<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:admin="http://webns.net/mvcb/"
	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
	<channel>
		<title>Steven Bellovin &#45; CircleID</title>
		<link>http://www.circleid.com/</link>
		<description>Postings from Steven Bellovin on CircleID</description>
		<dc:language>en</dc:language>
		<dc:rights>Copyright 2012, unless where otherwise noted.</dc:rights>
		<dc:date>2012-02-06T10:59:00-08:00</dc:date>
		

		
		<item>
			<title> The FBI and Scotland Yard vs. Anonymous: Security Lessons (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120206_fbi_and_scotland_yard_vs_anonymous_security_lessons</guid>
			<link>http://www.circleid.com/posts/20120206_fbi_and_scotland_yard_vs_anonymous_security_lessons</link>
			<description><![CDATA[A lot of people are fascinated by the news story that Anonymous managed to listen to a conference call between the FBI and Scotland Yard. Some of the interest is due to marvel that two such sophisticated organizations could be had, some is due to schadenfreude, and some is probably despair: if the bad guys can get at these folks, is anyone safe? <a href="http://www.circleid.com/posts/20120206_fbi_and_scotland_yard_vs_anonymous_security_lessons">More...</a>]]></description>
			<dc:date>2012-02-06T10:59:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Types of Attack (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/types_of_attack</guid>
			<link>http://www.circleid.com/posts/types_of_attack</link>
			<description><![CDATA[A lot of pixels have been spilled in the last few years about "advanced persistent threats" (APT); if nothing else, any high-end company that has been penetrated wants to blame the attack on an APT. But what is an APT, other than (as best I can tell) an apparent codename for China? Do they exist? After thinking about it for a while, I came up with the following representation... <a href="http://www.circleid.com/posts/types_of_attack">More...</a>]]></description>
			<dc:date>2012-01-10T21:40:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Water Supply System Apparently Hacked, with Physical Damage (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20111118_water_supply_system_apparently_hacked_with_physical_damage</guid>
			<link>http://www.circleid.com/posts/20111118_water_supply_system_apparently_hacked_with_physical_damage</link>
			<description><![CDATA[According to press reports, a water utility's SCADA network was hacked. The attacker turned a pump on and off too much, resulting in physical damage to the pump. ... For years, security specialists have been warning that something like this could happen. Although more and more people have started to believe it, we still hear all of the usual reassuring noises -- the hackers don't know enough, we have defenses, there are other safeguards, etc. That debate is now over... <a href="http://www.circleid.com/posts/20111118_water_supply_system_apparently_hacked_with_physical_damage">More...</a>]]></description>
			<dc:date>2011-11-18T16:28:00-08:00</dc:date>
		</item>
		
		<item>
			<title> The Sins of the Flash (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/201110221_the_sins_of_the_flash</guid>
			<link>http://www.circleid.com/posts/201110221_the_sins_of_the_flash</link>
			<description><![CDATA[Recent news stories (based on research by Stanford student Feross Aboukhadijeh) state that an Adobe bug made it possible for remote sites to turn on a viewer's camera and microphone. That sounds bad enough, but that's not the really disturbing part. <a href="http://www.circleid.com/posts/201110221_the_sins_of_the_flash">More...</a>]]></description>
			<dc:date>2011-10-21T12:16:00-08:00</dc:date>
		</item>
		
		<item>
			<title> How to Abolish the DNS Hierarchy... But It's a Bad Idea (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/how_to_abolish_the_dns_hierarchy_but_its_a_bad_idea</guid>
			<link>http://www.circleid.com/posts/how_to_abolish_the_dns_hierarchy_but_its_a_bad_idea</link>
			<description><![CDATA[There's been a fair amount of controversy of late about ICANN's decision to dramatically increase the number of top-level domains. With a bit of effort, though and with little disruption to the infrastructure -- we could abolish the issue entirely. Any string whatsoever could be used, and it would all Just Work. That is, it would Just Work in a narrow technical sense; it would hurt innovation and it would likely have serious economic failure modes. <a href="http://www.circleid.com/posts/how_to_abolish_the_dns_hierarchy_but_its_a_bad_idea">More...</a>]]></description>
			<dc:date>2011-07-12T14:31:00-08:00</dc:date>
		</item>
		
