Usability: Fail

In the tradition of the Fail blog I am going to list some technology Fails that I have come across. They bother me because people should think this out a bit better before it goes in the store.

Blackberry Fail: If the advertiser gives their 1 800 number as a vanity number like 1 800 BUY STUF, how do you call that on a Blackberry? FAIL

HP Fail: With my HP All in one printer if I am low on a colored ink the driver will ask me to OK printing in all black. But then the printer needs me to press the OK button on the printer upstairs to answer the same question... For each document. To print 4 documents I have to run up and down the stairs 8 times. EPIC FAIL

If you have others send them to me!

Hmmm?

Today wired had this article http://www.wired.com/magazine/2009/10/st_essay_terroralert on the terror alert system. It's title - Why Color-Coded Terror Alerts Have Made Us Less Safe. And the only thing I could think of was... We are all color blind?

Challenges of PCI

An excellent article on Walmart's security woes and what steps they are taking. If you are familiar with PCI you will recognize it's effect on what Walmart is doing.

http://www.wired.com/threatlevel/2009/10/walmart-hack/

"Investigators found that the tool had been installed remotely by someone using a generic network administrator account. The intruder had reached the machine through a VPN account assigned to a former Wal-Mart worker in Canada, which administrators had failed to close after the worker left the company. The day the server crashed, the intruder had been connected to Wal-Mart’s network for about seven hours, originating from an IP address in Minsk, the documents show.

The security team disabled the compromised VPN account, but the intruder, who should have realized the jig was up, came back in through another account belonging to a different Canadian employee. When that VPN account was closed, the intruder grabbed yet a third account while Wal-Mart workers were still scrambling to get a fix on the scope of the breach.

When Wal-Mart reviewed its VPN logs, it found that the activity had begun at least as early as June 2005, according to memos written by Wal-Mart employees during the initial stage of the investigation. The company’s server logs recorded only unsuccessful log-in attempts, not successful ones, frustrating a detailed analysis.

Wal-Mart declined to respond to questions about the initial date of the attack, the server logging or the conclusions it reached in its final report, which Wired.com has not seen.

Nonetheless, Wal-Mart’s security team was able to identify “over 800 machines that the attacker either tried to brute force or actually made a successful connection,” according to a Nov. 10, 2006 e-mail summarizing the early investigation."

Let's do a bit of analysis here. Mistakes were made and the innocent will be punished:

1. Walmart failed to close old employee accounts. They should at least have the password age off.
2. Walmart does not restrict traffic to specifc IP spaces. If they don't do business in Minsk they should not accept traffic from there. This is a hard assumption to make for a giant like Walmart but if you have a smaller company and you don't do business in Russia, Bulgaria, or China then setup your routers not to accept traffic from there.
3. Why would you just log the unsuccessful attempts? These can indicate that you are being targeted but the paranoia should be on the SUCCESSFUL logons.
4. No two factor auth for your VPN?

Obviously since I am outside the situation I don't get the big picture. But what I have listed are low hanging fruit on the tree.

Your passwords are showing...

Here is a instance of password stealing that I talked about in my Nov 2008 column Password Managment. Crooks are scamming your bank account password because you used it to secure your email... Surely you didn't do that. Read all about it below.

http://www.foxnews.com/story/0,2933,561240,00.html?test=latestnews