Steve Keller Associates Breaking News Blog

Palin Email Hacked

Thu, 18 Sep 2008 22:00:56 -0400

As you know, Governor Palin’s email account was hacked. This crime will be solved soon. The hacker used a known proxy server to commit his hack and probably would have gotten away with it except that he included a screen shot of the email that included the URL address giving away the proxy server he used. The proxy server in question keeps a log of all IP addresses and what site they visited using the proxy server to keep users from committing serious crimes on his server. The FBI needs only to subpoena the logs and trace the computer from there.

Lessons for you: 1. Don’t commit a crime using a proxy server, 2. If someone commits a crime against you using a proxy server, there may actually be discoverable evidence so bring in experts, 3. Don’t rely solely on law enforcement. Your experts are better than any investigator or special agent. This rule applies to art thefts, too, and 4. No email is secure. Be careful what you put in writing in email.

Lesson for Governor Palin: If you are elected VP, please don’t conduct government business on a private Yahoo account. Good grief!

ASIS Report Day 4

Thu, 18 Sep 2008 08:56:57 -0400

Well, you’ve seen what we liked from ASIS this year let’s discuss other things of interest. Andover Controls has been sold to Schneider Electric, a new company on the security scene. Schneider has been around for years and is a major player in the U.S. and abroad in the electrical arena but now they have moved into security. My prediction: Watch for the Andover Controls system to be totally overhauled in 2010 and replaced. Those with current Andover Controls security systems could be forced to upgrade both hardware and software. Integral, the CCTV line of Andover Controls has been sold off to GE and Pelco is now the Andover CCTV product. Schneider also owns Pelco. General Electric, as you know, bought both Casi-Rusco and Infographics and are ending the identity of both systems and wrapping them into a new GE product.

Watch for the pricing model of Software House to become more like that of Lenel where you pay more licensing fees for the software. We don’t like this but this is where the world is heading. With Lenel, for example, you pay a license fee for every four IP addresses such as IP network cameras, This can really add up.

So what don’t we like? Several vendors offered internet hosting of your access system. What a terrible idea. While you don’t need to buy a server and software and pay the costs of maintaining it or updating the software, you pay an amount up front to set up an account and the hosting company lets you share a server in “where ever” to handle alarms and card access over the internet via a browser. You pay to have your readers installed by their installer and you pay a monthly fee per reader. You save absolutely nothing and you put your access system into the hands of strangers and administer it over the internet using that highly secure (I joke) program Internet Explorer. This might be a great service for a small low security facility but not cultural properties.

If you have never attended an ASIS annual seminars and exhibits you should. I will be in anaheim next year so budget for it now. Even if you don’t enroll in the seminars and only spend time on the exhibits floor you’ll learn a great deal if you ask questions. This is how the old pros learn. We ask to speak to the engineers and pick their brains. This is how we learn about vulnerabilities and problems with each product.

ASIS Report Day 3

Thu, 18 Sep 2008 00:48:50 -0400

Today we saw two cool products. The first is a flame detector. It detects flames. How is it used? Do you have a restroom where people smoke when they should not? Place two of these in a restroom and as soon as they strike the match they will alarm. The can be local (standalone) or hardwired to your alarm system. Available from Takex. Ask for the FS-3000E Flame Sensor.

We also found an outstanding new product by eData. It’s an access control system that uses a reader that is a combination fingerprint reader, prox card reader and keypad. The reader control panel is about two inches by two inches and has a built in server with embedded software. No real server is required. You can monitor or administer it over the internet using a browser from anywhere. This is a robust highly expandable and reasonably priced system that is technologically advanced. The company also makes a miniature magnetic lock. Mate the lock with the reader and you have a perfect exhibit case security system.

Finally, we liked the General Electric Alliance alarm and access system. This is a system remarkably like the Radionics 9412 system but with sixteen partitions and other great features. Check it out.

ASIS Report Day 2

Wed, 17 Sep 2008 00:35:42 -0400

What did we see today that impressed us? We met with the President of CCTV company Unlimited Visions. The IP addressable network cameras on the market today are coyote ugly. Obviously designed by engineers, they don’t pass muster with most architects we work with. Unlimited Visions makes a very small analog camera that looks great. We were shown a small rectangular IP camera (530 lines of resolution with an interchangeable lens). It’s nice but we want a tubular shaped camera like the analog cameras. No one has one. Our meeting occurred in the morning. By mid-afternoon she (the President we met with) had met with her team and showed us a tubular camera body that they feel can be used and they agreed to redesign the camera’s electronics so it will fit into a body we approve of. We met with two top engineers and discussed camera features we’d like. How many people get to influence the development of a new product?