		<item>
			<title> RSA Breach Fallout? (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20110528_rsa_breach_fallout</guid>
			<link>http://www.circleid.com/posts/20110528_rsa_breach_fallout</link>
			<description><![CDATA[Back in March, it was widely reported that RSA had suffered a serious security breach that (to some extent) weakened the security of its SecurID token. However, the NY Times reported then that the chairman said that the penetration wasn't absolute but "it could potentially reduce the effectiveness of the system in the face of a 'broader attack.'". <a href="http://www.circleid.com/posts/20110528_rsa_breach_fallout">More...</a>]]></description>
			<dc:date>2011-05-28T02:23:00-08:00</dc:date>
		</item>
		
		<item>
			<title> A Closer Look at Apple and Location-Tracking (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20110421_closer_look_at_apple_and_location_tracking</guid>
			<link>http://www.circleid.com/posts/20110421_closer_look_at_apple_and_location_tracking</link>
			<description><![CDATA[There's been a lot of media attention to a report that iPhones track your movements. It's even reached the U.S. Senate. I'm underwhelmed. I think that the threat is overhyped. What is happening is that these devices create a hidden file with your location... <a href="http://www.circleid.com/posts/20110421_closer_look_at_apple_and_location_tracking">More...</a>]]></description>
			<dc:date>2011-04-21T07:42:00-08:00</dc:date>
		</item>
		
		<item>
			<title> The Worm and the Wiretap (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20101017_the_worm_and_the_wiretap</guid>
			<link>http://www.circleid.com/posts/20101017_the_worm_and_the_wiretap</link>
			<description><![CDATA[According to recent news reports, the administration wants new laws to require that all communications systems contain "back doors" in their cryptosystems, ways for law enforcement and intelligence agencies to be able to read messages even though they're encrypted. By chance, there have also been articles on the Stuxnet computer worm, a very sophisticated piece of malware that many people are attributing to an arm of some government. The latter story shows why cryptographic back doors, known generically as "key escrow", are a bad idea. <a href="http://www.circleid.com/posts/20101017_the_worm_and_the_wiretap">More...</a>]]></description>
			<dc:date>2010-10-17T16:11:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Clarke and Knake's "Cyberwar" (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/clarke_and_knakes_cyberwar</guid>
			<link>http://www.circleid.com/posts/clarke_and_knakes_cyberwar</link>
			<description><![CDATA[I just finished reading Richard Clarke and Robert Knake's book <em>Cyberwar</em>. Though the book has flaws, some of them serious, the authors make some important points. They deserve to be taken seriously. I should note that I disagree with some of my friends about whether or not "cyberwar" is a real concept. Earlier, I speculated that perhaps it might be a useful way to conduct disinformation operations, but it need not be so limited. <a href="http://www.circleid.com/posts/clarke_and_knakes_cyberwar">More...</a>]]></description>
			<dc:date>2010-07-14T08:35:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Comments on the National Strategy for Trusted Identities in Cyberspace (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/comments_on_the_national_strategy_for_trusted_identities_in_cyberspace</guid>
			<link>http://www.circleid.com/posts/comments_on_the_national_strategy_for_trusted_identities_in_cyberspace</link>
			<description><![CDATA[The White House has recently released a draft of the National Strategy for Trusted Identities in Cyberspace. Some of its ideas are good and some are bad. However, I fear it will be a large effort that will do little, and will pose a threat to our privacy. As I've written elsewhere, I may be willing to sacrifice some privacy to help the government protect the nation; I'm not willing to do so to help private companies track me when it's quite useless as a defense. <a href="http://www.circleid.com/posts/comments_on_the_national_strategy_for_trusted_identities_in_cyberspace">More...</a>]]></description>
			<dc:date>2010-07-12T08:28:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Google, China, and Lawful Intercept (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20100114_google_china_and_lawful_intercept</guid>
			<link>http://www.circleid.com/posts/20100114_google_china_and_lawful_intercept</link>
			<description><![CDATA[Like many people, I was taken by surprised by Google's announcement about its threatened withdrawal from China in the wake of continued censorship and attacks that appeared to emanate from there. My immediate reaction was quite simple: "Wow". There's been a lot of speculation about just why they pulled out. Some reports noted that Google has been losing market share to Baidu... I don't think, though, that that's the whole story. <a href="http://www.circleid.com/posts/20100114_google_china_and_lawful_intercept">More...</a>]]></description>
			<dc:date>2010-01-14T13:15:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Why I Won't Buy an E-book Reader - and When I Might (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/why_i_wont_buy_an_e_book_reader_and_when_i_might</guid>
			<link>http://www.circleid.com/posts/why_i_wont_buy_an_e_book_reader_and_when_i_might</link>
			<description><![CDATA[There have been many news stories lately about ebook readers. The New York Times said that they were prominently featured at the Consumer Electronics Show. Amazon is pushing its Kindle; Barnes and Noble has its Nook. There are many other aspirants, either on the market now or waiting in the wings. For now, though, I'm sitting on the sidelines. <a href="http://www.circleid.com/posts/why_i_wont_buy_an_e_book_reader_and_when_i_might">More...</a>]]></description>
			<dc:date>2010-01-14T08:20:00-08:00</dc:date>
		</item>
		
