Friday, December 9, 2005


News Item 4425 Zone-Spoofing Fixed for IE 7 Home Users.

Zone-Spoofing Fixed for IE 7 Home Users. BeanBunny writes "The IE 7 dev team has essentially removed the intranet zone for Home users, resulting in a Web browser that is effectively invulnerable to a zone-spoofing attack. This security feature does not exist, however, on any installation that is part of a managed network. It also does not exist if you manually change the permissions on your Internet zone. However, in Windows Vista, both zones will be run in a 'protected mode,' something that allegedly prevents the invisible installation of code."  [Slashdot]
2:22:00 PM  PermaLink   / trackback []  

News Item 4424 HNS - The Unspoken Taboo - The Never Expiring Password

Well it seems that we're not alone in this concern about unchanged code. It seems that many if not all IT Auditors, CSOs, and IT security staff, live daily with the fear of the "never expiring password" being exposed. It is the unspoken taboo - the wide open back door in every corporate network today. It is virtually certain that there is not a single business critical application in your company that isn't wide open. Do you ever wonder how it is that information such as credit card details, personal data, intellectual property, seems to always be so vulnerable. You would think that companies had adequate security precautions to stop this happening, and yet it continues to be a problem.

So where is this wide open back door? In every one of your applications.

2:18:41 PM  PermaLink   / trackback []  

News Item 4423 The Unspoken Taboo - The Never Expiring Password.

The Unspoken Taboo - The Never Expiring Password. anon writes "Every security savvy professional lives with the daily fear of the "never expiring password" being exposed. It's the unspoken taboo, the wide open back door in every corporate network. But no-one ever acknowledges it or discusses it. All applications have got pre-defined passwords that never change. Which means developers, privileged users and hosting third party service providers will all have access to these passwords." Slashdot]
2:14:57 PM  PermaLink   / trackback []  

News Item 4422 BBC NEWS | Technology | Anti-piracy CD problems vex Sony

Sony BMG is being caught up in a row about more of its anti-piracy software.

Digital rights groups warned the music maker about vulnerabilities its MediaMax copy protection system created on users' PCs.

The same groups have now found that a patch Sony produced to close these holes is itself insecure and leaves users open to a separate attack.

The MediaMax system has been used on more than 5.7 million CDS spread across 50 titles sold in the US and Canada.
2:12:24 PM  PermaLink   / trackback []  

News Item 4421 Sony's SunnComm DRM Patch a Security Risk.

Sony's SunnComm DRM Patch a Security Risk. Spad writes "The BBC is reporting that mere days after the EFF and Sony announced a patch to fix the vulnerability in its SunnComm DRM system, security researchers Ed Felten and Alex Halderman have discovered that the patch itself introduces yet more vulnerabilities. They have now asked users not to apply the patch and are urging Sony to recall all of the affected CDs from sale. Sony has said that approximately six million CDs using [SunnComm] MediaMax have been shipped to stores. Affected artists include Alicia Keys, Britney Spears, Black Rebel Motorcycle Club and Faithless."  [Slashdot]
2:10:29 PM  PermaLink   / trackback []  

News Item 4420 U.S. passenger tracking plan under scrutiny | CNET News.com

A U.S. proposal that would require the travel industry to gather more passenger data and share it with federal health officials has some citizens worried about their privacy.

The new rule, proposed last month by the U.S. Centers for Disease Control and Prevention, aims to broaden the agency's quarantine powers amid rising fears of a deadly, global flu outbreak. It would also expand the government's ability to contact passengers who may have been infected during travel via a coordinated data-gathering effort with airlines and cruise operators.

Specifically, the plan calls for airlines and cruise companies to collect more personal data, including phone numbers, e-mail addresses and seat locations, from both domestic and international passengers and transmit the information to the CDC within 12 hours of a request. The companies would be required to retain the data electronically for at least 60 days and destroy it after one year.

