Wednesday, November 8, 2006

Lack of E-Voting Paper Trail Precludes Full Recount in Virginia, Elsewhere. Lack of E-Voting Paper Trail Precludes Full Recount in Virginia, Elsewhere. Many Virginians were among the millions of voters nationwide that cast their votes on electronic voting machines which lack paper trails. Voters thus could not verify that their votes were accurately recorded, and election officials will not be able to conduct a full and thorough recount. That's bad enough, and with the close margin in Virginia's Senate race and the U.S. Senate at stake, it is especially tragic for the entire country, regardless of who is ultimately declared the winner. Simple precautions could have been taken to prevent this and myriad other e-voting problems. Indeed, Montana fortunately requires a paper trail, which could aid a recount in its tight Senate race. Thankfully, there's an existing solution for the whole country: Rep. Rush Holt's Voter Confidence and Increased Accessibility Act (HR 550) contains several critically important election reforms, including the requirement of a paper audit trail for all electronic voting machines, random audits, and public availability of all code used in elections. The bill has gained the support of 220 bipartisan cosponsors, and, according to Holt, it even has a chance to pass before the next Congress takes office in January. Make your voice heard on HR 550 now using the form below and tell Congress to support this crucial reform. Listen to our podcast interview with Holt here. [EFF: Deep Links] 11:10:29 PM  PermaLink   / trackback []

E-Voting Problems in Tight Florida Race. E-Voting Problems in Tight Florida Race. A detailed report in Wednesday's Sarasota Herald-Tribune raises some important questions about touchscreen voting and a congressional race there that could be missing votes. The paper reports that as of Wednesday morning, Republican Vern Buchanan had a lead of a few hundred votes over Democrat Christine Jennings in the battle for Florida's 13th Congressional District. But in about 13% of the ballots cast, there was no vote in the congressional race at all. So while 87,797 in Sarasota County voted in the Florida senate race, only 76,549 made a choice in the congressional race. That's also about 3,000 fewer people than voted in the local hospital board election, according to the report. The Jennings campaign says voters complained throughout the day Tuesday about votes not registering properly in the congressional election. Supervisor of Elections Kathy Dent says nothing went wrong with the machines, but, without a paper trail, there's no way of knowing for sure that votes are accurately counted as cast. Voters in that county chose yesterday to scrap the machines in favor of paper ballots by 2008, but that can't remove the shadow e-voting machines cast over this election. [EFF: Deep Links] 11:08:37 PM  PermaLink   / trackback []

Google Accidentally Sends Out Kama Sutra Worm. Google Accidentally Sends Out Kama Sutra Worm. Staffers mistakenly e-mail the virus to subscribers of the Video Blog mailing list. [PC World: Latest Technology News] 11:06:35 PM  PermaLink   / trackback []

Is DRM Good Or Bad For Consumers? Is DRM Good Or Bad For Consumers? Experts at FTC event debate positive and negative effects of DRM on consumers. [PC World: Latest Technology News] 11:04:24 PM  PermaLink   / trackback []

