<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: tells]]></title>
    <link>http://securityratty.com/tag/tells</link>
    <description></description>
    <pubDate>Thu, 11 Sep 2008 09:59:42 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Expert to Obama: Take the Lead on Nuke Cuts]]></title>
      <link>http://securityratty.com/article/963ad83c8256d751a5fd9689b05a082d</link>
      <guid>http://securityratty.com/article/963ad83c8256d751a5fd9689b05a082d</guid>
      <description><![CDATA[Danger Room's series on national security threats facing the new administration kicks off with nuclear proliferation authority Joseph Cirincione. He tells the Obama crowd to lead by example on atomic...]]></description>
      <content:encoded><![CDATA[Danger Room's series on national security threats facing the new administration kicks off with nuclear proliferation authority Joseph Cirincione. He tells the Obama crowd to lead by example on atomic weapons, by cutting American's H-bomb stockpile.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=a801247ff695766ed91cefffd658a5e2" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=a801247ff695766ed91cefffd658a5e2" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=W1KzN"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=W1KzN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=nggfn"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=nggfn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=asvOn"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=asvOn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=6bXyN"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=6bXyN" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=2GddN"><img src="http://feeds.wired.com/~f/wired/politics/security?i=2GddN" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=zeGyn"><img src="http://feeds.wired.com/~f/wired/politics/security?i=zeGyn" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=w4lHn"><img src="http://feeds.wired.com/~f/wired/politics/security?i=w4lHn" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=I15BN"><img src="http://feeds.wired.com/~f/wired/politics/security?i=I15BN" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/453214441" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/453214443" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 14 Nov 2008 02:40:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/national security threats">national security threats</category>
      <category domain="http://securityratty.com/tag/obama crowd">obama crowd</category>
      <category domain="http://securityratty.com/tag/lead">lead</category>
      <category domain="http://securityratty.com/tag/atomic weapons">atomic weapons</category>
      <category domain="http://securityratty.com/tag/administration kicks">administration kicks</category>
      <category domain="http://securityratty.com/tag/h-bomb stockpile">h-bomb stockpile</category>
      <category domain="http://securityratty.com/tag/danger">danger</category>
      <category domain="http://securityratty.com/tag/series">series</category>
      <category domain="http://securityratty.com/tag/tells">tells</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/453214443/wars-in-iraq-an.html">Expert to Obama: Take the Lead on Nuke Cuts</source>
    </item>
    <item>
      <title><![CDATA[When Markets Collide]]></title>
      <link>http://securityratty.com/article/b33dd419bf17d2010a5e8c1da7814637</link>
      <guid>http://securityratty.com/article/b33dd419bf17d2010a5e8c1da7814637</guid>
      <description><![CDATA[One of my favorite Motley Fool analysts is Bill Mann, yesterday he wrote an article on China that re-set a number of the investing thesis themes in the current global situation


