<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>The Information Superhighwayman &#187; Security</title>
	<atom:link href="http://superhighwayman.com/category/security/feed/" rel="self" type="application/rss+xml" />
	<link>http://superhighwayman.com</link>
	<description>I am small and I don’t eat much...</description>
	<lastBuildDate>Sun, 07 Aug 2011 18:40:35 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.2.1</generator>
		<item>
		<title>How not to fire your Security Manager.</title>
		<link>http://superhighwayman.com/2010/05/20/how-not-to-fire-your-security-manager/</link>
		<comments>http://superhighwayman.com/2010/05/20/how-not-to-fire-your-security-manager/#comments</comments>
		<pubDate>Thu, 20 May 2010 17:11:48 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Events]]></category>
		<category><![CDATA[Groupthink]]></category>
		<category><![CDATA[Ponderings]]></category>
		<category><![CDATA[Quotes]]></category>
		<category><![CDATA[Rants]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://superhighwayman.com/?p=97</guid>
		<description><![CDATA[If you have ever read my resume on this site you will notice that I passingly refer to being sacked from British Telecom three times. Occasionally people ask for the story of this, but since I was always covered by some weird ethical code / Non Disclosure Agreement and the like I have always kept [...]]]></description>
			<content:encoded><![CDATA[<p>If you have ever read my resume on this site you will notice that I passingly refer to being sacked from British Telecom three times. Occasionally people ask for the story of this, but since I was always covered by some weird ethical code / Non Disclosure Agreement and the like I have always kept quiet. It is now more than ten years since the final event so I feel it is a good time to tell the story &#8211; Mostly because it sadly amusing to see how one of the largest telecoms companies in the world could be quite so stupid. Part of the problem with writing this is that I don&#8217;t actually believe it myself. This may come across as a little bitter &#8211; It should do, because I am. I don&#8217;t think I come out too badly in this story so I am not too worried about telling it.</p>
<p>Firstly I must say that if I am being completely truthful I was only actually fired once, and this is about that event. The other two times I left it was a mutually agreed situation &#8211; In the first one, I told my managers that I flat out refused to lie for them any more and apparently in a company who&#8217;s whole culture is based on lying to customers that is a bad thing &#8211; In the second case, I left because accounting every half  hour I worked to a customer cost-centre (when it often made no sense at all) was just ludicrous and often downright dishonest. In both cases, as soon as I left my contract was immediately picked up by another part of BT  with promises of various changes and a decent pay rise.  I actually ended up with what was effectively a long unbroken lump of employment for BT, even though I worked for a few different divisions.</p>
<p>So let us go back to a time just before the last Millennium. I had just returned from a few months secondment building a new Internet Service Provider for BT&#8217;s new mobile company (Genie, now O2) and I had in my hand a glowing letter from the Chairman of Cellnet saying how wonderful me and my team were for delivering the impossible in such a short timescale. We did good on that job, even though I didn&#8217;t want to do it. Back at the office I was finally at the point of being part of the sign-off process for any solutions that BT sold to customers. In theory, before any solution was sold I got to security evaluate it first and could refuse to sign it off and send it back for design corrections if it failed. I was also working with internal security and in all I should have been happy; but I wasn&#8217;t. In the past I had been able to do what I wanted and what was best for BT and its customers as a whole &#8211; To be proactive and to look for problems that needed solving. Now I wasn&#8217;t allowed to breath without it being charged to a customer. Any autonomy I once had was gone and I was fixing things on my own time and not being paid for them which was getting somewhat ridiculous. I told my managers I was really not renewing my contract when it came up and I thought that was that.</p>
<p>A week before I was due to leave I got a call from BT Operations begging me to come and work for them. They piled on the sweeteners; a nice big pay rise, all my billing to a single cost centre, just two months and no more and I could move back to my favourite office. I agreed to this, I decided not to go ahead with another job I&#8217;d planned to move to and I made sure the paperwork was all sorted out.</p>
<p>The following Monday, I turned up at my new job and had a tea. The office was basically a football-pitch sized machine room that took up a whole floor of a building with just me and 2 operators in it. There were a few offices in there from the days that this was the major PSS centre for the UK but they had basically been abandoned Marie-Celeste like in the 80&#8242;s. I had worked here before when I worked on Genie and had made a little cubby-hole in a long since abandoned conference room, the two Operators had also moved in there.</p>
<p>At mid-day both the Ops got a call and vanished. I never saw them again. Nobody had told me what they wanted me to do so I just sat around drinking tea and watched machines humming. At 3pm I got a call from my new boss saying he was coming around at 4pm for a meeting. At about this point I attempted to login to the Operations Systems and it wouldn&#8217;t let me so I got a little suspicious and phoned some people. Nobody was saying much but somebody said they had heard that word from the board said they were about to fire me, but nobody knew why. I couldn&#8217;t find out any more so I sat and waited. My boss arrived at 4pm, and curtly told me I had been fired and he had to escort me out of the building. I asked why, he said he didn&#8217;t know, he&#8217;d just been told to do it. He asked for my security card which I didn&#8217;t have on me that day and that was that &#8211; I was standing outside the heavily armoured and razor-wired front gate and very confused.</p>
<p>The next day I expected to hear more. I didn&#8217;t &#8211; At least, I didn&#8217;t hear anything from my bosses but I did hear a lot from other parts of BT. I received mails asking me to review secure networks, I had calls from customers asking me how to repair things and I had calls from various people within BT wanting advice. I made excuses when I had to and just waited to hear something official.</p>
