When The Customer Isn't King - Account & Data Security Breaches That Can Be Prevented

The news for two major retailer giants in Canada has not been good for them or their customers in the past few days. Loblaws, a grocer and dry goods retailer, had their PC Points loyalty system breached. One customer had 110 points worth $110 spent in the province of Quebec, and she has never even visited that province. Another customer who is a system administrator, said that he had a different password for every account, had his points stolen as well. News link: http://globalnews.ca/news/3237876/ps-plus-points-stolen-security-breach/

As well, Canadian Tire, a retail giant that sells everything from automobile accessories to sporting goods to snack foods, has been hacked, compromising both loyalty points and credit card balances online. News link: http://globalnews.ca/news/3236903/exclusive-canadian-tire-website-breached-consumer-accounts-in-question/

The financial losses of hacks such as these, are tremendous. When Target was breached in 2014, they estimated the losses to be $148 million dollars according to an article in Time Magazine. In that same year, job losses due to customer data breaches were estimated at 150,000 people in Europe. The global picture is frightening. McAfee, the Intel security company estimates monetary losses of $160 billion per year for data breaches.

Hacking isn't exactly a new phenomena. In 1979, infamous convicted hacker, Kevin Mitnick broke into his first major computer system, the Ark, the computer system Digital Equipment Corporation (DEC) used for developing their RSTS/E operating system software. The most embarrassing privacy breach came when Ashley Madison, the website for having extra-marital affairs, was hacked and over 30 million names and credit card numbers were exposed, causing at least two suicides.

So in this day and age, why does this happen? Can it be prevented?

Aside from an inside job, one of the reasons that hacking is successful, is the antiquated way that servers, databases and accounts are accessed. To connect to a server, one usually must have a username and a password. This is true to gain access to a server as an administrator. However one doesn't need administrator access to hack into data and accounts. Customer account information is stored in what is known as a 4GL database (4th Generation Language). This table-driven database is usually clustered on it own server and is exposed to the outside world so that its data can be accessed by platforms, analytics, and web interfaces. Again, with a user name and password, once can gain entrance to the data store and exploit the data. Many many databases still have "root" as the username to gain God-like access, and all that you have to do is either guess, derive, or gain access to the password. Many administrators commit the cardinal sin of using the same password on all accounts, and it may be gotten from such things as the name of their pet, which is information on social media. For years, the huge database company Oracle shipped their databases with a default account name of "Scott" and a password of "Tiger", left over from one of the original developers, that were never removed. I walked into many data centers as a consultant, and typed in Scott/Tiger and got access to the crown jewels.

No matter how much security that is built into any system, it is still vulnerable to the shaky access of system of a username and password. There is a better way. It is inexpensive, fairly autonomous, easy to use, and orders of magnitude more secure than a conventional database approach to storing customer data. It is a blockchain.

People know blockchain from the digital crypto-currency Bitcoin, and that fact alone has poisoned the well for quick adoption of blockchain technology. Blockchain is a technology & methodology for the digital recording of any transactions, events, ancillary derived meta-data & chronological logging of any business transaction that requires security, integrity, transparency, efficiency, audit & resistance to outages. It is the acme of trusted data. It also stores values like crypto-currency, digital cash and loyalty points, but its main selling point is that it is a true, autonomous ledger. Period.

When a technology evangelist mentions blockchain to the C-Suite level, several things happen. If they have heard of blockchain and its association with Bitcoin, there is pushback, because of how crypto-currencies have been exploited in the press. If they haven't heard of blockchain or have heard of it, but do not understand it, there is a fear of committing to the unknown. There are only about 2,000 blockchain developers worldwide, and most of them are still building proofs of concept. C-Level tech officers in corporations do not have the tech talent to immediately go to this technology, and it is perceived as untested bleeding edge stuff (not true). The other fly in the ointment, is that there is a blockchain consortium built around the Ethereum platform. That may all be well and good, but Fortune 500 is more suited to a private blockchain, controlled by themselves as they are responsible for their data.

So why is a blockchain more secure? For starters, any responsible blockchain incarnation does away with username and passwords. Authentication is done with a private encryption key right on the device. No amount of keylogging or password trapping will allow the breach. On top of it, conscientious construction of the authentication should be done with a tandem collection of MAC address or MDID of the mobile device. A MAC address is the embedded serial number of the network card in the computer that can easily be collected by any web page and MDID is the hardware serial number of a mobile phone or tablet that can be externally queried. Thus, any machine making changes to the data can be identified by device and encryption key.

On top of all of that, each blockchain query agent needs an encryption key just to read the blockchain. No amount of brute force hacking can get you into the blockchain, unless you are authorized to do so, and have a key created for you.

