Monday, December 4, 2006

DHS "Targeting" Program Attracts Scrutiny -- Comment Period Still Open! DHS "Targeting" Program Attracts Scrutiny -- Comment Period Still Open!  The Department of Homeland Security's attempt to quietly assign "risk assessment" scores to tens of milions of law-abiding American citizens (not to mention foreign nationals) may be approaching a roadblock. According to an Associated Press article: Incoming Senate Judiciary Chairman Sen. Patrick Leahy of Vermont pledged greater scrutiny of such government database-mining projects after reading that during the past four years millions of Americans have been evaluated without their knowledge to assess the risks that they are terrorists or criminals. "Data banks like this are overdue for oversight," said Leahy, who will take over Judiciary in January. "That is going to change in the new Congress." EFF sounded the alarm on the Automated Targeting System last week, in a press release and formal comments submitted to DHS. The system has now drawn strong criticism from a number of quarters, including the ACLU and the Business Travel Coalition. Comments can still be submitted to DHS until midnight ET on December 4 at www.regulations.gov. To submit comments, you must enter the appropriate "keyword or ID," which is DHS-2006-0060-0001 (no, they don't make this easy). [EFF: Deep Links] 2:13:51 PM  PermaLink   / trackback []

Police wolves pace round electric EU sheep. Police wolves pace round electric EU sheep. European council dilutes data proposals to taste European privacy wonks have become alarmed over the degeneration of policy talks on the protection of people who become the subject of police database cross-border pollinations. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 2:05:28 PM  PermaLink   / trackback []

Nike + iPod poses threat to personal security. Nike + iPod poses threat to personal security. Could aid stalking and burglary One of this year's must-have gadgets for music-crazy runners is a security nightmare that could help someone track your movements with relative ease, according to researchers at the University of Washington. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 2:01:49 PM  PermaLink   / trackback []

Aggressive MySpace Worm Attacks via QuickTime. Aggressive MySpace Worm Attacks via QuickTime. Fast-moving pest exploits site, player holes to steal passwords. [PC World: Latest Technology News] 1:55:18 PM  PermaLink   / trackback []

Windows Live Local Virtual Earth and Privacy in Public. Windows Live Local Virtual Earth and Privacy in Public. A post on Slashdot recalls the discovery of an SUV filming the streets of San Francisco: Today as we were biking around our neighborhood in a small city we saw a strange vehicle slowly driving around. It appeared to be an SUV, bristling with cameras mounted on the roof, and pointing just about every possible direction. The first time we saw it, all we could see was that it had a sign on the side, something about Windows. The second time we saw it, we stared at it so hard that the driver stopped and we had a chance to ask him what it was all about. He said he was driving around, filming streets, and that there were people doing this all over the world, and getting data from the air too. It was going to be available on the Web. I asked him if this was Microsoft[base ']s answer to Google Earth, and he indicated that it was. Enter Windows Live Local Virtual Earth, currently offering street level images of San Francisco and Seattle. You can drive or walk around the map and view the streets and storefronts[sigma]and the people. This detailed level of mapping carries significant concerns about one[base ']s privacy in public (that I[base ']m too swamped to fully theorize now). For now, click on this image and you[base ']ll find the image captured for the Hustler Club in San Francisco. What if you were walking out the door with a big smile on your face at the moment Microsoft[base ']s magical SUV was passing by? Instead of being seen by just the handful of people who happen to be on the street at that moment, now anyone with a computer will know your dirty little secret[sigma] [michaelzimmer.org] 1:52:33 PM  PermaLink   / trackback []