<p>A week went by. I heard nothing. No letter, not even an email. Nothing to tell me formally I had been sacked and nothing to tell me why. I contacted S-Com, my agency who were cagey (rightly so since they owed me a month&#8217;s salary in notice period). I am assuming they knew nothing and were keeping quiet hoping I wouldn&#8217;t notice that I was out of a job. I decided to contact a few people in BT and had a few shady meetings in pubs and BT canteens but the upshot was that nobody knew a thing. Nobody had been told I had been sacked, most people were astonished and assumed I was still working ther,  I still had my fixed network connection into BT from my house and I could still access all of their systems except for one I had been deleted from and my mail addresses all still worked.</p>
<p>I decided to arrange a meeting with BT Internal Security, I was curious to know if they knew anything so I popped to Milton Keynes for dinner and we had a chat. They&#8217;d not heard a thing and even when they dug around they could find nothing. As far as they were concerned I was still working for BT. I asked them if I could see how much access I still had without them arresting me and they said sure as long as I wasn&#8217;t silly or naughty.</p>
<p>Over the next month I tested various networks. I could access all of the customers I ever worked on which included governments, law enforcement, most of the major banks, various ISPs and a whole load of internal things. I tested my card and my ability to just walk into a building &#8211; Nobody ever challenged me, I had a nice cup of tea in the room that housed the central Bank Clearing System and the national salary payment systems (CHAPS) and yes, I could still login to them. I could also wander into Telehouse and the like at any time I wanted. I was still getting many calls from customers and internal BT people and in the end I just pointed them at somebody else and didn&#8217;t explain why.</p>
<p>At this point, I was thoroughly pissed off. BT owed me nearly £10,000 and my agency S-Com (who had sent me a crate of champagne just 2 months earlier) claimed they knew nothing about it. I sent them a copy of the purchase order and the reference numbers but they just refused to reply after that. Nobody seemed to have a clue why I was fired they just know I was. There were various rumours but none of them really seemed right. It had just been ordered from on-high.</p>
<p>So we have one exceptionally disgruntled ex-security manager, who was owed money, who was being constantly ignored and treated like shit by BT and who still had access to every customer, internal system and building of importance. I had to change my phone number after six months, people were still calling me about things. It took them two years to disconnect my lines from my house into BT and to this day there may still be personal  machines of mine housed on the internal networks that I can access. As far as I know, my card was never disabled and as far as I know, nobody in BT and certainly no customers were ever told I had stopped working there. My email address eventually stopped working in about 2004 when they changed systems.</p>
<p>To my credit, I never did anything to them &#8211; But that&#8217;s not really the point, I could have caused untold amounts of hugely embarrassing damage. I am not sure if relying on the continuing ethics of somebody you treat dismally is really a good policy but apparently in this instance it worked for them.</p>
<p>It&#8217;s at times like this I remember the old mantra:</p>
<h2 style="text-align: center;"><span style="color: #ff0000;">&#8220;WE ARE THE TELEPHONE COMPANY. WE DON&#8217;T GIVE A FUCK&#8221;.</span></h2>
<p style="text-align: left;"><span style="color: #ff0000;"><br />
</span></p>
]]></content:encoded>
			<wfw:commentRss>http://superhighwayman.com/2010/05/20/how-not-to-fire-your-security-manager/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Please turn out the lights&#8230;</title>
		<link>http://superhighwayman.com/2008/06/18/please-turn-out-the-lights/</link>
		<comments>http://superhighwayman.com/2008/06/18/please-turn-out-the-lights/#comments</comments>
		<pubDate>Wed, 18 Jun 2008 21:34:15 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Groupthink]]></category>
		<category><![CDATA[Masturbation]]></category>
		<category><![CDATA[Narrative]]></category>
		<category><![CDATA[Observations]]></category>
		<category><![CDATA[Ponderings]]></category>
		<category><![CDATA[Rants]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://web.uknet.com/blog/michael/2008/06/18/please-turn-out-the-lights/</guid>
		<description><![CDATA[I used to consider myself something of a nationalist. Not in the jack-booted send home all the blacks and &#8220;The Empire could do no wrong&#8221; sense, but certainly in the sense that deep down I believed that as a nation, The British are generally pretty cool. Admittedly, this is somewhat hard to defend given our [...]]]></description>
			<content:encoded><![CDATA[<p>I used to consider myself something of a nationalist. Not in the jack-booted send home all the blacks and &#8220;The Empire could do no wrong&#8221; sense, but certainly in the sense that deep down I believed that as a nation, The British are generally pretty cool. Admittedly, this is somewhat hard to defend given our history of invasion, genocide and miscellaneous rights abuses but even with all of these things against us, I would like to believe that there were at all times people in the county actively working against these things and ultimately correcting them.</p>
<p>Of all the people in the world unlikely to lose faith in Britain I would have put myself pretty high on the list; somewhere between Churchill and Thatcher maybe. So why do I want to leave? People keep asking me this so I started thinking of the reasons myself.</p>
<p>It&#8217;s not been a sudden decision although the last 10 years has hurried it a lot. So let&#8217;s think of some utterly random and disordered thoughts. This will be long, it will ramble, it will be rather typical of my weblog postings. As ever, you don&#8217;t have to read it. I am not forcing you to.</p>