Exploit Released for Unpatched Apple Wi-Fi Flaw. Exploit Released for Unpatched Apple Wi-Fi Flaw. Update, 4:35 p.m. ET: Lynn Fox over at Apple called back with the following statement: "We were recently made aware of this security issue in our first generation AirPort card, which has not shipped since October 2003. This issue affects a small percentage of previous generation AirPort enabled Macs and does not affect currently shipping or AirPort Extreme enabled Macs. We are currently investigating the issue." Original Post From Earlier Today: Security researcher HD Moore today released computer code showing how attackers can exploit an unpatched flaw present in the wireless drivers in some Apple Macintosh computers. "With all the hype and buzz about the now infamous Apple wireless device driver bugs (brought to attention at Black Hat, by Johnny Cache and David Maynor, covered up and FUD'ed by others), hopefully this will bring some light (better said, proof) about the existence of such flaws in the Airport device drivers," said LMH (the alias of the hacker who runs the Kernelfun blog) -- referring to an Apple wireless driver issue covered by Security Fix earlier this year (the links in the quote are his). Moore said he tested the exploit on a 1.0Ghz PowerBook running Mac OS X 10.4.8 with the latest updates (Halloween, 2006). "The fastest way to trigger this bug is to place the card into active scanning mode. This can be accomplished by launching Kismac [a wireless network scanning program] with the active scanning driver, or by using the 'airport' utility provided with OS X." While Apple released updates in September to fix at least three problems in its wireless drivers, there is currently no fix available from Apple for the flaw detailed by Moore. I exchanged a series of e-mails with Moore today to ask about some of this exploit's more technical details, which can be viewed here for anyone interested. In a nutshell, he says the exploit is somewhat unreliable as written, but that it could be made more so if someone spent a bit more time finessing it. He also said "it may be possible to make this exploit reliable by hammering the Airport driver with requests while triggering the bug." Moore has since folded the exploit into Metasploit 3.0, a free software tool built to help users exploit security flaws against a variety of operating systems and third-party software applications. The vulnerability is the first in a series of daily bug details to be released over the next 29 days as part of the "Month of Kernel Bugs" project. LMH said we can expect at least five more Apple kernel bugs to be detailed in the coming days, as well as kernel flaws in Linux, BSD, and Solaris 10 systems. The "kernel" is probably the most vital and fundamental area of any computer system, as it handles the transfer of information between hardware and software on a machine, among other things. Kernel flaws are serious vulnerabilities, but kernel flaws that are exploitable remotely are extremely dangerous, because an attacker can use them to completely subvert the security of the target machine, usually regardless of the presence of security software or the system privileges of the user account the victim happens to be running at the time. I put a call in to Apple spokeswoman Lynn Fox and will update this post if I hear back from the company. I also pinged David Maynor from SecureWorks to determine if this was related to the exploit I saw at the BlackHat security conference in Las Vegas this summer, but I've not yet received a response from him either. I did catch up with Maynor's co-presenter, Johnny "Cache" Ellch, who said the bug Moore released today is unrelated to the flaw detailed at Black Hat. [Security Fix] 8:58:53 PM  PermaLink   / trackback []

