This isn't acceptable. When we are barely over 5% over what I have personally given to Valour-IT, I have a feeling someone, specifically you, isn't pulling your weight. $1, $5, or $10 isn't asking a lot for most Americans, I encourage those who have held out to this point to reconsider. Credit cards are accepted. In case you were wondering, hell no I would never ask anyone to contribute to anything I don't pony up for myself.So in the spirit of giving you your money's worth, I offer an IT related story for Monday for those who want something for their money. Hopefully it will be entertaining.
As I have said before, I own an IT Corporation. In the past, I have specifically worked in technical security related fields over the last decade as part of the larger trend towards the information age.
Several years ago, I was hired as a consultant as part of a Tiger Team for a security related review of large health enterprise (hospital for outpatient care). They had recently implimented a pilot for biometrics, specifically the use of a finger print scanner as a requirement for users to access data.
It was around Halloween so a few of decided we would get a feel for the hospital area by volunteering to dress up as clowns and entertain the patients. It wasn't hard for some of us, we are clowns most of the time anyway, and the charity was good for us and them. Besides, we had a reason.
Within 5 minutes of 'volunteering' we had been able to sit one of our systems guys at a computer terminal and check out the system security. For the most part, the security was pretty good, with one exception, we could script to disable the virus scanner. We later learned the capability to disable the virus scanner was a 'feature' for nurses due to the virus scanner creating false positives with a specific patient care program, a medication lookup program. Either way, we disabled the virus scanner on every workstation, plugged in a jump drive that had a hidden keylogger on it, and left gummy bears all over the tables in each patient care room. We would then note which doctors and nurses entered the patient rooms.
At the end of the day, we collected our jump drives, enabled all the virus scanners, and removed all the gummy bears from the trash cans, each to a specific labeled bag.
You see, gummy bears leave fingerprints, and keyloggers monitor passwords. By monitoring each nurse and doctor who would go into each patient room, we were able to match fingerprints key logged passwords due to time stamps to people. We were able to grab the fingerprints of 4 doctors and 9 nurses. By midnight that night, exploiting the VPN which was password only, we were able to access all of the patient records by using gummy bears as our finger prints.
We got paid well in exposing the failure of the pilot. Because the biometrics finger print scanner was set on such a low setting, mostly because it was unreliable, gummy bears worked well enough. In the end, the pilot and our review proved fingerprints weren't the best approach, and the company ultimately took our advice and went with RSA SecureID fobs.
Moral of the Story: Never trust a clown on Halloween, and support voice activated laptops over rediculous fingerprint scanners every day until Veterans Day!