<p>I remember cameras being one of the first things that pissed me off. When I was being trained in Surveillance one of the things we had to do was to start to be aware of who was watching us. I learned to look for cameras; this was a mistake. In 2006 there were over 4.2 million surveillance cameras in Britain, that was one for every 14 people. There are no statistics for the current number, but it has certainly increased. A report by Privacy International says that Britain is the worst Western Democracy at protecting individual privacy, in fact, in the world the only two countries worse than Britain are Malaysia and China. The cameras and other means of surveillance are there for various reasons including the often overlooked &#8220;US Security Operations&#8221;- Yup, the US is monitoring Britain on our own soil. Of course, whilst we are at this I was stopped and searched under the prevention of terrorism act a couple of years ago for taking photographs of Menwith Hill, a US surveillance station in the North of England which used to be a Cold War listening post and now spies on Europe for US commercial means. I should point out that taking photos of this place is not hard, it is visible from miles away, it is enormous and has been growing at a vast rate since the end of the Cold War when everybody assumed it would simply be closed.</p>
<p>They are not the only cameras I have issues with. Speed cameras are now a growing parasite on our roads. These things are operated by local police forces ostensibly as a safety measure but that myth has been debunked so many times that everybody knows it&#8217;s not true at all. They don&#8217;t add any safety, research shows that they actually have a tendency to make people speed more anyway and all they do is to make the police a fortune in fines. I have heard a theory that the Speed Camera is the single largest thing which has put a barrier between the police and the people in modern Britian. They make everybody a criminal, they make a majority of people hate and distrust the police and they make people subconsciously less willing to co-operate with a police force that seems to concentrate more on getting money from motorists than actually dealing with any crime at all. Of course, the modern British police force seems to be able to get away with shooting an unarmed man 8 times with no comeback on them so maybe it is good that we don&#8217;t trust them any more.</p>
<p>So I don&#8217;t trust the police&#8230; What about the rest of the authorities who run these surveillance operations. New legislation launched under the umbrella of making us safer from terrorists (of which much more later) is now being used by local authorities to spy on the general public for absolutely non terrorist activities. This came to light when Dorset Council admitted to spending more than 2 weeks spying on a family they suspected of lying on a school application form. The new surveillance powers granted by the Regulation of Investigatory Powers Act 2000 give local authorities access to things such as phone records, email information and monitor what web sites somebody is visiting as well as the right to mount on-the-ground physical surveillance against them. Needless to say, this act wasn&#8217;t ever created to allow this but what the hell, hey?</p>
<p>All of this makes the fact I do actually trust the British Security Services somewhat a moot point. I just thought since I was ranting about the misuse of such powers I&#8217;d actually carry on my fairly consistent defence of that lot. I also still have some respect for the higher judges, unfortunately this isn&#8217;t true of the lower court rabble.</p>
<p>Of course, the 2-type legal system is something else that annoys me although this has always been a problem so I can&#8217;t claim it to be any particular reason that I am leaving. We have, however, embraced the EU human rights convention and part of this is the right to a fair trial and the assumption that you are innocent until proven guilty. The British Criminal court system does operate on this assumption but the Civil Courts certainly don&#8217;t. Anybody can take somebody to Civil Court and it&#8217;s up to you to prove that you are innocent. In any case, the chances are you will end up paying a fortune in costs, win or lose.</p>
<p>The monarchy is one of the things often cited as a reason that Britain is so great. The relationship between the Crown and Government is a complicated one and much of it is governed by convention rather than actual laws. Maybe I am made more naive because I have more knowledge of how these conventions work than most but one of the things I always thought would happen when the government started to behave tyrannically and went against the will of the people in an overwhelming way (such as entering into an illegal war) was that the Crown would step in and do something about it. I would think that this is not only the right, but the very raison d&#8217;etre of the Queen. This is why we pay for them to live a life of opulence and luxury. When Blair invaded Iraq in 2003 (an act which we now know was based on lies to Parliament) an overwhelming majority of the British people opposed this blatantly illegal act and yet the Queen still allowed her seal to be used to send her armed forces to invade another country. This shouldn&#8217;t happen, this shouldn&#8217;t happen on so many levels. Of course, to add insult to injury on this matter, Tony Blair has never been taken to account for his various lies and his various crimes. He&#8217;s happily swanning around the world making a fortune on the lecture circuit without a care in the world. There are lots of groups trying to have him called to account but frankly, they seem to be pathetic and somewhat shit. If that&#8217;s all there is then he doesn&#8217;t have much to worry about at all.</p>
<p>Do I even need to talk about the fact that Parliament has now allowed the police to hold terror suspects for 42 days, without charge. The Magna Carta? The Bill of Rights? May as well just sell them all to Americans as pretty things to go into picture frames. Oh sorry, I forgot we already did that. Talking of the Magna Carta I note that the government is still trying to push ahead with its id card scheme. Europeans and Americans don&#8217;t really understand my objection to this but it&#8217;s quite important in that it does remove a very basic right given to us in the Magna Carta all those hundreds of years ago. We still have a presumption of innocence, we still have the right to be nameless and identyless in general life. If the police want to know who we are, they have to show good reason. An identity card will lose our right to anonymity, it will shift the power slightly further towards a state where we have to show our right to be here rather than the state assuming that right by default. I am ignoring the fact that as soon as we do get an identity card, the security will be cracked, the Russian Mafia will be selling fake ones for a few thousand a piece and the government will lose all the details on a train to Waterloo or post them on a DVD to somebody. We know this will happen, it&#8217;s just how these things go. I would start talking about this all being more steps towards Corpus Juris at this point but I don&#8217;t want to sound like a nutter from the UK Independence Party, I love Europe still though I am still not sure Britain should be part of it. I just have very different reasons for my beliefs than they do.</p>