14 Arrested for Credit Card, Phishing Scams. 14 Arrested for Credit Card, Phishing Scams. The Washington Post today ran a story I wrote on the first phase of "Operation Cardkeeper," an international investigation by the FBI into scammers who are using online fraud forums to traffic in stolen credit cards and identities. From the story: "Facing charges in the U.S. are Frederick T. Hale, 27, and Zanadau Lyons, 24, both of Columbus, Ohio, and Dana Carlotta Warren, 29, of Ellenwood, Georgia. Authorities have also served search warrants in Albany, N.Y., Atlanta, Dallas, Knoxville, Memphis and Omaha. "Working with international authorities, the FBI also assisted in the arrests of 11 people in Poland believed to be connected to a network of online fraud forums. The FBI said it has traced a series of 'phishing' attacks from late 2004 back to members of the Polish ring." The piece was trimmed fairly heavily because the paper was tight on space, and I thought some of the details that got cut were interesting enough to include them here: "The 21-count arrest warrant against Lyons and her accomplice charges that between Dec. 2005 and Sept. 2006, the two repeatedly used online fraud forums to trade or purchase Social Security numbers and bank account information on at least seven victims. "The government also alleges that the duo purchased 'dumps,' or data electronically copied from the magnetic stripe on the back of credit or debit cards, data they allegedly then imprinted onto counterfeit cards and used in tandem with victims' stolen 4-digit PINs to withdrawal thousands of dollars from automated teller machines (ATMs) in Ohio and Virginia. "According to the indictment against Warren, between February and September of 2006, she sold Social Security numbers and other personal data via online carder forums, data that was then used to establish credit cards in the victims' names. Prosecutors say Warren, who used the hacker alias 'Sysco,' also withdrew tens of thousands of dollars using counterfeit credit cards. In addition, Warren is accused of using stolen credit cards to buy laptop computers and other electronic goods online that were then resold or shipped abroad. "None of those arrested could be immediately reached for comment. But Steven Nolder, Lyons's appointed public defender, said the government wants her to plead guilty and cooperate in turning evidence against Hale's brother - who he said also happens to be the father of Lyons's two children. "'The [FBI] is of the mind that Hale's brother is also involved here, and that [the brother] has evidence that shows there are more people involved in this than just those who were indicted,' Nolder said. 'I think the government sees her case as likely to have the cement needed to put all the pieces together.' "According to U.S. investigators, the suspects arrested in Poland were connected to a network of online fraud forums with names such as Theftservices.com, Darkmarket.org, TheGrifters.net, and CCPowerForums.com. The FBI alleges said it traced a series of phishing attacks from late 2004 back to members of the Polish ring. The man described as the ringleader of the Polish group -- Mateusz Rymksi, also known online as 'Blindroot,' -- was an active member of CCPowerfurms who allegedly sold access to hacked computers for helping criminals maintain anonymity online. "Phishing and carding have become a multi-million dollar business for hackers and identity thieves, thanks in large part to the emergence of shadowy online forums where would-be criminals can learn the tricks of the trade, buy, sell and trade stolen sensitive and financial data. The crime forums also aid in the spread of phishing Web sites by selling pre-built kits scammers can use to set up bogus bank Web sites within minutes. According to a recent report from the Anti-Phishing Working Group, and industry consortium, more than 10,000 phishing Web sites were reported in August alone, roughly double the number found in January. "In 2004's 'Operation Firewall,' the FBI and U.S. Secret Service infiltrated and dismantled the Shadowcrew and Carderplanet fraud forums, arresting 28 individuals who collectively traded more than 1.7 million stolen credit card numbers. "CCPowerforums and several other popular online fraud bazaars also appear to have been taken offline recently, yet the FBI would neither confirm nor deny whether it had sought to shutter them. But experts say that while similar crackdowns may help bring some fraudsters to justice, the scammers who remain behind will most likely just set up shop at another online fraud community. "'These guys need these types of forums to build the relationships necessary to perpetuate very complex types of fraud,' said Ken Dunham, director of rapid response for iDefense, a Verisign company. 'Unfortunately, the shutdowns in [Operation Firewall] only resulted in the scattering of people in the forums who popped up elsewhere and learned to be a lot more wary of law enforcement.'" Security Fix Live I'll be online at 11 a.m. ET this morning to answer your questions about this story and any other security topic on your mind. Submit a question here. [Security Fix] 8:55:26 PM  PermaLink   / trackback []

Microsoft Warns of More "Zero-Day" Exploits. Microsoft Warns of More "Zero-Day" Exploits. Microsoft Corp. is warning Windows users to be on guard against a couple of unpatched security holes in its products that criminal hacking groups are actively exploiting. According to an advisory issued on Friday, Microsoft's implementation of XML contains a flaw that bad guys can use to compromise Windows machines just by getting them to visit certain Web sites with Internet Explorer. The other problem, covered by an advisory released last Tuesday, resides in Microsoft's Visual Studio 2005 and is similarly exploitable. Microsoft has had a tough time this year with so-called "zero-day" (or 0day) attacks -- those in which the bad guys leverage a previously undocumented software security hole to compromise computers hooked up to the Internet. Last year, Microsoft had to deal with just four zero-day attacks. From January through October of 2006, the company has had to chase down no fewer than 14 such attacks by my count, with most surfacing just after Microsoft's regularly scheduled monthly software patch release. Now it looks like we can add two more to that number. Last week, Security Fix wrote about the "Month of Kernel Bugs" project, which promises to present proof of a new, undocumented security hole for each day of November. Today's bug is one that was actually reported to Microsoft back in Oct. 2004, according to Cesar Cerrudo from Argeniss, the guy credited with discovering the vulnerability. [Security Fix] 8:45:59 PM  PermaLink   / trackback []

Malicious Code Injection: Itís Not Just for SQL Anymore. Malicious Code Injection: It's Not Just for SQL Anymore. Bryan Sullivan contributes this paper discussing injecting data beyond SQL, LDAP and XPath as examples, and what one can do to protect themselves. By Bryan Sullivan. [Infosec Writers Latest Security Papers] 8:44:08 PM  PermaLink   / trackback []

