SeanReadsTheNews

NYT: Hackers Can Take Over Your Car

John Markoff of The New York Times hits on a "Panic in the Streets" worthy topic -- remote takeovers of cars by hackers.  It's scary, broadly applicable to the reading audience and there hasn't been a single instance of it happening yet.

Because many of today’s cars contain cellular connections and Bluetooth wireless technology, it is possible for a hacker, working from a remote location, to take control of various features — like the car locks and brakes — as well as to track the vehicle’s location, eavesdrop on its cabin and steal vehicle data, the researchers said. They described a range of potential compromises of car security and safety.

Markoff admits this hasn't happened yet - the story is pegged to an academic study puporting to show it's possible - and also provides additional sources to say that the hackers did need direct access to the car to make it happen.

These academic stories about the potential of technology are important and valuable, but perhaps the headline writers could cool it a bit?

Wired: Why Can't We Stop Botnets

The mighty Ryan Singel comes dangerously close to a "panic in the streets" post today - writing about how botnets defy efforts to destroy them without any victims identified in the story.

Based on his track record, however, we'll give him a pass, particularly since this post is a follow-up to a real news story on the arrest of several hundred cybercriminals last September.

I do love the "cure" recommended by the generic security expert in the story.

For now, experts recommend running patch-checking tools like Secunia PSI as a complement to your antivirus software. Windows PCs remain the most vulnerable, mainly due to their ubiquity. But attacks are targeting Macs, too, as they become more widespread. For true security, Runald suggests buying a cheap Linux netbook for banking.

If that's the answer, Singels' right, the thieves already won.

 

Wired: Facebook Bans Political Ad's Pot Leaf

Ah Facebook - you produce a product that even people who hate it find indispensable.  Why do you always shoot yourself in the foot publicity-wise?

After serving up 38 million ads from a group supporting the legalization of marijuana since August 7, Facebook told the group on August 16 that it could no longer use a pot leaf in its ad, since it might promote smoking.

“The image in question was no longer acceptable for use in Facebook ads,” wrote Facebook spokesman Andrew Noyes in an e-mail to Wired.com. “The image of a marijuana leaf is classified with all smoking products and therefore is not acceptable under our policies.”

And if you've just done something stupid, the last person in the world you want to notice is Wired's Ryan Singel, the sultan of sanity in technology journalism.  Regardless of how you feel about the issue, why does the company insist on inserting itself here?  Now that it has done so, it will be responsible on an ongoing basis for anything that runs in an advertisement, inviting an infinite loop of protest movements and more bad publicity.

In addition, unlike some of the company's missteps over privacy, which at heart were about the company's ability to make money, this is an unforced error.  They weren't going to make or lose any money based on the positioning of the demon leaf in the ad - they just got huffy about anything that is smoked - a really bad issue on which to take a side.

Panic In the Streets: Thieves Stealing SS#s From Children

Bill Draper of the Associated Press reports on a purported trend of identity thieves targeting the social security numbers of children for their clean credit records and low likelihood of noticing a story that intrigues but ultimately fails to deliver the goods.

It's not clear how widespread the fraud is, mostly because the scheme is difficult to detect and practiced by fly-by-night businesses.

But the deception is emerging as millions of Americans watch their credit scores sink to new lows. Figures from April show that 25.5 percent of consumers — nearly 43.4 million people — now have a credit score of 599 or below, marking them as poor risks for lenders. They will have trouble getting credit cards, auto loans or mortgages under the tighter lending standards banks now use.

Another story on a cyber scare that lacks a victim on the record.  That really should be standard for a story like this.

Panic in the Streets: Scammers Target the Jobless

I was excited to get an e-mail from Wired's Ryan Singel today thanking me for a recent post on his "Threat Level" blog for Wired that debunks Internet scare stories.

I'm less excited to bust on USA Today's Byron Acohido again - but he just keeps reporting stories about terrible dangers lurking online without giving me any evidence than anyone has been substantially harmed.  This one is about scam job offers that involves check kiting - sending a fake check to induce the mark into writing a real one.  Trouble is - few are falling for it and those that do are usually saved by the bank before they lose any money.

However, to earn the fee, the recruit would have to execute the transfer within 24 hours. The scam probably only works in a minority of cases, where the fake check is cashed and funds transferred quickly enough to escape detection, Stewart says.

But swarms of attempts are being made. Stewart recently discovered a computer server storing digital images of some $9 million worth of high-quality fake checks, each slightly less than $3,000, written against some 1,200 business accounts.

If the worst damage a scammer does is hurting someone's feelings, is it worth a feature story?

CNBC's Kneale on Wal-Mart Derangement Syndrome

I'm really starting to dig Dennis Kneale's CNBC.com columns on technology, and in particular today's on alarmist columns on Wal-Mart using RFID tags to track the clothes it sells.  It is amazing to me that anyone viewed this as something other than an inventory control device - as if Wal-Mart cares what happens to its shirts once they are paid for.

Um, so what is it I should fear that Wal-Mart will do with this new data horde showing that I just bought a pair of boxers? (Alright let’s stipulate: We’d be less keen on Wal-Mart’s knowing we just bought Spanx.)

The privacy guys always do this—raise well-intended but fear-provoking possibilities at the advent of most any new, promising technology. It is part of what the 1990s Internet sage, Nicholas Negroponte, called the “demonization of bits.” If a salesperson follows us around a store watching our purchases, fine; but use technology to do it and suddenly it’s Orwellian.

I should have included one of the early AP stories on this topic in the "Panic in the Streets" section but since Dennis has done me the favor of writing that post for me, I'll just call it even with this one.

God Bless Ryan Singel: Wired on iDosing

Ryan Singel of Wired's Threat Level blog packs more common sense into a paragraph than whole news networks carry in a month.  Today, he has some fun with what is perhaps the ultimate evening news segment: kids getting high using digital drugs.

