Microsoft shutters Windows private folders

Found on CNet News on Friday, 14 July 2006
Browse Software

Following an outcry from corporate customers, Microsoft is removing an add-on feature to Windows that allowed users to create password-protected folders.

The feature was introduced as a free download last week. Almost immediately, people raised questions over how businesses would grapple with the ability of individual workers to encrypt their data.

"Oh great, have they even thought about the impact this could have on enterprises. I'm already trying to frantically find information on this product so that A) I can block to all our desktops and B) figure out how we then support it when users inevitably lose files. I can see the benefit in this product for home users, but it's a bit of a sloppy release by Microsoft," Stuart Graham said in a posting on Windows Server-related site MSBlog.

Now come on. All the time, people whine about MS software being insecure and bad with data protection; but when encryption is added, they whine too. I guess we'll be reading more news about lost laptops with the personal data of thousands of people in the future. Plus, there's always TrueCrypt.

File-swappers' identities protected by Dutch court

Found on The Register on Thursday, 13 July 2006
Browse Filesharing

A Dutch appeals court has thwarted attempts by the Dutch anti-piracy organisation BREIN to get the identities of file-sharers from five ISPs, including Wanadoo and Tiscali.

The court found that the manner in which IP addresses were collected and processed by US company MediaSentry had no lawful basis under European privacy laws. A lower court in Utrecht had reached a similar conclusion last year.

Last year, expert witnesses at Delft University of Technology criticised MediaSentry's software for being too limited and simplistic. For instance, MediaSentry took filenames in Kazaa at face value. More importantly, the software scans all the content of the shared folder on the suspect's hard disk. In that process, it breached privacy laws.

Be simple, think simple. That's what the entertainment industry does. All Kazaa users (I'm surprised there still are some) should fill their shared folder with thousands of faked music files. This could mess up MediaSentry's system; well, Kazaa too, but it died long ago already.

Should music downloads be free?

Found on BBC News on Wednesday, 12 July 2006
Browse Internet

A group representing the UK's independent music labels says it wants to change the way we pay for music online.

They say music could, in effect, be free to customers - with payment collected as part of their internet subscription.

Wenham says she envisions a two-tier system for music fans.

Customers would have access to any music track they wanted, delivered in real-time over the internet, as part of their broadband connection.

However, they would have to make separate payments for "premium content", such as exclusive performances, or to keep permanent copies of songs offline.

Most importantly, they want Internet Service Providers (ISPs) to pay for music distributed over their services.

ISPs had been contacted, he added, but "they don't reply much".

In other words, they try to say that the downloads are free because I pay more to my ISP for covering those costs? That doesn't sound much like "free". Plus, all those ideas about permanent copies: if I can listen to it, I can record it (or simply save the stream) unless they come up with a restrictive DRM player. However, people will ask for open formats, like MP3. In my opinion, this idea will fail.

MySpace may face legislative crackdown

Found on CNet News on Tuesday, 11 July 2006
Browse Politics

Politicians on Tuesday accused MySpace.com and other social-networking sites of failing to protect minors from sexual predators and other malign influences and said a legislative crackdown may be necessary.

"MySpace.com has been a center of drug activity, of gang activity, and of Internet predators," said Rep. Mark Kirk, an Illinois Republican.

"If we could save one child, then it's worth it--that one child, that innocent child who may fall prey during the school hours because the legislation wasn't enacted," said David Zellis, an assistant district attorney in Bucks County, Penn., who testified at the hearing.

Yes, elections are coming and politicians are out hunting for votes again. Zellis is so obviously fishing for votes that it makes me cringe. And no, it's not worth it.

Terror accused 'face US injustice'

Found on Ananova on Monday, 10 July 2006
Browse Legal-Issues

Two terrorist suspects wanted by the US Government would be exposed to "a real risk of fundamental injustice and discriminatory treatment" if extradited to America, the High court has been told.

The QC told Lord Justice Laws, sitting with Mr Justice Walker, that the men also faced the risk of extraordinary rendition - the process of removing terrorist suspects to third countries for interrogation - and being held in solitary confinement.

He said they were in danger of being indefinitely detained under a military order applying to foreign citizens or tried and sentenced by a military commission as enemy combatants in what would amount to "a flagrant denial of justice".

The worst thing that can happen today to you is being accused of supporting terrorism; no matter if you do or not.

British music industry targets ISPs

Found on Ars Technica on Sunday, 09 July 2006
Browse Legal-Issues

Stepping up its campaign against illicit file-swappers, the British Phonographic Industry (BPI) has moved from targeting individual users to putting pressure on their ISPs. The BPI has just announced that 59 accounts suspected of large-scale piracy have been reported to two ISPs, which are expected to deal with the issue.

The ISPs offer no guarantee that anything will be done, but the BPI wants to move faster against suspected file-swappers than is possible in the court system.

