<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: cotton]]></title>
    <link>http://securityratty.com/tag/cotton</link>
    <description></description>
    <pubDate>Tue, 07 Aug 2007 13:30:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Phreaknic 12 (2008) Hacker Con]]></title>
      <link>http://securityratty.com/article/4f1c46cc8d2c53438d8656355e1bfa74</link>
      <guid>http://securityratty.com/article/4f1c46cc8d2c53438d8656355e1bfa74</guid>
      <description><![CDATA[New Video: Phreaknic 12 (2008) Hacker Con

This is a quick and dirty video documentary of the things that when on around the talks and event at Phreaknic 12 (2008). Don't watch if you get sick at...]]></description>
      <content:encoded><![CDATA[New Video: <a href="http://www.irongeek.com/i.php?page=videos/phreaknic-12-hacker-con">Phreaknic 12 (2008) Hacker Con</FONT></B></a>
<p></p>
<p>This is a quick and dirty video documentary of the things that when on around the talks and event at <a href="http://www.phreaknic.info">Phreaknic 12 </a>(2008). Don't watch if you get sick at shaky cam movies like Blair Witch or Cloverfield. A rough timeline of the content in the video is as follows: </p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Intro and leaving Louisville with Brian. Morgellon talks about hacking the <a href="http://dailyduino.com/">Arduino</a> micro controller platform.&nbsp;Sorteal talks about the LiVes Open Source video editor. AT&amp;T Batman building by night. Mojo-JoJo soldering some stuff for the shooting range. The patron gods of hackerdom. Registration. Con swag overview. Morgellon&nbsp; gets his discreet logic on. AK-47 building with HandGrip and Buttstock. Froggy talks up Notacon, which I plan to go to next year. Skydog explains the Jware chair toss event, and then we compete. Rootwars hacker wargames. I ask <a href="http://dualcoremusic.com/nerdcore/">Int80 about using his nerdcore</a> music in some of my videos. NotLarry explains rootwars. Some iPhone hacking with <a href="http://leebaird.com/Me/Hacking.html">Lee Baird</a> and John Skinner. I do a little <a href="http://www.irongeek.com/i.php?page=security/bluecasing1">Bluecaseing/Warnibbling </a>with the Bluetooth on my Nokia n810. John, Lee, Brian and I go to the German restaurant. I blind DOSman with the light from my camera and check out what folks are doing with the <a href="http://dailyduino.com/">Arduinos</a> Droops brought for folks to play with. I check back in on R00tW4rz. I blind Droops. I talk Ettercap filters with <a href="http://www.rmccurdy.com/">operat0r</a>. USB door key fun with the <a href="http://dailyduino.com/">Arduino</a>. More breadboard fun. Nokia n810 + Ettercap Filter + Lemon-part = win. <a href="http://dualcoremusic.com/nerdcore/">Int80</a> gets down with his own bad self, and the rest of Phreaknic. I find an energy drink with protein. Folks play with the hardware keyloggers I brought, and we have some epic fail with the IBM Model M + USB adapter + Mac OS 10.5. <a href="http://www.winnschwartau.com/">Winn Schwartau</a> joins in on the keylogger fun. <a href="http://www.packetsniffers.org/">DOSman and Zack</a> use a directional antenna from the 9th floor to search downtown Nashville for WiFi access points. Zoom in on Al. John and Lee eat jerky. <a href="http://www.hak5.org/">Daren and Shannon from Hak5</a> blind me this time. :) Then they do a quick interview. I interview <a href="http://www.digome.com/">TRiP</a> about the legalities of wardriving, sniffing and leaving your access point open so you have plausible deniability of copyright infringement (most likely it won't hold water in court if you are a computer geek). I give Hak5 Daren beef jerky. <a href="http://www.offensive-security.com/">Ziplock</a> had more con badges than God. I meet up with Iridium. I talk with Nightcarnage about the audio/video setup at Phreaknic. As I predicted, the <a href="http://www.shmoo.com/~gdead/Site/Home.html">Potters</a> won the WiFi Race. I say why this was the best Phreaknic ever. Using green lasers on crack dealers. Techno in the dark, the Aiptek action HD does not do well in low light. Nicodemius shows off his Minority Report like multi-touch table. Hula hoop contest. I check back in with Jeff Cotton and his USB keyed door. I strap on my gear to leave the con. Brian and I do a wrap up of our thoughts on Phreaknic 2008.</p>
<p><a href="http://feedads.googleadservices.com/~a/fu-jGbBXkZllK6znlRDBB8Bbjxo/a"><img src="http://feedads.googleadservices.com/~a/fu-jGbBXkZllK6znlRDBB8Bbjxo/i" border="0" ismap="true"></img></a></p><img src="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~4/H4w0W-ygK2s" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 29 Oct 2008 02:59:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/con">con</category>
      <category domain="http://securityratty.com/tag/phreaknic">phreaknic</category>
      <category domain="http://securityratty.com/tag/video">video</category>
      <category domain="http://securityratty.com/tag/con swag overview">con swag overview</category>
      <category domain="http://securityratty.com/tag/source video editor">source video editor</category>
      <category domain="http://securityratty.com/tag/talks">talks</category>
      <category domain="http://securityratty.com/tag/sorteal talks">sorteal talks</category>
      <category domain="http://securityratty.com/tag/hacker con">hacker con</category>
      <category domain="http://securityratty.com/tag/lee eat jerky">lee eat jerky</category>
      <source url="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~3/H4w0W-ygK2s/i.php">Phreaknic 12 (2008) Hacker Con</source>
    </item>
    <item>
      <title><![CDATA[Phreaknic 12 (2008) Hacker Con]]></title>
      <link>http://securityratty.com/article/91dad2a3ec5ac9d4f78bd2d1a2bb18c2</link>
      <guid>http://securityratty.com/article/91dad2a3ec5ac9d4f78bd2d1a2bb18c2</guid>
      <description><![CDATA[New Video: Phreaknic 12 (2008) Hacker Con

This is a quick and dirty video documentary of the things that when on around the talks and event at Phreaknic 12 (2008). Don't watch if you get sick at...]]></description>
      <content:encoded><![CDATA[New Video: <a href="http://www.irongeek.com/i.php?page=videos/phreaknic-12-hacker-con">Phreaknic 12 (2008) Hacker Con</FONT></B></a>
<p></p>
