Friday Summary: April 23, 2010By Adrian Lane
“Don’t worry about that 5 and 1 Adjustable Rate Mortgage. 5 years from now your house will be worth twice what you paid, and you can re-finance.” It’s worth half, and you can’t get a new loan. “That’s a great interest rate!” It wasn’t, and points were padded on the back end. “Collateralzied debt obligations are a great investment – they are Triple A rated!” Terrible investment, closer to Triple B value, and a root cause of the financial collapse. “Rates have never been lower so you should refinance now!” The reappraisal that is a part of refinancing often resets the equity proportions and amortization percentage, so you can pay an extra $100k in interest, plus PMI to protect the bank. “This credit card gives you 1 air mile for every dollar you spend!” And a 31.5% interest rate, plus a fee for the privilege. Haven’t heard these? How about “Don’t use your PIN number with your Debit Card: it’s less secure”? Are you kidding me?
Signatures are pretty easy to forge, but a stolen debit card is a lot more difficult to use if you don’t have the PIN number. But this is not a little misunderstanding, like “Diet soda doesn’t make you fat.” Despite the existence of illicit card readers and hidden cameras, PINs are effective at stopping most would-be criminals from draining your bank account. Chase is actually encouraging their customers to be less secure so they can weasel a few extra bucks from the merchants. Multiply this across a few million people and we are talking serious money. And when fraud does occur, the bank is exempt from liability. Amazing!
I used to get mad when I visited foreclosed homes and saw “Lawn Service by …” signs – when there was no lawn, or new “Winterized by …” signs on home in Phoenix. In June. I thought the banks were getting ripped off. Then I learned that the banks owned a significant portion of the service companies performing these unneeded services. I guess I should not be surprised by banking shenanigans any more, but this is maddening. Take my advice … use a PIN with your debit card. Or if the banks frustrate you, just use cash.
Webcasts, Podcasts, Outside Writing, and Conferences
- Adrian’s Dark Reading post on PCI Alternatives.
- Rich on Database Security for Security Professionals.
- Rich on Security and Pen Testing.
Favorite Securosis Posts
- Mike: Whitepaper Released: Quick Wins with Data Loss Prevention. This is a great paper. Short, focused, and to the point. How can you get quick value from a DLP investment? The answer is here.
- Rich: ESF: Controls: Full Disk Encryption. It’s not just a good idea, it’s the law. Sort of. In some states. Depending on the data. Not so much the law as a safe harbor. Well, sometimes a safe harbor, depending on how the data is lost. And… forget it – just encrypt your damn hard drives.
- Adrian: Who DAT McAfee Fail?
Other Securosis Posts
- Database Security Fundamentals: Auditing Events.
- Incite 4/21/2010: Picky Picky.
- Google: An Example of Why Single Sign On Sucks.
- Level 4 Apathy.
- FireStarter: You Don’t Need Central Key Management.
- ESF: Endpoint Incident Response.
- Public Goods.
Favorite Outside Posts
- Mike: Cybersecurity and National Policy This is from two weeks ago (and I mentioned it in the Incite this week), but if you missed Dan Geer’s perspectives on the challenges facing to building the national cybersecurity policy, you really missed out. Read It Now.
- Rich: CSRF Isn’t A Big Deal – Duh! Here’s what stuns me about the CSRF article Rsnake criticizes. My hacking skills are far from 133t, but CSRF was the first thing I figured out on my own long before I ever heard the term. It’s so simple you need to be pretty brain dead to miss it. Repeat after me: if a site maintains session persistence, odds are really darn good you can hit it with a Cross Site Request Forgery, because all you need to do is fake-submit some form data.
- Adrian: Measurements Over Models.
Project Quant Posts
Research Reports and Presentations
Top News and Posts
- Get your friends to join EFF, go to Defcon!
- Porn Virus Blackmails Victims Over “Copyright Violation”.
- Network Solutions Sites Hacked Again.
- SANS: Critical Control 15: Data Loss Prevention.
- Amrit’s Securing the Mobile Workforce.
- PayPal Patches Critical Vulnerabilities.
- US government finally admits most piracy estimates are bogus. Not that it will stop them. Personally, I welcome our RIAA and MPAA thought police overlords.
- Google to Reveal Research into Fake AV Operations.
- Oracle released the April 2010 CPU.
- Hackers exploit new Java zero-day bug.
- Apple Patches Pwn2Own Flaw That Hacked Safari.
Blog Comment of the Week
To McAfee’s credit, they did own the issue and made numerous apologies. Personally, I think the apology should have come from DeWalt, the CEO on the blog. But they aren’t making excuses and are working diligently to fix the problem.
You must not be a McAfee customer. They didn’t own the issue. They blamed the customer. They said “Corporations who kept a feature called “Scan Processes on Enable” in McAfee VirusScan Enterprise disabled, as it is by default, were not affected.” Unfortunately, the above is factually inaccurate. It is disabled by default in 8.7, if you were running an older client, you’re screwed. Not only is it on, but it cannot be disabled. Also, if you don’t scan SVChost on process enable, you may scan it when you conduct a daily memory scan or when you do a scheduled scan. Either of those can catch it and screw you. If you do a memory scan at boot, you’ll be in the same loop. They also obfuscated on the severity:
“the error can result in moderate to significant issues on systems running Windows XP Service Pack 3.”
When is a constant reboot considered a moderate to significant issue? How about fatal? How about a tech needs to touch every PC. How about they published a “fix” that didn’t work. I’m sorry, but the way they handled this is a case study in how not to handle this.