It’s easy to think that the main contribution of social media tools like Twitter and Facebook is to connect you more tightly to your friends, colleagues, and family. Which is true. But don’t underestimate the immediacy of using networks like Twitter to interact directly with the companies you do business with. I have two recent examples which highlight this trend.
Those of you who follow me on the Tweeter (@securityincite) know I don’t tweet a lot. I’m not going to tell you where I am. Most of the time I’m not going to tell you what I’m doing. But I lurk, ready to pounce when an interesting discussion presents itself, or to whore out something we’ve written or a speaking gig. As the boy told me this week when I asked him why he was uncharacteristically quiet earlier this week, “I only talk when I have something to say.” I’m like that on Twitter.
So when I had a pretty negative experience on a recent flight, my first thought was to Tweet. I did, and got an almost immediate response from Delta, apologizing for the issue. Wait, what? Because anyone bitching on Twitter isn’t just having a one-on-one conversation – they are venting to all their followers, and anyone searching for the terms (hashtags) mentioned in the tweet. So many companies have become much more responsive to customers venting, and those Tweets get higher visibility. You have heard the stories of high-profile CEOs responding directly to nasty tweets about their companies. Delta had a good response. It didn’t take the sting out of my crappy experience with their gate agent but at least I knew someone was listening.
On the other hand, Barnes and Noble had a total #FAIL Monday, a stark example of how some companies are unlikely to make it in this age of Internet commerce. We were packing the kids up for sleepaway camp, and wanted to send them with a bunch of books to not read while they are away. Normally I buy from Amazon, but they had one of the Big Nate books backordered. B&N had it in stock for the same price. There is a store right where I was, so I figured I’d just pick it up at the store.
But when I got the confirmation, the price listed was different than the online price. Huh? I figured maybe it was just some idiotic system problem and they’d honor the price they offered me online. That’s what every other retailer with stores and an online presence does, right? Evidently not – B&N charges full price for books you buy at the store, even if you can get them at 40% off on their website. They also provide free shipping on website orders. And you wonder why that company is struggling.
I figured if I cannot avoid being inconvenienced to order online, I’ll just order two of the books from Amazon. Voting with my dollars, as I should. I did need the other book (backordered at Amazon), so I ordered that from B&N and took advantage of their free shipping. Of course I was perplexed, so I tweeted my frustration at B&N. They would respond and try to explain their idiotic policy, right? They couldn’t have their heads up their asses that badly, right?
Wrong. Crickets in my timeline. So when you hear about B&N following Borders into bankruptcy don’t be surprised. Companies that don’t understand the direct feedback customers expect through social media nowadays aren’t long for this world anyway.
–Mike
Photo credits: B&N tombstone created by Mike Rothman with the help of Tombstone Builder
Heavy Research
We’re back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, where you can see all our content in its unabridged glory. And you can get all our research papers too.
Understanding and Selecting Data Masking
Pragmatic Key Management
Evolving Endpoint Malware Detection
Understanding and Selecting a Database Security Platform
Malware Analysis Quant
Incite 4 U
- Which came first: the chicken or the Flame? Evidently the folks at Kaspersky have definitively proven that Flame was a pre-cursor to Stuxnet. Bully for them. What came first isn’t really important, rather highlighting what you already know. Adversaries are very good, if you are their target. They use advanced crypto and pretty much any other tactics to achieve their mission. The interesting thing about Flame, regardless of when it appeared, is how it gamed Windows Update. Most folks, even if they do harden detection, give patching a free pass, as patches update and change executables, config settings, and registry values. But if you can’t trust the patches? Ruh-roh. I’m doing a lot of research into evolving endpoint malware detection, as with attacks like Flame you don’t know what the malware looks like, so you need to watch what it does and block bad behavior. – MR
- LinkedOut: I’m not going to pick on LinkedIn for losing a bunch of passwords and then mishandling their public response. That’s pretty much par for the course with this sorts of breach, and considering how often they happen it’s obvious no one listens to us anyway. I won’t even slam them for neglecting to make clear to users that if they allowed the iPhone app to read their calendar, LinkedIn would grab their data. While it is incredibly obvious to anyone with an understanding of technology that linking your calendar to a social networking app might, you know, leak the data, folks seem to enjoy being shocked more than thinking for themselves. But I will suggest that these privacy issues are starting to really grow in the public consciousness as the overlap of cloud, mobility, and services begins to enhance the personal connection people have with things they stuff in their pants every day. If you are going mobile, you definitely need to recognize customers’ (or products’) emotional attachments and reactions, and plan around not only mandated or actual privacy, but user’s perceptions and expectations of privacy too – on mobile specifically. If you don’t, try to enjoy your day in the headlines. – RM