<p>And now, we couldn&#8217;t avoid it could we. The climate of fear.</p>
<p>I don&#8217;t kid myself that I am much more clever than the average Brit and the only advantage I can think of is that my post graduation background was in social psychology with my PhD being in controlling people. Don&#8217;t get me wrong, I am as susceptible to control as anybody, I go out and buy Fox&#8217;s biscuits every time that damned panda on my TV tells me to. I am an advertisers dream; I fall for all the tricks and it&#8217;s made worse by the fact that I know it too. The thing is, I think that deep down most people know they are being manipulated and like me they don&#8217;t much care as long as it doesn&#8217;t play too much havock with their lives. Unfortunately, the latest big lies seem to be playing havock with mine, and everybody elses.</p>
<p>That odd chap Joseph Goebbels once wrote:</p>
<p><em>“If you tell a lie big enough and keep repeating it, people will eventually come to believe it. The lie can be maintained only for such time as the State can shield the people from the political, economic and/or military consequences of the lie. It thus becomes vitally important for the State to use all of its powers to repress dissent, for the truth is the mortal enemy of the lie, and thus by extension, the truth is the greatest enemy of the State.”</em></p>
<p>And so we come to The War On Terror. My government tells me that we are living in very dangerous times and that my personal rights and liberties should be forfeit little by little to help them fight it.</p>
<p>Bollocks.</p>
<p>My government tells me that this is the most dangerous time ever and my very life and existence and freedom is at stake through the threat of Terrorism.</p>
<p>Bollocks to the first bit. I will concede to the last bit &#8211; But the threat is not from Terrorists.</p>
<p>My government tells me that invading Afghanistan and Iraq is something they had to do because we are at war with Terrorists.</p>
<p>What the fuck?</p>
<p>I started to come of political awareness in the early 80&#8242;s. I am product of that time. At that time and for the next decade or so, there were lots of bombs all over Britain, planted by the IRA and paid for by the Americans. Do Americans know that as short a time ago as 1996, the IRA bombed England&#8217;s biggest skyscrapers? Do most people outside this country know that almost every day in London there were bomb scares, train, bus and tube disruptions and general upheaval because of bombs or the threat of bombs. I don&#8217;t know how many people lost their lives through IRA bombs, I don&#8217;t know how many bombs there were. The reported numbers almost certainly don&#8217;t match the reality because the government and the press rather sensibly co-operated to keep a lot of the incidents quiet so as not to give publicity to terrorists. That is how a country with a lot of experience of terrorists works, they realise that terrorism feeds off publicity and taking that away from them helps to damage its impact. Our new enemy (which apparently now has a name, it is militant Islam) has, in the last few years made what amounts to a pathetically small impact on the country in terms of actual bombs and lives lost and yet we never hear anything else! Liberties are lost every month as we do more and more to fight this new thing, Terrorism. Have I missed something here? New thing? Terrorists in Britain? Get real!</p>
<p>In the early 80&#8242;s I didn&#8217;t think we&#8217;d make it to the year 2000 and I very much doubt I was alone. We were having leaflets posted through the door of every house in the country telling us how to survive in the aftermath of a Nuclear War and it was a time when films like When The Wind Blows and Threads were able to change British public opinion on the whole nuclear warfare issue. We slowly started to realise that we probably wouldn&#8217;t survive global nuclear war but these still seemed to be a greater than 50% chance that it would happen. My government tell me that I am at greater risk now from a bunch of disorganised terrorists?</p>
<p>HA FUCKING HA!</p>
<p>The weird thing is that like Goebbels great lies, it doesn&#8217;t seem to be global. It seems to be rather restricted to Britain and the USA. Its an excuse to go to war to further commercial interests abroad, it&#8217;s an excuse to step closer to that Governmental Holy Grail, a total and legal control of the people.  The two are Hand in hand, this is a dangerous situation for us to be in and I don&#8217;t like it. This &#8220;war&#8221; is costing us hundreds of billions of pounds and although I realise it&#8217;s cliche to count this in how many hospitals we could have built with the money it is worth pointing out that Britain&#8217;s filthy hospitals and the superbug epidemic are causing far far more deaths in this country than any terrorist activity ever will.</p>
<p>The other great lie is to do with Global Warming. Don&#8217;t switch off, don&#8217;t sneer at me. I am not saying that Global Warming is a lie, it&#8217;s not. There are differences of opinion as to what is causing Global Warming and I doubt you agree with me but even so, Global Warming has become a bandwagon to impose even more taxes and controls on the people and as I have ranted about in the past; the people it is hurting most are the poor. I foresee more and more happening in the name of global warming; I foresee more and more silly laws and restrictions and less and less useful action. Global warming will be used as an excuse to sell more and more protected land to companies to exploit and sell more and more overpriced houses to people. The poor will stay in the lowland floodable areas and will end up uninsurable and like New Orleans but on a grander scale we&#8217;ll probably end up with refugees in Mainland Britain in a decade or two. Adding more and more tax to plane travel and fuel isn&#8217;t going to help this. Putting some of those billions of pounds we are spending to protect our freedom is. Global Warming is inevitable. Taxes aren&#8217;t going to stop it. Preventing it isn&#8217;t going to work. We should be doing something about it, and doing something about it now, not later. It&#8217;s a big lie. We all know this why aren&#8217;t we doing anything about it?</p>