<p>This is a quick and dirty video documentary of the things that when on around the talks and event at <a href="http://www.phreaknic.info">Phreaknic 12 </a>(2008). Don't watch if you get sick at shaky cam movies like Blair Witch or Cloverfield. A rough timeline of the content in the video is as follows: </p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Intro and leaving Louisville with Brian. Morgellon talks about hacking the <a href="http://dailyduino.com/">Arduino</a> micro controller platform.&nbsp;Sorteal talks about the LiVes Open Source video editor. AT&amp;T Batman building by night. Mojo-JoJo soldering some stuff for the shooting range. The patron gods of hackerdom. Registration. Con swag overview. Morgellon&nbsp; gets his discreet logic on. AK-47 building with HandGrip and Buttstock. Froggy talks up Notacon, which I plan to go to next year. Skydog explains the Jware chair toss event, and then we compete. Rootwars hacker wargames. I ask <a href="http://dualcoremusic.com/nerdcore/">Int80 about using his nerdcore</a> music in some of my videos. NotLarry explains rootwars. Some iPhone hacking with <a href="http://leebaird.com/Me/Hacking.html">Lee Baird</a> and John Skinner. I do a little <a href="http://www.irongeek.com/i.php?page=security/bluecasing1">Bluecaseing/Warnibbling </a>with the Bluetooth on my Nokia n810. John, Lee, Brian and I go to the German restaurant. I blind DOSman with the light from my camera and check out what folks are doing with the <a href="http://dailyduino.com/">Arduinos</a> Droops brought for folks to play with. I check back in on R00tW4rz. I blind Droops. I talk Ettercap filters with <a href="http://www.rmccurdy.com/">operat0r</a>. USB door key fun with the <a href="http://dailyduino.com/">Arduino</a>. More breadboard fun. Nokia n810 + Ettercap Filter + Lemon-part = win. <a href="http://dualcoremusic.com/nerdcore/">Int80</a> gets down with his own bad self, and the rest of Phreaknic. I find an energy drink with protein. Folks play with the hardware keyloggers I brought, and we have some epic fail with the IBM Model M + USB adapter + Mac OS 10.5. <a href="http://www.winnschwartau.com/">Winn Schwartau</a> joins in on the keylogger fun. <a href="http://www.packetsniffers.org/">DOSman and Zack</a> use a directional antenna from the 9th floor to search downtown Nashville for WiFi access points. Zoom in on Al. John and Lee eat jerky. <a href="http://www.hak5.org/">Daren and Shannon from Hak5</a> blind me this time. :) Then they do a quick interview. I interview <a href="http://www.digome.com/">TRiP</a> about the legalities of wardriving, sniffing and leaving your access point open so you have plausible deniability of copyright infringement (most likely it won't hold water in court if you are a computer geek). I give Hak5 Daren beef jerky. <a href="http://www.offensive-security.com/">Ziplock</a> had more con badges than God. I meet up with Iridium. I talk with Nightcarnage about the audio/video setup at Phreaknic. As I predicted, the <a href="http://www.shmoo.com/~gdead/Site/Home.html">Potters</a> won the WiFi Race. I say why this was the best Phreaknic ever. Using green lasers on crack dealers. Techno in the dark, the Aiptek action HD does not do well in low light. Nicodemius shows off his Minority Report like multi-touch table. Hula hoop contest. I check back in with Jeff Cotton and his USB keyed door. I strap on my gear to leave the con. Brian and I do a wrap up of our thoughts on Phreaknic 2008.</p>]]></content:encoded>
      <pubDate>Wed, 29 Oct 2008 02:59:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/con">con</category>
      <category domain="http://securityratty.com/tag/phreaknic">phreaknic</category>
      <category domain="http://securityratty.com/tag/video">video</category>
      <category domain="http://securityratty.com/tag/con swag overview">con swag overview</category>
      <category domain="http://securityratty.com/tag/source video editor">source video editor</category>
      <category domain="http://securityratty.com/tag/talks">talks</category>
      <category domain="http://securityratty.com/tag/sorteal talks">sorteal talks</category>
      <category domain="http://securityratty.com/tag/hacker con">hacker con</category>
      <category domain="http://securityratty.com/tag/lee eat jerky">lee eat jerky</category>
      <source url="http://www.irongeek.com/i.php?page=videos/phreaknic-12-hacker-con">Phreaknic 12 (2008) Hacker Con</source>
    </item>
    <item>
      <title><![CDATA[Phreaknic 12 (2008) Hacker Con]]></title>
      <link>http://securityratty.com/article/215684d0c6bd7ef7ac4756e6b556cf79</link>
      <guid>http://securityratty.com/article/215684d0c6bd7ef7ac4756e6b556cf79</guid>
      <description><![CDATA[New Video: Phreaknic 12 (2008) Hacker Con

This is a quick and dirty video documentary of the things that when on around the talks and event at Phreaknic 12 (2008). Don't watch if you get sick at...]]></description>
      <content:encoded><![CDATA[New Video: <a href="http://www.irongeek.com/i.php?page=videos/phreaknic-12-hacker-con">Phreaknic 12 (2008) Hacker Con</FONT></B></a>
<p></p>
<p>This is a quick and dirty video documentary of the things that when on around the talks and event at <a href="http://www.phreaknic.info">Phreaknic 12 </a>(2008). Don't watch if you get sick at shaky cam movies like Blair Witch or Cloverfield. A rough timeline of the content in the video is as follows: </p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Intro and leaving Louisville with Brian. Morgellon talks about hacking the <a href="http://dailyduino.com/">Arduino</a> micro controller platform.&nbsp;Sorteal talks about the LiVes Open Source video editor. AT&amp;T Batman building by night. Mojo-JoJo soldering some stuff for the shooting range. The patron gods of hackerdom. Registration. Con swag overview. Morgellon&nbsp; gets his discreet logic on. AK-47 building with HandGrip and Buttstock. Froggy talks up Notacon, which I plan to go to next year. Skydog explains the Jware chair toss event, and then we compete. Rootwars hacker wargames. I ask <a href="http://dualcoremusic.com/nerdcore/">Int80 about using his nerdcore</a> music in some of my videos. NotLarry explains rootwars. Some iPhone hacking with <a href="http://leebaird.com/Me/Hacking.html">Lee Baird</a> and John Skinner. I do a little <a href="http://www.irongeek.com/i.php?page=security/bluecasing1">Bluecaseing/Warnibbling </a>with the Bluetooth on my Nokia n810. John, Lee, Brian and I go to the German restaurant. I blind DOSman with the light from my camera and check out what folks are doing with the <a href="http://dailyduino.com/">Arduinos</a> Droops brought for folks to play with. I check back in on R00tW4rz. I blind Droops. I talk Ettercap filters with <a href="http://www.rmccurdy.com/">operat0r</a>. USB door key fun with the <a href="http://dailyduino.com/">Arduino</a>. More breadboard fun. Nokia n810 + Ettercap Filter + Lemon-part = win. <a href="http://dualcoremusic.com/nerdcore/">Int80</a> gets down with his own bad self, and the rest of Phreaknic. I find an energy drink with protein. Folks play with the hardware keyloggers I brought, and we have some epic fail with the IBM Model M + USB adapter + Mac OS 10.5. <a href="http://www.winnschwartau.com/">Winn Schwartau</a> joins in on the keylogger fun. <a href="http://www.packetsniffers.org/">DOSman and Zack</a> use a directional antenna from the 9th floor to search downtown Nashville for WiFi access points. Zoom in on Al. John and Lee eat jerky. <a href="http://www.hak5.org/">Daren and Shannon from Hak5</a> blind me this time. :) Then they do a quick interview. I interview <a href="http://www.digome.com/">TRiP</a> about the legalities of wardriving, sniffing and leaving your access point open so you have plausible deniability of copyright infringement (most likely it won't hold water in court if you are a computer geek). I give Hak5 Daren beef jerky. <a href="http://www.offensive-security.com/">Ziplock</a> had more con badges than God. I meet up with Iridium. I talk with Nightcarnage about the audio/video setup at Phreaknic. As I predicted, the <a href="http://www.shmoo.com/~gdead/Site/Home.html">Potters</a> won the WiFi Race. I say why this was the best Phreaknic ever. Using green lasers on crack dealers. Techno in the dark, the Aiptek action HD does not do well in low light. Nicodemius shows off his Minority Report like multi-touch table. Hula hoop contest. I check back in with Jeff Cotton and his USB keyed door. I strap on my gear to leave the con. Brian and I do a wrap up of our thoughts on Phreaknic 2008.</p>