Things are so bad in...]]></description>
      <content:encoded><![CDATA[<p><span style="font-size: 13px; ">One of my favorite Motley Fool analysts is Bill Mann, yesterday he wrote an </span><a href="http://www.fool.com/investing/international/2008/11/07/why-i-believe-in-the-chinese-miracle.aspx"><span style="font-size: 13px; ">article</span></a><span style="font-size: 13px; "> on China that re-set a number of the investing thesis themes in the current global situation:</span></p><div><span style="font-size: 13px; "><br /></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #222222; font-size: 14px; line-height: 20px; "><span style="color: #222222; line-height: 20px; font-size: 13px; ">Things are so bad in China that its gross domestic product growth rate may fall from double digits to the dowdy level of 8%. Eight percent, by the way, is a level at which the United States is unlikely&#0160;</span><em style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 100%; font-weight: inherit; font-style: italic; "><span style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-weight: inherit; font-style: italic; font-size: 13px; ">to ever grow again</span></em><span style="color: #222222; line-height: 20px; font-size: 13px; ">. It can&#39;t. Our economy is simply fully developed. Thus the sobriquet &quot;developed economy.&quot; I know, not exactly catchy.</span></span><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 40px; border-top-style: none; border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 13px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #222222; line-height: 20px; font-size: 13px; ">..</span></p></blockquote><p><span style="font-size: 13px; "><br /></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #222222; font-size: 14px; line-height: 20px; "><span style="font-size: 11px; line-height: 10px; "><p style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-left: 0px; font-style: inherit; font-weight: inherit; font-size: 1.3em; margin-top: 10px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; line-height: 20px; padding-bottom: 5px; "><span style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-left: 0px; font-style: inherit; font-weight: inherit; margin-top: 10px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; line-height: 20px; padding-bottom: 5px; font-size: 13px; ">All of the headlines show China sitting at a crossroads. But the reason I have faith in China is that it has historical proxies. Since 1970, with the exception of a few OPEC members, only four economies have made the transition from emerging to developed markets (meaning their per-capita incomes exceed $15,000 per year): Taiwan, Singapore, Hong Kong, and South Korea.</span></p><p style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-left: 0px; font-style: inherit; font-weight: inherit; font-size: 1.3em; margin-top: 10px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; line-height: 20px; padding-bottom: 5px; "><span style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-left: 0px; font-style: inherit; font-weight: inherit; margin-top: 10px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; line-height: 20px; padding-bottom: 5px; font-size: 13px; ">These four economies have two things in common. First, they have few natural resources; and second, they are dominated by Chinese values and the traditional Chinese work ethic. Mainland China is different only because it got a later start.</span></p></span></span></p></blockquote><p><span style="color: #222222; line-height: 20px; font-size: 13px; "><br /></span></p><div><span style="color: #222222; line-height: 20px; font-size: 13px; ">Also, China reportedly has currency reserves $1.6 trillion. That means that China has a better balance sheet than the US, plus 1.6 trillion beats minus 12 trillion if you are scoring at home.</span></div><div><span style="color: #222222; line-height: 20px; font-size: 13px; "><br /></span></div><div><span style="color: #222222; line-height: 20px; font-size: 13px; ">Given that the Chinese stock market is down 70% in the last year, its an interesting time to look at Chinese stocks. A few weeks back Mohamed El-Erian made the bull case for buying the MCSI Emerging Markets index which gives you exposure to the BRICs plus a lot of other countries.</span></div><div><span style="color: #222222; line-height: 20px; font-size: 13px; "><br /></span></div><div><span style="color: #222222; line-height: 20px; font-size: 13px; ">Speaking of El-Erian, his book &quot;When Markets Collide&quot; was just </span><a href="http://business.timesonline.co.uk/tol/business/economics/article4968973.ece"><span style="font-size: 13px; ">voted Best Business Book of the Year</span></a><span style="color: #222222; line-height: 20px; font-size: 13px; ">. If we could have voted for a book that we wished everyone had read in 2007 he would have won that too, he said&#0160;</span></div><div><span style="color: #222222; line-height: 20px; font-size: 13px; "><br /></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="line-height: 16px; font-size: 13px; ">“When I wrote the book, I thought I was writing about the future. When it was going to press, I thought it was about current affairs. Now I wish it was about history.”</span><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 40px; border-top-style: none; border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 13px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="line-height: 16px; font-size: 13px; "><br /></span></p></blockquote><p><span style="line-height: 16px; font-size: 13px; ">This part below reminds me a lot of 1995 security architectures used to defend 2008 integrated applications</span></p><div><span style="line-height: 16px; font-size: 13px; "><br /></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 40px; border-top-style: none; border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 13px; ">The present crisis had been triggered because the international financial system had undertaken activities that had “far outpaced the ability of the infrastructure to sustain them”, said El-Erian.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 40px; border-top-style: none; border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 13px; "><br />And it was not just the markets that could not cope with their own changes, but governments as well. Significant weaknesses had been exposed “from the firms, to the regulatory agencies, to governments, to multilateral oversight”.<br /><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 40px; border-top-style: none; border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 13px; ">“Turbocharge that with financial innovations, which history tells us we tend to overproduce and overconsume, and it’s inevitable that you will get a series of market accidents,” he said.<br /></span></p></blockquote><p><span style="font-size: 13px; "><br /></span></p><div><span style="font-size: 13px; ">In a Robert Garigue sense, in computer security our infostructure (users, apps and data) &#0160;are outpacing our infrastructure-centric security models</span></div><div><span style="font-size: 12px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="font-family: Arial;"><br /></span></div>]]></content:encoded>
      <pubDate>Sat, 08 Nov 2008 08:29:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/markets">markets</category>
      <category domain="http://securityratty.com/tag/china">china</category>
      <category domain="http://securityratty.com/tag/china reportedly">china reportedly</category>
      <category domain="http://securityratty.com/tag/markets collide">markets collide</category>
      <category domain="http://securityratty.com/tag/mainland china">mainland china</category>
      <category domain="http://securityratty.com/tag/markets index">markets index</category>
      <category domain="http://securityratty.com/tag/business book">business book</category>
      <category domain="http://securityratty.com/tag/trillion beats minus">trillion beats minus</category>
      <category domain="http://securityratty.com/tag/trillion">trillion</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/when-markets-collide.html">When Markets Collide</source>
    </item>
    <item>
      <title><![CDATA[Movie-Plot Threat: Terrorists Using Twitter]]></title>
      <link>http://securityratty.com/article/31ccaa1220f62cfe9008fd043b4179f8</link>
      <guid>http://securityratty.com/article/31ccaa1220f62cfe9008fd043b4179f8</guid>
      <description><![CDATA[No , really . ( Commentary here
This is just ridiculous. Of course the bad guys will use all the communications tools available to the rest of us. They have to communicate, after all. They'll also use...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.computerweekly.com/Articles/2008/10/28/232944/terrorists-could-use-twitter-for-attacks-says-us-intelligence.htm">No<a/>, <a href="http://www.fas.org/irp/eprint/mobile.pdf"> really</a>.  (<a href="http://www.fas.org/blog/secrecy/2008/10/twitter.html">Commentary</a> <a href="http://blog.wired.com/defense/2008/10/terrorist-cell.html">here</a>.)</p>

