<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: dwight]]></title>
    <link>http://securityratty.com/tag/dwight</link>
    <description></description>
    <pubDate>Sun, 10 Feb 2008 03:46:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Wee-Fi: Houston-Fi, ASCII WPA Passphrases, Green Wi-Fi]]></title>
      <link>http://securityratty.com/article/7f30d96346f66d41619e4abd9bae8e7d</link>
      <guid>http://securityratty.com/article/7f30d96346f66d41619e4abd9bae8e7d</guid>
      <description><![CDATA[Houston flips switch on free downtown Wi-Fi: Dwight Silverman of the Houston Chronicle accidentally discovers the soft launch of the network funded by EarthLink's $5m default fee. (The fee was paid...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://blogs.chron.com/techblog/archives/2008/08/it_lives_city_of_houston_turns_on_free_downto.html"><strong>Houston flips switch on free downtown Wi-Fi:</strong></a> Dwight Silverman of the Houston Chronicle accidentally discovers the soft launch of the network funded by EarthLink's $5m default fee. (The fee was paid when they missed a milestone, and the firm later walked away.) The downtown area now has a limited pilot project that's free; the real effort in Houston is supposed to be at 10 housing projects and in parks where service would be used to bridge the digital divide and improve the quality of life. How, exactly, is part of what's being tested.</p>

<p><a href="http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/08/18/MNH312BTS1.DTL&hw=wi+fi&sn=004&sc=589"><strong>That's ASCII, not hex:</strong></a> An article on wardriving raises security hackles by repeating some slightly overheated statements about Wi-Fi security. The article opens with a 63-character ASCII WPA passphrase, which is later described as "hex." (ASCII passphrases in WPA can be up to 63 "printable" characters - ASCII 32 to 127 - while a hex version of a 256-bit TKIP or AES password is 64 hexadecimal digits long.) The article tries to conflate Wi-Fi attacks that led to the largest set of breaches in retail credit-card systems and wardriving, a hobbyist activity that's never been looked on very favorably by law enforcement. The sense of ennui of wardriving pioneers is pretty clear; when Wi-Fi is everywhere and generally secured, it's far less interesting. The wardriver in the article convinced the reporter that a maximum-length WPA passphrase stored on a USB drive for automatic use was the best way to go. But, really, 20 characters containing letters and punctuation and no words found in a dictionary along with changing your network's SSID (network name) provides all the security you'll ever need for a home or small business. (If you need more, deploy WPA/WPA2 Personal.)</p>

<p><a href="http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/08/16/BUA712BH1O.DTL&hw=wi+fi&sn=001&sc=1000"><strong>Green Wi-Fi's Senegal efforts hit snags:</strong></a> The folks at Green Wi-Fi are well motivated, and they're running up against all forms of security theater and bureaucracy both here and in Senegal, where they have an active project. The San Francisco Chronicle notes the group's effort to build solar-powered, self-sustaining Internet access via mesh networked nodes. Getting devices out of the country, clearing customs in Senegal, and hooking up their solar system all hit problems they're working through. As with the One Laptop Per Child program, I see a "build it and they will come" mentality in <a href="http://www.green-wifi.org/"><strong>Green Wi-Fi's mission statement</strong></a>: the notion that providing computing power and Internet access will result in good things, rather than an effort to figure out what good things need to be achieved, and whether computers and the Internet will assist. </p>]]></content:encoded>
      <pubDate>Tue, 19 Aug 2008 06:26:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi attacks">wi-fi attacks</category>
      <category domain="http://securityratty.com/tag/houston">houston</category>
      <category domain="http://securityratty.com/tag/wi-fi security">wi-fi security</category>
      <category domain="http://securityratty.com/tag/free downtown wi-fi">free downtown wi-fi</category>
      <category domain="http://securityratty.com/tag/free">free</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/ascii">ascii</category>
      <category domain="http://securityratty.com/tag/security theater">security theater</category>
      <source url="http://wifinetnews.com/archives/008423.html">Wee-Fi: Houston-Fi, ASCII WPA Passphrases, Green Wi-Fi</source>
    </item>
    <item>
      <title><![CDATA[Pocono Mountain School District "irregularities"]]></title>
      <link>http://securityratty.com/article/428a87c41a9a2ff786e39b2738b49910</link>
      <guid>http://securityratty.com/article/428a87c41a9a2ff786e39b2738b49910</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/30/08

