CallerID scams: the perils of flawed trust mechanisms

As Schneier repeatedly tells us, there's a big risk to a trusted identity mechanism. For example, expedited airport security checks based on special IDs increases the risks of a flaw in the ID mechanism. That's what's happened to caller ID, with unsurprising consequences:

USATODAY.com - Caller ID scammers plan to do a number on you:

...The AARP Bulletin recently reported a scam in which people received fraudulent calls claiming they missed jury duty and asking for their Social Security number. The calls seemed legitimate because the telephone number of the localcourthouse showed up on caller ID.

In Pennsylvania, constituents of Republican Rep. Tim Murphy were flooded with bogus calls from someone purporting to be from Murphy's office.

The primary worry for consumers is that if a call appears to be coming from their bank, credit card company or a government agency, they could be persuaded to give up financial data a thief could use to open new bank accounts or apply for loans and credit cards.

'It's a new way to scam people, because people rely on caller ID,' says Sid Kirchheimer, author of 'Scam-Proof Your Life' and the AARP Bulletin's Scam Watch columnist."

Sigh. This one came out shortly after I posted my essay on the threats ahead. Not far ahead evidently. The USA today article comes with a set of recommended safeguards; they remind me of the 'duck and cover' recommendations for nuclear attack ...

All the vulnerable people: eFraud, aging and special needs

Eight years ago I wrote a web page on Fighting Spam. That was a year after I'd first suggested to an ISP (Mindspring then) that they provide spam filtering services.

Alas, the spam deluge continues. My Gmail spam filter was stable at 5500 spams/month for about a year, but now it's up to 6500 spams/month. The zombie bots are getting worse.

Spam is bad, and it's sad that we still haven't adopted relatively inexpensive fixes like reputation management of authenticated sending services. I've come to realize, however, that the problems of spam are only the leading edge, the snout in the door, of something much worse. The most dangerous spam is increasingly about fraudulent schemes; desperate corporations like Vonage, Cingular, Yahoo and Delta are only marginal contributors. The spam is spawning phishing, splogs, and VOIP supported phone fraud, combining age old scams like the Publisher's Clearinghouse parasite, state lotteries, or "low interest credit card" scams with new technologies.

These fraud strategies are merging, morphing, and evolving with extraordinary speed, fueled by the worldnet. Charles Stross writes about sentient financial instruments, but one could as easily see how fraud strategies might be an even better candidate for emergent sentience [1]. Even as this happens, the prey population is growing with the aging of the wealthy western nations and the predator population is growing as the young and the desperate come online.

It takes a fair bit of intelligence, discipline and experience to see through these schemes and to to monitor one's human frailties. My handful of readers are likely immune. Not so our aging parents, not so the 50% of our population with IQs under 100. One day, all too soon, my IQ too will drop below some magic threshhold and I will join the population of the vulnerable. Most of us will, unless we die first. An increasingly complex world will offer endless opportunities for highly refined schemes to separate the vulnerable from their assets.

We're going to have to evolve new systems of defense, trust relationships, identity management and reputation management. Developing these systems will be a major social challenge over the next few decades. In the meantime, encourage your parents, and your vulnerable family members, to consult about their financial decisions.

[1] One of the leading theories for a driving force behind the evolution of the human mind is fraud detection and fraud invention.

Update 2/1/2010: See also - Phishing with the post-Turing avatar

Exploding LiOn batteries and air travel

[see update for my second thoughts]

I hadn't paid much attention to June reports of an exploding Lithium ion battery. This happens every few years, sometimes there are product recalls, sometimes not. Today a NYT article on the impact on Dell piqued my curiousity, and I read the Inquirer article. The pictures sure are impressive.

In the story a witness is quoted: "..It is only a matter of time until such an incident breaks out on a plane...". Hmm. Good point. When I was in high school a rogue lab tech demonstrated the joy of Lithium by dropping a chunk of it in a pan of water. That was one of my more memorable learning experiences. Lithium is wonderously reactive.

So how long before LiOn batteries are banned from air travel? It must now have occurred to a large number of people that a rare accident could be engineered into a planned event.

