Author: mrkoot

WANTED: Journal of Negative Results in Security, Privacy and Surveillance

Posted on by mrkoot

Biomedicine has a Journal of Negative Results in Biomedicine, edited by Bjorn Olsen from Harvard. Could a Journal of Negative Results in Security and Privacy be viable? Perhaps it’s quixotism, considering the persistent lack of reliable metrics to measure even positive outcomes in these domains. But the absence of “it should do X”-criteria does not imply impossibility to establish “it should NOT do -X” or “it should not do Y”-criteria. Marked for further deliberation.

Study Materials on Cyberwar, Intelligence and Security Services

Posted on by mrkoot

Here’s a list of (mostly) books about cyberwar, intelligence and security services.

Materials about Netherlands

Not specifically about Netherlands

Cyberwar-related
(thx Niels Groeneveld)

What additional study materials do you recommend? Please comment!

    Meta-Data in Public Documents, Cont’d

    Posted on by mrkoot

    For fun, I extracted metadata from most of the documents publicly available at these websites:

    aivd.nl
    belastingdienst.nl
    cia.gov
    ctivd.nl
    defensie.nl
    eerstekamer.nl
    europol.eu
    fbi.gov
    gchq.gov.uk
    minbuza.nl
    mindef.nl
    nsa.gov
    officielebekendmakingen.nl
    om.nl
    overheid.nl
    politie.nl 
    rijksbegroting.nl
    rijksoverheid.nl
    sis.gov.uk
    tno.nl
    tweedekamer.nl

    Here is a count of e-mail addresses I found in Tag_AuthorEmail and Bytes:

    1    accor.com
    1    aesn.fr
    1    agentschapnl.nl
    1    atech-acoustictechnologies.com
    1    bda.amsterdam.nl
    1    bieleveldvanhoek.nl
    1    bletchleypark.org.uk
    1    brgm.fr
    2    cbs.nl
    2    cesg.gsi.gov.uk
    1    coe.int
    1    CvT.nl
    1    diplomatie.gouv.fr
    3    ec.europa.eu
    2    ecologie.gouv.fr
    4    eerstekamer.nl
    1    europolhq.net
    7    fbinet.fbi  <— internal FBI mail
    1    gakushikai.jp
    2    gchq.gsi.gov.uk
    1    gmail.com
    2    hotmail.com
    1    hydro.nl
    6    ic.fbi.gov
    1    inro.tno.nl
    1    isc-cie.com
    1    iwiweb.nl
    1    kabinets-formatie.nl
    1    klpd.politie.nl
    7    leo.gov
    1    let.ru.nl
    1    mail.ing.unibo.it
    3    militairefondsen.nl
    2    minbuza.nl
    14    minbzk.nl
    1    mindef.nl
    7    minfin.nl
    22    minjus.nl
    3    minlnv.nl
    8    MINSZW.NL
    1    minvws.nl
    1    mma.es
    1    mrw.wallonie.be
    2    noord-holland.nl
    1    oieau.fr
    1    olemiss.edu
    1    prv.gelderland.nl
    1    ross.nl
    1    sdu.nl
    1    SMOJMD.USDOJ.gov
    5    sp.nl
    1    sp.se
    1    steunfondsofficieren.nl
    2    tg.nl
    3    tk.parlement.nl
    1    tmleuven.be
    2    tno.nl
    146    tweedekamer.nl
    2    unesco.org
    2    uwv.nl
    2    wereldschool.nl
    1    wwi.minbzk.nl
    1    wxs.nl
    1    xs4all.nl

    Furthermore, these are some network/directory paths found in Title and Hyperlinks tags:

    http://cd0.bistro.ro.minjus/cgi1frnt.exe
    Sggv12fkdbbTemplates GMODCDC-kl+DB 2.jpg
    VAF0002groups03$COAlHDPDPLMAPMPmm100 Projecten190 Business Proces Redesign296Fase 11a-04-Digitaliseren formulierenPi Digitale formulierenkastLogo defensie.gif
    tante-eshome$LienekeSdatapdfHeffingsverordening Marktgelden Zeeburg 2009, tabel 2009.d…
    sk1ntdata03homedir$MRoosDesktopTekening deel 1.xps
    U:wp51wp51verlof tbsgesteldeverlof tbs gestelde 7-7-2010.wpd
    N:HDP AIMPF GO4 Processen99. Financiële werkinstructiesWerkmap Gerard3TekentjesLogo defensie.gif
    T:_PPentaBP Badge.jpg
    F:dataProjectenCivTecGroenBomenbeleidsplanBomenbeleidsplan 25-10-2010 Totaal (1)
    G:Realisatie en BeheerTeam Vastgoed en ProjectenStedenbouwKimAlgemeenkomgrenzenkomgrenzen Layout1 (1)
    sfgvp12FEBCOBiaProjectenZeusZeuswerkODPPwerkChrisLogo´sdefensie.wmf, sfgvp12FEBCOBiaProjectenZeusZeuswerkODPPwerkChrisLogo´sdefensie.wmf, sfgvp12FEBCOBiaProjectenZeusZeuswerkODPPwerkChrisLogo´sdefensie.wmf
    V:SHAREDNICS SHAREDEDASDRAFTSKisnerOPS 2008FINAL OPs 2008Copy of 2008 NICS OPERATIONS REPORT PDF.wpd
    V:SHAREDNICS SHAREDEDASDRAFTSKisnerOPS 20072007 Operations Report PDF.wpd
    H:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2006 NICS Operations Report PDF.wpd
    N:AutocadMedewerker TVDBStrooiroutes Berkenwoude (1)
    /cgi-bin/pdcsns.cgi?user=%26dir=/9202000/g/%26filename=/9202000/t5.sns%26via=direct%26v01=25910
    C:WpdocWORD97LogoConsLogoCons.jpg
    C:Documents and Settingsu0072s1Local SettingsTemporary Internet Filesu0072s1Local Settingsu00a110Local SettingsLocal Settingsu00g5m0Local SettingsTemporary Internet FilesOLK12wetsuwior1tog00.htm

