Tag Archives: Chief Executive

The Battery DDOS: Tip of An Iceberg

An interesting story brewing about the FBI investigating a DDOS (Distributed Denial of Service) attack on websites selling batteries. But the reporting does not go far enough: In fact, a little research reveals this is part of a much bigger assault on a range of industries.

As a starting point, look at Elinor Mills of the excellent Insecurity Complex at CNET:

U.S. battery firms reportedly targeted in online attack | InSecurity Complex – CNET News: “The FBI is investigating denial-of-service attacks targeting several U.S. battery retail Web sites last year that were traced to computers at Russian domains in what looks like a corporate-sabotage campaign, according to documents published yesterday by The Smoking Gun.”

But a closer look at the source documents suggests this is just the tip of a much bigger iceberg. The Smoking Gun incorrectly reports the email address used by the alleged hacker, a St Petersburg man called Korjov Sergey Mihalivich, as lvf56fre@yahoo.com. In fact, the FBI lists it as lvf56kre@yahoo.com, which yields much more interesting results. Such as this one, from ShadowServer.

ShadowServer shows that the domains under that person’s control, globdomain.ru (not globdomian.ru as reported by the Smoking Gun) and greenter.ru, have been prolific since 2010 in launching DDOS attacks against 14 countries and more than 30 industries and government websites. An update from ShadowServer in January 2011 counted 170 “different victims. Again, these attacks are across many different industries and target some rather high profile sites.” (It doesn’t identify them.)

The DDOS attacks use the BlackEnergy botnet, described by Arbor Networks’ Jose Nazario in a 2007 paper [PDF]. Back then Nazario reported the botnet’s C&C systems were hosted in Malaysia and Russia.

The same email address used for those two domains has registered other domains: trashdomain.ru, which has been recorded as the host for a Trojan dropper called Microjoin.

In other words, this is a lot more than about batteries. This appears to be a DDOS for rent to businesses wanting to take out business rivals in a host of fields. Indeed, the FBI investigation makes this clear, and cites the $600,000 damage caused as included attacks on “a wide range of businesses located in the United States.” (This does not include the dozen other countries affected, hence, presumably, the quite low sum involved.)

The batteries attack took place in October 2010, but the FBI document makes clear that as of May 2011 the attacks were still going on.

At present it’s not clear who is behind these attacks–in other words, who is paying for them. This could be a ransom attack–pay up or we will keep DDOSing–but this doesn’t seem to be the case, as Batteries4less.com Chief Executive Coryon Redd doesn’t mention any such approach in an interview with Mills. He seems to believe that “[t]he competitor is going to be U.S.-based and contracting out with a bad guy in Russia.”

Could be right. In which case the investigation has stumbled on a dark world of business tactics stretching from banking to astrology consultants. More research needed, please.

Media: Reducing Story Production Waste

In trying to change news to match the new realities of the Interwebs, media professionals are still somewhat stuck in old ways of doing things. One is to fail to address the massive waste in news production–or at least parts of it.

So what potential waste is there? Well, these are the obvious ones:

  • Gathering: Reporters/trips/stories per trip/matching other outlets
  • Editing: The number of people who look at a story before it is published/time a story takes to work through the system

I’m more interested, however, in the amount of waste from material generated. Think of it like this:

Inputs:

  • Story idea
  • Logistics (travel/communications/reporting tools)
  • Interviews, multimedia and other material generated

Outputs:

  • Story
  • Photo
  • ?Video

Wastage:

  • All content not used in story (some may be reused, eg photos, sidebars but rarely)
  • All content used that’s not reused/repurposed.

This seems to me to be extremely wasteful in an industry in so much pain. Any other industry wouldn’t just look to pare back on factors of production but to also minimize the waste generated.

Any journalist will know just how much we’re talking about. Say you interview five people for a story. Even a stock market report is going to involve five interviews of at least five minutes. At about 150 words a minute that’s nearly 4,000 words. The stock market report itself is going to be about 500 words, maybe 600. That’s a 3,600 words–say 2,500, allowing for the reporter’s questions, and some backchat–gone to waste. For 500 words produced we had to throw out 2,000.

Yes, I know it’s not a very scientific way of doing things, but you get my point. Most journalists only write down the quotes they need for the story, and many will delete the notes they’ve taken if they’re typing them on the screen in the same document they’re writing the story on. So all that material is wasted.