We met with the President of Acuity-vct, another CCTV company that has outstanding products and invited the President of Unlimited Visions along. The objective was to get them working together to produce a museum specific camera we can use to protect art. We asked if a quality IP camera could be made that is no thicker than one inch, rectangular in shape, about the size of a light switch plate, with the network cable and input jacks on the side opposite the lens. This would mean that this camera could be mounted flat on the ceiling looking down at a row of pictures on the wall. The low profile would make it nearly invisible.

We are convinced that if we had such a camera we could use the video analytics of the outstanding Acuity-vct CCTV system in far more museums. Acuity has an excellent feature that allows you to use the CCTV system for art protection far better than any similar system. The problem has been that traditional IP cameras are unattractive.

The camera manufacturer is Unlimited Visions. They make small high quality cameras for other camera companies. With the other company’s label, they cost about $600 each. Without the label our clients can buy them for under $200 each. I took one apart today and it had a Sony label inside. Why pay for the name brand when you know you can buy the exact product at deep discount? More later.

ASIS Report Day 1

Wed, 17 Sep 2008 00:09:07 -0400

I’m writing from the 2008 ASIS Conference in Atlanta. This is the largest security trade show in the world and I’ve been spending my time studying technology and other products on display on the exhibit floor. This is where the new security products are introduced. So, what’s new and impressive?

The most impressive items will be discussed in more detail but this is a quick overview. You may not be aware of this limitation, but the longest cable run that i allowed for a network cable is 330’. Network cable, called unshielded twisted pair cable, can only be run 330’ before the signal degrades. Now, a small inexpensive device has been invented to extend this distance indefinitely by adding the device every 330’. Why is this relevant to us? Because all new CCTV cameras will likely be run on network cable and some camera distances are more than 330 feet from the control room. Even new analog cameras should not be run on coaxial cable in most instances so that the wires are ready for IP cameras when you are ready to use them.

Another gizmo we liked is a device that allows you to run up to four IP addressable network cameras on a single piece of existing coaxial cable. The advantages of this device should be obvious. Most museums have coaxial cable in their CCTV system and IP network cameras won’t run on coax. And, if you have one cable and one camera, it is “maxed-out” and you can’t add another camera without running a new wire. This new device actually lets you run four IP addressable network cameras to that single coax by making it think it’s a network cable. This will extend the life of your existing coaxial cable system for many more years.

We will discuss these in more detail when we have more time and information about where to buy them. We plan to have a technical meeting with the manufacturer’s engineers tomorrow. Call if you have questions.

How To Open A Combination Lock

Tue, 9 Sep 2008 02:32:08 -0400

Check this out.

A Personal Note

Mon, 8 Sep 2008 19:25:37 -0400

I can’t help but share this news with my readers. Museums are not the only guardians of art and antiquities. Private collectors also preserve and protect. I am a collector of historic and rare newspapers. Among my prize items are newspapers reporting on the great San Francisco earthquake, the crash of the Hindenburg, the bombing of Pearl Harbor, the bombing of Hiroshima, the D-Day invasion, the assassination of President Lincoln, the major battles of the Civil War, and, of course, all of the papers everyone else has such as the Kennedy assassination, man walking on the moon, and the bombing of the World Trade Center.

I’ve always “targeted” a paper and searched for it on the open market. Finding a paper for sale, I’ve then bid in auctions or negotiated with dealers. I’ve been disappointed many times. I can’t count the times I dropped out of the bidding when the bids far exceeded my budget. From the day I began collecting, the “holy grail” for me was the newspaper you see above. “Dewey Defeats Truman” is widely considered to be the most recognizable headline in U.S. history.