<p>Leigh visited England from Canada a few weeks ago and said that one of the things she noticed most about this country was the press. I have to admit I had barely noticed this but now it&#8217;s been pointed out to me I see the point. I am not sure what has happened to it, it&#8217;s not a press any more it is just popularist celebrity drivel interspersed with bigoted opinion. I don&#8217;t read newspapers any more so I hadn&#8217;t really noticed. and whilst I can&#8217;t use this as a reason for leaving I can still mourn its passing.</p>
<p>The BBC still sits on the sidelines as the only party of opposition; uncomfortably though it relies on the government for funding so its subversion is probably rather less than one would hope. I view it as some sort of ineffectual superhero that still tries hard. By day, it broadcasts endless mind numbing gobshite devoted to cookery, decorating, selling all your crap to buy new crap and buying new houses &#8211; All the things we as new-age sheep seem to like. By night, it allows platform to some quite cutting satire and the occasional excellent documentary that says much the same as I am saying here only in a less self-obsessed way. The other channels generally broadcast cheap and easy to make crap and reality TV. It&#8217;s depressing really and if this is the opium of my nation then I demand a new pusher.</p>
<p>And now for the punchline. None of this is why I want to leave&#8230;</p>
<p>The country has had messes before, England and Britain have a long history and throughout it, lots of shit has happened. But as I said at the start of this post; I have always felt that behind the scenes there were competent people working to mend things. Of course, the English have a history of being quite pathetic and resistant to change, our history of revolution is pitiful; from the rather pathetic Peasants Revolt which ended with a single blow to the Civil War which simply annoyed a bunch of people before sending everything back to how it was before as soon as the leaders realised they didn&#8217;t have anything to do once they&#8217;d won. There&#8217;s no spirit left in this country any more. Nobody cares; the people aren&#8217;t stupid, they know what is happening as well as I do but they don&#8217;t seem to care any more. Even the few who do can&#8217;t do much. Armed revolution is conveniently illegal and political revolution is, as I see it, impossible. Maybe it has always been that way, maybe this is something I have missed.</p>
<p>The only useful things that the Brits have ever really done to create change is to leave. For the first couple of centuries at least I don&#8217;t think we did so badly in America. Australia looks pretty to me and I think we have done pretty well in Canada, all things considered. Maybe it will be interesting to see how the Colonies have fared instead of constantly whining about what the Motherland has become.</p>
<p>Will the last one to leave the country please turn out the lights? Global Warming, don&#8217;t you know.</p>
<p>Some links &#8211; I didn&#8217;t want them in the main text because I am odd that way:</p>
<ul>
<li><a href="http://news.bbc.co.uk/1/hi/uk/6108496.stm" target="_blank">Britain is &#8216;surveillance society&#8217;</a></li>
<li><a href="http://news.bbc.co.uk/1/hi/uk/4713753.stm" target="_blank"> 					Police shot Brazilian eight times</a></li>
<li><a href="http://www.telegraph.co.uk/news/uknews/1584808/Council-spy-cases-hit-1,000-a-month.html" target="_blank">Council Spy Cases hit 1000 a month</a></li>
<li><a href="http://en.wikipedia.org/wiki/Magna_carta" target="_blank">The Magna Carta</a></li>
<li><a href="http://en.wikipedia.org/wiki/Bill_of_Rights_1689" target="_blank">The Bill of Rights </a></li>
<li><a href="http://www.britsattheirbest.com/freedom/f_eu_corpus_juris.htm" target="_blank">42 Days later&#8230; </a></li>
<li><a href="http://www.britsattheirbest.com/freedom/f_eu_corpus_juris.htm" target="_blank">UKIP on Corpus Juris </a></li>
<li>The BBC&#8217;s <a href="http://en.wikipedia.org/wiki/The_Power_of_Nightmares" target="_blank">The Power of Nightmares</a> &#8211; You really should <a href="http://www.archive.org/details/ThePowerOfNightmares" target="_blank">watch it here</a>.</li>
</ul>
]]></content:encoded>
			<wfw:commentRss>http://superhighwayman.com/2008/06/18/please-turn-out-the-lights/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Brother, can you spare a grand?</title>
		<link>http://superhighwayman.com/2008/05/15/brother-can-you-spare-a-grand/</link>
		<comments>http://superhighwayman.com/2008/05/15/brother-can-you-spare-a-grand/#comments</comments>
		<pubDate>Thu, 15 May 2008 12:50:48 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Nothing in particular]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://web.uknet.com/blog/michael/2008/05/15/brother-can-you-spare-a-grand/</guid>
		<description><![CDATA[Here&#8217;s an interesting new scam I had never heard of before. The scammer breaks into a hotmail, gmail or other free-email account and then sends the following email out to everybody in their contact list: Hi I am in a hurry writing this mail. I had a trip to Nigeria visiting the tinapa opening ceremony. [...]]]></description>
			<content:encoded><![CDATA[<p>Here&#8217;s an interesting new scam I had never heard of before.</p>
<p>The scammer breaks into a hotmail, gmail or other free-email account and then sends the following email out to everybody in their contact list:</p>
<hr />
<ul>
<li>
<em>Hi<br />
I am in a hurry writing this mail. I had a trip to Nigeria visiting the tinapa opening ceremony. Unfortunately for me all my money got stolen at the hotel where i lodged from the attack of some armed robbers and since then i have been without any money i am even owing the hotel here,So i have only access to emails,my mobile phone  can&#8217;t work here so i didnt bring it along.Please can you lend me 1000 pounds so i can return back and settle the hotel bills i would return it back to you as soon as i get home, I am so confused right now.You can have it sent through western union.I have already spoken to the hotel manager, please let me hear from you so i can collect his full name and address where you can send the money tomorrow please or if possible today. I am waiting for your reply.</em><em>Thank you.<br />
(Person&#8217;s name)</em>
</ul>
