Tag archive for "Cloud Risks"
attorneys, Events, Presentations
http://nycla.org/index.cfm?section=CLE&page=CLE_Detail&itemID=2682&dateID=20120515
Location: 14 Vesey Street
Faculty:
Program Co-sponsor: NYCLA’s Cyberspace Committee
Faculty: Raj Goel, brainlink.com and Natalie Sulimani, Law Offices of Natalie Sulimani
CFO/CSO/CPO, CISSP, Events, Presentations
http://www.dhses.ny.gov/ocs/awareness-training-events/conference/2012/index.cfm
June 5, 2012, 11 am
Social Media has quickly woven itself into the very fabric of everyday life. This boom in sharing, even the most banal of details, has had a resounding impact on how our children, employees and colleagues communicate.
Using case studies from the US and around the world, we’ll examine how people have lost jobs, college admissions, college degrees, fortunes and freedom through (un)social media.
We’ll also investigate the rampant OVERCOLLECTION of customer and subscriber data by major corporations and governments.
We’ll also discuss some strategies and steps we can take to protect civil liberties and privacy in the age of Social Media.
Sep 11, 2012 – ASIS 58
Social Media & Cloud Computing Threats to Privacy, Security and Liberty, Session 3183
http://www.asis2012.org/Pages/Seminar-Home-Page.aspx
Social Media has quickly woven itself into the very fabric of everyday life. This boom in sharing, even the most banal of details, has had a resounding impact on how our children, employees and colleagues communicate.
Using case studies from the US and around the world, we’ll examine how people have lost jobs, college admissions, college degrees, fortunes and freedom through (un)social media.
We’ll also investigate the rampant OVERCOLLECTION of customer and subscriber data by major corporations and governments.
We’ll also discuss some strategies and steps we can take to protect civil liberties and privacy in the age of Social Media.
Social Media & Cloud Computing Threats to Privacy, Security and Liberty
Social Media has quickly woven itself into the very fabric of everyday life. This boom in sharing, even the most banal of details, has had a resounding impact on how our children, employees and colleagues communicate.
Using case studies from the US and around the world, we’ll examine how people have lost jobs, college admissions, college degrees, fortunes and freedom through (un)social media.
We’ll also investigate the rampant OVERCOLLECTION of customer and subscriber data by major corporations and governments.
We’ll also discuss some strategies and steps we can take to protect civil liberties and privacy in the age of Social Media.
Social Media & Cloud Computing Threats to Privacy, Security and Liberty
Social Media has quickly woven itself into the very fabric of everyday life. This boom in sharing, even the most banal of details, has had a resounding impact on how our children, employees and colleagues communicate.
Using case studies from the US and around the world, we’ll examine how people have lost jobs, college admissions, college degrees, fortunes and freedom through (un)social media.
We’ll also investigate the rampant OVERCOLLECTION of customer and subscriber data by major corporations and governments.
We’ll also discuss some strategies and steps we can take to protect civil liberties and privacy in the age of Social Media.
Yes, Girls Around Me – the app, is gone. For now.
It wasn’t illegal, but it creeped people out.
What I find amusing is that while these guys creeped people out, there are hundreds of developers building similar apps for Law Enforcement, Governments and Corporations that no one’s talking about.
The data YOU share is out there.
Once published, it’s NOT going to be erased.
And lots of people are making fortunes slicing/dicing/mining you to death.
Original article from Forbes:
As far as I can tell, the app “Girls Around Me” wasn’t violating any laws. But it was high on the creepy scale when, according to reports, women’s identity, photographs and location were being revealed to strangers, even though the women never opted into the service. Although the developer, Moscow-based I-Free, hardly deserves any awards, the app’s a good wake-up call for people to use the privacy settings of legitimate social networking and location services.The app mashed together information people posted about themselves publicly on Foursquare and Facebook and created a map showing the location and photographs of nearby women.
via Girls Around Me App Is a Reminder To Be Aware What You Share – Forbes.
In a rare show of honesty, Sergey Brin admitted that
their data that was now in the reach of US authorities because it sits on Google’s servers. He said the company was periodically forced to hand over data and sometimes prevented by legal restrictions from even notifying users that it had done so.