<p>This is just ridiculous.  Of course the bad guys will use all the communications tools available to the rest of us. They have to communicate, after all.  They'll also use cars, water faucets, and all-you-can-eat buffet lunches.  So what?</p>

<p>This commentary is dead on:</p>

<blockquote>Steven Aftergood, a veteran intelligence analyst at the Federation of the American Scientists, doesn't dismiss the Army presentation out of hand. But nor does he think it's tackling a terribly seriously threat. "Red-teaming exercises to anticipate adversary operations are fundamental. But they need to be informed by a sense of what's realistic and important and what's not," he tells Danger Room. "If we have time to worry about 'Twitter threats' then we're in good shape. I mean, it's important to keep some sense of proportion."</blockquote><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=XrBFM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=XrBFM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=If9PM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=If9PM" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 30 Oct 2008 04:51:13 +0000</pubDate>
      <category domain="http://securityratty.com/tag/veteran intelligence analyst">veteran intelligence analyst</category>
      <category domain="http://securityratty.com/tag/all-you-can-eat buffet lunches">all-you-can-eat buffet lunches</category>
      <category domain="http://securityratty.com/tag/bad guys">bad guys</category>
      <category domain="http://securityratty.com/tag/tells danger">tells danger</category>
      <category domain="http://securityratty.com/tag/commentary">commentary</category>
      <category domain="http://securityratty.com/tag/army presentation">army presentation</category>
      <category domain="http://securityratty.com/tag/adversary operations">adversary operations</category>
      <category domain="http://securityratty.com/tag/twitter threats">twitter threats</category>
      <category domain="http://securityratty.com/tag/water faucets">water faucets</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/movie-plot_thre_1.html">Movie-Plot Threat: Terrorists Using Twitter</source>
    </item>
    <item>
      <title><![CDATA[Do you have poorly trained security guards working for you? If you do, al-Qa'ida may be watching]]></title>
      <link>http://securityratty.com/article/d3bb73a510242a5cb3d3116bdd9cd56c</link>
      <guid>http://securityratty.com/article/d3bb73a510242a5cb3d3116bdd9cd56c</guid>
      <description><![CDATA[It seems strange that the Department of Homeland Security would be mentioning a recording by deceased al-Qa'ida operative Yousef Al-Ayeeri made before his death in 2003

