Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Index to Volume 25

Forum on Risks to the Public in Computers and Related Systems

Volume 25 Issue 00 ()

• Subject: SUMMARY OF RISKS VOLUME 25 (ongoing)
• (archived in ftp file risks-25.00)

Volume 25 Issue 01 (Monday 7 January 2008)

• Fire! Works! oops, too slow (Mark Brader)
• Boeing 787 networking issues (Martyn Thomas)
• Feds Release Pass Card details (Brock N. Meeks via David Farber)
• Has chip-and-pin failed to foil fraudsters? (Pere Camps)
• Sears exposes customers' information via its web site (Rich Kulawiec via IP)
• User Data Stolen From Pornographic Web Sites (David Lesher)
• Election Computers Stolen in Tennessee (David Lesher)
• Er, Airline Captains Do What, Again? (Rick Moen)
• Risks of embedded javascript (Paul Wallich)
• Mercedes console display with conflicting information (Henry Baker)
• Mac Quickbooks update deletes user desktop (Bonnie Packert)
• No more loose lithium batteries in checked luggage (Peter Gregory)
• Risks of believing what you see on the WayBack Machine (Fred Cohen)
• Re: Computer Failure Causes Closure of Seattle Downtown Transit Tunnel (Stanislav Meduna)
• Re: Satnav: Nope, you can't get there from here. (Craig DeForest)
• Re: Satnav (Martyn Thomas)
• Re: Drunk a better guide than sat nav (Ross Younger)
• Passing of Computing and Information Security Pioneer: Jim Anderson (Gene Spafford)

Volume 25 Issue 02 (Monday 14 January 2008)

• Coffee Grounds Qantas (Charles Wood)
• Computer problem suspected in erratic Airbus flight (Antonomasia)
• Metal structure beneath runway affects aircraft instruments (David Dixon)
• Polish teenager uses city trams as train set (Peter Houppermans)
• Novel approach to reducing electoral fraud (Peter Mellor)
• Risks of believing a GPS system (Paul Karger)
• GPS in a tea shop anecdote (Mark Brader)
• More GPS mishaps (Paul Saffo)
• Nightmare on VoIP Street (Ed Ravin)
• A risk of static analysis tools -- and refereeing (Peter Gutmann)
• Bank gives money to fraudster posing as its chairman (David Dixon)
• REVIEW: "Managing Knowledge Security", Kevin C. Desouza (Rob Slade)

Volume 25 Issue 03 (Tuesday 29 January 2008)

• Data entry error leads to incompatible transplant (Mark Brader)
• London Heathrow plane crash (Colin Stamp)
• "Butterfly Award": French Bank Says Trader Hacked Computers (Henry Baker)
• Henhouses, guarding of, by foxes: Kerviel Kerfuffle (Steve Summit)
• Problems with the German tax software "Magpie" (Debora Weber-Wulff)
• Florida computer problems halt early voting (PGN)
• The risks of upgrading software (Clive D. W. Feather)
• Charter Cable deletes 14,000 e-mail accounts. No backups. (Danny Burstein)
• IRS: Kansas City lost our tapes. Lots of personal info.... (Danny Burstein)
• Automated parking garage reopens (Rich Mintz)
• Blue Screened Asphalt Jungle... (David Lesher)
• Windows virus protection on NASA Linux machines (David Lesher)
• Authors, pseudonyms, and software (Steven M. Bellovin)
• Re: Metal structure beneath runway affects aircraft instruments (Roderick A Rees)
• Re: Boeing 787 networking issues (Mark Siegel)
• Re: Coffee Grounds Qantas (Brian Hayes)
• Re: More GPS mishaps (Joel Maslak, Dag-Erling Smørgrav, Paul Saffo)
• REVIEW: "Fuzzing", Michael Sutton/Adam Greene/Pedram Amini (Rob Slade)

Volume 25 Issue 04 (Saturday 2 February 2008)