Update: Hmm. Second thoughts. There's not that much lithium in those batteries. Was that fireball photoshopped? Was there a big pile of paper beneath the laptop? One can set fire to a bag of newspaper and get a fireball on an airplane too ... I'd like to see a 'Dan's Data' analysis, but I suspect the FAA considered this problem a while back and decided it wasn't worth worrying about ...

Update 7/10: Dan did a quick private analysis for me and pointed to this public resource. Suffice to say LiOn batteries are not a security threat. The email from Dan also caused me to reflect again on something that's become apparent over the past five years.

Most terrorists, like almost all criminals, are not very bright. If someone like Dan went bad, the threat would be far greater -- but it's evidently rare for a truly bright or imaginative person to join a group like al Qaeda. Even their very few elite agents, like Atta or Zawahiri, were/are only a bit above average. I think that's the main thing that's kept us going, but it wasn't obvious to me when I wrote this.

Update 7/17/06But on third thought ...

The Empire strikes back - An Apple employee on the dangers of tech blogs

Last week I wrote about the revenge of the consumer. Now I'll give some airtime to someone from the other side:

After Apple - We Are, I’m Afraid, Only Human

.... So some guy on a blog writing that Apple are saying that MacBook top cases are being replaced when they are not doesn’t help anyone. Not the pissed off customer who travelled thirty miles to the Store, not the Genius, no-one. So please blog writers, and yes, you know who you are, for the love of God stop writing this nonsense as if you know what you are talking about because you don’t and you are doing more damage than you could possibly imagine in your wildest nightmares. Seriously. Apple are damm good at admitting mistakes and when there is a need for a product recall everyone will know about it on the support pages of the website or if you have registered your product correctly a direct email will inform you. Even if the product is out of warranty Apple will honour the repair if it’s been officially announced. Most electronics manufacturers don’t do this sort of thing for their customers, Apple do. Most electronic manufacturers don’t have a free tech support area in their Store, if they even have a Store in the first place, Apple do. Blog writers are not the authority, Apple are, that’s not arrogance, it’s a fact.

Hmm. Food for thought. I'm biased by my experience with 3 consecutive defective 3rd generation iPods (I kept the last one rather than go for yet another return -- the usb sync doesn't work), but my iBook video fears turned out to be misplaced. Macintouch has made a valiant effort to look deeper, and they find some Apple products have unusually high defect rates and some are remarkably solid. (The G4 iBooks are a wonder of reliability, the 3rd generation iPods were somewhat lemony.) I remain suspicious about the quality of Apple's central repair services -- even the sober minded Macintouch site cautions against buying Apple refurbished laptops.

On the other hand I do believe Apple is far more responsive and supportive than Dell, and vastly better than SONY, Panasonic, etc. I'll try to give them a bit more credit than I have ...

Spyware companies: Yahoo, Delta, Cingular

Business Week has written an expose of a spyware company -- Direct Revenue. Take careful note of their paying customers and investors:

Spyware developers net huge profits, outrage - Tech News & Reviews - MSNBC.com

Spyware rakes in an estimated $2 billion a year in revenue, or about 11percent of all Internet ad business, says the research firm IT-Harvest. Direct Revenue's direct customers have included such giants as Delta Air Lines and Cingular Wireless. It has sold millions of dollars of advertising passed along by Yahoo. ..

I'll be looking to avoid these three companies in the future. Yahoo must be in worse shape than the industry has realized. What they $#@$#! was Cingular thinking?

Update: A few others to live in infamy. Emphases mine:

By early 2005, Direct Revenue had notched deals with JPMorgan Chase, Delta, and the Internet phone company Vonage, according to former sales staffers and Direct Revenue documents. Cingular Wireless spent more than $100,000 a month at the peak of its relationship with Direct Revenue, current and former employees say. Direct Revenue put Cingular pop-ups in front of other phone companies' Web sites and news sites such as the one affiliated with tech magazine Wired. Vonage, meanwhile, was billed $110 for each customer that Direct Revenue delivered, according to a sales report from July, 2005. For that month, Direct Revenue billed Vonage for 287 new customers, or $31,570.

JPMorgan Chase confirms that it advertised with a Direct Revenue unit through the middle of last year, but says it was unaware of any spyware activity. Delta and Cingular declined to comment. Vonage didn't respond to inquiries.

