Saturday, February 10, 2007


News Item 8377 Lawmakers Introduce Breach Notification, Other Bills.

Lawmakers Introduce Breach Notification, Other Bills. A flurry of new technology-related bills was introduced this week in the U.S. Congress. [PC World: Latest Technology News]
5:57:47 PM  PermaLink   / trackback []  

News Item 8376 Conference Attendees Drop Ball on Wi-Fi Security.

Conference Attendees Drop Ball on Wi-Fi Security. More than half of the wireless LAN devices being used at this week's RSA Conference on information security are themselves unsecured. [PC World: Latest Technology News]
5:55:59 PM  PermaLink   / trackback []  

News Item 8375 A Dozen Patches Expected From Microsoft Next Week.

A Dozen Patches Expected From Microsoft Next Week.

Microsoft Corp. said today that it plans to release at least a dozen patch bundles next Tuesday to plug security vulnerabilities in its Windows operating systems and other software.

This patch batch could wind up breaking records for the most number of vulnerabilities fixed in one go by the company, as each patch can and often does address multiple security flaws. Microsoft said most of them will address "critical" flaws -- security holes so serious that they could be exploited by an attacker or computer worm to take complete control over the affected computer with little or any action on the part of the user.

The company said it plans to release at least three patches to fix security problems in its Microsoft Office productivity suites. Currently, there are more than a half dozen unpatched Office flaws for which exploit code is already available online, and most of those are already being exploited for targeted attacks.

Interestingly, Microsoft noted that one of the critical patch bundles will address security flaws in Windows Live OneCare, Microsoft Antigen, Microsoft Windows Defender, and Microsoft ForeFront -- Microsoft programs designed to defend Windows machines from spyware, viruses and worms.

As always, Security Fix will bring you the lowdown on these updates when Microsoft officially releases them on Tuesday.

[Security Fix]
5:53:44 PM  PermaLink   / trackback []  

News Item 8374 Asking the Right Question: Penetration Testing vs. Vulnerability Analysis Tools, Which Is Best?

Asking the Right Question: Penetration Testing vs. Vulnerability Analysis Tools, Which Is Best? Dennis Hurst of Spi-Dynamics contirbutes this paper which discusses how penetration testing and assessments have matured and become more complex when dealing with web facing applications. By Dennis Hurst. [Infosec Writers Latest Security Papers]
5:51:44 PM  PermaLink   / trackback []  

News Item 8373 Perils in Parallels? or Killing your Mac with windows?

Perils in Parallels?

Earlier this week Security Fix managed to install a new copy of Microsoft's Windows Vista Ultimate on top of Apple's Mac OS X operating system running on a Macbook Pro. I did this using Parallels, a powerful, free "virtual machine" program that lets users run two or more operating systems side by side at the same time.

When I went to behold the Frankenstein I'd created, I literally gasped when I realized that Vista now had complete access to read, write, or destroy files on my Mac's hard drive. The guest operating system -- in this case Vista -- has almost full run of the data on the underlying hard drive (the critical system files appear to be guarded). I later found a rather longish thread about this feature at the Parallels user forum.

In everything else, Parallels strikes me as an extremely powerful, elegant and useful application. But the Parallels people should change the default behavior of the software to disallow the sharing of directories between the operating systems by default. There may be more dangerous implications of this design: I am still in the process of monkeying around with different scenarios.

I found the whole situation to be rather ironic. After all, virtual machines, such as VMware, have been very popular among virus researchers because they typically were used to protect people from threats, not introduce new ones. Security researchers have long used virtual machines to execute malicious software in a controlled environment that can be reset back to its previous, pristine state with the push of a button.

In response, a number of online threats will check to see if they're being run in VMware or some other kind of virtual environment. If the answer is yes, those viruses or worms generally refuse to run, in an effort to escape analysis and live longer, undetected, in the wild.

This scenario with Parallels presents the opposite threat: Virus writers could, by default, simply begin to tell their creations to check whether they are being run in a Parallels virtual machine, and if so run some basic checks to see which operating system the host machine is running, and then drop appropriate malicious code in key places on the host system.