But judging from the first round of public comments posted online Wednesday, some people are up in arms over the proposed rule and its data-collection requirements. Their concerns, voiced in a dozen or so comments, center mainly on potential civil liberty violations.

"I am opposed to requiring any more information from people booking air travel," wrote David Kelley of Alexandria, Va. "There is already too much information collected, and adding more is totally uncalled for. We are supposed to be living in a free society that respects the privacy of its citizens, not a police state."


1:01:00 PM  PermaLink   / trackback []  

News Item 4419 National ID card issue scrutinized at conference.

National ID card issue scrutinized at conference. Former Homeland Security chief Tom Ridge and security guru Bruce Schneier argued both sides of the debate over national ID cards at the Infosecurity conference in New York this week.

[Computerworld Privacy News]


12:36:01 PM  PermaLink   / trackback []  

News Item 4418 NewsFactor Network - Enterprise - Beyond the Patchwork of Privacy Regulations

What elements associated with identity must be held private? Once you define that, how do you translate it into protecting it through technology? We must start with understanding what we need to protect.
12:32:46 PM  PermaLink   / trackback []  

News Item 4417 eHomeUpgrade | Xbox 360 Opens Pandora's Box of Privacy Concerns

HEXUS gaming has posted information and screenshots related to Xbox LIVE that you've got to see if you're an Xbox 360 owner, or someone who is in the process of acquiring one. The information is especially relevant if you're planning on using the Xbox's Extender functionality to communicate with your Media Center PC. HEXUS says: "Simply put, anyone you've been in contact with through Xbox LIVE can subsequently see what you're up to, regardless of whether they're in your friends list or not. [...] The amount of detail Xbox LIVE passes to others goes way beyond just being helpful in linking you up with other gamers, so far beyond that you could easily regard it as a pretty major intrusion into your privacy."

[...]

I don't know about you, but this kind of thing creeps me out. Luckily, however, HEXUS has already received feedback on the article and informs readers there's an easy fix. To correct the problem, locate the console's privacy settings and make the proper adjustments to everyone, friends only, or no-one at all. For the life of me, why would Microsoft set up privacy settings to be open to all by default? I thought they had a new direction for the company that was all about security and stability for its users. Thanks HEXUS for bringing this issue to light!


12:29:12 PM  PermaLink   / trackback []  

News Item 4416 HEXUS.gaming : Feature : Xbox 360 LIVE ... Privacy? What privacy? : Page - 1/3

Now no doubt Microsoft has this totally covered in its Terms and Conditions that you have to agree to when you sign up for an Xbox LIVE account, but did you know just how much information Microsoft shares with other Xbox 360 owners about what you're doing? Simply put, anyone you've been in contact with through Xbox LIVE can subsequently see what you're up to, regardless of whether they're in your friends list or not.

We here at HEXUS became a little anxious when the boss sent me a voice message over Xbox LIVE asking what I was doing viewing pictures through Media Connect instead of playing games on my Xbox 360. I assumed he'd made a lucky guess as he knew I was still playing around with the Xbox 360's media functions, using Media Connect to view stored family photos from my main PC. What I didn't realise was that he could actually see what I was doing as it was being relayed over Xbox LIVE and showing up in my profile!

12:27:17 PM  PermaLink   / trackback []  

News Item 4415 Deal Struck to Extend Patriot Act.

Deal Struck to Extend Patriot Act. GOP backers on Capitol Hill cut a deal to give law enforcement four more years of secret access to a raft of personal data. The White House is thrilled, but the threat of a Senate filibuster lingers. [Wired News: Security Blanket]
12:23:04 PM  PermaLink   / trackback []  

News Item 4414 Worker Privacy: You Have None.

Worker Privacy: You Have None. The vast majority of U.S. employers monitor workers' internet use, a practice that goes almost completely unregulated. Here's a look at your privacy rights in the workplace. By Joanna Glasner. [Wired News: Security Blanket]
12:21:44 PM  PermaLink   / trackback []  

News Item 4413 Novell rolls out Identity Manager 3.