Of course, he conveniently points the finger at his rivals – Facebook, Apple, Hollywood (RIAA/MPAA).
Yes Sergey, your competition is evil. So’s your company. If you don’t want the US government demanding access to all the data that Google collects, then STOP COLLECTING so much data. START telling your users about the threats to THEIR privacy that you’ve created. A Google Good-To-Know about ECPA and PATRIOT ACT would be so much nicer than your current ads.
The threat to the freedom of the internet comes, he claims, from a combination of governments increasingly trying to control access and communication by their citizens, the entertainment industry’s attempts to crack down on piracy,
From the attempts made by Hollywood to push through legislation allowing pirate websites to be shut down, to the British government’s plans to monitor social media and web use, the ethos of openness championed by the pioneers of the internet and worldwide web is being challenged on a number of fronts.
In China, which now has more internet users than any other country, the government recently introduced new “real identity” rules in a bid to tame the boisterous microblogging scene. In Russia, there are powerful calls to rein in a blogosphere blamed for fomenting a wave of anti-Vladimir Putin protests. It has been reported that Iran is planning to introduce a sealed “national internet” from this summer.
via Web freedom faces greatest threat ever, warns Google’s Sergey Brin | Technology | The Guardian.
Utilities are used to deploying electric meters that last 20-30 years in the field.
They are also deploying “smart” meters to enable variable pricing and cut down on their projected labor force.
Smart technology, meet good, old-fashioned human greed.
Electric Company employees have altered meters in Puerto Rico (and elsewhere) for a few-hundred dollars.
In the process, they have cost the utilities hundreds of millions of dollars.
Poorly secured electric meters, meet the internet.
From Krebs On Security:
Smart meters are intended to improve efficiency, reliability, and allow the electric utility to charge different rates for electricity at different times of day. Smart grid technology also holds the promise of improving a utility’s ability to remotely read meters to determine electric usage.But it appears that some of these meters are smarter than others in their ability to deter hackers and block unauthorized modifications. The FBI warns that insiders and individuals with only a moderate level of computer knowledge are likely able to compromise meters with low-cost tools and software readily available on the Internet.
via FBI: Smart Meter Hacks Likely to Spread — Krebs on Security.
All of us have experienced Patch-Tuesdays, when we come into work and find our desktops & laptops rebooted due to mandatory Microsoft patches.
Imagine starting your car and finding out the dashboard changed…and your radio stations are gone. Or worse, the car won’t start.
Yes, automakers have a lousy track record in software development and security.
See http://www.wired.com/threatlevel/2010/03/hacker-bricks-cars/
http://news.bbc.co.uk/2/hi/asia-pacific/4396831.stm – Malaysia car thieves steal finger
But I’m sure MB has THIS system locked down…and if believe that, I’ve got a bridge to sell you.
Yes Virginia, the ultimate expression of physical ownership and transportation is just another droplet in the cloud…
From the TXNOLOGIST:
This new system upgrades on the fly, he said, the first such in-car application to do so. “It’s seamless to the customer,” Link said. “I have a friend who was excited about his system upgrade, which required him to plug in his stick and leave his car running for 45 minutes. Who wants to do that? In a process called ‘reflashing,’ the Mercedes system can turn on the car operating system (CU), download the new application, then cut itself off. It doesn’t require you to do anything at all.”
The implications of this go far beyond transparent upgrade of your streaming music system. Consider that the average car has 70 to 100 electronic control units (ECUs) and even econoboxes have lines of code in the tens of millions — the Mercedes S-Class has more than 20 million. According to Link, software-related recalls are a big problem for carmakers, costing $75 to $95 per car. Not only is it expensive, but it’s a hassle for drivers—nobody likes bringing their car to the shop.
via New York Auto Show: Upgrading Auto Software In A Flash | Txchnologist.
In the EU-vs-Facebook cases, Facebook has sent european citizens 800 PAGES of documents.
In the US, a subpeona merits 62 pages.
