ipad security hole

My job as the resident “security guy” places me at the butt of jokes that serve as the passive aggressive means of venting the frustration that my co-workers feel about the strict military and DoD policies. Security is almost never appreciated until an information system’s security is broken or breached. And even then solutions only come after blame and public humiliation.

Why did so many important government figures decide to risk using the new iPad without proper military grade testing and scrutiny is the biggest question. I would expect a start up in Silicon Valley to grab an iPad the first day it comes out but not U.S. military organization in the middle of two wars.

more here:
http://money.cnn.com/2010/06/09/technology/iPad_email_breach/index.htm?postversion=2010061009
http://gawker.com/5559346/apples-worst-security-breach-114000-ipad-owners-exposed

There maybe parts of your life you want to share with family that you don’t want co-workers on your friends list to see.

With Facebook you can manage all the content that you post by creating Lists. Once the list is created you can control who has access to what you post and upload.

How to Create Facebook Friends Lists:
1) Login and go to Account | Edit Friends
2) Click on “Create New List” and make a name for your new list
3) Once you have your new list you can add people to that list

Limiting Access to Content:
Anytime you post content you will be given the option of permitting or deny certain lists of friends (or even individuals) to what you are posting. At the bottom of every post near the “Share” button, there is a lock with an arrow to a drop down featuring: Everyone, Friends of Friends, Friends, and Custom. If you click Custom, it will allow you to choose the new list you created or even specific individuals.

With this built in access control feature you have pretty good control over your privacy.

Basically, someone creates a innocent looking extension or plug-in, they distribute it and the innocent looking plug-in/extension sends your personal information to where ever.

How can a person avoid this?! I guess the safest way would be to not use ANY plug-ins and extensions.. but that is over kill.
I know that I am pretty paranoid about Wordpress extensions/plug-ins but the open source community is pretty good about peer reviewing, testing and reviewing some of the more popular plug-ins. When it comes to software I depend heavily on reviews of others who have used the product. If there are no reviews (even on forums or dev/plug-in sites), I usually consider the app to risky.

Sometimes what I do is try the app/extension/plug-in on a site/blog I don’t care as much about. In the case of browser plug-ins, I use a single trusted browser with minimal plug-ins to do important sensitive/personal transactions. Most of the stuff I do on the web does not require so much scrutiny.

Unfortunately, there is always a risk with plug-ins, apps, and extensions. All we can really do is manage the risk, by being careful and suspicious.

Thanks Mr. Grech for the knowledge.

From the desk of: Tony Adams
Head of Operations
International settlement Dept.
Barclays Bank plc
Private Clients & International
Murray House
1 Royal Mint Court
London
EC3N 4HH

Attn: Beneficiary,
Re:Immediate Credit Card Payment Notification
Your Name And Your Contact Details Was Given To This Office In Respect Of Your Total lnherited/Contract Sum Owed To You Which You Have Failed To Claim Because Of Either Non-Compliance Of Official Processes Or Because Of Your Unbelief Of The Reality Of Your Genuine Payment.
We wish to bring to you the solution to this problem. Right now we have arranged your payment through our Credit Card Payment Centers, That is the latest instruction from the director incharge of remittance and also check executive officer private clients and International, David Roberts.
We at Barclays Bank Plc are willing to give you the best of our services so long as you are ready to comply with our working instructions as mandated. We have been instructed by our director to issue out $250,000 in claims that has been awarded to you as part payment for the 2nd quater of the fiscal year 2010, with the 2nd batch of the payment will be duely spread out before the 3rd and 4th quaters of this year.
This Card Center Will Send To You your payment directly to you credit card account which you will use to withdraw your money in any ATM Machine in any part of the world, So if you will like to receive your funds in this Way, Please let us Know by contacting us back and re-confirmation the information as listed below:
1. Full Name.
2. Phone And Fax Number
3. Address:
4. Attach Copy Of Your Identification
Also for your information, You have to stop any further communication with any other person (s) Or Office(s) To avoid any hitches in receiving your payment.
Note That Because Of Impostors, We Hereby Issued You Our Code Of Conduct, Which Is (ATMC-202) So You Have To Indicate This Code When Contacting The Card Center By Using It As Your Subject.
Waiting For Your Response.

Yours In Service,
Tony Adams
Head of Operations
International settlement Dept.
Private Clients & International
Barclays Bank plc

I originally started elamb.org for computer & Internet security issues. I found a few useful techniques on preventing and recovering from malware. After getting scammed I got interested in the helping people avoid fraud. I have found that people all over the world have the same experience I have had with these scams.

One of the biggest scams on the Internet right now are dateing scams. Scammers seem to be having great success on the dating sites and judging from what readers have submitted to this site, I believe it has to do with two primary factors:
1) Dating sites limited ability to stop scammers
2) Members of dating sites giving lots of money to scammers

Essentially, these two factors enables Internet date scams to exist and do fairly well.

The good news is that many of the major dating sites are doing better about informing their members of the date scam pandemic. Dating sites are beginning to for put up messages before they allow members to send any message to other members. Internet dating sites are also much better about discovering false profiles and shutting them down. They have begun to allow the users the ability to spot scammers and report them immediately.