E-Voting Glitches Already Abound in Election 2006. E-Voting Glitches Already Abound in Election 2006. As early voting has started in states across the country, electronic voting machine problems are already being widely reported. For instance, machines in apparently Arkansas, Florida, and Texas have flipped votes; voters attempted to select a particular candidate, but the machine incorrectly indicated a vote for the opponent. The Chicago Sun-Times reports that this problem and a host of others occurring in Illinois. Meanwhile, five counties in Florida report that their machines are mistakenly set to stop recording votes one hour prior to the end of election day. And that's just a few of the stories we're hearing. Sometimes, machine glitches can be identified and addressed before they cause any votes to be lost or incorrectly recorded. Unfortunately, election workers remain woefully under-trained regarding potential e-voting problems. Case in point: election officials in Ohio reportedly used e-voting memory cards in ordinary laptops, exposing them to possible security threats. We hope no harm comes of this particular mistake, but, when it comes to the next e-voting impropriety, voters might not be so lucky. All of these problems underline, once again, why a voter verifiable paper trail is necessary. We'll continue to keep you posted on e-voting problems throughout Election 2006. (Hat tip: VotersUnite.org, which provided links to the news reports in this post.) [EFF: Deep Links] 8:41:49 PM  PermaLink   / trackback []

Homeland Security to "Target" Millions in Data-Mining System. Homeland Security to "Target" Millions in Data-Mining System. The Department of Homeland Security today published a notice in the Federal Register disclosing the existence of a "new system of records" -- the Automated Targeting System (ATS) -- that assigns "risk assessments" to millions of U.S. citizens who seek "to enter or exit the United States" or whose work involves international trade. The system appears to involve the data-mining of massive amounts of information derived from a wide variety of sources, including Passenger Name Record (PNR) data obtained from commercial air carriers. The "risk assessments" generated by the system will be retained for "up to forty years," according to DHS, in order to "cover the potential lifespan of individuals associated with terrorism or other criminal activity." But wait -- just because you're currently innocent, that doesn't mean you get a free pass. As the notice goes on to explain, All risk assessments need to be maintained because the risk assessment for individuals who are deemed low risk will be relevant if their risk profile changes in the future, for example, if terrorist associations are identified. DHS has exempted all of the data contained in the ATS from the "access" and "correction" requirements of the Privacy Act of 1974, which means that citizens have no right to learn about their own "risk assessments" or to challenge them. Franz Kafka, call your office . . . [EFF: Deep Links] 8:36:10 PM  PermaLink   / trackback []

Line Noise Podcast Election Special. Line Noise Podcast Election Special. As America goes to the polls, EFF's own podcast, Line Noise, returns with an interview with Representative Rush Holt, the politician behind the "gold standard" of e-voting reforms - a plan to introduce voter-verified paper records, public source releases, and random audits to all US electronic voting machines. You can listen in glorious MP3, vibrant Ogg, or subscribe to our ongoing podcast feeds. We're also available via iTunes. [EFF: Deep Links] 8:34:17 PM  PermaLink   / trackback []

Excellent Election Day Law FAQ For Online Journalists. Excellent Election Day Law FAQ For Online Journalists. In collaboration with the Center for Citizen Media, the Stanford Center for Internet Society has published an excellent election day law FAQ, including information on taking photos or videos at polling places. Check it out here and here, and stay tuned to that blog for more answers to your questions. [EFF: Deep Links] 8:32:53 PM  PermaLink   / trackback []

AP: "Technical glitches reported in early voting". AP: "Technical glitches reported in early voting". AP has a round-up of some early election activity: "About a third of voters were using new equipment, and problems in several states were reported right out of the gate. The government deployed a record number of poll watchers to the many competitive races across the country. "Glitches delayed balloting in dozens of Indiana and Ohio precincts, and Illinois officials were swamped with calls from voters complaining that poll workers did not know how to operate new electronic equipment. "In Delaware County, Indiana, officials planned to seek a court order to extend voting after an apparent computer error prevented voters from casting ballots in 75 precincts. "Florida officials, working to avoid a repeat of the vote-counting debacle of 2000, fielded extra voting machines, paper ballots and poll workers. "In the Jacksonville suburb of Orange Park, Florida, voters were forced to use paper ballots after an electronic machine broke." Update:Here's another round-up posted at 3 ET. [EFF: Deep Links] 8:30:43 PM  PermaLink   / trackback []