Eventhough DHS said there was...]]></description>
      <content:encoded><![CDATA[It seems strange that the Department of Homeland Security would be mentioning a <a href="http://deepbackground.msnbc.msn.com/archive/2008/10/06/1501940.aspx">recording by deceased al-Qa'ida operative Yousef Al-Ayeeri </a>made before his death in 2003.  <br /><span id="fullpost"><br />Eventhough DHS said there was no credible or specific information, they still deemed it necessary to release the note because it is "important for local authorities, building owners and operators to be aware of potential attack tactics". <br /></span><br />Apparently, Al-Ayeeri made the recording to encourage other al-Qa'ida operatives to take over a publicly accessible building(s) in the U.S. and destroy it by using a series of strategically placed explosives.<br /><br />What makes the plan especially interesting to a security consultant is the way Al-Ayeeri describes the ease with which operatives would be able to take over public buildings.  His recording advises that it will be quite easy due to "poorly trained and lightly armed or unarmed security guards".<br /><br />What does this tell us?  It tells us that terrorists are carrying out surveillance right under our noses and taking notes when they observe a breach of security or "poorly trained security".<br /><br />Hopefully none of you reading this have "poorly trained security" working for you.  If you did, how would you know?  Perhaps it is time to have a security review and or/survey of your premises conducted.  <br /><br />They say "dead men can't talk", but it nearly seems like this one is sending out a warning.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sun, 19 Oct 2008 15:37:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security consultant">security consultant</category>
      <category domain="http://securityratty.com/tag/security guards">security guards</category>
      <category domain="http://securityratty.com/tag/security review">security review</category>
      <category domain="http://securityratty.com/tag/homeland security">homeland security</category>
      <category domain="http://securityratty.com/tag/poorly">poorly</category>
      <category domain="http://securityratty.com/tag/al-qa">al-qa</category>
      <category domain="http://securityratty.com/tag/al-ayeeri">al-ayeeri</category>
      <category domain="http://securityratty.com/tag/potential attack tactics">potential attack tactics</category>
      <source url="http://www.thebulletproofblog.com/2008/10/do-you-have-poorly-trained-security.html">Do you have poorly trained security guards working for you? If you do, al-Qa'ida may be watching</source>
    </item>
    <item>
      <title><![CDATA[Mark Curphey On Builders and Breakers]]></title>
      <link>http://securityratty.com/article/207400daa5782f9a7cfce814ad45404e</link>
      <guid>http://securityratty.com/article/207400daa5782f9a7cfce814ad45404e</guid>
      <description><![CDATA[Superb post by Mark on what I think is the biggest problem we have in security. One thing you learn in consulting is that no matter what anyone tells you when you start a project about what problem...]]></description>
      <content:encoded><![CDATA[<p>Superb <a href="http://securitybuddha.com/2008/09/10/are-you-a-builder-or-a-breaker/">post</a> by Mark on what I think is the biggest problem we have in security. One thing you learn in consulting is that no matter what anyone tells you when you start a project about what problem you are trying to solve, it is <span style="font-style: italic;">always</span> a people problem. The single biggest problem in security is too many breakers not enough builders. Please understand I am not saying that breakers are not useful, we need them, and we need them to continue to get better so we can build more resilient systems. But the industry is about 90% breaking and 10% building and thats plain bad.</p><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Georgia; line-height: 19px; ">It’s still predominantly made up of an army of skilled hackers focused on better ways to break systems apart and find new ways to exploit vulnerabilities than “security architects” who are designing secure components, protocols and ultimately secure systems. If you don’t believe me go have a conversation with a&#160; so called application security&#160; consultant about SAML or security issues in Enterprise Message Buses and you’ll almost definitely draw blank stares. Ask application security consultants if they know about the latest HTTP or HTML spec and they’ll likely say yes (and want to demonstrate the latest issues) but if you ask them about the latest WS-x spec you’ll likely draw more blank stares.&#160; When was the last time you saw an attack drawn out as a UML sequence diagram? This is worrying and somewhat sad. I don’t think we are culturing, encouraging and nurturing people with the right skills to make a positive difference.&#160;</span></p></blockquote><br /><div>This is exactly my experience as well. Not only that, we have too much destruction and not enough construction, this is a big enough problem all by itself. I would go one step further and say we need creative destruction, breakers breaking things that lead to better systems over time. Maybe we need an OWASP Builders project?</div><br /><div>In any case, for my small part I am builder. I teach a <a href="http://arctecgroup.net/training.htm">class</a> (and will at <a href="http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference">OWASP</a>) that is 100% focused on building secure Web services, identity management, distribut authN, authZ, message security and so on. I can tell you first hand there are not a lot of people approaching the problem from a builder mindset.&#160;</div>]]></content:encoded>
      <pubDate>Fri, 19 Sep 2008 08:02:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/issues">issues</category>
      <category domain="http://securityratty.com/tag/security issues">security issues</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/application security consultants">application security consultants</category>
      <category domain="http://securityratty.com/tag/message security">message security</category>
      <category domain="http://securityratty.com/tag/builders">builders</category>
      <category domain="http://securityratty.com/tag/systems">systems</category>
      <category domain="http://securityratty.com/tag/security architects">security architects</category>
      <category domain="http://securityratty.com/tag/resilient systems">resilient systems</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/mark-curphey-on-builders-and-breakers.html">Mark Curphey On Builders and Breakers</source>
    </item>
    <item>
      <title><![CDATA[The Pentagon's World of Warcraft Movie-Plot Threat]]></title>
      <link>http://securityratty.com/article/b60783b0204251f583fde52e625be0be</link>
      <guid>http://securityratty.com/article/b60783b0204251f583fde52e625be0be</guid>
      <description><![CDATA[In a presentation that rivals any of my movie-plot threat contest entries, a Pentagon researcher is worried that terrorists might plot using World of Warcraft: In a presentation late last week at the...]]></description>
      <content:encoded><![CDATA[<p>In a presentation that rivals any of my movie-plot threat contest entries, a Pentagon researcher is worried that <a href="http://machinist.salon.com/blog/2008/09/16/warcraft/">terrorists might plot</a> using World of Warcraft:</p>