A good reporter will keep the good stuff, even if it’s not used in the story, and will be able to find it again. But I don’t know of any editorial system that helps them do that–say, by tagging or indexing the material–let alone to make that available to other reporters on the same beat.

This is where I think media needs to change most. It needs to assume that all material gathered by journalists, through interviews, research, even browsing, is potentially content. It needs to help journalists organise this material for research, but, more importantly to generate new content from.

Take this little nugget, for example, in a New York Times, story, Nokia Unveils a New Smartphone, but Not a Product of Its Microsoft Deal – NYTimes.com: The reporter writes of the interviewee, Nokia’s new chief executive Stephen Elop: ”During the interview, he used the words “innovate” or “innovation” 24 times.”

I really like that. It really captures something that quotes alone don’t. We would call it “interview metadata”–information about the interview that is not actual quotes or color but significant, nonetheless.

Whether the journalist decided to count them early on during the interview, or took such good notes a keyword search or manual count after was enough, or whether he transcribed the whole thing in his hotel room later, I don’t know. (A quibble: I would have put the length of the interview in that sentence, rather than an earlier one, because it lends the data some context. Or one could include the total number of words in the interview, or compare it with another word, such as “tradition” or something. Even better create a word cloud out of the whole interview.)(Update: here’s another good NYT use of metadata, this time the frequency of words in graduation speeches: Words Used in 40 Commencement Speeches – Class of 2011 – Interactive Feature – NYTimes.com)

The point? Elop is an executive, and he has a message. He wants to convey the message, and so he is using carefully chosen words to not only ensure they’re in any quote that’s used, but also to subliminally convey to the journalist the angle he hopes the journalist will adopt. By taking the interview metadata and presenting it separately, that objective, and strategy, will be well illustrated to the reader.

And, of course, you’ve reduced the story production wastage, or SPW, significantly.

Media can help this process by developing tools and offering services to maximise the usefulness of material gathered during research and interviews, and to reduce the time a journalist spends on marshalling this material.

Suggestions?

  • Transcription services, where journalists can send a recording and get the material back within the hour (or even as the interview is conducted, if the technology is available).
  • Push some of the content production to the journalist: let them experiment with wordclouds and other data visualization tools, not only to create end product but to explore the metadata of what they’ve produced.
  • Explore and provided content research and gathering tools (such as Evernote) to journalists so they don’t have to mess around too much to create stuff drawing on existing material they’ve gathered, for the story they’re working on, from previous research and interviews, and, hopefully, from that of colleagues.

A lot of my time training journalists these days is in these kinds of tools, and I’m always surprised at how little they are made use of. That needs to change if media is to find a way to make more use of the data it gathers in the process of creating stories.

Cabin Fever

Flight International reports (sorry, can’t find a link, but here are some similar stories from Thisislondon and New Electronics) that “BAE Systems and its research partners have completed initial tests with an in-cabin computer vision system intended to identify suspect behaviour by potential terrorists.” Seems the system involves cameras in the cabin with software that analyses the image “for movement or other actions that indicate an unruly or potentially dangerous individual, whether seated or standing.” Some of this, says BAE Systems Advanced Technology Centre human factors specialist Katherine Neary, involves face recognition. Given most people behave badly on airlines, I think they’re going to have to tweak their algorithms if they don’t want to subdue everyone on the flight.

I think I’d prefer an airline like Thailand’s Nok Air, which takes a friendlier attitude to passengers. According to Flight, the low-cost carrier “is expanding its fleet Boeing 737-400s and its fleet of scantily-dressed “PDA girls”” who help check-in passengers that only have carry-on bags. Chief executive Patee Sarasin tries not to sound surprised when he says “It’s been fantastically well received”. Of course he then spoils it by adding: “It is very efficient and costs you less than $4.00 a day to have these girls walking around in Thailand.”

Nok
Khun Patee’s walking check-in counters

 

The Long Tail of the LongPen

Writer Margaret Atwood launched her LongPen invention over the weekend, allowing authors to sign books over the Internet. As CTV.ca, Canada’s CTV news reports, a technical glitch marred the LongPen’s first test:

Atwood and fans had to wait while the invention got some final adjustments. When it came back to life, she used the LongPen to sign a copy of her new book, The Tent, for Nigel Newton, chief executive of Bloomsbury. While Atwood talked with Newton over a video linkup, the LongPen mirrored her hand motions and signed Newton’s book. She then signed books for her Canadian fans in Guelph, Ont., far across the Atlantic Ocean.

