Defaults and weaknesses

Unfortunately there are too many real world examples where default passwords, weak passwords or test accounts are left on a system begging to be exploited.

Here are a two recent examples:

A Security Lesson From the Joe the Plumber Snooper

Prisoner PWNS Correctional System - Security Admins Out to Lunch

Doppelganger effect

So after some discussion about how an online presence can cause security issues, can a lack of an online presence be as bad? Imagine the target is a fairly well-known individual. S/he stays off of social networking sites to avoid the potential security and privacy issues we mentioned before. What could possibly happen to this person when they have exercised such caution?

Since anyone can sign up for Facebook, Myspace, Twitter, LinkedIn etc and can use fake information, what is preventing someone from creating a fake profile or Doppelgänger of the target? If the target person is really well known then the Doppelgänger will have no problem collecting lots of friends under false pretenses. The possibilities are endless for what the Doppelgänger could do in this position now.

The above scenario was tested when Shawn Moyer created a fake twitter profile for Gadi Evron, a security specialist. A fake profile on LinkedIn was also created for Marcus Ranum the CTO of Tenable Security. The potential for abuse is clear. From the article:

Moyer noted that on any given social network there are what he called, "linkwhores." These are people that will accept friend connections from anyone else. So the researchers sent out friend requests to people based on a Google search for people that had security in their profiles. Moyer claimed they had more than 50 connections within 24 hours. They also got invites from other people, among them was Ranum's sister who was also fooled by the bogus profile.

The security researcher did the same trick on Twitter for noted security researcher Gadi Evron. Moyer claimed that the bogus Twitter profile actually received an interview request from a journalist who was looking for a source to talk about the Kaminsky DNS flaw.

So perhaps some online presence is better than none. What do you think?

CBS Early Show

This might be interesting to some of you:

Daniel Sieberg explains how millions of people are socializing via internet and mobile sites without meeting each other, sometimes with life-altering consequences.


Watch CBS Videos Online

Disobeying Corporate Rules

Read this blog post for the next class. It has some interesting points that fall into our recent discussions.

Passive ID Theft

Keeping with our passive information theme, read this article on Passive ID Theft.

Data loss in the age of information

Information is power. This is so true in today's society. We had a great discussion today about ways of obtaining information. Here are a few articles/links that were mentioned:

Bugtraq

Partial Disclosure

The Web Hacking Incidents Database

Privacy Rights Clearing House

Data Loss Database (more information here)

How Can Government Improve Cyber-Security? (I)

How Government Can Improve Cyber-Security (II)

Laptop/Border Control

FISA and Border Searches of Laptops

Laptop searches at the border: No reason? No problem

When Will Social Networking Cripple Corporate Network Security

Videos

CNBC "Big Brother, Big Business"

Privacy is Dead Get Over It (I)

Privacy is Dead Get Over It (II)

Capturing Keyboard Strokes

In the last class we talked about different ways of passively capturing information. Check out these videos on keyboard capture