Slashdot Mirror
"Clear" Laptop Found, In the Same Locked Office
jafo alerts us to an SFGate story reporting that the lost "Clear" Program laptop has turned up in the same office from which it was reported missing, but not in its previous location. "A preliminary investigation shows that the information was not compromised... The computer held names, addresses and birthdates for people applying to the program, as well as driver's license, passport and green card information. But, she said, the computer contained no Social Security numbers, credit card numbers, fingerprints, facial images or other biometric information... The information was encrypted on the server, but not on the laptop, although it should have been... However, it was protected by two levels of passwords." Reader jafo adds, "Pardon me if I have little confidence that an organization that loses a sensitive laptop for 9 days is able to tell if it was compromised."
... I borrowed it for the weekend to play WoW.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Those are, like, needed to remove the hard drive, right?
Even though this laptop was not actually stolen, that does not excuse the gross lapse of judgement by the people responsible. Two levels of passwords is fine, but unencrypted data still leaves potential victims vulnerable. This still raises the question of why sensitive data was on something as portable as a laptop. Oh and nevermind the fact that they managed to lose it in their own office completely kills any confidence I had in them.
and none of it came back today.
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
The truth is, they have no idea if it was compromised or not. All you'd need is an Ubuntu boot CD and you could read the data straight off the drive.
Next time they should use THREE levels of passwords. ;)
So... what does that actually mean? I know that TFA is a media fluffed version washed for the general masses, but they could've mentioned that part at least. If one was the NT login, were the admins smart enough to disable the LM Hash? Still, booting it with a *NIX CD and blanking the SAM password for administrator is trivial. What could the second be? A BIOS password? Open it and pull the battery. Big deal.
Is there something I'm missing about this? Are there a (whopping!) two password scheme that could actually make something more secure then just booting it with something else and pulling data off?
I'm not a prophet or a stone-age man,
I'm just a mortal with potential of a super man.
Yeah, we...uhm...found the laptop again...really did...yeah...because claiming so leaves us protected from any coming lawsuits that might or might not be caused by any identity theft cases that could be related to (but, of course, actually are nothing at all caused by) this incident...which certainly did never happen...
And of course noone tampered with the machine...after all if WE couldn't find it, who else could have?
Friends again?
That is why I prefer opaque laptops.
Better known as 318230.
Lost for nine days? Found in the same office in which it was reported lost? How hard did they look for it? Talk about failing to build confidence...
The laptop had either been stolen, and sold with the information wiped, stolen and the information sold, lost, destroyed, or left in an office.
Whichever it was, the only information they had was that it was unaccounted for. It was actually a good response to automatically assume the worst case scenario and deal with the situation as if that had happened. If the worst case scenario was the case then at least it was dealt with as best it could be. If not then the only harm done is to them and not their customers.
So while losing it was very inept, their response afterwards was actually fairly responsible of them.
This whole 'Clear' thing is bullshit. Its a bad solution to a problem that should not exist in the first place.
If you buy the story that all the airport security that results in thousands standing around waiting to get to their gates is both necessary and effective then you must question any program that claims to pre-screen anyone because that just opens a window of opportunity between the pre-screen and the actual boarding of the flight in which the pre-screened person can be compromised in any number of ways.
It all comes back to the problem that there is no such thing as "the evil bit" - and any system which tries to make up for that by using some other combination of 'bits' as a proxy for the non-existent 'evil bit' is just a house of cards built on a non-existent foundation.
Even if you take Bruce Schneier's view that Clear is a good thing - not for the pre-screen, but because of the open-market approach to airport security which lets people pay more in exchange for a guaranteed short processing time - its still bullshit. That's because the rich and the powerful - the idiots who make the laws that created the TSA and their time/money wasting policies will be able to avoid having to suffer the consequences of their own actions. They can just pay a few hundred dollars more and never suffer the crap that they dumped on all the plebes.
Congress already exempts itself from too many of the laws its passes (no social security, they have their own program, no anti-discrimination in hiring laws on the hill, etc) they should not be able to get another free pass on suffering the effects of creating the TSA.
When information is power, privacy is freedom.
"[data was not encrypted] However, it was protected by two levels of passwords."
Baby, I'm sorry I cheated on you. But I was thinking of you while we did it.
When they finally found the laptop did they stop cleaning the office or did they finish up?
So, what we have here is starting to sound like: employee 'borrows' office computer for home use, manager raises alarm, news media panics, employee waits until dust settles a little to slip 'borrowed' property back into office.
Either that, or the identity thieves who who masterminded the scheme to steal that data were really slow.
