Thursday, March 30, 2006

Why Phishing Works. Why Phishing Works. h0neyp0t writes  "Harvard and Berkeley have released a study that shows why phishing attacks work (pdf). When asked if a phishing site was legit or a spoof, 23% of users use only the content of the website to make the decision! The majority of users ignore the address and SSL indicators in the browser. Some users think that favicons and lock icons in HTML are more important indicators. The paper hints that the proposed IE7 security indicators and multi-colored address bar will also suffer a similar fate. This study is brought to you by the people who developed the security skins Firefox extension."  [Slashdot] 2:16:01 PM  PermaLink   / trackback []

Linux.com | Review: Trustix Secure Linux lives up to its name Trustix Secure Linux is an interesting distro for servers that is designed to be all about security. While Linux, in general, is fairly secure, a distro that focuses on security and stability from the ground up should be a good choice for Internet servers. In our testing, we found Trustix lives up to its intentions. I downloaded the stable 2.2 release of Trustix. You can also download the new version, 3.0, which is based on the 2.6 series kernel. However, if your focus is security, Trustix suggests that you use the stable version. The 450MB ISO is easy to download, especially since it's available via Bittorrent. Trustix concentrates on keeping it simple. You won't get a GUI or the latest bells and whistles. What you do get with Trustix is a small and secure distribution that incorporates IBM's Stack Smash Protection, which protects the system and applications from stack-smashing attacks. This is one of the major forms of attacks, and many secure Linux distros have this turned on by default. The developers have kept the number of packages to a minimum by including only the basic server-specific packages. Trustix contains no graphical desktop and few userland tools.   2:11:54 PM  PermaLink   / trackback []

Trustix, a Worthy Contender? Trustix, a Worthy Contender?  Linux.com (also owned by OSTG) is running a quick look at Trustix, a Linux distro designed for servers that focuses on ground up security and stability. From the article: "No operating system can claim to be completely secure. There will always be zero-day exploits, configurations errors, user errors, and other factors that can defeat the best security for any system. On the other hand, it's always good to start from a secure base and then add more security. Trustix provides a reliable and secure Linux distribution that you can build upon. There are no wasteful graphical displays and no wizards to set up your firewall. If you aren't comfortable with the command line, forget about Trustix. [...] That said, Trustix does a good job of keeping your system up-to-date, and if you have the required experience, you'll find that it's a robust distro. As a simple server distro with a high level of security and customizability, Trustix is a worthy contender." [Slashdot] 2:07:52 PM  PermaLink   / trackback []

Drone aircraft may prowl U.S. skies | CNET News.com In a scene that could have been inspired by the movie "Minority Report," one North Carolina county is using a UAV equipped with low-light and infrared cameras to keep watch on its citizens. The aircraft has been dispatched to monitor gatherings of motorcycle riders at the Gaston County fairgrounds from just a few hundred feet in the air--close enough to identify faces--and many more uses, such as the aerial detection of marijuana fields, are planned. That raises not just privacy concerns, but also safety concerns because of the possibility of collisions with commercial and general aviation aircraft. "They're a legitimate user of the airspace and they need to play by the same rules as everyone else," Melissa Rudinger, vice president of regulatory affairs at the Aircraft Owners and Pilots Association, said in a telephone interview. Pilots undergo extensive training on collision detection and avoidance. Planes that fly at night are required to have certain types of lights, for instance. Operating an aircraft near busy airports (in government parlance, "Class B" airports) requires a transponder that broadcasts its altitude. And during all flights that take place in poor weather or higher than 18,000 feet above sea level, the pilot must be in radio contact with controllers. No such anti-collision rules apply to UAVs. Rudinger is concerned that UAVs--either remote-controlled or autonomous drones--will pose a safety threat to pilots and their passengers. She's not that worried about larger UAVs operated by the military that have sophisticated radar systems, but about smaller ones that have limited equipment and potentially inexperienced ground controllers. 1:59:01 PM  PermaLink   / trackback []

