The Insecurity of Security Software

Found on Slashdot on Saturday, 18 June 2005
Browse Software

BusinessWeek is reporting that, despite a number of software products meant to safeguard Windows PCs from harm, a rising number of them endanger their hosts because of poor design and flaws. From the article: 'A new Yankee Group report, to be released June 20, shows the number of vulnerabilities found in security products increasing sharply for the third straight year -- and for the first time surpassing those found in all Microsoft products.'

That's why it's important to let people test the software and expose all flaws. It's impossible to stop people from trying to exploit a software product. However, if it's not allowed to publish the bugs, they will remain unfixed. That's by far more dangerous. If you keep that in mind and look at France, where it is illegal to publish bugs found by reverse-engineering, then that makes you wonder why someone should use french software.

40M credit cards hacked

Found on CNN Money on Friday, 17 June 2005
Browse Internet

A security breach has occurred at a third-party processor of payment card transactions that affects over 40 million card accounts, Mastercard International said Friday.

Of the cards involved, 13.9 million were MasterCard-branded cards, which include Maestro and Cirrus, and 22 million were Visa cards, said Visa spokeswoman Rhonda Bentz.

The breach took place at the Tucson office of CardSystems Solutions, which processes transactions on behalf of financial institutions and merchants. CardSystems said in a statement that it identified the breach on May 22 and contacted the FBI the next day.

"We're working with the FBI. It's a criminal investigation," Visa's Bentz said, noting that CardSystems "was out of compliance" with Visa's security standards when the breach occurred and that Visa would review whether it would continue to work with CardSystems when the case is resolved.

Seems like good old paper and coin still is one of the safest ways to pay (although you can still get mugged).

Enter Avalanche: P2P filesharing from Microsoft

Found on The Register on Thursday, 16 June 2005
Browse Software

Researchers at Microsoft's computer science lab in Cambridge have developed a peer-to-peer filesharing system that they say overcomes the scheduling problems associated with existing distribution protocols such as Bit Torrent.

The researchers claim download times are between 20-30 per cent faster, using their network coding approach, than on systems that only code at the server, and between 200 and 300 per cent faster than distributing un-encoded information.

Naturally, Microsoft is very keen to stress that this technology should be used for distributing legitimate content. It even put that in italics in the press material.

The basic principle of the system, dubbed Avalanche, is pretty much the same as BitTorrent. Certainly the problem it solves is: a large file needs to be distributed to many people. One server does not have the bandwidth to deal with all that traffic, so you need to find another way of getting the file to everyone who needs it.

20-30% faster download? When Bittorrent has enough sources, it will saturate a line; call me blind, but I can't see how MS could increase the maximum speed of a line by 20-30%. Anyway, I think this is just another PR bubble. Much ado about nothing. Perhaps MS really thinks Avalanche will beat Bittorrent, who knows. Just like wma has beaten mp3. Programs aren't just faster because MS made them. For example, Samba is considerably faster than Windows' file and printer services (which is even tied into the OS) on the same hardware.

Spyware Floods In Through BitTorrent

Found on eWEEK on Wednesday, 15 June 2005
Browse Filesharing

Public peer-to-peer networks have always been associated with adware program distributions, but BitTorrent, the program created by Bram Cohen to offer a new approach to sharing digital files, has managed to avoid the stigma.

According to Chris Boyd, a renowned security researcher who runs the VitalSecurity.org nonprofit resource center, the warm and fuzzy world of BitTorrent has been invaded by a massive software distribution campaign linked to New York-based adware purveyor Direct Revenue LLC.

Boyd said he got the first inkling that BitTorrent was a major adware distribution vehicle while searching for the source of Direct Revenue's Aurora, an adware program that includes the prevalent "nail.exe" component. Sifting through mountains of HijackThis logs posted on security forums, Boyd said the answer was staring him in the face. (HijackThis is a popular freeware spyware removal tool that keeps detailed logs of Windows PC scans).

"I expect we'll see more of this, and if the first ever 1GB malware/adware install has a chance of happening anywhere, it will be on file-sharing networks where programs are broken up into pieces. The problem is, you never know what's going to come out the other side," he said.