Organization
Pocono Mountain School District

Contractor/Consultant/Branch
None

Victims
Students and parents

Number Affected
Unknown

SCHOOL...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/poconosd.jpg" align="right" height="103" width="72"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/30/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.pmsd.org/Home/tabid/36/Default.aspx">Pocono Mountain School District</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Students and parents<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown*<br><br><font size="1">*"SCHOOL DISTRICT ENROLLMENT (2007-2008) 11,500 students K-12 (Current as of Oct. 17, 2007)"</font><br><br><span style="font-weight: bold;">Types of Data:</span><br>"Student ID, network password, SSN if provided, ethnicity, gender, birthdate, grade, grade year, building no., building name, homeroom no., homeroom teacher, attendance code (if absent today), dietary allergies (for food services), bus assignment, free/reduced lunch status, home phone, primary home mailing address, secondary mailing address, parent names, parent phone numbers, emergency contact names, and emergency contact phone numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"An apparent cyber break-in of Pocono Mountain School District's computer system has put at potential risk personal information about students and parents, the district announced Friday.<br><br>District Superintendent Dwight Pfennig sent home letters on Friday afternoon telling parents about the apparent breach, which the district found out about the previous evening, according to Wendy Frable, director of public information."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.pmsd.org/Home/tabid/36/mid/1293/newsid1293/64/Letter-to-Parents-on-Computer-Security/Default.aspx">Pocono Mountain School District "Letter to Parents"</a> <br><a href="http://www.poconorecord.com/apps/pbcs.dll/article?AID=/20080601/NEWS/806010334">Pocono Record</a> <br><a href="http://www.mcall.com/news/local/all-b4_3pocono.6436000may31,0,1422227.story">The Morning Call</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Pocono Mountain School District<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A hacker apparently broke into the computers at Pocono Mountain School District and may have tapped into confidential information concerning students and their parents, the district's superintendent said Friday.<br><span style="font-style: italic;">[Evan] This statement is provided by Joe McDonald of The Morning Call.&nbsp; It is unclear if a "hacker" breached the system or if there was another cause for the "irregularities" reported at the school.</span><br><br>District Superintendent Dwight Pfennig sent home letters on Friday afternoon telling parents about the apparent breach, which the district found out about the previous evening, according to Wendy Frable, director of public information.<br><span style="font-style: italic;">[Evan] This is a quick notification.&nbsp; I think it is possible to be too quick in notifying victims, almost like The Boy Who Cried Wolf.&nbsp; It seems as though the school has not gathered the facts required to make a proper notification.&nbsp; Judge for yourself.</span><br><br>Frable said the district's technical staff had noted some irregularities during a routine security check Thursday night. "They detected some activity that seemed a little unusual," she said.<br><br>The technical staff is checking to see to what extent any personal information — and to whom it may belong — had been compromised.<br><br>The district referred the matter to Pennsylvania State Police at Swiftwater for further investigation, Frable said.<br><br>The information that may have been compromised includes the following: Student ID, network password, SSN if provided, ethnicity, gender, birthdate, grade, grade year, building no., building name, homeroom no., homeroom teacher, attendance code (if absent today), dietary allergies (for food services), bus assignment, free/reduced lunch status, home phone, primary home mailing address, secondary mailing address, parent names, parent phone numbers, emergency contact names, and emergency contact phone numbers.<br><br>"We don't know if anything was accessed," she said, adding that the district will contact anyone whose data had been found to be compromised. Frable also said that very few records include children's Social Security numbers.<br><span style="font-style: italic;">[Evan] A breach involving children's personal information is especially bothersome. </span><br><br>We have conducted an internal investigation and suggest you take the following preventative measures now to help prevent and detect any misuse of your or your child’s information.<br><br>"As a first step to protect yourself from the possibility of identity theft, we recommend you closely monitor any accounts that may contain any or some of this information," Pfennig wrote in his letter to parents.<br><br>If you see any unauthorized activity, promptly contact your service provider and or office of the Executive Director of Technology at (570) 873-7121 Ext. 10151.<br><br>"We're just trying to do what's right by everyone," Frable said. "There's no reason to panic anyone, but people should just be cautious."<br><span style="font-style: italic;">[Evan] Understandable, but some people will panic anyway.&nbsp; This is why it’s a good idea to gather facts before notification.</span><br><br>Parents got the letters when their children returned at the end of the school day, and at least one parent felt the school was being rather nonchalant. <br><br>''It sounds to me like they're trying to downplay it,'' said Ralph Ortega, who lives in Jackson Township. ''It's incredibly vague.''<br><span style="font-style: italic;">[Evan] I agree.&nbsp; I question whether this is because there aren't enough facts available yet, or whether the school is not being square with the victims.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>This breach leaves us with more questions than answers.&nbsp; People will speculate where there is a lack of clarity.&nbsp; I hope students and parents get the answers to the questions that they should demand answers too. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/02/poconosd.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 02 Jun 2008 08:36:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/district">district</category>
      <category domain="http://securityratty.com/tag/school">school</category>
      <category domain="http://securityratty.com/tag/contact">contact</category>
      <category domain="http://securityratty.com/tag/promptly contact">promptly contact</category>
      <category domain="http://securityratty.com/tag/school district enrollment">school district enrollment</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/emergency contact names">emergency contact names</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <source url="http://breachblog.com/2008/06/02/poconosd.aspx">Pocono Mountain School District "irregularities"</source>
    </item>
    <item>
      <title><![CDATA[Presbyterian Hospital admissions rep allegedly steals patient information]]></title>
      <link>http://securityratty.com/article/1472d3fd5c2c44e4a769e4ba5ada2c55</link>
      <guid>http://securityratty.com/article/1472d3fd5c2c44e4a769e4ba5ada2c55</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/12/08