<p><a href="http://feedads.googleadservices.com/~a/fu-jGbBXkZllK6znlRDBB8Bbjxo/a"><img src="http://feedads.googleadservices.com/~a/fu-jGbBXkZllK6znlRDBB8Bbjxo/i" border="0" ismap="true"></img></a></p><img src="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~4/f9ViIhlukDU" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 29 Oct 2008 02:59:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/con">con</category>
      <category domain="http://securityratty.com/tag/phreaknic">phreaknic</category>
      <category domain="http://securityratty.com/tag/video">video</category>
      <category domain="http://securityratty.com/tag/con swag overview">con swag overview</category>
      <category domain="http://securityratty.com/tag/source video editor">source video editor</category>
      <category domain="http://securityratty.com/tag/talks">talks</category>
      <category domain="http://securityratty.com/tag/sorteal talks">sorteal talks</category>
      <category domain="http://securityratty.com/tag/hacker con">hacker con</category>
      <category domain="http://securityratty.com/tag/lee eat jerky">lee eat jerky</category>
      <source url="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~3/f9ViIhlukDU/i.php">Phreaknic 12 (2008) Hacker Con</source>
    </item>
    <item>
      <title><![CDATA[Modelling The Global Financial Meltdown]]></title>
      <link>http://securityratty.com/article/15c8ebf58fa47d569eb7cdbc4039c683</link>
      <guid>http://securityratty.com/article/15c8ebf58fa47d569eb7cdbc4039c683</guid>
      <description><![CDATA[Yesterday I received a call from Penny Grosman , Senior Editor, Wall Street &amp; Technology . Penny was interested in my opinion, Will risk management applications be the next killer app for CEP on Wall...]]></description>
      <content:encoded><![CDATA[<p>Yesterday I received a call from <a href="http://www.wallstreetandtech.com/penny-crosman/" target="_blank">Penny Grosman</a>, Senior Editor, <a href="http://www.wallstreetandtech.com/" target="_blank">Wall Street &amp; Technology</a>.   Penny was interested in my opinion, &#8220;Will risk management applications be the next killer app for CEP&#8221; on Wall Street.    I enjoyed talking with Penny.  She caught up with me leaving a tailor&#8217;s shop in Chiang Mai, so I hope she did not mind hearing my stories of buying unique Northern Thai cotton fabric and designing my own casual shirts in the economic turndown.</p>
<p>We read many stories on the net where folks claim that the current financial crisis could have been avoided with more or better use of technology.     This is expected, as software companies and IT professionals will often try to piggy-backtheir business development strategy on the &#8220;crisis of the day&#8221; to sell more goods and services.    Honestly, in this current situation, the main technology that we needed was simple, accurate financial models.</p>
<p>For example, in the chart above, the US economy was doing quite well with US federal funds rates low.   Housing prices in the US were skyrocketing and there was a concern about inflation.    There was an understandable concern the sustainability of that economy.</p>
<p style="text-align: center;"><img class="aligncenter" style="vertical-align: bottom;" src="http://www.thewrittenblog.com/main_1/images/97kcpv16xjh0uvsi8k7kdhaw.gif" alt="" width="277" height="415" /></p>
<p>So, in perhaps one the most ill-advised Federal Reserve actions of many decades, the folks at the helm of the Fed decided to raise their lending rates around 500 percent over a two year period.</p>
<p>As we all know, primarily because of the action by the Fed, the world faces perhaps the worst economic disaster in modern times, while the US Executive Branch and the Congress fight over how to spend $700 Billion taxpayer dollars to inject liquidity into the markets to try to head off a global financial disaster.</p>
<p>It is amazing to me that the US Federal Government, or their advisors, does not have simple financial models with cause-and-effect analysis such as:</p>
<ul>
<li>Homeowners with adjustable rate mortuages will not be able to make payments;and</li>
<li>Housing prices will fall dramatically; then</li>
<li>Homeowners will default on loans where the collateral is much less than the asset value, and</li>
<li>Banks will suffer great losses, and</li>
<li>Lending will come to a halt, then</li>
<li>Banks will collapse, then</li>
<li>Wall Street will exit the markets in panic</li>
<li>&#8230; and more trouble&#8230;.. !!</li>
</ul>
<p>There are and continue to be a lot of discussion and opinions about how risk management needs improvement. and I agree.   We will also read folks talk about how technology can be used to help solve this problem, including CEP/EP and related software (see also <!-- This wrapper class appears only on Page and Single Post pages. --><a title="Capital Market CEP Fantasy Land" rel="bookmark" href="../2008/06/23/capital-market-cep-fantasy-land/">Capital Market CEP Fantasy Land</a>). However, as much I would be pleased to see more CEP/EP applications and use cases, I do not believe that event processing technology is really very useful to solve the core problem of the current financial crisis.</p>
<p>The core problem is, seemingly, that our &#8220;financial experts&#8221; do not even have simple models that will illustrate what will or could happen when you raise the fed lending rates 500 percent in two years in an economy pregnant with adjustable rate mortgages.</p>
<p>To me, this does not appear to be rocket science.  The negligence by the US Federal Reserve and their advisors is astonishing.</p>
]]></content:encoded>
      <pubDate>Thu, 02 Oct 2008 02:33:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/simple financial models">simple financial models</category>
      <category domain="http://securityratty.com/tag/financial models">financial models</category>
      <category domain="http://securityratty.com/tag/current financial crisis">current financial crisis</category>
      <category domain="http://securityratty.com/tag/crisis">crisis</category>
      <category domain="http://securityratty.com/tag/simple">simple</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/wall street">wall street</category>
      <category domain="http://securityratty.com/tag/main technology">main technology</category>
      <category domain="http://securityratty.com/tag/folks">folks</category>
      <source url="http://www.thecepblog.com/2008/10/02/modelling-the-global-financial-meltdown/">Modelling The Global Financial Meltdown</source>
    </item>
    <item>
      <title><![CDATA[Tucson area Domino's Pizza customer information exposed]]></title>
      <link>http://securityratty.com/article/8a47859f1eed2fddfeb4d9a0979c73fb</link>
      <guid>http://securityratty.com/article/8a47859f1eed2fddfeb4d9a0979c73fb</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/18/08

Organization
Domino's Pizza

Contractor/Consultant/Branch
Unnamed former owner of 24 Tucson area locations

Victims
Customers