Novell rolls out Identity Manager 3. Novell keeps repeating the mantra that, going forward, the company will emphasize the "twin pillars" (as CEO Jack Messman calls them) of Linux and identity management. But lately all we've heard from the company is "Linux, Linux, Linux" - it seemed that it was limping along on one pillar! As I said in Network World's Identity Management newsletter last week, Novell, once the leader identity management, has allowed its identity management offerings to twist slowly in the wind while it pursues open source nirvana and while undergoing internecine battles. [Identity mangement news]
12:12:13 PM  PermaLink   / trackback []  

News Item 4412 North Carolina Sued for Illegally Certifying Voting Equipment.

North Carolina Sued for Illegally Certifying Voting Equipment.

EFF Asks Court to Void Approval of Diebold and Others Without Source Code Review

Raleigh, North Carolina - The Electronic Frontier Foundation (EFF) on Thursday filed a complaint against the North Carolina Board of Elections and the North Carolina Office of Information Technology Services on behalf of voting integrity advocate Joyce McCloy, asking that the Superior Court void the recent illegal certification of three electronic voting systems.

North Carolina law requires the Board of Elections to rigorously review all voting system code "prior to certification." Ignoring this requirement, the Board of Elections on December 1st certified voting systems offered by Diebold Election Systems, Sequoia Voting Systems, and Election Systems and Software without having first obtained [^] let alone reviewed [^] the system code.

"This is about the rule of law," said EFF Staff Attorney Matt Zimmerman. "The Board of Elections has simply ignored its mandatory obligations under North Carolina election law. This statute was enacted to require election officials to investigate the quality and security of voting systems before approval, and only approve those that are safe and secure. By certifying without a full review of all relevant code, the Board of Elections has now opened the door for North Carolina counties to purchase untested and potentially insecure voting equipment."

North Carolina experienced one of the most serious malfunctions of e-voting systems in the 2004 presidential election when over 4,500 ballots were lost in a voting system provided by e-voting vendor UniLect Corp. Electronic voting systems across the country have come under fire during the past several years as unexplained malfunctions combined with efforts by vendors to protect their proprietary systems from meaningful review have left voters with serious questions about the integrity of the voting process.

"North Carolina voters deserve to have their election laws enforced," said co-counsel Don Beskind of the Raleigh law firm of Twiggs, Beskind, Strickland & Rabenau, P.A. "Election transparency is a requirement, not an option. The General Assembly passed this law unanimously, and it is now time for the Board of Elections to meet their obligations."

On behalf of McCloy, EFF and Beskind intervened in [^] and convinced a judge to dismiss [^] a separate lawsuit filed last month by Diebold, which sought to be exempted from the state's transparency laws. Diebold represented to the court that it would be "unable" to comply with the code escrow requirement of the statute. Inexplicably, the Board of Elections certified Diebold despite it's admitted inability to comply with the law.

A hearing in McCloy's case against the Board of Elections is set for Wednesday, December 14. EFF and Beskind have asked the Court for a temporary restraining order preventing North Carolina's 100 counties from purchasing any of the recently certified systems unless and until the Board of Elections complies with its statutory obligations.

For the full complaint:
http://www.eff.org/Activism/E-voting/EFF_Mandamus_Complaint_TRO_20051208140945.pdf

Contact:

Matt Zimmerman
Staff Attorney
Electronic Frontier Foundation
mattz@eff.org

[EFF: Breaking News]
12:10:40 PM  PermaLink   / trackback []  

News Item 4411 Speakers Confirmed for the Second Security-Enhanced Linux Symposium and Developer Summit; Event Slated for February 27-March 3, 2006 in Baltimore, Md., USA

Speakers Confirmed for the Second Security-Enhanced Linux Symposium and Developer Summit; Event Slated for February 27-March 3, 2006 in Baltimore, Md., USA

BALTIMORE --(Business Wire)-- Dec. 7, 2005 -- The Security-Enhanced Linux ("SELinux") Symposium announces papers and speakers for its second annual symposium. Experts from business, government, and academia will share and discuss the latest SELinux research and development results, application experience, and product plans. The event explores the emerging SELinux technology and the power of flexible mandatory access control in Linux. Registration for the SELinux Symposium, scheduled for February 27-March 3, 2006 in Baltimore, Maryland, will open soon at www.selinux-symposium.org.