Unmanned Aerial Drones Coming Soon Above U.S.. Unmanned Aerial Drones Coming Soon Above U.S..  cnet-declan writes  "Unmanned aerial vehicles (UAVs) have been flying over Iraq and Afghanistan, but now the Bush administration wants to use them for domestic surveillance. A top Homeland Security official told Congress today, according to this CNET News.com article, that: "We need additional technology to supplement manned aircraft surveillance and current ground assets to ensure more effective monitoring of United States territory." One county in North Carolina is already using UAVs to monitor public gatherings. But what happens when lots of relatively dumb drones have to share airspace with aircraft carrying passengers? A pilot's association is worried."    [Slashdot] 1:55:49 PM  PermaLink   / trackback []

Lenovo Under U.S. Probe for Spying. Lenovo Under U.S. Probe for Spying. BigControversy writes "The DailyTech has a report indicating that Lenovo, the giant Chinese PC manufacturer, is under a probe by the U.S.-China Economic Security Review Commission (USCC) for possible bugging. Apparently, the government has ordered 16,000 PCs from Lenovo but is now requesting that Lenovo be investigated by intelligence agencies. The fear is of foreign intelligence applying pressure to Lenovo to equip its PCs so that the U.S. can be spied on." From the article: "Despite the probe, Lenovo says that its international business, especially those that deal with the US, follow strictly laid out government regulations and rules. Lenovo also claims that even after purchasing IBM's PC division, its international business has not been affected negatively. Interestingly, in an interview with the BBC, Lenovo mentioned that an open investigation or probe may negatively affect the way that the company deals with future government contracts or bids." There just has to be better uses of our intelligence community's time. [Slashdot] 1:51:12 PM  PermaLink   / trackback []

DRM and the myth of the 'analog hole' | George Ou | ZDNet.com Copying high definition 1080p content over an analog signal is very expensive, time consuming, and prone to quality loss during the conversion even without ICT restrictions. Even if there was no way to make a high-speed bit-for-bit digital copy directly in a computer because of some DRM mechanism, there will always be some way for determined crackers to intercept unprotected digital content before it's delivered to the video output device. It is simply naive to think that any music or video pirate professional or casual is going to use the so called "analog hole" to pirate content and even dumber to pass laws that make maximum quality analog connectors illegal. Most new HDTV sets don't even have HDMI connectors let alone older HDTV sets so if ICT enforcement is ever adopted, almost everyone will be negatively affected. Most movie companies with the exception of Warner Brothers have already indicated that they would not initially implement ICT because they realize that they would have an uproar because so many people would be adversely affected. But in the future when enough HDMI-capable HDTV sets are on the market, there is no guarantee that the movie companies won't try to sneak ICT enforcement in to future releases. 1:42:18 PM  PermaLink   / trackback []

DRM and the Myth of the Analog Hole. DRM and the Myth of the Analog Hole. Art Grimm writes "Movie studios want to punish legitimate customers for legally purchasing content, while the real pirates go right on stealing. ZDNet's George Ou writes: "There seems to be a persistent myth floating around the board rooms of the movie companies and Congress that analog content is the boogie man of music and video piracy. In fact, they're so paranoid about it that they're considering a mechanism called ICT (Image Constraint Token) that punishes law-abiding customers for content that they legally purchased. But ironically, the real content pirates who make millions of bootleg movies have no intention of ever taking advantage of the so called "analog hole" because that is the slowest and lowest quality method of stealing content."" [Slashdot: Your Rights Online] 1:38:43 PM  PermaLink   / trackback []

UK Government Passes ID Card Bill. UK Government Passes ID Card Bill. cowbutt writes "The two houses of the UK government, the elected House of Commons and the House of Lords have agreed a compromise on Labour's ID cards bill, after Conservative peers accepted a Labour amendment. Under the new amendment, anyone renewing a designated document (e.g. passport) will be able to opt-out of getting a card until 2010, but will still have their details put on the National ID Register immediately." [Slashdot: Your Rights Online] 1:34:07 PM  PermaLink   / trackback []