Blockchains can not only hold digital values like money or loyalty points, but they also can contain bits of code that enable smart contracts. In fact, they can store a digital anything. In other words, when certain conditions are met, actions can happen securely because of code embedded in the blockchain. Blockchains are impervious to data being fraudulently altered, because each transaction is linked to a previous transaction using encryption and hashing. You would have to change the entire transaction history to perpetrate a fraud.

The last benefit of blockchains is not that obvious, but highly desirable. You can write any information to the payload of a blockchain. So if you store transactions with a semantic, machine-readable identifiers, one can perform stream analytics in real time on the transactions. This can be coupled to machine learning, not only to identify fraud, but also to enable wallet-stretch to sell the consumer more things that they really need.

Does a beast such as a private semantic blockchain exist? You bet. Ping me.

Data Privacy At International Borders

There is a shocking liberty and data privacy incident going on in Canada. The Canada Border Services or Custom Guards stopped a traveler and asked him for his smart phone password.  He refused.  The traveler was charged with obstructing a customs officer. In Canada, a smart phone can be considered like any other of your belongings and liable to be searched.  The constitutionality is being tested in May, but the border authority still asserts the right to check your smart phone, tablet or computer.  Here is the link:
http://www.cbc.ca/news/alain-philippon-phone-password-case-powers-of-border-agents-and-police-differ-1.2983841

So, if you want to be immune from these sorts of fishing exercises what can you do?  Here are some tips:

1) Offload documents to a book type external disk. A terabyte drive is less than $100 now. Documents that you will need can be stored in the cloud. There are several cloud providers for file services.

2) Carry documents on a USB stick on a key chain. There are several USB key chain novel items that do not even look like USB keys. Put it on a keychain in plain site. Or here is a pair of USB keys that are earrings:

3) Offload your photos to other storage. They may want to clone your photos to see if you are lying about where you traveled to.

4) When traveling, never use your mail program like OutLook that resides on your computer. Just by firing it up, one can see all of your contacts.

5) If you do have an email account that doesn't have a web interface or browser interface, create a gmail account, that is accessible by browser, and for the duration of travel, forward your mail to the gmail account.

6) Do not download the mobile app for email, either Yahoo, or Gmail or whatever.  Always use the browser.

7) Before crossing international borders, always erase your browsing history and delete all of your cookies.  That way, it will not even be apparent that you have a web email account.

8) It goes without saying, do not have questionable documents or pictures on your devices.  You know what they are.

9) In many countries, your hard disk is surreptitiously cloned (notably China and Israel). So even if you delete documents, all that is deleted is the memory reference to them. They can be forensically reconstructed. The solution is that sensitive documents are never written to disk. They are copied to a USB stick, and edited on the stick. That way, temp edit files that are created when you open the document, are not written to the disk, but in the same directory on the USB stick. If the system doesn't clean them out (and they do stick around), they will not be on your cloned disk.

10) Your smart phone is your life. It is the repository of who you are. Giving up the password is opening the book on your life, your finances, your business, everything. If you are really concerned about this, the solution is to buy a cheap flip phone while travelling. Remove the SIM card from your smart phone, and put it in the cheap flip phone. You still have  conventional SMS texts, phone and a browser for you email, but you don't carry your own personal data repository around with you.

11) Never use free airport WIFI. Always use your 3G or 4G data in the airport. All of the intelligence agencies in the world listen in, (and so do I when I am bored).  I just fire up my network monitoring tools and watch the data go by.

12) Finally, if you are a bona fide company, or a High Net Worth Individual  looking for an enterprise or robust solution to the empty laptop, send me an email   DataPrivacy-at-mail.com (substitute "-at-" with "@")     We have an enterprise, secure solution where the data is safely stored in a bunker in the Bahamas, and access is through a hardware key to your computer with intense SSH/SSL encryption and tunneling.  Be advised though that we do due diligence and KYC (Know Your Customer) because we want purely legitimate business with privacy concerns. Our usual customers are financial institutions and multi-national or international corporations operating from a G20 country.

The age of information really erodes personal privacy, but there can be technology solutions as well.

The Black Hole Net ~ Dark Web 2.0

There will come a time when internet privacy will be the concern of everyone. Only the lower socio-economic classes of people with continue to use the internet in a promiscuous way. But I predict the evolution of a deep dark web called the BlackHoleNet. This will be like the black credit cards or Swiss trusts -- a place where those that can afford it, can surf the web in virtual assured privacy. What will the BlackHoleNet look like?

First of all, to get to it, you will enter an IP address with no domain name. A lack of a domain name means one less step of information gathering by the registrar. When you arrive at the site, it will be a blank page that has a happy face or an "Under Construction" banner. Nothing. Nada. No links. Nowhere to go.

Then you insert a USB key, or SD card or another removable memory device into a port on your computer. You refresh your browser, and another page opens up. No apparent links. However this page contains an Easter Egg. If you know where it is, it asks you to log in. You have made it passed the bastion server. You are connected to the bastion server with an encrypted tunnel. On top of that, the contents of the traffic are encrypted as well.

Once behind the bastion server, you have the dark net. No search engines. No DNS. You have to know the IP addresses. The browser is such that if you start scripting a series of IP addresses, the browser will never work again, nor will the credentials to the dark web.

Inside the BlackHoleNet, there is no SMTP email. Not everyone is aware that every single email sent is archived by the intelligence agencies of almost every First World government. Inside there is no general broadcast of email. One logs into a server, and the email goes from mailbox to mailbox, in the server. Each subscriber must tunnel into the server to get their mail.

If you have to send an external regular email, the email is passed to a tokenizer which creates a token of the identity of the sender. All geo-location stuff is stripped out, and the email is then sent over regular SMTP channels. When the email is answered, a server decodes the token and takes it to its appropriate inbox.

There is a Facebook-like social media app, but it is all private, and the app is prevented from selling data or advertising. All of this privacy is funded by subscription.

There are websites that one can surf without anyone collecting information on you. There are stores that sell products, and all transactions are handled by an anonymity broker. Both the seller and buyer pass their information to the broker, and neither one knows the particulars of the other. The anonymity broker is a trust, that is audited regularly.

In essence, there will be an exclusive private darknet that will not be accessible to governments, intelligence agencies, pornographers, spammers, pedophiles, British tabloid editors, Rupert Murdoch and other scumbags and all of the vermin that now infests the internet.

Coming to an IP address near you soon. Bring a couple of wallets to pay the subscription fee.

It's Time -- A New Plug-in Filter for Browsers Needed

I am starting to get a little ticked off at how much data is being collected on me when I surf the internet. Websites often ask for authentication data including name and birth date, which they match to an IP address and can get a geographic location. For websites that I deem do not need that information, I always give them an alias, fake birthday and I use a throw-away free email address.

However, through various means, many companies collect browsing data, referrers and all sorts of meta-data, browser information etc. that can be used to pinpoint you. I say that it is time to stop the madness. It is time for us software geeks to take back the internet. I don't want to have to use a proxy server to browse the internet. I say that it is time for a new privacy plug-in for the browsers.

This privacy browser, first of all, would effectively filter out the ads as efficiently as the old incarnations of Firefox did. But it would do much more.

It would deny all http calls to third party sites not in the visiting domain. It would filter out third party cookie information. It would filter out browser information. It would prevent the reading of browsing history. It would deny any app from reading my email address or my contacts. It would not send any data to any domain not in the visiting domain.

Certainly it is not in the best interest for any organized company to write this browser filter, so it would have to come from the community of programmers who are concerned about online privacy. It is certainly time to take this privacy issue into our own hands.

Ultra secure, Data Privacy and Secure Storage

This is a reprint from a White Paper about "My Privacy Tool".

Data privacy is a growing concern in this day and age. As the Internet evolved, it has become an incredibly important facet of our lives for communication, transacting business, socializing and entertainment.

Our electronic data and personal information is trapped every day in multiple locations through activities as signing up for a social network account, buying items online, or just surfing the web. We are tracked, recorded and analyzed continuously as we use the Internet.

Even more problematic in the privacy domain, is that various agencies, governments, businesses and media are quite interested in gaining access to our electronic data, documents and communications.

India and several countries in the Middle East have announced that they are banning Blackberry because their intelligence agencies cannot read the communications.

The United States, in its war on drugs and terrorism, has sweeping powers of electronic surveillance. The intelligence agencies currently archive every single email sent over the Internet, and automated software robots troll the emails for keywords.

In early September of 2010, the Obama administration announced that they were seeking to further the government’s ability to tap into communications, by having providers like Skype and Blackberry build a back door into their software so that the government could monitor communications.

The "My Privacy Tool" solution is a secure, encrypted paradigm that incorporates email, instant messaging, data storage in a document repository and hot back up for documents on a computer.

The way it works, is that the application creates an encrypted tunnel to a storage and server farm in a trusted offshore jurisdiction (You can have your own server hosted there, you can use it as a service and have it hosted on an application hosting service, or you can have the server on your own premises.)

The encryption in the "My Privacy Tool" system is twofold. The first level of encryption is the tunnel which uses SSH and SSL encryption. SSH is a network protocol that allows data to be exchanged using a secure channel between two networked devices. Secure Sockets Layer (SSL), are cryptographic protocols that provide security for communications over networks such as the Internet. Then the documents are further encrypted by AES encryption. In cryptography, the Advanced Encryption Standard (AES) is a symmetric-key encryption standard adopted by the U.S. government.