The Second SELinux Symposium features two full days of SELinux-related tutorials followed by a two-day technical agenda that includes papers, presentations, and case studies by experts and practitioners with SELinux. Topics for the symposium include in-depth discussions of the core SELinux technology, emerging SELinux policy management and development tools, experiences using SELinux to build secure system solutions, and the status of SELinux within Linux. New this year is an invitation-only SELinux developer summit, where the core developers and contributions of SELinux discuss upcoming technology changes, requirements, and plans.
12:08:52 PM  PermaLink   / trackback []  

News Item 4410 SELinux Symposium - February 27 through March 3, 2006 Baltimore, Maryland

Wyndham Hotel February 27 through March 3, 2006 Baltimore, Maryland 



The preliminary agenda for the Second SELinux Symposium and Developer Summit has been released. This year's agenda includes 2 days of SELinux-related tutorials and a two-day technical session that includes papers, presentations, and case studies by experts and practitioners with SELinux. New this year is an invitation-only SELinux developer summit, where the core developers and contributors of SELinux discuss upcoming technology changes, requirements, and plans.

Registration for the Second SELinux Symposium will open soon, please check back.


12:06:25 PM  PermaLink   / trackback []  


News Item 4409 PATRIOT Reauthorization Slogs On.

PATRIOT Reauthorization Slogs On.

Next Steps Unclear, Action Still Needed

The PATRIOT Act took a step closer to reauthorization today as Senator Arlen Specter of Pennsylvania announced that he would sign the conference report (in three parts: one, two, and three).

Backroom deals have watered-down the best reforms and opportunistic politicians have bolted on unpopular additions. However, several other senators refuse to go along with the deal, and a filibuster may be in the offing next week. Call your senators and representative now, and demand they vote "no" on PATRIOT renewal!

[EFF: Deep Links]
12:02:07 PM  PermaLink   / trackback []  

News Item 4408 Government pitches ID cards as fix for online ID fraud.

Government pitches ID cards as fix for online ID fraud.

But not entirely convincingly...

The Home Office is considering pitching the UK identity card scheme as a fix for online and 'card not present' fraud, according to answers given to parliamentary questions by Home Office Minister Andy Burnham earlier this week. The Home Office has previously indicated that it foresees the possibility of ID cards being used to support financial transactions at some point in the future (for example, when the deployment of future generations of ATMs might allow the ID card to 'piggy back' on the banking networks), but it now seems that it anticipates more immediate financial uses for the ID cards.

[The Register - Internet and Law: Digital Rights/Digital Wrongs]
12:00:02 PM  PermaLink   / trackback []  

News Item 4407 Appeals Court hearing on airline ID requirement.

Appeals Court hearing on airline ID requirement.

As I mentioned yesterday, the 9th Circuit U.S. Court of Appeals heard oral argument this morning in Gilmore vs. Gonzales (originally Gilmore vs. Ashcroft ), the U.S. Federal case challenging the secrecy and the legality of the requirement for would-be travellers to "show ID" (a surprisingly ambiguous phrase) as a precondition to travel within the USA by airline common carrier or to the exercise of their Constitutional right, under the First Amendment, to assemble by means of air travel.

