Financial Institutions and Passwords

You would think that financial institutions would want individuals to choose really strong passwords that are difficult to guess.  But in at least one very big case, you would be wrong.  What makes a strong password?  Several things:

  • A lot of characters.  The more the merrier.  The only limitation on this is that you have to remember All of That.
  • A lot of randomness.  That is, words in a dictionary are bad, because attackers will often go through dictionaries to attempt to guess passwords.
  • Characters that are not letters or numbers.  This increases the search space, given a certain sized password.

Now let’s review the actual guidance given by a very popular broker:

Your new password must:

  • Include 6-8 characters AND numbers
  • Include at least one number BETWEEN the first and last characters
  • Contain no symbols (!,%,# etc.)
  • Cannot match or be a subset of your Login ID

Examples of valid passwords: kev6in, 2be111, wil1iam

In other words, they’re violating two very big rules.  The 6-8 character rule means that they are limiting the search space, and people cannot put together phrases, which are actually easier to remember than passwords.  Removal of symbols from the search space makes it easier for attackers to perform a dictionary attack.

This site is not alone.  Many sites have the same problem, and it is likely a problem with what their security professionals think is the industry standard.  Well it’s a bad standard.  Who takes on the risk?  In the brokerage world, the chances are that you are assuming at least some risk.

[del.icio.us] [Digg] [Facebook] [Reddit] [Twitter]

A lesson in transitive trust

CybercrimeGrowing up in the New York area in the 1970s, one never really paid attention to all the crime that occurred.  There just was so much of it.  Even when I lived in California, while a murder would make the local news, it wasn’t something that would shake the community.  A murder in the Zürich area, however, is rare.  Maybe it’s because everyone has a gun, as my friend Neal might say.  Who knows?  The point is that people here are not inured to that level of violence.

Now we are discovering the online version of that.  When last we left our situation, we were trying to figure out how best to protect ourselves from evil bad guys by limiting the damage dumb passwords can do.  Since then, it has been widely reported that 10,000 Hotmail account passwords were stolen.  But they weren’t the only ones.  Many of the people who use Hotmail accounts also have GMail and Yahoo! accounts, and many of those passwords are the same.  Why?  Because humans don’t like having to remember lots and lots of passwords.  And of course, if you were one of those people who used the same password between both and linked your Yahoo or GMail account to Facebook, that means that your Facebook account could have been compromised as well.  And that means that your friends may have been attacked, as we previously discussed.

How could this be worse?  Let’s add Paypal into the mix.  If you use the same password for eBay as you used for Yahoo!, now all of a sudden, you have invited someone to empty your bank account.  Had Paypal implemented an OpenID consumer for login, an attacker wouldn’t even need your password.

Now let’s aggregate all of the people who do that.  The popular OpenID providers include Google, Yahoo, and Verisign.  As the number of providers increases, the concentration of risk of any one single failure decreases.  Concentration of risk is a fancy way of saying that one is putting all of one’s egg in one basket.  On the other hand, from the perspective of a web site that uses OpenID or some other federated mechanism such as SAML, the information received from any random Identity Provider (IdP) could reasonably be considered suspect.

This leads to a few conclusions:

  • A large number of Identity Providers will require a service that provides some indication as to the reliability of the information returned by a given IdP.
  • The insurance and credit industries can’t manage concentrated risk.  We’ve seen what happens in the housing market.  The Internet can reproduce those conditions.  Hence, there will be limitations on transitive trust imposed.

Conveniently, you are not without any protection, nor are the banks.  There are large federated market places already out there.  Perhaps the two biggest are eBay and Amazon.  Amazon has the advantage of requiring a physical address to deliver to, for most goods, the exceptions being software, soft-copy books and downloadable movies.  In each of these cases, the transaction value tends to be fairly low, and the resale value of most of these items is 0.  It’s the resale value that’s important, because the miscreants in this business don’t want 150 copies of Quicken for themselves, nor can they really sell off an episode of House.

Paypal is another matter.  If someone has broken into your Paypal account, here is what they can do:

  • Empty it of any credit it might have;
  • Charge against your credit cards; and/or
  • Take money from your bank.

If you’re paying attention and act quickly, you might prevent some of these nasties from happening.  But first you will have to read a tome that is their agreement.  In all likelihood you have no recourse to whatever final decision they make.  If you’re not paying attention, your account and those associated with it become an excellent opportunity for money laundering.  What does it mean to pay attention?  It means that you are receiving and reading email from paypal.com.  That means that they have to have a current email address.  When was the last time you checked that they do?  Assuming that they do, it also means that you have to read what you are receiving.  Now- I don’t know about you, but I’ve been spammed to death by people claiming to be PayPal.  Remember, how this posted started by talking about being inured to crime?  Well, here we go again.

