Epileptics vs Hackers

Wired reported in March an attack hackers carried out against a forum where epileptics can go to exchange information and discuss their condition. The attack appeared as a post on a the forum which is run by the Epilepsy Foundation using Java

RyAnne Fultz, 33, says she suffered her worst epileptic attack in a year after she clicked on the wrong post at a forum run by the nonprofit Epilepsy Foundation.
Photo courtesy RyAnne Fultz

Internet griefers descended on an epilepsy support message board last weekend and used JavaScript code and flashing computer animation to trigger migraine headaches and seizures in some users.

The nonprofit Epilepsy Foundation, which runs the forum, briefly closed the site Sunday to purge the offending messages and to boost security.

"We are seeing people affected," says Ken Lowenberg, senior director of web and print publishing at the Epilepsy Foundation. "It's fortunately only a handful. It's possible that people are just not reporting yet -- people affected by it may not be coming back to the forum so fast."

The incident, possibly the first computer attack to inflict physical harm on the victims, began Saturday, March 22, when attackers used a script to post hundreds of messages embedded with flashing animated gifs.

The attackers turned to a more effective tactic on Sunday, injecting JavaScript into some posts that redirected users' browsers to a page with a more complex image designed to trigger seizures in both photosensitive and pattern-sensitive epileptics.

RyAnne Fultz, a 33-year-old woman who suffers from pattern-sensitive epilepsy, says she clicked on a forum post with a legitimate-sounding title on Sunday. Her browser window resized to fill her screen, which was then taken over by a pattern of squares rapidly flashing in different colors.

Fultz says she "locked up."

"I don't fall over and convulse, but it hurts," says Fultz, an IT worker in Coeur d'Alene, Idaho. "I was on the phone when it happened, and I couldn't move and couldn't speak."

After about 10 seconds, Fultz's 11-year-old son came over and drew her gaze away from the computer, then killed the browser process, she says.

"Everyone who logged on, it affected to some extent, whether by causing headaches or seizures," says Browen Mead, a 24-year-old epilepsy patient in Maine who says she suffered a daylong migraine after examining several of the offending posts. She'd lingered too long on the pages trying to determine who was responsible.

Circumstantial evidence suggests the attack was the work of members of Anonymous, an informal collective of griefers best known for their recent war on the Church of Scientology. The first flurry of posts on the epilepsy forum referenced the site EBaumsWorld, which is much hated by Anonymous. And forum members claim they found a message board thread -- since deleted -- planning the attack at 7chan.org, a group stronghold.

Fultz says the attack spawned an uncommonly bad seizure. "It was a spike of pain in my head," she says. "And the lockup, that only happens with really bad ones. I don't think I've had a seizure like that in about a year."

But she's satisfied with the Epilepsy Foundation's relatively fast response to the attack, about 12 hours after it began on Easter weekend. "We all really appreciate them for giving us this forum and giving us this place to find each other," she says.

Epilepsy affects an estimated 50 million people worldwide, about 3 percent of whom are photosensitive, meaning flashing lights and colors can trigger seizures.

Ever wonder how the new US passports are made?

Recent news stories recently raised questions about the fact that some of the components of U.S. passports are produced overseas. Questions were also raised about passport security and why foreign firms have been engaged as part of the passport production process. Under Secretary of State for Management Pat Kennedy joined Department Spokesman Sean McCormack for a video podcast to discuss these issues. This video walks you through the process and explains the new passport's new security features.

High Security or HIgh In-security?

As part of my job, I'm responsible for implementing certain measures to thwart attacks. The most common measure I implement is choosing which locks go on which doors. Sounds pretty basic right? Those in the business know, like computer security, physical security has to change constantly to deal with new threats. Over the last few years, you've heard about key-bumping. This entails taking a key blank for a lock and then guiding the blank through the lock and knocking out the pins. torque is then applied to the lock and the lock and key turn to open the door. Some locks claim to be "bump-proof". Well as we found out last year, this ain't necessarily so. At Defcon (world's largest hacker conference) last year, Marc Weber Tobias gave a talk about "high security" locks, their standards, and their weakness. He even demonstrated bypasses. I HIGHLY encourage everyone who missed this talk to check out the video below.