Interactive undersea cable map

Ever since I was a kid, maps have always fascinated me. I eagerly anticipated each month’s National Geographic not for the usual, ah, imagery that would so fascinate adolescents but instead because I knew the magazine would include an incredibly detailed map of someplace in the world or beyond. Even today maps can hold my interest for unusually long times: I’m certainly guilty of spending too much time gazing at the route maps in airline magazines and playing with the Great Circle Mapper (the planet sure looks different when you’re standing on the top or on the bottom).

While cartography was and remains a hobby, data communications was where I wanted to start my career. Imagine my surprise, then, when I encountered Greg’s Cable Map, a live mashup of undersea telecommunications cables culled from multiple data sources. Pointing to a cable reveals its landing count, length, and bandwidth; clicking it displays links with additional detail; zooming in close enough shows all the landings in a particular city. I spent a few hours exploring the world’s interconnects. Some interesting tidbits:

• Guam’s a pretty data-busy place — 12 cables carry 26.7 terabits per second through three cities
• Southeast Asia has more bandwidth than I would have imagined given how expensive it is to get decent speeds there (time to declare a pox on all government-run PTTs)
• Chennai and Singapore share a huge 8.4 Tbps, 3200 km link
• A half dozen cables carry 15 Tbps along the west coast of Africa
• A fat 5.1 Tbps cable connects a tiny town in Iceland to Denmark
• Svalbard (!) luxuriates in a 5 Tbps link to Norway, the world’s northernmost connection
• New Zealand, whose population exceeds Svalbard by 170,000 percent, gets a paltry 1.2 Tbps with the world’s southernmost connection
• Cuba is surrounded by bandwidth but apparently connected to nothing
• Antarctica truly is deserted
• There’s a 7.68 Tbps link out of Redondo Beach that’s connected to nothing right now, apparently

You can export Greg’s data collection as a .dbf file, which Excel handily reads. Check out the macro view: 211 undersea cables carry 249 terabits per second across 1,077,658 kilometers with 505 landings throughout the world. Wow.

• Share:

Scam spam on the rise

What a busy weekend it must have been for folks who need assistance transferring money out of their destitute dictatorial regimes. As I watched my inbox open this morning I was overcome with joy: so many near-famous yet obscure political figures are reaching out to me personally for help! I’m so grateful to everyone, and I promise that I’ll give each of you the full attention you deserve. Hah.

A dozen examples follow for your entertainment, typos and crappy grammar preserved. Snarkiness added.

1

The shouted subject line seems to demand my attention to a prior ignored request. Guess what: you can’t count, this is the twelfth request of yours I’ve ignored.

From: James Patton <jamespatton00jk8@hotmail.co.uk>
Sent: Friday 27 August 2010 20:30
To: jamespatton00000@rediffmail.com
Subject: 2ND NOTICE AGAIN

Greetings,

We wish to notify you again that you were listed as a Heir to the total sum of (Three Million Six Hundred Thousand British Pounds) in the codicil and last testament of our deceased client. Name now withheld since this is our second letter to you.

We are reaching you the second time because her instruction stipulates that this fund should be paid directly to you upon her death.

If you receive this notice, we request you to kindly acknowledge officially to enable us file in all necessary legal documents to the paying bank for the urgent release of your inheritance.

Please call urgently or send an acknowledgement email to enable us process your inheritance.

Yours Truly,

James Patton

2

Hm. So a religious figure is appointed as the head of a group tasked with fighting scam and fraud, yet your methods invoke fraud? Well, you do claim to be a “reverend,” so I guess resorting to scams and frauds is nothing new to you.

From: Rev Fr Anthony Phillips <anthonyp@uno.com>
Sent: Saturday 28 August 2010 14:54
Subject: Payment Approved

WORLD BANK GROUP

From Desk of the Secretary-General

World Bank Group, LONDON, UNITED KINGDOM

PAYMENT APPROVAL FROM WORLD BANK LONDON, UNITED KINGDOM.

I am Rev Fr Anthony Phillips, Bill and Exchange Manager/ Secretary General, Head of the World Bank Finance Group, London Branch, set up to fight against scam and fraudulent activities worldwide.

This Group is responsible for investigating the legitimacy of unpaid contract, inheritance and lotto winning claims by companies and individuals and directs the paying authorities (banks) worldwide to make immediate payment of verified claims to the beneficiaries without further delay. You are being legally contacted regarding the release of your long awaited fund. After a detailed review of your file, the World Bank Group has mandated that your fund should be release immediately.

The sum of $7,000,000.00 USD (Seven Million United States Dollars) has been approved in your favor via my desk. I therefore wish to inform you that your payment is being processed and will be released to you as soon as you respond to this letter.

Please re-confirm the following to me:

(1) Name

(2) Phone and Fax

(3) Company Name, and Home Address, Profession

Note that the above fund has been cleared from terrorist or fraud related activities. Thanks for Your Cooperation.

Rev Fr Anthony Phillips

(Secretary-General)

World Bank Group

3

At least you got the telephone country code for Benin right.

From: Mrs. Omor Onye. <omor@w.cn>
Sent: Saturday 28 August 2010 16:01
Subject: CONTACT UNDERSIGN PERSON NOW !!

Hello Dear

I have been waiting for you since to come down here and pick your Bank Draft but did not hear from you since that time ,Then I went and deposited the Draft of $800,000USD with Global Courier Service Company here in Benin Republic,because I traveled to Iraq for health reasons and will not come back till next month end.  You have to contact the Global Courier Service Company to know when they will deliver your package.

I have paid for the delivering charges and insurance fee.The only money you have to send to them is there security keeping fee which is $105 to received your package.  Don’t be deceived by any body this is there Contact Address:

Contact Dr.Chi August

Director global courier company

E-MAIL:( glabal002010@w.cn )

Phone:+22996342832

Try to contact them as soon as possible to avoid increasing the security keeping fee. Reconfirm your delivering address to them to avoid wrong delivering. Let me know as soon as you receive your Draft.

Thanks

Mrs. Omor Onye.

4

Miss Moureen, you forgot to mention exactly what you need me to be reliable about. Are you looking for a discreet liaison? You should know even my best friends don’t think I have “allot” of sincerity.