Number Affected...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/dominos.jpg" align="right" height="176" width="175"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/18/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.dominos.com/home/index.jsp">Domino's Pizza</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>Unnamed former owner of 24 Tucson area locations&nbsp;&nbsp;&nbsp;&nbsp; <br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names and credit card numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>Hundreds of credit card receipts dating back as many as five years were found "blowing in the wind" after a former owner of 24 Domino's Pizza stores in the Tucson, Arizona area was found to have been discarding boxes of old records near her home.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.kvoa.com/Global/story.asp?S=8516485&amp;nav=HMO6HMaY">KVOA Channel 4 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Tom McNamara, KVOA Channel 4 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>Investigators found credit card numbers blowing in the wind for anyone to see.<br><br>These piles and papers strewn across the alley contain hundreds of old receipts from Domino's Pizza stores.<br><br>When we got a call about this, we went down to University Avenue and Euclid and saw these receipts were three, four, and even five years old.<br><span style="font-style: italic;">[Evan] Is there any business reason to keep credit card receipts for this period of time?&nbsp; I suppose a case could be made that these should be kept for up to seven years for </span><a style="font-style: italic;" href="http://www.irs.gov/businesses/small/article/0,,id=98513,00.html">tax purposes</a><span style="font-style: italic;">.</span><br><br>We contacted the former owner of 24 Domino's Pizza stores in Tucson.<br><span style="font-style: italic;">[Evan] This could have been a very risky breach in terms of overall potential impact considering the number of affected persons.&nbsp; 24 stores, x number of credit card transactions per year, and 5 years could add up to a pretty significant number.</span><br><br>She won't talk with us on-camera, but told us she'd been discarding boxes of old records near her home and somehow all those receipts got loose.<br><span style="font-style: italic;">[Evan] Incidents like this tear me up.&nbsp; I very much doubt that this lady had any malicious intention behind her actions, but nonetheless her actions could have caused considerable inconvenience (and possible loss) to a number of individuals.&nbsp; I presume that she just didn't know any better.</span><br><br>We found Scott Brumage's name and credit card number on one of those receipts in the alley.<br><br>Tom McNamara asks him, "See that? Recognize that name? Recognize the number?" Scotts nods, "Uh huh."<br><br>Tom asks, "Well how'd you feel when we called you out of the blue and told you what we'd found? What went through your mind?"<br><br>"It was just kind of surreal at first because I like to think I can trust using my card [because of] the convenience and everything of course."<br><br>Scott was startled to see his name and card numbers on our screen.<br><br>He says he's ordered a lot of pizzas over the years and expects privacy and protection when he pays for his pepperoni pie.<br><span style="font-style: italic;">[Evan] Is this an unreasonable expectation?&nbsp; Maybe it is an unreasonable expectation, given the current environment and considering the bigger picture (merchants, processors, banks, "the system", etc.).&nbsp; I don't think that it is an unreasonable requirement, but requirements, expectations and practices are not in alignment.</span><br><br>Scotts tells us, "I don't know. [I'm] just dumbfounded, other than they need to figure a better way of disposing."<br><span style="font-style: italic;">[Evan] It is dumbfounding, isn't it.&nbsp; I often wonder what people are thinking when they do some of the things they do.</span><br><br>The Investigators contacted the Federal Trade Commission in Washington and they say thieves could potentially use discarded credit card numbers even if the card has expired. The numbers on the card in many cases are still the same.<br><br>They say there could be enough information on the receipt to help a thief reveal more information about you, such as your social security number.<br><br>It's small comfort for Scott. He says, "I'm hoping this is a one time only [situation]. They might have just lost a loyal customer."<br><span style="font-style: italic;">[Evan] The impact to the victim is usually pretty clear and easy to quantify.&nbsp; The impact to the business (or organization) is not usually as easy to measure.&nbsp; In a competitive business like pizza sales, companies need to identify and communicate differentiators like ingredient quality, service, taste, price, location, etc.&nbsp; Maybe if customers viewed information security practices as an important differentiator, businesses would put more time and effort into securing information.&nbsp; Pipe dream?</span><br><br>In this case, the Investigators contacted Tucson Police and several officers came to collect the records we found and have them destroyed.<br><br><span style="font-weight: bold;">Commentary:</span><br>This breach reminds me of a <a href="http://breachblog.com/2008/06/11/cotton.aspx#comment-1124161">recent discussion</a> I had online with Benjamin Wright in the comments section of the "<a href="http://breachblog.com/2008/06/11/cotton.aspx">Cotton Traders confirms that their website was compromised</a>" breach.&nbsp; He makes a very good argument regarding accountability in credit card breaches.&nbsp; My responses to him are included. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/18/dominos.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 18 Jun 2008 06:43:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/credit card transactions">credit card transactions</category>
      <category domain="http://securityratty.com/tag/credit card">credit card</category>
      <category domain="http://securityratty.com/tag/credit card receipts">credit card receipts</category>
      <category domain="http://securityratty.com/tag/credit card breaches">credit card breaches</category>
      <category domain="http://securityratty.com/tag/card">card</category>
      <category domain="http://securityratty.com/tag/pizza">pizza</category>
      <category domain="http://securityratty.com/tag/receipts">receipts</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/tucson">tucson</category>
      <source url="http://breachblog.com/2008/06/18/dominos.aspx">Tucson area Domino's Pizza customer information exposed</source>
    </item>
    <item>
      <title><![CDATA[Analysis: Cotton Traders Hack A Warning For Business]]></title>
      <link>http://securityratty.com/article/e466668483b0b8b3b1318c2de31a64b0</link>
      <guid>http://securityratty.com/article/e466668483b0b8b3b1318c2de31a64b0</guid>
      <description><![CDATA[Well, a better headline might read another warning for business. Heres an analysis piece of the Cotton Traders credit card breach story that broke last week
From IT PRO
In many ways, Cotton Traders is...]]></description>