		<item>
			<title> The Real Face of Cyberwar? (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20091211_the_real_face_of_cyberwar</guid>
			<link>http://www.circleid.com/posts/20091211_the_real_face_of_cyberwar</link>
			<description><![CDATA[Anyone who reads the papers sees stories -- or hype -- about cyberwarfare. Can it happen? Has it already happened, in Estonia or Georgia? There has even been a Rand Corporation study on cyberwarfare and cyberdeterrence. I wonder, though, if real cyberwarfare might be more subtle -- perhaps a "cyber cold war"? <a href="http://www.circleid.com/posts/20091211_the_real_face_of_cyberwar">More...</a>]]></description>
			<dc:date>2009-12-11T17:05:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Congress and Peer-to-Peer Filesharing (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/congress_and_peer_to_peer_filesharing</guid>
			<link>http://www.circleid.com/posts/congress_and_peer_to_peer_filesharing</link>
			<description><![CDATA[Some members of Congress have gotten extremely upset about peer-to-peer filesharing. Even the New York Times has editorialized about the issue. The problem of files leaking out is a real one, but the bills are misguided. Fundamentally, the real issue is that files are being shared without the user <em>intending</em> that result... <a href="http://www.circleid.com/posts/congress_and_peer_to_peer_filesharing">More...</a>]]></description>
			<dc:date>2009-11-20T06:37:00-08:00</dc:date>
		</item>
		
		<item>
			<title> The Role of a Cybersecurity Czar (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20091104_the_role_of_a_cybersecurity_czar</guid>
			<link>http://www.circleid.com/posts/20091104_the_role_of_a_cybersecurity_czar</link>
			<description><![CDATA[For years now, there have been calls for a high-level cybersecurity official, preferably reporting directly to the president. This has never happened. Indeed, there is a lot of unhappiness in some circles that President Obama has not appointed anyone as "czar" (or czarina), despite the early fanfare about the 60-day cybersecurity review. There are many reasons why nothing has happened... <a href="http://www.circleid.com/posts/20091104_the_role_of_a_cybersecurity_czar">More...</a>]]></description>
			<dc:date>2009-11-04T08:25:00-08:00</dc:date>
		</item>
		
	</channel>
</rss>
