Marketing AV in Tallinn, Estonia

Last week saw the end of DigiEXPO 2007 in Tallinn, Estonia. The event started in 2006 and was designed to be a exhibition of the latest and greatest digital lifestyle products and services available to consumers in Estonia. Conveniently located at the Viru Centre in Viru Väljak, the event was designed to allow Tallinn's weekend shoppers to check out the latest digital SLRs from Canon or Nikon, browse the freshest laptop offerings from the likes of HP or even get your hands on Apple's iPhone.


I was lucky enough to be visiting Tallinn that weekend and went along to see what all the fuss was about, imagine my surprise to see scantilly clad ladies marketing Kaspersky's Anti-Virus software in a way that I have never seen Anti-Virus software marketed before. The three ladies were approximately twenty years of age and all dressed up as little red riding hood but with a more considerable amount of cleavage, incredibly short skirts and fishnet stockings. They were quick to hand out a copy of Kaspersky's "Personal Security" edition of their Anti-Virus product from a woven hand basket. What an incredibly small box, what was inside? A USB memory stick with Kaspersky on it perhaps? It couldn't be a CD, even the mini CDs would not fit in that. Instead I found one packaged condom, not software but "soft-wear"!


I stared at it for a while in disbelief, it was a clever marketing ploy but I wondered whether this kind of marketing would alienate business users. But the more time I spent in Tallinn the more I realised that this was a perfect marketing ploy. Tallinn is the seventh most technologically advanced city in the world and the New York Times recently proclaimed it the "Silicon Valley on the Baltic Sea". Free wi-fi is available all over the city and indeed over a great proportion of the urbanised country. Wherever you go you will see young professionals and students alike with a coffee in one hand and a laptop sitting on park benches or in one of the many new cafes and bars that have sprung up in the wake of communism. Unlike most of the old Eastern Bloc countries, Estonia is managing to retain the young demographic where most other countries are losing the young portion of the population to the West. The answer is simple, Estonia is investing in it's future, it wants people to stay. Kaspersky was marketing to the young dynamic population that is responsible for the likes of Skype and Kazaa ... and it's working. (Thanks to Michal for taking the time to take the photos above)

Flickr Security Part 1 - Your Personal Profile

As always I start with a disclaimer; total security does not exist, I merely suggest best practice when it comes to finding that happy medium between online privacy and application functionality.

I'm a photographic hobbyist which makes Flickr a really cool place for me to safely exhibit photographs anonymously or otherwise. However, with any registered service you will exhibit an online presence, here is my privacy best practices:

Personal

• Buddy icon - Choosing an icon that does not directly resemble you is probably a good idea, you don't have to be a registered user to see this so in actual fact your icon is visible to the world. If you do choose a self-portrait then be sure it is suitably obscure and does not exhibit any distinguishing marks, scars or have a picture of your house/car/workplace, etc. All of those elements can lead to a full disclosure of your personal details. Likewise, avoid posting pictures of others. More about this later.
• Your screen name - There is so much that you can do wrong here, it depends on your vigilence. If you decide to call yourself dublingirly1982 or dubchick25 I can safely assume you are Female, you live in Dublin or you were born there perhaps. I could also safely assume you were either 25, born in 1982 or both. All of this information could be used to profile you or even to break passwords. I once saw a screen name that identified a single residential address. Another point of caution is to avoid using screen names that you use elsewhere, cross referencing allows other people to use two or more online profiles with the same screen name to "fill in the blanks" or to use profile information from one service to break passwords or identity checks on another service.
• Your profile
• First and Last Name - It isn't mandatory so why put it there?
• Your Timezone - Over a 100 million people live in my timezone so I don't see this as particularly revealing.
• Gender - 50% of the world is Male, once again I see no harm in telling the world I'm Male.
• Singleness - If you want a date, go to a dating website, don't advertise your singleness here. If you have a need to tell the world you are married to avoid those seeking more from their online endeavours then by all means say so ... otherwise I would recommend not the "Rather not say" option.
• Describe Yourself ... - Be sensible, try not to put anything in here that could be used by itself or in conjunction with other information to reveal your identity.
• Online bits
• Your website address - Personal websites can be used for information gathering and social engineering. I would only list a website if you are a professional photographer looking to drum up business for your own personal online portfolio or otherwise.
  
