Saturday, February 24, 2007


News Item 8542 Wired News: Why Smart Cops Do Dumb Things By Bruce Schneier

Since 9/11, we've spent hundreds of billions of dollars defending ourselves from terrorist attacks. Stories about the ineffectiveness of many of these security measures are common, but less so are discussions of why they are so ineffective. In short: Much of our country's counterterrorism security spending is not designed to protect us from the terrorists, but instead to protect our public officials from criticism when another attack occurs.
11:58:46 PM  PermaLink   / trackback []  

News Item 8541 Are we stuck with CYA homeland security? | NetworkWorld.com Community

Wired has a thought-provoking piece this morning from security expert Bruce Schneier - headlined "Why smart cops do dumb things". It makes the case that the bulk of post-9/11 homeland security excesses stem from a most natural of human instincts: the need to cover one's ass.

The headline is misleading in that the essay is not about police officers specifically, but rather public safety officials, politicians and regulators of all stripes. But on the broader score the column is dead-on accurate: We've scared ourselves half to death and thus practically demand that those entrusted with keeping us safe go to absurd extremes to keep from being scapegoated should something go wrong. ... And something will go wrong. That part of the equation is not irrational.

The only quibble I have with Schneier's assessment is his conclusion that "there might not be a solution." Call me a crazy optimist (you'd be the first), but I've got to believe there's a way out of this knot.


11:53:52 PM  PermaLink   / trackback []  

News Item 8540 Human Nature Trumps Homeland Security.

Human Nature Trumps Homeland Security. netbuzz writes "Security expert Bruce Schneier suggests this morning that 'there might not be a solution' to our post-9/11 penchant for making domestic anti-terrorism decisions based on the basic human desire to cover one's backside. He might be right. But shouldn't we at least try to figure out a better way? For example, wouldn't 'Commonsense Homeland Security' be a winning political banner, not a risky one? " [Slashdot: Your Rights Online]
11:41:19 PM  PermaLink   / trackback []  

News Item 8539 Think Your Social Security Number Is Secure? Think Again - New York Times

It should come as little surprise that Social Security numbers are posted on the Internet. But, says Betty Ostergren, a former insurance claims supervisor in suburban Richmond, Va., who has spent years trolling for them, "people are always astounded" to learn that theirs is one of them.


Mrs. Ostergren, 57, has made a name for herself as a gadfly as she took on a lonely and sometimes frustrating mission to draw attention to the situation. With addresses, dates of birth and maiden names often associated with Social Security numbers, she said, they are a gift to data thieves.

But in the last few weeks, Mrs. Ostergren's Web site, The Virginia Watchdog -- with the help of lobbying from an unexpected ally, America's farm bureaus -- is having an effect.

One by one, states and counties have started removing images of documents that contain Social Security numbers, or they are blocking out the numbers. Four states, including New York, have removed links to images of public documents containing Social Security numbers.


11:35:33 PM  PermaLink   / trackback []  

News Item 8538 Pendulum Swinging Toward Privacy.

Pendulum Swinging Toward Privacynetbuzz writes  "The New York Times reports this morning on a gathering movement to remove Social Security numbers from online public records. While justifiable, given the reality of and concerns about identity theft, it also doesn't take much to imagine how such concerns will be abused by public officials who are strapped for cash and/or ethically challenged."  [Slashdot: Your Rights Online]
11:31:04 PM  PermaLink   / trackback []  

News Item 8537 DRM Causes Piracy.

DRM Causes Piracy. igorsk recommends an essay by Eric Flint, editor at Baen Publishing and an author himself, over at Baen's online SF magazine, Baen Universe. In it Flint argues that, far from curbing piracy of copyrighted materials, DRM actually causes it. Quoting: "Electronic copyright infringement is something that can only become an 'economic epidemic' under certain conditions. Any one of the following: 1) The products they want... are hard to find, and thus valuable. 2) The products they want are high-priced, so there's a fair amount of money to be saved by stealing them. 3) The legal products come with so many added-on nuisances that the illegal version is better to begin with. Those are the three conditions that will create widespread electronic copyright infringement, especially in combination. Why? Because they're the same three general conditions that create all large-scale smuggling enterprises. And... Guess what? It's precisely those three conditions that DRM creates in the first place. So far from being an impediment to so-called 'online piracy,' it's DRM itself that keeps fueling it and driving it forward." [Slashdot: Your Rights Online]
11:26:18 PM  PermaLink   / trackback []  

News Item 8536 Fraudsters Declare War on Anti-Scam Services.

Fraudsters Declare War on Anti-Scam Services.

