechanism is too slow and clumsy to ever work more quickly or even at the same speed as a person processing you.

So this is just a bad experience? No, it is demonstration of government inefficiency and waste with appalling technology choices. After all, I operate facial recognition to unlock my Android tablet (with blink detection) which operates in less than two seconds compared to the almost 1 minute that the facial recognition at passport control took to do EXACTLY the same thing with a better error rate. So much for picking the contractor with the lowest bid rather than the one that can actually do the job. Thankfully the British Government doesn’t put men in space (to their certain death).

Next time I will pick the queue to see the nice people at the desks and I recommend you do to :-)

O2 and its telephone number leak update

O2 has now posted on its blog, its own description of the problem that occurred today. It describes it pretty much as a misconfiguration that allowed a provision for ‘selected partners’ to receive the client’s phone number in the headers of the HTTP request to spread to be applicable to all sites.

Although seemingly a reasonable explanation, it is the first time that I have heard that O2 would be using this with ANYONE. Almost certainly I will find the clause buried down in my terms of use somewhere (still looking), but this is a shoddy and appalling lack of privacy and control around something that a few people (not me but I still don’t want to share it with web sites unless I choose to) keep VERY private. To not be expressly clear to the user or to provide a mechanism for blocking it is bad. I am reminded of an old Internet Explorer feature that had to be disabled very quickly in the 1990s whereby the browser would present the username of the logged in PC user to every website. The feature was useful in authenticating in a corporate environment but unfortunately they allowed presentation to every site – a horrible privacy AND security issue. The disabling came in to the user control through Security Zones but it was by default turned OFF. This is something that should be the case here.

We shall have to see how this issue progresses. Certainly I am thinking twice about having O2 as a service provider. I will also be more careful about my use of SIM cards from providers I am new to in the future, after all they could similarly do this.

O2 and its Telephone number leak

This morning a twitter comment alerted me to an issue with the O2 mobile phone broadband data service. In common with all broadband internet services, O2 passes its traffic from customers via a transparent proxy which can additionally do things like reduce the file size of pictures through compression. This is normally specified in the APN configuration of your phone. The ‘new information’ though was that it was making use of a feature of the Openwave WAP proxies to additionally tag a HTTP request header on to each transaction that gave away the subscriber’s mobile phone number. The HTTP request header is the very clear x-u-calling-line-id. You also need to know that this happens regardless of the client device you are using as it is built in to the Openwave proxy.

This is a serious breach of privacy for any mobile phone owner as EVERY SINGLE WEBSITE that the subscriber visits via the broadband connection will then have a copy of the subscribers mobile phone number. No opt-in or opt-out. Also it is quite likely that this has been happening for many years, in fact it could be as old as 3G Broadband from O2. To confirm if you are affected, I suggest you visit a site that displays all of your headers and look for your phone number or other personally identifiable information such as http://www.cylog.org/headers/.

Right now O2 is scrambling to deal with this PR and possible legal issue. I am personally offended that they do this as well. However you need to think wider than this. O2 is not necessarily the only company doing this, nor does it have to be via the same HTTP request header. After all, that header is something that Openwave provides which can be being used by any mobile operator in the world. Additionally other mobile operator WAP gateways manufacturers can and do use different methods of doing the same thing. The result is that privacy can be being breached worldwide, whenever you use your 3G Broadband connectivity.

This means that not only can someone personally identify you very easily, they can pair the informaton directly with the IP address that you are operating on which will also allow the identification of where you are.

If you are interested in background as to what you can be sharing when using your Mobile Broadband connectivity, please look at these two sites http://mobiforge.com/developing/blog/useful-x-headers and http://www.mulliner.org/collin/academic/publications/mobile_web_privacy_icin10_mulliner.pdf.

No excuses – Encrypt Now, Yesterday and Tomorrow

Us mobile people like all the newest gear, particularly when it either speeds things up, saves precious battery life or makes our equipment more robust. SSDs do all of that, however it is bad when they can affect our information security.

I have gone on record stating that for you and your customer’s piece of mind (as well as some laws), that you should fully encrypt your hard drives, recommending that the small business owners uses Truecrypt… a very effective solution. Now comes the (relatively) obvious news that you need to be wary of SSDs

If you’re in a business that handles sensitive information, or are just conscientious about your privacy, you might want to read this study on SSD erasure. As you know, there are ways of erasing traditional magnetic hard drives that are more or less totally irreversible. Writing all zeros, writing garbage, zeroing again, and so on. After a few cycles it’s fresh and clean.

via PSA: SSDs Are Difficult To Securely Erase.

So get the SSD encrypted as soon as you. How much this effects people who have Hybrids like my Momentus XT is probably minimal, but STILL present as you do not know exactly what data ends up on the 4GB Flash part. So Encrypt it now, and encrypt it early.

There may be trouble ahead for techie travellers

As a traveller with a lot of tech along for the ride, the security queue even in Europe can be a little troublesome. The following article though may indicate more trouble ahead.

The Transportation Security Administration has banned ink and toner cartridges of more than 16 ounces from both carry-on bags and checked luggage on flights within the United States or in-bound to the United States. You know why: because of that incident from a few days ago where authorities found bombs hidden inside toner cartridges.

via TSA Bans Ink & Toner Cartridges From Flights. Next On The Ban List: People..