That's why people should use firewalls. Of course this won't help if you're using the original client; there are many free (and better) alternatives. Your traffic-shaper/monitor should also help you here.

Geldof forces eBay to block Live 8 ticket sales

Found on The Inquirer on Tuesday, 14 June 2005
Browse Various

Saint Bob was fuming over the affair and has been encouraging folk to bid stupid amounts for the tickets and "mess up the whole system".

More than two million people sent text messages in a lottery to secure the 150,000 tickets for the gig in Hyde Park, London on July 2.

But soon after the tickets were released some inevitably turned up for sale on eBay.

This got Bob all hot under the collar and he began ranting to anyone with a TV camera. He told the BBC he thought eBay's UK management should resign or be sacked.

Ebay offered to make a donation to the cause - feeding poor people - saying that in a free market people should be allowed to do what they like with their tickets.

When this failed to dampen Bob's ire, the firm said it had decided to block the sales of Live 8 tickets on its auction site.

I doubt he would have complained if all the money from the sales went to the charity. Besides, it's the right of the winners to sell them. After all, they won the tickets legally and so they own them. This should make it pretty much legal to sell them. It's surprising to see eBay to give in; after all, they usually protect their sellers (after all, they pay the fees). Perhaps it will also teach those a lesson who followed Bob's advice: eBay suspended the accounts of those who bid "stupid amounts".

More CD Copy Protections Coming

Found on Techdirt on Monday, 13 June 2005
Browse Various

For all the talk here on Techdirt about file sharing, I don't use any file sharing programs. I still prefer to have the actual CD. While I would like to be able to use file sharing apps to hear new songs in figuring out what to buy, the legality question is still very much up in the air, and it's not worth messing around with those apps until it's settled. A few months ago, I finally got around to the big project of converting my music to MP3s so I could listen to it on an MP3 player. Last week I bought a new CD online -- and it was the first time I've received a CD that had copy protection on it (it points it out in tiny print on the CD -- if I'd known beforehand, I wouldn't have bought it). Since I started converting my collection to MP3, I no longer listen to CDs -- even if I still like to have them for the backup and the full liner notes. It's just more convenient to have everything on the MP3 player. So, here's a CD that is more or less useless to me. I legally bought it -- and yet I'm unlikely to listen to it at all, because I can't turn it into MP3s. If anything, this only makes me more interested in finding the same songs on a file sharing program -- and less interested in ever buying a CD again. How is this possibly beneficial to the recording industry? With that in mind, it's amazing to see that EMI is following Sony BMG's lead in making more CDs copy protected, and they even admit that it's not to stop piracy, but just to annoy the legal purchasers: "Executives at EMI and Sony BMG said the point was to rein in copying by the everyday music fan, not to stop determined bootleggers." That "everyday copying" is to make it so we can actually listen to the music we bought in a way that's convenient. Since the "determined bootleggers" are getting the content on file sharing networks anyway -- there appears to be absolutely no benefit whatsoever to putting copy protection on CDs. The only thing it does is give people less incentive to buy CDs.

This article couldn't describe the situation better. As long as you can listen to it, you can put it online. Even if you'd have to use a microphone. And it just takes one with the decent hardware to do a high-quality recording.

Film shows Saddam legal grilling

Found on BBC News on Sunday, 12 June 2005
Browse Legal-Issues

New film has been released showing the former Iraqi leader Saddam Hussein being questioned by magistrates, the first footage of him in almost a year.

Saddam Hussein's lawyers have recently complained that he has been allowed only two meetings with them since being arrested in Iraq in December 2003.

The former Iraqi leader, who is accused of ordering a string of massacres and murders during his rule, looks pensive as he answers questions.

The BBC's Alastair Leithead in Baghdad says the video portrays Saddam Hussein in a respectful way, but that he does not appear to be as in control of the situation as he did when he appeared in court last year.