So, either the Craigslist killer didn’t use Facebook as much as a dummy German profile, or Facebook held back hundreds of pages of data. You decide.
If you’d like the full PDF, grab it from http://dl.dropbox.com/u/105727/fb-subpoena-db/index.html
From ZDNET:
The 71-page document is actually two documents in one. The first eight pages are the actual subpoena;the remaining 62 pages are from Facebook. Most of the pages sent over from the social networking giant consist of a single photograph, plus formal details such as the image’s caption, when the image was uploaded, by whom, and who was tagged. Other information released includes Wall posts, messages, contacts, and past activity on the site.
The document was released by the The Boston Phoenix as part of a lengthy feature titled “Hunting the Craigslist Killer,” which describes how an online investigation helped officials track down Philip Markoff. The man committed suicide, which meant the police didn’t care if the Facebook document was published elsewhere, after robbing two women and murdering a third.
via Here’s what Facebook sends the cops in response to a subpoena | ZDNet.
WOW! Even the Wall Street Journal thinks Facebook’s data collection, data profiling and app-sharing is out of control.
From the 4/9/12 WSJ column:
A Wall Street Journal examination of 100 of the most popular Facebook apps found that some seek the email addresses, current location and sexual preference, among other details, not only of app users but also of their Facebook friends. One Yahoo service powered by Facebook requests access to a person’s religious and political leanings as a condition for using it. The popular Skype service for making online phone calls seeks the Facebook photos and birthdays of its users and their friends.
Interactive: How Grabby Are Your Facebook Apps?
View Interactive
Yahoo and Skype say that they seek the information to customize their services for users and that they are committed to protecting privacy. “Data that is shared with Yahoo is managed carefully,” a Yahoo spokeswoman said.
The Journal also tested its own app, “WSJ Social,” which seeks data about users’ basic profile information and email and requests the ability to post an update when a user reads an article. A Journal spokeswoman says that the company asks only for information required to make the app work.
This appetite for personal data reflects a fundamental truth about Facebook and, by extension, the Internet economy as a whole: Facebook provides a free service that users pay for, in effect, by providing details about their lives, friendships, interests and activities. Facebook, in turn, uses that trove of information to attract advertisers, app makers and other business opportunities.
…
The unconstrained collection of digital data is stirring feelings of distrust among some users. “Consumers are being pinned like insects to a pinboard, the way we’re being studied,” said Jill Levenson, a creative project manager at Boys & Girls Clubs of America in Atlanta. She recently deleted nearly 100 apps on Facebook and Twitter, she said, because she was uncomfortable with the way details about her life might be used.
Not only are apps obtaining data directly from people’s Facebook accounts, some apps are also letting unapproved advertising companies track users, according to data collected from PrivacyChoice, a start-up that offers privacy services. This could be a violation of Facebook’s advertising policies.
…
In July 2009, the Office of the Privacy Commissioner of Canada investigated Facebook and discovered that it was sharing too much of users’ personal data with app makers without informing users. “This is no trivial issue: There are close to a million developers out there, scattered across some 180 countries,” said Elizabeth Denham, who was then Canada’s assistant privacy commissioner.
According to surveys of U.S. and U.K. matrimonial attorneys, more and more of them are asking (or requiring) their clients to disclose Facebook, Twitter, LinkedIn, and other social media credentials to the attorney start of the case. The retained counsel has no wish to be surprised in court, by finding out that his or her client said or posted things online that are detrimental to the case.1
As a Cyberforensics consultant, I ask the following questions when working with lawyers in order for my clients to get the best results possible when fighting matrimonial cases:
1) Does your client (the wife, husband or partner) have a legal right to the computer or smartphone? If the device is jointly owned, then we can image and analyze it. If the device is owned by the other person’s employer, or is somehow construed as private property, then we do not have the legal right to analyze it, without a court order.
2) Has a PRESERVATION LETTER been issued to the opposing side?
3) Has either side retained an expert to acquire multiple copies of legally compliant forensics images? If both sides agree that the image is forensically sound, then both sides can invest resources in evidence analysis, not re-acquisition.
