eriksmartt.com/blog

More reasons to feel safe

Lately I’ve been putting most of my bookmarks on del.icio.us instead of here, but these three recent articles on WIRED NEWS were worth pointing out:

First, “Known Hole Aided T-Mobile Breach.” We’ve all heard plenty about what’s her name’s Sidekick getting owned, but the less recent T-Mobile breach has me a bit more concerned. According to this article, the back-door wasn’t nearly as elaborate as one would have hoped — it was simply an un-patched version of BEA WebLogic that let Jacobsen in. According to the article, older versions of WebLogic had a “feature” that allowed any file on the server to be read or replaced using an undocumented HTTP parameter. That’s right, someone designing the software decided that they would enable a full-on backdoor, but not tell anyone. You’ve got to be kidding. Worse still is that the flaw was discovered and a patch was issued, but T-Mobile simple failed to update their web servers.

But it get’s better. According to this article, the U.S. Government has decided that there will be “No Encryption for E-Passports.” Well that’s just great. How about just issuing T-Shirts and ball-caps with our social security numbers on them, and requiring travelers to hand out business cards with all their personal information to everyone they see. At least they thought about the issue enough to suggest that wrapping one’s passport in tin foil and duct tape should protect your personal information.

Of course, even with proper security measures, none if it will matter if the people who collect and sell this information don’t care who they sell it to. The article, “California Woman Sues ChoicePoint“, describes a case against ChoicePoint, “a data broker that collects financial, medical and other personal information on billions of people”, for apparently selling personal records to identity thieves.