The idea here is a simple one: Atwood got sick of the demand of book tours, especially when she was being asked to be in more than one place at the same time. Finding that no device existed which allowed her to sign books without actually touring, she set up the Unotchit company in 2004. She hopes the LongPen can also “help authors sign books for readers in places not normally on promotion tours, such as small towns or countries.”

There’s been a lot of criticism about this. How dare an author sign by remote control? How can authors be close to their readers if they don’t even turn up for book tours? I only know a couple of famous authors, and my understanding is that book tours take up a ridiculous amount of time for very little actual purpose. Book signings are either crowded or empty, radio interviews inane and pointless, and all this saps the energy of the writer who would, presumably, be much happier back home penning their next tome.

The only problems I can see with this are if the gadget goes wrong and makes a mess on someone’s new book, or if the author mishears the intended dedication. I think on the whole it will add to the mystique. Who has ever met an author hero and found her/him to stand up to our expectations? Much better to be a hazy image on a screen and a disembodied pen scratching over a page of a proferred book. Plus it will, in theory, allow smaller booksellers to get a slice of the book-signing action, as well as authors with only a small but loyal audience to get a glimpse and a signature out of their heroes.

The Big Credit Card Theft

Trying to make sense of the massive theft of credit card numbers at CardSystems, ‘a leading provider of end-to-end payment processing solutions focused exclusively on meeting the needs of small to mid-sized merchants’, in which information on more than 40 million credit cards may have been stolen.

CardSystems itself has issued only a brief statement on its website (no permalink available) saying it had identified

a potential security incident on Sunday, May 22nd. On Monday, May 23rd, CardSystems contacted the Federal Bureau of Investigation. Subsequently, the VISA and MasterCard Card Associations were notified to alert them of a possible security incident. CardSystems immediately began a remediation process to ensure all systems were secure. Additionally, CardSystems immediately engaged an independent 3rd party to validate systems security.

Notice the careful language: It talks only of ensuring all ‘systems were secure’ — in the security industry this is like checking all the locks work while watching all the horses bolting off down the street. (And don’t the FBI work on Sundays? Why wait a day to let them know?)

Then there’s the question: Why wait almost a month to let us know? A separate story by AP quotes CardSystems as saying that

it was told by the FBI not to release any information to the public. The company says it’s surprised by MasterCard’s decision to go public.

Actually, not so, say the FBI: Another AP story quotes an FBI spokeswoman, Deb McCarley, as denying

that the agency told CardSystems not to disclose the existence of the intrusion. McCarley says the FBI told CardSystems to follow its corporate policies without disclosing details that might compromise the ongoing investigation.

In fact, a MasterCard statement suggests that it was they, not CardSystems, who first identified the breach:

MasterCard International’s team of security experts identified that the breach occurred at Tuscon-based CardSystems Solutions, Inc., a third-party processor of payment card data. Third party processors process transactions on behalf of financial institutions and merchants.

Through the use of MasterCard fraud-fighting tools that proactively monitor for fraud, MasterCard was able to identify the processor that was breached. Working with all parties, including issuing banks, acquiring banks, the processor and law enforcement, MasterCard immediately launched an investigation into the breach, and worked with CardSystems to remediate the security vulnerabilities in the processor’s systems.

In the meantime CardSystems was pretending it was business as usual, including an announcement on June 14 of a move into check processing, and posting job-ads for a ‘Software Quality Assurance Analyst’ to cover, among other things, ‘troubleshooting from operations, production, and outside vendors’ who can work ‘in a very fast-paced, high-visibility organization where priorities often change’. Indeed.

Anyway, the scale of the thing is pretty awesome: Softpedia quotes experts as saying

that this is the worst case of data theft in IT history. “In sheer numbers, this is probably one of the largest data security breaches,” said James Van Dyke, principal analyst at Javelin Strategy & Research in Pleasanton, Calif.