...Many major companies, such as Cingular and Yahoo, have severed connections with Direct Revenue. But the ads of others, including Vonage, continue to appear in Direct Revenue pop-ups. Insight and TICC remain investors.

Vonage's share price is in free fall. They're making deals with devils, but it won't help them ...

Charles Stross and the Fermi Paradox

Charles Stross is a former pharmacist, former programmer and journalist, certified geek, and current full time writer. Most people would tag him as 'science fiction' writer. From what I've read of his journals, and especially his books, he's terribly bright and very imaginative.

Accelerando is one of his commercially successful books (you can scan it for free before you buy). The amateur Amazon reviews are well done (one of the two 'professional' reviews is by someone who didn't read the book); I can't add much to them. The book does not fully succeed as a novel -- it was published as a series of short stories and it doesn't hang together all that well. There are some annoying plot holes (no security on the goggles? Did one of the lead characters flee to alpha centauri or commit suicide? Why is Pierre asking what happened - he was there?!), some dangling and overly fluid characters, and too many synopses of 'what went before'. The writing itself is professional, and that's no mean trick, but the work would have needed a harsher editor and a complete rewrite to fly as a novel.

That's ok, because it's really a series of speculative essays disguised as a novel -- and the thinking is deep and creative. I thought I was being a bit whacky when I blogged about the spanish inquisition as a corporation, and the emergent sentience of corporations in the ecosystem of economic interactions, but Stross goes much, much further. He plays with the idea that at some point the relationship between finance wizard and financial instrument might be inverted, so that souls would be traded by sentient financial instruments. That's not bad; I can just about see how it might happen ...

The embedded essay I most enjoyed reading, however, is on one of my all-time favorite topics -- the Fermi Paradox. This is one of those conumdrums that bothers a very few people a great deal and is irrelevant to most of humanity.

In short, we ought by all rights, to be overrun by little green beings. The puzzle is that we appear to have much of the galaxy to ourselves. To Fermi fan-boys this is the biggest question around, compared to which matters of theology or epistemology are merely derivative.

The answer to the Fermi Paradox is most often expressed in the terms of the Drake Equation. The best bet is that something utterly inevitable ends all technological civilizations like our own in well under a thousand years. The most popular candidate for an "inevitable fate" over the past 23 years has been the Singularity (Greg Bear's 1982 short story 'Blood Music' is the earliest version of the Singularity theory I know of, Vernor Vinge developed the ideas extensively in the early 1990s.) Stross takes these ideas and pushes the boundaries. Why might a post-singular entity find travel unappealing? Why would it be hard for entities like us to live near such a beast -- even if it didn't spend any time thinking about us?

Reading Stross is like having an extremely bright and free thinking fellow over for a beer (or something, these UK writers seem fond of a range of substances). He tracks all over the place, the narrative doesn't always hang together, but it's a heck of a lot of fun -- and where else can a geek get his Fermi fix?

Follow Me Here on Bush fatigue

Follow Me Here is the blog I read that's most like this one -- though FMH is more popular and more outward directed. Recently FMH wrote a retrospective post about years of blogging. I particularly emphathized with this portion ...

Follow Me Here... : 07/02/2006 - 07/08/2006

... Third, I have an incredible degree of Bush fatigue; it is not that I cannot get outraged anymore, but there is only a finite roster of ways in which a government can lie, cheat, steal, kill, destroy, and oppress. Bush and his minions have long since done them all; I have long since taken note of them here; nothing surprises me, and my outrage is constant and numbing.

And I have only a limited tolerance for my own frustration and despondency that a more effective movement of opposition has not arisen in response to his outrages. And I have no confidence that weblogs like FmH are change agents. (I don't know what would be effective activism these days, I guess, but I can no longer rationalize as I did for so long that FmH was an integral form of activist activity)...

I also started this blog partly because I felt compelled to do something about the terrible choice America made in 2000 -- or that was made for America. Something beyond campaign donations and volunter efforts.

After Bush was reelected, however, I couldn't pretend any longer that anything I wrote was going to make much of a difference. I, slowly and reluctantly, accepted that I didn't understand America.

