Bluebottle

 

Image from Pixabay

“Big bluebottle optimistic about 160th attempt to pound through the window,” the Dutch satirical website De Speld reported this week. At times I feel a great connection with that insect.

Do you that feeling that something is crystal clear to you yet not at all understood by someone else? I also sometimes sit on the other side, for example when the children have fun saying "Hey Marco, great!" and I ask them what the hell they're talking about (it’s a viral TikTok thing; you don’t need to know more about it).

However, if I myself am surprised because someone really doesn’t get it, then it is a different story. You need to respond professionally, whether in your private life or at work. An example of the former I experienced twice when the children entered high school and were taught mathematics. I used to help them with math, and when I was dealing with simple equations, I found that they had no idea what a variable actually is. Their glazed looks when I said: “Just fill in 2 for x…” spoke volumes. Then you have to reset yourself, go back to basics and find words to explain something that is completely self-evident to you. In the meantime, I do wonder how a teacher could possibly not notice something like this. By the way, it helps if you've been through a situation like this before – with the second child I quickly recognized what was going on and wasn't even surprised anymore.

But especially in my work I sometimes feel like the bluebottle, trying to smash through double glazing. Taking an extra run-up and hitting that window again at full speed definitely wouldn’t do much good. That fly doesn't understand. I do. And so I'm going to look for another window that might be open. Although that takes extra time and effort, it does offer perspective on achieving my goal.

You have to be open to this phenomenon on both sides. Yesterday I was in a meeting about how we should deal with the BIO (the Dutch government’s baseline for information security, fully bases on ISO27002) in a certain project. After a while I realized that one of the participants might not know what that BIO is all about. That's why I asked him. In this case, he was well informed, but it’s also possible that someone completely drops out because they don't know what you're talking about. On the other hand, if someone talks about something you don't know, or uses an abbreviation that doesn't mean anything to you, ask about it. After all, there is only one stupid question: the question that was never asked.

I've been struggling with passwords for a while now. Every now and then I run into colleagues who – no doubt with the best intentions – handle passwords insecurely. Typically, these are system to system passwords used in testing. These tests are often performed automatically, sometimes in the middle of the night. Now there are techniques to ensure that those passwords are in a digital vault, from which they can be retrieved by the relevant process. Without human interference. And no one knows those passwords, because they are automatically generated and immediately encrypted and stored in that vault. Sounds solid, doesn't it?

Unfortunately, there are teams that cannot or do not want to apply this. They request the password in plaintext and want to store it in their team password manager access it if necessary. When I hear about that, I'm just that bluebottle thinking: how come they don't understand that passwords for system to system access should not be known to people? But of course it is never that simple. There are always good reasons not to do it the right way. And if something works, there is usually little incentive to change it. But, I say: open your window to let the bluebottle through. This results in a win/win situation: fly happy, you happy. And your operation becomes a bit safer. Even if it is 'only' in the test environment. Which by the way should be production-like…

 

No Security (b)log next week.

 

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

 

• online platforms, such as Google and Amazon, will no longer be allowed to manipulate their European users.
• Google will soon offer us a smoother cookie wall. [IN DUTCH]
• maybe that iOS app is still tracking you.
• Preferably arrange your privacy before critical questions arise. [IN DUTCH]
• As early as 1971, people were already concerned about the privacy aspects of computer use.
• can you not report data leaks for a while. [IN DUTCH]
• finds weaknesses in the security of systems quite a bit of pocket money.
• ill-considered implementation of zero trust can lead to security systems going blind.
• Patient records, which were stored in the cloud, were inaccessible for hours due to a DDoS attack. [IN DUTCH]

Cannot can't be

Image from Unsplash

The motto of the 2007 film K3 and the cat prince is: cannot can’t be. The Belgian/Dutch girl group K3 aims at children as its audience. That same audience sometimes shouts at home: “I can't do that”. But if they have seen that film, then as a parent you can make appropriate use of that motto for quite a long time.

This can be a bit more difficult for adults. We are currently in the process of implementing some additional security measures that will affect all users. The first is that you have to enter an extra code when booting the laptop, the second measure is that Webex (our video conferencing system) will be equipped with multi-factor authentication (more about that later). A pilot group was set up to test the extra startup code. This has resulted in some outspoken reactions: I can't do that! I don't want to participate in that! I'm about to retire! I have the memory of a goldfish, I immediately forget that code! I don't have time for this!