Organization
Presbyterian Hospital/Weill Cornell Medical Center

Contractor/Consultant/Branch
None

Victims
Patients

Number Affected
Over...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/mcpherson.jpg" align="right" height="198" width="165"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/12/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.nyp.org/">Presbyterian Hospital/Weill Cornell Medical Center</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>Over 50,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, phone numbers and social security numbers of male patients between 58 and 78 years old"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"A former employee of the New York Presbyterian Hospital/Weill Cornell Medical College pleaded guilty on Friday to selling information from the personal records of over 50,000 patients."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://cornellsun.com/section/news/content/2008/04/14/former-med-college%E2%80%88employee-pleads-guilty-charges-identity-theft">The Cornell Daily Sun</a> <br><a href="http://m.nypost.com/ms/p/nyp/nyp/view.m?pid=23907&amp;storyid=106316">New York Post</a> <br><a href="http://www.upi.com/NewsTrack/Top_News/2008/04/12/new_york_40000_patients_records_stolen/7783/">United Press International</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>United Press International<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A former employee of the New York Presbyterian Hospital/Weill Cornell Medical College pleaded guilty on Friday to selling information from the personal records of over 50,000 patients.<br><span style="font-style: italic;">[Evan] According to this statement, he has already pleaded guilty.</span><br><br>After the hospital was made aware of the theft in January, it was confirmed in an internal investigation hospital spokeswoman Myrna Manners said.<br><br>"We obviously deeply regret that this has happened," she told the Times.<br><br>Dwight McPherson, the man arrested in connection with the crimes, was said to have been selling information since 2006, when he was approached with a request for the names, phone numbers and social security numbers of male patients between 58 and 78 years old.<br><span style="font-style: italic;">[Evan] He was approached rather than the other way around?&nbsp; This is interesting if it is true.&nbsp; It means that identity thieves (or those that trade in such information) are actively seeking out employees of organizations for sensitive personal information.&nbsp; This is an angle that I never really thought of, though in hindsight I should have.</span><br><br>McPherson's alleged scam was uncovered when postal inspectors in Atlanta executing a search warrant on an identity-theft operation there discovered 221 documents that had come from New York-Presbyterian Hospital.<br><br>Dwight McPherson, a 38-year-old patient-admissions representative from Brooklyn, admitted he began to access the files and sell information in early 2006<br><br>the information was used for identity theft<br><br>McPherson was released on Saturday under the condition that he not leave the state<br><br>McPherson was released on $500,000 bail<br><span style="font-style: italic;">[Evan] Whoa!&nbsp; Does this mean that he had to come up with $50,000 to post bail?&nbsp; I think you have to come up with 10% yourself.&nbsp; $50,000 is a lot of money for a "patient-admissions representative" to have lying around.</span><br><br>His lawyer, Bob Walters, defended his client, saying, "He is a hardworking, honest man,"<br><span style="font-style: italic;">[Evan] Uh, but he pleaded guilty to taking the easy way and committing fraud, right?</span><br><br>After looking through computer logs, they realized McPherson's user login had been used to improperly access the files of 49,841 patients.<br><br>McPherson most recently sold 1,000 records near the end of last year for about $750 and more records a bit later for $600.<br><br>Those whose identities have been stolen will receive a letter detailing what happened, and have access to a hotline with credit-monitoring services.