<hr />It&#8217;s an interesting one in that it may actually work (provided the person is usually illiterate anyway). A whole new clever little twist on the traditional 419 scam. I shall watch this one with interest.</p>
]]></content:encoded>
			<wfw:commentRss>http://superhighwayman.com/2008/05/15/brother-can-you-spare-a-grand/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Antisocial Security</title>
		<link>http://superhighwayman.com/2008/05/14/antisocial-security/</link>
		<comments>http://superhighwayman.com/2008/05/14/antisocial-security/#comments</comments>
		<pubDate>Wed, 14 May 2008 00:19:03 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Masturbation]]></category>
		<category><![CDATA[Narrative]]></category>
		<category><![CDATA[Ponderings]]></category>
		<category><![CDATA[Quotes]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://web.uknet.com/blog/michael/2008/05/14/antisocial-security/</guid>
		<description><![CDATA[A while ago I pondered starting a weblog devoted to security. I occasionally feel the need to write something about this subject and I was worried that my one loyal reader would probably get bored stiff if I wrote too much in amongst my generally pointless rants. My problem is that I know more about [...]]]></description>
			<content:encoded><![CDATA[<p>A while ago I pondered starting a weblog devoted to security. I occasionally feel the need to write something about this subject and I was worried that my one loyal reader would probably get bored stiff if I wrote too much in amongst my generally pointless rants.</p>
<p>My problem is that I know more about security than you. I am pretty safe in saying this unless you are one of a handful of people, all of whom I could name and none of which would be reading my weblog. Don&#8217;t get me wrong &#8211; If you are an expert in Linux, I bet you know tonnes more about Linux security than I do and I know 12 year olds who know more about modern hacking tools and methods than I ever will. The problem is that these specialisms don&#8217;t make good all around security experts; experience and exposure does and if nothing else, I have a lot more of that than most.</p>
<p>I got an email from an old adversary of mine today and part of my reply got me thinking about how I view a profession I used to be very much involved with. I quote:</p>
<p><em>&#8220;My former industry is full of self-publicists who are dreadful at<br />
what they do; I care nothing at all for them and their paranoia<br />
fuelled money making machine. I&#8217;ll stick with breeding camels and<br />
just drag myself back into security when I need to eat occasionally,<br />
but even so I don&#8217;t much think that will last.&#8221;</em></p>
<p>I&#8217;d like to write about security. As an odd kid working out better ways of nicking things or how to open locks I wasn&#8217;t meant to open, I have always been interested in the topic and I have devoted most of my adult life to it. When I was at school and a teacher of mine suggested that I manage the school computer systems as an alternative to trying to pull them to bits to see how they worked; I had no idea that a few years later I would be in the position to happily ignore fax requests for help from the FBI because they refused to give me a cool baseball cap or getting hate mail for working with the government to get Universities to prosecute hackers under the then new Computer Misuse Act (an action on my part which was  very misunderstood since I was actually more on the side of the students trying to make sure that they received a fair trial where the Rules of Evidence applied). Incidentally, we haven&#8217;t even hit the 1990s nor the start of the Internet in the UK yet.</p>
<p>I am not blowing my own trumpet here, I don&#8217;t like blatant self publicity and it&#8217;s certainly a bad trait in a security person anyway. That said, I am going to talk about me. It&#8217;s my weblog and if you don&#8217;t like it, then stop reading. I am making a point that I don&#8217;t like being told I am wrong by somebody who got a degree in Computer Security from Wigan Polytechnic in 2005 and then spent a few months getting a bunch of commercial &#8220;qualifications&#8221; consisting of seemingly random letters from computer-equipment manufacturers and then gets employed by some company and given a job title with the word manager, or consultant in it.</p>
<p>In my previous jobs I was surrounded by &#8216;em. I&#8217;d go to meetings to be told I was wrong by people who didn&#8217;t  have a clue what they were talking about. I wasn&#8217;t wrong, I am rarely wrong about things I profess to know something about. At BT, we had a chap who I will call John (mostly because that is is name). He didn&#8217;t go to University, he didn&#8217;t have a single security qualification and he knew very little about computers, networks or telephony. He had, however, spent more than 10 years as a soldier in Northern Ireland on constant active duty. I had been told by my colleagues that John was a jobsworth and something of a tosser and although his job was to give security advice for high-profile projects, he shouldn&#8217;t be consulted. I ignored them and decided to talk to him one day  about a system I was building for one of the country&#8217;s biggest banks. It was a pretty good design and there weren&#8217;t too many flaws that I could see but as soon as he saw it, he started asking questions that other people hadn&#8217;t thought of and prompted me to make a lot of changes for the better. He didn&#8217;t know about anything like as much about technology as the people I was surrounded by but he did have a much better appreciation of security in general and he knew what questions to ask and wasn&#8217;t afraid to ask them. Although he doesn&#8217;t know it, it was him who prompted me to get more military training to increase my skill set. I would say thanks but he&#8217;ll never  read this; I don&#8217;t think he knows how to use a web browser.</p>
<p>It&#8217;s become an odd industry. We are talking security here and security is meant to be quite important in the modern world. There are billions of pounds flying around the world at any given moment and as you see every time the government accidentally sells a few million people&#8217;s personal details at a carboot sale, there are people who actually worry about this sort of thing. Who is protecting all this money? Who&#8217;s looking after your personal  details? Generally speaking, it&#8217;s the people with the Wigan Poly degree I am afraid. They don&#8217;t have a clue what they are doing and in the rare cases where somebody who does have a clue gets to contribute, the babbling rabble who are shouting out &#8220;We can do it for you on a Linux box for 50p&#8221; will win the day anyway since it all ultimately comes down to money.</p>