4) How many devices are owned by the couple? Computers, laptops, smartphones, etc.
5) Do they have any shared passwords to e-mail, online banking, Facebook, LinkedIn, etc? If yes, then we ask the attorney retaining us to determine (and advise us in writing) whether their client still has a legal right to those passwords, now that the divorce process has started.
6) What are we looking for? Financial records? Evidence of online romances? Deleted files and documents?
The best way to minimize forensics costs is to limit what we need to look for.
Every client has something to hide.
Guide your forensics investigator – frame the request as narrowly as possible. For example, “find me financial records” or “we suspect he’s hiding funds offshore” or “she’s got a shopping addiction” or “we suspect he’s having an affair.”
7) Has anyone used non-forensics software to try an undelete files or used a non-forensic computer technician to gather evidence? If so, then there’s a possibility that the evidence is spoiled and cannot be used in court. Based on my experience, even when the evidence cannot be presented in court, it often results in negotiated settlements.
8 ) Is there any suspicion of child pornography (CP) on the device(s)?
Under current Federal laws, if we encounter more than three items of CP, we are legally obligated to stop work and report it to the FBI, Secret Service and ICE. Unlike any other form of evidence, mere possession of CP by an attorney (or their consultants) is illegal under federal law2,3 and attorneys have been prosecuted for possessing CP while they were conducting research on behalf of their clients.
See the case of Attorney Leo Thomas Flynn at www.brunolaw.com/prosecutionserves-as-warning.html.
Below are several case studies that illustrate the above points:
1) In a case, the family kept using the shared computer(s) months after the divorce was filed. Analysis of the data revealed that the husband had lied to the wife, and his attorney, about what he did with the couple’s sex tapes, which were on the shared computer. Since the entire family (husband, wife, children, guests, etc.) used the same user name and password to log in to the computer, it was forensically impossible to tell who created, modified or deleted files — this evidence was considered polluted and could not be used in court. While this evidence could not be used in court, it assisted the wife’s attorney in negotiating a favorable settlement.
2) In another case, the husband fled from his native country to the U.S. 18 months ago. The wife followed suit six months later. She brought the family laptop with her, and presented it to her U.S. attorney as evidence. Having established the dates of his departure, and her departure from their native country, we started the analysis. We located some financial records. We also found large stashes of adult imagery from dating sites–both male and female dating profiles. The initial conclusion we drew was that the husband was having a homosexual affair, or was bisexual, due to the prevalence of both male and female dating profiles. Upon review, the wife rejected the analysis. The discrepancies in the dates of profiles led us to re-interview the wife, with counsel present. During this re-interview, we discovered that after the husband had fled, the wife’s sister has used the laptop to engage in online dating for the intervening six months. Because the client allowed her sister to use the laptop for six months, and did not communicate this with the attorney, all digital evidence had to be thrown out, because it was spoiled.
Defending Against Cyber Evidence
When defending against cyber-evidence, determine the legality of the evidence. In most cases, the evidence was spoiled or may have been collected illegally. Determine the correctness of evidence – the data may have been collected legally – but was it collected and analyzed correctly?
In one case, the client was charged with 107 counts, based on the fact that he clicked on one link, and the popup downloaded 50 images on the hard drive. Analysis by the author was able to prove that these were the result of popups downloading multiple images per click, and should therefore be counted as one violation per popup or web page. In the end, the client was charged with five counts–a far cry from the initial 107.
Social Media and Cloud Evidence
While we cannot gather forensic evidence from cloud providers (Facebook, Gmail, Twitter, World-of-Warcraft (WOW), Farmville, etc.), in many cases, once references to these services have been located on the clients’ hard drives, you can subpoena log files from these providers. Facebook, WOW, and EZ-pass are great places to acquire digital evidence.
Raj Goel is founder and CTO of Brainlink International, Inc. Learn more at www.RajGoel.com andwww.Brainlink.com.
