There was a great article from the Council on Foreign Relations regarding the hypocrisy surrounding Kaspersky since the U.S. government earlier this month banned federal agencies from using Kaspersky Lab software.  Best Buy is getting in on the action and will stop selling Kaspersky products because of possible(?) ties to the Russian government.  Why doesn’t Best Buy get rid of some of the other shit-for-security products on its shelves as well if it’s so concerned about security?

The U.S. House Science Committee received a classified briefing Tuesday related to Kaspersky.  I’d really wish some more details over the alleged collusion between Kaspersky and the Russian government would see the light of day.

And what would a Kaspersky post be without an RT link!?  ‘It’s crazy’: Kaspersky Lab attacked in US only for being Russian, says founder

Old Passwords

I went into my password vault the other day to retrieve a password.  For the application in question I had noted in the comments “old password may be ________”.  I’m not sure why I felt the need at some point to record a previous password.  This is terrible opsec practice to leave old passwords lying around.  Ask yourself, how many folks do you think use old passwords as seeds for new passwords?

monkey12 -> monkey123

password! -> password!!

mommieOct06 -> MommieDec08


Some interesting data in the Statistics section on the U.S. Courts website.   Neat to view different states and their wiretap costs, quantities and type (narcotics, homocide, gambling)


I’m disappointed to see no one has created an app on Data.Gov with the above data.  I couldn’t find anything from the US Courts on data.gov (i.e. bankruptcy).  Who has free cycles!?

Do they have your dox!?

AboutTheData.com just publicly launched this week. It’s brought to you by Acxiom, one of the web’s advertising heavy hitters. After verifying your identity the site allows you to view all of the marketing data they’ve collected about you (demographics, family, loans, auto/home, employment, education etc). They’re also very nice —- they let you update the information in case it’s not accurate! I found my dox to be lacking — not surprising as I don’t believe I’m any of Acxiom’s target demographics.

More from NYTimes here

Another breach notification…

Dear valued community members,

On the 22nd of July 2013, it was discovered that unauthorized access to our website and database has been obtained on the 20th of July.
The method is similar to the hacks that were recently conducted at other websites, even though those sites used other software.
One of the admin accounts password was discovered, and from there further escalation wasn’t too difficult considering admin privileges can do just about anything.

Unfortunately, we are 100% sure that our user database has been stolen.
As such we HIGHLY RECOMMEND, even implore you, to:
1.) Change your password on other websites you are using, if you use the same password there. This is very important to do, as it also will help prevent other websites being hacked through your compromised password, if it is compromised.
2.) Change your password here on our website.
3.) If you use the password you use here anywhere else, say for example to login to your webhost, it is highly urged to change it.
4.) Please note that personal messages may have also been compromised. We don’t know for sure if the hacker only downloaded the user tables or not, although that’s the only thing he/she is after. If they did: keep in mind that passwords you shared through PM should now be considered vulnerable. It’s best not to take the risk and gamble, and just change any password you shared through PM as well.
5.) Charter members, current and past, are encouraged to change ALL passwords if they ever sent any in to us. That would include FTP.

Please keep in mind:
This is !!NOT!! a security issue with the SMF software. If you are running the latest SMF version you have nothing to fear from this hack if you use different passwords.

The method used by the hacker is that a database is downloaded from another hacked website, the passwords are attempted to be decrypted and if it is successful: they try to login to other websites using that username & password, or try to cross-reference by using password reset links.
Unfortunately for us, a Administrator used the same password elsewhere on another site and access to our site was obtained when the password from the other hacked site was successfully decrypted. As a result, the hacker was able to login here with admin rights.
Hundreds of websites have been hacked lately by using this method, so you are highly encouraged to change your passwords…

… And remember: don’t use the same password on multiple sites!
It helps to prevent hacks like this.

Thank you for your consideration and we deeply apologize for any inconvenience this causes for you.
By changing your passwords, you will help ensure that other sites do not fall victim to this method of hacking and help put a halt to the hacking spree that has affected hundreds, if not thousands, of websites already.

Any questions, please do feel free to ask.
Please stay on topic.

Kind regards,
Board of Directors
Simple Machines

Announcement URL: http://www.simplemachines.org/community/index.php?topic=508232.new#new

AT&T’s new Privacy Policy….

I received an updated AT&T privacy policy in the mail yesterday.  They’re making their policy easier to understand AND “pointing out programs that could help other businesses serve you better”

That’s great, so AT&T isn’t getting enough revenue from our cellular subscription fees — they also have found new ways to generate revenue by undermining our privacy.  Of course it’s not just AT&T, but all big (and smart?) companies.

It sounds like AT&T is now selling cell tower/node registration information to third parties.  Kevin Mitnick was tracked using cell tower triangulation.  This same concept can be bundled as a service and sold to retailers i.e. What time of day/week are the most 25-35year old males in a 1 mile vicinity of our storefront?  Maybe we’ll have a scantily clad woman stand on the street to lure these men into the store.

For example, we might provide reports to retailers about the number of wireless devices in or near their store locations by time of day and day of week, together with the device users’ collective information like ages and gender.

The second program sounds like using location data coupled with advertisements.  If your cell phone is frequently showing up near airports or hotels you’ll get travel focused ad’s.

ATT Privacy Policy Page 2ATT Privacy Policy Page 1