Bendrath on the Politics of 'Identity Governance'� Bendrath on the Politics of 'Identity Governance'� Ralf Bendrath has a thoughtful post on Oracle[base ']s recently announced [base "]Identity Governance Framework[per thou], a set of draft standards for sharing and controlling personally identifiable information across different systems and applications. He was particularly struck by the use of the term [base "]governance[per thou] in this context, and how it reflects a changing discourse on privacy & identity management: In the good old days, the social value to be safeguarded was called [base "]privacy[per thou]. Then came computers, and the ugly word [base "]data protection[per thou] took over. The semantic move was subtile, but worked to some extent: It was about protecting the data (i.e. the computers on which they reside), not the privacy of the persons the data was about. After the rise of the Internet, it started to be called [base "]privacy and identity management[per thou]. The idea of protecting data or persons got lost and replaced by [base "]management[per thou]. Instead, [base "]identity[per thou] was introduced, which also includes an idea of control: The users have to authenticate themselves. Nowadays, it is mostly called just [base "]identity management[per thou], and the idea of privacy has to be re-introduced as a kind of add-on, like in the [base "]privacy-embedded laws of identity[per thou]. So, it sounds like the discourse of identity has won over the discourse on privacy. By introducing the term [base "]governance[per thou], Oracle makes it clearer again that it is not just a corporate process, as [base "]identity management[per thou] sounds like, but includes externally set values and goals. An interesting development. It is still unclear to me how [base "]privacy[per thou] could systematically be inserted into this on the semantic level, as it would be one of many theoretically possible goals of the governance of identity. On the other hand, [base "]governance[per thou] here just means enforcement of data-usage policies inside the corporation. In political science, [base "]governance[per thou] has a far wider meaning, including public laws, private-public partnerships, standards, private contracts, education, publicity and so on. The Identity Governance Framework in this perspective is just enabling the operational implementation of values set in the larger network of institutions that deal with the governance of personal information - privacy governance, that is. Of course, reality is much more complex, and there are always competing discourses, side-branches and so on. But this big picture with little complexity should do for the moment, if we look at the private sector perspective on it. I also did not attempt a Foucauld-inspired discourse analysis, which would much more focus on the governmentality of the modern buraucracy that rose and developed together with the practices and laws of identity management from the 15th century on. He writes more, and it is worth reading. [michaelzimmer.org] 1:49:54 PM  PermaLink   / trackback []

MySpace Video Worm Pimps Adult Content. MySpace Video Worm Pimps Adult Content. A password-stealing computer worm broke out in the Myspace social-networking universe over the weekend, with the perpetrators using hijacked accounts to blast out junk messages seeking to gin up traffic to several porn sites, including some sponsored by an adware company that just last month settled a landmark $3 million consumer deception case brought by the Federal Trade Commission. The worm steals victims' usernames and passwords by transparently replacing the links in the victim's blog that a MySpace user would normally click on to log into and out of their accounts. Upon clicking one of those links, an unknown number of Myspace users were redirected to multiple third-party sites that hosted fraudulent copies of MySpace login pages. All that a MySpace user needs do to fall victim to the scam is visit an infected user's "about me" page. According to the FaceTime Security Labs blog, a victim's profile page will be altered with an odd, blue site navigation banner at the top with all of the links pointing to the same fake MySpace user login pages. Infected profiles also are seeded with a copy of the malicious video. Hovering over any of the navigation links in the "about me" page of a Myspace account still compromised by this attack shows that they all try to take the user to the same bogus user login pages. (Screenshot by Brian Krebs) This scam is powered in part by an ill-conceived feature included in Apple's QuickTime video player software that allows embedded video files to load Web content from other sites. This attack also apparently involved a recently disclosed programming flaw on Myspace's site, which allowed for the manipulation of MySpace users' profile pages. Even infected Myspace blogs whose authors have the poisoned QuickTime video and malicious links scrubbed from their pages can expect to get reinfected when other Myspace users on their "friends" lists get hit by the worm, says this alert sent out by MySpace administrators. Victims should remove infected blogs from their "friends" lists until those MySpace users take action to clean up their own pages. Myspace users who notice odd changes to the MySpace site navigation bar, or unapproved messages being mass-spammed from their accounts, should consider their accounts stolen and change their passwords. I read on one MySpace forum about how infected MySpace accounts randomly sent spam messages promoting pornographic Web sites to random user accounts every six seconds. Such an aggressive attack has the potential to spread quite rapidly among MySpace's 80 million-or-so users. Users who enter their credentials into one of these password-stealing sites may soon find their accounts being used to blast out junk messages to others advertising the online adult content. Included with the messages, says FaceTime, is a screenshot of a pornographic film that if clicked leads the visitor to a porn site that links to a bunch of other porn sites sponsored by embattled adware purveyor Zango. This new fiasco can't look good for them. Just a month ago Zango agreed to pay $3 million to settle Federal Trade Commission charges that it profited through deceptive distribution methods. Allowing QuickTime videos to silently load interactive Javascript content and commands seems like a pretty bad idea from a user-protection perspective. Allowing QuickTime vids to be embedded like that in massive social networking sites strikes me as an invitation to disaster. I clicked on a bunch of the navigation links on one infected Myspace blog that I found, and it looks like the links to the scam login pages are presently unreachable. But the bad guys behind this attack are probably already adapting. A MySpace blog called "Burnt Pickle" has an engaging account of the cat-and-mouse game between Myspace administrators and the fraudsters behind this attack, as the bad guys kept adjusting their attacks based on changes the admins were making to the system. The Burnt Pickle says we can expect attacks like these to continue as long as MySpace allows embedded QuickTime files. "This is just a temp fix though. They'll need to ban QuickTime files if they want to prevent this kind of stuff from happening on a daily basis." The Pickle may be right. Online scam artists just don't seem to pass up these kinds of opportunities anymore, I'm afraid. Anyway, Firefox users can use add-ons like "noscript" to block sites from loading Javascript unless specifically allowed. But the problem is that noscript works on a per-domain basis, so if a Myspace users decides to permanently allow Myspace to load Javascript because he wants to see some wacky MySpace blog that requires it, they're effectively trusting that the other 79 million-odd users on Myspace aren't trying any funny business with Javascript. If anyone knows of a noscript equivalent add-on for Internet Explorer 7, please drop me a line or leave a comment below with more information. The AdBlock add-on for Firefox also can help users block certain file types -- all .".mov" (Quicktime) files, for example -- from automatically opening or playing when you merely browse a MySpace page. [Security Fix] 1:45:48 PM  PermaLink   / trackback []

