Thursday, December 29, 2005

Blu-Ray Facing Delays Caused by DRM Squabbling. Blu-Ray Facing Delays Caused by DRM Squabbling. Tomo Hiratsuka writes "Disney, Warners et al, the companies behind the AACS content management system, apparently can't get their act together to complete the standard they wish to impose on Blu-ray. The result? Pioneer has the first Blu-ray drive for PCs ready for market next month but is openly admitting the DRM issue may force it to delay." From the article: "The inability of the companies behind the AACS (Advanced Access Content System) content management system to complete their work has already caused Toshiba to put launch plans for its HD DVD player on hold. AACS is made up of a number of companies from the electronics and content industries. The group's founders include IBM, Intel, Microsoft, Panasonic, Sony, Toshiba, Disney and Warner Bros." [Slashdot: Your Rights Online] 1:16:18 PM  PermaLink   / trackback []

IT Architect | Will ISPs Quarantine You From the lnternet? | January 1, 2006 When the FCC announced it would deny independent ISPs access to the phone companies' wires as of August this year, commissioners claimed that their decision would somehow improve competition. In the small print, it was clear they didn't believe their own spin. Recognizing the threat that the newly enthroned monopolies posed to customers, the FTC adopted a statement of principles that said ISPs shouldn't block access to lawful Internet content, services, or applications. The statement is one small piece of good news. It means SBC and Verizon can't firewall off competitive VoIP services (as North Carolina phone company Madison River Communications tried to do with Skype) or censor their critics (as Canadian phone company Telus did during a labor dispute). But it applies only to the Internet side of the link. A greater threat is that ISPs may try to restrict the customer's side by denying access to machines based on their hardware or software configuration. And far from banning that, the government may be encouraging it. Back when he was head of cybersecurity, White House terrorism advisor Richard Clarke even said it should be made mandatory to quarantine malware. It seemed crazy at the time, but the required technologies are now becoming available. Vendors call them by different names, but all use an agent on the client to verify its configuration. If the agent reports software (or in more advanced versions, hardware) that isn't on a white list, access is denied. Access control agents have two big practical problems on a private network, both of which are more serious on the wider Internet: Not all clients can run the agents, and new programs not yet certified malware-free won't be on the white list. Worse, ISPs might base their lists on commercial considerations. So while custom enterprise applications are locked out, Sony's rootkit gets through. I asked some of the key players in the Trusted Computing Group (TCG), which is standardizing agent hardware and protocols, whether abuse by ISPs was likely. Their answers were mixed. Brian Berger, chair of the TCG's marketing group, says ISPs might want to use them to offer value-added services. Critics fear that in the future "added value" could mean access to anything beyond a small subsection of the Internet. 1:12:33 PM  PermaLink   / trackback []

ISP Restrictions Based on Hardware/Software? ISP Restrictions Based on Hardware/Software? An anonymous reader writes "IT Architect magazine is reporting that ISPs are working towards a greater restriction of a customer's right to run what may be 'insecure' software. From the article: 'A greater threat is that ISPs may try to restrict the customer's side by denying access to machines based on their hardware or software configuration. [...] former head of cybersecurity, White House terrorism advisor Richard Clarke even said it should be made mandatory to quarantine malware.' Something that may also come as a surprise to some is that Microsoft is completely against this censorship of internet access. 'According to Chief Privacy Officer Peter Cullen, Microsoft is against ISPs doing anything that would restrict customers' choice of software. And he says this isn't just about the impracticability of demanding that data centers patch everything on the second Tuesday of the month. Laptop and home users also have the right to run an insecure PC.'" [Slashdot: Your Rights Online] 1:08:53 PM  PermaLink   / trackback []

Australian Media 'Crooks' to Come in from the Cold. Australian Media 'Crooks' to Come in from the Cold. pagefault writes "News.com is reporting that millions of Australians who tape TV shows and copy CDs will soon get the right to do it with a clear conscience. From the article: 'The Federal Government will next year legalize the video recording of television shows for personal use, and the transfer of songs from CDs to MP3 players, in a bid to overturn a ban which has made criminals of much of the population."  [Slashdot: Your Rights Online] 1:05:05 PM  PermaLink   / trackback []

ALA | Student Claims Homeland Security Has Book Watch List - A Little Red Hoax ?? A little red hoax. MyNameIsFred writes "In an earlier Slashdot story, it was reported that a student was investigated for requesting Mao's Little Red Book on inter-library loan. It appears that the story was a hoax." [...] The UMD chancellor's office released a statement December 19 that said, "At this point, it is difficult to ascertain how Homeland Security obtained the information about the student's borrowing of the book. The UMass Dartmouth Library has not been visited by agents of any type seeking information about the borrowing patterns or habits of any of its patrons." Chancellor Jean F. MacCormack stated, "It is important that our students and our faculty be unfettered in their pursuit of knowledge about other cultures and political systems if their education and research is to be meaningful." Kirk Whitworth, a spokesman for the DHS--the U.S. cabinet department that oversees the Immigration and Customs Enforcement agency, the Secret Service, and Citizenship and Immigration Services, among others--said in the December 21 Standard-Times that the story seemed unlikely. "We're aware of the claims," he said. "However, the scenario sounds unlikely because investigations are based on violation of law, not on the books and individual[s who] might check [them] out from the library." An earlier report that the incident occurred at the University of California at Santa Cruz has proven false. 1:01:53 PM  PermaLink   / trackback []

