---------------------------------------------
February 09, 2006
Google Copies Your Hard Drive - Government Smiles in Anticipation
Consumers Should Not Use New Google Desktop
San Francisco - Google today announced a new "feature" of its Google Desktop software that greatly increases the risk to consumer privacy. If a consumer chooses to use it, the new "Search Across Computers" feature will store copies of the user's Word documents, PDFs, spreadsheets and other text-based documents on Google's own servers, to enable searching from any one of the user's computers. EFF urges consumers not to use this feature, because it will make their personal data more vulnerable to subpoenas from the government and possibly private litigants, while providing a convenient one-stop-shop for hackers who've obtained a user's Google password.
"Coming on the heels of serious consumer concern about government snooping into Google's search logs, it's shocking that Google expects its users to now trust it with the contents of their personal computers," said EFF Staff Attorney Kevin Bankston. "Unless you configure Google Desktop very carefully, and few people will, Google will have copies of your tax returns, love letters, business records, financial and medical files, and whatever other text-based documents the Desktop software can index. The government could then demand these personal files with only a subpoena rather than the search warrant it would need to seize the same things from your home or business, and in many cases you wouldn't even be notified in time to challenge it. Other litigants—your spouse, your business partners or rivals, whoever—could also try to cut out the middleman (you) and subpoena Google for your files."
The privacy problem arises because the Electronic Communication Privacy Act of 1986, or ECPA, gives only limited privacy protection to emails and other files that are stored with online service providers—much less privacy than the legal protections for the same information when it's on your computer at home. And even that lower level of legal protection could disappear if Google uses your data for marketing purposes. Google says it is not yet scanning the files it copies from your hard drive in order to serve targeted advertising, but it hasn't ruled out the possibility, and Google's current privacy policy appears to allow it.
"This Google product highlights a key privacy problem in the digital age," said Cindy Cohn, EFF's Legal Director. "Many Internet innovations involve storing personal files on a service provider's computer, but under outdated laws, consumers who want to use these new technologies have to surrender their privacy rights. If Google wants consumers to trust it to store copies of personal computer files, emails, search histories and chat logs, and still 'not be evil,' it should stand with EFF and demand that Congress update the privacy laws to better reflect life in the wired world."
For more on Google's data collection:
http://tinyurl.com/chxk6
http://tinyurl.com/7wjyg
http://tinyurl.com/d85wt
http://tinyurl.com/aujee
Contact:
Kevin BankstonStaff AttorneyElectronic Frontier Foundation
bankston@eff.org
Posted at 11:04 AM
---------------------------------------------
When the first Google Desktop was released, I pushed up the ranks for this to not be used in the corporate world. People can (and will) do what they want on their personally computers, but in the business world...the "unknown" risk of this software is just unnecessary.
As attackers move away from OS levels, applications security problems will hit center stage. We are seeing this start to happen right now.
Remember the old OS security measure of reducing the number of running services? This reduces your online signature and therefore reduces the attack pathways. The same idea can be applied for system security at the application level.
More Applications = more lines of running code = higher change of security vulnerabilities
Need I say more....
Friday, February 10, 2006
Thursday, February 9, 2006
AOL/GoodMail - The Internet's First Email Tax
The "Fight for Internet Neutrality Principles" has moved into the e-mail system.
Ahh, back in the day. I remember when friends would tell me about how the Postal Service was going to impose a 5 cent surcharge on every e-mail message sent via the Internet. I used to laugh and just say "Ohh that is just an urban legend".
Well, sometimes the truth is scarier than legend. Change "Postal Service" to "AOL/Yahoo" and you are pretty close to truth.
AOL and Yahoo have decided that creating "mail classes" is the next best way to fight spam. They believe that by charging companies just factions of a penny, that they can cut spam. Factions of a penny? That isn't alot? Do you remember "Office Space"? It is alot....really alot.
I am not so sure that I agree with this method. Sounds like a way to make extra money, pretend they are doing something about the spam problem and a great way for other companies to spam directly into your inbox all the time by bypassing spam filters.
It also sounds like a GREAT reason to drop AOL for a better ISP, like you should have done years ago IMHO. If the systems doesn't catch on like expected, AOL may be running their own customers away. Kinda like Sony and the RIAA.
The New York Times had a great article on this very subject earlier this month. "AOL users will become dissatisfied when they don't receive the e-mail that they want, and when they complain to the senders, they'll be told, 'it's AOL's fault,' " said Richi Jennings, an analyst at Ferris Research, which specializes in e-mail.
AOL and Yahoo will be using Goodmail Systems’ processing system to collect the electronic postage and verify the identity of the sender. AOL will be implementing the system in the next two months, while Yahoo will be trying the system out, and has not yet decided how paid vs. unpaid mail will be treated.
Supporters of the system, say it is just like preferred mail classes at your post office. People against the system say it is only going to hurt customers and will be another nail in the "internet e-mail" coffin.
