Thursday, January 18, 2007

REAL ID Privatized, Activist Says. REAL ID Privatized, Activist Says. The feds want applicants for driver's licenses to be verified by a third party, likely a private company, according to a privacy advocate. In 27B Stroke 6. [Wired News: Top Stories] 5:12:01 PM  PermaLink   / trackback []

Review: Six Rootkit Detectors Protect Your System - News by InformationWeek I've also looked at these applications in a more general light and tried to consider how useful the program is likely to be in the future: how easy the detector is to use; how easy it is to interpret the results; how often the detector was updated; and so on. Remember that rootkits, like viruses, are a moving target. An anti-rootkit program that protects you today might be defenseless tomorrow against a whole new variety of threat -- in fact, many rootkit makers write their programs to specifically avoid detection by some existing programs. 5:09:23 PM  PermaLink   / trackback []

Six Rootkit Detectors To Protect Your PC. Six Rootkit Detectors To Protect Your PC. An anonymous reader writes "InformationWeek has a review of 6 rootkit detectors.This issue became big last year when Sony released some music CDs which came with a rootkit that silently burrowed into PCs. This review looks at how you can block rootkits and protect your machine using F-Secure Backlight, IceSword, RKDetector, RootkitBuster, RootkitRevealer, and Rookit Unhooker." [Slashdot] 5:07:25 PM  PermaLink   / trackback []

MySpace Moves to Give Parents More Information - WSJ.com In a bid to appease government critics, News Corp.'s popular Web site MySpace.com is planning to offer free parental notification software -- a move that risks alienating its young users. Parents who install the monitoring software on their home computers would be able to find out what name, age and location their children are using to represent themselves on MySpace. The software doesn't enable parents to read their child's e-mail or see the child's profile page and children would be alerted that their information was being shared. The program would continue to send updates about changes in the child's name, age and location, even when the child logs on from other computers. [...] But a group of 33 state attorneys general led by Connecticut's Richard Blumenthal are investigating taking legal action against MySpace if it doesn't raise the age limit to join the site to 16 (from 14 currently) and begin verifying MySpace members' ages against public databases. A lawsuit by the attorneys general could cost MySpace tens of millions of dollars in fees and generate reams of negative publicity, at a time when major advertisers are just overcoming their concerns about the site. So far, MySpace has refused to take either of the steps demanded by the attorneys general. It defends its age limit of 14, arguing that it is better for high-schoolers to join with the special privacy controls designed for 14- and 15-year-old members than to lie about their age to join. "If you're 14 you'll try to get on our site anyway because your friends are going to be on it," says Hemanshu Nigam, chief security officer for Fox Interactive Media, the unit that oversees MySpace. 5:04:31 PM  PermaLink   / trackback []

MySpace to Offer Spyware for Parents. MySpace to Offer Spyware for Parents. mrspin writes "Following continuing pressure from politicians (and parts of the media), MySpace is planning to offer parents the chance to download software which will monitor aspects of their children's activities on the social networking site. From a business point of view, the move appears to be a highly risky one. The young users of social networking sites are notorious for their lack of loyalty [~] and history suggests that a change like this could tempt many to abandon MySpace for the 'next cool thing'." [Slashdot] 5:00:58 PM  PermaLink   / trackback []

The Surprising Security Threat: Your Printers Networked printers -- yes, printers -- can open your corporate network to malicious attacks. They need security patches, too. The Blaster worm hit McCormick and Co. hard and fast. It entered the famous spice company through a service provider connection and ripped across plants and offices in a matter of hours. What was most vexing, however, was that the virus kept coming back on disinfected network segments. Upon further investigation, it turned out that Blaster, as well as some instances of the Sasser worm, were trying to repropagate from infected network printers. "Printers were just one of several types of systems contributing to the nightmare at the time," says Michael Rossman, who'd just taken over as global director of IT services and information security at McCormick at the time of the worm outbreak in 2003. "Blaster went to all our PCs, our radio frequency units, our handhelds. And, we learned belatedly, it also spread to our printers." 4:51:53 PM  PermaLink   / trackback []

Printers Vulnerable To Security Threats. Printers Vulnerable To Security Threats. jcatcw writes "Networked printers are more vulnerable to attack than many organizations realize. Symantec has logged vulnerabilities in five brands of network printers. Printers outside firewalls, for ease of remote printing, may also be open to easy remote code execution. They can be possible launching pads for attacks on the rest of the network. Disabling services that aren't needed and keeping up with patches are first steps to securing them." From the article: "Security experts say that printers are loaded with more complex applications than ever, running every vulnerable service imaginable, with little or no risk management or oversight.... [N]etworked printers need to be treated like servers or workstations for security purposes [~] not like dumb peripherals." [Slashdot] 4:49:16 PM  PermaLink   / trackback []