      <content:encoded><![CDATA[<p>Well, a better headline might read &#8220;another warning for business&#8221;. Here&#8217;s an analysis piece of the Cotton Trader&#8217;s credit card breach story that broke last week.</p>
<p>From IT PRO:</p>
<blockquote><p>In many ways, Cotton Traders is an ordinary, mid-sized British business. The company, which is based in Altringham, Cheshire, was founded in 1987 by two former England rugby captains, Fran Cotton and Steve Smith. Today, Cotton Traders operates a mail-order business, including online sales, a wholesale operation and a network of stores. Its turnover now exceeds £50 million. It is not involved in high finance or technology; nor is it an e-commerce pure play. It is typical of thousands of companies around the country that have used the internet to expand their sales, with some success. Its website is clean, simple and easy to use, and is designed to appeal to the mass market.</p>
<p>So if Cotton Traders could fall victim to an online criminal gang, so could almost any business that trades on the net. The security breach took place in January, although it was only confirmed by the company earlier this month, and attracted media attention over the last few days.</p></blockquote>
<p>The company maintains that the data was encrypted. for their sakes I hope that is was. I&#8217;m a little surprised of how long it took for the company to disclose this breach. It apparently took place in January and it only now has come to light. </p>
<p>Read on for the full article.</p>
<p><a href="http://www.itpro.co.uk/603714/analysis-cotton-traders-hack-a-warning-for-business">Article Link</a></p>

<p><a href="http://feeds.feedburner.com/~a/Liquidmatrix?a=goAfgd"><img src="http://feeds.feedburner.com/~a/Liquidmatrix?i=goAfgd" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=dWpxyI"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=dWpxyI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=eCOlvi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=eCOlvi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=GztZgi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=GztZgi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=NLGbOi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=NLGbOi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=ulshLi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=ulshLi" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/Liquidmatrix/~4/313706126" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 17 Jun 2008 06:39:03 +0000</pubDate>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/cotton traders">cotton traders</category>
      <category domain="http://securityratty.com/tag/mail-order business">mail-order business</category>
      <category domain="http://securityratty.com/tag/company maintains">company maintains</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <category domain="http://securityratty.com/tag/british business">british business</category>
      <category domain="http://securityratty.com/tag/sales">sales</category>
      <category domain="http://securityratty.com/tag/article link">article link</category>
      <category domain="http://securityratty.com/tag/security breach">security breach</category>
      <source url="http://feeds.feedburner.com/~r/Liquidmatrix/~3/313706126/">Analysis: Cotton Traders Hack A Warning For Business</source>
    </item>
    <item>
      <title><![CDATA[Cotton Traders confirms that their website was compromised]]></title>
      <link>http://securityratty.com/article/bf111990caad3724772db18cb2b78b6d</link>
      <guid>http://securityratty.com/article/bf111990caad3724772db18cb2b78b6d</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/10/08

Organization
Cotton Traders Ltd

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
thought to be up to 38,000

Cotton...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/cotton.jpg" align="right" height="94" width="169"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/10/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.cottontraders.co.uk/">Cotton Traders Ltd.</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>"thought to be up to 38,000"*<br><br><font size="1">*Cotton Traders claims this figure is "widely inaccurate" but isn't supplying the correct figure</font><br><br><span style="font-weight: bold;">Types of Data:</span><br>"addresses and credit card details"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Clothing firm Cotton Traders has confirmed that customers’ addresses and credit card details were stolen during a hack on its website in January."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://news.bbc.co.uk/2/hi/technology/7446871.stm">BBC News</a> <br><a href="http://www.information-age.com/home/information-age-today/439866/up-to-38000-credit-cards-stolen-in-cotton-traders-hack.thtml">Information Age</a> <br><a href="http://www.silicon.com/retailandleisure/0,3800011842,39244963,00.htm">CNET Networks (Silicon.com)</a> <br><a href="http://www.channelregister.co.uk/2008/06/11/cotton_traders_hack/">The Register</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>BBC News and an informed reader of The Breach Blog<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>The credit card details of up to 38,000 customers of clothing firm Cotton Traders were stolen following a hack of its website<br><br>It was initially reported that 38,000 card details were stolen. Cotton Traders claim the number is "substantially less" but refuse to confirm the actual number.<br><span style="font-style: italic;">[Evan] Why is Cotton Traders not disclosing the number of persons affected by the breach?&nbsp; I think they do more damage to their reputation by not appearing open and honest about the breach.&nbsp; I can't think of any significant risk in sharing this information.</span><br><br>The firm has not confirmed the size of the breach but it has acknowledged the site was attacked early this year. <br><br>Barclaycard was contacted as soon as it learned of the attack, and most cards were stopped in January<br><br>"Those involved were notified at the time and card replaced,"<br><span style="font-style: italic;">[Evan] Really?&nbsp; In what manner were the people involved notified?&nbsp; Typically, when people are notified, they talk and/or share their experiences.&nbsp; BBC News reports about this breach ~5 months after the incident, so I wonder if people really were notified "at the time".</span><br><br>The payment industry's trade body said it was serious because hackers accessed details for "card not present" fraud<br><br>customer addresses were also stolen in the hack<br><br>a specialist police force was investigating the case<br><br>In a statement, Cotton Traders said all of its customers' credit card data was encrypted on the website<br><span style="font-style: italic;">[Evan] Hmmm.&nbsp; How and where was the data encrypted?&nbsp; Due to the lack of disclosed details, we are left to speculate.&nbsp; I can tell you from my past experiences that encryption is typically used for data in transit (from the front-end web server to the client) and sometimes where data is at rest (stored in the database).&nbsp; It is not uncommon for data to flow unencrypted between the back-end (database) and front-end (web server).