And just how did the theft happen? Details are sketchy, probably because no one yet knows (the MasterCard software which identified the fraud did so by monitoring transactions, not the actual breach. In other words, they observed the stolen goods being peddled, not the actual break-in). According to another AP story, MasterCard has identified CardSystems as being ‘hit  by a viruslike computer script that captured customer data for the purpose of fraud’, but hasn’t given any more details. CardSystems itself is not talking:

CardSystems’ chief financial officer, Michael A. Brady, refused to answer questions and referred calls to the company’s chief executive, John M. Perry, and its senior vice president of marketing, Bill N. Reeves. A message left for Perry and Reeves at the company’s Atlanta offices was not returned.

Both Perry and Brady have been with CardSystems a little over a year.

How Bad Was Sasser?

Just how bad was Sasser? Here’s a list, courtesy of F-Secure, of places and companies affected by the worm:

  • County hospital in Lund, Sweden (5000 computers and X-ray equipment offline)
  • European Commission in Brussels (1200 machines offline)
  • Coastguard in UK (19 regional offices offline)
  • British Airways in UK (flights delayed)
  • Westpac Bank in Australia (offices and call centers closed)
  • Post Office systems in Taiwan (1600 machines offline, 400 offices affected)
  • Heathrow airport in UK (computers at one terminal offline)
  • Public courts in Cantabria, Spain
  • Hong Kong government systems
  • State hospital of Hong Kong
  • Suntrust Bank in USA
  • American Express in USA
  • Nova University in USA

In other words, quite a lot. Part of the problem is that it hit at the weekend — probably deliberately. Very few institutions keep their tech support at full levels then — some don’t have any at all. That, or they use weekends to perform upgrades, which leaves systems even more vulnerable.

The Australian Financial Review quoted David Morgan, chief executive of Westpac Bank, as saying that the bank was in the midst of installing the three-week old patch which would have protected it against Sasser when the worm hit. “The perpetrators of the virus moved more quickly than us . . . and caused that disruption to our network,” David Morgan was quoted as saying. Result: 800 computers knocked offline and staff forced back to pen and paper for nearly two days.

Column: Under the Wire

UNDER THE WIRE

From 26 June 2003 edition of the Far Eastern Economic Review (c) 2003, Dow Jones & Company, Inc.

You’re Fired

SMS, or text messaging, is great for staying in touch but isn’t so hot for conveying bad news. A recent spate of dismissals via SMS — staff of British insurer Accident Group, for example, were notified by administrators from PricewaterhouseCoopers that they were being laid off and would no longer be paid — raises interesting ethical and legal questions about the medium. The new chief executive of Britain’s Vodafone Group, Arun Sarin, is taking no chances: His contract says he cannot be fired via “electronic mail or any other electronic messaging service.”

More on Spam

If you need more evidence that spam is big business, try this: DoubleClick, better known for its on-line advertising strategies, on June 12 announced initiatives “to further differentiate legitimate marketing communications from spam.” Given that I’ve seen very little difference in tactics between spammers and “legitimate marketing communications” I don’t find this particularly reassuring. Here’s something else: CNET, an on-line magazine, reported last week on a legal dispute between two anti-spam software makers over patents for something called challenge-response technology, which allows an e-mail recipient to check out the sender to see if he’s [a] a person, and [b] the person he says he is. The recipient receives an e-mail asking for verification, and if the e-mail goes unanswered, the e-mail gets dumped. Nice idea, but not rocket science, in my view, and kind of time wasting. Still, Mailblocks and Spam Arrest have been slugging it out, at least until a Washington district court denied Mailblocks a preliminary injunction. I stick by my advice: Go with free software developed by people genuinely committed to ridding us of spam, not to making money out of it. My Bayesian Filters from POPFile are working wonders: In the past week only five bits of spam have reached my inbox. But if you want to try out commercial solutions, here are a couple: AlienCamel [www.aliencamel.com], allows you to select what e-mails you want to allow through, and Spam Slicer [www.spamslicer.com] provides each user with a virtual e-mail ID, so the user can tell where a spammer got his name and can block subsequent spam from that source even if the spammer changes his e-mail address.