No one knows how many of these papers remain but it is believed to be in the hundreds. The paper was typeset by management during a strike as election results came in. The suburban edition was printed and put on trucks and delivered in the middle of the night. Nearly all were dropped off in front of the closed stores that would sell them in the morning. After the election night tide had turned and it was clear Truman would win, the newspaper sent their trucks back out to the dealers and gathered up the bundles of papers and returned them for disposal. Very few were distributed because this all occurred before the “paperboys” could pick them up or the stores opened. A few copies were kept as souvenirs by newspaper staff. But the edition never went into circulation like other collectible editions do.

Last week I bought a copy of the “Dewey Defeats Truman” newspaper. It was a budget buster for something soon to be 60 years old that has a cover price of only four cents! But, like anything collected by a collector, its value is not monetary.

With ownership of something like this goes the responsibility of caring for it. My hurricane plan includes protecting my collection and that plan is a better plan than in most museums I survey. My storage is “museum quality” and my security--well, you guess. I will do my best to keep my pieces of American history safe.

Mandatory Reading

Tue, 26 Aug 2008 21:56:59 -0400

If you are in the security profession, you absolutely must read this article.

Diebold Was Wrong

Tue, 26 Aug 2008 21:21:18 -0400

For years people have been offering growing proof that e-voting machines made by Premier Election Solutions (formerly Diebold) was flawed and could be manipulated to throw an election. Few doubted the evidence--except Diebold which denied the facts but refused to allow outside auditors to inspect the machines. Now Premier has admitted that the machines are indeed flawed. Why do we think that technology is better than a pencil and paper? For 200 years paper ballots have served us well. Computerized voting machines make life easier for election commissions. So what? We pay them to work, let them count ballots! We don’t need instant voter totals, we need accurate voter totals. See this and this. (The first link is 1 of 9 sections of a full movie that proves the case against the Diebold/Premier e-voting machines).

In my opinion Premier, formerly known as Diebold, is about four years too late in admitting this problem and I am having difficulty forgiving them for what in my opinion was less than straightforward handling of this. Yes, this is the Diebold many clients use as their security contractor.

By the way, you probably vote with one of these machines even if you think you don’t. Regardless of your politics, the American vote is too precious to trust to a private company with protection from oversight by critics. The machines not only can be tampered with via technology, they can be compromised via old fashioned means. Someone should go to prison.

So You Can’t Get A Virus

Tue, 26 Aug 2008 21:06:05 -0400

Regular readers know I am constantly preaching against putting your security systems on the building network out of fear of getting a virus, being hacked or suffering a distributed denial of service attack. If I had a dollar for every IT professional in a museum that insisted that it is absolutely beyond possible for them to get a virus, I’d buy you all a beer. I’ve always said that even the best suffer from malware infections.

NASA has disclosed that the international space station has been infected with a worm that steals passwords. It came aboard on a laptop computer used by an astronaut. Enough said.

Human Stupidity and Security

Sun, 24 Aug 2008 00:03:19 -0400

CNN and local TV station KWCH carried a story about a Texas canning company that used shredded checks purchased from a local bank as packing paper inside the boxes they shipped to customers. That’s right, the bank receives and processes checks from local people then shreds them. they then sell the paper to the WHH Ranch company which stuffs the paper between jars to keep them from breaking in transit when they deliver their chili to customers. See the CNN story here: http://consumerist.com/5040975/whh-ranch-company-uses-shredded-checks-as-package-cushioning

What were they thinking? Some of the checks in the video weren’t even shredded! Identity thieves must buy tons of this company’s can goods!

“What were they thinking” exactly. They weren’t. Employees don’t think “security” like we do so resign yourself that as the security manager you have to think about security for them. Never underestimate how incredibly thoughtless they can be and how many vulnerabilities they can create for you.

I’m Back!

Fri, 22 Aug 2008 14:59:24 -0400

Sorry for the lag in posting new items but our website was moved from one server to another by the hosting company and we didn’t have the ability to upload items. They locked us out by changing our password. As you can see, we are finally back. Just before coming back, however, Fay decided to pay us a visit and like many Florida visitors she over stayed her welcome. We have been closed much of this week. The photo above was taken mid-day today when I drove to the office to check on it. Welcome to Florida. Let’s go to the beach.

If you are reading this via an RSS Feed through a news reader, there are a lot of posts that are just now being posted so there may be more new posts than your news reader can display. Visit the blog and click on the archive and you may see several new articles that don’t appear on your news reader’s list of new posts.