&nbsp; Let's assume that this was a well </span></font><span style="font-style: italic;">architected </span><font size="2"><span style="font-style: italic;">ecommerce platform (from an information security standpoint), and that data is encrypted between the front and back end components.&nbsp; The information still exists for a some amount of time on the front-end server in a non-encrypted state.&nbsp; If the front-end web server were compromised, it is completely conceivable that the information confidentiality was compromised.&nbsp; I am not even going to speculate where and how encryption keys could be managed, but obviously this is another critical component of the architecture.</span><br><br>Cotton Traders, a specialist clothing outfit founded by ex-England rugby stars Fran Cotton and Steve Smith, said the potential to misuse the data is low because the credit card information was encrypted.<br><span style="font-style: italic;">[Evan] See my comments above.&nbsp; More information is required before a claim like the "potential to misuse the data is low" can be verified.</span><br><br>Earlier this year we identified a security issue. We immediately brought in industry security experts to resolve the problem.<br><span style="font-style: italic;">[Evan] Who are the "industry security experts"?</span><br><br>"Cotton Traders have recently upgraded all security on their website which has been validated by leading Industry experts."<br><br>"We would like to reassure all our customers that their data is secure and that the Cotton Traders website meets all leading Industry security standards."<br><br>The exact method used to hack the Cotton Traders website is not known.<br><br>Cotton Traders warned that other major retailers would be vulnerable to the same attack saying its website has always met "leading security standards".<br><span style="font-style: italic;">[Evan] How do you make a claim like this and not share?!&nbsp; If other major retailers "would be vulnerable to the same attack", then shouldn't they and the information security industry be notified ASAP?&nbsp; Maybe they/we have, but I don't think so.&nbsp; The fact that the bad guys share information so much better than us good guys has been an "industry vulnerability" that has existed for many years.&nbsp; This seems like another example of the communication barrier that still exists between "industry experts".</span><br><br>The firm has said customers worried about their cards should contact their card provider.<br><br>Security groups say the attack highlights the need for laws governing companies' response to breaches, as called for by silicon.com's Full Disclosure campaign.<br><span style="font-style: italic;">[Evan] Unfortunately, we need laws to force organizations to do the right things that they should have been doing all along.&nbsp; If organizations were managed well globally, would we need laws like breach notification statutes, SOX, HIPAA. etc.?&nbsp; The chances of organizations being well managed globally is a pipe dream.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>I don't know what irks me more about breaches like this, the breach itself or the poor response. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/11/cotton.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 11 Jun 2008 06:45:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cotton traders">cotton traders</category>
      <category domain="http://securityratty.com/tag/credit card details">credit card details</category>
      <category domain="http://securityratty.com/tag/website">website</category>
      <category domain="http://securityratty.com/tag/card details">card details</category>
      <category domain="http://securityratty.com/tag/information security standpoint">information security standpoint</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/card">card</category>
      <category domain="http://securityratty.com/tag/firm cotton traders">firm cotton traders</category>
      <category domain="http://securityratty.com/tag/front-end server">front-end server</category>
      <source url="http://breachblog.com/2008/06/11/cotton.aspx">Cotton Traders confirms that their website was compromised</source>
    </item>
    <item>
      <title><![CDATA[Human error is blamed in WellCare Health Plans breach]]></title>
      <link>http://securityratty.com/article/cbc5414d6865f7f4f33a04c97a433326</link>
      <guid>http://securityratty.com/article/cbc5414d6865f7f4f33a04c97a433326</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/7/08

Organization
WellCare of Georgia, Inc

WellCare Health Plans, Inc. provides managed care services exclusively for government-sponsored healthcare...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wellcare.jpg" align="right" height="54" width="161"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/7/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.wellcare.com/">WellCare of Georgia, Inc.</a>* <br><br><font size="1">*WellCare Health Plans, Inc. provides managed care services exclusively for government-sponsored healthcare programs, focusing on Medicaid and Medicare. Headquartered in Tampa, Florida, WellCare offers a variety of health plans for families, children, the aged, blind and disabled and prescription drug plans, currently serving more than 2.3 million members nationwide. </font><br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Members of "Georgia Families"<br><br><span style="font-weight: bold;">Number Affected:</span><br>up to 71,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"name, birth date, dates of eligibility, Medicaid or PeachCare for Kids member identification number, social security number or other health plan related information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"ATLANTA, GA (April 7, 2008) — WellCare of Georgia, Inc. today announced that a human error made some Georgia Families member data available on the Internet. On March 28th, WellCare secured the data on its own computer systems and by April 2nd, all WellCare member information had been removed from the Internet. "<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wellcare.com/WCAssets/corporate/assets/Georgia_press_release_040708_final.pdf">WellCare announcement</a> <br><a href="http://triangle.bizjournals.com/triangle/othercities/tampabay/stories/2008/04/07/daily18.html">Triangel Business Journal</a> <br><a href="http://www.ajc.com/metro/content/metro/stories/2008/04/08/breach_0409.html">The Atlanta Journal-Constitution</a> <br><a href="http://www2.tbo.com/content/2008/apr/09/bz-georgia-wellcare-data-exposed/">The Tampa Tribune</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>WellCare Health Plans<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Private records of up to 71,000 Georgia families who are members of health insurance programs for the poor or working poor were accidentally made available on the Internet for several days, and some of the data may have been viewed by unauthorized people, Tampa-based WellCare Health Plans Inc. said today.<br><br>“We were able to determine what data was available on the Internet,” explained Anil Kottoor, WellCare’s chief information officer, “and we are notifying anyone who might have been affected.”<br><br>a human error allowed the information to be accessible for an unknown period of time, but that the secret data was removed from the Internet on April 2. It was not immediately known when the data breach occurred or how long the secret data was available.