Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[kitz]

Good Grief! 

I've only briefly scanned the thread as I'm well behind on posts on here, nvm spending time to read it in detail.... but there are some umm interesting comments and theories.

Skilty's post about sums it up for me.   The media always love a juicy story...  what I was politely trying to say in my earlier post because I'd only been exposed to different media reports from TV and newspapers was that I was taking a lot of it with a pinch of salt... and it was pretty damn obvious to me that Sky news appeared to be lapping up the opportunity to overdo the 'Joe Bloggs' lost x amount or nearly lost y amount, whilst anyone with half a clue may realise there wasnt any hard information to tie up the events.    Even my mother who is a technophobe commented about how many scam type phone calls there are and it may not be related.   


{Moderator edited to fix the link to the post so referenced, above.]

[Black Sheep]

Far more intriguing, is how big is your bl00dy house that you pay the window cleaner by cheque    

[broadstairs]

Far more intriguing, is how big is your bl00dy house that you pay the window cleaner by cheque  

I could pay mine by direct debit if I wanted to.... and I dont have a large house!

Stuart

[sevenlayermuddle]

Far more intriguing, is how big is your bl00dy house that you pay the window cleaner by cheque  

Some of us (including I've heard, some of the Royal family) simply don't carry much loose change.   

More seriously, whilst I have no reason to suspect that particular chappie of any wrong doing, in fact I'd refuse to believe it if we was accused, I argue it is a good habit to pay tradesmen by cheque.   Just in case they might have trouble 'remembering' when filling out their tax returns.   

[broadstairs]

The window cleaner called last week, I paid him with a cheque.

That means he now has...

My name (from the cheque)
My partner's name (joint account, so also on the cheque)
My full address.
Our phone number (from above, and BT directory).
The name of my bank.
Sort code.
Account number.
And (one up on the Talk Talk hackers),  a copy of my signature.

We do that all the time, or at least we used to.   And nobody worried about it.   Why is it then, that when the same data we give away freely to total strangers is 'hacked', people and the media suddenly assume it's terribly dangerous?

I think the problem with the TT hack was that initially no one knew what had been taken, and because TT obviously (to me) knew that IF their main core systems HAD been hacked then all sorts of financial information COULD have been taken which COULD have resulted in folks bank accounts being targeted and potentially emptied. My view is that their core system does NOT have the required encryption of financial data and I suspect we are seeing a significant delay in their website coming back precisely because they are right now encrypting everything in sight in the core just in case a potential new hacker does manage to get in to it.

Stuart

[sevenlayermuddle]

I think the problem with the TT hack was that initially no one knew what had been taken, and because TT obviously (to me) knew that IF their main core systems HAD been hacked then all sorts of financial information COULD have been taken which COULD have resulted in folks bank accounts being targeted and potentially emptied. My view is that their core system does NOT have the required encryption of financial data and I suspect we are seeing a significant delay in their website coming back precisely because they are right now encrypting everything in sight in the core just in case a potential new hacker does manage to get in to it.

I don't really buy the encryption thing, because anything that is encrypted can be decrypted.   It can be decrypted by guesswork, or by brute force, or by finding a flaw in the algorithms or if all else fails, by slowly pulling out the toenails of somebody who knows the password.

What worries me most is, if we allow the notion to prevail that "encryption saveguards data", we may find that organisation progress to storing more and more data, of a more and more personal nature, on the assumption that "as long as it is encrypted they'll be off the hook".

[broadstairs]

While I agree that encryption does not prevent data theft or make it more secure of itself real encryption can make it harder for anyone to use the data and it takes a very long time to decrypt several 1000's of peoples data using brute force.  All the time people succeed in getting data by hacking that is not encrypted then it is like leaving the door to the safe open, at least with the safe closed all you get initially is the safe, and breaking into it may destroy the contents. As I think I said before detection of unauthorised entry into systems is something all corporations should be investing in as well as doing things like encryption. You have to do lots of things which I suspect TT were not doing.

Stuart

[sheddyian]

Perhaps Im cynical, but Im not sure if I believe that all 'scam' incidents were directly related to the most recent breach of security and some may have been co-incidental.   I'm also unsure as yet to the extent of the involvement of the 17 y/o youth.

I'm very much the same; as soon as the news was reporting customers who had lost money through scams, I could see no reason why these were connected to the recent data theft.  We know that scammers have (some?) TT account data from a while back, and are presumably still using that. 