Fortunately the 9th Circuit sits in San Francisco only a few blocks from my office at Airtreks.com South of Market, and I was able to take the morning off to attend the appellate hearing. (Currently the court uses the elegant and functional former San Francisco main Post Office and District Courthouse where I used to collect the mail for the National Resistance Committee from our post office box. But the 9th Circuit has a hideous new highrise fortress, making astonishingly inefficient use of its space, under construction across the street for its future home.)

Most of the hearing was devoted to procedural and jurisdictional issues of little interest to the majority of my readers who, unlike me, probably don't read law for fun.

There is no required calendar for the Circuit Court's decision, but it probably won't come for at least a month or two, perhaps longer.

The good news, as I read the tea leaves of the argument, is that it appears that John Gilmore and the cause he has taken up will eventually get their day in court, and may get it somewhat sooner rather than later: the 3 judges seemed inclined, if they rule that the case should first have been filed with them instead of with the district court, to order it transferred to their jurisdiction, rather than ordering it dismissed and making Mr. Gilmore start over from scratch in the circuit court.

The bad news is that it seems that the judges just don't get it on two points that are key to the case:

First, the judges seemed to have no recognition of air travel or travel in general as an act of assembly, an activity protected under the First Amendment, or a right protected by Federal law. They seemed to assume that ID is not required for other means of travel (ID is increasingly required, as Gilmore's attorney Jim Harrison pointed out, for travel by every means from Amtrak and Greyhound to passenger ships and ferries; the government's lawyer suggested that Mr. Gilmore could "hire a chauffeur" if he didn't want to show ID, which might be characterized as the "Let them eat cake" theory of travel rights), and that Mr. Gilmore "could just leave" the airport if he didn't want to show ID to travel by air.

But as I've noted earlier in relation to this appeal, airlines can be licensed under U.S. Federal law only on condition that they agree to operate as "common carriers". Unlike some other businesses, they can't say, "We reserve the right to refuse service", or tell a would-be passenger to take their business elsewhere. It would be a Federal offense for an airline to refuse to transport (as both Southwest and United did in Mr. Gilmore's case) anyone who is willing to pay the fare in their published tariff and complies with their published conditions of carriage, as that tariff and those conditions are filed with the government.

Second, none of the judges seemed to recognize the distinction between "asking for ID" and "requiring the showing of ID", despite the crucial role that distinction played in the Supreme Court's decision on ID demands earlier this year in Hiibel vs. Nevada .

ID as "identity" (a concept or personal attribute) is not the same as ID as "a document or other credential providing evidence of one's identity" (an object).

I pointed this out at the time of the Hiibel decision, and Professor Michael Froomkin noted the same point then and again more recently in relation to the case of Deborah Davis, who was scheduled for arraignment tomorrow in Denver for refusing to show ID in order to ride a public bus but against whom charges were dropped at the last minute.

There are four distinct potential components to an "ID" rule, each raising different legal issues and potentially subject to different legal analysis: (1) asking for verbal self-identification (the right to ask a question); (2) demanding such self-identification (the right to impose sanctions, such as more intrusive search, as a penalty for silence or an unsatisfactory answer, which raises the privilege against self-incrimination); (3) demanding that tangible credentials of identity be produced and displayed for visual inspection -- or, perhaps, that RFID credentials be removed from an RF shield and exposed to RF interrogation (it's the demand for the production and display of the tangible object, and its exposure to visual or RF inspection, that constitutes a "search" and raises 4th Amendment issues); and (4) requiring that the proffered credential satisfy specified criteria of acceptability as a condition of being permitted to take some action or avoid some sanction (which raises questions of due process in how that determination is made, as well as its permissibility as a precondition to exercising any legal right such as the right to assemble or to travel by common carrier).

The Supreme Court explicitly recognized at least part of this set of distinctions. It found that Hiibel had only been subjected to a (permissible, it found, although in circumstances different from those in Mr. Gilmore's case) demand to identify himself verbally (items 1 and 2) above, and not to a demand to produce or display any identity documents. As a result, the Supreme Court found that the ID demand, being limited to a demand for verbal self-identification, didn't constitute a "search". Not being presented (they said) with circumstances 3 or 4 above, the Supreme Court didn't address or decide any of the issues they would have raised.