From: Moureen Ahmed <moureen01ahmed@att.net>
Sent: Sunday 29 August 2010 5:28
Subject: Hello,

Hello,

My name is Moureen Ahmed a young girl from Ivory coast. I got your contact email while making some research for reliable foreigner on the Internet (Remember the distance or colour does not matter but our good heart and sincerity matters allot in life ) i will be waiting to hear from you so that i will tell you more about my self and send my picture to you.I wish you all the best for your day.Always stay blessed from my deepest heart.

Yours respectfully,

Miss Moureen.

5

If you’re now “seeking for refugee” in Dakar, why are you writing someone in America? You can find Senegalese refugees in — surprise — Senegal! Also, if you don’t mind, would you please forward me the web address of the Internet directory you found me in? I’d like to make sure that you also are represented, for some day I may need to inquire a favor of you.

From: Sasua Alessandro <sasua01@operamail.com>
Sent: Sunday 29 August 2010 9:55
To: sasuaalessandro@hotmail.com
Subject: Hello Dear,

Hello Dear,

I know that this proposal might be a surprise to you but do consider it as an emergency. I introducing my self as Ms.Sasua G. Alessandro. 22years of age, from the republic of Sierra-Leone in west Africa,now seeking for refugee in Dakar Senegal under the UN destitute home. I am the only Daughter of late Chief Mrs Gregoire Alessandro. the managing director of Rainbow Gold and Diamond Mine company in (KENEMA) Sierra-Leone. But he was killed along side with my mother during the political civil war and all his properties was totally destroyed. However, after their death I managed to escape with a very important documents DEPOSIT CERTIFICATE of Thirty Six Million Six Hundred Thousand U.S. Dollars. ($36.6M) in a finances company which i am the next of kin. I seek a trust worthy foreign person to assist me achieve my late father fund because of my situation here.I got your contact from an online Directory I will be gladly to give you 25% of the total sum for your assistance input. please it is very important you contact me immediately on my private email address: (sasuaalessandro@hotmail.com) for further explanation on how we will proceed. Awaiting your immediate response, Thanks and God bless.

Best Regards

Ms.Sasua G. Alessandro.

(sasuaalessandro@hotmail.com)

6

Hm, another email from a relative of a dead mining executive. What’s going on? I thought only the miners themselves died because of poor working conditions and corruption from the top. One can only hope this is indicative of a trend: maybe the repressed miners are murdering their rapacious dictators!

From: samyang@cantv.net
Sent: Sunday 29 August 2010 10:36
To: samyang@cantv.net
Subject: Re: I need your co-operation !!!

Dear Friend,

It is with heartfelt hope that I write to seek your co-operation and assistance in my client’s desire to invest into Estate properties or any lucrative business in your country or elsewhere.

My name is Mr. Samuel  Yang; I work with ICF International, a global professional services firm, partners with government and commercial clients to deliver consulting service.

And my clients are daughter and wife of the late Chairman of TARJAM GOLD AND DIAMOND MINING CO, and wish to seek for your maximum cooperation and assistance in their plans of investing in your country. However, I will be happy to disclose to you the amount to be claimed and invested as soon as I received your reply, as I expect you to be trustworthy and kind enough to respond positively to my Inquiry.

Your’s sincere

Mr.Samuel  Yang

7

Melvin, truly it isn’t necessary to shout at me in your emails. Plus, what’s with the square brackets? Haven’t you learned from your compatriots (see above for plenty examples) that monetary amounts should be enclosed in parentheses? Obviously you’re a noob at this stuff.

From: Melvin Bruce <melvinbruce901@gmail.com>
Sent: Sunday 29 August 2010 16:23
Subject: URGENT AND CONFIDENTIAL!!!

DEAR FRIEND

URGENT AND CONFIDENTIAL.

TRANSFER OF [$13,500.000.00 USD. THIRTEEN MILLION FIVE HUNDRED THOUSAND UNITED STATES DOLLARS WE WANT TO TRANSFER TO OVERSEAS [$13,500.000.00] THIRTEEN MILLION FIVE HUNDRED THOUSAND UNITED STATES DOLLARS FROM CAPITEC BANK IN SOUTH AFRICA. I WOULD LIKE, IF YOU WILL BE CAPABLE AND FIT TO PROVIDE EITHER AN EXISTING BANK ACCOUNT OR TO SET UP A NEW BANK ACCOUNT IMMEDIATELY TO RECEIVE THIS MONEY, EVEN AN EMPTY ACCOUNT CAN SERVE TO RECEIVE THIS MONEY, AS LONG AS YOU WILL REMAIN HONEST TO ME TILL THE END OF THIS IMPORTANT BUSINESS TRANSACTION.

I WANT TO BELIEVE THAT YOU WILL NEVER LET ME DOWN EITHER NOW OR IN FUTURE. I   AM  MR. MELVIN BRUCE OF ACCOUNTS DEPARTMENT OF CAPITEC BANK SA, DURING THE COURSE OF OUR AUDITING I DISCOVERED A FLOATING FUND IN AN ACCOUNT OPENED WITH OUR BANK IN 1999 AND SINCE 2008 NOBODY HAS OPERATED ON THIS ACCOUNT AGAIN, AFTER GOING THROUGH SOME OLD FILES IN THE RECORDS I DISCOVERED THAT THE OWNER OF THE ACCOUNT DIED WITHOUT AN HEIR HENCE THE MONEY IS FLOATING AND IF I DO NOT REMIT THIS MONEY OUT URGENTLY IT WILL BE FORFEITED FOR NOTHING.

THE OWNER OF THIS ACCOUNT WAS A FOREIGNER,AN INDUSTRIALIST, HE DIED SINCE 2005 AND NO OTHER PERSON KNOWS ABOUT THIS ACCOUNT OR ANYTHING CONCERNING IT, THE ACCOUNT HAS NO BENEFICIARY AND MY INVESTIGATION PROVED TO ME AS WELL THAT THE ACCOUNT OWNER UNTIL HIS DEATH WAS A EXPERTRIATE/CONTRACTOR WITH ESKOM IN SOUTH AFRICA [PTY] SA.