I-dosing involves donning headphones and listening to “music” — largely a droning noise — which the sites peddling the sounds promise will get you high. Teens are listening to such tracks as “Gates of Hades,” which is available on YouTube gratis (yes, the first one is always free).

Those who want to get addicted to the “drugs” can purchase tracks that will purportedly bring about the same effects of marijuana, cocaine, opium and peyote. While street drugs rarely come with instruction manuals, potential digital drug users are advised to buy a 40-page guide so that they learn how to properly get high on MP3s.

It's not a parody, Singel includes the Kansas City Channel 9 segment in his post.  Making fun of regional newscasts and their scaremongering segments hardly requires sophistication and wit but it is nice to see at least one outlet calling B.S. on this stuff.  I wonder what the cop interviewed in the TV segment says to his own kids when they announce they have to change schools as a result of his talking about how iDosing can lead to more dangerous activity. 

USAT Finds Health Threat on Airplanes: No Vicitms, However

Gary Stoller of USA Today reports on health inspection failures at the contractors who supply food to airlines.  The FDA found numerous violations but Stoller was unable to uncover a single example of anyone being harmed, entering this story into our ongoing "Panic in the Streets" round-up.

The FDA reports say many facilities store food at improper temperatures, use unclean equipment and employ workers who practice poor hygiene. At some, there were cockroaches, flies, mice and other signs of inadequate pest control.

"In spite of best efforts by the FDA and industry, the situation with in-flight catered foods is disturbing, getting worse and now poses a real risk of illness and injury to tens of thousands of airline passengers on a daily basis," says Roy Costa, a consultant and public health sanitarian.

Conditions open the door to food-poisoning outbreaks, says Costa, a former Florida state food inspector who volunteered to review the FDA reports obtained by USA TODAY.

The article includes ritual quotes from airlines saying they are really trying hard to make sure their contractors don't poison their customers, as well as analysis from a retired FDA inspector who says the violations are serious.

What I don't see is evidence of harm.  Shouldn't there be some if the problem is that widespread? 

Another question the article should have answered is who made the Freedom of Information Act Request of the FDA to release the findings?  It wasn't USA Today or the article would have said so.  Instead, Stoller merely notes that the reports were reviewed by the paper.  I'd like to know 1) who knew enough to ask the question and 2) why it took an FOIA request to get it?  Aren't these the kind of findings the FDA releases on purpose?

The Freedom of Information Act is a vitally important piece of legislation that allows at least a modicum of transparency in government operations.  Who is using and why are the flip side of that transparency.  It wouldn't undermine the data if, for example, the requester turned out to be a trial attorney looking to sue the airlines - but it would add important context to an article that seems explosive but offers very little in terms of specifics about passenger harm.

Finally, the article challenges the caterers and airlines to defend their operations in the face of the report.  Why didn't Stoller challenge FDA management to defend their attempts to keep the report results secret in similar fashion?

WSJ on App Security Risks

Spencer E. Ante today covers potential privacy risks from smart phone applications.

As more companies, governments and consumers use wireless gadgets to conduct commerce and share private information, computer bad guys are beginning to target them, according to government officials and security researchers.

"Mobile phones are a huge source of vulnerability," said Gordon Snow, assistant director of the Federal Bureau of Investigation's Cyber Division. "We are definitely seeing an increase in criminal activity."

What he doesn't do is give Ante a single example of a crime being committed successfully in the fashion described.  The Air Force is quoted about being attacked - unsuccessfully.  There is mention of an App pulled from Android that "could have been modified" to steal bank data and another game pulled because its maker was uploading user contact lists - but nothing about money actually being stolen.

The closest he comes to a successful attack is the kicker:

Some victims are now more cautious. Sara Dellabella, a car saleswoman in Cuba City, Wisc., said she doesn't download as many apps on her Motorola Inc. Droid phone after a malicious game her son downloaded from the Android Market wiped out all of her text messages and personal notes.

When the reporter puts the only real harm in the article in the last paragraph, that's a sure sign that we're dealing with paranoia and not a real threat. 

Panic In the Streets: Tax Scams in USAT

Byron Acohido of USA Today is a long-tenured and very good technology reporter, which is why it is sad to see him saddled with alarmist-but-catchy assignments like reporting that scammers use tax time to ply their trade.  

With the federal tax-filing deadline looming, spam enticing Internet users to fill out bogus forms at faked IRS websites is flooding inboxes. And slick Web page promotions for overnight tax-preparation services and instant refunds are turning up in Google search results and Twitter micro-blog postings.

Be wary, the IRS and tech security experts say. The Web is littered with scams to get you to divulge sensitive information, such as your Social Security number and online account logons. The data are then used in identity theft scams.

My ongoing complaint about this type of article, that you should have to have at least one victim before you can report it, continues.  No one who fell for any of these scams is interviewed and there is no concrete information on any harm being done.

In the past two years, tax-related scams have run longer than other types of scams, as people have months to file their taxes. Criminals are expert at playing off consumer fears of running afoul of the IRS. "Well after tax day, the scams about detecting a problem with the tax return or being owed a refund will still be quite viable," says Randy Abrams, researcher at anti-virus firm ESET.

What percentage of people fall for them?  How much money, on average, do they lose?  What is the victim profile - elderly web surfers, stressed small business owner, first time filers?  Do any of these sound like questions that should be answered before you get feature coverage in a major newspaper?

It's a great platform for "security consultants" to tout their services but not much more.  We already know that any mass activity, from the Super Bowl to celebrity scandals to the new health care bill, political campaigns and yes, taxes, leads to targeted online scamming.  Reporting it each time there is a mass event doesn't add knowledge.