(The Supreme Court got the facts wrong. The video clearly shows that Hiibel was asked repeatedly, "Show some ID", not "State your name". That was a search, not just an interrogation. But the precedent is applied on the basis of the "facts" as the Supreme Court found them, not the actual facts.)

In today's hearing, Judge Trott in particular kept asking questions like, "What's your best case for the proposition that asking for ID is a search?" While Mr. Harrison immediately answered, "Hiibel", it wasn't clear that Judge Trott recognized the critical distinction in the Hiibel decision between the (permissible) questioning in that case, and the (potentially impermissible) search embodied in a demand for tangible credentials.

Mr. Gilmore had, in fact, identified himself to the airlines prior to attempting to travel: In each case, he had presented a ticket showing his name. It's impossible under IATA standards to issue tickets without specifying on them the name of the passenger. Since those tickets were, under the contractual conditions in the airlines' tariffs, non-transferable, it would have been a breach of contract and perhaps a Federal crime (fraud and/or attempted theft of services) for him to attempt to fly on those tickets if he were anyone other than the person for whom they were originally purchased.

I don't know if Mr. Gilmore was verbally asked, or stated, his name -- so far as I can tell, the record is silent on that point. But by presenting himself for transportation, and presenting those tickets as entitling him to passage, he was implicitly making a legally binding self-declaration as to his name and identity.

This case is not, therefore, about anonymous travel, an interesting but irrelevant side issue that was raised in this morning's argument. It's not about whether Mr. Gilmore could be asked for ID (he was, in effect, when he was asked to present a name-identified non-transferable ticket) or whether Mr. Gilmore could be sanctioned for failing to identify himself (he did identify himself).

The issue in this case is specifically about the legality of the search embodied in the demand for tangible evidence of identity, and the lack of due process embodied in the secrecy of the "rule" requiring production of ID credentials (whose existence, even today, government counsel would "neither confirm nor deny") and the lack of any publicly-disclosed criteria as to what evidence of identity is sufficient, or how its sufficiency is to be determined.

A demand, by or at the behest of the government, to take out something on or about your person (but not otherwise in public view), and display it for their inspection, is a search -- whether that demand takes the form of, "If you have any pot in your pockets, show it to me," or "If you have any ID cards in your pockets, show them to me".

[The Practical Nomad]
11:52:33 AM  PermaLink   / trackback []  

News Item 4406 Cops, Crooks Find Cell Phones Handy Tools.

Cops, Crooks Find Cell Phones Handy Tools. Securing phone data is an overlooked business concern, say experts. [PCWorld.com - Latest News Stories]
11:49:46 AM  PermaLink   / trackback []  

News Item 4405 Critical Windows Patch Expected.

Critical Windows Patch Expected. Malware removal tool update is among scheduled December fixes. [PCWorld.com - Latest News Stories]
11:48:28 AM  PermaLink   / trackback []  

News Item 4404 Tentative PATRIOT Deal Weak on Civil liberties.

Tentative PATRIOT Deal Weak on Civil liberties. CDT today responded to reports describing a tentative deal to renew the PATRIOT Act that fails to set adequate standards for use of the Act's more intrusive surveillance powers. "The conference report as it stands today is not an acceptable compromise," CDT Executive Director Jim Dempsey said. "Congress is missing an opportunity to preserve the PATRIOT Act's investigative tools while protecting privacy with some modest checks and balances. CDT supported a Senate renewal bill that included a few basic protections. The deal described in recent reports would still allow the government to get private data on people who are not suspected of having any connection to terrorism. The legislation would also expand the impact of National Security Letters, which are issued with no judicial review, by making them easier to enforce and harder for recipients to resist." [Center for Democracy and Technology]
11:46:59 AM  PermaLink   / trackback []