Lost Treasures

Some say computer science rediscovers old ideas every twenty years or so. Justin mentioned it last week in the context of explicit vs implicit information flows. I was reminded again today when I saw a call for papers from IEEE Security & Privacy titled ‘Lost Treasures of Computer Security & Privacy’ [http://www.computer.org/portal/web/computingnow/spcfp6] for a special issue next year. The list of topics the editors seek makes for fascinating reading, but I wish to note a different, practical reason.

When tracking down a reference a few months ago, I ran into an example of what librarians call a ‘black hole’ or ‘dark age’: periods of history inaccessible due to changing technology. The document I was looking for contains hearings before the U.S. Senate Select Committee on Small Business, 85th Congress, in 1957. But when I went to that room in the regional depository library, all I found were pieces of shelving on the floor. The microform collection is being digitised and decades of microfilm are ‘temporarily unavailable’, where temporary may mean upwards of a year or more.

What other instances of forgotten lore have you personally encountered?

How not to look like a spearphishing attack

This is not a protip on how to make your spearphishing attacks more effective.

Today I received an email on my work account. It happens to be at a large defence contractor, and that’s relevant. Because spear phishing attacks are a primary threat in my environment, and they look just like this:

From: [redacted] SPAWARSYSCEN-ATLANTIC, 987654 [[redacted]@navy.mil]
Subject: EXTERNAL: Intelligence Advisor
Attachment: Newsletter_1.docx
Attached is our latest Newsletter.  Please review.
[name redacted]
ASSO/Security Specialist
SSC-Atlantic SSO
[telephone redacted]
[fax redacted]
For Official Use Only - Privacy Sensitive - Any misuse or unauthorized disclosure may result in both civil or criminal penalties.

A few things stand out in that email: the empty To: and Cc: fields, the extremely generic filename of the attachment, the fact that the attachment is, or at least appears to be, a Word document; and in the body of the message, the odd capitalisation of ‘Newsletter’, the imperative phrase ‘Please review.’

I took the precaution of examining the mail headers in detail.  Thanks, Microsoft, for making that difficult to do.  The Received: header chain looked reassuring; it came from the expected place.  Interestingly, I only now noticed that the email was digitally signed.  The icon is so tiny I overlooked it.  Thank you, Microsoft, again for hiding that piece of important information from me.

I was still wary about the attachment, though.  After a suitable period of contemplation, I clicked on it.  The expected warning message from the OS appeared: “you should not open files received from unknown senders”.  Why show me that warning message when it knows that the message is digitally signed?  Instead of saying it’s from an unknown sender, why not show me the certificate path of the digital signature?  My future career prospects flashing before my eyes, I hesitated.  Instead of opening the attachment at once, I decided to try scanning it first with my computer’s anti-virus programme.

And promptly received a demand for the Administrator password—which I don’t have—because apparently that’s not something users are allowed to do.

So my question for the community is, how can this problem be solved?  Crippling suspicion can’t be good for the efficiency of organisations.

P.S. It was not a spear-phishing attack.  I had a nice conversation with the sender later and we comiserated over the state of trust on the internet.