David Stanley, vice president and managing director of messaging security company CipherTrust, said the plan was "a ridiculous idea" and "nothing more than a money-making idea that will not stop spam but will give account holders free reign to send all sorts of 'authenticated' mail."
Umm, I guess the people of the world will have to get together, buy all the dark fiber and create an Open Source Internet. ;)
Ahh, back in the day. I remember when friends would tell me about how the Postal Service was going to impose a 5 cent surcharge on every e-mail message sent via the Internet. I used to laugh and just say "Ohh that is just an urban legend".
Well, sometimes the truth is scarier than legend. Change "Postal Service" to "AOL/Yahoo" and you are pretty close to truth.
AOL and Yahoo have decided that creating "mail classes" is the next best way to fight spam. They believe that by charging companies just factions of a penny, that they can cut spam. Factions of a penny? That isn't alot? Do you remember "Office Space"? It is alot....really alot.
I am not so sure that I agree with this method. Sounds like a way to make extra money, pretend they are doing something about the spam problem and a great way for other companies to spam directly into your inbox all the time by bypassing spam filters.
It also sounds like a GREAT reason to drop AOL for a better ISP, like you should have done years ago IMHO. If the systems doesn't catch on like expected, AOL may be running their own customers away. Kinda like Sony and the RIAA.
The New York Times had a great article on this very subject earlier this month. "AOL users will become dissatisfied when they don't receive the e-mail that they want, and when they complain to the senders, they'll be told, 'it's AOL's fault,' " said Richi Jennings, an analyst at Ferris Research, which specializes in e-mail.
AOL and Yahoo will be using Goodmail Systems’ processing system to collect the electronic postage and verify the identity of the sender. AOL will be implementing the system in the next two months, while Yahoo will be trying the system out, and has not yet decided how paid vs. unpaid mail will be treated.
Supporters of the system, say it is just like preferred mail classes at your post office. People against the system say it is only going to hurt customers and will be another nail in the "internet e-mail" coffin.
David Stanley, vice president and managing director of messaging security company CipherTrust, said the plan was "a ridiculous idea" and "nothing more than a money-making idea that will not stop spam but will give account holders free reign to send all sorts of 'authenticated' mail."
Umm, I guess the people of the world will have to get together, buy all the dark fiber and create an Open Source Internet. ;)
Wednesday, February 8, 2006
IE7 Beta Breaks Google AdSense
BetaNews - Developers testing out the latest version of Internet Explorer 7 are discovering a nasty flaw -- the browser seems to be incompatible with Google's AdSense advertising service. Although the problem seems limited to those running IE7 Beta under Windows XP, it still has some developers worried. For many, AdSense has become the de facto method for generating revenue for their sites. Google generates over $2 billion in revenue yearly from the program alone.
"Considering that by the end of the year, IE7 should be available for almost all versions of Windows, unless Microsoft wants to face the ire of developers everywhere, it had better fix this," Nathan Weinberg of the InsideGoogle Web log wrote Wednesday. Although it is unknown as to why this is occurring, it is suspected it may have to do with how IE7 now handles JavaScript. Microsoft could not be reached for comment.
-------------------------------------------------
Add this little piece of information with the rumors of Vista being released on Dec 1st and you have a adsense money problem in the making. =)
I guess Microsoft can fix this issue when they fix the Remote Code Execution buffer overflow flaw found on several weeks ago.
"Considering that by the end of the year, IE7 should be available for almost all versions of Windows, unless Microsoft wants to face the ire of developers everywhere, it had better fix this," Nathan Weinberg of the InsideGoogle Web log wrote Wednesday. Although it is unknown as to why this is occurring, it is suspected it may have to do with how IE7 now handles JavaScript. Microsoft could not be reached for comment.
-------------------------------------------------
Add this little piece of information with the rumors of Vista being released on Dec 1st and you have a adsense money problem in the making. =)
I guess Microsoft can fix this issue when they fix the Remote Code Execution buffer overflow flaw found on several weeks ago.
WMF Vulnerability Returns for IE5
Microsoft issued a new security advisory yesterday. Yet another WMF vulnerabilitiy.
(91333) Vulnerability in Internet Explorer Could Allow Remote Code Execution
This new advisory only relates to the following two cases :
1) Internet Explorer 5.01 SP4 on Microsoft Windows 2000 SP4
2) Internet Explorer 5.5 SP2 on Microsoft Windows Millennium
Note - This is not the same issue as the one addressed by MS06-001
Secunia Advisories (SA18729) - Highly Critical - System Access
Candidate CVE-2006-0020
It would appear that this might be connected to the flaw pointed out by HD Moore on the FunSec mailing list in Jan.