<p>I am not going to start a security weblog. I am not sure there is much I could write that hasn&#8217;t already been butchered by the Wigan Polytechnic Press. I may still write about security things but I will just do them as normal rants.</p>
<p>Now you know.</p>
]]></content:encoded>
			<wfw:commentRss>http://superhighwayman.com/2008/05/14/antisocial-security/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Some advice, young folks&#8230;</title>
		<link>http://superhighwayman.com/2007/05/21/some-advice-young-folks/</link>
		<comments>http://superhighwayman.com/2007/05/21/some-advice-young-folks/#comments</comments>
		<pubDate>Mon, 21 May 2007 01:59:59 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Ponderings]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>

		<guid isPermaLink="false">http://web.uknet.com/blog/michael/2007/05/21/some-advice-young-folks/</guid>
		<description><![CDATA[I have some advice &#8211; I don&#8217;t give advice very often, but this one is important, so listen up. When I was younger, I had a near perfect memory. I could remember 62 character random passwords fairly easily, I could remember passwords from years earlier and having a head filled with god knows how many [...]]]></description>
			<content:encoded><![CDATA[<p>I have some advice &#8211; I don&#8217;t give advice very often, but this one is important, so listen up.</p>
<p>When I was younger, I had a near perfect memory.  I could remember 62 character random passwords fairly easily, I could remember passwords from years earlier and having a head filled with god knows how many passphrases seemed to be a fairly normal thing. I didn&#8217;t forget them, I didn&#8217;t need to keep a note of them.</p>
<p>Then I got ancient, and senile.</p>
<p>I found today that I can&#8217;t remember passphrases I set 10 years ago even though oddly, I can still remember passwords I had 25 years ago. The problem is that sometimes I need passwords I set 10 years ago. It&#8217;s not that I completely forgot them, I remember it is a passphrase about a sheep and a thunderstorm and I remember some of the words, but I can&#8217;t remember the capitalisation nor the punctuation, nor even really the word order. It&#8217;s useless, I doubt I will ever actually get it. I also have endless boxes of tape archive that when I contemplate it, I know I don&#8217;t actually know the passwords to any more (even if I can find the software).</p>
<p>The point is, I never thought I would forget them so I never thought of making a note of them.</p>
<p>So my advice? Despite everything that grown ups will tell you, and despite everything I tend to teach normally, start making a note of your passwords. Keep them in a heavily protected storage device, and use a passphrase that you will certainly remember and use it every few days to make sure you do remember it. Make it a good one, and you&#8217;ll be fine.</p>
<p>Whilst you are keeping the passwords, you may as well keep copies of the software that will allow you to use the encrypted thing, the backup program you used, the weird mailer, the weird key storage utility or ssh program. In 20 or 30 years when you want to read your old mail, you may be glad of it.</p>
<p>Pop to http://www.truecrypt.org/ &#8211; Install that and make yourself a disk that you can keep all this stuff on, without having to worry about extra security. Hell on an encrypted disk you can even store your passwords in plain text in a text file. Keep a backup copy of that password file on another encrypted disk and tell a close friend  the password to it &#8211; Don&#8217;t give them the disk but ask them to keep the password safe, this&#8217;ll cover you in the event of complete senility too as long as you remember how to use a computer. That&#8217;s all, nothing complicated, just do it, and you will thank me one day.</p>
<p>Now, with all that said and done &#8211; If anyone remembers the sodding password to my PGP keys, and what on earth those sheep were doing in that thunderstorm, can they please tell me? Quickly? Before I go even more mad?</p>
]]></content:encoded>
			<wfw:commentRss>http://superhighwayman.com/2007/05/21/some-advice-young-folks/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>What a nice chap.</title>
		<link>http://superhighwayman.com/2007/05/01/what-a-nice-chap/</link>
		<comments>http://superhighwayman.com/2007/05/01/what-a-nice-chap/#comments</comments>
		<pubDate>Tue, 01 May 2007 14:19:01 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Groupthink]]></category>
		<category><![CDATA[Ponderings]]></category>
		<category><![CDATA[Pretty Pictures]]></category>
		<category><![CDATA[Scribbles]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://web.uknet.com/blog/michael/2007/05/01/what-a-nice-chap/</guid>
		<description><![CDATA[I finally got around to dragging all of the photos from my mobile phone last night, and found this little shot that I took in a tacky tourist shop in Berlin. Can I just say&#8230; amazing! But then I guess every Revolutionary needs their own lip-balm. I am not a fan of Ernesto so I [...]]]></description>
			<content:encoded><![CDATA[<p>I finally got around to dragging all of the photos from my mobile phone last night, and found this little shot that I took in a tacky tourist shop in Berlin.</p>
<p><img src="http://lorry.org/Weblog/chebalm.jpg" alt="CheBalm" width="552" height="711" /></p>
<p>Can I just say&#8230; amazing! But then I guess every Revolutionary needs their own lip-balm.</p>
<p>I am not a fan of Ernesto so I don&#8217;t think I will be wearing his lip balm. The only thing that amuses me is that it is being sold in what was formerly East Berlin, and his various dodgy causes won&#8217;t benifit even slightly by any sales of this, nor do they from the wonderfully Capitalist use of his image on just about anything that will take it.</p>
<p>I don&#8217;t like regurgitation in weblogs, so I will simply paste a couple of links:</p>
<p><a title="http://lorry.org/Weblog/che-standard.html" href="http://lorry.org/Weblog/che-standard.html" target="_blank">http://lorry.org/Weblog/che-standard.html</a></p>
<p>and:</p>
<p><a title="http://www.slate.com/id/2107100/" href="http://www.slate.com/id/2107100/" target="_blank">http://www.slate.com/id/2107100/</a></p>
<p>Actually, thinking about it &#8211; I may be wrong. Ernesto  Guevara may well have been quite the fan of the capital of Capitalism that is modern America; they are, after all, both huge fans of concentration camps in Cuba.</p>