The Blog | James Love: WIPO Stumbles on Broadcast Treaty | The Huffington Post Geneva: The specialized UN Agency known as the World Intellectual Property Organization (WIPO) is meeting this week to finalize an eight-year negotiation on a new treaty for the protection of broadcast organizations. The treaty comes at a time when our whole concept of what constitutes a broadcast or a broadcaster is undergoing profound changes. Many now follow news events from youtube videos clips (including apparently President Bush, who told 60 minutes he watched the cell phone video of the Saddam Hussein hanging on the Internet). The proliferation of low cost video cameras and editing software, higher bandwidth cable, satellite and Internet connections, are creating a highly diverse and dynamic environment for creating, distributing, redistributing and remixing information. To this exciting world the UN's specialized agency for intellectual property wants to impose a new legal regime. The problem is, no one here has a clue what the legal regime should look like. 4:46:55 PM  PermaLink   / trackback []

WIPO Creating New IP Rights Over Web Content. WIPO Creating New IP Rights Over Web Content. An anonymous reader writes "The WIPO is currently engaged in negotiating a new treaty on digital IP rights, but they're having trouble agreeing on the particulars. Though the world of YouTube and podcasts seems like a place that 'requires' laws, the WIPO seems confused about what to do about it. From the article: 'The proliferation of low cost video cameras and editing software, higher bandwidth cable, satellite and Internet connections, are creating a highly diverse and dynamic environment for creating, distributing, redistributing and remixing information. To this exciting world the UN's specialized agency for intellectual property wants to impose a new legal regime. The problem is, no one here has a clue what the legal regime should look like.' The U.S. is also pushing for reviving a 1962 treaty (never ratified) that would give the large cable distributors (like Discovery, Sci-fi, Spike, etc) ownership of even public domain content if they carry it. This would be in addition to any rights normally afforded the distributors. " [Slashdot] 4:44:57 PM  PermaLink   / trackback []

Trojans and spyware account for 57 Percent of malicious code in 2006. Trojans and spyware account for 57 Percent of malicious code in 2006. Other malware types detected include dialers, backdoor Trojans, worms and bots. [GT: Security and Privacy] 4:21:46 PM  PermaLink   / trackback []

The Seattle Times: Local News: State to share data on some Medicaid patients YAKIMA -- In an effort to curb abuse of prescription narcotics, the state will begin sharing medical information about certain low-income clients with doctors and others who treat them. In the Yakima pilot program, state Medicaid officials will identify clients with a chemical dependency and send pharmacy, inpatient and emergency-room information to all medical professionals who have treated them in the past 12 months. "My major intention as chief medical officer is to do this for safety reasons," said Dr. Jeffery Thompson, of the state Department of Social and Health Services, which oversees Medicaid. 4:19:51 PM  PermaLink   / trackback []

Companies, Groups Address Global Civil Liberties Challenges. Companies, Groups Address Global Civil Liberties Challenges. CDT has joined with a broad group of companies, investors, academics, and human rights groups to address the free expression and privacy challenges facing companies that do business internationally. That process -- which aims to produce a set of principles guiding company behavior when faced with laws, regulations and policies that interfere with the achievement of human rights -- marks a new phase in efforts that the groups began in 2006. The joint process represents the merging of several concurrent efforts by companies, academics and public interest advocates to address the issues. One of those efforts was a series of consultations coordinated by CDT last year. [Center for Democracy and Technology] 4:09:46 PM  PermaLink   / trackback []

DRM threat to net radio returns. DRM threat to net radio returns. You cannot be Sirius... A bill re-introduced last week to the US Senate compels digital radio broadcasters to use DRM. [The Register - Music and Media] 4:08:04 PM  PermaLink   / trackback []