Likewise with the 17yo kid, he could have simply submitted the ransom email "as a laugh" without considering the consequences, or posted some (fake?) data to pastebin etc etc. 

What we can learn from all of this is it's unlikely we'll get an accurate picture from any mainstream news service that doesn't seem to understand anything technical (or wants to chase particular angles, ignoring inconvenient facts along the way).

This is a great shame.

Ian

[AArdvark]

I agree that encryption alone is no protection but is not security a game of layers.
The idea is to combine a number of techniques to make the cost of trying to get the data too high compared to other targets, at a minimum.
Encryption does have value otherwise no one would use it or test it or keep developing 'new/better' methods etc.
It may be misused or misunderstood but that is a different set of issues.
Basic things like only keeping data you need and only allowing access to data from the internet when necessary would also help.
If you are reasonably going to treat 'pulling of toenails' etc as a serious threat then the data needs to be isolated from external access and/or stored somewhere that is geared up to withstand all serious attempts to force access, including protecting the data from unauthorised access by having key stakeholders with security access guarded from kidnap etc or needing simultaneous key entry at multiple secure locations. [Of course costs goes up as security gets more paranoid ]
The issue is one of understanding what security you really need and being prepared to pay what it costs to reach and maintain that level of security.
Many companies do not understand fully what they need (this does not mean they have not been told) or feel that cutting a few corners is worth the risk to save costs.
Until the true costs of these sorts of 'events' are known and publicised, the risks will continue to be underestimated or undervalued in terms of their financial hit on the company *after* the event.

In short, encryption has its place but is only one of many techniques to secure data. One that is relatively cheap to implement and can complement other security methods well.

[sevenlayermuddle]

Apologies for any factual/mathematical innacuracies in what follows... I am not a mathematician or cryptologist, though I do believe I have a basic understanding...

Encryption was developed for the purposes of protecting communications from eavesdroppers.  From the earlest letter-shifting techniques, through Germany's Enigma machines in WW2, and beyond to current RSA methods, all have served their purposes well.  At least until each, in turn, was worthwhile dedicating some serious mathematical brainpower (as in Enigma) to defeating it.

Per communications data I find current technologies very convincing indeed, to the extent I trust them completely.  As far as I understand the technology, the maths of prime factorials, while unproven, are widely acceptable as being good, and keys are machine generated and evaporate after the communications is complete, so nobody's toenails to pull.

But the real distinction that worries me is nowadays, people think encryption can be used not just to protect communications, but also to protect stored data.   That is my criticism,  based on all historical precedent they are wrong.  If if the data is that sensitive then I would say either...

A) don't store it
or
B) ensure that nothing bad will happen if it escapes
or
C) accept that if it escapes it is your own fault, the fact it was encrypted is no defence at all.


I have not the slightest doubt the day will come when somebody finds a mathematical flaw in prime factorials and RSA.   It will come as a shock, but no more of a shock that cracking Enigma was to 1930s Germany.   But when that day comes, I shall feel vindicated that I have no online bank accounts.   

[broadstairs]

I shall feel vindicated that I have no online bank accounts.   

You may not USE online banking but that does not mean your data could not be exposed if your Bank was hacked, it just means that your security methods used to access data online cannot be collected 

Stuart

[sevenlayermuddle]

You may not USE online banking but that does not mean your data could not be exposed if your Bank was hacked, it just means that your security methods used to access data online cannot be collected 

Stuart

It means I have never agreed to the liability shifts buried in the T&C of online banking, so if the bank is hacked they cannot blame me, or accuse me of disclosing my own account details.

[sevenlayermuddle]

Back on topic, BBC are reporting another arrest, a 16 year old.

[broadstairs]

This morning the BBC are reporting a 20 year old in Staffordshire has been arrested in connection with this hack.

Stuart

[sevenlayermuddle]

And another arrest, another 16 year old.

http://www.bbc.co.uk/news/uk-34717572

I've mixed feelings here, seems a pity if what might have seemed to them like a 'prank' ends up ruining these kids' lives.   Even a police caution is a blight these days, being effectively a criminal record that must be declared long for evermore (eg if applying for foreign travel Visas).

Yet if a 16 year old were to steal my car, I'd want to see him (/her) serve a very long prison sentence.