• Transplant patient has NEW kidney removed after NHS computer blunder (Richard I. Cook)
• Tachometer error caused 2005 runway overrun (Mark Brader)
• Mideast submarine cable disruptions (David Lesher)
• Empire State Building car e-interference mystery (David Chessler)
• Technology Review: Stopping cars with microwaves (David Chessler)
• Manufacturer Blames Bankruptcy on Failed ERP Implementation (Ken Dunham)
• 2008 meltdown margin player blames s/w for failure to complete trades (George Michaelson)
• Fifth Amendment: Passphrase cannot be forced (David Lesher)
• British software pirate sells GBP 12K package at 1/1000 (Peter Mellor)
• DTV vs USPS (Peter Zilahy Ingerman)
• Voting Machine Usability Testing (Ken Dunham)
• Impersonating armored car personnel (Craig Partridge)
• Another public data loss in the UK (Robert Klemme)
• Automated calling system glitch locks down school (Steve Eddins)
• Re: Air Canada A319 upset (Peter Ladkin)
• Re: Coffee Grounds Qantas (Preston de Guise)
• Re: Metal structure beneath runway ... (Neil Youngman)
• Hoist by one's own petard: data security: UK Child Benefits (Adrian Cherry)
• REVIEW: "Software Testing Practice: Test Management", Spillner et al. (Rob Slade)

Volume 25 Issue 05 (Monday 18 February 2008)

• L.A. School payroll system's spectacular failure (Richard I. Cook)
• FBI mistakenly receives supposedly protected e-mail (Steven M. Bellovin)
• Canadian Government Mails Out Confidential Data (Ken Dunham)
• JAL cabin crews sue over personal info (PGN)
• JAL near miss on attempted takeoff (PGN)
• Future of e-voting in doubt in Japan (PGN)
• Computer Error Strands Tanker off Massachusetts (Lee Rudolph)
• Bell Canada Data on 3.4 Million Customers Stolen (Ken Dunham)
• Royal Canadian Mounted Police Censured for Privacy Violations (Ken Dunham)
• Re: Lost Kansas City IRS tapes with personal info. (Danny Burstein)
• Critics chuck MS 'friendly worm' plan on the compost heap (Chris Leeson)
• Another BlackBerry Outage Caused by System Upgrade? (Ken Dunham)
• Vulnerability info suppressed by criminals paying to hide it (Ken Dunham)
• New GAO Report on IRS Information Security Pervasive Vulnerabilities (Diego Latella)
• The GPS miracle (Rich Mintz)
• 'Woman Says Being Declared Dead Ruins Life' (PGN)
• A reminder: Eric Sevareid's Law (Ken Knowlton)
• Ah yes, just what you need!!! (David Lesher)

Volume 25 Issue 06 (Monday 25 February 2008)

• Securing The Wrong Spaces: A Lesson (Paul Ferguson via Gregory Hicks)
• Software problem at London Heathrow Terminal 4 affects baggage (Peter Mellor)
• YouTube outage blamed on Pakistan (Amos Shapir)
• One way not to conduct Internet voting (Peter Kaiser)
• Being declared dead ruins life (Andrew Koenig)
• New RFID ticketless bus system in Brisbane goes live... with glitches (George Michaelson)
• US Treasury "TreasuryDirect" Web site security enhancements (Jonathan Kamens)
• EU money for 4 small businesses IT risk mgmt pilot (Patrick O'Beirne)
• Cold Boot Attacks on Disk Encryption (Jacob Appelbaum, Declan McCullagh)
• Illegal drag race kills eight (John Curran)
• Free-to-download password cracker (Peter Mellor)
• Re: the GPS miracle (Steven M. Bellovin)

Volume 25 Issue 07 (Saturday 1 March 2008)