Keep Out the Hackers

Talking of sleaze, Zone Labs Inc. [www.zonealarm] have just released a new version of their excellent ZoneAlarm firewall program. If you have a computer connected to the Internet then you should have a firewall, software that does its best to prevent ne’er-do-wells from getting in, either to steal pictures of your dog’s wedding, or to use your computer to attack other computers. ZoneAlarm Pro 4.0 improves its security features, including one that examines not just inbound but outbound e-mails for harmful file attachments — usually a kind of virus called a worm. Another innovation gathers data on suspected hackers, helping security experts to track and report them to their moms. ZoneAlarm Pro sells for $50; a free version of the earlier model is still available, and should be enough for us amateurs.

 

Loose Wire: Here’s Where The

Loose Wire: Here’s Where The Party Is

By Jeremy Wagstaff
from the 7 February 2002 edition of the Far Eastern Economic Review, (c) 2003, Dow Jones & Company, Inc.

The Internet is like a teenage party: lots of groping around in the dark hoping to bump into something worth telling your friends about later. And like a teenage party, chances are you’ll be hanging around sipping warm Coke with the complexion-challenged in the kitchen, unaware that all the action is taking place in the basement.

Weblogs may be the answer to this finding-the-action problem. Weblogs are Web pages built by real people, blessedly free of corporate-speak and ubiquitous images of tall, shiny skyscrapers, smiley people gazing intelligently into laptops, or besuited business types shaking hands.

Weblogs are where the real action is. They are the creation of individuals, usually musings on national, local or personal events, links to interesting articles, a few lines of comment or discussion collected and presented by one person. Weblogs are a milestone in the short history of the Internet.

They first appeared in 1997, according to Rebecca Blood in her excellent history of the Weblog form’s development (www.rebeccablood.net/essays/weblog_history.html). By early 1999 it was shortened to “blog.” Blogs took off with the advent of Web-based programs to set up and maintain sites without fiddling around with lots of formatting. The most popular of these is Blogger (www.blogger.com) which maintains 350,000 blogs, according to Evan Williams, chief executive of Blogger and something of a legend in the blogging community.

Although the media hype has faded, blogs show no sign of going away. Of those 350,000 blogs, 20% were published in the last month. Williams says new users are signing up at an average of 1,300 a day.

For The People, By The People

It’s not hard to see why. Blogs are probably unique in that they allow ordinary people to put things on the Net easily, and yet to feel that the space in some way reflects and belongs to them. “There are other things that can work on the Web — it’s a highly flexible medium, obviously — but the blog format is one of the ‘natural’ formats for Web publishing, and this is a big reason it’s taking off,” says Williams. Given that the original promise of the Web as a levelling medium — as open to ordinary folk as to big press barons — has faded in recent years, this is good news.

I won’t recommend any specific blogs, since it’s a personal thing, but here are some places to start: Linkwatcher (www.linkwatcher.com), a kind of real-time monitor of selected blogs; Weblog Review, where blogs are reviewed by other bloggers (www.theweblogreview.com); or the more earthy BlogHop (www.bloghop.com) which stores some 8,779 blogs, most of them deeply opinionated.

Part of a blog’s charm is simplicity. In most cases it’s just text, simply but elegantly laid out. Pages are quick to load. The content is concise and measured. The more you read a blog you like, the more inclined you are to trust the author’s choice and follow the links offered. And, of course, it’s free.

There are, of course, downsides. The sheer plethora of blogs makes finding one you like difficult. Indexes of blogs are few and far between and most don’t give much idea of what lies therein, beyond a usually short and obscure title. And there’s a lot of rubbish out there — overly introspective bleatings of the terminally unhappy, irrational whingings — as well as blogs that don’t get updated and just take up Web space.

So where is it going? I’d like to think that blogs do what the much vaunted portal of the dotcom boom failed to do: collate, filter and present information from other sources, alongside comment. Bloggers — those that blog — will be respected as folk who aren’t journalists, or experts in their field, but have sufficient knowledge and experience to serve as informal guides to the rest of us hunting for stuff on the World Wide Web.

There’s not much money in this, though doubtless they’re likely to upset the media barons who realize that their carefully presented, graphics-strewn home pages are being bypassed by blog-surfers stopping by only long enough to grab one article. But that may be the future: The editor that determines the content of our daily read may not be a salaried Webmaster or a war-weathered newspaper editor, but a bleary-eyed blogger in his undershirt willing to put in the surfing time on our behalf.

Who knows? We may even be willing to pay to read their blogs. As long as there are no grinning, laptop-carrying hand-shakers in sight.