    Public Figures and Their Personal Data

    Posted on by mrkoot

    Politicians are public figures and therefore have reduced reasonable expectations of privacy. The Dutch House of Representatives provides information about all 150 representatives in a single XML file: http://www.tweedekamer.nl/xml/kamerleden.xml (mirror of today’s copy; also in Google-cache, but not archive.org). Some of the personal information it contains (not all values are present for all representatives):

    1. full name
    2. gender
    3. date of birth
    4. place of birth
    5. home town
    6. education
    7. work experience
    8. work e-mail (@tweedekamer.nl)
    9. travels 
    10. personal website
    11. personal statement
    12. (past) affiliations w/foundations, associations
    13. political affiliation
    14. photo 

    When stumbling upon that file, the following thoughts came to mind:

    • I hope these public figures don’t use that information as password or answer to security question in their private life.
    • With personal data being readily available, these high-profile targets surely must have already been victim (although maybe not be aware of it) of password-guessing and social engineering attacks?
    • If they aren’t, is that…
      • …because nobody cared to target them?
      • …because this particular knowledge does not pose a threat?
        • …because their personal subscriptions/service-usage is unknown?
          • E.g. you don’t know they use Gmail, which bank, insurance, webshops.
        • …because their personal logins/names are unknown?
          • E.g. you know they are customer/employee/student at X but you don’t know their username for logging in to X
        • …because this personal info was not used as password or answer to a security question?
          • E.g. you know <username>@gmail.com but can’t guess the password
        • …because this personal info is, by itself, insufficient to compromise accounts?
          • E.g. more information is needed (SSN, bank account number), or multifactor authentication requires possession of token
      • …because of something else?

    In a sense, our representatives function as guinea pigs for testing assumptions about the risk associated with disclosing personal data — or rather, at least with disclosing this particular personal data. Disclosing SSN, bank account numbers, credit card numbers and DigiD credentials probably remains a bad idea.

    UPDATE 2011-04-23: I suddenly realize that A Study on the Re-Identifiability of Dutch Citizens (.pdf) presented at HotPETS 2010 is relevant here. Guido van ‘t Noordende, Cees de Laat and I studied registry office (GBA) data of 2.7 million Dutch citizens (~16% of the total population) to explore their identifiability by various quasi-identifiers consisting of partial or full postal code, partial or full date of birth and gender. We also included this one (tables 2 and 3 in the paper):

    QID = { town + date-of-birth + gender }

    The median anonymity set size was 2, meaning that half of the combinations of town + date of birth + gender in our data set either unambiguously identified an individual (Dutch citizen), or a group of only 2 individuals. The numbers vary depending on town size, but for ~37% of Dutch citizens in our set that QID is identifying up to a group of 5 or less individuals. As you see on the above list, the disclosed personal information possibly includes quasi-identifier value + real identity for the representatives. Just thought this is worth mentioning.

    Since the data is publicly available anyway: here is the list of all representatives and their quasi-identifier value.

    U.S.-Owned Trackers on Dutch Govt Websites

    Posted on by mrkoot

    I used Firebug and manual code inspection to puzzle out which Dutch govt websites have which (ad)trackers like Google Analytics and Nedstat comScore (who bought Nedstat in Q3/2010). Some reflection is desirable, IMHO, on whether or not to disclose which (Dutch) IP address accessed what (Dutch govt) content to foreign-owned companies who’s government may require/force them to hand it over. Note: I only looked at the homepage of each site.

    First the good (tracking-free –> kudos!):

    Then the bad:

                I don’t know what data is collected / is not collected by the various trackers, and lack the time to carry out that analysis. If you feel like it, please do so; I will be more than happy to link to your results or post them on this blog on your behalf.