The challenge is that anyone can create a false profile. Even legitimate members can create a fictitious profile and there is nothing that can stop them, however scammers can be easily identified by their practice of mass messaging hundreds of members over and over from a false profile. The success of Internet Dating scams are dependent on their ability to cast a wide net for profile phishing for the most emotionally vulnerable members of multiple dating sites.

Even with all the scammers and fraud, dating sites are still quickly becoming the best way to find a life partners. The caution that I would offer to members of dating sites is to take things slow and be VERY suspicious of anyone asking for money online also remember that most of the scammers are from Ghana, Nigeria and Russia but that is not to say they can not come from anywhere in the world.

Hello,

If you want a job fast I would suggest checking out simplyhired.com. I would also put my resume out on Monster.com, if you have not already done so. If you want a security job the security+ is the way to go, but also consider doing a search on monster and simplyhired to look at the skills and certifications that employers are looking for. Pay particular attension to keywords and phrases that they are using. You will know the keywords/phrase because they are repeated in nearly every resume for your chosen career path and/or job title.

How I get Jobs Fast
For example, in my career “system security engineer” and “information security officer” I see the following keywords/phrases over and over: security clearance, cissp, 8500, diacap. If noticed that when I have these keywords on my resume, I get calls almost DAILY from all over the US. Here is how you can do the same:
1) Find a good job title that fits what you do or what you want to do
2) Do a search for that job title [use google, simplyhired.com, monster.com, dice.com or any other search engine/job database]
– Read through the job results and try to find keywords/phrases that seem to be in most or all of the jobs listed
3) Try to get as many of the applicable keywords/phrases in your resume
– Either have the skills required for the chosen job title or begin working toward them
– I am not suggesting that you put lies on your resume, you’ll have to look for job titles that you have experience & skills in
– Don’t mess with stuff that completely out of your league or level of expertise, be honest on your resume
– Sometimes employers will take you if you are willing to learn the skills or earn the require certification/degree in a certain time frame. Put that on your resume.
4) Put your resume [with keywords/phrases in place] online, as many places as you can

Research Employer Demand in certain locations
I am from California and I have been trying for years to find a decent job (for what I do) there. They’ve got them in southern California but almost none in Northern. California seems to be lacking jobs and then they don’t want to pay comparable to the cost of living there. I noticed that Cali has a LOT of networking jobs. If you type in CCNP in simplyhired.com for Cali, you’ll find a lot of good paying jobs. The problem is that CCNP is a very difficult certification to get (or so I’ve heard).

I would recommend checking out what sort of IT skills employers are looking for in the area you want to work. For example, even though I have lots of certifications, most of the ones that I have [that are still active lol] won’t help me for moving back to Northern California. I researched it and found that they are mostly looking for Network Engineers [as of 2006-2010] and my Cisco routing and switching skills are still developing.

Play Capitalisms Game: Start a Business
Another option is to start your own business. This may sound daunting, but believe it or not my website elamb.org qualifies as a business. It took me about 1 year to get it making money, but now it makes between $400 – 800/month without me even looking at it. It has made as much as 2k and I know people who make more in a month then many people make in a year with their blogs. It is becoming harder and harder to be an employee. Companies do the bare minimum to take care of employees, the economy goes in a recession (or worse) and hard working people can not find a job and the value of the dollar flutuates on a downward spiral. It seems the only way to be comfortable in this new “capitalism” is to have multiple streams of income.

If you are interested, start at your states business page and here

Thanks,
Rob E.

thank you for reading this and i hope you answer me back
CHERYL BLACK

YOU SEE, I am such a good procrastinator that I JUST procrastinated on getting to the REAL subject of this article, security, IA updates.

A fellow IA Analyst wrote me with questions that got right to the heart of IA… change.

She asked about AFI 33-202.
And I said:

Right as I felt I had mastered the contents of 33-202, the airforce moved to 33-210 (to replace all its C&A stuff). I believe 33-202 is now obsolete and replaced with 33-200 & 33-202 and others.. last time I was with the AF, anyway.

What about IT LEAN?
I said:

As for IT Lean, you can find that on AF Knowledge Now site and I think they have links to it on EITDR. If you are interested in IT Lean you’ll be REALLY interested in 33-210:
33-210

But if you are working with the Air Force and want more on the IT LEAN process you should be digging into AFCAP, Air Force Certification & Accreditation Program, an AF version of IT Lean.

CNSS 1253:
A lot of people also ask me to send them a copy of the CNSSI 12-53. But it is actually OUT. Its the CNSSI 1253. I, personally, have not had any clear direction (currently NO direction) on how to start moving some of the CNSSI to the systems I work on. I suspect that the Govt. will start this within the next couple of years and start phasing out DIACAP.. but who the hell knows what a bureaucracy of their size will do next!

Lastly, my fellow IA Analyst asked me about EITDR
and I said:

You’ll find the EITDR POCs on the Air Force Portal or Knowledge Now. Log on to the Air Force Portal (if you don’t have an account get one.. you may have to get sponsor by the Govt to get it). Once on the AF Portal search for EITDR and they’ll have tons of stuff on it. Waaaaay more stuff than you want to read. You’ll also find the person you need to start the EITDR process with.