Sure the media has screwed up. Sure some powerful people have used a lot of money and dirty tricks. At the root of things, however, is an American public that doesn't care, doesn't understand, and doesn't want to know. I can't fix that.

Like FMH I've mostly given up on political blogging. I'll toss in a few reminders here and there of the most egregious sins of this administration, but in general I'll just assume they're methodically dismantling our democracy and destroying our physical, economic, cultural and social world. Same old, same old. America has chosen, and I'm about ready to march off to Galt's Gulch (oh, wait, you don't let in our sort? Oops ...)

I do enjoy writing about ideas and trends though, and I'll keep doing that -- if only for my own amusement ...

Disbanding the CIA's bin Laden group: the bright side

There's a bit of a fuss about the closing of the CIA's bin Laden unit. Like most people, I have no way of knowing whether this is good or not. If whatsisname were still Director I'd assume it was very bad, but nowadays I can't say. I do think it has a bright side though.

bin Laden, it's been reported, is a typical zealot megalomaniac. The way to enrage him is to suggest that he's no longer important, that he's 'yesterday's news'. If he feels neglected, he may try to raise his profile. That's how he'll be caught ....

Google's weakness: devotion to the algorithm

I have four Google Blogger (Blogstpot hosted) weblogs I post to regularly. This is one. I've another that's pure geekery and product reviews and a third that's dedicated to special needs children. The fourth is purely for internal family use, nobody else knows the URL. All are hosted on blogger. All have only a modest number of regular readers (the tech blog generates the most traffic because people searching for answers to problems end up there fairly often).

Over the past few months all of them, 100%, have been tagged by "the blogger team" as spam blogs (splots). Every one of them, when I filed an appeal, were subsequently cleared:

Your blog has been reviewed, verified, and cleared for regular use so that it will no longer appear as potential spam. If you sign out of Blogger and sign back in again, you should be able to post as normal. Thanks for your patience, and we apologize for any inconvenience this has caused.

I hope they're done now, but I wouldn't be surprised if they did it again. What the heck are they using for an algorithm? What do they consider an acceptable 'false positive rate'? How many miscategorized bloggers simply give up? I'd ask whether Blogger would be so innaccurate if it cost them user revenue, but the answer to that question is just too obvious.

Which gets to the point of my post. Google's religion is the Algorithm, the belief that they can write rules against their de facto 'neural network' (web backmaps) and produce results competitive with human analysts. In this case the algorithms are failing, but Google persists in their use. That's a weakness. They need to emulate Amazon's Amazing Turk and use humans as their splog detectors ...

Update 7/9: Why are humans so good at detecting a splog, and computers so bad? One of the most common models for the evolution of intellect and sentience is that it's important for deception and deception detection. Spotting fakes and lies is fundamental to human cognitive function. A splog is nothing if not a lie. It's not surprising that humans will be very good at spotting them, and computers very weak ...

New old trends in software evolution

An otherwise unremarkable NYT article on Web 2.0 mashups ends with a review of some novel new projects. Similar projects were underway in the late 1990s, but they were derailed with the .com crash. I worked, for example, on an electronic medical record project that used some of these approaches. Now they're back. Very interesting. Now if only we could remove the relationship between employment and healthcare benefits. I think that's the single biggest block to new opportunities for many Americans ...

Software Out There - New York Times

... Another new idea comes from Amazon, whose Web Services group recently introduced a service called the Mechanical Turk, an homage to an 18th-century chess-playing machine that was actually governed by a hidden human chess player.

The idea behind the service is to find a simple way to organize and commercialize human brain power.

"You can see how this enables massively parallel human computing," said Felipe Cabrera, vice president for software development at Amazon Web Services.

One new start-up, Casting Words, is taking advantage of the Amazon service, known as Mturk, to offer automated transcription using human transcribers for less than half the cost of typical commercial online services.

Mturk allows vendors to post what it calls "human intelligence tasks," which may vary from simple transcription to identifying objects in photos.

Amazon takes a 10 percent commission above what a service like Casting Words pays a human transcriber. People who are willing to work as transcribers simply download audio files and then post text files when they have completed the transcription. Casting Words is currently charging 42 cents a minute for the service.