AACS: Modeling the Battle. AACS: Modeling the Battle. By this point in our series on AACS (the encryption scheme used in HD-DVD and Blu-ray) it should be clear that AACS creates a nontrivial strategic game between the AACS central authority (representing the movie studios) and the attackers who want to defeat AACS. Today I want to sketch a model of this game and talk about who is likely to win. (Previous posts in the series: 1, 2, 3, 4, 5, 6.) First, let[base ']s talk about what each party is trying to achieve. The central authority wants to maximize movie studio revenue. More precisely, they[base ']re concerned with the portion of revenue that is due to AACS protection. We[base ']ll call this the Marginal Value of Protection (MVP): the revenue they would get if AACS were impossible to defeat, minus the revenue they would get if AACS had no effect at all. The authority[base ']s goal is to maximize the fraction of MVP that the studios can capture. In practice, MVP might be negative. AACS makes a disc less useful to honest consumers, thereby reducing consumer demand for discs, which hurts studio revenue. (For example: Alex and I can[base ']t play our own HD-DVD discs on our computers, because the AACS rules don[base ']t like our computers[base '] video cards. The only way for us to watch these discs on our equipment would be to defeat AACS. (Being researchers, we want to analyze the discs rather than watch them, but normal people would insist on watching.)) If this revenue reduction outweighs any revenue increase due to frustrating infringement, MVP will be negative. But of course if MVP is negative then a rational studio will release its discs without AACS encryption; so we will assume for analytic purposes that MVP is positive. We[base ']ll assume there is a single attacker, or equivalently that multiple attackers coordinate their actions. The attacker[base ']s motive is tricky to model but we[base ']ll assume for now that the attacker is directly opposed to the authority, so the attacker wants to minimize the fraction of MVP that the studios can capture. We[base ']ll assume the studios release discs at a constant rate, and that the MVP from a disc is highest when the disc is first released and then declines exponentially, with time constant L. (That is, MVP for a disc is proportional to exp(-(t-t0)/L), where t0 is the disc[base ']s release date.) Most of the MVP from a disc will be generated in the first L days after its release. We[base ']ll assume that the attacker can compromise a new player device every C days on average. We[base ']ll model this as a Poisson process, so that the likelihood of compromising a new device is the same every day, or equivalently the time between compromises is exponentially distributed with mean C. Whenever the attacker has a compromised device, he has the option of using that device to nullify the MVP from any set of existing discs. (He does this by ripping and redistributing the discs[base '] content or the keys needed to decrypt that content.) But once the attacker uses a compromised device this way, the authority gets the ability to blacklist that compromised device so that the attacker cannot use it to nullify MVP from any future discs. Okay, we[base ']ve written down the rules of the game. The next step [~] I[base ']ll spare you the gory details [~] is to translate the rules into equations and solve the equations to find the optimal strategy for each side and the outcome of the game, that is, the fraction of MVP the studios will get, assuming both sides play optimally. The result will depend on two parameters: L, the commercial lifetime of a disc, and C, the time between player compromises. It turns out that the attacker[base ']s best strategy is to withhold any newly discovered compromise until a [base "]release window[per thou] of size R has passed since the last time the authority blacklisted a player. (R depends in a complicated way on L and C.) Once the release window has passed, the attacker will use the compromise aggressively and the authority will then blacklist the compromised player, which essentially starts the game over. The studio collects revenue during the release window, and sometimes beyond the release window when the attacker gets unlucky and takes a long time to find another compromise. The fraction of MVP collected by the studio turns out to be approximately C/(C+L). When C is much smaller than L, the studio loses most of the MVP, because the attacker compromises players frequently so the attacker will nullify a disc[base ']s MVP early in the disc[base ']s commercial lifetime. But when C is much bigger than L, a disc will be able to collect most of its MVP before the attacker can find a compromise. To predict the game[base ']s outcome, then, we need to know the ratio of C (the time needed to compromise a player) to L (the commercial lifetime of a disc). Unfortunately we don[base ']t have good data to estimate C and L. My guess, though, is that C will be considerably less than L in the long run. I[base ']d expect C to be measured in weeks and L in months. If that[base ']s right, it[base ']s bad news for AACS. Share This [Freedom to Tinker] 4:06:18 PM  PermaLink   / trackback []

VoIP and Broadband Internet Access Providers Face Upcoming CALEA Deadlines. VoIP and Broadband Internet Access Providers Face Upcoming CALEA Deadlines. In the next several months providers of interconnected Voice over Internet Protocol (VoIP) services and facilities-based broadband Internet access must become compliant with the Communications Assistance for Law Enforcement Act (CALEA). Enacted in 1994, CALEA imposes obligations on traditional wireline and wireless telephony service providers to design their networks to facilitate law enforcement surveillance of voice communications. However, in 2005 the Federal Communications Commission extended that obligation to providers of VoIP and facilities-based broadband Internet access services. Under the new regime, the scope of entities covered by CALEA is broader than in the past - specifically, in addition to VoIP services, providers of broadband Internet access services, including cable modem, DSL, satellite, wireless, fixed wireless, and broadband over powerline services, are now also subject to CALEA. Interestingly, the FCC defined "broadband" services are those with ability to support upstream or downstream speeds exceeding 200 kilobits per second (kbps) in the last mile.  [Privacy and Security Law Blog] 4:03:58 PM  PermaLink   / trackback []

Update on Eli Lilly Zyprexa Documents Fight. (EFF) Update on Eli Lilly Zyprexa Documents Fight. EFF was back in court January 16-17 defending the right of an anonymous wiki contributor to post links to important internal Eli Lilly documents about its biggest-selling drug, Zyprexa. After hearing two days of testimony from those involved (and not involved) with the disclosure of the Lilly documents, the judge has ordered additional briefs and promised a decision sometime in early February. Unfortunately, he also extended his January 4 injunction that bars anyone from posting the documents or information that would "facilitate the dissemination of the documents" (presumably, including links) to zyprexa.pbwiki.com until he is able to issue his ruling. The good news is that the documents continue to be readily available on the Internet (one law professor said he was able to find and download them in 19 minutes). The bad news is that the judge's order constitutes a prior restraint on free speech -- the court's injunction prohibits the whole world from publishing the documents on zyprexa.pbwiki.com. It's hard not to compare this outcome with the Pentagon Papers case, where the Supreme Court threw out even a temporary injunction against publication of stolen Pentagon documents in the New York Times and Washington Post. (It's also reminiscent of Proctor & Gamble v. Bankers Trust, where the court threw out a prior restraint against Business Week over documents leaked from a lawsuit). But based on the evidence introduced in court, it appears clearer than ever that Eli Lilly will not be able to justify any ongoing restriction on publication of these documents by those who were not involved in the initial leak. So we are looking forward to Judge Weinstein's ultimate ruling. For more on this, see the recent New York Times article (which also broke the story about the damning evidence against Lilly contained in the documents). For more about why these documents are so important, take a look at this summary of yesterday's testimony in court by Vera Sharav, head of the Association for Human Research Protection. [EFF: Deep Links] 4:01:34 PM  PermaLink   / trackback []

Newspaper Publisher Tries to Thwart First Amendment. Newspaper Publisher Tries to Thwart First Amendment. The Santa Barbara News-Press needs a lesson in the First Amendment. Insisting that an anonymous comment posted for a few hours on a news blog skewed a labor unionization vote, the publisher of the newspaper is demanding that Google disclose the blogger's account information. It all started last September. Three months after several editors walked off the job amid allegations that News-Press owner and co-publisher Wendy McCaw had improperly interfered in editorial decisions, the employees that remained were struggling to form a union to negotiate with McCaw. McCaw did not take kindly to the unionization effort or even commentary about it--in fact, she has sued two newspapers based on their coverage of the labor dispute and threatened defamation suits against individual citizens who posted pro-union signs in their windows. The legal campaign has made headlines around the country. Enter pseudonymous blogger Sara de la Guerra. Sara reports and comments on current events in Santa Barbara and has been critical of McCaw's anti-union tactics. In early September, a third party submitted a comment advocating various acts of cybersabotage against News-Press management. The comment was taken down within hours, but News-Press later issued a press release quoting and complaining about the comment. When the employees then voted to form a union, News-Press filed objections with the National Labor Relations Board, arguing that the comment had influenced the election. Three months later, just a few days before the hearing on the objections, News-Press issued a subpoena to Google seeking information relating to Sara's account. News-Press has apparently forgotten a basic principle of the journalistic profession--respect for the First Amendment, which protects the right to anonymous speech. Court after court has recognized that discovery requests that seek to pierce the anonymity of online speakers must be carefully scrutinized in order to prevent the improper use of the discovery process to unmask anonymous speakers. Moreover, courts have recognized the need for a particularly high level of protection when the discovery request seeks information about a nonparty. Such protection seems especially important here, given McCaw's proclivity for retailiating against critics. Sara's important but fragile anonymity interests must be shielded unless News-Press can show that its claims are viable and that the requested evidence is necessary to advance those claims. And therein lies the rub: The hearing to which the information would be relevant was held last week, with no reference to the subpoena. Thus, even assuming the information was relevant to some claim, the need for that information has passed. EFF has written a letter to the NLRB judge explaining the free speech interests at stake and asking him to confirm the subpoena is moot. Here's hoping that the judge will bring a quick end to this dangerous skirmish in the News-Press' anti-union campaign. [EFF: Deep Links] 3:59:45 PM  PermaLink   / trackback []