Why Heartbleed is a Good Thing

Don't get me wrong: Heartbleed wasn't a shining moment in tech security and I'm not super-glad that the vulnerability occurred. Still, personally, I'm pretty happy when stuff like this hits the fan.

Well, I suppose I'm glad in a "question authority" kind-of-way. When a wide-ranging vulnerability like this is brought into the open, it gets us in the technology security field off of our butts to, one, provide a remedy to the most immediate problem, but two, question all of our assumptions.

Incidents like Heartbleed, Edward Snowden's NSA revelations, and the good work conducted by Wikileaks, gets technology professionals to look more carefully at our solutions. It forces us to think differently. These incidents also reveal certain threats that we may haven't foreseen. They also lead us down a path of hardening our all our technologies in short-order to curtail compromise. In all, situations like Heartbleed elevates all of our security postures. They make all of us safer.

Arguably, what wasn't safe was continuing to live in ignorance as Heartbleed was exploited, or, while the NSA was wiretapping private data centers without warrants, or, believing that corporations and governments always have our best interests in mind. Assuming everything is okay wasn't safe. Proving flaws and vulnerabilities - even if the outcomes are undesirable - is how we all get better.

Question authority. Further, question our assumptions. Learn, build awareness, and do better next time. That's what will improve cyber security.

R 

Remove GPS Data from iPhone Pictures

The iPhone, like many modern cell phones, can take pictures. When those pictures are taken, information about the location of where the picture was taken is embedded into the photo. This is called metadata, and specifically it's referred to as a geotag.

Geotags are an interesting feature in that they can be pulled up on a map, then, sequenced in time to replay where you were when the photo was taken, even down to the very accurate location of a room within a household.

Very clever and fun. Until you start thinking about children using iPhones - their privacy and security become compromised in that it lays out a predictable pattern of their whereabouts.

Photos (along with the metadata) are uploaded conveniently into social media networks and distributed to whomever in uncontrolled ways. 

This date is also used by professional computer forensics technicians (hey, like me!) to identify potential evidence in the court of law. 

Further, if someone wanted to "case" another (a term used in hacking meaning we collect personal private information about individuals in order to break into their accounts), geotagging provides a unique and easy exploit. Imagine a stalker determining the predictable locations and timing to harm a victim?

So ... You may be curious on how to turn off geotagging on your iPhone or iPad.

1. Go to Settings.

2. Privacy. 

3. Location Services. 

4. Camera Setting and flip to OFF position. 

Doing this will prevent the device from storing geo-tag metadata in future photographs.  The photos you've already taken and uploaded probably already have the geotag information in them and it cannot be removed, other than deleting the photo, or, Using an app like deGeo (you can find it in the iTunes App Store).

It's not perfect, but it is one step you can take to control the distribution of your whereabouts, and the whereabouts, safety, and privacy of your children. 

R

2007 CSI Computer Crime Survey

The 2007 CSI Computer Crime Survey is available for public consumption. Further, an Oct 9, 2007 Webcast is available for viewing.

Interesting about this year's survey:

1. The gradual decline of reported incidents (page 14). All of the usual threat metrics are either in a downward trend or are stable (virus attacks, phishing, IM abuse, telecom fraud, etc.). In terms of reported incidents, what is up this year and quite dramatically are insider (employee) abuses of Internet access.

2. The fact that 74-percent of respondents only spent 0%-5% of their annual IT budgets on IT security this last year (page 8). This number is surprising to me. It suggests that the security problem has either become a non-issue or lacks total priority. If the metrics are any indicator, it would seem that in terms of reported incidents, technical vulnerabilities are being contained in corporate America better than ever before, and this places less emphasis on the security function. Good news for consumers and businesses; bad news for information security consultants and technology professionals. Automation and better-designed products/services are fixing the glaring problems.

3. The effects of SOX on IT security (page 26). This was actually spotted by one of my students - credit where credit is due. The survey would suggest that many respondents do not feel that increased IT governance has improved the IT security problem, nor do they feel that the emphasis has moved away from security to governance. The transparency offered by SOX and better IT governance isn't making a better difference in information security for a bulk of respondents? Eh? Seems contradictory to the academic, but maybe techheads in the field feel that the frontline battles are still fought tooth and nail, and have nothing to do with better oversight or management? This one is a little hard to read and is counter-intuitive, but is interesting nonetheless.

R