<br><br><span style="font-weight: bold;">Commentary:</span><br>Of the 300 breaches reported thus far on <a href="http://breachblog.com">The Breach Blog</a>, this is the first one that I recall in which an outsider approached an employee for personal information.&nbsp; I have read about breaches where the employee approached and sold information to an intermediary or outsider (i.e. Fidelity/Certegy and William Sullivan), but not the other way around.&nbsp; This is interesting.<br><br>Mr. McPherson appears to have used his legitimate user account to access records in a manner for which he was not authorized.&nbsp; This activity can be difficult to detect without specialized controls.&nbsp; People that do bad things end up costing us all in the long run. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/14/mcpherson.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 14 Apr 2008 12:04:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/records">records</category>
      <category domain="http://securityratty.com/tag/access records">access records</category>
      <category domain="http://securityratty.com/tag/dwight mcpherson">dwight mcpherson</category>
      <category domain="http://securityratty.com/tag/mcpherson">mcpherson</category>
      <category domain="http://securityratty.com/tag/patients">patients</category>
      <category domain="http://securityratty.com/tag/male patients">male patients</category>
      <source url="http://breachblog.com/2008/04/14/mcpherson.aspx">Presbyterian Hospital admissions rep allegedly steals patient information</source>
    </item>
    <item>
      <title><![CDATA[Inspector General claims the Park Police are plagued by low morale]]></title>
      <link>http://securityratty.com/article/b6cd6ba61944bed9f0091834b81919fa</link>
      <guid>http://securityratty.com/article/b6cd6ba61944bed9f0091834b81919fa</guid>
      <description><![CDATA[According to a report from the Interior Department's inspector general, the U.S. Park Police may not be properly protecting the Nation's monuments. Even the Fraternal order of Police have appealed for...]]></description>
      <content:encoded><![CDATA[According to a report from the Interior Department's inspector general, the U.S. Park Police may not be properly protecting the Nation's monuments.  Even the Fraternal order of Police have appealed for management changes and describe the agency as a <a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/02/04/AR2008020402835_2.html?nav=rss_metro&sid=ST2008020803897">"mess".     </a><br /><span id="fullpost"><br />A Union survey found that only 2.2% of respondents had confidence in the Chief, Dwight E. Pettiford.  When Chief Pettiford was asked about the failure of his officers to properly protect the monuments he replied: "They're still standing".  <br /><br />Apparently, his comment referred to the monuments, not the photograph of a supposedly sleeping officer on post.     <br /><br /></span><div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sun, 10 Feb 2008 03:46:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/police">police</category>
      <category domain="http://securityratty.com/tag/park police">park police</category>
      <category domain="http://securityratty.com/tag/chief pettiford">chief pettiford</category>
      <category domain="http://securityratty.com/tag/pettiford">pettiford</category>
      <category domain="http://securityratty.com/tag/properly protect">properly protect</category>
      <category domain="http://securityratty.com/tag/monuments">monuments</category>
      <category domain="http://securityratty.com/tag/properly">properly</category>
      <category domain="http://securityratty.com/tag/chief">chief</category>
      <category domain="http://securityratty.com/tag/inspector">inspector</category>
      <source url="http://www.thebulletproofblog.com/2008/02/inspector-general-claims-park-police.html">Inspector General claims the Park Police are plagued by low morale</source>
    </item>
  </channel>
</rss>