Spammers have been attacking and threatening several of the groups and individuals who have been performing some of the most important work in hobbling online scams, spam and computer viruses.

The SANS Internet Storm Center on Thursday found a piece of malicious code (called "sans.exe") designed to update a group of several thousand infected computers that SANS has been monitoring. The code includes text strings that suggest an attack on the center if two of its crime fighters don't stop interfering with his money-making spam operations. The message, in part, read:

"You better f*** off SANS.org especially that [SANS chief technology officer] Johannes Ullrich (phone and e-mail address deleted) and Kevin Hong (phone and e-mail address deleted). I really don't have anything against you, just piss off alright?" [sic]

"I guess we always felt like this [was] going to happen at some point," Ullrich said in an online chat with Security Fix this morning. "Adding taunts like this to their code isn't what you would expect from a professional criminal trying to stay low profile. [It] points to a more juvenile 'hooligan' mentality," than hardened cyber crook.

Last month, a number of anti-spam Web sites came under a sustained "distributed denial of service" (DDoS) attack, an electronic assault during which the attackers use thousands of compromised personal computers to overwhelm a target with so much bogus traffic that the PCs can't accommodate legitimate visitors.

The attacks were made possible by tens of thousands - perhaps millions - of computers infected by the recent e-mail virus known as the "Storm worm. The virus links all infected computers into a peer-to-peer data network using the same technology as the eDonkey file-sharing network. The attackers later instructed the networked machines to attack sites such as spam trackers Spamhaus and the personal Web site of Joe Stewart, the SecureWorks researcher who conducted some of the most detailed analysis of the Storm worm.

The Web sites for CastleCops -- an all-volunteer, online scam fighting community -- also have been under a consistent denial-of-service attack for the past couple of weeks. Its main site and user forum are not working again this morning. Security Fix has spotlighted the laudable work this volunteer group does in bringing down phishing Web sites and analyzing new malicious software.

CastleCops co-founder Robin Laudanski said the intermittent site shutdowns have been inconvenient, but added that they have bolstered support for the group from within the security community.

"I take [the attacks] as a compliment because if we weren't putting a dent in the bad guys' pocketbooks, we wouldn't be getting attacked," Laudanski said. "It means we're being a pain, and that we're doing something right."

[Security Fix]
11:15:24 PM  PermaLink   / trackback []  

News Item 8535 RIAA to Parents: Pop-Ups + Viruses = Piracy!

RIAA to Parents: Pop-Ups + Viruses = Piracy!

If a parent sees pop-up ads and viruses on her computer, she can be sued for copyright infringement by the RIAA.

At least that's what the RIAA is arguing in a recent court filing in the Capitol v. Foster case, in which a federal judge made the RIAA cough up attorney's fees to a mother, Debra Foster, who had been sued because her daughter was file sharing. The RIAA lawyers had dawdled in dismissing their complaint against Foster, even after her child admitted to being the file-sharer in the house (the RIAA went ahead and got a default judgment against the child).

This new filing marks the first time the RIAA has explained its claim that parents are liable for the infringements committed by their children (a theory that has never been accepted by any court, to the best of my knowledge). The argument is pretty remarkable, built on a house of cards including the notion that "everyone knows" pop-up ads and viruses signify piracy! Here's the relevant portion of the RIAA brief:

Given that it has been established that the Kazaa file-sharing program was on the Foster family's computer, the evidence would have established that the Kazaa icon was clearly visible on the computer when defendant was using it and that there were likely a substantial number of pop-up advertisements, the types of which have been associated with the Kazaa program.
In other words, the RIAA believes that pop-up ads and a system tray icon should put every parent on the hook for every download on the computer.
In addition, it is undisputed that defendant had an account with Cox Communications. Defendant's subscriber agreement with Cox made clear that defendant, as the account holder, was responsible for what is done on her account. ...
Here, the RIAA is trying to make a private contract between Cox and the parent into a promise to the RIAA. Of course, since this is standard boilerplate in ISP customer agreements, this argument would apply equally to every broadband subscriber, whether parent, employer, library, or school.

Finally, plaintiffs believe that discovery would have revealed substantial other evidence of defendant's knowledge and material assistance in the underlying infringements. For example, the computer may well have been in a common area such that defendant heard music coming from the computer when admitted infringer Amanda Foster was using it. In addition, the evidence may have established, as it has in other similar cases, that there were viruses on the computer due to Kazaa and that defendant may have had work done on the computer that would have revealed the existence of the file-sharing program. ...

Yes, parents, that means every time you hear music emanating from a computer, the RIAA believes you have a legal duty to check the copyright pedigree of its source. Oh, and if your computer has a virus, same answer.

