Category Archives: Security

Roll your own cell network (OpenBTS)

I wrote recently about Mobile Device Economics and Security. The OpenBTS project could increase the rapid growth trend of wireless even more dramatically:

OpenBTS is an open-source Unix application that uses the Universal Software Radio Peripheral (USRP) to present a GSM air interface (“Um”) to standard GSM handset and uses the Asterisk software PBX to connect calls. The combination of the ubiquitous GSM air interface with VoIP backhaul could form the basis of a new type of cellular network that could be deployed and operated at substantially lower cost than existing technologies in greenfields in the developing world.

Naturally a question of managed spectrum comes to mind. Yet another explanation of why regulation is good for commerce can be found in an OpenBTS implementation on an unregulated island that ran into trouble finding air space.

Killing IE6

Jeremiah turned me on to this article about the man at Microsoft whose job is to kill IE6.

“Part of my job is to get IE6 share down to zero as soon as possible,” said Ryan Gavin, head of the Internet Explorer business group.

Gavin said Microsoft will continue to work with companies to move legacy applications to more modern versions of Internet Explorer, as well as continuing to highlight the improved security on offer in Internet Explorer 8. For example, a recent campaign run by Microsoft Australia compared using IE6 to drinking milk nine years past its sell-by date.

Supposedly IE6 is the “most used browser version in the world”. I am not sure I buy that statement, especially as it is not sourced. The article claims this is due to being the default browser in XP and also because of developing nations use of old hardware. Bah, it could just as easily be because robots and scripts masquerade as IE6.

Whatever the case, a good solution would be for Microsoft to work with companies like Yahoo! (we are talking legacy here, right?) Facebook and Google to post a warning banner to users of IE6. Something that says “Hello, your browser needs to be upgraded to use this site” could be very effective. Why would a Google or Facebook ever dare to interfere with the user experience? One giant reason is to help turn off things like SSLv2, which actually dates all the way back to the very fist IE4 in 1998.

Late last year I was surprised when Google called me in and asked for my suggestion for what to do about SSLv2. Hard to believe but their engineers still debated how best to support SSLv2 even though it has no advantages and a giant security disadvantage. I gave the same answer as above — post a warning to users with a deadline, give fair notice and link to more information. Start forcing redirects to an upgrade page. No one needs to use SSLv2 and it has been prohibited by regulations for at least three years. No one needs it, and yet it persists. IE6 thus will be an even harder argument, as it might actually be useful, so what chance does Microsoft have to kill it off?

Aside from security flaws there is really no immediate need to mandate users upgrade from IE6. Why would Google to do the right thing and help Microsoft? Their support of an IE6 end of life plan is improbable, but who knows. Google just added SSL to their search page. They already try to warn users of suspicious or dangerous links. Maybe they would also see value in warning users that Microsoft no longer supports IE6 and then offer Chrome as an update.

Incidentally, I must also comment on that milk analogy by Microsoft. It is probably more appropriate than they realized. I would reply that “milk nine years past its sell-by date” is also called cheese. It could in fact be some really GOOD cheese. The big difference, obviously, is that old milk does not require patches and support from the manufacturer (cow?) to remain safe.

So, unless Microsoft can point out the clear (health) risk (they refuse to support their product any longer) consumers will very likely see no harm to aging their milk for many years to come.

AMEX blasted for security flaw

Joe Damato checked the source of an AMEX page and then sniffed the traffic to see if his credit card information was encrypted properly. He was not impressed.

So I filled out the form with fake information and sniffed the POST to the server.

The Daily Wish sign up form from the American Express Network is sending credit card numbers, expiration dates, and all the other personal information on the sign up form in the clear back to their server.

Big ooops. AMEX fixed the problem quickly.

An interesting twist to Damato’s blog post is the comment section where many people seem to rant about outsourcing and jobs instead of the actual issue. Outsourcing certainly brings security issues but a mistake in coding practices is not something you can blame on it — it happens both inside and outside.

Damato’s post also reminds me of the conviction of a computer consultant in England in 2005. That consultant argued he was worried about his credit card safety when he used a website that looked insecure. His story was not consistent, however, and a Judge found him in violation of the Computer Misuse Act, 1990.

The conviction of a computer consultant who gained unauthorised access to the Disaster Emergency Committee’s fundraising Web site has left security experts leafing through the magistrate’s decision to try and understand the full implication of the verdict.

On Thursday, Daniel Cuthbert, a computer security consultant from Whitechapel in London, was found guilty of breaching Section One of the Act on the afternoon of New Year’s Eve, 2004. He admitted attempted to access the Web site, which was collecting donations for victims of last year’s tsunami.

I doubt anyone would charge Damato in a similar fashion so times have apparently changed for the better, or at least Damato does not mince words about what he did and why.

Digital Forensics and Search and Seizure

The Fourth Amendment site has posted an interesting result for a search and seizure suit, related to digital forensics.

United States v. Stewart, 2010 U.S. Dist. LEXIS 50876 (E.D. Mich. May 24, 2010)

A laptop searched at the border turned up illegal data. A second laptop had no power and no adapter so it was instead seized and taken away to a lab where further investigation could be performed. This provoked a lawsuit claiming Fourth Amendment rights were violated.

The US District Court just ruled that law enforcement needs to show “a particularized and objective basis for suspicion” to be allowed to move data/devices to forensic labs.