[del.icio.us] [Digg] [Facebook] [Reddit] [Twitter]

Beware Best Western

The customers of Best Western are the latest to have their identities stolen.  As the article goes on to say, the crime gangs are going to have a field day with such live and valuable information that included credit card numbers and home addresses.  There’s a clear lesson here in authorization: nobody needs to have access to the aggregate data that Best Western had.  It might be necessary to modify one or two reservations at once.  Perhaps it might even be necessary to know how much of a block is sold.  But the whole kitten caboodle?  Nobody needs that information.  Here are some protections Best Western could have taken:

  • Apply specific encryption of the credit card information and compartmentalize the use of any decryption key.  Hotels have need to retain credit card information in order to guarantee bookings.  Encrypting credit card data is nowhere near a perfect solution because there is relatively little clear text information and some of that can be guessed, like the first four digits.
  • Encrypt all backups and protect the decryption keys so that multilevel authorization is required to access them.  Many backups are stolen.  If they are stolen no encryption is perfect and so notification is necessary, but with encryption those whose information is stolen can take action, like have a house sitter or change credit card numbers.
  • Employ intrusion detection within the database.  When a specific user acts outside a profile, flag it and see what is going on.

In perhaps a more perfect world a separate identity provider could retain identifying characteristics of an individual such as address and credit card number.  Commerce likes some of this information because they can market to you, and absent legislation they have very little motivation to protect the information.

[del.icio.us] [Digg] [Facebook] [Reddit] [Twitter]

Why Extradition of Hackers Is Important

Each day we hear about different forms of fraud and theft on the Internet.  Someone in America gets phished from a computer in the UK that is controlled by another computer in Switzerland, that is controlled by an individual in Italy, and their bank account emptied to a mule in America, and the money ends up with some gang in Russia.

Even if you found the individual in Italy you have to answer this question: where was the crime committed?  The Convention on Cybercrime of the Council of Europe addresses this very question, and fosters cooperation amongst  cooperating societies.  Extradition is so rare that it is worth pointing out when it happens.  On the 30th of July a UK Court refused to block extradition to someone who is accused of having caused many hundreds of thousands of dollars to US government systems.  While in this case the government was a victim, something that happens all too often, far more often it’s individuals who are harmed.  In this case the person sounds a bit disturbed. Let’s hope that next time they extradite people who do this sort of thing to make money, and demonstrate to them that it is not worth the risk.

Because the risk of getting caught is so small, this is an instant where the penalties should be very high when intent on theft, fraud, or disruption of services is clearly evident.

[del.icio.us] [Digg] [Facebook] [Reddit] [Twitter]

Time to Takedown: Successes and Failures

Takedown is a term used by Internet service providers and law enforcement officials that means the involuntary removal of a computer from the Internet.  For instance, if a computer has been compromised and is attacking other computers, a takedown is seemingly appropriate.  Tyler Moore and Richard Clayton have done some analysis on how long it takes to get a site off the net when it is doing something anti-social.  They look at about six different circumstances: phishing, defamation, child pornography, copyright violation, spam and bot sites, and generally fraudulent web sites.

Not surprisingly, firms such as banks that actively defend their brand are able to expunge hosts serving bogus content the fastest, and service providers are the most cooperative (the numbers cross jurisdictional boundaries).  Sites harboring material that exploit of children takes 10-100 times longer than banks.  That’s an enormous difference.  There are several likely reasons for this difference.  First, banks are acting in their clear best interest and do not mind shouting at whoever they need to shout at to get rid of material.  They’ve also likely developed strong relationships with service providers to speed the process.

The data on child protection is somewhat skewed by a single source, and that source had substantial jurisdictional issues, in as much as they did not feel empowered to deal directly with certain governments and service providers outside the UK, and in particular in the United States.  Worse, images that were removed had a tendency to re-appear on the very same web sites, indicating that either the site was re-compromised or it was poorly managed or both.

The data points to a clear need for stronger coordination by service providers throughout the world to protect children.  The fact that banks are able to be more successful in removing content that offends them demonstrates that it is possible when self-interest is a factor.

In the area of copyright violation, the RIAA has had success in removing sites that are clearly violating copyrights.  By injecting themselves into P2P networks the RIAA has been able to determine many sources of copyright violation.  The paper does not have a data source to analyze takedown periods.

[del.icio.us] [Digg] [Facebook] [Reddit] [Twitter]