Flood Hack: Developers Build Flood-Relief Apps

The recent flooding in England has brought in developers together in an effort to provide relief with ingenious apps and systems created over night.

The initiative kicked off on Friday, the 14^th of Feb, in a No. 10 meeting where the government called on the tech community to make use of the flood data from the Environmental Agency. This was a monumental change from the usual mindset of holding on to data records, due to lack of clear directives of what to do with it.

Once the main issues have been resolved with accessing the records, the statistics updated every 15 minutes, providing live data to the 100 developers. Microsoft, Google, Facebook engineers, as well as independent programmers answered the call to action.

The event proved that data can be used in efficient and creative ways to help in crisis situations. The result was setting up a hackaton where developers could bring in ideas evaluated by a panel of judges. Hacks have been documented here. An outstanding entry was finding a way to instantly report on damaged flood defences, as the Environmental Agency reported that the function was flawed by hoax reports.

The digital efforts have been great, but its success depends largely on volunteers' help and on efficient promotion; as one of the participants said: “if we don’t find a way to make this memorable and public-facing this will all get lost in the computer”.

It’s a refreshing change for the public to physically benefit from data harvesting, but ultimately it’s a wonderful way to prove that the tech community can work together with the general public and bring in ideas which can be translated in real, immediate solutions.

Sochi 2014: Cyber Threats, Security Issues and Misperceptions

The media is having a field day out of Sochi2014. However on a closer inspection, there seems to be a lot of confusion in the press over the concept of cyber security at the Winter Olympics. Let’s have a look at the main stories present in the headlines (and conveyed in a muddled perspective):

1. Russia’s cyber spooks

Source: Sydney Morning Herald

With a monitoring system described as “PRISM on steroids”, Russia has made significant changes in anticipation of the Winter Olympic Games. Investigative journalists Andrei Soldatov and Irina Borogan have uncovered that deep packet inspection software was being upgraded for new devices and that compatibility with SORM (System for Operative Investigative Activities) was re-enforced across all Russian networks.

This story has been carried across countries, networks and channels and, like any good conspiracy theory, has gathered momentum in its own right. The result was a state of general tension, especially for the journalists who went to report on the games. This picture from the Sydney Morning Herald is a good example of media fuelling the frenzy: 


Accompanied by the worrying tweets of Yahoo journalist, Charles Robinson:

Source: Sydney Morning Herald

Understandable conclusions with regards to censorship and privacy were speculated, but the reality was that this was a check-up exercise to ensure journalists were not setting up their own Wi-Fi networks which would interfere with the official ones.

2. The NBC misleading story “Hacked Within Minutes”

Richard Engel (NBC News) and Kyle Wilhoit (Trend Micro) took on an experiment to see just how dangerous the cyberspace was surrounding the Winter Olympics. Sadly the point of the experiment got lost in the NBC reportage, but important details can be found in this article posted by Kyle Wilhoit. This blog post from Robert Graham makes it very clear that the experiment has little to do with the NBC claim that coming to Sochi and turning your computer on is enough for your private data to be extracted right before your eyes. You’d have to put in a bit of effort to get hacked so efficiently.

While the NBC report implies that the attack was an extraordinary automatic compromise, the “hacking” occurred a) under very low security measures; b) by being initiated by Engel himself, with user-interaction. The noteworthy point here is the hostility of Olympic themed websites, which is expected to receive heavy media coverage and public interest.


The advice for anyone (in Sochi or elsewhere) who wants to keep up to date with the Olympics is to follow the same cyber security guidelines as you would in normal day-to-day activities: don't open attachments from unknown email senders, use updates, use an anti-virus and keep it updated, don't disable security on your phone when prompted to do so by a suspect app.  

3. Hacktivist group threats 

Threats from a hacktivist group have been made towards investors and sponsors, claiming that the games are taking place on the graves of a million Caucasians who were murdered in 1864. But as the surveillance is such a strong point, presumably SORM will keep a close eye on this affair and settle the issues as they come up.


The confusing issue with the points above is that they have all been bundled under one big Russia-spy-cyber-hacks story which is simply too unclear to follow anymore. For the average reader, the entire Sochi affair has been portrayed as the greatest nest of online dangers, teamed with hidden state surveillance (and hints at censorship) and a breeding ground for hacktivism at its worst. This FT article sums it all up pretty well, and true to the form, is entirely confusing!

Target. A Series of Unfortunate Events

Source: yahoo.news.com

It started right before the holidays, with Brian Krebs’ first report on a 40 mil. financial data breach at Target stores.  News followed that a further 70 mil. accounts containing personal identifiable information was also compromised during the heist.

From then on the focus was on how  the breach happened, what software was deployed, where did Target go wrong and who should take the best part of the blame. Meanwhile, Target provided customers with a sign up for free credit monitoring and identity theft protection system and announced it will invest $5mil in a brand new cyber security coalition. 

But that’s not the end of the problems for the retailer.

Alongside Target, the retail industry is experiencing a surge in cyber attacks and POS malware. The FBI re-assures us that they are aware of these attacks and they are not likely to stop. Compliance is widely criticised as Target was in fact compliant with the PCI DSS standards and it did nothing to stop these spectacular attacks. 

However the infosec community is looking at the entire story with a shaking head and a look of “I told you so”, because researchers have long stated that compliance does not mean security. Previous incidents at Wall-Mart and Heartland Payment Systems had left an even more embarrassing mark on compliance, as they were certified compliant while their networks were in the process of being hacked.

The implications of these recent hacks are wide and diverse. Banks will tighten their liability policies, payment providers will continue to issue fines for poor cyber security measures, while retailers deal with bad publicity and falling share prices. 
This in turn affects economies and market statutes while the customer is left in the middle with the choice of a week’s worth of hassle for cancelling a compromised card and/or the expense of a lawsuit against the retailer.

It seems that all these industries should take a break from trying to only protect themselves and come together for a long-term cooperation strategy centered around the key player: the consumer.  As it stands every industry is furiously trying to escape the responsibility and pass an already irritated and distrustful victim from one institution to another. 

This may work for the time being, but will only lead to a deeper lack of trust in a flawed system.  There is more to be done to educate, prevent and restore trust, and this will take a cooperative and supportive effort from all the industries if they continue to expect customers to hand over their data.