Saturday Morning Phishing Call

Fairly early Saturday morning, my phone rang. Although I didn't recognize the number, I answered, learning during this election period that if I ignore the pollsters attempts to contact me, they just call back, again, and again...(I don't know if it is that my opinion is extremely valuable or if there are just lots of pollsters that I receive so many calls. I suspect the latter.)

“Hello?”

“Yes, hello, Lee. My name is Marcus, and our servers have detected some hacking in your computer, and I am calling to help you.”

I don't know about you, but it always throws me off a little when a stranger calls me by name. However, I was instantly alert, mostly due to the use of a verb (hacking) in place of a noun, and the accent. I would place Marcus in India. I would expect his servers to find a virus or malware – the results of hacking. Not completely certain how they would detect the act of hacking without detecting the results of hacking.

“Marcus, please tell me my computer IP address where you detected the hacking.”

“Lee, I don't have your IP address, but I do have the ID of your Windows computer.”

“Continue, Marcus. What is my computer's ID, and please, which version of Windows am I running?”

The version question was just to string him along a little. I realized as I asked it that there was a good chance he could guess correctly – I think there are only 3 versions remaining in widespread use. I chuckled, thinking of the scene in the movie Elf where Elf asks the department store Santa, who he believes is fake and wants to prove it, “Yeah? If you're the real Santa, what song did I sing for you on your birthday?” “Why, Happy Birthday, of course!”

I was really intrigued, and a little concerned, that he might actually have my computer ID. So, I wanted to play along just to see. While we continued talking I was busy pulling up the two values that he might have: My computer ID and my Windows ID, just to see which he might give me as 'proof' that his servers had indeed detected hacking on my machine.

Marcus was pretty slick, too. He didn't attempt to answer the Windows version question, deflecting with “I'm not talking about your OS. I'm talking about your computer ID”

“I'm ready, Marcus. Please, give me my computer ID.”

“888DCA60-FC0A-11CF-8F0F-00C04FD7D062”

Whew. That was neither my windows ID nor the number on the back of my computer. Didn't match my MAC address, either. But what was it, and why would Marcus think I would accept it as my number?

“That's not my computer ID, Marcus.”

“Sir, it is your CLSID. Please, press your windows key, and then 'r', and type the command 'assoc'”

Some more time occurred as I acted stupid and had him explain several times where the windows key was and how to recognize it. (For humor imagine a non-English speaker attempting to describe what that key looks like – nothing I was hearing made any sense!) I know well what windows+r would give me the command prompt, and I wasn't going to start running unfamiliar commands that some caller asked me to. So, while he was busy attempting to get through to me what to do, I was searching (I don't 'google', since, #1, Google is a noun, and should not be used as a verb, and #2, I don't use Google has my search engine, having switched to DuckDuckGo) for 'Assoc scam'. Which I found, here.

I also typed help assoc in the command window, and realizing that the assoc command by itself was only Marcus' attempt to 'prove' his legitimacy, I typed it. And sure enough, there is the CLSID that matches the string Marcus gave. Fortunately, the CLSID is not unique to any particular computer, and so I now knew that Marcus possessed no identifying information on my computer.

It was time to end this phishing call. “Marcus, that value is not unique. In fact, that is a known scam, and that makes you nothing more than a common thief, a worthless piece, a horrible human being, and a waste of resources. You should find something constructive and productive to do rather than attempt to steal.”

I suspect that Marcus did not want my (well meant) advice: He hung up on me! Oh well...

But my taking this call had become a useful teaching opportunity for me. My children had been following along wondering just what was going on. They were very excited by the conclusion, but we were able to go back over the details: How I had revealed nothing to the caller, not answering any of his questions, asking my own to stall, searching details, being very suspect of his motives. We talked about good security – I absolutely didn't run any command he asked me to, and that I could have just ended the call early (which is probably best) – and that legitimate companies will not call and ask you to allow a connection to your computer.

The final point is the most important: Your bank, your doctor, your credit card company, none will initiate a call to you and ask you for personally identifying information or a connection to carry out their business. Neither will the FBI or any other legitimate institution.

