Embassy leaks highlight pitfalls of Tor

Found on Security Focus on Monday, 10 September 2007
Browse Internet

A Swedish security professional that posted the usernames and passwords for 100 e-mail accounts belonging to various nations' embassies and political parties revealed on Monday that he exploited the improper usage of the Tor network -- a distributed system of computers that anonymizes the source of network traffic -- to collect the information.

In total, Egerstad collected the e-mail credentials of more than 1,500 government workers, corporate employees and private individuals using the Tor network, he said. Because the technique is already known, Egerstad decided that fully disclosing the list of e-mail accounts and passwords for 100 of the government accounts was the best way to bring more attention to the issue.

Following the posting of the information to his Web site, a few countries did respond. India, Iran and Uzbekistan were friendly and supported the manner in which he disclosed the issue, he said. China filed a criminal complaint over the posting, while U.S. authorities complained to his Texas Web provider and had his original Web site taken down, Egerstad said.

He pointed to exit nodes run by hacking groups as potential ways of getting information for identity fraud, while massive nodes located in Washington D.C. and at the Space Research Institute in Russia are possible intelligence gathering tools for the U.S. and Russian governments, respectively.

That's not a bug in Tor per se. The traffic is only encrypted while it's in the onion network, but decrypted as soon it does out to the usual Internet. Tor helps making you anonymous, but it doesn't remove the need for encryption, like SSL for e-mail and websites. It may be easy to blame the technology, but here it's your own fault.

419Eater DDoS'd?

Found on Spamnation on Saturday, 08 September 2007
Browse Internet

We've had a report that the popular scambaiting site 419Eater and the anti-scam site Scamwarners are the latest anti-spam sites to fall victim to a distributed denial of service (DDoS) attack. Both sites are down at this time.

There's good reason to believe that the Zhelatin (Storm Worm) gang have been behind a number of other DDoS attacks this year, including an attack against anti-spam sites and download sites operated by a rival spam gang.

Other attacks have targeted blacklists, anti-malware and -spyware sites, and general 'umbrella' sites like Spamhaus. (Although Spamhaus is probably under attack 365 days a year, so it may be hard to distinguish an attack from background noise). The current attack, with its focus on anti-scam sites, seems to fit that pattern.

Stormworm once again. You might want to curse those behind it, but you also have to face the reality: as long as enough people (and obviously there are way more than just a few) who are stupid enough to buy from spam or fall for pennystocks, this will continue. You can call for tougher laws against spammers and for more restrictions for Internet connections, but this won't help. You need also take care of the other end: go after those selling fake pills and make changes to the stock trading.

Storm more powerful than supercomputers

Found on itnews on Thursday, 06 September 2007
Browse Internet

The Storm worm botnet has grown so massive and far-reaching that it easily overpowers the world's top supercomputers.

"In terms of power, the botnet utterly blows the supercomputers away," said Matt Sergeant, chief anti-spam technologist with MessageLabs, in an interview. "If you add up all 500 of the top supercomputers, it blows them all away with just 2 million of its machines. It's very frightening that criminals have access to that much computing power, but there's not much we can do about it."

Sergeant said researchers at MessageLabs see about 2 million different computers in the botnet sending out spam on any given day, and he adds that he estimates the botnet generally is operating at about 10 percent of capacity.

"We've seen spikes where the owner is experimenting with something and those spikes are usually five to 10 times what we normally see," he said, noting he suspects the botnet could be as large as 50 million computers. "That means they can turn on the taps whenever they want to."

The botnet actually is attacking computers that are trying to weed it out. It's set up to launch a distributed denial-of-service attack against any computer that is scanning a network for vulnerabilities or malware.

The more I read about the Storm network, the more impressive it becomes.

China hacked into Pentagon computer network

Found on PhysOrg on Monday, 03 September 2007
Browse Internet

China's military successfully hacked into the Pentagon's computer network, it was reported reported Tuesday, although the Chinese government dismissed the accusation as groundless.

While the Pentagon declined to say who was behind the hacking, which led to the shutdown of a computer system serving the office of Defence Secretary Robert Gates, officials told the paper it was China's People's Liberation Army.

"Against the background of good momentum towards the improvement of Sino-US military ties, some people are making groundless accusations that the Chinese military is attacking the networks of the US defence department," Jiang told journalists when asked about the Financial Times report.

Despite what officials admit, it should be clear that every country has some espionage programs running. Just remember Alexander Litwinenko.

Web TV sparks bandwidth crisis fears

Found on IT News on Saturday, 18 August 2007
Browse Internet

The internet is heading for a crash unless it increases its bandwidth capabilities, according to an analyst report.

Stan Schatt, research director at ABI, told Ars Technica: "Uploading bandwidth is going to have to increase, and the cable providers are going to get killed on bandwidth as HD programming becomes more commonplace."

Cisco found that American video websites currently transmit more data per month than the entire amount of traffic sent over the internet in 2000.

Orange revealed in an ASA investigation into adverts for its unlimited broadband service that as of 31 March 2007 only 1.09 percent of customers exceeded the fair usage policy limitation for its service.

Orange said that it logged a breach of fair usage as being more than 40GB in March 2007.

If an old highway is jammed on a daily basis, people call for new lanes to allow more traffic, not for less cars. However, if the tubes are getting filled, those in charge call for less traffic and a ban on traffic-intensive applications like Bittorrent. That's like driving happily on a bumpy road for the rest of your life. Unlimited bandwidth is advertised on every corner, but as soon as someone makes use of it, problems arise. What are 40GB/month these days? Not much. I've been below 40GB only twice this year; usually, traffic gets close to 50GB every month.

Comcast Throttles BitTorrent Traffic

Found on Torrentfreak on Friday, 17 August 2007
Browse Internet

Over the past weeks more and more Comcast users started to notice that their BitTorrent transfers were cut off. Most users report a significant decrease in download speeds, and even worse, they are unable to seed their downloads.

It is reported that Comcast is using an application from Sandvine to throttle BitTorrent traffic. Sandvine breaks every (seed) connection with new peers after a few seconds if it's not a Comcast user.

Although BitTorrent protocol encryption seems to work against most forms of traffic shaping, it doesn't help in this specific case. Setting up a secure connection through VPN or over SSH seems to be the only solution.

One of the ISPs that joined our discussions said: "The fact is, P2P is (from my point of view) a plague - a cancer, that will consume all the bandwidth that I can provide. It's an insatiable appetite.", and another one stated: "P2P applications can cripple a network, they’re like leaches. Just because you pay 49.99 for a 1.5-3.0mbps connection doesn't mean your entitled to use whatever protocols you wish on your ISP's network without them provisioning it to make the network experience good for all users involved."

No, when I pay 49.99 for a connection offered without limitations, this means I can use it without limitations. If the ISP doesn't like Bittorrent or full bandwidth usage, he needs to point that out in his Terms of Service. Then I simply won't sign up with that ISP. But wait, there's the problem for the ISP, right? If he says what users cannot do, users won't sign up. So instead, shut up and cripple their connection once you've got them.

A Campaign to Block Firefox Users?

Found on Slashdot on Thursday, 16 August 2007
Browse Internet

A website is aiming at blocking Firefox users. This because a fraction of the Firefox users installed an Ad Blocker and are therefor 'stealing money' from website owners that use ads. They recommend using IE, Opera or IE tab. From the site: 'Demographics have shown that not only are FireFox users a somewhat small percentage of the internet, they actually are even smaller in terms of online spending, therefore blocking FireFox seems to have only minimal financial drawbacks, whereas ending resource theft has tremendous financial rewards for honest, hard-working website owners and developers.'

Hm, I use a rather old IE, but ads are blocked perfectly. My hosts file is filled with hostnames of adservers, and a local proxy does a nice job filtering annoying scripts and ads. If this guy doesn't want me too to visit his site, I happily add it to my blocklist.

Google Rolls Out Storage Services

Found on Forbes on Friday, 10 August 2007
Browse Internet

Web search and Internet services company Google Inc. on Friday began selling expanded online storage, targeted for users with large picture, music or video file collections.

The prices range from $20 per year for 6 gigabytes of online storage; $75 per year for 25 gigabytes of storage; $250 per year for 100 gigabytes of storage; and $500 per year for 250 gigabytes of storage.

Google shares fell $2.08 to $512.65 in afternoon trading.

First of all, it's pretty expensive; you can get way more storage with a normal harddrive. Granted, it's not online, but there's always a USB version. Second, I won't upload a single byte to Google. That company proved more than once that it doesn't care that much about privacy.

US Senators call for universal Internet filtering

Found on Press Sec on Wednesday, 25 July 2007
Browse Internet

US senators today made a bipartisan call for the universal implementation of filtering and monitoring technologies on the Internet in order to protect children at the end of a Senate hearing for which civil liberties groups were not invited.

Commerce Committee Chairman Daniel K. Inouye (D-Hawaii) and Senate Commerce, Science, and Transportation Committee Vice Chairman Ted Stevens (R-Alaska) both argued that Internet was a dangerous place where parents alone will not be able to protect their children.

"While filtering and monitoring technologies help parents to screen out offensive content and to monitor their child’s online activities, the use of these technologies is far from universal and may not be fool-proof in keeping kids away from adult material," Sen. Inouye said.

The measures they are calling for include directing the Federal Communications Commission to identify industry practices "that can limit the transmission of child pornography" and requiring the Federal Trade Commission to form a working group to identify blocking and filtering technologies in use and "identify, what, if anything could be done to improve the process and better enable parents to proactively protect their children online."

I can't hear it anymore. Just because parents fail to look after their kids, everybody needs to be monitored? This "sweet" filtering solution will fail as soon as proxies and encryption comes into play. However, by using the old "protect children" approach, politicians can introduce monitoring more easily, because everybody who is against it "automatically" is a child molester. After such a surveillance has been established, it's easy to add new thngs to monitor, until everybody is made of glass.

ISP Seen Breaking Internet Protocol

Found on Wired on Monday, 23 July 2007
Browse Internet

Internet service provider Cox Communications is reportedly diverting attempts to reach certain online chat channels and redirecting them to a server that attempts to remove spyware from the computer.

Specifically, Cox's DNS server is responding to a domain name request for an Internet Relay Chat server. Instead of responding with the correct IP address for the server, Cox sends the IP address of its own IRC server (70.168.70.4). That server then sends commands to the computer that attempt to remove malware.

Though clever, the tactic is being heavily debated by networking experts on the NANOG mailing list, some of whom question the effectiveness of the technique and who question whether blocking access to the channels for all users (by breaking the DNS protocol) in order to stop some malware is the appropriate solution.

Even if my computer is infected, an ISP has no legal basis to attempt to fix it. That's as illegal as planting the zombie. This reminds me of the "Make Love Not Spam" project and some counter-virus-viruses; all not legal. Notifying? Perhaps, but that would show that the ISP monitors my connection for bot-related commands; something that doesn't go along with net neutrality. And honestly, if I would be a developer of zombiekits, my new update would wreak havoc on the computer as soon as someone tries to clean it with "uninstall" or "remove"; the machine is lost if it succeeds, so why not make it messy for whoever attempted to cleaned it?