Judges on Secretive Panel Speak Out on Spy Program - New York Times  Five former judges on the nation's most secretive court, including one who resigned in apparent protest over President Bush's domestic eavesdropping, urged Congress on Tuesday to give the court a formal role in overseeing the surveillance program. In a rare glimpse into the inner workings of the secretive court, known as the Foreign Intelligence Surveillance Court, several former judges who served on the panel also voiced skepticism at a Senate hearing about the president's constitutional authority to order wiretapping on Americans without a court order. They also suggested that the program could imperil criminal prosecutions that grew out of the wiretaps. Judge Harold A. Baker, a sitting federal judge in Illinois who served on the intelligence court until last year, said the president was bound by the law "like everyone else." If a law like the Foreign Intelligence Surveillance Act is duly enacted by Congress and considered constitutional, Judge Baker said, "the president ignores it at the president's peril." Judge Baker and three other judges who served on the intelligence court testified at a Senate Judiciary Committee hearing in support of a proposal by Senator Arlen Specter, Republican of Pennsylvania, to give the court formal oversight of the National Security Agency's eavesdropping program. Committee members also heard parts of a letter in support of the proposal from a fifth judge, James Robertson, who left the court last December, days after the eavesdropping program was disclosed. 1:29:38 PM  PermaLink   / trackback []

Florida banks hacked in new spoofing attack. Florida banks hacked in new spoofing attack. Three Florida banks have had their Web sites compromised by hackers in an attack that security experts are calling the first of its type. [...] According to Breeden, the affected banks are Premier Bank, Wakulla Bank and Capital City Bank, all small, regional banks based in Florida. This attack was similar to phishing attacks that are commonly used against online commerce sites, but in this case hackers had actually made changes to legitimate Web sites, making the scam much harder for regular users to detect. Phishing attacks generally require users to click on a bogus Web link, but this attack worked on users who had typed in the correct URL for the banks in question. [Computerworld Privacy News] 1:20:30 PM  PermaLink   / trackback []

U.K. poised to move ahead with national ID cards. U.K. poised to move ahead with national ID cards. The British government could soon roll ahead with plans to issue national ID cards after both houses of Parliament reached a compromise Wednesday night on a bill detailing the plan.[Computerworld Privacy News] 1:17:34 PM  PermaLink   / trackback []

Banks Hit With New Spoofing Attacks. Banks Hit With New Spoofing Attacks. Attackers made changes to legitimate Web sites, making the scams much harder to detect. [PCWorld.com - Latest News Stories] 1:12:00 PM  PermaLink   / trackback []

(IN)SECURE Magazine Issue 5. (IN)SECURE Magazine Issue 5. Articles in this issue include: Web application firewalls primer, Review: Trustware BufferZone 1.6, Threat analysis using log data, Looking back at computer security in 2005, Writing an enterprise handheld security policy, Digital Rights Management, Revenge of the Web mob, Hardening Windows Server 2003 platforms made easy and Filtering spam server-side [(IN)SECURE Magazine Notifications RSS] 10:00:12 AM  PermaLink   / trackback []

(IN)SECURE Magazine Issue 6. (IN)SECURE Magazine Issue 6. Articles in this issue include: Best practices in enterprise database protection, Quantifying the cost of spyware to the enterprise, Security for websites - breaking sessions to hack into a machine, How to win friends and influence people with IT security certifications, The size of security: the evolution and history of OSSTMM operational security metrics, Interview with Kenny Paterson, Professor of Information Security at Royal Holloway, University of London, PHP and SQL security today, Apache security: Denial of Service attacks, War-driving in Germany - CeBIT 2006 [(IN)SECURE Magazine Notifications RSS] 9:58:43 AM  PermaLink   / trackback []

House Committee Approves Revised Data Security Legislation. House Committee Approves Revised Data Security Legislation. The House Energy and Commerce Committee today approved a version of data security legislation that, in addition to providing a nationwide standard for notifying consumers about data security breaches, would give consumers the right to review information in their data broker files. The bill represents a substantial improvement over the version approved at the subcommittee level last year, and is significantly stronger than an alternative bill approved by the House Financial Services Committee earlier this month. The overall prospects for enacting federal data security legislation this year remain uncertain, as it would require reconciling the multiple bills on the subject that have been proposed by several committees in both the House and Senate. [Center for Democracy and Technology] 9:56:07 AM  PermaLink   / trackback []