• Risks of Leap Years and Dumb Digital Watches (Mark Brader)
• Risks of Leap Years and Dumb Airline Software (PGN)
• $1.2 billion up in smoke (Paul Saffo)
• Southeast Florida Massive Power Outage (Steven J. Greenwald)
• FL power failure triggered by human error (Lauren Weinstein)
• Competent? We can't even archive our own e-mail reliably! (Jim Horning)
• DreamHost Accidently Bills Customers $7,500,000 (Dan Jacobson)
• IT Project Failure Blog (Ken Dunham)
• Is the "law of unintended consequences" biting W3C DTD reference? (George Michaelson)
• Pakistan, YouTube, Google, and No Simple Answers (Lauren Weinstein)
• Re: YouTube outage blamed on Pakistan (R A Lichtensteiger, Richard Grady, Jay R. Ashworth)
• Cold Boot Attacks: Vulnerable While Sleeping (Ed Felten via Monty Solomon)
• Citibank needs a clue (Rich B. Astaird)
• Re: Hoist by one's own petard: data security: UK Child Benefits (Merlyn Kline)
• REVIEW: "Better Ethics Now", Christopher Bauer (Rob Slade)

Volume 25 Issue 08 (Friday 14 March 2008)

• Wind Power Risks (Charles Wood)
• FBI Found to Misuse Security Letters (lynn via Dave Farber's IP)
• RFID hack could crack open 2 billion smart cards (Sharon Gaudin)
• Nasty scanner attack: AccuBasic malware (PGN)
• Hacking a pacemaker (Gadi Evron)
• More on pacemaker risks (PGN)
• Stopping cars with microwaves (Matthew D. Healy)
• It's too easy to access the "off" switch (Robert P Schaefer)
• UK ISPs to sell users' private browsing information (Mike Scott)
• TSA can't believe MacBook Air is a real laptop; owner misses flight (Paul Saffo)
• Deja Vu all over again (Andrew Koenig)
• CAPTCHA attacks (Monty Solomon)
• Safari "beachball" black on black (Richard A. O'Keefe)
• Risks of Leap Years and Dumb Digital Watches (Clive D. W. Feather, Amos Shapir)
• USENIX Announces Open Access to Conference Proceedings (Lionel Garth Jones)

Volume 25 Issue 09 (Thursday 27 March 2008)

• Billion-dollar IT failure at Census Bureau (eekid via David Farber)
• A Heart Device Is Found Vulnerable to Hacker Attacks (Barnaby Feder via Monty Solomon)
• FL power outage NERC updates (Catherine M Horiuchi)
• Vandals halt some hybrid buses using external 'off' switch (Rick Damiani)
• Flight Service Software Crashes; Pilot Briefings Delayed (Gabe Goldberg)
• Substantial supermarket breach affects millions (Robert Heuman)
• Man arrested by mistake over phone system bug (Rick Damiani)
• Hoax on Craiglist causes duped victims to steal property (Mark Brader)
• Payment by fingerprint disappears (Jon Van and Becky Yerak via Paul Saffo)
• Cute e-mail leak (Steve Summit)
• Search engine bait? (Steve Schafer)

Volume 25 Issue 10 (Tuesday 1 April 2008)

• A modest proposal for the improvement of Daylight Saving (Tony Finch)
• A Current Affair: Lauren Weinstein, Inside Risks, CACM April 2008 (PGN)
• Chaos Computer Club publishes Minister's fingerprint - and more (Peter Houppermans)
• DST transition time mismatches (Tony Finch)
• Mini-Y2K fears over Aussie daylight saving change (Max Power)
• NYPD erases crime statistics for February 29 (Ed Ravin)
• More flights canceled as Heathrow remains in chaos (Alan Cowell via David Farber's IP)
• Heathrow: The risks of hubris (Diomidis Spinellis)
• GPS Errors are riskier than you may imagine: consider Liability-Critical Applications (Bern Grush)
• Re: Securing The Wrong Spaces: A Lesson (Rick Damiani)
• Re: Arrest over phone system bug: Trailing zeroes (Graham Reed)
• Re: Thieves become victims? (stanley)