Looking at their court records, one can see why they would prefer to change strategy. The BPI has filed only 139 charges against file uploaders—merely a drop in the bucket. Only four of these cases have actually proceeded to trial, while another 111 have been settled out of court for a few thousand pounds each.

The BPI now gathers IP addresses and supporting documentation on egregious offenders and simply turns it over to the ISPs for action.

Neither Tiscali nor Cable & Wireless will be excited about devoting resources of their own to sifting through complaints from the BPI, but neither do the ISPs want to be portrayed as looking the other way while users hoist the Jolly Roger on their networks.

I prefer an ISP who hoists the Jolly Roger instead of bending over and serving the entertainment industry. They just found another way to save money: let the logfiles grow and make someone else do your work, instead of going to court by yourself.

Explosives stolen from US defence facilities

Found on New Scientist on Saturday, 08 July 2006
Browse Various

Things have a habit of going missing from US defence labs.

In a 2005 audit, hundreds of conventional explosives at Sandia National Laboratory in Albuquerque, New Mexico, could not be accounted for, says a report released last week by the US Department of Energy's Inspector General.

Plastic and powdered explosives, detonators and rocket motors were all missing. "Extremely dangerous and potentially destructive materials may be subject to theft or diversion," says the report, claiming that neither Sandia nor Los Alamos National Lab in New Mexico has adequate controls or regularly tests the stability and safety of ageing explosives.

They are particularly worried about explosives stored at poorly guarded, off-site facilities. In past years, computer hard drives, including one containing nuclear secrets, have gone missing from US defence labs.

And people wonder where all those terrorists get their materials from.

FBI plans new Net-tapping push

Found on CNet News on Friday, 07 July 2006
Browse Internet

The FBI has drafted sweeping legislation that would require Internet service providers to create wiretapping hubs for police surveillance and force makers of networking gear to build in backdoors for eavesdropping, CNET News.com has learned.

The draft bill would place the FBI's Net-surveillance push on solid legal footing. At the moment, it's ensnared in a legal challenge from universities and some technology companies that claim the Federal Communications Commission's broadband surveillance directives exceed what Congress has authorized.

Require any manufacturer of "routing" and "addressing" hardware to offer upgrades or other "modifications" that are needed to support Internet wiretapping.

Authorize the expansion of wiretapping requirements to "commercial" Internet services including instant messaging if the FCC deems it to be in the "public interest."

Eliminate the current legal requirement saying the Justice Department must publish a public "notice of the actual number of communications interceptions" every year.

Say hello to the police state. In the end, this means you can only use products which are not created for the US. It's easier to switch to open source software; the tricky part is to get unaltered network hardware. Additionally, you should also switch to the strongest encryption to protect your privacy. Perhaps laws will be tweaked a bit more so it would be illegal to use encryption without having a license for it.

Copy protection hole in Blu-ray and HD DVD movies

Found on Heise Security on Thursday, 06 July 2006
Browse Various

The Blu-ray Disc and HD DVD are new data carriers for high-resolution motion pictures. For fear of piracy, Hollywood had the developers install a cornucopia of copy prevention mechanisms on them. For instance, the film data on the disks are protected by means of the Advanced Access Content System (AACS). Digital output only reaches the monitor via connections encrypted by means of High Bandwidth Digital Content Protection (HDCP).

Computer magazine c't has discovered that the first software players running on Windows XP allow screenshots of the movies to be created in full resolution. To do so, you only need to press the Print key on your keyboard while the movie is running. Such a screenshot function could then be automated to produce copies of HD movies both from Blu-ray Discs and from HD DVDs picture by picture.

When asked to comment, Toshiba confirmed the security hole found by c't, which affects the computers already sold, and announced updates for the player software and graphics card driver. These new software versions should disable the screenshot function.

Step by step, legitimate options are removed for the sake of content protection; that's like removing the shift-key so users cannot bypass the autorun function when they insert an infected "audio-cd". In the worst case, when your Windows is crippled so much that you cannot copy anything, you run it virtualized on a Linux system and do the recording from there. The "protection" stays inside the gues OS, and the recording will be done through the host OS.

FBI Computer System So Screwed Up

Found on Techdirt on Wednesday, 05 July 2006
Browse Computer

The incredible saga of the FBI's overbudget $500 million computer system that needed to be scrapped after it turned out it was useless in fighting terrorism apparently had some other problems as well. The news has come out today that a contractor hired to work on the computer system was so frustrated by the bureaucracy he needed to go through to do something as simple as adding a printer to the network, that he used some free internet tools to breach the network and get access to the usernames and passwords of 38,000 FBI employees, including director Robert Mueller. The contractor pleaded guilty to various charges, though even the FBI admits that he only appears to have done what he did to actually get work done. It's not clear which part is more disturbing: that the FBI's computer system was so easily hacked, or that the best way to get work done at the FBI is to breach its computer security.

One would think that asking for a password is faster than breaching the whole system.