--------------------------------
More where that came from. The fun thing about these is that they DO apply to Windows 96, 98, 2000-2003, Vista. You can trigger it via RTF, directly inside IE, and anything else that loads metafiles. A fun bug you can find in a certain WMF parsing application...:
uint_size = wmf_header.size * 2;
ptr = malloc(uint_size);
read(fd, ptr, uint_size - sizeof(wmf_header));
:-)
-HD
---------------------------------
Upgrading to IE 6 SP1 is the suggested action on Windows 2000 SP4 and Windows ME
No patch for the older IE5. My suggested action would to get off Windows ME as soon as possible. The Win9x kernel is dead as dead...
(91333) Vulnerability in Internet Explorer Could Allow Remote Code Execution
This new advisory only relates to the following two cases :
1) Internet Explorer 5.01 SP4 on Microsoft Windows 2000 SP4
2) Internet Explorer 5.5 SP2 on Microsoft Windows Millennium
Note - This is not the same issue as the one addressed by MS06-001
Secunia Advisories (SA18729) - Highly Critical - System Access
Candidate CVE-2006-0020
It would appear that this might be connected to the flaw pointed out by HD Moore on the FunSec mailing list in Jan.
--------------------------------
More where that came from. The fun thing about these is that they DO apply to Windows 96, 98, 2000-2003, Vista. You can trigger it via RTF, directly inside IE, and anything else that loads metafiles. A fun bug you can find in a certain WMF parsing application...:
uint_size = wmf_header.size * 2;
ptr = malloc(uint_size);
read(fd, ptr, uint_size - sizeof(wmf_header));
:-)
-HD
---------------------------------
Upgrading to IE 6 SP1 is the suggested action on Windows 2000 SP4 and Windows ME
No patch for the older IE5. My suggested action would to get off Windows ME as soon as possible. The Win9x kernel is dead as dead...
Science: NASA Appointee Resigns
NYTimes.com - George C. Deutsch, the young presidential appointee at NASA who told public affairs workers to limit reporters' access to a top climate scientist and told a Web designer to add the word "theory" at every mention of the Big Bang, resigned yesterday, agency officials said.
Mr. Deutsch's resignation came on the same day that officials at Texas A&M University confirmed that he did not graduate from there, as his résumé on file at the agency asserted.
...
Mr. Deutsch, 24, was offered a job as a writer and editor in NASA's public affairs office in Washington last year after working on President Bush's re-election campaign and inaugural committee, according to his résumé. No one has disputed those parts of the document.
According to his résumé, Mr. Deutsch received a "Bachelor of Arts in journalism, Class of 2003."
Yesterday, officials at Texas A&M said that was not the case.
"George Carlton Deutsch III did attend Texas A&M University but has not completed the requirements for a degree," said an e-mail message from Rita Presley, assistant to the registrar at the university, responding to a query from The Times.
Repeated calls and e-mail messages to Mr. Deutsch on Tuesday were not answered.
Mr. Deutsch's educational record was first challenged on Monday by Nick Anthis, who graduated from Texas A&M last year with a biochemistry degree and has been writing a Web log on science policy, scientificactivist.blogspot.com.
--------------------------------------------
All political comments aside, how can a person work for the President and then for NASA and no one checks on their college degree??
Mind-blowing...
Mr. Deutsch's resignation came on the same day that officials at Texas A&M University confirmed that he did not graduate from there, as his résumé on file at the agency asserted.
...
Mr. Deutsch, 24, was offered a job as a writer and editor in NASA's public affairs office in Washington last year after working on President Bush's re-election campaign and inaugural committee, according to his résumé. No one has disputed those parts of the document.
According to his résumé, Mr. Deutsch received a "Bachelor of Arts in journalism, Class of 2003."
Yesterday, officials at Texas A&M said that was not the case.
"George Carlton Deutsch III did attend Texas A&M University but has not completed the requirements for a degree," said an e-mail message from Rita Presley, assistant to the registrar at the university, responding to a query from The Times.
Repeated calls and e-mail messages to Mr. Deutsch on Tuesday were not answered.
Mr. Deutsch's educational record was first challenged on Monday by Nick Anthis, who graduated from Texas A&M last year with a biochemistry degree and has been writing a Web log on science policy, scientificactivist.blogspot.com.
--------------------------------------------
All political comments aside, how can a person work for the President and then for NASA and no one checks on their college degree??
Mind-blowing...
Tuesday, February 7, 2006
Verizon: We're Ending Google's "Free Lunch"
NetworkingPipeline Blog – “One more member of the Telco mafia has threatened Google with a bandwidth cutoff. Verizon senior VP and general counsel John Thorne told a conference that Google "is enjoying a free lunch," by using Verizon's network, and issued a veiled threat to cut off Google's bandwidth. “
Needle in the Neutrality Haystack that Telecos intend to burn.
Needle in the Neutrality Haystack that Telecos intend to burn.
All Your Data Belong to Us
Man, have the reports of data leakage been crazy the last couple of weeks. Here are some of the highlights...