The company that provides the "My Privacy Tool" operating infrastructure has been providing gateway mail services over fifteen years to international clientele.

The secure tunnel over the internet is created when the user starts the application. The application cannot be started without a USB key, which contains the encryption tools necessary to connect and be validated. Each user is also provided with a panic password. If the user is forced to divulge his login credentials, he/she can provide a panic password that when used, insulate the data and the session is directed to an innocuous place with artificial data. Removing the USB key also causes the application to quit with no ill effects should the user require instant privacy.

Once the tunnel is set up, the user enters their password, and has access to secure communications and storage.

The email is not regular SMTP email, or email that is broadcast across the internet. When an email is sent from one person to another, it is merely put into an inbox behind the bastion server in the bunker that guards against intrusion.

Users wishing to check their email, must tunnel into the bunker and check their inbox. Nothing is ever broadcast over the internet like regular email.

The instant messaging (chat) works in the same manner as the email, in terms of security. Both users tunnel in, and if they are both connected, they can chat. Chats transcripts may be saved.

The communications (email & instant messaging) algorithm is based on the Swiss Trust paradigm that enables anonymous communication. Each user has three account numbers that he may give out to other "My Privacy Tool" users. These numbers all point back to the user. The other user then creates a contact nickname for this person using the given number. The nickname or alias can be nominal or random. Also, if the account number is disclosed by one party only, the person receiving the account number may communicate with that person without ever disclosing his/her identity. The system keeps track of the users while routing the messages.

The next piece of the solution is the secure document storage. It is a repository with the capability of created private and shared folders. Each user must be specifically assigned to a folder by an administrator before he or she has access to it.

There are various levels of access. The first is a data contributor. A person may create a document for the enterprise, and has the ability to upload it to a shared folder. But that person does not have the ability to download documents or delete documents.

The second level of trust is the data user, who has the ability to upload documents to shared folders, download them to edit them, and upload them again. This person has no delete privileges.

The next level of trust is the ordinary user who can create his/her own folders, and upload and download documents to them. They may also contribute or download documents to shared folders if they are authorized to do so by the administrator. They can delete documents as well.

The administrator is responsible for re-keying users that have lost their USB keys. He/she also locks out users who have been terminated by the organization, and keeps track of the organization through the contacts list.

The data storage area is a generous 100 GB per user. Not only is the tunnel encrypted, but the data is as well, as it is stored in a database. As a result, it is not readable to hackers, or to anyone else for that matter.

The last feature of the "My Privacy Tool" tool is the hot backup function. A user can list up to 50 documents, and the system automatically checks to see if they have been modified on the host computer. If so, they are automatically backed up without user intervention.

Benefit 1

"My Privacy Tool" is the most secure way to transfer a document electronically over the internet.

Benefit 2

"My Privacy Tool" is the most secure way to communicate electronically either with email or instant messaging.

Benefit 3

"My Privacy Tool" is a powerful enterprise tool, yet can be used by an individual as well, for privacy.

Benefit 4

"My Privacy Tool" permits travel with an empty laptop. When a document is required, it is downloaded from the Nassau bunker, edited, printed, and uploaded back to the server.

Benefit 5

Because there is no SMTP stack, multiple copies of emails or communications are not kept all over the system. There is no central place that keeps email and thus when an email is deleted, it is gone. An added feature is that "My Privacy Tool" is not susceptible to email and chat viruses, because it does not use the vulnerable Microsoft paradigm that viruses and Trojans exploit.

Benefit 6

"My Privacy Tool" can be used from anywhere in the world where there is an internet connection.

Benefit 7

"My Privacy Tool" can be used to deliver ultra-private monthly statements or other documents that require care, trust and privacy.

Benefit 8

"My Privacy Tool" can save hundreds of dollars in courier fees for the transmission of private documents.

Benefit 9

"My Privacy Tool" provides your clients with the knowledge that you are vigilant of their privacy needs, and have taken steps to insure their privacy.

Benefit 10

"My Privacy Tool" is a revenue center for your business. It can be marked up, or included with premium services which will generate an additional revenue stream.

Summary

"My Privacy Tool" is not meant to replace your regular document repository and communications systems. It is intended for private, sensitive documents. It enables travel with an empty laptop and protects against email & chat viruses, theft, loss of computer, or unwarranted seizure of your computer. "My Privacy Tool" is the first integrated tool to do this. It is a necessary tool for complaint privacy users.

This concept is an incarnation of the non-cloud cloud storage concept.

Note: This tool is supplied to bona fide entities and corporations after KYC is established, and is not open to individuals or the general public.

For further information, please send an email from a non-free corporate account to DataPrivacy-at-mail.com. (Replace "-at-" with "@")