I AM CONTACTING YOU AS A FOREIGNER BECAUSE THIS MONEY CAN ONLY BE APPROVED TO A FOREIGNER WITH A VALID INTERNATIONAL PASSPORT OR DRIVERS LICENCE AND FOREIGN ACCOUNT BECAUSE THE MONEY IS IN US DOLLARS AND THE FORMER OWNER OF THE ACCOUNT IS A FOREIGNER.I AM REVEALING ALL THIS TO YOU WITH THE BELIEF THAT YOU WILL NEVER LET ME DOWN IN THIS BUSINESS, YOU ARE THE FIRST AND THE ONLY PERSON I AM CONTACTING FOR THE BUSINESS SO PLEASE REPLY URGENTLY FOR ME TO TELL YOU THE NEXT STEP TO TAKE.

YOU SHOULD FORWARD YOUR TELEPHONE AND FAX NUMBERS WHICH IS ALSO NEEDED. YOU WILL HAVE TO GIVE ME THE ASSURANCE WHEN WE MEET THAT THIS MONEY WILL BE INTACT PENDING OUR PHYSICAL ARRIVAL IN YOUR COUNTRY FOR SHARING AND DISBURSEMENT OF THE FUND WHICH WILL BE 40% FOR YOUR ASSISTANCE, 55% WILL BE FOR US WHILE 5% WILL BE SET ASIDE TO TAKE CARE OF ALL THE EXPENSES THAT WILL BE INCURED BY BOTH PARTIES DURING THE COURSE OF THE TRANSFER.

I LOOK FORWARD TO YOUR EARLIEST RESPONSE, NOTE YOU CAN ALSO CALL ME ON MY PRIVATE NUMBER OR MY E-MAIL ADDRESS BELOW, FOR SECURITY REASONS.

BEST REGARDS

MR. MELVIN BRUCE

Tel:+27-731-562-016

Fax:+27-865-711-287

Email:melvinbruce02@aol.com

8

Curse those poisonous heartless elements! If only they came with, oh, warning labels or something. Then we wouldn’t have to read messages of such inane tragedy.

From: Jenny Marissa <jennym25@yahoo.com>
Sent: Monday 30 August 2010 1:46
Subject: HONEST SOMEONE

HONEST SOMEONE

During the civil and political crisis in our country, my parents together with my three sisters were poisoned by heartless elements. Fortunately for me, I was in school when this tragedy took place to our family. I was in coma for almost two weeks. But I thank the almighty God because I never knew that I could support the shock of losing almost my whole family. That is by the way. Right now I am still here in Cote d’Ivoire with but very unsafe for me. I’m living in great fear and bondage. I intend leaving this country as soon as possible but only one thing kept me back. My late father has deposited with one of the prime bank the sum of money, $5.2Million USD, for onward transfer to any bank abroad .But unfortunately he did not complete the transaction before he died. I have met with the bank director who has certified my claims to the money. I have all the documents concerns this money in the bank; I have mapped out 20% out of the total money for your help and assistance because it looks stupid for me trying to confide in a total stranger I never met before. By instinct I am convinced you are an honest person and you have the capacity to handle this transaction with me. As soon as it is done, I will come over to meet you and spend the rest of my live in your country. I wish to invest the money into estate business etc. I promise to greatly compensate you for any assistance you may offer us. I do not know how you may feel about this but I want you to take this very serious and confidential. Down here, I am living in fear because enemies of my parents are hunting for me. Please let me know your mind concerning my proposal to you.

Miss Jenny

9

Attention Email Sender: I do have a name, you know. If you Google it, I rank pretty highly. Perhaps if you readdressed it to me personally, rather than relying on a bulk remailer that’s apparently constructed entirely of fail, I might consider responding to you. One would think that your offer of half a million bucks should be addressed to a recipient you actually can name. Oh, one question about the third item in your list. By “sex” do you mean gender or amount? And if you mean amount, then where you come from are “age” and “sex” proportional or inversely proportional?

From: Loteria Nacional <info@loterianacional.org>
Sent: Sunday 29 August 2010 16:24
Subject: Your E-Mail Address Has Won 485,910.00 Euros

Attention Email ID User,

We happily announce to you the draw of the Loteria Nacional Special Global 2010 Promotional Draw held in Madrid Spain.Your e-mail address attached to REF No;ESP/62934LN/2010, with Batch No: CH 200 drew the Winning No: 02 10 16 18 27 41, Bonus No: 28 for LN-49 Lotto under the choice of the lottery in the 1st category.

All participants were selected randomly from World Wide Web site through computer draws system and extracted from over 10,000,000 companies and personal e-mails. So your email is your online automatic ticket that qualified you for this draw. You have therefore been approved to claim a total sum of 485,910 Euros (Four Hundred and Eighty Five Thousand Nine Hundred and Ten Euros)

Therefore, you are required to forward your details to our claims Agent/Finance and Legal office to help facilitate the processing of your fund as stated below:

1. FULL NAMES: ________

2. ADDRESS: __________

3. AGE AND SEX: ________

4. MARITAL STATUS: _____

5. OCCUPATION: ________

6. E-MAIL ADDRESS: ______

7. TELEPHONE NUMBER: ________

Contact Person: Barrister.Luis Capiel.

Tel: +34 672 860 220

E-mail:info.hamiltonabogados@aol.es

Congratulation!!

Sincerely,

Sandra Luque (Mrs.)

10

Hey, are you related to the Moureen Ahmed who wrote me earlier? She’s from the Ivory Coast, too. You chicks have similar names! Perhaps you could get together and talk about whose is spelled correctly. Oh wait, you live in a country where women are prevented from getting a decent education. Maybe one day the entire world will realize this is the goddamn 21st century. You’ve been kept in such ignorance that you believe an Internet email and “praying over my profile” will help you. I’m sorry.

From: maureen jaffar <maureenjaffar1@gmail.com>
Sent: Monday 30 August 2010 4:58
Subject: Hello My Dear,

Hello My Dear,

Permit me to inform you of my desire to go into business relationship with you, after going through your profile and I prayed over it and selected your name among other names due to the nature of my proposal, which requires a reputable and trustworthy person. Someone who will be kind and sincere to me. I am writing to seek your partnership in the investment of my inheritance.