• Website name - Only required if you list a website address (see above).
• AIM (AOL IM), MSN Messenger, Yahoo! IM, ICQ - Listing IM addresses not only reveals which services you use and thus allows cross referencing of information, but can also be used to determine your online status.
• Offline bits
• Your Occupation - No need to be too specific here, I don't think I need to explain why listing yourself as a prison security guard, model, bank clerk, etc. can lead to targetted social engineering attacks and worse.
• Your Hometown, City you live in now, Country, 3 letter airport code - More than a million people live in my town so I dont perceive this to be a real threat. This is not personally identifiable information so is harmless. If someone came up to you on the streets of New York and said "You live in New York" I doubt you would find the level of knowledge particularly disturbing. The same is true here.
• Things you like...
• Interests, Favorite Books & Authors, Favorite Movies, Stars & Directors, Favorite Music & Artists - All of this information can be used to crack passwords, ever been asked to specify a secret question like "Name your favourite movie" or "What is your faourite band?". I thought so. Information like this is invaluable for people who are trying to crack passwords or circumnavigate security systems like online banking or web based email accounts. Due diligence is key here, if you have ever listed Forrest Gump as your favourite movie ... don't put it down here.
  
• Your profile privacy
• Email address - Flickr has an anonymous mail function, this should be set to "Nobody" unless of course you wish to share files with your contacts in which case set it to "Contacts".
• Instant messaging names - if you chose to specify an IM name this should be set to "Friends and family". If you did not set this option then it shouldn't matter what the level is set to.
• Real name - If you chose to specify you real name this should be set to "Any Flickr member" which is the highest level. In my personal opinion this should have the option "Nobody" but that option does not exist.
• Current city - Any option would be suitabel and should pose no security threat, however, if like me you are paranoid then you may wish to set this to "Any Flickr member" which is the most secure option available.
  
• Hide my profile from searches? - I don't really see this as a perceivable threat, hiding your profile from searches does not really add any real benefit if you have followed the rest of my advice.
• Hide my EXIF data? - If you own seriously expensive camera gear you may want to consider enabling this option. The EXIF data contains the make and model of your camera and can also give an idea of what lenses you have.
  

A guide to Facebook's security settings aka Facebook Security for the Unitiated!

Firstly a disclaimer, in my opinion there is no such thing as complete security, there is only ever a solution of best practice in terms of security which can be limited by the online application.

The developers at Facebook have implemented some of the best privacy settings I have seen in a social networking tool. These can be found in the "privacy" menu on the top right of a profile page. Here is my version of proposed default settings:

Profile

• Profile: "Only my friends" (allows only your added friends to view your profile details.) HIGHEST LEVEL AVAILABLE
• Status Updates: "Only my friends" (allows only your added friends to view your status updates.) HIGHEST LEVEL AVAILABLE
• Videos Tagged of You: "Only my friends" (allows only your added friends to view videos of you, can also be set to "only me".)
• Photos Tagged of You: "Only my friends" (allows only your added friends to view photos of you, can also be set to "only me".)
• Online Status: "Only my friends" (allows only your added friends to view your online status, can also be set to "only me" or "no one".)
• Friends: "Only my friends" (allows only your added friends to view your friends list) HIGHEST LEVEL AVAILABLE
• Wall: "Only my friends" (allows only your added friends to view or add to your wall, can also be set to "only me" or "no one")

Contact Information

• IM Screen Name: "Only my friends" (allows only your added friends to view your IM screen name.) HIGHEST LEVEL AVAILABLE
• Mobile Phone: "Only my friends" (allows only your added friends to view your mobile phone details.) HIGHEST LEVEL AVAILABLE
• Land Phone: "Only my friends" (allows only your added friends to view your landline telephone details.) HIGHEST LEVEL AVAILABLE
• Current Address: "Only my friends" (allows only your added friends to view your contact address details.) HIGHEST LEVEL AVAILABLE
• Website: "Only my friends" (allows only your added friends to view your website details.) HIGHEST LEVEL AVAILABLE

Contact emails

• Personal email addresses: "Only my friends" (allows only your added friends to view your personal email addresses, can also be set to "no one") Facebook also obscures this by displaying it as a graphical image rather than plain text so that automated email address harvesters cannot grab it for spam purposes.