On the right you see the Can/Want matrix of vocational expert Hanneke Tijken. That matrix divides humanity very clearly into four groups, based on whether they can do something and whether they want to do it. People who can solder, for example, and who also want to, can easily be used for a soldering job. If someone can solder, but doesn't feel like it, you might be able to convince them to do it anyway. Still others, who would like to do it, but can't solder yet, can take a course. At the bottom left of the matrix you have a problem. There are the people who can't do it and who don't feel like it at all. Getting these people to solder would require a disproportionate effort. That is why – somewhat pessimistically – the word 'lost' appears in that quadrant: if budget and time are limited, then rather spend them elsewhere.

This matrix also applies to information security. Because there too we have to deal with people who want or don't want something and people who can or cannot do something. Sometimes people just think they can't do something, and not wanting to can be based on incomplete information. If you can explain why something is necessary, then you can convince those people. Just like you can teach people something with a tip, trick or course.

The colleagues quoted above are clearly not in the top right quadrant. They uttered can't-statements as well as unwilling-statements. With some statements, you might suspect that they both can’t and don’t want to. But I don't want to consider anyone lost on the basis of a vague suspicion. I've been making a strong case for years to keep everyone on board. And it is especially important with the upcoming changes, because they are really going ahead.

Where are you in that matrix? Especially for the people on the top left, I'd like to explain what's going on. The first adjustment, the extra boot code, is necessary because research has shown that the security of our laptops is not as good as we thought. This will be restored with this adjustment, so that our business data is also safe if your laptop ends up in the wrong hands due to loss or theft. The second change has to do with the fact that we will soon be using Webex for more than only video conferencing: we are going to chat, share files and scribble on virtual whiteboards with that app. Video conferencing is volatile: what you hear and see there is immediately gone. However, chats, shared files and whiteboards will be saved – outside our own data center, that is. We must take additional steps to ensure the confidentiality of that information. We want to make sure it's you when someone wants to log in with your user ID, and that’s where multi-factor authentication kicks in: the first factor is your password, the second is an app on a mobile device which constantly generates new codes. When logging in you have to enter the code that the app shows at that very moment. Elsewhere, those same codes run along on a system, and when you use one, both codes are compared to check whether you really entered a code that corresponds with your device. In this way you log in based on something you know (your password) and something you have (the mobile device with the app linked to you): multi-factor! The entire process of checking whether it is really you is called authentication.

The pilot also generated positive reactions. I like this one the best: “It was not too bad for me, it only took five minutes!” And I actually expect that the largest group of users will just sigh and then take it for granted.

Finally, an inspiring quote. At the town hall of Vaals, a town in the very south of the Netherlands, there’s this Latin inscription: nil volentibus arduum. Which means: nothing is impossible for those willing.

This blog post has been translated from Dutch to English by Google and edited by the author.

 

 

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

• John Oliver apparently read last week's Security (b)log and made a program about trading our data.
• Germany is positive about a new Google button that allows you to reject all cookies. [IN DUTCH]
• the tax authorities in the Netherlands have received a hefty privacy fine for keeping a blacklist. [IN DUTCH]
• your data and processes in the cloud may just be unavailable for a while.
• an 'Order now' button does not imply and obligation to pay. [IN DUTCH]
• this malware hijacks your call to your bank's customer service.
• the European Parliament has approved new rules for data exchange with countries outside the EU. [IN DUTCH]
• chat apps also want to be updated again and again. [IN DUTCH]
• a German hosting provider offered its customers a twenty euro voucher for the loss of data. [IN DUTCH]
• your Lego bricks may be on the street. [IN DUTCH]

 

Cookies

 

Image from Pixabay

I really like American chocolate chip cookies. Just love those large chuncks of chocolate in a crunchy biscuit. It becomes a completely different story if you omit the first three words: in my country, the word cookie is solely associated with computer cookies and as such I associate them with annoying flies rather than with a delicacy.

The advertising and marketing industry – and especially its clients –have the right to earn their living. We all use all kinds of 'free' services on the internet, but of course the suppliers of those services need an income. They make money by accompanying their services with advertising. Let them have their fair share. Cookies are used to organize that advertising. A cookie is a file that is placed on your computer or mobile device and that records information about the contact with you; in other words, the relationship between your behavior and your device is recorded.