Since the invasion (which began March 20, 2003), life isn't much better for the people in Iraq than before. Several sources (for example Human Rights Watch) estimate that 250,000 people were killed during 25 years by the Ba'th Party. More than 100,000 have been killed since the US invasion. Those numbers result in 10,000 deaths/year under Saddam's regime vs 80,000 deaths/year under US occupation. Some may argue that Saddam has killed more and therefore double, triple or even quadruple his "score"; others then might say that the victims of the sanctions and the previous war should be added to the US number. I don't want to defend Saddam here, but people should see the relations.

The evil in e-mail

Found on IT Business on Saturday, 11 June 2005
Browse Internet

By watching for certain keywords, law enforcement agencies can already identify e-mails that might contain clues to criminal activity and corporations can flag employee messages that could cause legal problems.

Keywords have limitations, though – people trying to avoid detection may steer clear of language likely to attract attention. So a Queen's University researcher is exploring ways to spot suspicious e-mails even when writers try not to give themselves away.

Dr. David Skillicorn's work is based on the idea that when people are trying to hide something, they write differently than people who have nothing to hide. That's more true of e-mail than of more formal documents, he adds, because few of us go back and edit our e-mails.

A related trick, he says, is to examine patterns in who e-mails whom. As an example, in criminal networks it is common to find several people communicating regularly with the same person, but never with each other. This is meant to ensure that if one lawbreaker is caught, he or she is unlikely to lead authorities to too many others. But it can also be a clue to suspicious activity.

Let me introduce PGP/GnuPG. If I'm up to something and want to hide it, I simply slap a strong encryption onto it. Then I can savely discuss possible targets for bombing or other forms of attack. I doubt that criminal masterminds are dumb enough to send plain text (or hey, even HTML emails). Sounds more like an attempt to justify more surveillance.i>

Microsoft bans 'democracy' for China web users

Found on MSN Money on Saturday, 11 June 2005
Browse Censorship

Microsoft's new Chinese internet portal has banned the words "democracy" and "freedom" from parts of its website in an apparent effort to avoid offending Beijing's political censors.

Users of the joint-venture portal, formally launched last month, have been blocked from using a range of potentially sensitive words to label personal websites they create using its free online blog service, MSN Spaces.

Attempts to input words in Chinese such as "democracy" prompted an error message from the site: "This item contains forbidden speech. Please delete the forbidden speech from this item." Other phrases banned included the Chinese for "demonstration", "democratic movement" and "Taiwan independence".

MSN on Friday declined to comment directly on the ban on sensitive words, but its China joint venture said users of MSN Spaces were required to accept the service's code of conduct. "MSN abides by the laws and regulations of each country in which it operates," the joint venture said. The MSN Spaces code of conduct forbids the posting of content that "violates any local and national laws".

But while China's ruling Communist Party deals harshly with political dissenters, there is no Chinese law that bars the mere use of words such as democracy.

That's called "brown nosing". Honestly, if I'd run a company as big as MS, I'd tell China clearly what to do with their censorship. They can go on and develop their own portals if they want.

From Russia With Malware

Found on Information Week on Friday, 10 June 2005
Browse Internet

An online business based in Russia is paying Web sites 6 cents for each machine they infect with adware and spyware, according to security researchers who call the practice "awful."

IframeDollars.biz says it pays Webmasters to place a one-line exploit on their sites. The code exploits a number of patched Windows and Internet Explorer vulnerabilities, including some that go back as far as 2002. Systems that haven't been updated would be vulnerable to the exploit. According to analysis done by the SANS Institute's Internet Storm Center, the exploit drops at least nine pieces of malicious code--including back doors, other Trojans, spyware, and adware--on any PC whose user surfs to a site that hosts the exploit code.

IframeDollars says it pays $61 per thousand unique installations, or 6.1 cents per compromised machine, to any site that signs up as an affiliate.

According to the Internet Storm Center, companies can prevent the downloading of adware and spyware from iframeDollars' servers by blocking the IP address 81.222.131.59.

How nice. Of course, if you are against censorship, you cannot simply demand a shutdown. It's the job of the users to keep their systems updated and secure.