• Work or organisational email addresses: "No one" (Does not allow anyone to see your work or organisational email address. Ultimately, work and organisational email addresses are for that purpose only. By allowing others to see that email address they can use it for purposes outside of your control, such as sending pornographic material, viral code, phishing emails, etc. Organisations have been known to take legal action against individuals who publish work email addresses because they allow attackers an insight into email address structure, etc. Additionally, it is in your best interest to use a personal email address that is not affiliated to somewhere you might not even be at a year from now!) HIGHEST LEVEL AVAILABLE

Applications in your Profile

These should be on a case-by-case basis, I have set all my applications to be either "no one" or "only my friends". Why on earth would you want to set your posted items to be viewed by everyone in your country level network for example? Simple answer, there isn't one.

Search

• Who can find me in a search: "Everyone" (Allows all Facebook users to view your public profile, more about your public profile in a minute. This is a good case of security where needed, if you were to lock this setting down to no-one then there would be no point using Facebook! In order for a social network website to work you need to be able to network! However, we can control what the Facebook population can view in a search, more details below.)

• Allow anyone to see my public search listing: YES (This allows public search engines to view your profile)

• Allow my public seach listing to be indexed by external search engines: NO (This means that search data cannot be cached by search engines, if you change your name for example, you won't be found from a previously indexed search.)

What Can People Do With My Search Results:

• See your picture: NO (Why? Isn't a name good enough, let them send you a message first so you can see if you want them to view your picture. People can use photographs for social engineering purposes.) HIGHEST LEVEL AVAILABLE
• Send you a message: YES (No harm in messages)
• Poke you: YES (No harm in "poking" :-D )
• Add you as a friend: YES (People can add you as a friend, of course, this is a reciprocal two step process. Someone can only be your friend if both people add each other as friends and thus confirm the relationship.
  
• View your friend list: NO (Why should an otherwise complete stranger be able to see who you are friends with. Take this example, someone who you do not wish to be affiliated with wants to confirm which one of five profiles is you from a search, by viewing your friends list they may be able to confirm which one is you and use your friend list as information to target a social engineering attack.) HIGHEST LEVEL AVAILABLE

News Feed and Mini-Feed

Changing your profile can trigger news alerts regarding those changes to your friends. Whilst your friends are ... well ... your friends, they might not always be your best friends. Certain events you may not wish to advertise to colleagues, co-workers or friends in general. This is my list:

• Remove Profile Info: NO
• Write a Wall Post: NO
• Comment on a Note: NO
• Comment on a Photo: YES
• Comment on a Video: YES
• Comment on a Posted Item: YES
• Post on a Discussion Board: YES
• Add a Friend: NO
• Remove my Relationship Status: NO
• Leave a Group: NO
• Leave a Network: NO

• Show times in my Mini-Feed: NO (Because these times can show when you are online.)

Poke, Message and Friend Request Settings

When you poke, message or add someone as a friend you allow them to see your profile, whilst this is useful you may wish to limit some of the information you allow others to view. These are my settings:

• Basic Info: NO
• Contact Info: NO
• Personal Info: YES
• Education Info: NO
• Work Info: NO
• Wall: NO
• Photos Tagged of Me: YES
• Videos Tagged of Me: NO
• Online Status: NO
• Status Updates: NO
• Friends: NO
• Posted Items: NO
• Notes: NO
• Groups: NO

Essentially, if someone wants to know who I am they should only need the most basic of personal information and a photo or two. From there people can then add you as a friend to have access to more information. Any supplemental information such as work, telephone, networks, etc. is purely open to abuse from a social engineer.

Applications

A little note about Applications, they are written by third parties. Do you really want the writer of an add-in application to see your religious or political views? Or what sex you're interested in? Probably not. Be sure to uncheck all available options in the "What Other Users Can See via the Facebook Platform" settings option.

Block People

Does exactly what it says, this stops the specified users from acessing your profile or even seeing it in a Facebook search. Userful huh? It even blocks unwanted communications from the user within the Facebook tool.