<br><br>The state of Georgia said it was notified March 31.<br><br>WellCare believes that this affected only our Georgia Families membership in Georgia, and not our Medicare coordinated care, private fee-for-service or prescription drug plan membership. <br><br>The files exposed did not contain credit card, debit card or financial account numbers. <br><br>They may have contained personal identifying information, such as a member’s name, birth date, dates of eligibility, Medicaid or PeachCare for KidsTM member identification number, social security number or other health plan related information. <br><br>about 10,500 members' Social Security numbers may have been viewed by unauthorized people on the Internet, all members of Medicaid or PeachCare.<br><br>"There is a possibility that an initial 59,000 members may have had some personal information made accessible, so we are notifying them as well, just to be safe," Knapp said. (spokeswoman Amy Knapp)<br><br>At this time, WellCare is not aware of any misuse of its member information due to the accidental exposure of the file on the Internet.<br><br>A Web developer prepared a copy of a DCH report folder that was "to be deployed to our Georgia Web portal" but instead made it accessible on the Internet. <br><span style="font-style: italic;">[Evan] Ugh.&nbsp; I can state from a lot of first-hand experience that developers can either be your information security best friend or your information security worst enemy.&nbsp; Developers that put functionality and usability first without taking information security into account along the way can be dangerous.&nbsp; Effective information security governance and information security training and awareness can help significantly.&nbsp; Having said all of that, people are people and we all make mistakes.&nbsp; I wonder if there is room for significant process improvement here though.</span><br><br>She said at least 53 folders of names were accessed 248 times.<br><span style="font-style: italic;">[Evan] This means that the folders and files did not go completely unnoticed.</span><br><br>WellCare is now notifying in writing the members who could have been affected by this incident. Members should receive those letters by the middle of this week. <br><br>WellCare is offering to pay for one year of credit monitoring for those individuals.<br><span style="font-style: italic;">[Evan] Every time I see this offering in a breach notification if feel like this is really short-sighted.&nbsp; Better than nothing I guess, but people need to recognize it for what it is.</span><br><br>“We regret that this incident occurred,” said Mike Cotton, president of WellCare’s Georgia region. “WellCare takes the privacy and security of personal information very seriously. It is an honor to serve our members in Georgia, and we apologize for any inconvenience this issue has caused.” <br><br>To ensure its data security for the future, WellCare has retained a national information technology firm to perform a full assessment of its security and privacy controls.<br><span style="font-style: italic;">[Evan] I wonder who.&nbsp; A "national information technology firm" means very little to me.&nbsp; The "national information technology firm" may do a good job for helping improve "information technology", but who is going to handle "information security"?&nbsp; Information security is NOT an information technology issue.&nbsp; It's bigger than that. </span><br><br><span style="font-weight: bold;">Commentary:</span><br>This breach is being chalked-up as human error, but I think there are many times when "human error" could have been avoided by effective processes and controls.&nbsp; I appreciate WellCare's candid explanation and attempt to make things better. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/09/wellcare.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 09 Apr 2008 08:39:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/wellcare">wellcare</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/wellcare health plans">wellcare health plans</category>
      <category domain="http://securityratty.com/tag/health plans">health plans</category>
      <category domain="http://securityratty.com/tag/information technology issue">information technology issue</category>
      <category domain="http://securityratty.com/tag/georgia families">georgia families</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <source url="http://breachblog.com/2008/04/09/wellcare.aspx">Human error is blamed in WellCare Health Plans breach</source>
    </item>
    <item>
      <title><![CDATA[Playing With Homemade Explosives]]></title>
      <link>http://securityratty.com/article/52ea73fc52265ad93aa2b7797d47f9be</link>
      <guid>http://securityratty.com/article/52ea73fc52265ad93aa2b7797d47f9be</guid>
      <description><![CDATA[After reading Bruce Schneier s interview with TSA Administrator Kip Hawley I started thinking of all the explosives used in recent terrorist plots and how silly they were. As a kid, I loved going into...]]></description>
      <content:encoded><![CDATA[<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>After reading </FONT><A href="http://www.schneier.com/interview-hawley.html"><FONT face=Calibri>Bruce Schneier &#8216;s interview with TSA Administrator Kip Hawley</FONT></A><FONT face=Calibri> I started thinking of all the explosives used in recent terrorist plots and how silly they were.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>As a kid, I loved going into the woods and playing with all sorts of dangerous stuff which of course included fireworks, gas cans, hair spray, propane tanks, etc.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>What I learned was that it&#8217;s a lot harder to get things to explode than you think.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>If any of these terrorist had a background in chemistry or even played with anything dangerous as a kid, they would have realized how silly they were as well.</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>I plan on posting about explosives and how they were used in the terrorist attacks tomorrow, but in the mean time, I thought it would be fun to share some of the lessons I learned as a child through trial and error.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>First off, a word of warning:<SPAN style="mso-spacerun: yes">&nbsp; </SPAN><SPAN style="mso-spacerun: yes">&nbsp;</SPAN></FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><B style="mso-bidi-font-weight: normal"><FONT face=Calibri>Do not try any of this at home.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>The experiments were done by an idiot.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>None of it is legal.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>I&#8217;m lucky to have my fingers and some of the hair I lost never grew back.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>Scar tissue isn&#8217;t as strong as regular tissue.<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p></FONT></B></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>I remember one of the first little experiments I did as a kid involved the lawn mower&#8217;s gas can.