Auto-nomy no more

I’m a big fan of digital camera technology, and thus I usually am quick to support intelligent uses related to detective controls. Take for example a Bed & Breakfast that had issues with people loitering across the street dealing drugs. The B&B installed a camera, took some extracted video to the absent property owner and the next thing you know the neighborhood felt safe again. Here’s another example. Some well-intentioned system administrators were moving equipment in the racks when suddenly a core network device went off-line. Everyone started pointing fingers but a simple review of the video at the exact moment that the services were terminated shows who was in the cookie jar pulling power cables, and who was not.

Surveillance doesn’t happen in a vacuum, however, and there should be the same care and caution applied as with any other detective controls. Sadly, some investigators get so excited about the opportunity to nail every tiny infraction with uncontestably strong evidence that they start to sound like rabid dogs, ready to chase down every living thing and chew it to the bone.

Take for instance this proposal, recently captured in The Times:

BRITAIN’S top traffic policeman is pushing through plans to create a national network of roadside spy cameras that will be able to track the movements of motorists around the clock.

Meredydd Hughes wants the cameras to be installed every 400 yards on motorways, as well as at supermarkets, petrol stations and in town centres.

They are designed to crack down on uninsured driving, road tax evasion and stolen cars, but will also monitor millions of law-abiding drivers.

It sounds expensive and invasive with little return, if you ask me. One thing that surveillance camera projects should never do is start with an overly broad objective. It is similar to saying you want to write software to improve security every 400 yards on motorways…if you don’t start out with a good focus on the purpose of the system, then you will never end up with a clear picture of its usefulness.

On the other hand, when someone actually reveals that not only is there no intended benefit to the public but the real purpose of the surveillance (detective control) system is to become a source of revenue/taxation for the police, well, that should ring some alarm bells under the category of “clear conflict of interest”:

An Acpo strategy document, seen by The Sunday Times, makes the controversial suggestion that every ANPR “intercept officer� should aim to issue at least 310 fixed-penalty notices a year.

Blog riot

Fascinating article in the Guardian by Jeff Jarvis about online communication as a tool in the French riots:

the arrest last week of at least three young bloggers for allegedly using their sites to incite violence precisely highlights the confusion this new medium brings

I am surprised to hear that the French government is trying to control the debate by spending advertising money on Google. That just seems unsettling on so many levels, it’s hard to know where to begin.

UK Trains to get Airport Security

The Guardian reports today that train stations in the UK are considering passenger security to be implemented in a similar fashion to airports. The problem with train stations today, which they rightly identify, is that they are not “closed”, especially compared to the sealed-off nature of airport terminals. Trains also are regularly accessible, unlike planes at 30,000 ft.

When you get right down to it, train security actually does not have much in common with planes other than the movement of large numbers of passengers on a schedule (e.g. “public transportation”).

The airport screening model seems to be increasingly considered high-cost and largely biased in some odd control areas, especially if you consider the lack of relevance to other forms of public transportation, so let’s hope the upcoming conference gets back to the basics like preventive and detective controls, defense-in-depth, etc.

FTP pubstro

An increase in attacks meant to setup high speed, public, distribution networks (pubstro) seems to be spreading. In a nutshell, this means vulnerable servers are being used as hosts for hidden ftp servers with little impact on other data that might be exposed on the host. Nothing especially new here other than the amazing efficiency of the attacks, which leads to robust “networks” of compromised systems, as well as the fact that breach laws are now in effect. The odd situation with market forces in this scenario is that attackers seem better at writing code to remotely install agents to generate revenue than many of the companies that are actually supposed to be in charge of the servers themselves. If this rate of change goes unchecked, my guess is that developers may see a more lucrative future in stealing resources than in being tasked to try and prevent them from being stolen. But who should bear the cost of the disincentives?

Some discussion on Educause suggests even fully-patched Windows 2000 systems are at risk.

Microsoft labels Sony DRM as spyware

Jason Garms finally stepped up to the plate on Saturday, November 12th, 2005 and announced that Microsoft’s internal Anti-Malware Engineering Team formally acknowledges Mark Russinovich’s October 31st, 2005 blog entry and will now add Sony’s DRM software into its anti-malware software. That’s right, twelve days after the news broke and two full days after exploits were documented in the wild, Microsoft has quietly announced on a blog that they are going to update their signatures.

Here is Microsoft’s criteria for determining what is spyware, and here are some comments I made earlier.

Quite frankly, we all know that people dumped Microsoft’s anti-spyware software once it was revealed that they cave to companies for odd reasons (which begs the question of what spyware company wouldn’t apply pressure if they know they can — hello, spyware is all about being annoying and persistent, no?).

But even so, I am really disappointed that Microsoft continues to show that they are not the kind of company that a user or company can bank on if they need security. Sony has had to eat so much publicity about this issue that just about everyone and their dog is aware of the issue (contrary to what Thomas Hesse, President of Sony BMG, suggested in an NPR interview, that people don’t know enough to care about root-kits). Just take a look at an anti-virus company who started addressing the issue the very day the news of the root-kit broke. F-secure claims that they were even working on it prior to Mark’s announcement because they were fielding reports about the same suspicious behavior.

The Inquirer responded to Microsoft’s blog announcement on Sunday, November 13th, 2005, with an excellent write-up on why this giant company, yet again, seems to entirely miss the point on what it means to establish trust with users. In brief, one might summarize their point as something similar to the old adage “it’s not the crime, it’s the cover-up”:

So, what do we end the day with? Microsoft dipping a toe in the water and saying it will remove a solitary DRM infection. No future pledges, no strong stand. I was honestly hoping MS would stand up and plant a stake in the ground about things like this. A week later with a murmur in a blog is not the response of a market leader.

Mark has an excellent summary himself today, called “Sony: No More Rootkit – For Now”, regarding the Microsoft announcement as well as the Sony soundbite from NPR. Most importantly, he clarifies that the viruses are just a symptom of bad security:

The viruses simply take advantage of the Sony rootkit if it’s present, but could just as easily install their own rootkit to hide their presence on the system. If a user activating the virus, which is transmitted as an email attachment, is running with administrator privileges, the virus can install a kernel-mode rootkit just as powerful as Sony’s. But even if the virus is activated from a non-administrator account it can install a less powerful, though still effective, user-mode rootkit. The bottom line is that it’s not rootkits themselves that are the problem; it’s the inability to manage the objects that they hide that creates security, reliability and manageability problems.

His point that Sony owns the IP not the computer just reminds me of the story about people who “own” their cars and want the error codes under the Right to Repair Act. Transparency of technology and the ability to protect oneself from predatory corporations are gearing up to be tough issues for the next few years.