I am Ms Maureen Jaffar. From Ivory Coast, I am an orphan and I need your honest assistance to transfer my inheritance (USD$6.700, 000.00) which my late father deposited in a security company. here that he used my name as the only daughter for his next of kin in deposit of the funds. befor his assasination for reason which I will let you know as soon as I hear your quick reply. I am honourable seeking your assistance in the following ways.

(1) To serve as my guardian in your country while I will depend on your expert advise since l am a girl of 20 years.

(2) To make arrangement for me to come over to your country in order to further my university education and to secure a residential permit for me in your country. Moreover l am willing to offer you 20% of the total sum as compensation for your assistance in the transfer of this deposit to your country. Furthermore, you can indicate your option towards assisting me as l believed that this project would be concluded within seven days you signify interest to assist me by contacting the security company.

Hoping to hearing from you soon. May God bless you as you extend your helping hand to an orphan.

Please I would like you to keep this proposal as a top secret and delete it if you are not interested in assist me, I wish you a happy day.

Best wishes

Sincerely,

Ms Maureen Jaffar

11

What is up with orphaned Ivory Coasters? Are you even capable of picturing the kinds of numbers you claim to possess? You seem to know the mind of god, and seek a “GOD fearing partner overseas.” Sandra, you’ve written to the wrong man. Perhaps you should investigate your subjects a little more thoroughly.

From: Sandra Omaru <omaru.sandra@hanmail.net>
Sent: Monday 30 August 2010 10:51
To: omaru.sandra@hanmail.net
Subject: From Sandra Omaru

From Sandra Omaru

Abidjan. Cote dIvoire,

West Africa.

Hello dearest,

I deep it a respect and humble submission, I beg to state the following few lines for your kind consideration, I hope you will spare some of your valuable minutes to read the following appeal with sympathetic mind. I must confess that it is with great hopes, joy and enthusiasm that I write you this email which I know and believe by faith that it must surely find you in good condition of health.

My name is Sandra Omaru, I am the only child of my late parents Chief. Mr. Williams Omaru. My father was a highly reputable business magnet who operated in the capital of Ivory Coast during his days.

It is sad to say that he passed away mysteriously in France during one of his business trips abroad on the 12th April 2009. Though his sudden death was linked or rather suspected to have been masterminded by an uncle of mine who travelled with him at that time. But God knows the truth! My mother died when I was just 6yrs old, and since then my father took me so special.

Before the death of my father on April 2009, he called me and informed me that he has the sum of Five Million, Six Hundred thousand United State Dollars.(USD$5,600,000.00) he deposited in a private Bank here in Abidjan Cote D’Ivoire.. He told me that he deposited the money in my name, and also gave me all the necessary  legal documents regarding to this deposit with the Bank,

I am just 22 years old and a university undergraduate and really don’t know what to do. Now I want an honest and GOD fearing partner overseas who I can transfer this money with his assistance and after the transaction I will come and reside permanently in your country till such a time that it will be convenient for me to return back home if I so desire. This is because I have suffered a lot of set backs as a result of incessant political crisis here in Ivory coast.

The death of my father actually brought sorrow to my life. I also want to invest the fund under your care because I am ignorant of business world.

I am in a sincere desire of your humble assistance in this regards.Your suggestions and ideas will be highly regarded.

What percentage of the total amount in question will you take after the fund has being transferred to your account and I come over to meet you?

Please, consider this and get back to me as soon as possible. Immediately I confirm your willingness, I will send to you my Picture and also inform you more details involved in this matter. Please get back to me through my privait email omarusandra@yahoo.com waiting to read from you.

Kind Regards,

Sandra Omaru.

12

While you got Belgium’s country code correct, you shouldn’t assume that an international dialing sequence universally begins with zero-zero. Another sign that you’re an incompetent beginner: don’t start your emails with “RE:”; I certainly never sent you any original email with your subject line. I must say, though, that I’m intrigued about “the modalities we shall follow to ensure a smooth hitch-free transaction.” Would this include multiple midnight rendezvous underneath foggy nondescript highway overpasses? I do have one request, though: I’d like to bring a hitch. Preferably my favorite one, Christopher Hitchens. Watching him verbally destroy you would be such a gas.

From: conte <conteinvest1@gawab.com>
Sent: Monday 30 August 2010 14:00
To: aws-security@amazon.com
Subject: RE:REQUEST

I am Diallo Conte, Son of  Lansana Conte former president of Guinea-Conakry Who die on the December 2008. I am presently on oversea trip in Belgium.

First and foremost, I apologize using this medium to reach you for a transaction/business of this magnitude, but this is due to confidentiality and prompt access reposed on this medium.

Be informed that a member of the Republic of Guinea-Conakry Export Promotion Council who was at the Government delegation to your country during a trade exhibition gave your enviable credentials/particulars to me.

I have decided to seek a confidential co-operation with you in the execution of the deal described hereunder for the benefit of all parties and hope you will keep it as a top secret because of the nature of this transaction.

I have huge fund to invest in your country, my father deposited thirty five million six hundred thousand united state Dollar (35.600.000.00) in a financial firm before he die. For your assistant 20 % for you and 10% for miscellaneous expenses we may incur on the cause of this transaction.

On the notice of your willingness to assist me, I will tell you the modalities we shall follow to ensure a smooth hitch-free transaction.

Please send email to me as soon as you receive this message for more briefing, my email address is: ( contelab47@gmail.com ) or call me on this number :0032493833321

I wait in anticipation of your fullest co-operation.

Yours faithfully,

Diallo Conte

That’s all for today. My heart bleeds for these people! Now let me grieve in peace.

• Share:

Disscecting a phish: almost too clever

Recently a customer forwarded a phishing email he received. It was pretty close to the usual: claims of too many failed logins necessarily requires account suspension pending verification. This one had a curious twist: rather than encouraging the victim to click a malicious link, the email included an attachment. Not just any attachment, mind you, but an HTML form the victim was instructed to open in his web browser. The attacker did a decent job spoofing the Amazon look and feel–he pulled CSS directly from our site. Here’s a screenshot of the form (click to see in full size):

I’m fairly certain this is the first time I’ve seen a form ask for mother’s maiden name and drivers license! Really, though, shouldn’t it have also asked for my favorite color and my frequent flier numbers, too, just for even greater security?