<blockquote>In a presentation late last week at the Director of National Intelligence Open Source Conference in Washington, Dr. Dwight Toavs, a professor at the Pentagon-funded National Defense University, gave a bit of a primer on virtual worlds to an audience largely ignorant about what happens in these online spaces. Then he launched into a scenario, to demonstrate how a meatspace plot might be hidden by in-game chatter.

<blockquote>In it, two World of Warcraft players discuss a raid on the "White Keep" inside the "Stonetalon Mountains." The major objective is to set off a "Dragon Fire spell" inside, and make off with "110 Gold and 234 Silver" in treasure. "No one will dance there for a hundred years after this spell is cast," one player, "war_monger," crows.</blockquote>

<p>Except, in this case, the White Keep is at 1600 Pennsylvania Avenue. "Dragon Fire" is an unconventional weapon. And "110 Gold and 234 Silver" tells the plotters how to align the game's map with one of Washington, D.C.</blockquote></p>

<p>I don't know why he thinks that the terrorists will use World of Warcraft and not some other online world.  Or Facebook.  Or Usenet.  Or a chat room.  Or e-mail.  Or the telephone.  I don't even know why the particular form of communication is in any way important.</p>

<p>The article ends with this nice paragraph:</p>

<blockquote>Steven Aftergood, the Federation of the American Scientists analyst who's been following the intelligence community for years, wonders how realistic these sorts of scenarios are, really. "This concern is out there. But it has to be viewed in context. It's the job of intelligence agencies to anticipate threats and counter them. With that orientation, they're always going to give more weight to a particular scenario than an objective analysis would allow," he tells Danger Room. "Could terrorists use Second Life? Sure, they can use anything. But is it a significant augmentation? That's not obvious. It's a scenario that an intelligence officer is duty-bound to consider. That's all."</blockquote>

