Doppleganger (again)

Related to a previous post on this subject, some might suggest that you're nobody unless someone is faking you

MIT Boston Transit Talk

Last week we had discussed this talk and I said I would post a link. Make sure to check out the slides.

Article about this talk's cancellation

Enjoy!

Improvised RFID blocking

I thought you guys might like this blogpost.

Doppelganger effect

So after some discussion about how an online presence can cause security issues, can a lack of an online presence be as bad? Imagine the target is a fairly well-known individual. S/he stays off of social networking sites to avoid the potential security and privacy issues we mentioned before. What could possibly happen to this person when they have exercised such caution?

Since anyone can sign up for Facebook, Myspace, Twitter, LinkedIn etc and can use fake information, what is preventing someone from creating a fake profile or Doppelgänger of the target? If the target person is really well known then the Doppelgänger will have no problem collecting lots of friends under false pretenses. The possibilities are endless for what the Doppelgänger could do in this position now.

The above scenario was tested when Shawn Moyer created a fake twitter profile for Gadi Evron, a security specialist. A fake profile on LinkedIn was also created for Marcus Ranum the CTO of Tenable Security. The potential for abuse is clear. From the article:

Moyer noted that on any given social network there are what he called, "linkwhores." These are people that will accept friend connections from anyone else. So the researchers sent out friend requests to people based on a Google search for people that had security in their profiles. Moyer claimed they had more than 50 connections within 24 hours. They also got invites from other people, among them was Ranum's sister who was also fooled by the bogus profile.

The security researcher did the same trick on Twitter for noted security researcher Gadi Evron. Moyer claimed that the bogus Twitter profile actually received an interview request from a journalist who was looking for a source to talk about the Kaminsky DNS flaw.

So perhaps some online presence is better than none. What do you think?

CBS Early Show

This might be interesting to some of you:

Daniel Sieberg explains how millions of people are socializing via internet and mobile sites without meeting each other, sometimes with life-altering consequences.


Watch CBS Videos Online

Passive ID Theft

Keeping with our passive information theme, read this article on Passive ID Theft.

Data loss in the age of information

Information is power. This is so true in today's society. We had a great discussion today about ways of obtaining information. Here are a few articles/links that were mentioned:

Bugtraq

Partial Disclosure

The Web Hacking Incidents Database

Privacy Rights Clearing House

Data Loss Database (more information here)

How Can Government Improve Cyber-Security? (I)

How Government Can Improve Cyber-Security (II)

Laptop/Border Control

FISA and Border Searches of Laptops

Laptop searches at the border: No reason? No problem

When Will Social Networking Cripple Corporate Network Security

Videos

CNBC "Big Brother, Big Business"

Privacy is Dead Get Over It (I)

Privacy is Dead Get Over It (II)

Palin's Yahoo account compromised

It's almost as if we had foreshadowed this event. We spoke on Monday about how insecure Yahoo! accounts could be if you know the person well enough. Sarah Palin has just learned this the hard way.

For someone who has such a high profile she should have at least thought of using some fake information for her user questions and better passwords.

More articles:

wikileaks
Wired

The upcoming aftermath:

Wired update
TheRegister


Let's see if this doesn't get blown out of proportion...

9/3/08: Notes and Personal Security

Since my Blackboard account is slow in coming, I will have to put Power Point slides up online for now. You can find today's here.

Extras:
Social Engineering

We will discuss Social Engineering in the class and also talk a little about one of the best known social engineers. Here is a video on how to social engineer a free pizza:



The Social Engineering Panel at The Last HOPE



C|Net article on this panel

Pretending to be something you aren't

We will discuss an article from wired about a mole from the media who attended Defcon. The organizers suspected that she was in fact a reporter, in spite of the fact that she refused to buy the media pass instead of the regular one. She was hoping to out agents and others doing ``illegal activities'' and even commented on

How the people in Kansas would be interested in what takes place [at such events].

She then made the mistake of telling others her intent and revealing her hidden camera, so her unveiling was inevitable:

Phishing

We will also discuss Phishing, which is a type of social engineering. Here is a Phishing IQ test so you can see how tricky some of these guys can be.

We will take a look at a fraudulent email I received and a whois lookup to see which country the email is coming from. This is a Nigerian Letter or 419 fraud letter. There is a website called 419eater that is dedicated to fighting these fraudsters.

Bullying

Megan Meier was a teenager with some teenage problems who was duped by some ``friends'' including the mother of one of these friends. They had created a fake profile of a teenage boy and engaged in conversation with Megan. Eventually, they started to harass Megan with the fake profile and she took it rather badly and killed herself.

Here are some articles:

http://www.news.com/8301-13860_3-9819394-56.html
http://blog.wired.com/27bstroke6/2007/11/blog-readers-ou.html
http://blog.wired.com/27bstroke6/2007/11/megan-meier-sui.html

Some readers became so outraged that they outed the adults that had duped Megan and posted not only their names, but places of business, phone number and address. Then one of the bloggers who had outed them got outed herself:

http://www.wired.com/politics/onlinerights/news/2007/11/vigilante_justice

An even odder turn in the case, is that of a blog that surfaced as a comment in another article called ``Megan Had it Coming.'' The writer of the blog at some point ``confessed'' to being Lori Drew, or the mother of the child who was friends with Megan, and had harassed her to her death.

http://www.dvorak.org/blog/?p=14913
http://sigmundcarlandalfred.wordpress.com/2007/11/19/megan-the-bitchhad-it-coming-or-how-to-kill-a-child-twice/
http://www.cnn.com/2007/US/12/08/internet.suicide.ap/index.html

The blog was posted here:

http://meganhaditcoming.blogspot.com/

It was recently revealed that the blog was a creation of an Internet Troll.