References
1. www.guardian.co.uk/technology/2011/mar/- 08/facebook-us-divorces,
http://www.dailymail.co.uk/femail/article-2080398/Facebook-cited-THIRD-divorces.html,
http://kotaku.com/5576262/farmville-world-of-warcraft-are-divorce-lawyers-latest-weapons-in-court
2. www.orangecountycriminaldefenselawyerblog.com/2011/02/in-orange-county-ca-whathappe.html
3. www.brunolaw.com/prosecution-serves-as-warning.html
This article appears in the April 2012 issue of New York County Lawyers Association (NYCLA) Newspaper on pages 5 & 15. The PDF is available at http://www.brainlink.com/whitepapers/2012-04-04-New-York-County-Lawyer-April-2012-Cyberforensics.pdf
social game developer RockYou suffered a serious SQL injection flaw on its flagship website. Worse, the company was storing user details in plain text. As a result, tens of millions of login details, including those belonging to minors, were stolen and published online. Now, RockYou has finally settled with the Federal Trade Commission FTC.The FTC charged that, while touting its security features, RockYou failed to protect the privacy of its users, allowing hackers to access the personal information of 32 million users. The FTC also alleged in its complaint that RockYou violated the Children’s Online Privacy Protection Act COPPA Rule in collecting information from approximately 179,000 children.In agreeing to FTC’s settlement, RockYou has been barred from future deceptive claims regarding privacy and data security, has to implement and maintain a data security program, must submit to security audits by independent third-party auditors every other year for 20 years, is barred from future violations of the COPPA Rule, is required to delete information collected from children under age 13, and must pay a $250,000 civil penalty.
via FTC fines RockYou $250,000 for storing user data in plain text | ZDNet.
It’s not just kids anymore – adults with quirky humor, facebooking on their own time, with their own equipment are also being harassed.
From Time.com:
A teacher’s aide in Michigan was let go from her job after a school administrator demanded that she turn over her Facebook password and she refused. The aide, Kimberly Hester, is preparing for a legal showdown with the school system. The incident that prompted administrators to ask Hester for her password occurred last spring. According to local news station WSBT, “She jokingly posted a picture of a co-worker’s pants around her ankles and a pair of shoes, with the caption ‘Thinking of you.’” Hester wasn’t using Facebook during school hours or at a school computer, but her brand of humor got her in hot water at work anyway.
via Facebook: Employer Fires Aide Over Refusal to Give Up Facebook Password | Moneyland | TIME.com.
“Dictation” is one of the features of the new iPad, and it can be used to dictate notes, emails, text messages. But new iPad owners may want to use it sparingly if they’re worried about privacy: the feature sends what you say to Apple’s servers to process the information.
“What I’ve come to learn about Dictation is that it requires more from me to use than I’m comfortable with Apple requesting,” writes Stephen Chapman on ZDNet.
via iPad’s ‘Dictation’ sends info to Apple servers – Technolog on msnbc.com.
The IP address of a computer used to view a motorbike sales ad posted by an early victim of the Toulouse gunman played a vital role in narrowing down Mohamed Merah as the main suspect in a series of attacks that have horrified France, it has emerged.
French soldier Imad Ibn-Ziaten posted a video of the motorbike he wanted to sell online. The paratrooper was killed on 11 March after he invited someone who posed as a prospective buyer to his house.
Le Monde reports (Google translation here) that the ad was viewed by about 500 people. Cyber police narrowed down the list of likely suspects to those who lived in and around Toulouse in south-west France. This search was intensified after Ibn-Ziaten’s assassination was linked to the slaughter of three children and a rabbi at a Jewish school in Toulouse on Monday, 19 March.
In addition, Le Monde added, a motorcycle dealer had reported a suspicious conversation with someone who wanted to know whether it was possible to remove an anti-theft tracking device from a Yamaha scooter just days before the vehicle was stolen on 6 March and before the first attacks against French soldiers. The twin strands of evidence allowed police to compile a shortlist of suspects.
Merah was already under surveillance by French authorities and the use of an IP address, which was linked to his brother’s house, to view Ibn-Ziaten’s motorcycle video made him a prime suspect in the case.
via Cybercops traced Toulouse massacre suspect through IP address • The Register.
What can we learn from the Dharun Ravi case?