<p>My guess is <a href="http://www.schneier.com/blog/archives/2008/03/searching_for_t.html">still</a> that some clever Pentagon researchers have figured out how to play World of Warcraft on the job, and they're not giving that perk up anytime soon.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=t3Y6L"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=t3Y6L" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=zsKzL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=zsKzL" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 09:29:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/world">world</category>
      <category domain="http://securityratty.com/tag/warcraft">warcraft</category>
      <category domain="http://securityratty.com/tag/plot">plot</category>
      <category domain="http://securityratty.com/tag/play world">play world</category>
      <category domain="http://securityratty.com/tag/warcraft players discuss">warcraft players discuss</category>
      <category domain="http://securityratty.com/tag/movie-plot threat">movie-plot threat</category>
      <category domain="http://securityratty.com/tag/online world">online world</category>
      <category domain="http://securityratty.com/tag/meatspace plot">meatspace plot</category>
      <category domain="http://securityratty.com/tag/dragon fire">dragon fire</category>
      <source url="http://www.schneier.com/blog/archives/2008/09/the_pentagons_w.html">The Pentagon's World of Warcraft Movie-Plot Threat</source>
    </item>
    <item>
      <title><![CDATA[The NSA Teams Up with the Chinese Government to Limit Internet Anonymity]]></title>
      <link>http://securityratty.com/article/503f5010550f387cf3db2d9c00072cbb</link>
      <guid>http://securityratty.com/article/503f5010550f387cf3db2d9c00072cbb</guid>
      <description><![CDATA[Definitely strange bedfellows : A United Nations agency is quietly drafting technical standards, proposed by the Chinese government, to define methods of tracing the original source of Internet...]]></description>
      <content:encoded><![CDATA[<p>Definitely <a href="http://news.cnet.com/8301-13578_3-10040152-38.html">strange bedfellows</a>:</p>

<blockquote>A United Nations agency is quietly drafting technical standards, proposed by the Chinese government, to define methods of tracing the original source of Internet communications and potentially curbing the ability of users to remain anonymous.

<p>The U.S. National Security Agency is also participating in the "IP Traceback" drafting group, named Q6/17, which is meeting next week in Geneva to work on the traceback proposal. Members of Q6/17 have declined to release key documents, and meetings are closed to the public.</p>

<p>[...]</p>

<p>A second, <a href="http://politechbot.com/docs/itu.traceback.use.cases.requirements.091108.txt">apparently leaked ITU document</a> offers surveillance and monitoring justifications that seem well-suited to repressive regimes:</p>

<blockquote>A political opponent to a government publishes articles putting the government in an unfavorable light. The government, having a law against any opposition, tries to identify the source of the negative articles but the articles having been published via a proxy server, is unable to do so protecting the anonymity of the author.</blockquote></blockquote>

<p>This is being sold as a way to go after the bad guys, but it won't help.  Here's Steve Bellovin <a href="http://www.cs.columbia.edu/~smb/blog/2008-09/2008-09-04.html">on that issue</a>:</p>

<blockquote>First, very few attacks these days use spoofed source addresses; the real IP address already tells you where the attack is coming from. Second, in case of a DDoS attack, there are too many sources; you can't do anything with the information. Third, the machine attacking you is almost certainly someone else's hacked machine and tracking them down (and getting them to clean it up) is itself time-consuming.</blockquote>

<p>TraceBack is most useful in monitoring the activities of large masses of people.  But of course, that's why the Chinese and the NSA are so interested in this proposal in the first place.</p>

<p>It's hard to figure out what the endgame is; the U.N. doesn't have the authority to impose Internet standards on anyone.  In any case, this idea is counter to the U.N. Universal Declaration of Human Rights, Article 19:  "Everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers."   In the U.S., it's counter to the First Amendment, which has long permitted anonymous speech.  On the other hand, basic human and constitutional rights have been jettisoned left and right in the years after 9/11; why should this be any different?</p>

