An interesting day in information security

A Mafia boss was caught because of his using Facebook, while unrelated to that the EFF released the result of their Freedom of Information request for material on how law enforcement uses social networking to investigate suspects. "under cover".

The SEC moved to freeze portfolios and accounts following attacks by a Russian hacker, who manipulated stocks.

InfoSecurity magazine has a story on espionage in sport, mentioning how where there's a motive, cyber-crime follows.

And of course, the leading story (which I discovered thanks to a post on Facebook by Dave Aitel) is how an hacker (if that is a descriptive word in this case) broke into 100 cars to cause inconvenience, such as honking, or immobilizing customer the cars.

He hijacked the remote control system ("web-based vehicle-immobilization system normally used to get the attention of consumers delinquent in their auto payments") by logging on with an account of an employee. He used to be an employee himself, until fired later on.

Also, check out this extremely interesting paper from Cormac Herley at Microsoft Research on why people reject security advice:
So Long, And No Thanks for the Externalities:
The Rational Rejection of Security Advice by Users

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Bill Brenner Joe Jobbed by a Facebook App

My friend Bill Brenner, editor of CSO Magazine, just warned friends in his Facebook status message that someone may be trying to get them to add an application to their wall by using his name.

Bill Brenner: Some cyber-dope is apparently trying to use my name to infect your machine with the message "Bill Brenner has posted something on your wall." Do not click on it. It's a trick. Repeat: If you get a bunch of messages from me saying I posted something called "news feed" on your wall, do not allow the app access.

I don't know if this is targeted against Bill (if so, congratulations Bill! Your made it!) or if a malicious app is using names of friends to get people to add it. But this is certainly an interesting development.

Bill, stay strong and ignore. I passed it over to Facebook security. And people, remember to be careful of what you click on!

This is why I like Bill, he immediately warned everybody.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Hiring people and how communities run

This post by one Seth Godin speaks for itself, and is fascinating. The guy wanted to find out who to hire out of all the "PDFs". So, he put all the internship candidates on a Facebook group, and watched. He quickly saw four types of participants.

• The game-show contestants, quick on the trigger, who were searching for a quick yes or no. Most of them left.
• The lurkers. They were there, but we couldn't tell.
• The followers. They waited for someone to tell them what to do.
• The leaders. A few started conversations, directed initiatives and got to work.

Having had almost too much experience in getting projects running, making things happen, working to bridge big egos, building communities and forming new trends--or in other words, Herding Cats (TM)--I was hooked. it's not often I find another "campaign manager", and especially not a student of "affecting change".

I kept wishing the guy shared more information and some of his insight. He didn't, but it was still interesting.

Adjacent subjects hinted to in his post such as learning, hiring and mentoring are almost as interesting to me, and in general, I found the subject matter close to heart. The post really "spoke" to me.

The world is full of followers, and this idea will be copied. My fear is that the fakers will become the winners.

In the Israeli military any course you go through--especially officers' course--has occasional Psychometric tests where your friends "rate" you on different attributes. [*opinion* most of] The people who get the high scores are the fakers. That means you get smart people, but also poor actors (not too much acting required).

Looking at the huge industry preparing people for anything from the SATs to professional certifications, I can visualize how this methods could become [as] useless.

On the other hand, human nature has a way of coming through in the end. And, of course, in business--if the fakers "get the results" it doesn't really matter.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron