Monthly Archive for November, 2010

Detecting Firesheep

I wrote about Firesheep awhile back. Predictably, a countermeasure has appeared called Blacksheep.

New Firefox Add-On Detects Firesheep, Protects You on Open Networks

If you’re concerned about using open Wi-Fi networks because of Firesheep, the highly popular new hacking tool, you should check out BlackSheep, a Firefox add-on that makes surfing on open networks safe once again.

A Hacker’s Tale

A long but interesting article about Albert Gonzalez, the convicted hacker, in The New York Times Magazine.

After being caught due to the chance observations of a N.Y.P.D. Detective he worked by day for the U.S. Secret Service then went home and enriched himself using information from Secret Service investigations. He used information from government investigations to betray and set-up other hackers, all the while pocketing the money the other hackers paid him for credit card data.

The Secret Service let the fox into the hen-house for sure.

A very interesting read.

Right to Consult a Lawyer?

In R. V. Sinclair (2010 SCC 35, Docket # 32537) the SCC now says that an accused does not have the right to a lawyer during questioning by the police.

The Police must tell the prisoner that he has the right to a lawyer. However, that only means he has to take whatever lawyer he is able to contact at the time the police allow him to try to contact one.  This decision means an accused only has the right to talk to whatever lawyer he can find (usually by telephone) regarding whether he should cooperate or not before the interrogation starts.

Choosing Passwords

Here are a list of articles about password security that resulted from some recent research I was conducting.

Company Registers

The following articles have links to company registers that I am often asked about.

Fraud Not Important Enough to Prosecute In Ontario

Reading the following article makes me wonder what happened to Canada when the Crown refuses to prosecute Tzvi Erez for a $27 million Dollar Ponzi scheme. Ontario Attorney General Chris Bentley obviously doesn’t understand that incompetence is the worst form of corruption.

Accused Ponzi schemer won’t be prosecuted

According to a Sept. 30 memo written by Tencer’s lawyer, Lou Brzezinski, assistant Crown attorney Donna Gillespie told him the charges were dropped “because the courts were tied up with more serious criminal matters [such as rape and murder].”

Brzezinski, whose client invested more than $1.2 million with Erez, claimed Gillespie said that “court time and availability of judges were insufficient … and as a result, hard choices had to be made.”

The Crown also suggested another reason charges were withdrawn was because the victim should have known better.

Assistant Crown attorney Gillespie echoed that consideration when she appeared before court to have the charges withdrawn.

Profiling Circa 1921

How to Analyze People on Sight Through the Science of Human Analysis: The Five Human Types

This 1921 book represents a system of stereotyping people. This book, no doubt, sold to people striving to simplify their understanding others to nurture their biases. I’m sure this is as reliable as Phrenology and terrorist profiling.  (This is also a fine example of what one can find on the Internet if you have too much time on your hands.)

Can You Spot Agent 13?

Would You Believe … Vending-Machine Disguises?

Crime-wary Japanese are resorting to some interesting urban camouflage

DIY High Magnification Webcam

I found a video on how to turn an ordinary webcam into a telescopic surveillance device. This is interesting but I wouldn’t hot glue something to an expensive rifle scope. It would be better to put the webcam on the ocular of a spotting scope. that way if you must use glue, then only the ocular fitting needs replacement as most spotting scope makers have this as replacement part. However, I doubt the image quality would be useful in court.

Offline Wikipedia

If you find Wikipedia to be a useful reference source, then get an offline copy of Wikipedia onto your MS Window machine using WikiTaxi or  Linux users can install Wikipedia Dump Reader from KDE.

Ontario PI Training & Testing

Private Security & Investigative Services – Training and Testing Working Group

November 10, 2010

Training and Testing Working Group

Anyone seeking a licence as a private security guard and/or private investigator has been subject to mandatory training and testing requirements under the Private Security and Investigative Services Act, 2005 as of April 15, 2010.

Since then, the Ministry of Community Safety and Correctional Services has been monitoring the effectiveness of the basic training and testing program, and has recently set up a working group with participants from the Ontario private security industry. The overall objective of the working group is to ensure the basic training and testing program supports the government’s commitment to professionalize the industry and to protect public safety. The key areas of focus for this group are:

  • To review, and if necessary update, the ministry’s training and testing program to ensure the testing component is appropriate and relevant for the industry.
  • To provide a ministry-endorsed test preparation document to complement the curricula for security guard and private investigator training.

As well as participants from the private security industry, the working group also includes the Ministry of Community Safety and Correctional Services, and the Ministry of Training, Colleges and Universities. The group has been put together to ensure a province-wide perspective that includes representatives from the security guard, private investigation and loss prevention disciplines.

The ministry expects to report on the findings of the working group early in 2011.

Business Continuity Writ Large

The BBC bunker they don’t want you to know about

Buried 10 storeys into the hillside is a fully functioning nuclear bunker, built at great expense in 1966, at the height of the Cold War…

Measuring 175ft long, the bunker – known to high command as Pawn: Protected Area Wood Norton – remains ready for service in the event of an attack on London.

On Becoming a Web Worker — The Online Calendar

As you progress in your quest for Web Worker status you need to accept the concept of Web-based collaboration tools.

The first such tool to adopt should be your Calendar.  You may eventually have several, each with its own purpose. In this part of my little dissertation, you will learn how to manage both a shared and a private Calendar.

Google Calendar

Sharing your Calendar and giving access to your office staff will solve a lot of scheduling problems.  Your Calendar can have items from several calendars in it and you will never be lost or go AWOL ever again and you will know what other people are doing.

Security Issues

The first decision is who will have access to you Calendar.

If your office staff and others will have access to your calendar, then you may want to set-up another Google account for the calendar into which they enter events.  This calendar is shared, which means its events will be visible in your main calendar.  This is not entirely necessary but it divorces the shared calendar from your email archive.  You can also share events that you place in your personal calendar with the one you office staff use to enter events for you.

The events entered by other people can then be Copied to your calendar as your own so that you receive notifications of your agenda and individual events entered by other people.  You should look at your calendar every day for items added by other people.

It just sounds more complicated than it is.  You just have to devote set times during the day to answering email and reviewing your calendar.  I do this at 11am and at 4pm daily.

PI’s Hired to Dumpster Dive

Personal data at risk, study found

Some doctors’ offices and car dealers in the Greater Toronto Area got a failing grade after private investigators found easily accessible personal records in their dumpsters.

Hijacking Social Network Connections

The Firesheep Firefox plugin makes it easy to hijack someone’s social network connections. For example, Facebook authenticates the client using cookies. If someone logs on using a public WiFi connection, the cookies are sniffable. Firesheep uses Wincap to capture the authentication information which allows you to hijack the connection.

Protect yourself by forcing the authentication through TLS or stop logging into Facebook using public networks.