<p><em>Give me your tired, your poor,<br />
Your huddled masses yearning to breath free,<br />
The wretched refuse of your teeming shore.<br />
Send these, the homeless, tempest-tossed, to me:<br />
We&#8217;ll watch them carefully, inside our golden doors.<br />
And should they stray, or think aloud,<br />
Thoughts deemed extreme, rebellious or untrue.<br />
So onto Cuba, they will go.<br />
To keep this young land, pure and clean.</em></p>
<p>(Apologies Ms. Lazarus for not keeping it as a Sonnet)</p>
]]></content:encoded>
			<wfw:commentRss>http://superhighwayman.com/2007/05/01/what-a-nice-chap/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Oh How Fine is the Emperor&#8217;s New Credit Card.</title>
		<link>http://superhighwayman.com/2007/04/13/oh-how-fine-is-the-emperors-new-credit-card/</link>
		<comments>http://superhighwayman.com/2007/04/13/oh-how-fine-is-the-emperors-new-credit-card/#comments</comments>
		<pubDate>Fri, 13 Apr 2007 23:26:20 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Groupthink]]></category>
		<category><![CDATA[Observations]]></category>
		<category><![CDATA[Rants]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>

		<guid isPermaLink="false">http://web.uknet.com/blog/michael/2007/04/13/oh-how-fine-is-the-emperors-new-credit-card/</guid>
		<description><![CDATA[Those of you who know me should know that one of my fascinations is the phenomenon of Groupthink (or &#8220;Folie a Deux&#8221;) and one of my professions was working out how to steal things more effectively. I have been avoiding ranting about this topic for a while but it rather amazes me that the press [...]]]></description>
			<content:encoded><![CDATA[<p>Those of you who know me should know that one of my fascinations is the phenomenon of Groupthink (or &#8220;Folie a Deux&#8221;) and one of my professions was working out how to steal things more effectively. I have been avoiding  ranting about this topic for a while but it rather amazes me that the press are just starting to realise that all is not well in this nation of British Shopkeepers.</p>
<p>When I first heard that the British Government were pushing this Chip and Pin idea; I seriously had to check tha  it wasn&#8217;t April the first. For those people lucky enough not to be in the UK, Chip and Pin is a new way of paying  for things with a Credit or Debit Card.</p>
<p><img src="http://lorry.org/Weblog/dodgychipandpincard.jpg" alt="dodgychipandpincard.jpg" /></p>
<p>British payment cards have a little chip in them at one side, effectively making them into a smart card. They also have the magnetic and signature strip on the back so that they can be used abroad or used in cash machines  without chip readers. When you pay with one of these, you either give it to the person at the till, or pop it into the  little card reading machine yourself, wait for it to confirm the amount and then type in your 4 digit PIN to  complete the purchase. This should ring some alarm bells already simply on the basis of casual theft. Anyone  standing close to you when you are hassled in a shop queue and not being at all careful (as presumably you would be at a cash machine) can see you type your PIN and then thump you a few yards up the street, nick your cards and clean your account out at the closest cash machine.</p>
<p>This is a little dirty for the likes of a weblog like this but it&#8217;s not something that should be ignored just for that reason. Saying that this isn&#8217;t where the real issue lies. The real issue lies in the fact that the cards still have the  magnetic strip and don&#8217;t use a different PIN for the smartcard and the strip. Financially, it is not very viable to  clone a smartcard at the moment; it&#8217;s possible but until it becomes more useful (that would be when identity  cards come into force) the risk is still low. On the other hand, it is pathetically easy to copy a magnetic strip. When you give your card to somebody before you type the PIN into a machine, you don&#8217;t know what they are doing  with it.  Have they swiped it and copied the strip? Is the &#8220;Chip and Pin&#8221; machine recording your number? Is  there a camera in the roof monitoring what you type on the keypad? All it takes is one swipe of your magnetic strip by a shop assistant, a waiter, a petrol attendant or a well equipped prostitute and a knowledge of your PIN  and your details could be sent to across the world within seconds, your stripe details written to another card and your bank account cleared before you have even left the shop. Personally I find it quite annoying when the  country&#8217;s biggest supermarket (that&#8217;d be Tesco) has their staff take your card off you and swipe it behind the  counter rather than let you slide it into the card reader like most other shops do. At least when I physically put  the card into the machine myself I know that it can&#8217;t be reading the magnetic stripe. Tesco are just asking for staff fraud to happen. In fact, any checkout employees reading this who want to buy a 3 track magnetic card  reader/writer, I am doing a good deal on them.</p>
<p>It seems obvious that for this to be classed as an advance in security is just idiotic but then that is a fundamental  of Groupthink. Next time how about just sticking a photograph on the card? it&#8217;d be easier and cheaper. TV shows like &#8220;The Real Hustle&#8221; have been showing you how to rip people off for the last year with this and international gangs (should I be emotive and say GANGS PROBABLY LINKED TO ORGANISED CRIME AND TERRORIST ORGANISATIONS?) have been stealing hundreds of millions using this nice and easy free cash machine for quite a while now. It&#8217;s only in the last couple of weeks that it seems to have hit the news.</p>
<p>As far as I can see, the  government decided that the country should all have Chip and Pin from February the  14th, 2006. Supposedly it is possible to demand a card that doesn&#8217;t have a chip; I will have to remember to do  this sometime. It&#8217;s be nice to have seen any of their reasonings and to find out who their security consultants  were so that we could all stand around and throw peanuts at them. Frankly and speaking from a professional  point of view here, they must all either have been fucking morons with no understanding of anything at all or just out of their head on the Crade-A cocaine they&#8217;d bought with the money the government threw at them for their advice.</p>
]]></content:encoded>
			<wfw:commentRss>http://superhighwayman.com/2007/04/13/oh-how-fine-is-the-emperors-new-credit-card/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