NSA Caught With The Cookies. NSA Caught With The Cookies. zardo writes "The associated press is reporting that the NSA is putting cookies on visiting computers. Apparently it is unlawful for the government to put anything but a session cookie out unless it's expressed in the site's privacy policy." From the article: "Don Weber, an NSA spokesman, said in a statement Wednesday that the cookie use resulted from a recent software upgrade. Normally, the site uses temporary, permissible cookies that are automatically deleted when users close their Web browsers, he said, but the software in use shipped with persistent cookies already on. ... In a 2003 memo, the White House's Office of Management and Budget prohibits federal agencies from using persistent cookies _ those that aren't automatically deleted right away _ unless there is a 'compelling need.' A senior official must sign off on any such use, and an agency that uses them must disclose and detail their use in its privacy policy." [Slashdot: Your Rights Online] 12:54:25 PM  PermaLink   / trackback []

Tory and Lib Lords plan to hobble ID cards scheme. Tory and Lib Lords plan to hobble ID cards scheme. Amendment would make registration optional Tory and Liberal Democrat peers plan to 'decouple' passports and identity cards by allowing passport applicants to opt out of the National Identity Register, according to a report in the Daily Telegraph. Although the Government describes the initial rollout of the ID scheme as voluntary, it intends that ID cards first be deployed via passport renewals, with those needing new passports having no choice over being registered; removal of this aspect of the Bill could fatally undermine its ability to achieve critical mass for ID cards. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 12:50:28 PM  PermaLink   / trackback []

InformationWeek | Data Breach Protection | Data Security Movement Back-Burnered By Lawmakers | December 22, 2005 Once a hot-button item, data and identity theft protection has stalled in Congress, a research analyst said Thursday, pushed aside by bigger political fish, ranging from Iraq and Hurricane Katrina to domestic spying and Supreme Court nominees. Despite a year's worth of highly publicized security breaches and a lot of talk in Congress this summer on ways to protect consumers, there's been too little done to protect U.S. consumers' data, said Gartner research director Avivah Litan. "It's business as usual," she said, citing two recent breaches -- one involving a lost backup tape with data on two million mortgage holders, another related to credit card fraud at gas pumps -- as evidence. "Not enough has changed. Data protection has moved up the priority list, but not nearly enough." Identity theft legislation, which at one point this summer accounted for nearly 30 different bills in Congress, is going nowhere fast. "Everything that Congress does is politically motivated, of course," said Litan. "Data security and identity theft are not front-burner issues now. They've been superseded by things like Katrina and the NSA's domestic spying. With all the other matters in front of Congress, it's inevitable that data security would lose its political appeal." Although progress will continue to be made by states -- which have been leading the effort to regulate data security and consumer notification in the event of a breach -- Litan gives a federal bill just a 50-50 shot at passing in 2006. 12:46:32 PM  PermaLink   / trackback []

SC Magazine US - Marriott customer data missing A division of the Marriott International hotel empire has notified more than 200,000 clients of back-up security tapes missing from the company's Orlando corporate offices. The breached records contained personal information of about 206,000 associates, timeshare owners and timeshare customers, the company said this week in a statement. 12:43:30 PM  PermaLink   / trackback []

Virus Masquerades as MSN Messenger Beta. Virus Masquerades as MSN Messenger Beta. Users who think they are getting a sneak peek of the IM app are in for a surprise. [PCWorld.com - Latest News Stories] 12:40:38 PM  PermaLink   / trackback []

Malicious Hackers Exploit Windows Flaw. Malicious Hackers Exploit Windows Flaw. Fully patched Windows XP and Windows Server 2003 systems may be vulnerable, security firms warn. [PCWorld.com - Latest News Stories] 12:39:35 PM  PermaLink   / trackback []

Update on the Critical Unpatched Windows Flaw. Update on the Critical Unpatched Windows Flaw. Security Fix warned readers on Wednesday about thousands of malicious Web sites that are using an unpatched Windows security hole to install spyware, spam-ware and other programs on computers when their owners merely browse to one of these sites. As serious as this situation is -- and it is hard to find a recent Windows threat as potentially dangerous as... [Security Fix] 12:36:14 PM  PermaLink   / trackback []

Exploit Released for Unpatched Windows Flaw. Exploit Released for Unpatched Windows Flaw. Security researchers have released instructions for exploiting a previously unknown security hole in Windows XP and Windows 2003 Web Server with all of the latest patches applied. Anti-virus company Symantec warned of the new exploit, which it said uses a vulnerability in the way Windows computers process certain image files (Windows Meta Files, or those ending in .wmf). Symantec said... [Security Fix] 12:34:45 PM  PermaLink   / trackback []

Sony BMG to Settle Class-Action Lawsuit. Sony BMG to Settle Class-Action Lawsuit. It appears that Sony BMG Music Entertainment has agreed to a settlement that would end a nationwide class-action lawsuit brought against the company over security flaws in anti-piracy software that it shipped on millions of music CDs. The Sunbelt Software blog has a copy of the proposed settlement in the case, which was brought last month by a New York-based... [Security Fix] 12:33:21 PM  PermaLink   / trackback []