Behind the Curtain at TCG

DefCon: Google Ads Phishing Security Alert

DefCon (http://www.defcon.org) is a large annual hacking conference that attracts corporate security personnel, federal agents, and of course, hackers.  DefCon is significant since hackers use DefCon as a forum to unveil security vulnerabilities in tools and utilities we use daily.  The first day of this year's conference, DefCon 13, is no exception.

The focus for the presentation "Hacking Google AdWords" by StankDawg (http://www.stankdawg.com/) was how to effectively use the Google AdWords system to maximize your visibility on the Google site.  The competitive commercial applications alone made this talk interesting.  However, tucked in this presentation was the shocking revelation that anyone with a credit card (including one time use credit cards) can create a Google advertisement that is a convincing phishing attempt.

As a quick background, AdWords is a Google Program through which an individual or corporation can purchase keyword search terms.  When anyone searches with those terms, the purchased ads appear on the right hand column of the Google search results.  When you purchase an ad, you provide a title, summary text, and a link to your site.  For convenience, Google allows you to provide a destination for the link that differs from the displayed URL for the link in the ad.  This is useful for you to create a special page specifically for Google users.  However, the destination URL does not have to have any relationship with the link that is displayed on the ad!

This allows malicious advertisers to create fake web sites for the purposes of gathering personal information (one type of "phishing").  Let's say there was a bank "Example S&L" that allowed on-line banking services.  A phisher can create an advertisement with the search term "Example S&L" that has an appropriate title, appropriate text, appears to have a link to "www.examplesandl.com", but really points to "www.phishingexamplesandl.com" (or more subtly, "www.examplessandl.com").  The result is that a person who is not paying attention could search for "Example S&L", see the top paid advertiser that looks like a legitimate link to "Example S&L", click on it, be presented with a fake login page, and unknowingly provide their login information to a phisher.

For Google, a solution could be to at least ensure that the domain of the destination URL matches the displayed URL (or simply have the destination and displayed URL match).  For the rest of us, the main lesson learned is that as Web users, we need to utilize constant vigilance to ensure that the URL in the "address" line is what we expect before entering any personal information.

VoIP and telework

The government's been trying to get more people to work remotely for many years now, with legislation that mandates agencies to enable more staff to adopt this mode of working and prevents government contractors being penalized for the use of teleworkers. TCG has always been a proponent of telework, and we've adopted technologies that support it. One such technology is VoIP (Voice over IP), which creates a centralized telephone system by using our people's broadband connections, wherever they happen to be. GovExec has an article about the government's use of VoIP today, and the article portrays the technology as a cure-all for teleworkers. It's not. The biggest barriers to greater investment in government teleworking are cultural, not technological. Routing phone calls to remote offices has always been possible (though not always so inexpensive). As we learned at TCG, managing a teleworking staff takes a different set of disciplines than managing people that you can actually greet in the lobby every day, and it requires a very tangible shift in attitudes and approach. So it's a mistake to believe that any technology can solve the increased-use-of-teleworkers riddle. Like any business problem, it's primarily an organizational issue for which technology constitutes only a small piece of the solution.

Forecastfox

I started using Forecastfox some time ago and absolutely love it. It's a little Firefox extension that shows the current and forecast weather conditions wherever you wish in the browser. Until the latest version, the weather data came from Weather.com but now -- oh joy of joys! -- it's being drawn from Accuweather.com which includes "RealFeel": what the temperature feels like rather than its empirical measure. The creators of Forecastfox made the switch because Accuweather opened up its system with a new API that allows almost endless mining of their weather data.

This is important because it shows that, as well as being cause for lots of nerding around on the desktop for tweak-freaks like me, when companies open up the gateway to their crown jewels, smart people will find interesting new ways to use the data and drive more business your way. The BBC's Backstage project recently did something similar in opening an API for all of the Beeb's TV listings. The idea is for anyone on Earth to take that data and create new applications and communities around it. This kind of innovation is rife right now (witness Flickr.com!) and Wired has a great article on it this month, too (though it's not online yet, though, ironically).

In the meantime, stay cool by knowing how hot it is outside: get Forecastfox! (Obviously you should install Firefox first...)

IBM acquiring PureEdge

Woah! Government Technology reports that IBM is buying PureEdge, the producer of the e-forms software that's used by Grants.gov, among many others. I think this has been in the works for a while now, given that PureEdge seems to have obtained quite a foothold in the government marketplace, with significant agreements with HHS and the Army. We're quite familiar with the technology, having used it in our work with Grants.gov. I've heard a number of complaints about that system's use of PureEdge, not least being "There's no Mac version," which is a major bone of contention among research scientists in particular. With IBM's money behind them now, maybe that long-awaited problem might be solved.