"We reject as false the choice between our safety and our ideals." --The American President (20.1.2009)
After the big media blitz, I imagine the laptop was found "somewhere," and it was a lot easier to explain if "somewhere" became the same locked office it was supposed to be in. I seem to recall some removable hard drives in the Los Alamos fiasco that also eventually "were discovered" in secure areas like behind a copy machine or something.
/cynical
realistic (what's the difference, anyway?)
Laptops and removable hard drives are inherently portable - if you really care about preserving the confidentiality of anything, it should be treated in an "eyes only" manner while on the portable media - when you're done, either encrypt or wipe. If the portable device leaves your sight for 15 minutes, you can assume that it has been copied. If it's not encrypted, it doesn't matter how many passwords are required, it can be copied in a very short time with a screwdriver and a mini-notebook, or any other contraption with a compatible drive controller.
/realistic
Dear Slashdot,
I've borrowed a laptop from my office to download a little . . . well, nevermind. But, the thing is that my manager went apeshit and the laptop turns out to have a lot of valuable data sitting on it. What should I do?
The FBI is searching the homes of all the employees, so I can't keep it. If I give it to a friend, some one will eventually tell and I'll get busted.
If I dump it or destroy it, they'll assume espionage and the investigation will go on for months and I'm sure to slip up eventually.
If I return it to quiet things down, I might provide them with forensic evidence they can link to me, not to mention maybe getting caught doing it.
Please help. If I lose my security clearance, I'll never get another job.
"We reject as false the choice between our safety and our ideals." --The American President (20.1.2009)
Breaking into the Pentagon computer..
Double click on 'Yes.'
Oh. Password protected. Twenty billion possible chances..
Er..
Jeff.
Hey!
End of line..
It was never actually missing. They just couldn't find it in their own office.
I am Bennett Haselton! I am Bennett Haselton!
A lot of people don't know that. It's been helpful to know though. I've retrieved (or told someone to retrieve) things in "locked" rooms that weren't suppose to be locked.
Except for once... The CEO had this thing for keeping the tape backups in his safe, in his locked office. He was out of town, the door was locked, and we needed one of the tapes. With the COO's permission, one guy climbed over and opened the door from the inside for us. The safe was a lot easier, he left the door open.
Then again, I've been having more fun learning how to pick locks. It's a lot more impressive to sit at the door handle for 30 seconds, and pop the door open, without having to get dirty or climb on anything. :)
Serious? Seriousness is well above my pay grade.
the first password is 12345
Amazing, that's the same password that I use on my luggage!
No, no, no. Just a little radiation leak. Give us a minute to lock it down.
... uh ... oh look! We found it! It was here all along! We're fine here ... now. How are you?
Uh, negative, negative, don't come in here
You may be making things too complex. I still have various keys to campus buildings a decade since I've needed them. They never asked for them back when I quit working there.
My bet is though is that someone took the laptop home to play with and once things hit the media they brought it back.
I find being offended by me offensive.
WHY THE HELL IS THIS STUFF ON LAPTOPS TO START WITH!
I'm sorry, but there are some information that belongs on servers managed by people that at least understand (hopefully) security and encryption. And then the only access to it from secured thin client terminals inside the office.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
they no longer have to tell you they are searching, and can do it quietly/legally while you are away.
maybe the feds came in took it, got a good clean copy, and returned it?
I remember getting a security audit. These people came in to 'hack' (just get root access) to the systems. Once they had that they stopped. They really just ran password guessing programs on the machines. I had a DB server that was not part of the domain only used DB accounts no domain accounts were used. So the domain accounts and passwords didn't work. At the end of the week they never got into that machine. The rest of the windows, sun, VAX, I forget about the mainframe were cracked. My boss was wondering why that one windows box was not cracked, and so did the company. I never told the company I just said they failed to get into my DB machine. They left and my boss and a few VPs wanted to know how I did it.
The password was: ThisIsThePasswordForMachineDelta
They never went past 15 characters in their password program. I was surprised that it wasn't guessed since it was all letters but it worked. And a new 30+ password systems was set in place. I did get a few threatening emails after the new password policy was put in place though. This was also 1997 too, so it most likely would not work today.
As I was waiting my turn in line at the SFO security gates and about to put my things on the conveyor belt, all of a sudden a "Clear" employee brings a customer of theirs to cut right in front of me with a curt "excuse me". What is that? Just because they pay money they get to cut in front of me? Isn't the airport a public facility?
Can I open up shop in a grocery store and sell tickets whereby I cut in front of everybody else to get my clients through?
I wanted to raise a fuss but being that it was the airport I kept my mouth shut otherwise they'd probably arrest and detain me for terrorism or something. But seriously, what is the deal?
Makes me very angry.