Wired News: MPAA Kills Anti-Pretexting Bill A tough California bill that would have prohibited companies and individuals from using deceptive "pretexting" ruses to steal private information about consumers was killed after determined lobbying by the motion picture industry, Wired News has learned. The bill, SB1666, was written by state Sen. Debra Bowen, and would have barred investigators from making "false, fictitious or fraudulent" statements or representations to obtain private information about an individual, including telephone calling records, Social Security numbers and financial information. Victims would have had the right to sue for damages. The bill won approval in three committees and sailed through the state Senate with a 30-0 vote. Then, according to Lenny Goldberg, a lobbyist for the Privacy Rights Clearinghouse, the measure encountered unexpected, last-minute resistance from the Motion Picture Association of America. "The MPAA has a tremendous amount of clout and they told legislators, 'We need to pose as someone other than who we are to stop illegal downloading,'" Goldberg said. Consequently, when the bill hit the assembly floor Aug. 23, it was voted down 33-27, just days before revelations about Hewlett-Packard's use of pretexting to spy on journalists and board members put the practice in the national spotlight. Legislature records confirm that the MPAA's paid lobbyists worked on the measure. An aide to Bowen, who was forced out of the legislature by term limits and was elected Secretary of State, said the MPAA made its displeasure with the bill clear to lawmakers. 1:42:28 PM  PermaLink   / trackback []

MPAA Demands "License To Lie," But Wants To Make You 'Fess Up On WHOIS. MPAA Demands "License To Lie," But Wants To Make You 'Fess Up On WHOIS. I say this for the Intellectual Property Mafia; they do not allow either consistency or scrupples to get in the way of what they want. Like characters out of too many mob movies, [base "]it[base ']s just business[per thou] whether you need to disclose your real identity or not. Unsurprisingly, the IP Mafia reserve the right to lie to themselves, while wanting big time penalties for everyone else who tries to mainatin anonymity. According to this article, the MPAA lobbied hard to kill an anti-pretexting bill proposed in the California Legislature. [base "]Pretexting,[per thou] as folks who followed the recent scandal over at HP know, is pretending you are someone else in order to gain access to that other person[base ']s personal information. Why would the MPAA fight hard to kill a pro-privacy, pro-consumer protection bill? Because they assert they need to use pretexting to investigate allegations of piracy. And if investigating into possible piracy means puting consumers everywhere at greater risk for identity theft or other violations of privacy? [base "]Sorry, it[base ']s just business. Ya know?[per thou] read more [Public Knowledge - Policy Blog] 1:38:43 PM  PermaLink   / trackback []