1) Guardian Unlimited (Feb 7th) - Russian thieves have stolen more than €1m (£680,000) from personal bank accounts in France using "sleeper bugs" to infect computers. French authorities claim the thieves can take control of and empty a bank account in seconds. In one hit, a bank customer lost €40,000.
Police say the virus is embedded in emails or websites and remains dormant until the user contacts their bank online. When that happens, the bug becomes active and records passwords and bank codes which are then forwarded to the thieves. They then use the information to check the victim has money in the bank before transferring funds to the accounts of third parties, known as mules, who may have agreed to allow money to pass through their accounts in return for a commission of between 5% and 10%.
2a) Boston Globe - It has come to our attention that consumers are receiving telephone calls from companies offering to assist them prevent credit card fraud. These companies, including one calling itself the “National Verification Office”, are asking consumers to provide the credit card or bank card information the consumer used to pay his or her Boston Globe or the Worcester Telegram & Gazette subscription. These companies are NOT AFFILIATED with the Boston Globe or the Worcester Telegram & Gazette.
2b) Boston.com (Feb 1st) - Credit and bank card numbers of as many as 240,000 subscribers of The Boston Globe and Worcester Telegram & Gazette were inadvertently distributed with bundles of T&G newspapers on Sunday, officials of the newspapers said yesterday.
3) Networkworld.com (Feb 6th) - A small Lockport, Manitoba-based distributor of herbal remedies has for the past 15 months been mistakenly receiving faxes containing confidential information belonging to hundreds of patients with Prudential Financial's insurance group. The data exposed in the breach -- and faxed to the company by doctors and clinics across the U.S. -- included the patients' Social Security numbers, bank details and health care information.
4) InfoWorld.com (Feb 6th) - Honeywell International Inc. says a former employee has disclosed sensitive information relating to 19,000 of the company's U.S. employees. Honeywell discovered the information being published on the Web on Jan. 20 and immediately had the Web site in question pulled down, said company spokesman Robert Ferris.
5) Networkworld.com (Jan 27th) - About 365,000 hospice and home health care patients in Oregon and Washington are being notified about the theft of computer backup data disks and tapes late last month that included personal information and confidential medical records.
-----------------------------------------------
As you can tell, data loss comes in many forms.
Thieves stealing backup tapes, normal people making mistakes, old employees taking some anger out for kicks, and organized groups of hackers (perhaps even foot soldiers of Russian organized crime group).
Now just think about all the cases that are not reported....yeah - exactly.
1) Guardian Unlimited (Feb 7th) - Russian thieves have stolen more than €1m (£680,000) from personal bank accounts in France using "sleeper bugs" to infect computers. French authorities claim the thieves can take control of and empty a bank account in seconds. In one hit, a bank customer lost €40,000.
Police say the virus is embedded in emails or websites and remains dormant until the user contacts their bank online. When that happens, the bug becomes active and records passwords and bank codes which are then forwarded to the thieves. They then use the information to check the victim has money in the bank before transferring funds to the accounts of third parties, known as mules, who may have agreed to allow money to pass through their accounts in return for a commission of between 5% and 10%.
2a) Boston Globe - It has come to our attention that consumers are receiving telephone calls from companies offering to assist them prevent credit card fraud. These companies, including one calling itself the “National Verification Office”, are asking consumers to provide the credit card or bank card information the consumer used to pay his or her Boston Globe or the Worcester Telegram & Gazette subscription. These companies are NOT AFFILIATED with the Boston Globe or the Worcester Telegram & Gazette.
2b) Boston.com (Feb 1st) - Credit and bank card numbers of as many as 240,000 subscribers of The Boston Globe and Worcester Telegram & Gazette were inadvertently distributed with bundles of T&G newspapers on Sunday, officials of the newspapers said yesterday.
3) Networkworld.com (Feb 6th) - A small Lockport, Manitoba-based distributor of herbal remedies has for the past 15 months been mistakenly receiving faxes containing confidential information belonging to hundreds of patients with Prudential Financial's insurance group. The data exposed in the breach -- and faxed to the company by doctors and clinics across the U.S. -- included the patients' Social Security numbers, bank details and health care information.
4) InfoWorld.com (Feb 6th) - Honeywell International Inc. says a former employee has disclosed sensitive information relating to 19,000 of the company's U.S. employees. Honeywell discovered the information being published on the Web on Jan. 20 and immediately had the Web site in question pulled down, said company spokesman Robert Ferris.
5) Networkworld.com (Jan 27th) - About 365,000 hospice and home health care patients in Oregon and Washington are being notified about the theft of computer backup data disks and tapes late last month that included personal information and confidential medical records.
-----------------------------------------------
As you can tell, data loss comes in many forms.
Thieves stealing backup tapes, normal people making mistakes, old employees taking some anger out for kicks, and organized groups of hackers (perhaps even foot soldiers of Russian organized crime group).