- The failure of success: Sergei Golubchik disclosed a serious bug in MySQL over the weekend. In a nutshell, every so often a user will be allowed to connect to a MySQL database despite providing a bad password. It’s somewhat trivial for an attacker to try a bunch of bad passwords, given a known username, until the database allows them access. I hate to say it, but this type of thing is fairly common, and worse, it’s really hard to find in code reviews or functional testing. False negatives – cases where some operation is successful when it should not be – are not a condition most developers test for. Heck, most developers barely consider the possible failure and unknown states of an application, and they definitely don’t go looking for reasons it shouldn’t work – they coded it, so it should work! This is, however, a textbook use case for fuzz testing – looking for unknown conditions and reaching unreachable places in the code. – AL
- Speedy hashes and amateur night apps = password killers: Wait, what? You shouldn’t leave passwords unencrypted in a file somewhere on your website? Don’t laugh. It happens all the time. Obviously the LinkedIn, eHarmony, and other assorted breaches were a bit more complicated than that. But all the same, if you don’t protect passwords within your web app, it will not end well. Krebs interviews the reclusive Thomas Ptacek of Matasano to glean some knowledge about protecting passwords, different kinds of hashes, and the like. There is some good stuff in there, so read it. But more important: if you choose to build your own web apps, then you had better have someone who understands that salts and hashes are not just breakfast food. – MR
- Fast, but good? Is Agile better than other development methodologies? Mike Vizard discusses this question in Keeping Application Development Methodology Wars in Perspective, and concludes that there is no right answer – only what’s right for an organization at a particular point in time. Personally I think it’s a great question, with only conjecture available to answer. Very few people have even tried to measure multiple different development processes in parallel, and even then the teams are comprised of different people. As far as I know no one has ever built the same application, with two sets of people at the same time, under different development processes, so it’s nearly impossible to objectively say Agile is better. Adopting Agile because it’s ‘hot’ and “everyone’s doing it” is silly, but that does not keep it from happening. My personal feeling (which, along with $4 is enough to get you a coffee) is that Agile exists to satisfy unrealistic expectations in terms for code delivery – we want it before it can be done. We have altered development process to simplify and focus on small and important tasks, and some side effects turn out to be very beneficial. I have found that code quality has much more to do with the team and how well they enforce quality standards than with the Agile process. All things being equal, I find code quality from waterfall to be better because of the more formalized – and complete – testing it embraces. – AL
- What do you mean, China is after my shopping list? If you don’t think there are major cybersecurity games afoot between nation states, you haven’t been paying attention. If you don’t think private companies, even large ones, are pawns (or perhaps knights, but certainly not bishops or rooks) in these games, I have a bridge to sell you over a little river in New York. Take Google’s new warning to users when they suspect they are the target of a state-sponsored attack. Aside from creating some fear, do you think Google’s work with the NSA, and their previous exposure of the Aurora attacks coming from China are completely unrelated? This is fascinating stuff, and shows how high the stakes are these days. When 0-day exploits of iOS and Windows 7 can cost governments millions (according to some accounts) and major exploit campaigns start creeping into the major media, you know the days of innocence are over. The good news? Increased costs for nation-states mean increased costs for cybercrime, and reduced risk of mass attacks. Maybe. We hope. – RM
- Life after security: It’s hard to believe, but for some folks security is only a pit stop on the road to wherever they are going. I have long believed that not everyone has (or can develop) the mindset for security. But it’s also good training to do other things. This CSO Online interview asks four folks who escaped what they would have done differently and understood differently. Basically it’s a lot of stuff I wrote in the P-CSO. Understand your business, network, and get face time, ‘sell’ your agenda one-on-one, and be clear on the end user as the weak link. Not brain surgery, but lots of folks would rather buy an answer to a problem (which never really works), bury their heads in the sand (no good either), blame the users (doesn’t work), or figure the security data warehouse will solve all their problems (good luck with that). If you don’t like what you’re doing, make a change. Whether it’s into or out of security, or anything else. – MR
Reader interactions
One Reply to “Incite 6/13/2012: Tweeting Idiocy”
I take a bit of exception to your ending lines about customers expecting feedback from the social site. It’s really cool when it happens, but real complaints should still always be sent on through their advertised channels. Maybe B&N has their ear to the talk, but opts not to respond to every hit, or perhaps they had nothing to say that would help the situation, or have had plenty of degenerating exchanges by the internet trolls? 🙂 Then again, what’s the point of their social media presence? Announce deals? Marketing? Banter with customers? I can’t say I’m familiar with it.
It’s possible B&N knows what they’re doing. I’ve always thought it strange that someone like Best Buy has to honor online prices in-store, when it clearly should cost more in-store to provide the product to customers. There’s still some value, to me, to be able to inspect goods before purchase as well, and walk out with it immediately.
Of note, I had the pleasure of making mention of two things in the past week, and creators/owners of them responding back to me, either to add to my knowledge or say thanks. That was pretty nice, and unexpected. Though, these were small players, not major corps.