<p>But when the Chinese government and the NSA get together to enhance their ability to spy on the world, you have to wonder what's gone wrong with the world.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=ROw6L"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=ROw6L" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=dQUlL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=dQUlL" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 02:34:11 +0000</pubDate>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/chinese government">chinese government</category>
      <category domain="http://securityratty.com/tag/chinese">chinese</category>
      <category domain="http://securityratty.com/tag/articles">articles</category>
      <category domain="http://securityratty.com/tag/negative articles">negative articles</category>
      <category domain="http://securityratty.com/tag/government publishes articles">government publishes articles</category>
      <category domain="http://securityratty.com/tag/source">source</category>
      <category domain="http://securityratty.com/tag/proposal">proposal</category>
      <category domain="http://securityratty.com/tag/original source">original source</category>
      <source url="http://www.schneier.com/blog/archives/2008/09/the_nsa_teams_u.html">The NSA Teams Up with the Chinese Government to Limit Internet Anonymity</source>
    </item>
    <item>
      <title><![CDATA[This American Life on Scamming the Scammers]]></title>
      <link>http://securityratty.com/article/a0f43444bc9afa0cd221b17cea1a78e0</link>
      <guid>http://securityratty.com/article/a0f43444bc9afa0cd221b17cea1a78e0</guid>
      <description><![CDATA[A recent episode of This American Life featured a couple of Nigerian scammers who were being scammed by three other guys. Does it serve them right or is it just dangerous? Either way, its good once in...]]></description>
      <content:encoded><![CDATA[<p>A recent episode of &#8220;This American Life&#8221; featured a couple of Nigerian scammers &#8212; who were being scammed by three other guys. Does it serve them right or is it just dangerous? Either way, it&#8217;s good once in a while to see a case where the scammers get scammed back, instead of unwitting consumers.</p>
<p>From the <a rel="nofollow" target="_blank" href="http://consumerist.com/5050068/listen-to-these-vigilantes-scam-nigerian-419-scammers">Consumerist</a>:</p>
<blockquote><p>Last week, &#8220;This American Life&#8221; featured a 30-minute piece on people who scam the scammers—in this case, three guys who prey upon small-time Nigerian con men and <a rel="nofollow" target="_blank" href="http://www.thisamericanlife.org/Radio_Episode.aspx?episode=363">try to trick them into placing themselves in mortal danger</a>. &#8220;This American Life&#8221; tells how they almost got a guy to enter a Western Union office in Chad carrying an anti-Muslim/pro-Bush note that announces his intention to rob the place. Whether you think these stunts are funny probably depends on your level of empathy even for criminals, and whether you think the avengers ever fully succeed. But c&#8217;mon, getting someone in another country to <a rel="nofollow" target="_blank" href="http://forum.419eater.com/forum/viewtopic.php?t=133890">hold up a sign that&#8217;s offensive in your language</a> is pretty much <em>always</em> funny</p></blockquote>
<p>Listen to the episode over at<a rel="nofollow" target="_blank" href="http://www.thisamericanlife.org/Radio_Episode.aspx?episode=363"> this American Life.</a></p>]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 10:58:49 +0000</pubDate>
      <category domain="http://securityratty.com/tag/american life">american life</category>
      <category domain="http://securityratty.com/tag/american life tells">american life tells</category>
      <category domain="http://securityratty.com/tag/scammers">scammers</category>
      <category domain="http://securityratty.com/tag/episode">episode</category>
      <category domain="http://securityratty.com/tag/recent episode">recent episode</category>
      <category domain="http://securityratty.com/tag/small-time nigerian con">small-time nigerian con</category>
      <category domain="http://securityratty.com/tag/nigerian scammers">nigerian scammers</category>
      <category domain="http://securityratty.com/tag/western union office">western union office</category>
      <category domain="http://securityratty.com/tag/mortal danger">mortal danger</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/395620772/">This American Life on Scamming the Scammers</source>
    </item>
    <item>
      <title><![CDATA[Meraki Extends SF, Gives Shine to Newsom]]></title>
      <link>http://securityratty.com/article/4003710b9327800771316762b40e5d4e</link>
      <guid>http://securityratty.com/article/4003710b9327800771316762b40e5d4e</guid>
      <description><![CDATA[Despite the failed effort to build city-wide Wi-Fi in San Francisco, Gavin Newsom can still borrow credit: Meraki's SF Free the Net effort, which has them paying a hunk of the cost of building a...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><a href="http://meraki.com/blog/2008/09/16/free-the-net-san-francisco-makes-great-progress/"><strong>Despite the failed effort to build city-wide Wi-Fi in San Francisco, Gavin Newsom can still borrow credit:</strong></a> Meraki's SF Free the Net effort, which has them paying a hunk of the cost of building a grassroots Wi-Fi network across swaths of the city, continues to be coattailed (with the company's full encouragement) by Mayor Newsom. </p>