Other examples are also intriguing. A9, Amazon's search engine, is using Mturk to automate a system for determining the quality of photos, using human checkers. Other companies are using the Web service as a simple mechanism to build polling systems for market research.

The impact of modular software will certainly accelerate as the Internet becomes more accessible from wireless handsets.

Scott Rafer, who was formerly the chief executive of Feedster, a Weblog search engine, has recently become chairman of Wireless Ink, a Web-based service that allows wireless users to quickly establish mobile Web sites from anywhere via Web-enabled cellphones.

Using modular software technologies, they have created a service called WINKsite, which makes it possible to use cellphones to chat, blog, read news and keep a personal calendar. These systems are typically used by young urban professionals who are tied together in loosely affiliated social networks. In London, where cellphone text messaging is nearly ubiquitous, they are used to organize impromptu gatherings at nightclubs.

Recently, Wireless Ink struck a deal with Metroblogging, a wireless blogging service, to use its technology. Metroblogging, which already has blogs in 43 cities around the world, lets bloggers quickly post first-person accounts of news events like the July 2005 London bombings.

"Here are two tiny start-ups in California that care about Karachi and Islamabad," Mr. Rafer said. "It's weird, I'll grant you, but it is becoming increasingly common.

Nature: the top 50 science blogs

I read quite a few of the top of the top 50.

Managing North Korea: the special needs approach

This recommendation sounds a lot like the methods used to train exotic animals and some children:

Early Warning by William M. Arkin - washingtonpost.com:

... North Korea definitely shouldn’t be rewarded for its tantrum, and punishing it is also a certain type of reward. No instead, we should cautiously ignore the Muddled Kingdom, work to remove it from the front pages, let its neighbors take the diplomatic lead, shake our heads in exasperation at what can only be described as really bad behavior of no true consequence, and then build a strategy to eliminate the country Eastern European-style, circa 1990.

I'd say give it just enough attention that it feels it's gotten some attention (lest it keep acting out seeking more), but keep it modest. Meanwhile it's all about Cold War II and doing everything possible to cause the North Korean government to collapse. I suspect we've given up on the idea of a 'go gentle while the NK slowly reform' and moved to 'collapse the state as quickly as possible'.

The history of Google Base

Anyone remember Google Base? I bought the hype. (Must remember, must remember ...)

Here's what happened. Or at least a plausible simulation ...

Treating injured brains with ECT?

In an earlier post tonight, I wrote about how different patterns of brain injury and incomplete repair might characterize traumatic brain injury and neurodevelopmental disorders such as "autism" and the personality disorders. I forgot in that post to note the researchers particular interest in Mr. Walter's prolonged antidepressant therapy. Researchers now think of depression as the clinical manifestation of a sort of brain injury, and recovery from depression is associated with neuronal proliferation (healing) in focal areas of the depressed person's brain. Antidepressants may somehow support or trigger that neuroproliferation.

Hmm. Injury. Healing. Antidpressants. Naturally one thinks of electronvulsive therapy, an old, mysterious, and remarkably effective treatment for severe depression. Does that also cause neuroproliferation? If so, would it have a place in treating traumatic brain injury, autism or personality disorders? (Of course the heyday of ECT, as dramatized in that infamous slander One Flew Over the Cuckoo's Nest, it was used for just about everything.)

This would have occurred to researchers in the field many years ago, so I turned to PubMed. It turns out there's been a lot of rat brain work in the past five years. I couldn't find anything on ECT for traumatic brain injury, just old studies on whether ECT caused brain injury. I bet we'll see some animal studies on this topic within the year. As for ECT in autism -- the question has been asked. I think we'd need to have some reasonable animal models for autism before we could explore that one very much ...

Update 7/4: I was following the wrong path with ECT. This morning I remembered that Medtronic and others are using direct electrode "pacing" of brain tissue to treat Parkinson's Disease and depression. So the future is even closer than I'd guessed. We might end up using diffuse (ECT) or focal (pacing) electrostimulation to facilitate healing of a range of injured brains, including autistic brains. (This all reminds me of Accelerando ...)

Healing injured brains: implications for autism?

If injured brains heal over decades, how should we be treating adults with autism and other neurodevelopmental disorders?

Be the Best You can Be: Healing brains, healing minds...