Craigslist Sex Ad Scammer Seeks to Silence Critics. Craigslist Sex Ad Scammer Seeks to Silence Critics. Baseless Copyright Claims Used to Shut Down Debate Over Privacy Controversy San Francisco - The Electronic Frontier Foundation (EFF) filed suit today against the man behind "craigslist-perverts.org" -- a website that publicized responses to fake personal advertisements posted on Craigslist.org -- on behalf of an online journalist who criticized the controversial outing campaign and received legal threats in return. Michael Crook posted the fake ads earlier this year, claiming to be a young woman seeking a casual sexual encounter. Crook then displayed many of the replies on his craigslist-perverts.org website, including information such as the responders' names, photographs, phone numbers, and where they worked. Jeff Diehl, the editor of Internet magazine 10 Zen Monkeys, published an article in September critical of Crook's behavior and used an image of Crook being interviewed by Fox News to highlight how controversial a figure he was. Instead of responding to the criticism with words, Crook sent a legal notice to the magazine's online service provider, claiming to be the copyright holder of the image and demanding that it be removed under the Digital Millennium Copyright Act (DMCA). Such actions violate the DMCA's requirements that only the copyright holder or someone authorized by her can send such notices. "This is yet another case of someone intentionally misusing copyright law to try to shut down legitimate debate on an issue of public interest," said EFF Staff Attorney Jason Schultz. "Crook certainly doesn't own the copyright to the news footage -- Fox News does. Furthermore, a still shot of that footage, used as part of a commentary on the controversy surrounding him, is clearly a fair use. It's hypocritical for such an outspoken figure like Crook to attack other speakers just because they disagree with him." Because of Crook's misuse of the DMCA, Diehl was forced to switch web-hosting companies in order to continue publish the photo. But even then, Crook sent another bogus DMCA notice to the new hosting company, and Diehl had to remove the photo for a second time. In the lawsuit filed today, EFF asks that Diehl be compensated for the financial and personal expenses associated with responding to the meritless claims and switching web hosts -- as well as for the infringement to his free speech rights protected by the First Amendment. This lawsuit is part of EFF's ongoing work to protect online free speech in the face of bogus copyright claims. Last week, EFF filed an objection to a subpoena from Landmark Education, a group that claimed copyright infringement in a video uploaded to the Internet Archive. "The Internet is home to passionate debate on countless important issues. It is too bad that some people find the robust exercise of free speech so frightening that they use intimidation to try to silence it," said EFF Staff Attorney Corynne McSherry. "EFF is grateful that people like Jeffrey Diehl and the Internet Archive are fighting back." For more on the lawsuit against Michael Crook: http://eff.org/legal/cases/diehl_v_crook For more on the Internet Magazine 10 Zen Monkeys: http://10zenmonkeys.com/2006/11/01/eff-crook-dmca-lawsuit/ For more on the Landmark Education's subpoena campaign: http://www.eff.org/legal/cases/landmark/ Contacts: Jason Schultz Staff Attorney Electronic Frontier Foundation jason@eff.org Corynne McSherry Staff Attorney Electronic Frontier Foundation corynne@eff.org Jeff Diehl Editor 10 Zen Monkeys stupendous@gmail.com [EFF: Breaking News] 8:25:33 PM  PermaLink   / trackback []

Reports note that US ranks near the bottom for privacy protection, on par with Russia, China, and Malaysia -- and also is flunking on press freedoms Reports note that US ranks near the bottom for privacy protection, on par with Russia, China, and Malaysia -- and also is flunking on press freedoms. Posted by Bruce E.H. JohnsonPrivacy International has issued its annual Privacy and Human Rights Study analyzing privacy protections around the world. The study ranks the United States near the bottom for privacy protections, calling it an "extensive surveillance society." In failing to... [Privacy and Security Law Blog] 8:22:00 PM  PermaLink   / trackback []