Unfortunately, shady practices are also used to earn even more money. To find out more about this, I had a conversation with my colleague Hans van Buuren, solution architect interaction and specialized in this subject. The common thread through our conversation was profiling. It is very important for advertisers that they understand our interests and needs. An offer on diapers blows me neither hot nor cold, but when I’m looking for a new phone and you send me a great offer, you have my attention. In other words, untargeted advertising generates far less revenue than a well-timed ad delivered to the right address.

But profiling is what often comes with a nasty taste. 'They' know a lot about us and those cookies are quite persistent. At a cookie wall (the 'wall' that separates you from the information you want to see) most of us quickly click on “yes go ahead” to continue. If you indicate at such a cookie wall that you do not simply agree, then all types of cookies should be disabled by default and you can turn them on one by one if you wish. In addition, you should have the opportunity to reconsider your decision afterwards. You do not give perpetual permission to any website.

So far there is not much going on: you visit webshop A, they know which products you have viewed and will spam you in the near future with advertisements for similar products. But often it doesn't stop at a 1-on-1 relationship. There is a lively trade in profiles. Webshop A sells information about you to other parties. This creates a much broader picture of what you do online. So-called third-party cookies are also used for this: they are not managed by webshop A, but by a third party: advertising companies such as Facebook and Google. These somewhat crumbly cookies are sometimes stored in hidden places, so that they remain behind when you delete your cookies. But they are in a bad light, which is why several browsers have already banned third-party cookies, and even Google is phasing them out this year. Are they shooting themselves in the foot with that? Nope, they just came up with something new that will strengthen their own position in the advertising market and will deal with annoying privacy legislation.

Not only cookies say something about you – the things you put on social media also tells tales about you. Social media therefore read everything you write and make all kinds of connections. This all happens automatically and is used, among other things, to feed you with new information that fits your alley. That way you can become addicted to such a medium – they confirm your behavior and thus become your best friend. This can also lead to tunnel vision. You see this, for example, with conspiracy theorists, who are increasingly presented with similar information and then get stuck in a certain image.

I asked Hans if marketers are people that have no scruples. The average marketer isn't like that, but they don't always realize that offering "sixty thousand cookies" actually means that just as many people are going over the counter. Ultimately, the revenue from the advertising takes precedence over an individual’s privacy. A tip from Hans: with an adblocker in your browser you keep intrusive advertisements at bay.

Once in a while we go shopping across the border. In a German supermarket, we buy American chocolate chip cookies, made in the Netherlands. But nobody else knows that. Not even Google.

This blog post has been translated from Dutch to English by Google and edited by the author.

 

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

• Google delights us with a privacy guide to Chrome.
• lawyers struggle with the term social media. [IN DUTCH]
• the EU and the US are talking about the transfer of personal data again. [IN DUTCH]
• Ministers should also adhere to security guidelines. [IN DUTCH]
• The same goes for mayors. [IN DUTCH]
• Several political parties want ministers to be banned from using private e-mail accounts. [IN DUTCH]
• German police have taken down the world's largest cybercrime platform.
• several housing associations have become victims of ransomware attacks. [IN DUTCH]
• two Belgian airports were fined for taking travelers’ temperatures. [IN DUTCH]
• a lot of people still fall for bank help desk fraud. [IN DUTCH]
• you should always reset smart equipment before sale. [IN DUTCH]
• the minister wants proportional access to encrypted data for investigative services. I am curious how such a crypto algorithm will understand in which situations it should become 'weak'. [IN DUTCH]

 

 

Exclamation mark

Image: ANWB

Ten years ago on Friday January 13 I wrote something about the phenomenon Friday the 13^th. Do I have to come up with an ingenious April fool’s joke today? No, let’s not do that. I can be funny, but let’s leave thinking up and executing such a good joke to others. Such as the HEMA department store, where they announced the inside out boxer shorts: the underpants of today and tomorrow.

So you have been warned: it is April 1. In traffic we have a special road sign to warn of all kinds of danger: the triangle with a red border and a solid exclamation mark in the middle (at least, here in Europe). In the past, there wasn't an exclamation mark, by the way, but just a thick vertical line, with no dot underneath — as if using a symbol that anyone could easily understand was forbidden. Just like that garden gate that warns of crossing trains.