Now just think about all the cases that are not reported....yeah - exactly.
WDRaptor X - World's First Clear Cover Hard Drive
Ok, it isn't the "first" hard drive to have a window, but it is the first to be available right from the manufacturer.
The old way of doing the HD windows included a zip-lock bag, time, glass, cutting tools and other equipment to open the drive. Sometimes this process would kill the drive, sometimes it wouldn’t. It is important to also note that this reduces the drives shielding from magnetic damage - this may have kept the WDRaptor X window small.
In college, I was all into hardware modding. I created a custom windowed CD-ROM, created a dual-windowed aluminum case, glow-in-the-dark cables and created my own custom CPU fan. Ahh, those were the days. Once you could buy a windowed computer with lights at CompUSA, I knew it was time to move on.
Pre-Order your WDRaptor X 150GB 10k RPM for $350
Toms Hardware has a write-up on the new WDRaptor X as well.
The old way of doing the HD windows included a zip-lock bag, time, glass, cutting tools and other equipment to open the drive. Sometimes this process would kill the drive, sometimes it wouldn’t. It is important to also note that this reduces the drives shielding from magnetic damage - this may have kept the WDRaptor X window small.
In college, I was all into hardware modding. I created a custom windowed CD-ROM, created a dual-windowed aluminum case, glow-in-the-dark cables and created my own custom CPU fan. Ahh, those were the days. Once you could buy a windowed computer with lights at CompUSA, I knew it was time to move on.
Pre-Order your WDRaptor X 150GB 10k RPM for $350
Toms Hardware has a write-up on the new WDRaptor X as well.
US DoD - Quadrennial Defense Review Report
Recently, the United States Dept of Defense released it Quadrennial Defense Review Report (pdf).
The report singles out India, Russia and China as "major and emerging powers" in Asia. However China is singled out on page 29 has the "greatest potential to compete militarily with the United States and field disruptive military technologies that could over time offset traditional US military advantage abset US counter strategies.
I don't see this sentence as unreasonable. The DoD is making any assessment of powers in the region and China is one of the biggest and less understood by the US government.
But China doesn't seem to really like the words used in the report.
See the Feb 3rd, QDR Pentagon Briefing in video or plain audio.
The report singles out India, Russia and China as "major and emerging powers" in Asia. However China is singled out on page 29 has the "greatest potential to compete militarily with the United States and field disruptive military technologies that could over time offset traditional US military advantage abset US counter strategies.
I don't see this sentence as unreasonable. The DoD is making any assessment of powers in the region and China is one of the biggest and less understood by the US government.
But China doesn't seem to really like the words used in the report.
See the Feb 3rd, QDR Pentagon Briefing in video or plain audio.
Monday, February 6, 2006
Internet Neutrality - US Senate Commerce Committee
Today the US Senate Committee on Commerce, Science & Transportation held a full hearing on the subject of "Net Neutrality".
I was unable to watch this hearing because of work, but I will be watching for updates.
This issue was summarized in a Jan 18 blog titled "The Fight for Internet Neutrality Principles".
During the week in Jan, the blogosphere was filled with stories about it - Jeff Pulver blog and of course Vint Cerf's Official Google blog.
I was unable to watch this hearing because of work, but I will be watching for updates.
This issue was summarized in a Jan 18 blog titled "The Fight for Internet Neutrality Principles".
During the week in Jan, the blogosphere was filled with stories about it - Jeff Pulver blog and of course Vint Cerf's Official Google blog.
Bluetooth Stack Vuln on Sony/Ericsoon Cellphones
This is exactly why I have bluetooth disabled on my black Moto. Just posted to the FD Security list.
------------------------------------
[Software affected] Bluetooth Stack on Sony/Ericsson cell phones
[Version] Sony/Ericsson K600i, V600i, W800i, T68i and certainly other models
[Impact] Bluetooth Stack Denial of Service (may be more - may be a rootkit :) - Phone DoS (reboot or shutdown) - White screen bug (freeze sleeping)
[Credits] Pierre Betouin - pierre.betouin@infratech.fr - Bug found with BSS v0.6 GPL fuzzer (Bluetooh Stack Smasher)
BSS could be downloaded on http://www.secuobs.com/news/05022006-bluetooth10.shtml
[Vendor] notified now
[Original advisory]
http://www.secuobs.com/news/05022006-bluetooth7.shtml#english
http://www.secuobs.com/news/05022006-bluetooth7.shtml#french
[PoC] download it on http://www.secuobs.com/news/05022006-bluetooth6.shtml
[PoC usage]
# ./reset_display_sonyericsson 00:12:EE:XX:XX:XX
[Details]
A short raw L2CAP packet such as :
08 01 01 00
It represents the following L2CAP header fields :
code L2CAP_ECHO_REQ;
ident 1
length 1
The "real" packet sent is, in fact, 4 bytes long.
The DoS can be triggered when the length sent in the L2CAP field is equal to the real length minus 3 (which is the size of the L2CAP header here).
------------------------------------
------------------------------------
[Software affected] Bluetooth Stack on Sony/Ericsson cell phones
[Version] Sony/Ericsson K600i, V600i, W800i, T68i and certainly other models
[Impact] Bluetooth Stack Denial of Service (may be more - may be a rootkit :) - Phone DoS (reboot or shutdown) - White screen bug (freeze sleeping)
[Credits] Pierre Betouin - pierre.betouin@infratech.fr - Bug found with BSS v0.6 GPL fuzzer (Bluetooh Stack Smasher)
BSS could be downloaded on http://www.secuobs.com/news/05022006-bluetooth10.shtml
[Vendor] notified now
[Original advisory]
http://www.secuobs.com/news/05022006-bluetooth7.shtml#english
http://www.secuobs.com/news/05022006-bluetooth7.shtml#french
[PoC] download it on http://www.secuobs.com/news/05022006-bluetooth6.shtml
[PoC usage]
# ./reset_display_sonyericsson 00:12:EE:XX:XX:XX
[Details]
A short raw L2CAP packet such as :
08 01 01 00
It represents the following L2CAP header fields :
code L2CAP_ECHO_REQ;
ident 1
length 1
The "real" packet sent is, in fact, 4 bytes long.
The DoS can be triggered when the length sent in the L2CAP field is equal to the real length minus 3 (which is the size of the L2CAP header here).
------------------------------------
Independent Security Testing for DRM Software
It appears that SunComm has agreed to submit all future versions of its MediaMax DRM software for independent security testing in an effort to weed out any further vulnerabilities.
For those just tuning in to the story, late last year SunComm's MediaMax software was discovered covertly installing itself and leaving PCs vulnerable to attack.
SunComm hopes to reduce any future legal problems by using the independent software review model.
From the BBC article, it sounds like that testing might be headed by the EFF, which is good news. The EFF will look for security issues but will keep customer rights in mind at the same time.
But shouldn't the big record labels also have customer rights in mind? I would have said "yes" before the whole XCP/MediaMax incident. However it became very clear that security of their customers was pretty low on the DRM list of "things to do".
Will First 4 Internet, makers of the XCP DRM, make the same "good faith" move??
Should SunComm do this work in-house instead of using a non-profit group to secure their software??
Either way, this good is a positive step in protecting customer rights in the face growing DRM use.
For those just tuning in to the story, late last year SunComm's MediaMax software was discovered covertly installing itself and leaving PCs vulnerable to attack.
SunComm hopes to reduce any future legal problems by using the independent software review model.
From the BBC article, it sounds like that testing might be headed by the EFF, which is good news. The EFF will look for security issues but will keep customer rights in mind at the same time.
But shouldn't the big record labels also have customer rights in mind? I would have said "yes" before the whole XCP/MediaMax incident. However it became very clear that security of their customers was pretty low on the DRM list of "things to do".
Will First 4 Internet, makers of the XCP DRM, make the same "good faith" move??
Should SunComm do this work in-house instead of using a non-profit group to secure their software??
Either way, this good is a positive step in protecting customer rights in the face growing DRM use.
Super Bowl XL Commercials on Google Video
Just in case you missed a commerical or two yesterday, Google is hosting them all on a special Google Video page.
Sunday, February 5, 2006
Friday, February 3, 2006
Keep your Applications Updated or else....
1) If you aren't on Winamp 5.13 yet, get it now. Remember the extremely critical system access exploit that was released for it. Well the exploit posted for this vuln is not being used to push spyware. It didn't take very long.
2) Get your Firefox updates. Firefox 1.5.0.1 was released recently. It fixes several highly ciritical security issues. Improvements include - better support for OS X, several memory leaks are fixed and several other security enhancements.
3) Recently, some vulnerabilities have been reported in Thunderbird, which could result in compromise of the user's system. Recommended workaround is to disable JavaScript.
4) Disabling JavaScript is also the only workaround for the vulnerabilities reported in the Mozilla suite as well.
2) Get your Firefox updates. Firefox 1.5.0.1 was released recently. It fixes several highly ciritical security issues. Improvements include - better support for OS X, several memory leaks are fixed and several other security enhancements.
3) Recently, some vulnerabilities have been reported in Thunderbird, which could result in compromise of the user's system. Recommended workaround is to disable JavaScript.
4) Disabling JavaScript is also the only workaround for the vulnerabilities reported in the Mozilla suite as well.
Word Around the Campfire is...
Well, it is friday. As FatBoy Slim said - the weekend starts here....
1) eWeek.com is reporting that the WMF exploit was being sold in the middle of Dec 2005 on the Russia computer underground for $4,000 a pop.
2) Blue Boar posted information about a new project on the FunSec Mailing list this morning. The "mwcollect Alliance". Mwcollect is honeypot type program that can be ran in Linux or BSD to collect worms/bots and other bad stuff from right off the internet. Pretty cool sounding. After I move and get settled into my new place, I might have to play around with mwcollect.
3) Today is Feb 3rd. The day that CME-24 is set to attack full force. There have been initals reports from Indian about large volumes of e-mails and larger than normal to support centers, but initals reports always sound worse than truth.
Randy Abrams has a great blog about the work put into fighting the CME-24 threat. The TISF Blackworm task force worked very hard to reduce the damage worldwide. Good work guys. That "good work guys" also goes to Microsoft. =)
Watch for updates on the following sites.
ISC SANS & SecuriTeam Blog
While the global infection number of 300k isn't alot, it might hurt some of the top infected nations. We can only wait and see...no matter the outcome. We will still all be back at work on Monday - maybe even with a "case of the Mondays"
1) eWeek.com is reporting that the WMF exploit was being sold in the middle of Dec 2005 on the Russia computer underground for $4,000 a pop.
2) Blue Boar posted information about a new project on the FunSec Mailing list this morning. The "mwcollect Alliance". Mwcollect is honeypot type program that can be ran in Linux or BSD to collect worms/bots and other bad stuff from right off the internet. Pretty cool sounding. After I move and get settled into my new place, I might have to play around with mwcollect.
3) Today is Feb 3rd. The day that CME-24 is set to attack full force. There have been initals reports from Indian about large volumes of e-mails and larger than normal to support centers, but initals reports always sound worse than truth.
Randy Abrams has a great blog about the work put into fighting the CME-24 threat. The TISF Blackworm task force worked very hard to reduce the damage worldwide. Good work guys. That "good work guys" also goes to Microsoft. =)
Watch for updates on the following sites.
ISC SANS & SecuriTeam Blog
While the global infection number of 300k isn't alot, it might hurt some of the top infected nations. We can only wait and see...no matter the outcome. We will still all be back at work on Monday - maybe even with a "case of the Mondays"
Thursday, February 2, 2006
CME-24 Worm - The Black Cloud
Well, tomorrow is the 3rd. The payload trigger for CME-24.
As it stands right now - India, Peru, Italy and Turkey will be hit harder than the US.
On Jan 27th, I blogged about how Microsoft's was not going to release an updated Windows Malicious Software Removal Tool before "D-Day". They stated this again on Jan 30th in this Anti-Malware Engineering Team blog, but they do remind us that the Windows Live Safety Center Beta will remove the threat.
They could had just said - "Yeah, we can save some of you, like we did for Zotob, but we really need you to test our new beta products - Safety Center and OneCare. Thanks".
I agree that Safety Center is a great free website. I will all my friends about it. It provides much more than just malware removal as well. Microsoft created it and they did a very good job.
But why not take the extra step while there was still time?
Remember they rushed out a new version of the Windows Malicious Software Removal Tool in August for the Zotob worm. Why not now? It is true that 300,000 people isn't anywhere near the numbers that could have been attacked by Zotob, but still.
Why not now? Microsoft, please tell me it isn't to get people on your beta programs...please...get me something. Anything.
As it stands right now - India, Peru, Italy and Turkey will be hit harder than the US.
On Jan 27th, I blogged about how Microsoft's was not going to release an updated Windows Malicious Software Removal Tool before "D-Day". They stated this again on Jan 30th in this Anti-Malware Engineering Team blog, but they do remind us that the Windows Live Safety Center Beta will remove the threat.
They could had just said - "Yeah, we can save some of you, like we did for Zotob, but we really need you to test our new beta products - Safety Center and OneCare. Thanks".
I agree that Safety Center is a great free website. I will all my friends about it. It provides much more than just malware removal as well. Microsoft created it and they did a very good job.
But why not take the extra step while there was still time?
Remember they rushed out a new version of the Windows Malicious Software Removal Tool in August for the Zotob worm. Why not now? It is true that 300,000 people isn't anywhere near the numbers that could have been attacked by Zotob, but still.
Why not now? Microsoft, please tell me it isn't to get people on your beta programs...please...get me something. Anything.
Blue Light Reduces Melatonin Production
I was scanning over my Google Reader this morning and found this very cool Digg.com article. A small study, sponsored by National Space Biomedical Research Institute, suggest that subjects exposed to short-wavelenght light (aka blue light), are immediately perked up.
Very interesting. Back in a former part of my life, I was very into chromotherapy and Ayurvedic medicine in general. I am Pitta for the record. ;)
Anyways, lets get into the details of this blue idea.
1) In chromotherapy, Red is said to increase the pulse rate, to raise the blood pressure, and the rate of breathing. Perhaps this is why we always see red lights on planes in military movies, who knows.
2) Back in 2001, neuroscientists at Jefferson Medical College clarified how the human eyes uses light to regulate melatonion production. George Brainard, Ph.D. was a professor of neurology at Jefferson Medical College of Thomas Jefferson University in Philadelphia.