<p>Today's announcement sees Meraki nicely footing the bill for extending their service into neighborhood affordable housing, municipal-speak for low-income housing that's subsidized typically through government efforts and funds. Meraki will install networks at 12 buildings in the Tenderloin, known as San Francisco's roughest neighborhood, now going on many decades with that designation.</p>

<p>Meraki claims a "presence" in 42 of 52 major neighborhoods in the city, although <a href="http://sf.meraki.com/map"><strong>their map tells a very different story</strong></a> about how usage is clustered in areas in which it would make perfect sense that usage was seen. </p>

<p>Meraki has engaged in a very interesting public project, and likes the imprimatur of San Francisco, even as they don't really need the city; the city, in contrast, needs them (or Newsom particularly) to salvage something from years of planning that blew up in their faces.</p>

<p>Anyway, SF's EarthLink network would never have been built; or, having been underway, would never have been completed.</p>

<p>Forgive my snark tone and cynicism: Meraki has put a lot of resources into building a publicly accessible network across a hunk of SF that wouldn't otherwise exist.</p>]]></content:encoded>
      <pubDate>Tue, 16 Sep 2008 10:38:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/meraki">meraki</category>
      <category domain="http://securityratty.com/tag/newsom">newsom</category>
      <category domain="http://securityratty.com/tag/meraki nicely">meraki nicely</category>
      <category domain="http://securityratty.com/tag/meraki claims">meraki claims</category>
      <category domain="http://securityratty.com/tag/city-wide wi-fi">city-wide wi-fi</category>
      <category domain="http://securityratty.com/tag/san francisco">san francisco</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/mayor newsom">mayor newsom</category>
      <category domain="http://securityratty.com/tag/gavin newsom">gavin newsom</category>
      <source url="http://wifinetnews.com/archives/008446.html">Meraki Extends SF, Gives Shine to Newsom</source>
    </item>
    <item>
      <title><![CDATA[Turning off Fire Hydrants in the Name of Terrorism]]></title>
      <link>http://securityratty.com/article/f6930719122f72be0df5cd2f10adaea5</link>
      <guid>http://securityratty.com/article/f6930719122f72be0df5cd2f10adaea5</guid>
      <description><![CDATA[This really pegs the stupid meter: He explains all the district's hydrants, including those in Alexander Ranch, have had their water turned off since just after 9/11 -- something a trade association...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.wfaa.com/sharedcontent/dws/wfaa/latestnews/stories/wfaa080827_lj_hawes.1983f2d0.html">This</a> really pegs the stupid meter:</p>

<blockquote>He explains all the district's hydrants, including those in Alexander Ranch, have had their water turned off since just after 9/11 -- something a trade association spokesman tells us is common practice for rural systems.

<p>"These hydrants need to be cut off in a way to prevent vandalism or any kind of terrorist activity, including something in the water lines," Hodges said.</p>

<p>But Hodges says fire departments know, or should have known, the water valves can be turned back on with a tool.</blockquote></p>

<p>One, fires are much more common than terrorism -- keeping fire hydrants on makes much more sense than turning them off.  Two, what sort of terrorism is possible using working fire hydrants?  Three, if the water valves can be "turned back on with a tool," how does turning them off prevent fire-hydrant-related terrorism?</p>

<p>More and more, it seems as if public officials in this country have simply gone insane.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=65IeL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=65IeL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=A1h0L"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=A1h0L" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 11 Sep 2008 09:59:42 +0000</pubDate>
      <category domain="http://securityratty.com/tag/hydrants">hydrants</category>
      <category domain="http://securityratty.com/tag/fire hydrants">fire hydrants</category>
      <category domain="http://securityratty.com/tag/water valves">water valves</category>
      <category domain="http://securityratty.com/tag/water">water</category>
      <category domain="http://securityratty.com/tag/terrorism">terrorism</category>
      <category domain="http://securityratty.com/tag/water lines">water lines</category>
      <category domain="http://securityratty.com/tag/prevent">prevent</category>
      <category domain="http://securityratty.com/tag/common">common</category>
      <category domain="http://securityratty.com/tag/prevent vandalism">prevent vandalism</category>
      <source url="http://www.schneier.com/blog/archives/2008/09/turning_off_fir.html">Turning off Fire Hydrants in the Name of Terrorism</source>
    </item>
  </channel>
</rss>