Such a scenario may sound far-fetched, but the reality is that if you can dream it up, the bad guys online are probably already doing it. Here's hoping the good folks at Parallels fix this feature in their next release.

It's worth noting that this sharing of files, directories, etc., between the host and guest operating system(s) also is quite possible on VMware products as well, except that the default setting on VMware is not to let the guest operating system have read, write and delete privileges pretty much anywhere on the host OS.

To disable this functionality in Parallels, close out of the guest operating system, an in Parallels Desktop click on "edit." From there, click on "Shared Folders" and uncheck the box next to the option "Enable global sharing for drag-and-drop." You can then add any specific folders that you'd still like to share from that menu.

[Security Fix]
5:48:18 PM  PermaLink   / trackback []  

News Item 8372 The brain scan that can read people's intentions | Science | Guardian Unlimited

A team of world-leading neuroscientists has developed a powerful technique that allows them to look deep inside a person's brain and read their intentions before they act.

The research breaks controversial new ground in scientists' ability to probe people's minds and eavesdrop on their thoughts, and raises serious ethical issues over how brain-reading technology may be used in the future.

The team used high-resolution brain scans to identify patterns of activity before translating them into meaningful thoughts, revealing what a person planned to do in the near future. It is the first time scientists have succeeded in reading intentions in this way.

"Using the scanner, we could look around the brain for this information and read out something that from the outside there's no way you could possibly tell is in there. It's like shining a torch around, looking for writing on a wall," said John-Dylan Haynes at the Max Planck Institute for Human Cognitive and Brain Sciences in Germany, who led the study with colleagues at University College London and Oxford University.

The research builds on a series of recent studies in which brain imaging has been used to identify tell-tale activity linked to lying, violent behaviour and racial prejudice.

The latest work reveals the dramatic pace at which neuroscience is progressing, prompting the researchers to call for an urgent debate into the ethical issues surrounding future uses for the technology. If brain-reading can be refined, it could quickly be adopted to assist interrogations of criminals and terrorists, and even usher in a "Minority Report" era (as portrayed in the Steven Spielberg science fiction film of that name), where judgments are handed down before the law is broken on the strength of an incriminating brain scan.

"These techniques are emerging and we need an ethical debate about the implications, so that one day we're not surprised and overwhelmed and caught on the wrong foot by what they can do. These things are going to come to us in the next few years and we should really be prepared," Professor Haynes told the Guardian.

The use of brain scanners to judge whether people are likely to commit crimes is a contentious issue that society should tackle now, according to Prof Haynes. "We see the danger that this might become compulsory one day, but we have to be aware that if we prohibit it, we are also denying people who aren't going to commit any crime the possibility of proving their innocence."


5:42:58 PM  PermaLink   / trackback []  

News Item 8371 Brain Scanner Can Read People's Intentions.

Brain Scanner Can Read People's Intentions. Vainglorious Coward writes "Reality continues to catch up with Nineteen Eighty-Four with the announcement of the development of a brain scanner that can read a person's intentions. 'It's like shining a torch around, looking for writing on a wall,' said the leader of the project, Professor John-Dylan Haynes . Demonstrating his own mastery of doublethink, Haynes continued 'We see the danger that this might become compulsory one day, but we have to be aware that if we prohibit it, we are also denying people who aren't going to commit any crime the possibility of proving their innocence.'" [Slashdot: Your Rights Online]
5:39:13 PM  PermaLink   / trackback []  

News Item 8370 The Chronicle: 2/9/2007: Caught in the Network

I wasn't particularly impressed. I had helped edit and revise that policy when I worked for the information-technology office before I earned my Ph.D., and I knew that neither Tor nor any similar program had existed when the policy was first written. I also knew that the provisions in question were vague.

My visitors next produced page after page of logs detailing my apparent use of Tor. While I couldn't dispute most of the details in the logs, they seemed inaccurate. For example, the technician said I had been using Tor earlier that morning. In fact, I had been at Wal-Mart that morning looking for a good deal on an HDTV; I had reached my office only about five minutes earlier.