Even though we have heard about lifting the need to get the 11 inch Macbook Air out of hand luggage in the US, this has not transferred to Europe and is likely not going to. This is particularly a problem for me in future if I travel like I have this week – with both my main laptop (13 inch) and my notetaker netbook (10 inch), plus a load of cables, dongles and hard drives. Less said the better about my spare mobile phone :-) .

We shall just have to see how this all develops.

The Pain of Password Changes

Loved this article (click through) about the impact of regular password changes on businesses.

Big enterprises that force their workers to change their access passwords on a regular basis, and adhere to complex rules when they do, might be their own worst enemy.

via Mandatory Password Changes Costs Billions in Lost Productivity – Security – Lifehacker.

The presumption of most security policies is that changing passwords increases security, which is not strictly the case in my view. Most of the time, forced password changes result in written down passwords or easily guessed repeat passwords, or even trying to beat the strict rules that are required (like ‘must contain a number, a letter and at least one upper case letter). All this does this is give a crib to breaking the system. The other thing to say is that password changes like this assume that the password is guessable, you have been overlooked or that the system is insecure (like when you used telnet which sends passwords in the clear). Now with strong encryption, good personal security/awareness and a good sound none-word password, then the need for changes should be more based on education of staff to understand password changing in response to insecure behaviour instead. Like being overlooked, a security weakness being identified etc.

At least that is my view, what is yours?

Cost of the Loss of a Laptop

A new report by the Ponemon Institute in conjunction with Intel claims that the average cost to the enterprise of a stolen or lost laptop is $49,246, once you factor in not just replacement but intellectual property loss, lost productivity, forensics, and other downsides.

Report: average stolen laptop cost is $50K; Intel: buy vPro – Ars Technica.

This is an interesting report, but it is interesting to think about the impact of full disk encryption and full data synchronisation back to base on a continuous basis on the cost. The headings that they used are:

  1. Laptop replacement cost: $1,582
  2. Detection & escalation cost: $262
  3. Forensics & investigation cost: $814
  4. Data breach cost: $39,297
  5. Intellectual property loss: $5,871
  6. Lost productivity cost: $283
  7. Other legal and regulatory costs: $1,117

Now with the disk encryption and data synchronisation, you can see a different picture:

  1. Laptop replacement cost: $1,582 (or less than $500 for a netbook!)
  2. Detection & escalation cost: $262 – probably the same
  3. Forensics & investigation cost: $0, what forensics or investigation do you need when the machine is a dead weight without a valid logon
  4. Data breach cost: $0 as there would be no data breach
  5. Intellectual property loss: $0 as there is little or nothing lost through the data sync to base
  6. Lost productivity cost: $283 (probably the same)
  7. Other legal and regulatory costs: $0 as there is no loss, so no legal or regulatory costs

Now this is a simplistic view, but you can see that with using low cost laptops/netbooks, good full disk encryption and well implemented file sync, you can reduce the ‘cost’ of a laptop loss from $49,226 to $1,045. Even allowing for some error, the cost benefits are good in a loss situation.

Laptop Security

Try thinking of your notebook or mini-note not as a computer but as a pile of cash. Would you leave $800 lying around on a library table or the front seat of your car? How about $300? Chances are you wouldn’t, and that’s because we instinctively realize that’s tantamount to inviting unscrupulous types to help themselves.

Mobile PC Security Tips: Part I

This article offers some straightforward security tips, but the best one is unsaid.

Make it so you do not care whether your laptop is stolen. Take the normal physical security precautions, but make best use of the Cloud to ensure that if the laptop is lost or destroyed, that you do not lose any data. This is done via file sync systems such as Mesh, Live Sync or others, or by using Gladinet to give folder level access to online storage mechanisms like Google Docs, Amazon S3, or Skydrive. What about security of the data – well make sure you use full disk encyption for the laptop so nothing on the disk is recoverable without the password.

And then we come to the cost… well use low cost laptops or netbooks at less than €400/£400 or much less, so the biggest cost is actually the installation of a new machine.

These are what I can recommend, think about it.

Whole Disk Encryption Update

lock It has been a whole week since I moved my main machine over to using whole disk encryption through Truecrypt. I though it was timely just to give a short update on experiences.

Firstly, it has not crashed :-) .

Everything is working fine exactly the same as my experience immediately after the installation.

Secondly, the performance also has continued to match what I reported – about a 10-15% slowdown on disk access. The worst impact is on standard boot or restart from hibernation, but I have slightly altered my behaviour to account for this. The change is that I am using suspend a whole lot more, and I am lucky that the MSI Wind U100 clone I have has an interesting feature that is almost like a neat feature I have in my Vista machines – the move to hibernation after a period of time in suspend. Let me explain further, if I suspend my laptop on mains then it will stay suspended until I press the magic power button and almost immediately go into the Windows logon screen. If I am suspended on battery however, after a period of time the machine will enter hibernation mode to save battery life. This means I use suspend as the first option (getting around the slow restart from hibernation) always.

Thirdly, have I noticed any other long term effects? Well I have noted that the auto defrag tool of choice does not auto defrag as often as it used to. I believe this is a tuning matter, a property of how I have been using the machine which I will watch over time to see if I can confirm what is going on. Secondly (and related to why I noticed the defrag), the encryption of the HD is (as expected to be honest) is playing funny buggers with the level of fragmentation – the machine does seem to be tending towards getting a higher level of fragmentation.

So all in all, this has been a successful implementation with some areas to watch. I will give an update on a longer term basis of course, so watch out for that in the future. Also are you using disk encryption? What are your experiences?