Similarly, plaintiffs believe that, had they been given the opportunity, they would have been able to prove vicarious infringement. Specifically, plaintiffs would have proved that, as a parent, defendant had the full right and ability to control her daughter's use of the computer at issue. Most parents impose restrictions on computer usage by their children (e.g., rules about pornography sites and chat rooms), and plaintiffs believe that defendant would have done so as well. Plaintiffs further would have proven that defendant had a direct financial interest in her daughter's infringing activities, which, of course, involve substantial sums of money in terms of the value of the recordings at issue and the potential liabilities resulting from such activities.

By this logic, the more responsible you are as a parent, the more the RIAA will be entitled to collect from you. Moreover, the RIAA is confusing the benefit to the child with the benefit to the parent. As every parent knows, just because your kids wants a new CD doesn't mean you would have bought it for them.

Let's be clear what this pretzel logic is really all about -- the RIAA wants to reach a hand into every parent's pocket in order to fuel their mass litigation campaign, irrespective of whether the law supports this. But there is a bigger risk, as well. If court's accept this argument in file-sharing cases, the RIAA will have a precedent to use against every employer, every library, and every school for every copyright infringement committed on its computers. So I'm on the side of the judge in Capitol v. Foster, who dubbed these RIAA arguments "untested and marginal."

For more on parental liability in RIAA file sharing lawsuits, take a look at the memo we prepared on the subject in 2005 (soon to be updated in light of more recent authorities, including Capitol v. Foster).

[EFF: Deep Links]
11:01:25 PM  PermaLink   / trackback []  

News Item 8534 Second Google Desktop Attack Reported.

Second Google Desktop Attack Reported. Google Desktop is vulnerable to a Web-based attack that could give an attacker access to data indexed by the software, say security researchers. [PC World: Latest Technology News]
10:52:17 PM  PermaLink   / trackback []  

News Item 8533 Sarasota Study Report Released.

Sarasota Study Report Released.

The technical team commissioned by the State of Florida to study the technology used in the Sarasota election has released its report.

We are studying the report and will comment here as soon as we are able.

[Freedom to Tinker]
10:50:15 PM  PermaLink   / trackback []  

News Item 8532 Mozilla Fixes Firefox Bugs.

Mozilla Fixes Firefox Bugs. An update to Firefox fixes a number of security flaws in the browser. [PC World: Latest Technology News]
10:48:10 PM  PermaLink   / trackback []  

News Item 8531 Congressman Wants Answers About TSA Site.

Congressman Wants Answers About TSA Site.

Citing reports by Security Fix and Wired, the chairman of the House Committee on Oversight and Government Reform is demanding that the Transportation Security Administration produce a raft of documents to explain why it created a Web site for airline travelers that lacked basic security protections.

In a letter sent Friday to the assistant secretary of the TSA, Rep. Henry Waxman (D-Calif.) ordered the agency to produce all documents "relating to the period during which the site operated without encrypted data transfer protections, including the number of travelers who may have submitted their personal information to the site during the period when the site was not SSL-protected." The TSA has until March 9 to submit the documents.

Referring to reporting by Wired's 27B Stroke 6 blogger Ryan Singel about numerous spelling errors on the site, Waxman noted: "In fact, the overall appearance of the site was so poor that web experts first assumed it was a so-called 'phishing' site, a site internet hackers had created to look like a TSA website page."

The "Travel Verification Identity Program" Web site was designed to provide redress for airline travelers who have been delayed or prevented from boarding a plane on account of their name matching an identical one on the agency's "no-fly" list. The Department of Homeland Security has since launched a new version of the site that addresses most of the concerns expressed in Waxman's letter.

[Security Fix]
10:46:38 PM  PermaLink   / trackback []  

News Item 8530 NYC Gothamist: How the NYPD Videotapes You

In the wake of a federal judge criticizing the NYPD's videotaping procedures last week, I-Witness Video looks at what the NYPD actually uses to record public events and calls it "360 degrees of surveillance," best illustrated by what the police used during the 2004 Republican National Convention.

Officers used "lipstick cameras" which are easily concealed, as well as helicopters with "military-style infrared imaging." And Fuji lent the NYPD its BlimpCam, and I-Witness Video describes the blimpcam footage from August 27, 2004:


10:16:23 PM  PermaLink   / trackback []  

News Item 8529 NYC Gothamist: Tracking Firefighters with Chips

Eventually the FDNY hopes to track the movement of every firefighter in a burning building --they already have schematics for nearly all buildings in the city. Using the location devices firefighters on the scene could be warned of conditions from the FDNY Operations Center.
10:14:16 PM  PermaLink   / trackback []