Limited Profile List

This little option allows you to limit your profile to a level specified by you for certain added friends. Useful if you wish to have two different levels of profile; one profile for friends and one for work colleagues for example.

Love, light and lenses

I love photography, anyone who knows anything about me knows this much. Just recently I have been longing to take more wildlife photographs, crawling around in the undergrowth setting up spy huts to get close to nature isn't my cup of tea frankly. I would much prefer a big telephoto lens that I can just point at my subject at 50 metres away and get an impressive shot.

So time to hunt for a telephoto lens that will fit the bill. I currently have a very tasty Nikon Nikkor 18-200mm Vibration Reduction (VR). It has a 3.5 f-stop maximum aperture which lets in quite a bit of light and allows me to take photos at fairly low level light. But it's just not long range enough. The problem with lenses is that the longer the lens, the wider it has to be to get the same level of light through the lens, which in turn means that more glass is used, which in turn means that it is more expensive.

So why is light so important? Simple, however much you magnify your subject you ALSO amplify the noticeable movement of the lens/camera. The science of exposing a photograph is based on a trade-off between light levels and shutter speed. The lower the light level, the more time it will take to make the exposure, which in turn increases the risk of recording motion blur from shutter bounce, unsteady hands or general vibrations.

So I started looking around, I wanted a good telephoto zoom that also allowed a decent amount of light through without breaking the bank balance. What I found was the Sigma APO 200-500mm F2.8, I'm kind of guessing it's going to break my bank balance. It is HUGE. It weighs in at approximately 16kg and will cost approximately 7000 US dollars. Needless to say, I'm still looking.

IPhone patch already?

I have a Nokia 8800, a nice phone by most standards, not quite the same league as a Vertu but nice nonetheless. One of the great things about my phone is the robust stainless steel casing and the two year premium support that comes with these phones regardless of the network provider. The phone is now two years old, I was an early adopter so the time has come for me to look for a new one. Being an early adopter ... Iphone looked like the way to go.

Two days ago Apple released their first set of patches for the Iphone a month after the initial US launch. All the addressed vulnerabilities seem to be related to Safari, Apple's own internet browser software. Of particular note are the arbitrary code execution and cross site scripting vulnerabilities. Yikes! I'm glad I'm one of those people that refuse to use handheld devices to browse the internet. With vulnerabilities like that I wonder how long it will be before the Iphone becomes the target of viral code ...

Facebook identitiy crisis

One of the first things I do in the morning before my shift starts at work; tea (milk no sugar), shift handover call with my counterparts in the United States and then a swift check-in with my friends and colleagues on Facebook. This morning something was wrong however ...

When loading Facebook I noticed that the email address login prompt was already populated with an email address that wasn't mine. As if someone had used my laptop, not likely, those that know me will know that I am paranoid about security, my Firefox settings are so secure I have problems bookmarking sites. I figured this must be server side populated via a caching proxy server and that a successful login would change this. I logged in.

After logging in I noticed I had messages, yay! I love messages, probably because it means I have friends! Maybe ... although it suddenly dawned on me that the messages I had were not my own, in addition to this, I was no longer viewing my profile but someone else's profile. A glitch? Apparently not, at the time of discovery I was the only one in my office, later this morning it became apparent that all my work colleagues were experiencing the same issue. We were able to view the private details of employees across the globe seemingly cached by our proxy servers. I quickly escalated this to the highest levels and it is being investigated, however it is becoming increasingly apparent that this is the case in other companies also. Word of mouth prevails but so far I seem to be the only one to mention this.

I have had various conference calls this morning with our network security, global network and regional IT security managers and colleagues. I don't think I have seen this much activity since BugBear!

I'm refreshing my profile now, apparently I am now a female in the UK who is engaged to be married, my messages would indicate I'm having second thoughts, my credit card details? Yup, you guessed it, it's ALL there!

I am assuming at this stage that Facebook have made changes to their session based authentication methods ... I should imagine they will be quick to resolve the issue once known, but I would not imagine that the publicity will do them much good with their pending court case in eight days.

CURRENT DAILY VEND STATUS: PARANOID