Volume 25 Issue 11 (Wednesday 9 April 2008)

• Crossed wires cited in recent UAL skidding incidents (Monty Solomon)
• Unanticipated GPS risk: foreign translations (Paul Schreiber)
• Census to scrap handheld computers for 2010 count (Bob Schaefer)
• Boston city complaint line lags (Donovan Slack via Monty Solomon)
• Indiana school district wipes out high school grades (Danny Burstein)
• Re: Search engine bait? (Martin Ward)
• Another genuine mail that looks like a phish (Andy Piper)
• Nissan GT-R sports car recognizes racetrack coordinates and aftermarket parts (Clark Family)
• REVIEW: "Security Data Visualization", Greg Conti (Rob Slade)

Volume 25 Issue 12 (Tuesday 22 April 2008)

• Industrial Control Systems Killed Once, Will Kill Again (Ryan Singel)
• GPS leads a bus astray (David Caley)
• Neighbor's data shows up in my browser (borborugmus)
• Oklahoma Dept of Corrections Website URLs contain raw SQL (Jim Garrison)
• Real-time spying on credit card holders (Nick Brown)
• Larger Prey Are Targets of Phishing (John Markoff via Monty Solomon)
• Aer Lingus economy 5-euro flights to the US after test data leaked to web (Patrick O'Beirne)
• Gone in 60 seconds: Spambot cracks Live Hotmail CAPTCHA (Emil Protalinki via Monty Solomon)
• Bouncing Merrily Along (Peter B. Ladkin)
• The 10,000 web sites infection mystery solved (Bojan Zdrnja via Monty Solomon)
• Re: Census to scrap handheld computers for 2010 count (Derek P Schatz)
• Re: Search engine bait? (Randall Roberts)
• Re: Another genuine mail that looks like a phish (Gregory Hicks)
• Re: Nissan GT-R sports car and GPS (Peter Houppermans, JTaylor)
• 2008 IEEE Symposium on Security and Privacy (Yong Guan)
• REVIEW: "Computer Security: Principles and Practice" (Rob Slade)

Volume 25 Issue 13 (Sunday 27 Apr 2008)

• Hack into Obama campaign site exploited a coding flaw (Jordan Robertson via Joseph Lorenzo Hall)
• Hacking a rival smart card? (Robert P Schaefer)
• Face scans for air passengers to begin in UK this summer (Brian Randell)
• 30th Spamiversary (Brad Templeton via Mike Hogsett)
• Re: Bouncing Merrily Along (Paul Karger)
• Re: Real-time spying on credit card holders (Ron Garret)
• Re: Neighbor's data shows up in my browser (Paul D. Smith, Erik Mooney)
• Re: GPS leads a bus astray (Roger Scrafford)
• Re: Nissan GT-R sports car and GPS (Chris Kantarjiev, Dag-Erling Smørgrav, Dag-Erling Smørgrav, Peter Houppermans, Dag-Erling Smørgrav)

Volume 25 Issue 14 (Friday 2 May 2008)

• U.S. Customs computer system fails nationwide (PGN)
• Protecting Yourself From Suspicionless Searches While Traveling (Jennifer Granick via Monty Solomon)
• Air marshals' names tagged on 'no-fly' list (Audrey Hudson via Monty Solomon)
• Italy posts salary details on web (Amos Shapir)
• Tot dies after Internet 911 call fails to reach dispatchers (Tony Toews)
• Canadian Human Rights Commission investigator hijacks woman's Internet connection (Kelly Bert Manning)
• Microsoft anti-encryption toolkit (David Lesher)
• "Default Password" exploits still work (William Nico)
• Protecting credit card holders (Kearton Rees)
• Police officer uses real witness statement as template document (Identity withheld by request)
• False alarm guaranteed after 7 years (Daniel P.B. Smith)
• Facial recognition in airports... please say it's April 1st. (Fred Cohen)
• Re: Face scans for UK air passengers (Peter Houppermans)
• Re: 30th Spamiversary (Amos Shapir)
• Re: Real-time spying on credit card holders (Nick Brown)
• Blown to Bits, Abelson/Ledeen/Lewis (PGN)