Anyway…being the curious sort that I am, I just had to find out what lurked behind the “Continue” button. I opened the HTML file in Notepad++ and began my exploration. It’s 1703 lines long–too much to read line-by-line. What I really wanted to see was the form’s POST method, so I searched for that. No dice. Eh? A form without a POST is like, well, whatever. Time for close scrutiny. Eventually at line 1545 I find this little gem (shown here as an image):

Now isn’t that interesting? An on-the-fly unescape…obviously there be dirty deeds here. Using Malzilla (an excellent tool for ferreting out malicious code in web pages) I loaded the script and ran it through the decoder. Then I executed it. Here are the results:

Gold! But it gets even goldier: check out the IP address. When’s the last time you saw one in hex? To save you the trouble of reaching for that old programmer’s calculator, I’ll convert for you: it’s 69.198.196.10. A quick check at DomainTools shows that IP belongs to Cbeyond. My guess: someone found a vulnerable server, stowed their malware there, and is using it to harvest PII. I turned over my investigation results to our fraud group; we have an excellent process for shutting this crap down.

Ah, it was a fun day…

• Share:

Do people just not give a damn?

Last month an article in Dark Reading’s Tech Center discussed the FTC’s punishment of Twitter for security and privacy violations. Details of the attack:

According to the FTC, the privacy policy posted on Twitter’s website stated that “Twitter is very concerned about safeguarding the confidentiality of your personally identifiable information. We employ administrative, physical, and electronic measures designed to protect your information from unauthorized access.”

The FTC’s complaint alleges that between January and May 2009, hackers were able to gain administrative control of Twitter on two occasions. In January 2009, a hacker used an automated password-guessing tool to gain administrative control of Twitter after submitting thousands of guesses into Twitter’s login website. The administrative password was a weak, lowercase, common dictionary word, the complaint says.

During a second security breach in April 2009, a hacker was able to guess the administrative password of a Twitter employee after compromising the employee’s personal email account, where two similar passwords were stored in plain text. The hacker reset at least one Twitter user’s password, and could access nonpublic user information and tweets for any Twitter users.

According to the FTC’s complaint, Twitter was vulnerable to these attacks because it failed to prevent unauthorized administrative control of its system, including reasonable steps in password management among administrators and employees.

How many WTFs can you count here? The operator of the world’s largest personal status update service prattles forth about how secure they are, yet they use crappy passwords and send them around in plain-text emails. When I read stories like this I hang my head in shame and wonder what the hell is wrong with people. Hasn’t anyone been paying attention? Obviously not.

Sadly, the punishment seems just plain stupid. Again from the Dark Reading article:

Under the terms of the settlement, Twitter will be barred for 20 years from misleading consumers about the extent to which it protects the security, privacy, and confidentiality of nonpublic consumer information, including the measures it takes to prevent unauthorized access to nonpublic information and honor the privacy choices made by consumers.

Note the phrasing: “Twitter will be barred for 20 years from misleading consumers.” I hope that’s perhaps a misreading of the judgment on the part of the article’s author. If not, and the statement is truly accurate, does it mean that after 20 years, Twitter (if they’re still around then) is free to make up complete and total bullshit security statements again?

Actually, my parenthetical statement above leads me to another question. Maybe it’s time for an IETF standard for a publish-subscribe short message protocol. Why should one private company be your only choice?

• Share:

A rant, in which I heap scorn upon Priceline

Today I received an email with an example of truly horrendous concern for customer security. It’s fair to assume that the average surfer of the interwebs uses the same password everywhere. Priceline has cleverly figured out how to obtain this from unsuspecting users. Here’s the logon form for registering a new account:

Note the subtle phrasing. The box where you type your password prompts you to enter your preferred Internet password. Sneaky, clever, and evil.

That’s not all. Here’s another Priceline web form. Check out one of the questions:

I received this example via email from someone else, I can’t find it myself on Priceline’s web site. I’m really curious what this is for — if it’s an alternate way to initially set up your account, and it provides a choice of suggestions for secrets, here again they’ve figured how to engineer out of a customer what that person’s everywhere-on-the-Internet password is. Or perhaps it’s the world’s worst example of a password recovery question: tell us the password you use everywhere else.

Shame on you, Priceline; your wanton disregard for helping keep customers secure is pitiful. Apparently you spend so much money on marketing that you can’t afford to hire someone with decent security smarts.

• Share:

Building virtual three-tier architectures with AWS security groups

(This is a repost of my article on the AWS blog. I’m putting it here for my readers who don’t follow me there.)

Update (17 June): I’ve changed the command-line examples to reflect current capabilities of our SOAP and Query APIs. They do, in fact, allow specifying a protocol and port range when you’re using another security group as the traffic origin. Our Management Console will support this functionality at a later date.

During a recent webcast an attendee asked a question about building multi-tier architectures on AWS. Unlike with traditional on-premise physical deployments, AWS’s virtualization of compute, storage, and network elements requires that you think differently about how to build network segregation into your projects. There are no distinct physical networks, no VLANs, and no DMZs. So how can you construct the equivalent of traditional three-tier architectures?

Our security whitepaper alludes to the possibility (pp. 5-6, November 2009 edition). In my security presentations I show this diagram to illustrate conceptually how a three-tier architecture can be built:

Security groups: a quick review

Before we explore how to define the architecture, let’s take a moment to review some critical details about how security groups work.

A security group is a semi-stateful firewall (more on this in a moment) that contains one or more rules defining which traffic is permitted into an instance. Rules contain the following elements:

• The permitted protocol (TCP or UDP)
• The permitted destination port range (more on this in a moment, too)
• The permitted source IP address range or originating security group

Now there are three particular aspects I’d like to call your attention to. First: security groups are semi-stateful because changes made to their rules don’t apply to any in-progress connections. Say that you currently have a rule permitting inbound traffic to port 3579/tcp, and that there are right now five inbound connections to this port. If you delete the rule from the group, the group blocks any new inbound requests to port 3579/tcp but doesn’t terminate the existing five connections. This behavior is intentional; I want to ensure everyone understands this. In all other respects, security groups behave like traditional stateful firewalls.