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>Several attempts to use gasoline to replicate those awe inspiring car explosions from action movies failed time and time again.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>The only result I could get was a simple fire that often proved difficult to put out.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN></FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>It&#8217;s kind of funny the safety controls I employed at age 12.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>My love of danger was superseded by my desire to live and stay out of trouble.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>For example, one of the first things I learned was remote detonation systems.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>The first one I employed was a catapult, built from popsicle sticks, a metal spoon, and rubber bands which could launch a cotton ball soaked in alcohol 20 ft.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>The catapult itself could even be operated remotely by using a piece of dental floss to release the firing pin.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>The way I figured it, I could open a flame a safe distance from my explosive, run to my makeshift bomb shelter (a foxhole), launch the catapult, and wait for the explosion.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>My ignition systems advanced over the years to electrical (steel wool, 9V batteries, and phone cord), 12 gauge shotgun shells minus the lead shot, and tracer rounds (regular bullets do nothing, you need an incendiary round).<SPAN style="mso-spacerun: yes">&nbsp; </SPAN></FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>My experiments always started with small trial runs. The simple process I employed had numerous benefits, such as teaching me how to construct proper firebreaks, that gravel roads don&#8217;t burn but they do throw significant amounts of shrapnel, and why the military loves foxholes.</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>The first time I got an explosion occurred by accident.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>I was very disappointed after another failed experiment.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>As I sat there next to an empty gas can waiting for a fire to go out, I was playing with strike anywhere matches on the empty gas can when to my surprise it exploded and launched itself to the other side of the field.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>I lost all the hair on my knuckles and had now had a mystery to solve.</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>I can&#8217;t imagine what my dad must have thought when I started asking all these questions, but he explained to me how a combustion engine works.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>Either a carburetor or fuel injection systems mix gasoline with oxygen to form a gas which is ignited by a spark plug at specific intervals to propel a car.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>He also explained that if a car&#8217;s gas tank could explode then it would not be safe to drive.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>Without being properly mixed with an oxidant, gasoline does not detonate, but rather it deflagrates, or burns.</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>Experimenting with a car battery charger, a glass beaker, some balloons, and water was also a source of immense fun.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>At the time, I hadn&#8217;t taken any chemistry classes and thought I was collecting pure hydrogen in my balloons.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>In my mind, I was making mini-Hindenburg&#8217;s.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>I would take them out to my fort and blow them up.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>Those made some nice explosions.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>It wasn&#8217;t until a later experiment that I learned I was collecting oxygen in addition to hydrogen through electrolysis.</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>That later experiment occurred when I discovered dad&#8217;s acetylene tanks (he&#8217;s a jeweler and has a torch for soldering). At first I was disappointed.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>Balloons filled with only acetylene barely did anything.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>But then I found that if I mixed in some pure oxygen from the other tank in a 2:1 ratio of oxygen to acetylene, you could produce an explosion with a shock wave that could be felt from 50 ft. away.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>It literally sounded like a stick of TNT.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN></FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>Over the years I grew more and more brave.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>I don&#8217;t know what my poor parents must have thought.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>At age 15, I printed off an anarchist cookbook and unintentionally left before it was done printing.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>The printer was simply out of paper, and later that night when dad put some more in, out popped a page on making napalm from gasoline and styrofoam.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>They have also never asked me how the metal window screen in my room melted in one corner.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>I don&#8217;t know how I would have told them it was due to a freak accident when I was making my first accurate time delay fuse using slow burning gunpowder, cardboard strips that were coiled and soaked in wax, and a tuna can.</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>Looking back at some of the stuff I did from age 10 to 16, I would have made an excellent engineer, scientist, or lawyer.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>I built all kinds of things, always figured out how they worked, and argued my way out things that get people sent to Guantanamo :)</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><o:p><FONT face=Calibri>&nbsp;</FONT></o:p></P><img src ="http://marvets.com/blog/aggbug/4044.aspx" width = "1" height = "1" />]]></content:encoded>
      <pubDate>Tue, 07 Aug 2007 13:30:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/gas">gas</category>
      <category domain="http://securityratty.com/tag/lawn mowers gas">lawn mowers gas</category>
      <category domain="http://securityratty.com/tag/tank">tank</category>
      <category domain="http://securityratty.com/tag/cars gas tank">cars gas tank</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/time delay fuse">time delay fuse</category>
      <category domain="http://securityratty.com/tag/terrorist">terrorist</category>
      <category domain="http://securityratty.com/tag/empty gas">empty gas</category>
      <category domain="http://securityratty.com/tag/recent terrorist plots">recent terrorist plots</category>
      <source url="http://marvets.com/blog/archive/2007/08/07/4044.aspx">Playing With Homemade Explosives</source>
    </item>
  </channel>
</rss>