But as the title indicates, I'm mainly going to talk about exclamation marks. And that's for a reason. I recently did a risk analysis and asked those present what measures they had taken to protect their system against a particular threat. Do you know what they said? We've added exclamation marks in the manual! I like such creativity. It was recognized that a particular step in the installation manual is important for the security of the system and this feeling was expressed by using the universal attention symbol. While that simple symbol, consisting of a line and a dot, is not even intended for that: according to the Dutch dictionary it is only a “punctuation ­mark that ­is placed after exclamations, commands­, claims and wishing phrases”. Oh wait, maybe wishing phrases is applicable here. They obviously mean phrases like “Congratulations!”, but if you read “wishes” in a different sense, it could also mean “I wish you would pay proper attention to this!”

Is it really possible, an exclamation mark as a security measure? Oh well, it will probably help. But it is, of course, an illusion that such a character in itself could promote the security of a system. If a measure is important – whether it has to do with security or something else – then you need to make sure that the measure is implemented and working. You monitor its proper functioning, so that an alarm goes off somewhere if something is wrong. That signal is then automated or human-assessed and action is taken if necessary.

If all sentences in a text contain exclamation marks, their attention value is quickly lost! Just like that colleague, who sends all e-mails marked 'urgent'! In addition, it causes irritation! Okay, you get my point: too many alarms are not good because a person needs focus, which certain symbols can help with, unless there are too many. No way everything is super important. For the same reason, we work with a shopping list in a risk analysis. At the end of such an analysis, you will of course receive an overview of all risks with the associated severity (in five steps from 'very low' to 'very high'), but we also provide a separate list with only the high and very high risks. Because that's what your focus should be on.

The exclamation mark is also a popular object in passwords. We are often forced to use 'special characters' in addition to upper and lower case letters and numbers. Raise your hand if your password for such an account ends with an exclamation mark. Ah, I see a lot of hands. In 2017, the Washington Post headlined an article: “You added '!' or '1' to your password, thinking this made it strong. Science says no.” Despite the article being five years old, the tips are still current. An important characteristic of a good password is that it is not obvious. An exclamation mark at the end is predictable. Psst… in a password you can also have your exclamation mark in the middle! But of course you have your passwords generated by a password manager, which knows those kinds of things.

Meanwhile, I inadvertently sit here listening to Christmas music. Sky Radio has given its April Fool’s joke a special twist. Yesterday they announced that they would be treating us to a sort of catch-up white Christmas because of the snowfall (it’s unusual to have snow in this time of the year in the Netherlands, let alone the quantities we’ve seen yesterday and today). And then you think: haha, nice, I'm not falling for that. But now I'm seriously listening to Last Christmas by Wham! And that exclamation mark goes with the name of the band.

This blog post has been translated from Dutch to English by Google and edited by the author.

 

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

… you can hardly blame the system in question for not carrying out monitoring. [IN DUTCH]

https://www.destentor.nl/binnenland/bedrijf-achter-berichtservice-voor-criminelen-stapt-naar-rechter-nadat-minister-lek-systeem-stillegt~a67fe027/

… European institutions are not well prepared for major cyber attacks. [IN DUTCH]

https://www.nu.nl/tech/6192098/europese-bedrijven-zijn-onvoldoende-voor Prepare-op-grote-cyber Attacks.html

... hacked e-mail accounts from law enforcement agencies are used to request personal data from tech companies in the US.

https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/

… a Ukrainian IT worker fights against the Russians with his keyboard and mouse.

https://edition.cnn.com/2022/03/30/politics/ukraine-hack-russian-ransomware-gang/index.html

… Google says that Microsoft's dominance in US government is a security threat.

https://www.nbcnews.com/tech/security/attacking-rival-google-says-microsofts-hold-government-security-proble-rcna22159

... Log4j still echoes in VMWare Horizon servers.

https://www.darkreading.com/vulnerabilities-threats/log4j-attacks-continue-unabated-against-vmware-horizon-servers

… criminals looted hundreds of millions from an online game. [IN DUTCH]

https://www.destentor.nl/tech/hackers-stelen-hundreds-millions-aan-crypto-bij-populaire-game~ad16bfdc/

… it is unwise to include passwords in a spreadsheet. [IN DUTCH]

https://tweakers.net/nieuws/194946/lapsus-hackers-komen-poten-bij-okta-binnen-via-spreadsheet-with-passwords.html

... 65 email fraudsters worldwide have been arrested in an international police operation.

https://www.fbi.gov/news/stories/coordinated-operation-disrupts-global-bec-schemes-033022

