Monthly Archives: October 2007

Security

Police to License Access at Mumbai Cyber Cafes

Leave a comment

Mid-day news reports that Mumbai Internet access is under heavy surveillance and supervision:

Vijay Mukhi, President of the Foundation for Information Security and Technology says, “The terrorists know that if they use machines at home, they can be caught. Cybercafes therefore give them anonymity.”

“The police needs to install programs that will capture every key stroke at regular interval screen shots, which will be sent back to a server that will log all the data.

The police can then keep track of all communication between terrorists no matter, which part of the world they operate from.This is the only way to patrol the net and this is how the police informer is going to look in the e-age,” added Mukhi.

Seems like a good theory, but as we all know the “no matter which part of the world” and “every key stroke” phrases are absolutes. Absolutes and security rarely go well together.

All cyber cafes in the city will now need a police license to keep their business going. All cafes need to register at the police headquarters and provide details on the number of computers installed, type of computers and technical details like the IP address of each machine.

They will have some trouble when they realize how IP addresses are increasingly dynamic and spoofed.

I wonder how much of this type of cafe clampdown, if successful, will push anonymous network seekers onto the weaker wireless signals in residential neighborhoods.

Will police require home users to use a grade of security to prevent intrusion, and/or to report the number of computers, type, etc. when they run wireless networks? Will home users be held liable for weak security like WEP, or the providers, or even the manufacturers? The new Snoop law in England, if it survives public concern, may help provide answers.

History, Security

Amazon Loses One-Click Patent Lawsuit

Leave a comment

Interesting David v. Goliath story in the New Zealand news. I have not seen it anywhere else yet:

An Auckland man who defeated internet giant Amazon in a copyright battle, hopes his example will inspire others to challenge big corporations.

The United States Patents Office has ruled that Amazon does not have the exclusive rights to what is called one-click shopping – the technology that allows shoppers to buy goods with just a single click of a mouse.

Peter Calveley used internet archive sites to prove the one-click shopping idea was pionnered by a now defunct internet company called Digi Cash.

Calveley has said that he pursued the suit as a game, or in other words to make a point, but he financed it with donations. Suing Amazon for profit? His blog has more details:

Many thanks to everyone who helped out with the funding and promoting the blog.

Please don’t send any more money

(unless you want to contribute to my personal consumption ;-) ).

Should lawyers, or even laymen, solicit funds from the Internet to attack corporate interests? This is an interesting model I had not thought about. I wonder if it might someday alter the definition of “public defender”. Calveley reported some sources of support, but most are anonymous.

Security

Firefox and iPhone vulnerabilities

Leave a comment

Firefox 2.0.0.8

MFSA 2007-36 URIs with invalid %-encoding mishandled by Windows
MFSA 2007-35 XPCNativeWrapper pollution using Script object
MFSA 2007-34 Possible file stealing through sftp protocol
MFSA 2007-33 XUL pages can hide the window titlebar
MFSA 2007-32 File input focus stealing vulnerability
MFSA 2007-31 Browser digest authentication request splitting
MFSA 2007-30 onUnload Tailgating
MFSA 2007-29 Crashes with evidence of memory corruption (rv:1.8.1.8)

I would jump to 2.0.0.8 ASAP if I were you, where ASAP means no more than a month or two. I mention this because of what comes next…

In other news, Apple’s phone apparently failed to patch the ages-old libtiff vulnerability.

“I started Safari on my iPhone, browsed to a Website, and a few seconds later, HD was able to get root on my phone, without a wireless connection. Being able to run your own machine code pretty much opens the gates,” Finisterre said.

“I think it’s pretty serious — and even more so, ironic — that a year-old bug would get rolled into a semi-recent product,” added Finisterre.

It is definitely ironic. Where is the quality, Apple? Where is the quality?

In an interview with CMP Channel at Black Hat, Miller said Apple regularly uses outdated versions of open source code in the OS X platform, much of which contains known security flaws.

Outdated because of a pokey release cycle? Shame they do not develop release candidates in parallel to security fixes so the product is safe to use the day it reaches the public, or at least not prone to failure when a new product is tested for known bugs over a year old.

Disclaimer: I’m not a fan of the iPhone. While I have liked and owned Apple products that were different in meaningful ways from the competition (e.g. the original laptop keyboard pushed back to the screen with palm-wrests up front — genius) the iPhone strikes me as a lot of flash with not much practicality.

Food, Security

Stolen laptop worth lifetime of beer?

Leave a comment

Here is an interesting new take on the value of information:

Owners were desperate to retrieve the [stolen] computer containing designs, contact details and financial information, the Rotorua Daily Post said.

They have offered free beer to anyone giving clues leading to its recovery.

Co-owner Paul Croucher said the company would provide a lifetime supply of about 12 bottles a month to anyone who could name the thief.

The company has back-up copies of the material stored on the laptop but these are not up to date, the newspaper said.

What are the chances this will work? And if it does, should security start trying to recover all laptops with beer? Makes a perfectly good excuse for storing large amounts of the beverage at the office, no?

Updated to add:

Cost of 12 beer from the company in question = $36

$36 X 12 months = $432/yr

Average lifetime of a kiwi male = 78.2

78.2 – 18 (kiwi drinking age) = 60.2

60.2 years X $432/yr = $26,006.40

The problem with this reward system, obviously, is that the type of person who might be motivated by beer as a reward is going to want more than 12 bottles a month. And the person not motivated by beer is going to want more than $432/yr. In fact, $432 is not much of a reward for a laptop and, given the questionable information security practices of the company (e.g. no current backups), is there any real guarantee that they would be around to deliver bottles for years two and three let alone in perpetuity?