1) All the evidence was digital / social media
2) Dharun’s computers & phones self-incriminated him
They relied primarily on statements that Ravi made through conversations and text messages with friends as well as actions that he took using technology and social media without Clementi’s initial knowledge, to establish his bias and intent to intimidate. It was questionable whether this unorthodox approach toward establishing Dharun Ravi’s mental state would hold water with the jury.
http://www.huffingtonpost.com/matt-semino/dharun-ravi-trial_b_1365027.html
3) Because of a teenager’s stupid mistakes, 2 families are destroyed. Tyler Clemente’s lost a son. Dharun Ravi’s lost a future.
4) Social media bullying is a new field of evidence capture and prosecution
5) Do YOU understand that a computer or smartphone is a loaded handgun or a live grenade? It can hurt others, and blow your hand off?
Can you teach your kids the important lessons from this trial?
Who’s more invasive than State Governments & employers? Colleges.
Yes, the bastions of higher learning and organized sports are also erasing any concept of privacy. To protect the multi-billion dollar college sports rackets, er, business model, colleges are demanding that “student-athletes” hand over their facebook & twitter logins, friend coaches, etc.
Apparently, The US Constitution and The Bill Of Rights doesn’t exist inside a football stadium or the locker room.
From MSNBC:
Student-athletes in colleges around the country also are finding out they can no longer maintain privacy in Facebook communications because schools are requiring them to “friend” a coach or compliance officer, giving that person access to their “friends-only” posts. Schools are also turning to social media monitoring companies with names like UDilligence and Varsity Monitor for software packages that automate the task. The programs offer a “reputation scoreboard” to coaches and send “threat level” warnings about individual athletes to compliance officers.
via Red Tape – Govt. agencies, colleges demand applicants’ Facebook passwords.
Want a job? Login to your facebook account please…
From MSNBC:
In Maryland, job seekers applying to the state’s Department of Corrections have been asked during interviews to log into their accounts and let an interviewer watch while the potential employee clicks through wall posts, friends, photos and anything else that might be found behind the privacy wall.
Previously, applicants were asked to surrender their user name and password, but a complaint from the ACLU stopped that practice last year. While submitting to a Facebook review is voluntary, virtually all applicants agree to it out of a desire to score well in the interview, according Maryland ACLU legislative director Melissa Coretz Goemann.
via Red Tape – Govt. agencies, colleges demand applicants’ Facebook passwords.
In the US, UK and several other countries, employers are requiring that employees hand over their Facebook / Linkedin / etc accounts during the hiring process.
Some are requiring applicants to login to their social media accounts, with the interviewer looking over their shoulders, so that the employers can claim that they did not demand usernames & passwords…just a peek at the data.
From The Register:
The Facebook job test: Now interviewers want your logins
Need work? Better hand over that password
By Dan Olds, Gabriel Consulting • Get more from this author
Posted in HPC Blog, 21st March 2012 13:42 GMT
HPC blog When I wrote this blog about how a recent research study correlated social network behavior with employee success, I speculated that we’d soon see employers trying to circumvent Facebook’s privacy policies in order to get a good look at your Facebook pages.
Well, it turns out that some employers aren’t happy with just seeing the public part of applicant profiles; they’re actually asking prospective employees to turn over their Facebook login and password. Wait, did I get that right? (Looks again.) Yeah, I did. They’re outright asking applicants to give them their Facebook login details as part of the interview screening process.
Other companies are requesting that prospective (and presumably current) employees “friend” HR reps or background-checkers on Facebook. Others are requiring applicants to log in to their Facebook accounts from a company-owned computer – I guess they take screen scrapes of the page for later study, or maybe capture the login keystrokes.
If a company requires you to give them an intimate view of your social networking pages during the interview process, might there be something in the employment agreements that gives them the “right” to take a second, third, or fourth look – whenever they want to – after you’re hired?
via The Facebook job test: Now interviewers want your logins • The Register.
ISC(2) SecureSanAntonio – Jan 19, 2012
ISC(2) SecureDallas – Jan 20 2012
© 2012 Raj Goel, CISSP. Powered by WordPress.
