Guardian inaccurate article: Alleged credit card scam raises new web security fears
To the Guardian Tech Editor:
published Tuesday 18 August 2009 20.43 BST
incorrectly describes the computer vulnerability, or “exploit” allegedly used by one Albert Gonzalez and unnamed others to allegedly steal and sell credit card information from several companies. The article also mis-characterizes the legal procedure used to bring the charges.
The article says,
“The charge sheet says that Gonzalez, along with two others who “resided in or near Russia”, in December 2007 injected “structured query language”, a computer programming language designed to retrieve and manage data, into the computers of companies such as Heartland, one of the world’s biggest credit and debit card payment processing companies.”
Structured Query Language is not a computer language such as C or FORTRAN. It cannot be “injected” anywhere. It is a format or language for querying or posting information to a computer database.
It sounds like your reporters read “SQL injection”, didn’t understand what that meant, and made up a likely sounding (but wrong) explanation.
A more correct description would be that the alleged fraudsters illegally accessed corporate databases, and inserted fraudulent information into them in order to gain access to those or other systems.
SQL injection is a well-known and preventable vulnerability, see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1804
Your writers apparently could not even be troubled to look up the defendant on wikipedia, see http://en.wikipedia.org/wiki/Albert_Gonzalez
The article refers to a “charge sheet”, the correct term in this case is “indictment”, see http://www.usdoj.gov/usao/ma/Press%20Office%20-%20Press%20Release%20Files/IDTheft/Gonzalez,%20Albert%20-%20Indictment%20080508.pdf
A “charge sheet” in US usage refers to the daily written record of events in a police station, it has little or nothing to do with Grand Jury proceedings. In the Commonwealth, it may refer to a final police report. It is not the same as an indictment brought by a Grand Jury. Confusing charges brought by police and charges brought by a Grand Jury is a fundamental error.
The most newsworthy item overlooked in this rather poor excuse for an article is the question of liability. Both the “wardriving” and “SQL Injection” attacks are well-documented and generally preventable. Thus there is the question of the liability of the companies allegedly victimized as they may have failed to take even the most basic computer security precautions with this sensitive data. Further, how was the defendant able to carry out the alleged attacks while at the same time allegedly acting as a consultant or informant to the US Secret Service? To what degree is the Secret Service liable for failing to prevent, or even possibly enabling, these attacks?
The article’s confusion of the acting US attorney for New Jersey, Ralph Marra, with the “acting US Attorney General” further detracts from the accuracy and reliability of your reportage. The Attorney General of the United States is Eric Holder. There is no “acting US Attorney General.” Your reporters should certainly have known this if they were even moderately well-informed. Basic fact-checking by your editors should have caught and prevented this error from being published.
In the future, please don’t have articles written by people who A) have no idea what they are writing about in either the legal or technical sphere and B) don’t do even a basic job of research and fact-checking. Editors must fact-check and verify all references to technical descriptions, legal proceedings, and offices held by public officials.
Henry Edward Hardy
The subtitle refers to “‘Biggest ever’ case involves 130m cards”
Who says it is the “biggest ever” case? This unattributed quote appears nowhere in the article, which does not state anything of the kind. Was it simply made up by a copy editor?
I would also note that the title of the Guardian article claims that the incident “raises new web security fears.” This is bullocks. Wardriving and SQL injection are neither new issues nor are they web-dependent; how to defend against them is well-understood and documented; and fear-mongering about them isn’t warranted or appropriate.
Copyright © 2009 Henry Edward Hardy
An interesting article in the Guardian says that General Petraeus and his staff have concluded that the US faces a collapse of political and public support for the war in Iraq within the next six months. In addition, due to low morale, poor readiness and the high morale and level of experience of the resistance groups, the US faces a military collapse similar to the French collapse in Viet Nam in March-May 1954 or the collapse of US forces in Korea in October-December 1950.
US commanders admit: we face a Vietnam-style collapse
Elite officers in Iraq fear low morale, lack of troops and loss of political will
Thursday March 1, 2007
An elite team of officers advising the US commander, General David Petraeus, in Baghdad has concluded that they have six months to win the war in Iraq – or face a Vietnam-style collapse in political and public support that could force the military into a hasty retreat.The officers – combat veterans who are experts in counter-insurgency – are charged with implementing the “new way forward” strategy announced by George Bush on January 10. The plan includes a controversial “surge” of 21,500 additional American troops to establish security in the Iraqi capital and Anbar province.
But the team, known as the “Baghdad brains trust” and ensconced in the heavily fortified Green Zone, is struggling to overcome a range of entrenched problems in what has become a race against time, according to a former senior administration official familiar with their deliberations…
Copyright © 2007 Henry Edward Hardy