Volume 25 Issue 15 (Friday 16 May 2008)

• No-flies on you? (PGN)
• Gone in 60 seconds: Spambot cracks Live Hotmail CAPTCHA (Emil Protalinski via Monty Solomon)
• Hacker leaks 6 million Chileans' records (Amos Shapir)
• Dilbert site wants to install a widget (William Ehrich)
• Used hardware containing sensitive data (Tony Harminc)
• 88,000 hospital patient records stolen in NYC (Danny Burstein)
• UK CCTV used to create a music video (Forest Mars)
• QWERTYUIOOPS (Charles C. Mann)
• Post Office changes 100 SF addresses (Rob McCool)
• PO-boy (Peter Zilahy Ingerman)
• Debian OpenSSL Predictable PRNG Toys (H D Moore via Monty Solomon)
• Debian OpenSSL Vulnerability (Monty Solomon)
• How not to use SSL (Nickee Sanders)
• A risk for those that own Digital photo frames (Identity withheld)
• 'Peel and Stick' Tasers Electrify Riot Control (Paul Saffo)
• Risks of Be-clowning Yourself at Computerized Speeds, Internationally (R.G. Newbury)
• REVIEW: "Geekonomics: The Real Cost of Insecure Software", David Rice (Rob Slade)

Volume 25 Issue 16 (Thursday 22 May 2008)

• Betting glitch spurs calls for reform (Will Oremus via PGN)
• Animal tricks, take n+1 (Jeremy Epstein)
• Ants and Computers (Gene Wirchenko)
• F.B.I. Says the Military Had Bogus Computer Gear (John Markoff via Monty Solomon)
• Another undeleted/deleted Document - "Krolls Associates" (Danny Burstein)
• Don't phlash that dwarf - hand me the pliers! (John Leyden via Randall)
• Geolocation software risks (Mickey Coggins)
• Shopping centers tracking cell phones (PGN)
• China's All-Seeing Eye (EEkid via Dave Farber)
• Re: Real-time spying on credit card holders (Curt Sampson)
• Microsoft security advice for sale (Peter Houppermans)
• Old-Style Pumps Balk At $4-a-Gallon Gas, Too (Nick Miroff via Monty Solomon)
• Clueless in France (Pete Kaiser)
• PayPal XSS Vulnerability Undermines EV SSL Security (Paul Mutton via Monty Solomon)
• More GPS Mishaps (Gene Wirchenko)
• Re: UK CCTV used to create a music video (Chris Drewe)
• Re: Dilbert wants a widget (Bill Bumgarner)
• Re: Debian OpenSSL Predictable PRNG Toys (Jim Horning)
• Re: Securing The Wrong Spaces: A Lesson (David E. Price)

Volume 25 Issue 17 (Friday 30 May 2008)

• Wrong patient gets appendix removed, software to blame (Rex Sanders)
• E-Voting Banned by Dutch Government (Udo de Haes)
• Don't phlash that dwarf -- hand me the pliers! (John Leyden)
• Firmware-based phone vulnerabilities (David Magda)
• A Low-cost Attack on a Microsoft CAPTCHA (Jeff Yan and Ahmad Salah El Ahmad via Monty Solomon)
• SYN attack from RIAA contractor (David Lesher)
• Random and haphazard are not synonyms (Andrew Koenig)
• An iTunes file database problem Apple will never fix (Max Power)
• Microsoft's Masters: Whose Rules Does Your Media Center Play By? (Greg Sandoval)
• Fundraising that is too Excel-lent to report (Mark Brader)
• On-line registration for College Reunion 2008 (F John Reinke)
• Why not set the pump to half price and post a sign? (Daniel P. B. Smith)
• Re: Securing The Wrong Spaces: A Lesson (John Sullivan, Bill Hopkins)
• An account of the Estonian Internet War (Gadi Evron)

Volume 25 Issue 18 (Tuesday 3 June 2008)

• Fire at The Planet takes down thousands of websites (Gene Wirchenko)
• UK power rationing causes fires and false fire alarms (Alistair McDonald)
• Beware of Error Messages At Bank Sites (Brian Krebs via George Sherwood)
• Still even more lost data (Gene Wirchenko)
• Mass exploitation with Adobe Flash (Monty Solomon)
• Risks in Instant Runoff Voting (PGN)
• Arkansas Election Officials Baffled by Machines that Flipped Race (PGN)
• Spelling checker runs amok in Pennsylvania high-school yearbook (Al Stangenberger)
• Full Disclosure and why Vendors Hate it (Jonathan A. Zdziarski via Monty Solomon)
• Re: An iTunes file database problem Apple will never fix (Alistair McDonald)
• Re: Wrong patient gets appendix removed, software to blame (PGN)
• REVIEW: "Secure Programming with Static Analysis", Chess/West (Rob Slade)

Volume 25 Issue 19 (Sunday 8 June 2008)

• Control-Alt-SCRAM; update reboots nuke plant (Brian Krebs via David Lesher)
• Sensor error caused $1.4 bill B2 crash! (David A. Fulghum via Paul Saffo)
• UK bank takes 9 months to combine computer systems (Peter Mellor)
• Online registration for US visa waiver scheme from August 2008 (Donald Mackie)
• The ID Divide: Peter Swire and Cassandra Q Butts (Monty Solomon)
• ISP Secretly Added Spy Code To Web Sessions: Ryan Singel (Monty Solomon)
• Advice from HM Revenue & Customs on NI number fraud (Peter Mellor)
• Stanford employees' data on stolen laptop (PGN)
• Sometimes the computer is right... (David Hollman)
• "She'll never fail to stop at a railroad crossing ever again" (Jeff Rosen via Mark Brader)
• Experts Revive Debate Over Cellphones and Cancer (Tara Parker-Pope via Monty Solomon)
• Re: Risks in Instant Runoff Voting (Richard Gadsden)
• Re: Fire at The Planet takes down thousands of websites (Paul Czyzewski)
• Re: Whose Rules Does Your Media Center Play By? (Steve Wildstrom)
• Re: Beware of Error Messages At Bank Sites (Paul Czyzewski)
• Re: An iTunes ... problem Apple will never fix (Henry Baker, Max Power)

Volume 25 Issue 20 (Sunday 15 June 2008)

• Security hole exposes utilities to Internet attack (PGN)
• Representative Frank Wolf's computer owned by China (PGN)
• Hidden Code Costs Poker Players Thousands (Chuck Weinstock)
• Wikipedia for medical students? (Steven M. Bellovin)
• Wartime global temperature anomaly kicks the bucket (Mark Brader)
• Colleges With Federal Contracts Will Have to Use New E-Verify (PGN)
• Google "safebrowsing" diagnostic page (Rob Slade)
• ID cards by the back door (Peter Mellor)
• Spuds and system security (Rob Slade)
• Clothing firm "Cotton Traders" customer database breached (Peter Mellor)
• Update on ISP Actions Regarding C-Porn and Usenet (Lauren Weinstein)
• Re: Risks in Instant Runoff Voting (Stewart Fist, Andrew Koenig)
• Re: Stanford employees' data on stolen laptop (Hal Murray)
• Re: Advice from HM Revenue and Customs (Edward Rice)
• Re: She'll never fail to stop at a railroad crossing (Leonard Finegold)
• Re: An iTunes ... problem Apple will never fix (Andrew M. Langmead)
• Tracking the Trackers: Piatek et al. (Monty Solomon)

Report problems with the web pages to the maintainer