It is interesting, with all the high profile stories in the news about hacking, the majority of theft of ID or financial information still occurs through phishing – one person talking to another, and manipulating the victim into giving out the necessary information. As we've become more sophisticated in our understanding of phishing, so the phishers have gotten more clever at presenting 'proof' they are who they represent to be.

The stakes keep growing, too, as more and more personal information is gathered on us and stored on Internet connected devices. As we've seen, through the breach of Target, Home Depot, and Sony, large companies are not up to keeping our data safe.

Which poses the question: Should they even be allowed to maintain data on us? Should it even be a possibility that Marcus could have obtained (perhaps through a hack of a major computer reseller) my actual computer ID? Or my user profile as stored up by Google, Microsoft, Yahoo, Amazon, etc.?

Security expert Bruce Schneier thinks about this a lot. Through reading his book 'Data and Goliath' and rebuffing attempts like this morning, I've started thinking about it more, too.

Neal Stephenson's Anathem

I was struck by the depth of this book – both ideas and its insightful prose. Let's begin with a piece of prose:

So I looked with fascination at those people in their mobes, and tried to fathom what it would be like. Thousands of years ago, the work that people did had been broken down into jobs that were the same every day, in organizations where people were interchangeable parts. All of the story had been bled out of their lives. That was how it had to be; it was how you got a productive economy. But it would be easy to see a will at work behind this: not exactly an evil will, but a selfish will. The people who'd made the system thus were jealous, not of money and not of power but of story. If their employees came home at day's end with interesting stories to tell, it meant that something had gone wrong: a blackout, a strike, a spree killing. The Powers that Be would not suffer others to be in stories of their own unless they were fake stories that had been made up to motivate them. People who couldn't live without story had been driven into the concents or into jobs like Yul's. All others had to look somewhere outside of work for a feeling that they were part of a story, which I guessed was why Saeculars were so concerned with sports, and with religion. How else could you see yourself as part of an adventure?

[ mobes = cars

  concents = university, but cloistered with outside contact only once every ten years

  Yul = main character, his job is as a wilderness guide – think Alaska, Nepal

  Saecular = the world most people inhabit

]

Good Science Fiction is always part social commentary – by constructing another world that is often the same but subtly different, the author is allowed the freedom to make observations about the way people live and what gives life meaning. Stephenson does this by inverting some of our social institutions (the cloistered university), and changing the terms for many things which forces the reader to consider what exactly he is getting at, with the added insight he intends.

But all this is hung around the main story which is what really makes Anathem worth reading: Stephenson takes us on a romp through current theoretical physics which asks the following questions: Is ours the only universe, our could there be multiple? We can only see to the edge of our universe, which is the distance light has been able to travel since the formation – so anything beyond that boundary is invisible to us at this time. That doesn't preclude there being other 'universes' that are currently beyond that boundary...

Would other universes be the same as ours? Supporting this would be the observation that there is only a finite number of atoms (Hydrogen through Uranium, plus the few short-lived lab made ones). If there are an infinite number of universes, and finite types of atoms, then arrangements of atoms would necessarily repeat, and there would be virtual copies of the entities in this universe in other universes.

Throwing a monkey-wrench into this is the idea that the constants we observe (the charge of an electron, for example) needn't all be the same everywhere. This is where the anthropic principle comes into play: We could necessarily find ourselves only in a universe where the constants are very close to what they are – too large of deviations and 'we' wouldn't be present to observe them. But within some narrow boundaries, we, or beings very much like us, could exist and observe. Stephenson makes very good use of this last point late in the story...

Finally, would it be possible for us to experimentally determine if ours is a lone universe or if it is just one of many (or one of an infinite many)? Are there interactions that could be observed that would reveal the existence of multiple universes – of other ways of being? Part of what leads physicists down this path is the indeterminate-ness of quantum electrodynamics. Is Schrodinger's cat alive or dead? How, exactly, does the quantum field collapse into the state we observe? Is there a universe in which the cat is alive even though it is dead in this one? When world tracks come close together, could there be transfer of information?

Neal Stephenson spins a yarn of 'What If?' around all these ideas that creates a top-notch story set in an instance of top-notch world building where everything plays out as it could – somewhere. And that somewhere is Arbre which has eerie parallels to the world in which we live – and astounding differences.