Report: Looking for love in all the wrong places Despite all the dire warnings about legal liabilities and security risks, a new study indicates one in five workers uses his or her company's Web access for personal use. Among the industries reporting the highest abuse is the male-dominated manufacturing field, where nearly 13% of users try accessing forbidden pornography, dating and gambling sites. Its workforce also tended to chat longest with friends while at work. Government workers, meantime, were more likely to be lured to a site containing spyware and malicious code, according to a just-released report by content-filtering software provider Burstek, a unit of Burst Technology Inc. based in Bonita Springs, Fla. The study of 10,688 employees in seven industries reflects the reality of Internet usage in the office. Twenty percent of all Internet access at work was for personal use, accounting for 21% of a company's bandwidth costs. The study included education, engineering, finance, government, healthcare, manufacturing and non-profit organizations -- some of which used content filtering software and others that merely monitored their employees' behavior. 9:54:25 AM  PermaLink   / trackback []

(IN)SECURE Issue 6 has been released. (IN)SECURE Issue 6 has been released. The latest edition of this free PDF digital security magazine is packed with content that caters all levels of knowledge. Get your copy today! [LinuxSecurity.com] 9:50:20 AM  PermaLink   / trackback []

ID cards sorta compulsory. ID cards sorta compulsory. It's called a compromise ID card opponents lost a key battle in Westminster last night, after a month that has seen the Identity Card Bill tossed between the Commons and Lords. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 9:44:58 AM  PermaLink   / trackback []

Tories promise to ditch ID Cards. Tories promise to ditch ID Cards. A liberal conundrum? The Conservatives will scrap ID Cards if they win the 2010 election, shadow home secretary David Davis promised last night. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 9:43:10 AM  PermaLink   / trackback []

FEC Protects Bulk of Internet Speech From Campaign Finance Rules. FEC Protects Bulk of Internet Speech From Campaign Finance Rules. On Monday, the Federal Election Commission voted unanimously to adopt new regulations [PDF] that would leave Internet-related activities largely untouched by campaign finance rules. Monday's vote marked the culmination of a series of events put into motion in September 2004 when a federal district court ruled that the FEC couldn't categorically exempt the Internet from federal campaign finance rules and forced the agency to draw up new rules accordingly. The new rules are a big win for bloggers and other online speakers. When the proposed rules were first announced, bloggers across the spectrum raised concerns that the FEC might intrude too far, imposing burdensome recordkeeping regulations and potentially chilling online speakers who wanted to discuss political issues or coordinate volunteers to support various issues. Frequently forgotten, however, was the fact that the FEC had expressed little interest in adopting any kind of Internet regulations in the first place. Indeed, the 2004 court ruling chastised the agency for shielding the Internet more than federal law allowed. The final rules should put most of the immediate free speech concerns of bloggers to rest. As the introduction to the final rules note, "These final rules therefore implement the regulatory requirements mandated by the Shays district decision by focusing exclusively on Internet advertising that is placed for a fee on another person's website." The FEC has interpreted campaign finance laws (and the admonition of the district court) extremely narrowly, limiting rules regarding spending limits and reporting requirements to instances where paid advertisements are placed on the Internet. Unless they take money in exchange for political advertisements, the bulk of online speakers will remain unaffected by the rule changes. The new regulations will go into effect in a little over a month. [EFF: Deep Links] 9:35:46 AM  PermaLink   / trackback []

Technologist proposes Net neutrality solution. Technologist proposes Net neutrality solution. A former chief technologist for the Federal Communications Commission is calling for a fact-based solution to the Net neutrality issue, to be determined by a neutral group of experts, meeting out of the glare of the current hype. [Public Knowledge - Breaking News] 9:32:46 AM  PermaLink   / trackback []