The second aspect is our terminology for port ranges. This often confuses people new to AWS. The traditional usage of the words “from” and “to” in security-speak describes traffic direction: “from” indicates the source and “to” indicates the destination. This isn’t the case when defining rules for security groups. Instead, security group rules concern themselves only with destination ports; that is, the ports on your instances listening for incoming connections. The “from port” and “to port” in a security group rule indicate the starting and ending port numbers for occasions when you need to define a range of listening ports. In most cases you need to allow only a single port, so the values for “from port” and “to port” will be the same.

This leads to the third aspect I’d like to discuss: how to define traffic sources. The most common method is to specify a protocol along with an individual source IP address, a range of IP addresses using CIDR notation, or the entire Internet (using 0.0.0.0/0). The other way to define a traffic source is to supply the name of some other security group you’ve already created. Here’s the magic jewel for creating three-tier architectures; it’s this capability that answered the person’s question on the webcast.

Defining the security groups for a three-tier architecture

If you’re an API aficionado, you can use these eight simple calls to create the three required security groups to implement this architecture:

ec2-authorize WebSG -P tcp -p 80 -s 0.0.0.0/0
ec2-authorize WebSG -P tcp -p 443 -s 0.0.0.0/0
ec2-authorize WebSG -P tcp -p 22|3389 -s CorpNet

ec2-authorize AppSG -P tcp|udp -p AppPort|AppPort-Range -o WebSG
ec2-authorize AppSG -P tcp -p 22|3389 -s CorpNet

ec2-authorize DBSG -P tcp|udp -p DBPort|DBPort-Range -o AppSG
ec2-authorize DBSG -P tcp -p 22|3389 -s CorpNet
ec2-authorize DBSG -P tcp -p 22|3389 -s VendorNet

Note here the interesting distinction in the parameters used with the commands. If the rule permits a source IP address or range, the parameter is “-s” which indicates source. If the rule permits some other security group, the parameter is “-o” which indicates origin. Neat, huh?

The color coding in the rule list helps you visualize how the rules relate to each other:

• The first three statements define WebSG, the security group for the web tier. The first two rules in the group permit inbound traffic to destination ports 80/tcp and 443/tcp from any node on the Internet. The third rule in the group permits inbound traffic to management ports (22/tcp for SSH, 3389/tcp for RDP) from the IP address range of your internal corporate network — this is optional, but probably a good idea if you ever need to administer your instances

• The second two statements define AppSG, the security group for the application tier. The second rule in the group permits inbound traffic to management ports from your corpnet. The first rule in the group permits inbound traffic from WebSG — the origin — to the application’s listening port(s).

• The final three statements define DBSG, the security group for the database tier. The second and third rules in the group permit inbound traffic to management ports from your corpnet and from your database vendor’s network (required for certain third-party database products). The first rule in the group permits inbound traffic from AppSG — the origin — to the database’s listening port(s).

Of course, not everyone’s a programmer (your humble author included), so here are some screen shots showing how to define these security groups using the AWS Management Console. Please be aware that using the Console produces different results, which I’ll describe in a moment.

WebSG: permits HTTP from the Internet, HTTPS from the Internet, and RDP from our sample corpnet address range:

AppSG: permits connections from instances in WebSG and RDP from our sample corpnet address range:

DBSG: permits connections from instances in AppSG and RDP from our sample corpnet and vendor address ranges:

Important. The AWS APIs and the Management Console behave differently when defining security groups as origins:

• Management console: When you define a rule using the name of a security group in the “Source (IP or group)” column, you can’t define specific protocols or ports. The console automatically expands your single rule into the three you see: one for all ICMP, one for all TCP, and one for all UDP. If you remove one of them, the console will remove the other two. If you wish to further limit inbound traffic on those instances, feel free to use a software firewall such as iptables or the Windows Firewall.

• SOAP and Query APIs: With the APIs, rules containing security group origins can include protocol and port specifications. The result is only the rules you define, not the three broad automatic rules like the console creates. This provides you with greater control and reduces potential exposure, so I’d recommend using the APIs rather than the Console. As of now, while the Console correctly displays whatever rules you define with the APIs, please don’t modify API-created rules because the Console’s behavior will override your changes. We’re working to make the Console support the same functionality as the APIs.

More information

The latest API documentation provides details and examples of how to configure rules in security groups. To learn more, please see:

• Network security concepts (from the Amazon EC2 User Guide)
• Using security groups (from the Amazon EC2 User Guide)
• SOAP and Query API examples (from the Amazon EC2 Developer Guide)
• SOAP API syntax (from the Amazon EC2 API Reference)
• Query API syntax (from the Amazon EC2 API Reference)

I hope this short tutorial has been useful for you and provides information you can use as you plan migrations to or new implementations in AWS. Over time I plan to write more short security and privacy related guides which I’ll post here and in our Security Center. If you have comments or suggestions about content you’d like to see, please let me know. We’re here to make sure you succeed!

• Share:

Tim Joseph’s “Unified Field Theory”

Last night I tweeted a couple shorthand bits from Tim Joseph’s “Unified Field Theory” from the December 1975 issue of Analog. A couple folks wondered what else there was, so here’s the full thing:

In the beginning there was Aristotle,
And objects at rest tended to remain at rest,
And objects in motion tended to come to rest,
And soon everything was at rest,
And God saw that it was boring.

Then God created Newton,
And objects at rest tended to remain at rest,
But objects in motion tended to remain in motion,
And energy was conserved and momentum was conserved and matter was conserved,
And God saw that it was conservative.

Then God created Einstein,
And everything was relative,
And fast things became short,
and straight things became curved,
And the universe was filled with inertial frames,
And God saw that it was relatively general,
but some of it was especially relative.

Then God created Bohr,
And there was the Principle,
And the Principle was Quantum,
And all things were quantified,
But some things were still relative,
And God saw that it was confusing.

Then God was going to create Ferguson,
And Ferguson would have unified,
And he would have fielded a theory,
And all would have been one,
But it was the seventh day,
And God rested,
And objects at rest tend to remain at rest.