More important, the logs did not prove any wrongdoing on my part. All they demonstrated was that I, like thousands of others around the world, had installed and infrequently used Tor. In my case, of course, there was no wrongdoing.

Nonetheless, my visitors made two requests: that I stop using Tor, and that I avoid covering it in class.

Having been on the administrative end of academic technology, I appreciate the difficulties facing the information-technology staff. No one pats you on the back if nothing goes wrong, but if something does -- if a virus or worm sweeps through the campus's network infrastructure, or someone hijacks some computers to churn out spam -- you are off everyone's Christmas-card list. The last thing my former colleagues needed was some smarmy faculty member spouting off about academic freedom and threatening to demonstrate Tor to 100-plus students each semester.

Their job is to protect the network that allows me to do my job: to teach classes that are mostly or entirely online, and to conduct research. If they weren't here as the first or even only line of defense against the unscrupulous elements of our technological society, my university would cease to function. It's as simple as that.

Furthermore, I do not rely heavily on Tor, or even think much about it outside the context of my courses. I find all that routing makes it slow to use, even with the superfast connection I have at work.

But it is being used all around the world, by people in countries that restrict their access to information, by corporate whistle-blowers, and by digital-rights activists. It's even being used by average people like me, as a way to keep innocuous and personal online activities private.

So in the head-on collision between my appreciation of the role IT staff members play on my campus and my understanding of the role I have to play for my students, my need for academic freedom won. I found myself lecturing my three visitors into near catatonia about the uses of Tor.

Finally, they shook my hand, thanked me for talking with them, reminded me that I was probably violating the responsible-use policy, and left. They had bigger game to catch: the other Tor user on the campus.

A moment later, I heard another knock on my door. One of the detectives had come back to ask if I would reconsider my position. I told him that while I would think about giving up Tor, I honestly felt that this was a clear case of academic freedom, and I could not bow to external pressure. I reminded him that Tor is a perfectly legal, open-source program that serves a wide variety of legitimate needs around the world.

He nodded and left. Feeling an odd mixture of righteous indignation, patriotism, and dread, I closed the door.


5:35:45 PM  PermaLink   / trackback []  

News Item 8369 University Professor Chastised For Using Tor.

University Professor Chastised For Using Tor. Irongeek_ADC writes with a first-person account from the The Chronicle of Higher Education by a university professor who was asked to stop using Tor. University IT and campus security staffers came knocking on Paul Cesarini's door asking why he was using the anonymizing network. They requested that he stop and also that he not teach his students about it. The visitors said it was likely against university policy (a policy they probably were not aware that Cesarini had helped to draft). The professor seems genuinely to appreciate the problems that a campus IT department faces; but in the end he took a stand for academic freedom. [Slashdot: Your Rights Online]
5:28:22 PM  PermaLink   / trackback []  

News Item 8368 To Media Companies, BitTorrent Implies Guilt.

To Media Companies, BitTorrent Implies Guiltkripkenstein writes "The big media companies immediately assume you are guilty by your mere presence on a BitTorrent swarm, an investigation by a university security worker reveals. Turns out companies like BayTSP (which the media companies employ) will send shutdown notices to ISPs without any evidence of copyright infringment; all they feel they need is an indication that you are reported by the tracker to be in the swarm." From the post:  "For my investigation, I wrote a very simple BitTorrent client. My client sent a request to the tracker, and generally acted like a normal Bittorrent client up to sharing files. The client refused to accept downloads of, or upload copyrighted content. It obeyed the law... With just this, completely legal, BitTorrent client, I was able to get notices from BayTSP. To put this in to perspective, if BayTSP were trying to bust me for doing drugs, it'd be like getting arrested because I was hanging out with some dealers, but they never saw me using, buying, or selling any drugs."  [Slashdot: Your Rights Online]
5:23:16 PM  PermaLink   / trackback []