… fake emails from Europol and the Royal Netherlands Marechaussee (military police) accuse people of possessing child pornography. [IN DUTCH]

https://www.fraudehelpdesk.nl/alert/e-mail-europol-en-kmar-over-kinderporno/

… soon free services will also have to comply with consumer law. [IN DUTCH]

https://www.security.nl/posting/748301/Consumentenrecht+geldt+vanaf+28+mei+ook+voor+'gratis'+digitale+diensten

… your Mercedes will share information about the road with the government. [IN DUTCH]

https://www.security.nl/posting/748204/Mercedes+gaat+informatie+van+thousands+auto%27s+met+overheid+delen+-+update

  

Toilet roll

 

Image from Pixabay

After two years we are slowly returning to the office. There, a change has taken place that you never saw coming. New toilet roll holders were installed.

For readers without an office: such a holder is not the simple thing you’ll find in our homes, but a closed box with a slot at the front bottom. In the box there are two rolls on top of each other and the paper comes out through the slot. Well, that’s how it’s meant to be. And that's exactly what goes wrong with these new things. The rolls suffer too much friction. If you pull on the paper, it will tear - inside the holder. Which means you have to search for the beginning every time by sticking your finger into the holder and twisting the roll around – often several times – until you get hold of the end of the paper. And then pull carefully, because before you know it it will tear off again. Sometimes you get hold of the ends of both rolls and then you experience the luxury of double-layer toilet paper.

There is a manufacturer that makes these things. Not just out of the blue, but according to a design. They first make one, or a handful: the prototypes. They are tested, a few teething troubles come to light, the design is adjusted, there is a new prototype and eventually (after maybe a few more iterations) the holder is ready for production.

What went so wrong with this product? Did they only test under lab conditions? Has anyone come up with the idea to screw a prototype to the wall, put two rolls of toilet paper in it, sit on the pot and use paper according to some European standard or according to need? In short, didn’t they perform a field test?

But things also went wrong on our side. It must have been a government-wide tender. In such a tender, it is decided which offer, meeting the business requirements, offers the cheapest solution. Perhaps the buyers forgot to include a requirement that the paper should come out smoothly. And I wonder how the acceptance test was done.

Years ago we purchased a software package to manage our information security management system (ISMS) . It seemed like a great product and we went on a course with the manufacturer with a few people. We saw a product with a clear structure and we were able to carry out all the practice assignments smoothly. And then we had to implement the product in our organization. We were unable to reconcile our layout with that of the product. At that time I even reverse-engineered the data model of the product*, in other words: I drew out how the product was put together. We then tried to plot our organization and our working methods on this. We called in the manufacturer a few times and after each consultation we thought we understood how to do it. In the end we gave up and to this day we work with the old, trusted spreadsheets.

There is nothing wrong with that, by the way. At a conference, a speaker once asked the audience who was using Excel for this sort of thing. Numerous hands went up and there was a lot of laughter. At the same time, a sense of relief rippled through the room, because it suddenly became clear that it was not at all unusual to work in this way. Sometimes you simply have functional needs that you cannot express well in requirements and for which you cannot start a purchasing process for that reason. You then go tinkering yourself or you borrow something from another organization. In terms of management, this is a nightmare: if such a self-made tool becomes established and its maker is no longer available, then you have a problem.

I've put something like this together myself. And so as not to leave my colleagues in a bind in case of mishap strikes me, I made a technical manual for it, which describes exactly how things work under the hood of my spreadsheet. Whether it will be of any use to them, remains to be seen. Of course we are way too busy to test something like this. Besides, nobody knows where the manual is. So there’s room for improvement. How about you? Is the continuity of your team's important resources guaranteed?

*) Reverse engineering involves looking at how something works and deducing from that how it was designed.

 This blog post has been translated from Dutch to English by Google and edited by the author.

 And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English. 

• This article offers a rare insight into the negotiations between Mediamarkt and the criminals who took the chain's systems hostage. [IN DUTCH]
• ransomware takes very little time to encrypt many files. [IN DUTCH]
• LAPSUS$ extortion group recruits employees of large companies to get access to the company network.
• a teenager may be the LAPSUS$ mastermind.
• the London police have rounded up (part of) this hacker gang. [IN DUTCH]
• The FBI estimates the damage from cybercrime at more than $6.9 billion.
• you should encourage your kids (and yourself if necessary) to adjust a few settings in TikTok.
• President Biden calls on US companies to protect themselves against Russian cyber attacks.
• British soldiers are no longer allowed to use WhatsApp, for fear of Russian hackers.
• the NCSC in the Netherlands deems it possible that the Dutch digital resilience will be put to the test as a result of the war in Ukraine. [IN DUTCH]
• banks are often lenient if customers have been defrauded through phishing, but there are limits. [IN DUTCH]
• Fortunately, not everyone falls for the tricks of criminals. [IN DUTCH]
• British NCSC helps programmers with a toolkit to program safely.