Meanwhile, there's an interesting take on this news at PDFzone.com, with a predictable too-early-to-be-credible Adobe favoritism, which discusses how IBM's strategy may be to compete with Adobe and Microsoft (InfoPath) by offering a tightly-integrated front- and back-end solution that leverages their appserver assets.

IT governance and efficiency

Somehow or other, I ended up reading this article on Nicholas Car's blog about governance of IT purchasing in organizations. It highlights an important point: the governance structure should be focused on the objectives of the business, not as a means to create economic savings or placate management's desires for a greater sense of control. Instead, the governance structure begets certain outcomes:

Companies focused on profits exhibited greater centralization, those focused on innovation and sales growth were more decentralized, and those seeking to maximize asset utilization had hybrid models.

The US government's Lines of Business initiatives should take a close look at this. I've been watching the LoB's closely, and I'm still unclear on what their objectives are. Cost savings? Greater operational speed? Improved data quality? What? It could be one or all of these, and others, and the answer to th question of desired outcome has to be answered first before the government jumps head-first into consolidation initiatives. This is as true in HR as it is in financial management, grants management, or anything else.

Law enforcement IT standards

Another heads-up from Alice Marshall: DOJ is sponsoring an effort to develop law enforcement IT standards, called the LEITSC (Law Enforcement Information Technology Standards Council). With so much money at the levels of law enforcement closest to the feds, and so little closer to your neighborhood police officer, this is an excellent idea to develop economies of scale across all levels.

EmergingTechnology.gov

Via a newly-found friend, Alice Marshall of the Presto Vivace Blog and GCN, I see that NIST has launched a new site, ET.gov, to help increase adoption of reusable components. I was wondering when something like this would crop up. CORE.gov is limited to government participation, which seems like a very introverted approach to me, so it's about time that non-guvvie types can submit their components to a government-sponsored repository.

Accelerating Grants Streamlining - NGP paper #1 released!

The first NGP White Paper, Accelerating Grants Streamlining: Furthering the Recommendations of GAO's Grants Streamlining Report, was released a few hours ago.  I'm the co-chair of the NGP White Paper Series Committee and the team did a really fantastic job in putting this dense volume of information together, at the behest of Andrea Brandon of the P.L. 106-107 PMO at DHHS. We'll be embarking on our next white paper effort shortly. If you'd like to get involved, e-mail me and I'll connect you with the right people.

NGP White Paper #1 - phew!

So after a flurry of activity, I think the NGP's first white paper, Accelerating Grants Streamlining, is pretty much done! I wrote about it before on the blog, and will post the final paper here too once I have permission to do so. We've had some great input from across the grants enterprise, from organizations such as:

• State of New York
• State of Texas
• OMB Watch
• Department of Health & Human Services
  
• Department of Education
• Department of Agriculture
• Department of Transportation
  
• Census Bureau

In all, we received and responded to over 90 comments from NGP members on the draft that was sent out. The strong feeling is that we'll receive a lot more for the next paper, when we hope we'll be able to provide a more lengthy review period.

What we've ended up with is a really in-depth and provocative look at grants management, in the Federal and non-Federal spaces, and some recommendations that make a great deal of sense. Our hope is that the paper will open up the channels of communication between the Federal and non-Federal stakeholders, as those channels have been either closed or sporadic, at best.

Google! - grants and open source

I spotted this post on Slashdot about some old Google pages that are available on WayBackMachine.com, which is an archive of Internet sites and web pages. One of the pages in the archive is the old About Google! page, and it highlights some very interesting facts.

Funding for the research that made Google possible was provided by NSF, NASA, and DARPA (through grants, I presume), and an outfit called Interval Research. So Federal grants helped create possibly the most widely-used web application in the world and, in my mind, one of the cornerstones of the Internet's usefulness. I don't believe many people know this, and they should. Taxpayers should recognize that their investment in scientific research, via government grant-making, creates massive returns for them and for the benefit of the world.

Secondly, the developers made significant use of open source technologies, including GNU, Linux, Python, and Gimp. They didn't use fancy development tools, nor did they use a proprietary operating system. To revolutionize information indexing and searching, they employed stuff they could get and use at no cost. I'm sure this is less true nowadays at Google (although I'd be surprised if the majority of their development is done using anything other than fairly rudimentary tools) but the fact they started with tools available to anyone shows that open source is democratizing and a powerful enabler for innovators everywhere.