Remember that name ;)
Melatonin is a hormone produced in the pineal gland and also by the retina. It is commonly used against insomnia, jet lag and other types of sleep misalignments. In simple terms, melatonin makes you sleepy.
In the study, they looked at the effects of different wavelengths of light on 72 healthy volunteers, exposing them to nine different wavelengths, from indigo to orange. Subjects were brought into the laboratory at midnight, when melatonin is highest. The subjects’ pupils were dilated and then they were blindfolded for two hours. Blood samples were drawn.
Next, each person was exposed to a specific dose of photons of one light for 90 minutes, and then another blood sample was drawn. Wavelengths of blue light had the highest potency in causing changes in melatonin levels, he explains.
So bascially, certain light colors effects the production of melatonin in different ways. Very cool.
Now, if they can find the light color that inhibits serontonin reuptake in the synaptic terminls of neurons. That would be cool. Colored light should be much better on the body than ecstasy (MDMA), cocaine, and man-made TCAs.
Very interesting. Back in a former part of my life, I was very into chromotherapy and Ayurvedic medicine in general. I am Pitta for the record. ;)
Anyways, lets get into the details of this blue idea.
1) In chromotherapy, Red is said to increase the pulse rate, to raise the blood pressure, and the rate of breathing. Perhaps this is why we always see red lights on planes in military movies, who knows.
2) Back in 2001, neuroscientists at Jefferson Medical College clarified how the human eyes uses light to regulate melatonion production. George Brainard, Ph.D. was a professor of neurology at Jefferson Medical College of Thomas Jefferson University in Philadelphia.
Remember that name ;)
Melatonin is a hormone produced in the pineal gland and also by the retina. It is commonly used against insomnia, jet lag and other types of sleep misalignments. In simple terms, melatonin makes you sleepy.
In the study, they looked at the effects of different wavelengths of light on 72 healthy volunteers, exposing them to nine different wavelengths, from indigo to orange. Subjects were brought into the laboratory at midnight, when melatonin is highest. The subjects’ pupils were dilated and then they were blindfolded for two hours. Blood samples were drawn.
Next, each person was exposed to a specific dose of photons of one light for 90 minutes, and then another blood sample was drawn. Wavelengths of blue light had the highest potency in causing changes in melatonin levels, he explains.
So bascially, certain light colors effects the production of melatonin in different ways. Very cool.
Now, if they can find the light color that inhibits serontonin reuptake in the synaptic terminls of neurons. That would be cool. Colored light should be much better on the body than ecstasy (MDMA), cocaine, and man-made TCAs.
Wednesday, February 1, 2006
Humor: Adages of the Internet
According to Wikipedia, adages are short, but memorable sayings, which hold some important fact of experience that is considered true by many people, or it has gained some credibility through its long use.
I was reading up on Moore's Law and started to think about all the weird Murphy's Law variants that my friends and I used in college. So, I started to dig. Wikipedia has a pretty good list going and I can only laugh when I read them.
Here are some of the better ones:
I was reading up on Moore's Law and started to think about all the weird Murphy's Law variants that my friends and I used in college. So, I started to dig. Wikipedia has a pretty good list going and I can only laugh when I read them.
Here are some of the better ones:
- Murphy's Law - "If anything can go wrong, it will." - So true. I first heard about this law in college programming but by the end of college, it make so much sense (on many different levels)
- Occam's Razor - "Given two equally predictive theories, choose the simpler." - Perfect example of not following this? Steve Gibson and the WMF exploit. Need I say more...
- Hanlon's Razor - "Never attribute to malice that which can be adequately explained by stupidity. " - It is commonly said that people are the weakest security link, but why? Well this Jinx.com t-shirt says it all.
- Parkinson's Law - "Work expands so as to fill the time available for its completion. " - Anyone that has ever worked in the corporate world, knows this is true. =)
- Godwin's Law - "As an online discussion grows longer, the probability of a comparison involving Nazis or Hitler approaches one." - Anyone that has watched a security mailing list has seen this happen right in front of their eyes.
- Amara's Law - "We tend to overestimate the effect of a technology in the short run and underestimate the effect in the long run. " - Happens all the time.
I am sure there are more floating around the internet today. Anyone have any to add??
Fyodor on Nmap 4.00
Great Fyodor interview over at SecurityFocus. He goes over several of the new features in detail. Very good read for those that love Nmap.
Former SoC student Zhao Lei is working on the second generation of OS detection, which will use many new tricks. Nmap 4.00 uses application heuristics along with TCP/IP fingerprinting. Cool improvement.
Former SoC student Zhao Lei is working on the second generation of OS detection, which will use many new tricks. Nmap 4.00 uses application heuristics along with TCP/IP fingerprinting. Cool improvement.
Subscribe to:
Posts (Atom)