 

Garbage

 

Image from Pixabay

A while ago we had Corrie, Dudley and Eunice over. They were uninvited guests who beat the big drum. Eunice even killed four people in the Netherlands alone. Along with Dudley, this storm killed even more people in neighboring countries.

On one of these windy days, the orange wheelie bin was scheduled for collection. This is where PMD waste goes: plastic and metal packaging and drinking cartons. The garbage truck has an arm on the side that can lift two bins at once and then hold them upside down over an opening on top of the truck. In normal weather conditions, the waste falls neatly into the truck. But this time numerous pieces of plastic, over which the wind had more power than gravity, were blowing through the street.

We also have a blue wheelie bin. Paper waste goes in there and it is emptied in the same way as the orange container. What if the blue bin had been on the waste calendar? Would all kinds of documents with my name on them have been whirling around? Not such a nice thought. We may have nothing to hide, in the sense of: we don't do things that are inappropriate, but there are plenty of things that are none of other people’s business.

We used to feed everything that contained personal data into the paper shredder. That device broke down at some point and at the same time the stream of paper documents dried up considerably. The mailman visited our house only sporadically; his work was largely taken over by email and download portals. In short, the paper shredder was not replaced and the paper waste – now rather scarce – with our data on it 'just' goes in the wheelie bin. And I think that always goes well. Unless some Dudley comes along. Or someone is looking for information about us and does some dumpster diving.

As an information processing organization you cannot afford to put your paper waste on the street. Sooner or later that would cause trouble, if only because of the fact that there is paper with personal data among your waste – the rest of the leaked information does not even have to be flashy to make it into the newspapers. Such organizations have contracts with companies that dispose of and destroy the waste paper in a responsible manner.

What applies to paper, applies to computer files to an even greater extent. A colleague recently sent me a newspaper clipping from 1983, in which a commentator of the Leeuwarder Courant sighed under the heading 'Privacy talk' that it is remarkable “how that concept of privacy crops up time and again when it comes to computer files on personal numbers and never when it comes to card indexes with the same data in alphabetical order”. But this writer had understood it well early on: “In practice it may be different, because it is possible to transfer computer data quickly”. And in large quantities, you can safely add to that.

In 2004, public prosecutor Joost Tonino put his old computer, which no longer worked due to a virus infection, on the street for the waste collection. And of course someone took that device before the garbage truck came along and he just got the device working. The computer was full of confidential information, which found its way to Peter R. de Vries, a well-known crime reporter (who was murdered last year). A scandal was born. Newspaper Trouw wrote about this: “Rarely has a civil servant – even better, a magistrate – been so spanked by politics in public as yesterday's Amsterdam public prosecutor Joost Tonino.” If only he had read that Leeuwarder Courant… (Tonino was about 17 when the article appeared, so he just might have read it.)

As a good citizen you will rarely have to deal with dumpster diving. However, if you did something terribly wrong, the police might become very interested in your blue wheelie bin. But, depending on what you've been up to, your computer is probably much more interesting to them. The newspaper clipping also stated: “Anyone who has nothing to hide need not be afraid that he will appear in such a computer file, and that data from one file will be superimposed on that of another.” It doesn’t work like that anymore: everyone has something to hide, everyone is in countless files and if there’s one thing computers can do well, it is to connect data. That piece appeared one year too early in the newspaper.

This blog post has been translated from Dutch to English by Google and edited by the author.

  

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English. 

