The Insecurity of Security Software
BusinessWeek is reporting that, despite a number of software products meant to safeguard Windows PCs from harm, a rising number of them endanger their hosts because of poor design and flaws. From the article: 'A new Yankee Group report, to be released June 20, shows the number of vulnerabilities found in security products increasing sharply for the third straight year -- and for the first time surpassing those found in all Microsoft products.'
40M credit cards hacked
A security breach has occurred at a third-party processor of payment card transactions that affects over 40 million card accounts, Mastercard International said Friday.
Of the cards involved, 13.9 million were MasterCard-branded cards, which include Maestro and Cirrus, and 22 million were Visa cards, said Visa spokeswoman Rhonda Bentz.
The breach took place at the Tucson office of CardSystems Solutions, which processes transactions on behalf of financial institutions and merchants. CardSystems said in a statement that it identified the breach on May 22 and contacted the FBI the next day.
"We're working with the FBI. It's a criminal investigation," Visa's Bentz said, noting that CardSystems "was out of compliance" with Visa's security standards when the breach occurred and that Visa would review whether it would continue to work with CardSystems when the case is resolved.
Enter Avalanche: P2P filesharing from Microsoft
Researchers at Microsoft's computer science lab in Cambridge have developed a peer-to-peer filesharing system that they say overcomes the scheduling problems associated with existing distribution protocols such as Bit Torrent.
The researchers claim download times are between 20-30 per cent faster, using their network coding approach, than on systems that only code at the server, and between 200 and 300 per cent faster than distributing un-encoded information.
Naturally, Microsoft is very keen to stress that this technology should be used for distributing legitimate content. It even put that in italics in the press material.
The basic principle of the system, dubbed Avalanche, is pretty much the same as BitTorrent. Certainly the problem it solves is: a large file needs to be distributed to many people. One server does not have the bandwidth to deal with all that traffic, so you need to find another way of getting the file to everyone who needs it.
Spyware Floods In Through BitTorrent
Public peer-to-peer networks have always been associated with adware program distributions, but BitTorrent, the program created by Bram Cohen to offer a new approach to sharing digital files, has managed to avoid the stigma.
According to Chris Boyd, a renowned security researcher who runs the VitalSecurity.org nonprofit resource center, the warm and fuzzy world of BitTorrent has been invaded by a massive software distribution campaign linked to New York-based adware purveyor Direct Revenue LLC.
Boyd said he got the first inkling that BitTorrent was a major adware distribution vehicle while searching for the source of Direct Revenue's Aurora, an adware program that includes the prevalent "nail.exe" component. Sifting through mountains of HijackThis logs posted on security forums, Boyd said the answer was staring him in the face. (HijackThis is a popular freeware spyware removal tool that keeps detailed logs of Windows PC scans).
"I expect we'll see more of this, and if the first ever 1GB malware/adware install has a chance of happening anywhere, it will be on file-sharing networks where programs are broken up into pieces. The problem is, you never know what's going to come out the other side," he said.
Geldof forces eBay to block Live 8 ticket sales
Saint Bob was fuming over the affair and has been encouraging folk to bid stupid amounts for the tickets and "mess up the whole system".
More than two million people sent text messages in a lottery to secure the 150,000 tickets for the gig in Hyde Park, London on July 2.
But soon after the tickets were released some inevitably turned up for sale on eBay.
This got Bob all hot under the collar and he began ranting to anyone with a TV camera. He told the BBC he thought eBay's UK management should resign or be sacked.
Ebay offered to make a donation to the cause - feeding poor people - saying that in a free market people should be allowed to do what they like with their tickets.
When this failed to dampen Bob's ire, the firm said it had decided to block the sales of Live 8 tickets on its auction site.
More CD Copy Protections Coming
For all the talk here on Techdirt about file sharing, I don't use any file sharing programs. I still prefer to have the actual CD. While I would like to be able to use file sharing apps to hear new songs in figuring out what to buy, the legality question is still very much up in the air, and it's not worth messing around with those apps until it's settled. A few months ago, I finally got around to the big project of converting my music to MP3s so I could listen to it on an MP3 player. Last week I bought a new CD online -- and it was the first time I've received a CD that had copy protection on it (it points it out in tiny print on the CD -- if I'd known beforehand, I wouldn't have bought it). Since I started converting my collection to MP3, I no longer listen to CDs -- even if I still like to have them for the backup and the full liner notes. It's just more convenient to have everything on the MP3 player. So, here's a CD that is more or less useless to me. I legally bought it -- and yet I'm unlikely to listen to it at all, because I can't turn it into MP3s. If anything, this only makes me more interested in finding the same songs on a file sharing program -- and less interested in ever buying a CD again. How is this possibly beneficial to the recording industry? With that in mind, it's amazing to see that EMI is following Sony BMG's lead in making more CDs copy protected, and they even admit that it's not to stop piracy, but just to annoy the legal purchasers: "Executives at EMI and Sony BMG said the point was to rein in copying by the everyday music fan, not to stop determined bootleggers." That "everyday copying" is to make it so we can actually listen to the music we bought in a way that's convenient. Since the "determined bootleggers" are getting the content on file sharing networks anyway -- there appears to be absolutely no benefit whatsoever to putting copy protection on CDs. The only thing it does is give people less incentive to buy CDs.
Film shows Saddam legal grilling
New film has been released showing the former Iraqi leader Saddam Hussein being questioned by magistrates, the first footage of him in almost a year.
Saddam Hussein's lawyers have recently complained that he has been allowed only two meetings with them since being arrested in Iraq in December 2003.
The former Iraqi leader, who is accused of ordering a string of massacres and murders during his rule, looks pensive as he answers questions.
The BBC's Alastair Leithead in Baghdad says the video portrays Saddam Hussein in a respectful way, but that he does not appear to be as in control of the situation as he did when he appeared in court last year.
The evil in e-mail
By watching for certain keywords, law enforcement agencies can already identify e-mails that might contain clues to criminal activity and corporations can flag employee messages that could cause legal problems.
Keywords have limitations, though – people trying to avoid detection may steer clear of language likely to attract attention. So a Queen's University researcher is exploring ways to spot suspicious e-mails even when writers try not to give themselves away.
Dr. David Skillicorn's work is based on the idea that when people are trying to hide something, they write differently than people who have nothing to hide. That's more true of e-mail than of more formal documents, he adds, because few of us go back and edit our e-mails.
A related trick, he says, is to examine patterns in who e-mails whom. As an example, in criminal networks it is common to find several people communicating regularly with the same person, but never with each other. This is meant to ensure that if one lawbreaker is caught, he or she is unlikely to lead authorities to too many others. But it can also be a clue to suspicious activity.
Microsoft bans 'democracy' for China web users
Microsoft's new Chinese internet portal has banned the words "democracy" and "freedom" from parts of its website in an apparent effort to avoid offending Beijing's political censors.
Users of the joint-venture portal, formally launched last month, have been blocked from using a range of potentially sensitive words to label personal websites they create using its free online blog service, MSN Spaces.
Attempts to input words in Chinese such as "democracy" prompted an error message from the site: "This item contains forbidden speech. Please delete the forbidden speech from this item." Other phrases banned included the Chinese for "demonstration", "democratic movement" and "Taiwan independence".
MSN on Friday declined to comment directly on the ban on sensitive words, but its China joint venture said users of MSN Spaces were required to accept the service's code of conduct. "MSN abides by the laws and regulations of each country in which it operates," the joint venture said. The MSN Spaces code of conduct forbids the posting of content that "violates any local and national laws".
But while China's ruling Communist Party deals harshly with political dissenters, there is no Chinese law that bars the mere use of words such as democracy.
From Russia With Malware
An online business based in Russia is paying Web sites 6 cents for each machine they infect with adware and spyware, according to security researchers who call the practice "awful."
IframeDollars.biz says it pays Webmasters to place a one-line exploit on their sites. The code exploits a number of patched Windows and Internet Explorer vulnerabilities, including some that go back as far as 2002. Systems that haven't been updated would be vulnerable to the exploit. According to analysis done by the SANS Institute's Internet Storm Center, the exploit drops at least nine pieces of malicious code--including back doors, other Trojans, spyware, and adware--on any PC whose user surfs to a site that hosts the exploit code.
IframeDollars says it pays $61 per thousand unique installations, or 6.1 cents per compromised machine, to any site that signs up as an affiliate.
According to the Internet Storm Center, companies can prevent the downloading of adware and spyware from iframeDollars' servers by blocking the IP address 81.222.131.59.