• Share:

Upcoming webinar – Application security in the cloud

Amazon Web Services is teaming with RightScale and HyperStratus to deliver a webinar on cloud security. In survey after survey, and just about everywhere I travel, potential cloud computing users mention security as their number one concern. This webinar presents a set of best practices to ensure security for applications running in the Amazon Web Services (AWS) environment using the RightScale management platform with HyperStratus application integration.

Come and learn application security best practices from Bernard Golden, CEO of HyperStratus; Michael Crandell, CEO of RightScale; and yours truly (Steve Riley), Sr. Technical Program Manager at Amazon Web Services. Topics include:

• The three crucial layers of security in a cloud computing environment
• How Amazon Web Services ensures a secure infrastructure throughout its cloud computing environment
• How RightScale implements a management and monitoring framework to ensure consistent application of security policies throughout an application deployment
• Best practices from HyperStratus that integrate applications with the infrastructure and monitoring framework to ensure the highest possible level of application security
• How to address the five key areas of application security configuration to prevent unauthorized access and poor data security in cloud environments

Register now! See you online, Thursday 20 May 2010 at 11:00 AM PDT/2:00 PM EDT.

• Share:

This is freaking me out

Makes me happy because I can get to more places directly, but still…this is gonna make me go ??? every time I see it for a few months, at least!

(Yes, yes, I know I haven’t written anything for a while. I’ve been heads-down working on presentations and some other security-related stuff. I’ll be back on the blog soon.)

• Share:

Explaining Twitter to a newbie

Feel free to reuse

After you become a Twitterer, your activity is called tweeting. Your pithy 140-character missives are called tweets. Those who hang desperately to your every utterance are called followers; collectively they are your tweople. Some of your followers will re-tweet statements they particularly like or want to ridicule. Self-aggrandizement often appears in the form of a twidnap, where unimportant people become jealous of certain Twitterers and follow the same tweople they do. During significant events many Twitterers become twittery with excitement, inundating their followers with useless information. It’s primarily only these folks who assemble at regular in-person tweet-ups, where presumably they continue speaking in 140-character bursts of poorly spelled text.

• Share:

Attention Las Vegas airport thief: go to hell

I dutifully placed my shoes in the bin. I obligingly removed my one-liter baggie of 100-milliliter liquids, gels, and creams from my carry-on. I separated my electronics. I double-checked my empty pockets. All good, right? Wrong. I walked through the metal detector and heard a beep — but not the accusatory BZZZZZZZZZT! one would expect. Instead, a soft chime. The security guy (sorry, despite their blue shirts and gold badges, they don’t warrant the term “officer”) directed me into the little glass jail that you see at some screening stations like in the photo here.

Naturally, I objected. “Why? Your magnetometer didn’t detect anything.” The soft chime, apparently, is the output of some new software in certain magnetometers that randomly chooses people for secondary screening. I’ve been through a zillion screening stations and never encountered this before. So I stand in the little transparent prison, feeling kind of embarrassed, awaiting my fate.

Eventually grizzled old Mr. Male Assist opens the door. Again I ask why I was detained. Acting as if I just questioned the truth of all that is sacred and holy, he growled predictable TSA double-speak at me for the entire time he lovingly caressed my armpits, chest, and back. Finally having gotten his jollies, he toddled off.

Oh, did I mention during this time that he had me turn around and face away from my luggage awaiting me on the conveyor after the X-ray machine? I gathered up my belongings and headed toward the D concourse train. Once on the train I opened my laptop bag to organize some receipts — and noticed the obvious absence of my PlayStation Portable and $70 cash!

Because my back was turned away from the conveyor, I have no idea who swiped my stuff. Nor do I have any means of proving that I previously possessed a PSP or some money, so I don’t think it would do any good to make a report. Maybe I’ll call the airport’s lost-and-found, perhaps my PSP somehow grabbed the cash, defied gravity and jumped up over the height of the gray plastic bin, and landed softly at the feet of a honest TSA droid who turned them in. Yeah, right.

Look, TSA people. Your systems suck, they’re only for show, they do nothing to eliminate actual risk. You intentionally separate people from their belongings, you create unbearable stress for the traveling public, you act as if every single person wanting to get on a plane is a criminal, and you are partially responsible for the downfall of travel revenue — I know plenty of people who don’t travel specifically because they hate your pointless procedures.

And to the person now enjoying my PSP: fuck you.

• Share:

New TSA logo

The winner of Bruce Schneier’s contest for a new logo for the Transportation Security Agency is Rhys Gibson. I love the detail: check out the number of heads and what the eagle is fearlessly clutching in its claws. Gibson must not be from ’round theez parts ‘cuz he cain’t spel theater, huh. Oh well, congrats anyway, can’t wait to get this on some stickers!

If you can possibly believe it, the TSA even has its own apologist blog. Read at your peril: its twisted logic will make your head explode.

• Share:

I’m presenting at CloudCamp Seattle

CloudCamp is coming to Seattle on Wednesday 3 February 2010. My first experience at a CloudCamp was in Phoenix last year. I love its unique format and am excited to join another Camp. It starts with several five-minute “lightning talks”; the Seattle event will have four, and I’ll deliver a rapid overview of cloud security in Amazon Web Services. After the lightning talks is a panel, followed by two breakout “unsessions.” The unsessions are attendee-driven; I’ll focus on general cloud security/compliance and AWS specifics, so come prepared with your toughest questions. Registration is free; donations accepted, too. Hope to see you there!

• Share:

SIIA webinar: Cloud security for dummies

Good day, everyone. The Software and Information Industry Association (SIIA) is hosting a webinar about cloud security on Tuesday 19 January 2010 at 12:30 PM EST/9:30 AM PST. I’m one of the panelists. Here’s a brief blurb and the participants:

Cloud webinar series: Cloud security for dummies
Security and cloud computing have come a long way in just a few years. Understanding these issues becomes vital as cloud computing expands into government and the large enterprise. New trends — like the emergence of private clouds — are changing the way companies think about their security strategy. In this webinar, you’ll hear persepectives from service providers, platforms, pure-play firms, and other players in the cloud security space.