• Two men have been arrested for trading personal data of thousands of people. [IN DUTCH]
• the government gives insight into the sharing of personal data. [IN DUTCH]
• leaked Samsung source code contained thousands of secret keys and passwords.
• Ukraine believes that Russian state hackers are overrated.
• the German government is now also done with the antivirus software from the Russian company Kaspersky. [IN DUTCH]
• a report on the (un)safety of mobile equipment in 2021 was published.
• this businessman lost a lot of money because of an e-mail from the 'tax authorities'. [IN DUTCH]
• the FBI provides tips against help desk fraud. [IN DUTCH]
• Zoom has addressed several important privacy risks. [IN DUTCH]
• the government is investigating to what extent it can and should tap into chat services. [IN DUTCH]
• your microwave thinks it's a steam oven after a software update. [IN DUTCH]

 

Canvassing

 

Image from Pixabay

Colporteur is, at least in Dutch, such a nice old-fashioned word that, if you don't know it, could easily let you think of criminal activities. At least, that's how it sounds to me. But no: in principle, canvassing (as it’s known in a broader sense) is a venerable activity, in which the practitioner visits houses to sell a product or service. The Dutch dictionary cites the encyclopedia colporteur and the vacuum cleaner colporteur as (probably extinct) examples. The energy salesperson mentioned there, however, is very much alive and doesn’t always adhere to high standards. Once such a person presented himself as a representative of 'the energy company', thus suggesting that I was already a customer of his company.

At our doorbell, there is a modest sign that reads: “TIP – We only buy things and services that we have asked for ourselves.” That stops most canvassers from ringing the doorbell. And sellers, who have the audacity to do so anyway, will be kindly asked if they may have missed the sign. A few will lie that they don't want to sell anything at all, but most of them drop off while stammering apologies.

In the past – before the pandemic – in the weeks after participating in a conference or visiting a trade fair you were often called by companies that tried to monetize your visit. Today, that activity seems to be disconnected from any event. What is particularly striking is that I receive calls from Dutch landlines by English-speaking employees of  companies in my industry, who want to pitch their products or services or organize an informative meeting. I always brush them off saying that I am not the one who deals with suppliers and that they are wasting their and my time talking to me. And when they ask who they should contact, they are told that I am not allowed to provide that information.

Come on, if you really work for that company (they're always companies I've at least heard of), then you're also able to find the right point of entrance . You don't have to scour LinkedIn profiles looking for interesting prey. Because in some of these contact attempts, which also often take place via e-mail, I clearly recognize elements from my LinkedIn profile. I just tightened that profile. For years now it said that you can only become friends if you have met me before in real life or if you are a colleague. Now I have explicitly added that I will decline the invitation if I don’t know you, and the reason for this is also stated: LinkedIn is often used for phishing. Those people first want to make a connection, and then they subtly hear you out. They may not even be interested in you, but in your contacts. Or they use the connection with you to make a good impression with their real target: if someone sends you an invitation, LinkedIn very usefully lists which contacts you have in common with the newcomer. That can give you the (sometimes false) feeling that someone is trustworthy.

Often I receive contact attempts like this: “Hi Patrick, I'm working with Senior IT leaders on a Private Online Roundtable surrounding Security, IoT and Transformation to name a couple of topics. Our directors would love your expertise, I would like to offer you a complimentary invitation to join us in June! Can I send the agenda please?” The message is intended to make you feel important: Senior IT leaders, Private Roundtable, our directors. The young lady who sent me this invitation from London has this position mentioned in her profile: Connecting IT Leaders together across the Benelux region. Invitations like “You and I both work in information security, shall we link?” are also very common. And a very good 90 percent of all these contact attempts will just be legitimate, I have no doubt about that. But in order to keep that faction of possible wrong contacts out, and because I have little to gain from them, I reject those. With this I not only protect myself, but also my contacts. And more people should do that.

A few people have just received a contact request from me. Because while I was looking at the incoming contact requests, LinkedIn also showed a lot of people “that you may know”. When you scroll through that, you sometimes involuntarily think: “Hey, are we not connected yet?”

This blog post has been translated from Dutch to English by Google and edited by the author.

 

 And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

• malware can now be detected using electromagnetic waves.
• a researcher discovered a serious vulnerability in Linux, which also affects Android.
• the police arrested eight (!) young people for defrauding an elderly person through bank help desk fraud. [IN DUTCH]
• Ukrainian hackers only attack military targets in Russia, they say.
• smart speakers can, of course, be hacked, which also makes other devices and services vulnerable.
• the government wants to issue digital passports once again. [IN DUTCH]
• new cars get a few mandatory gadgets that come with privacy concerns. [IN DUTCH]
• Parliamentary questions are also asked in response to the privacy report on Microsoft Teams, OneDrive and SharePoint. [IN DUTCH]
• Many websites follow you without using cookies. [IN DUTCH]
• You can now read why the antivirus software from the Russian company Kaspersky Lab was banned by the Dutch government in 2018. [IN DUTCH]