Intelligence as it relates to safety…and political philosophy

The Guardian tosses a beautifully written review at the Daily Mail over a story called “Rightwingers are less intelligent than left wingers, says study”.

The Mail’s report went on to detail the results of a study carried out by a group of Canadian academics, which appears to show some correlation between low childhood intelligence and rightwing politics. It also claimed that stupid people hold rightwing views in order to feel “safe”. Other items they hold in order to feel safe include clubs, rocks and dustbin lids. But those are easy to let go of. Political beliefs get stuck to your hands. And the only way to remove them is to hold your brain under the hot tap and scrub vigorously for several decades.

As you might expect, many Mail Online readers didn’t take kindly to a report that strived to paint them as simplistic, terrified dimwits. Many leapt from the tyres they were swinging in to furrow their brows and howl in anger. Others, tragically, began tapping rudimentary responses into the comments box. Which is where the tragi-fun really began.

Charlie Brooker, the author, is a comedian fast becoming part of my required Monday reading. He runs a weekly slice of The Guardian. Here’s a recent piece he wrote on privacy and the risk of social networks

When Sony launched the Walkman back in the late 70s, its main appeal was that for the first time in history you could stroll down the high street listening to Neil Diamond belting out Sweet Caroline and no one could judge you for it. It made you the master of a private world of music. If the Walkman had, by default, silently contacted your friends and told them what you were listening to, not only would no one have bought a Walkman in the first place, its designers would have been viewed with the utmost suspicion.

iPhone usbmuxd buffer overflow

In June of 2010 I wrote about upgrading the iPhone on Linux. I just noticed a report (CVE-2012-0065) that there is no boundary specified in the “SerialNumber” field of usbmuxd (USB multiplexor daemon for iPhone) in the “receive_packet()” function (libusbmuxd/libusbmuxd.c), as shown in a recent update and diff on git.marcansoft.com

diff --git a/libusbmuxd/libusbmuxd.c b/libusbmuxd/libusbmuxd.c

index e06ee61..98e92df 100644 (file)

--- a/libusbmuxd/libusbmuxd.c
+++ b/libusbmuxd/libusbmuxd.c
@@ -189,7 +189,7 @@ static int receive_packet(int sfd, struct usbmuxd_header *header, void **payload
                                char *strval = NULL;
                                plist_get_string_val(n, &strval);
                                if (strval) {
-                                       strcpy(dev->serial_number, strval);
+                                       strncpy(dev->serial_number, strval, 255);
                                        free(strval);
                                }
                                n = plist_dict_get_item(props, "LocationID");

It could lead to a heap-based buffer overflow. Not all versions are affected. RedHat indicates the flaw was introduced after 1.0.5 last July along with plist-based support. That’s why Canonical shows Ubuntu 10 as not-affected but 11 needs a patch.

Fox News Exclusive: WikiLeaks

Many interesting issues are raised in the scenario contemplated in a recent Fox News Exclusive titled, “WikiLeaks to move servers offshore, sources say.”  I am interested since I am quoted numerous times about international law issues; but regardless, this topic could raise some interesting discussion.

The issue is similar to the concept of Sealand, the man-made platform off the coast of England whose owners claim it belongs to no nation and they are their own sovereign territory.  At one time Havenco placed a server farm on Sealand and offered server space.  The only restriction in the terms of service was no child porn.  Anyone could rent server space and keep anything, other than child porn, on the servers regardless of the data’s legality, e.g. copyrighted material, terrorist info, data related to various criminal activity such as stolen info, money laundering, etc.  It seems the server farm went out of business at some point in the early 2000’s, but that is not confirmed.

Placing servers in international territory, let’s say on a ship in international waters, raises some interesting legal questions, especially international law, when a nation feels it needs to seize or prevent whatever activity is occurring on those servers.  In some regards this situation may be easier, legally speaking.  If the server owners claim no law controls their actions, well then, what law can they cite to that would prevent a nation from taking action, especially if the nation believes their national security is threatened?  If the server owners claim to be citizens of a particular nation then that nation’s laws apply to them and they may potentially be captured and extradited, or just snatched up out of international waters by the offended nation.  It gets trickier when you have a nation that has no laws to criminalize the activity.  This was the case with the creator of the “I Love You” virus.  The Philippines could not prosecute since they had no law criminalizing the activity.

Many very interesting issues to consider and discuss.  Anyway, here is a link to the Fox News article:   “WikiLeaks to move servers offshore, sources say”.  Enjoy and I would love to hear your comments.

Courts and Lawyers: Gauging the Level of Technical Knowledge

Like many people, I make a lot of assumptions.  Lately, I have made a lot of assumptions about people’s level of knowledge when it comes to cyber security and technology.  This is likely due to my background and training.  If you work in the IT or cyber security or related areas chances are you also make a lot of these assumptions as well.

Recently I learned that the level of knowledge regarding cyber security and technology amongst the legal profession is not as high as I had assumed.  This is not a knock on my colleagues in the law profession, but my failure to avoid making assumptions.  For instance, when emails are offered into evidence their authenticity must be established, but does this include whether the email address is genuine and was not spoofed, the content is original and was not altered, the date and time was not altered, the location of where the mail was accessed if webmail; how webmail works, where the servers are located, the meta data of messages, etc.  Example: if one party offers emails to prove a point about their opponent and the offering party had not been given access to the email account, the question should be raised as to where the emails came from and whether they constitute evidence of a crime; e.g. was the email account hacked?

This is not unique to email but would apply to social media accounts as well.  Many people today do not realize how easy it is to fake, alter and manipulate Online or E-accounts.  Certainly the legal profession must be provided the training and information to know the right questions to ask regarding the authenticity of evidence.