Moderator:
Lars Ewe, Chief Technology Officer, Cenzic
Panelists:
Deb Banerjee, Director of Engineering, Symantec
Jim Cavalieri, Chief Security Officer, Salesforce
Steve Riley, Sr. Technical Program Manager, Amazon Web Services

Event price for SIIA members: free
Event price for non-SIIA members: US$50.00

Please join us if you can!

• Share:

More on ADFS with Amazon EC2

Thanks to those who wrote to me with ideas about using ADFS to federate with Windows instances running in Amazon EC2. My original post was picked up by a couple other blogs, which I’d like to acknowledge here:

• ADFS / WIF on Amazon EC2 by Eugenio Pace (part of the ClaimsID Project)
• A repost on Kim Cameron’s Identity Weblog

As part of a joint project between Amazon Web Services and Microsoft, I’m proud to announce the release of a whitepaper written by David Chappell that explores these federation scenarios in more detail. David begins his paper with an additional scenario — your Amazon EC2 resources are placed in an Amazon Virtual Private Cloud (VPC) and joined to your own corporate domain; here, there’s no use of ADFS. Then he illustrates the two scenarios I mentioned before, and shows how it would work with both ADFS 1.1 and ADFS 2.0.

Soon we’ll release a companion step-by-step guide that walks you through the steps required to build these federation scenarios in a lab. From this you’ll gain the skills and experience necessary to implement them in your production environment. I’ll announce here and on the AWS blog when the guide is available for download.

• Share:

Windows Server 2008, ADFS, and Amazon EC2

As I’ve talked with customers who have deployed or plan to deploy Windows Server 2008 instances on Amazon EC2, one feature they commonly inquire about is Active Directory Federation Services (ADFS). There seems to be a lot of interest in ADFS v2 with its support for WS-Federation and Windows Identity Foundation. These capabilities are fully supported in our Windows Server 2008 AMIs and will work with applications developed for both the “public” side of AWS and those you might run on instances inside Amazon VPC.

I’d like to get a better sense of how you might use ADFS. When you state that you need “federation,” what are you wanting to do? I imagine most scenarios involve applications on Amazon EC2 instances obtaining tokens from an ADFS server located inside your corporate network. This makes sense when your users are in your own domains and the applications running on Amazon EC2 are yours.

Another scenario involves a forest living entirely inside Amazon EC2. Imagine you’ve created the next killer SaaS app. As customers sign up, you’d like to let them use their own corpnet credentials rather than bother with creating dedicated logons (your customers will love you for this). You’d create an application domain in which you’d deploy your application, configured to trust tokens only from the application’s ADFS. Your customers would configure their ADFS servers to issue tokens not for your application but for your application domain ADFS, which in turn issues tokens to your application. Signing up new customers is now much easier.

What else do you have in mind for federation? How will you use it? Feel free to join the discussion. I’ve started a thread on the forums, please add your thoughts there. I’m looking forward to some great ideas.

(Reposted from the AWS blog, where I’ll be writing from time to time.)

• Share:

What are the odds?

Offered for your perusal.

• Share:

The terrorists have won

By now you’ve read plenty about the idiot who tried to blow up an airplane yesterday, and probably have gotten your blood in a boil over the TSA’s detestable reactions. Although there seems to be some reaction among a few folks in the general population that all the security theater insanity has got to stop, alas there are enough sheeple who seem convinced that you can never have too much security. And since these people unfortunately get to vote, and reliably vote for headline-grabbing politicians who care more about the limelight than learning how to respond to real threats, I predict that soon you’ll encounter two more layers of security theater next time you fly. First, the question “What color would you like those rubber gloves?” will no longer be just a joke. Second, billions of dollars will be wasted on whole-body imaging equipment at airports nationwide. Someday this will be you:

Rather than engage in the difficult and successful yet invisible work of meaningful risk assessment, thorough threat investigations, and disrupting the funding of terrorist organizations and their wanna-be copycats, our elected representatives and their political appointees take the easy path: they stoke the fears of a worried, ignorant public. Attention, DHS: piss off.

• Share:

Speaking in New York, Thursday 10 December 2009

It’s great to be back on the road. One of the things I always enjoyed about my previous job was the travel — meeting new people, exploring new destinations. I’m glad that my work at Amazon Web Services continues in that vein.

I’ll be in New York and New Jersey later this week for customer meetings. I was invited to speak at the meeting of the New York IT Security User Group on Thursday evening, 10 December. I’ll give a general talk on cloud computing, followed by a more detailed talk on cloud security and AWS security. If you’re in the area, please come — the event is open to all.

Venue information
AXA Financial Building
1290 6th Avenue (nee Avenue of the Americas)
New York 10104
map

NYITSUG event details (no registration necessary, however)

Come to the Microsoft office on the 6th floor
We start at 6:00 PM

___________________
Presentation abstracts

Fear the cloud no more
Suddenly, it seems, the simple network diagram symbol for the Internet has become a major component for providing infrastructure platforms and service offerings. Unlike the application service provider days of the late 1990s, cloud computing is here to stay. It’s already gained much traction for specialty computing purposes, yet many IT shops remain wary. Moving compute and storage out of your own data center and into someone else’s, mingled among many others, seems daunting at first. Common questions arise around security, manageability, performance, and reliability. Think about it, though–these are the same concerns you’ve always had. Nothing about the cloud requires that you jettison everything you’ve learned during your career. The cloud is a logical next step in the evolution of computing, and when integrated with corporate IT removes much of the burden and allows a business to concentrate on its core functions. Steve Riley will explore common concerns, dispel several myths, and help you learn how your business can benefit from the cloud.

Security and compliance in the cloud
Moving to the cloud raises lots of questions, mostly about security. Providers worthy of your business should answer them clearly and honestly. Amazon Web Services has built an infrastructure and established processes to mitigate common vulnerabilities and offer a safe compute and storage environment. Steve Riley will discuss common cloud security concerns, show how AWS protects its infrastructure from internal and external attack, and explain how you can take advantage of the security features of AWS in your own applications as you extend your enterprise into the cloud.

• Share:

Staying safe online–my contribution to JustAskGemalto

Gemalto has launched a consumer education program called JustAskGemalto featuring advice and short videos by many folks in the information security industry. I was interviewed a few weeks ago about staying safe online. The video is now available on JustAskGemalto’s YouTube channel.

• Share: