Language Selection

English French German Italian Portuguese Spanish

Lost a BlackBerry? Data Could Open A Security Breach

Filed under
Security

The ability to carry vast amounts of data in small but easily misplaced items such as computer memory sticks and mobile e-mail devices has transformed the way Americans work, but it has also increased the risk that a forgotten BlackBerry or lost cell phone could amount to a major security breach.

Worried that sensitive information could ride off in the back of a taxicab or be left in a hotel room, companies are peeling back some of the convenience of mobile devices in favor of extra layers of password protection and other restrictions. Some are installing software on their networks to make it impossible to download corporate information to a portable device or a memory stick, which is a plug-in device that holds data for use on other computers. Wireless providers are developing weapons to use against their own products, like digital "neutron bombs" that can wipe out information from long distance so one misplaced device doesn't translate into corporate disaster.

It's a nightmare that individuals and corporations fret about when their mobile e-mail or handheld devices go missing or fall into the wrong hands. With the swift stroke of a keypad, someone's e-mail, corporate data and business contacts can be laid bare for others to see -- and potentially abuse.

Personal devices "are carrying incredibly sensitive information," said Joel Yarmon, who, as technology director for the staff of Sen. Ted Stevens (R-Alaska), had to scramble over a weekend last month after a colleague lost one of the office's wireless messaging devices. In this case, the data included "personal phone numbers of leaders of Congress. . . . If that were to leak, that would be very embarrassing," Yarmon said.

A couple of years ago, David Yach and all other workers at his Canadian company woke up to an e-mail full of expletives from an otherwise mild-mannered female employee.

But it was not sent by the woman. A thief had broken into her home, commandeered her BlackBerry wireless device and sent the note, said Yach, vice president of software at Research in Motion Ltd., the company that makes the BlackBerry, a device that allows e-mail to be sent and received.

"It's terrifying," said Mark Komisky, chief executive of Baltimore's Bluefire Security Technologies Inc., who recently lost his iPaq 6315 Pocket PC in a cab or at O'Hare International Airport in Chicago. The device, a small pocket phone with a miniature keyboard, contained his e-mail, details of his company's strategy, Social Security numbers of his wife and son, and phone numbers for high-level executives at companies with which Bluefire does business, such as Intel Corp.

"I got off the plane in Baltimore and did the pat-down, and didn't have it," he said. "It's bad," even for the head of a firm that sells security services for companies and government agencies trying to secure their wireless devices. At 10:30 p.m., he called a technician at Bluefire, who erased the information on the iPaq remotely. Luckily, it was also locked with a password, he said.

Companies are seeking to avoid becoming the latest example of compromised security. Earlier this year, a laptop computer containing the names and Social Security numbers of 16,500 current and former MCI Inc. employees was stolen from the car of an MCI financial analyst in Colorado. In another case, a former Morgan Stanley employee sold a used BlackBerry on the online auction site eBay with confidential information still stored on the device. And in yet another incident, personal information for 665 families in Japan was recently stolen along with a handheld device belonging to a Japanese power-company employee.

To combat the problem, security companies have come up with ways to install layers of password protection and automatic locks on devices. Others market the ability to erase data over the air once the device is reported lost. In Japan, cell phone carrier NTT DoCoMo Inc. started selling models that come with fingerprint scanners to biometrically unlock phones.

Some companies suffer only embarrassment from such incidents. But for public companies or financial firms, a lost device could mean violation of the Sarbanes-Oxley Act, which requires strict controls over disclosure of financial information. For doctors and health care companies, the loss of customer data compromises patient confidentiality, protected by the Health Insurance Portability and Accountability Act.

Potential security breaches are made scarier by the greater reliance on mobile devices. Smart phones, such as the Treo or some BlackBerry models, come with enough memory and high-speed Internet access to function as small computers. In some cases, accompanying memory cards allow users to store even more data, including client lists and contract information.

"I hear less about the cost of the devices, because it really is a pittance, but I really do hear more about the potential cost of someone gaining access to corporate data," said Kenny Wyatt, a vice president for Sprint Corp., which helps some of its business customers manage the security of wayward devices.

Three years ago, Wyatt lost a cell phone containing phone numbers of co-workers and clients. Sprint now can delete information by sending a signal to a phone over the air, he said, although if the device is turned off, the kill signal won't work.

Without the kill service, losing his phone would be a bigger deal today than it was three years ago because the device contains so much more information, he said. "It'd be like I lost an appendage."

In Chicago, 160,000 portable devices are left in taxicabs every year, according to a survey earlier this year by Pointsec Mobile Technologies, a security software firm. Fifty to 60 percent of those are reunited with their owner, according to the firm, which polled cab companies.

According to another survey sponsored by software maker Symantec Corp., 37 percent of smart-phone users store confidential business data on their phones. Only 40 percent of those surveyed worked at companies that have corporate policies about wireless security.

Yarmon, the staffer for Sen. Stevens, said he sends an e-mail every few months reminding colleagues to install passwords on devices. "That is my worst fear," he said, "for a user to have it fall into the hands of somebody who disseminates it or uses that information against my boss."

By Yuki Noguchi
Washington Post

More in Tux Machines

today's leftovers

  • [LabPlot] Improved data fitting in 2.5
    Until now, the fit parameters could in principle take any values allowed by the fit model, which would lead to a reasonable description of the data. However, sometimes the realistic regions for the parameters are known in advance and it is desirable to set some mathematical constrains on them. LabPlot provides now the possibility to define lower and/or upper bounds for the fit parameters and to limit the internal fit algorithm to these regions only.
  • [GNOME] Maps Towards 3.28
    Some work has been done since the release of 3.26 in September. On the visual side we have adapted the routing sidebar to use a similar styling as is used in Files (Nautilus) and the GTK+ filechooser.
  • MX 17 Beta 2
  • MiniDebconf in Toulouse
    I attended the MiniDebconf in Toulouse, which was hosted in the larger Capitole du Libre, a free software event with talks, presentation of associations, and a keysigning party. I didn't expect the event to be that big, and I was very impressed by its organization. Cheers to all the volunteers, it has been an amazing week-end!
  • DebConf Videoteam sprint report - day 0
    First day of the videoteam autumn sprint! Well, I say first day, but in reality it's more day 0. Even though most of us have arrived in Cambridge already, we are still missing a few people. Last year we decided to sprint in Paris because most of our video gear is stocked there. This year, we instead chose to sprint a few days before the Cambridge Mini-Debconf to help record the conference afterwards.
  • Libre Computer Board Launches Another Allwinner/Mali ARM SBC
    The Tritium is a new ARM single board computer from the Libre Computer Board project. Earlier this year the first Libre Computer Board launched as the Le Potato for trying to be a libre and free software minded ARM SBC. That board offered better specs than the Raspberry Pi 3 and aimed to be "open" though not fully due to the ARM Mali graphics not being open.
  • FOSDEM 2018 Will Be Hosting A Wayland / Mesa / Mir / X.Org Developer Room
    This year at the FOSDEM open-source/Linux event in Brussels there wasn't the usual "X.Org dev room" as it's long been referred to, but for 2018, Luc Verhaegen is stepping back up to the plate and organizing this mini graphics/X.Org developer event within FOSDEM.
  • The Social Network™ releases its data networking code
    Facebook has sent another shiver running up Cisco's spine, by releasing the code it uses for packet routing. Open/R, its now-open source routing platform, runs Facebook's backbone and data centre networks. The Social Network™ first promised to release the platform in May 2017. In the post that announced the release, Facebook said it began developing Open/R for its Terragraph wireless system, but since applied it to its global fibre network, adding: “we are even starting to roll it out into our data center fabrics, running inside FBOSS and on our Open Compute Project networking hardware like Wedge 100.”
  • Intel Icelake Support Added To LLVM Clang
    Initial support for Intel's Icelake microarchitecture that's a follow-on to Cannonlake has been added to the LLVM/Clang compiler stack. Last week came the Icelake patch to GCC and now Clang has landed its initial Icelake enablement too.
  • Microsoft's Surface Book 2 has a power problem
     

    Microsoft’s Surface Book 2 has a power problem. When operating at peak performance, it may draw more power than its stock charger or Surface Dock can handle. What we’ve discovered after talking to Microsoft is that it’s not a bug—it’s a feature.

Kernel: Linux 4.15 and Intel

  • The Big Changes So Far For The Linux 4.15 Kernel - Half Million New Lines Of Code So Far
    We are now through week one of two for the merge window of the Linux 4.15 kernel. If you are behind on your Phoronix reading with the many feature recaps provided this week of the different pull requests, here's a quick recap of the changes so far to be found with Linux 4.15:
  • Intel 2017Q3 Graphics Stack Recipe Released
    Intel's Open-Source Technology Center has put out their quarterly Linux graphics driver stack upgrade in what they are calling the latest recipe. As is the case with the open-source graphics drivers just being one centralized, universal component to be easily installed everywhere, their graphics stack recipe is just the picked versions of all the source components making up their driver.
  • Intel Ironlake Receives Patches For RC6 Power Savings
    Intel Ironlake "Gen 5" graphics have been around for seven years now since being found in Clarkdale and Arrandale processors while finally now the patches are all worked out for enabling RC6 power-savings support under Linux.

Red Hat: OpenStack and Financial News

Security: Google and Morgan Marquis-Boire

  • Google: 25 per cent of black market passwords can access accounts

    The researchers used Google's proprietary data to see whether or not stolen passwords could be used to gain access to user accounts, and found that an estimated 25 per cent of the stolen credentials can successfully be used by cyber crooks to gain access to functioning Google accounts.

  • Data breaches, phishing, or malware? Understanding the risks of stolen credentials

    Drawing upon Google as a case study, we find 7--25\% of exposed passwords match a victim's Google account.

  • Infosec star accused of sexual assault booted from professional affiliations
    A well-known computer security researcher, Morgan Marquis-Boire, has been publicly accused of sexual assault. On Sunday, The Verge published a report saying that it had spoken with 10 women across North America and Marquis-Boire's home country of New Zealand who say that they were assaulted by him in episodes going back years. A woman that The Verge gave the pseudonym "Lila," provided The Verge with "both a chat log and a PGP signed and encrypted e-mail from Morgan Marquis-Boire. In the e-mail, he apologizes at great length for a terrible but unspecified wrong. And in the chat log, he explicitly confesses to raping and beating her in the hotel room in Toronto, and also confesses to raping multiple women in New Zealand and Australia."