Tuesday, February 27, 2007

Battle brewing over RFID chip-hacking demo | InfoWorld | 2007-02-26 | By Paul F. Roberts Secure card maker HID Corp. is objecting to a demonstration of a hacking tool at this week's Black Hat Federal security conference in Washington, D.C. that could make it easy to clone a wide range of so-called "proximity" door access cards. HID has sent a letter to IOActive, a security consulting firm, accusing Chris Paget, IOActive's director of research and development, of possible patent infringement over a planned presentation, "RFID for beginners," on Wednesday, a move that could lead to legal action should the talk go forward, according to Jeff Moss, founder and director of Black Hat. [ See also our Video: "Hack in action" ] 10:04:59 PM

Lawsuits, patent claims silence Black Hat talk | InfoWorld | 2007-02-27 | By Paul F. Roberts A planned talk on RFID security by a security researcher has been pulled from this week's Black Hat Federal security conference after secure card maker HID claimed the talk violated the company's patent rights and threatened to take legal action against Chris Paget, the researcher, and IOActive, Paget's employer, if the talk went forward. The company decided to cancel the talk after all-night negotiations with HID collapsed, said Josh Pennell, CEO of IOActive. In response, Black Hat organizers were forced to tear materials out of printed show proceedings and will instead present a discussion by a representative of the ACLU on the criticality of RFID security, said Jeff Moss, founder and director of Black Hat. A spokeswoman for HID did not immediately respond to a request for comment. The incident recalled a 2005 dispute over a presentation at Black Hat in Las Vegas involving Cisco Systems and Michael Lynn, a security researcher who worked for Internet Security Systems at the time. 9:59:50 PM

New Controversy over Black Hat Presentation. New Controversy over Black Hat Presentation. uniquebydegrees writes  "InfoWorld is reporting about a new controversy swirling around a planned presentation at Black Hat Federal in Washington D.C. this week. Security researcher Chris Paget of IOActive will demo an RFID hacking tool that can crack HID brand door access cards. HID Corp., which makes the cards, is miffed and is accusing IOActive of patent infringement over the presentation, recalling the legal wrangling over Michael Lynn's presentation of a Cisco IOS hole at Black Hat in 2005. Black Hat's Jeff Moss says they're standing by their speaker. A news conference is scheduled for tomorrow AM." Update: 02/27 20:10 GMT by Z :InfoWorldMike wrote with a link to story saying that the presentation has been pulled from the slate for Black Hat, as a result of this pressure. [Slashdot] 9:55:39 PM

Windows Genuine Advantage's newest setting: "you might be a pirate" Windows Genuine Advantage is an anti-piracy tool loathed by many, tolerated by some, and even appreciated by others. How you feel about it may depend in part on whether or not you've been caught in its snares: the "authentic software" validation tool is known to have falsely identified thousands of "pirated" Vista installs. As Microsoft steps up its war against piracy, the company has decided to slightly nuance Windows Genuine Advantage (WGA). Rather than identify users as either in the clear or not, the company has added a third classification for users who set off some, but not all of WGA's undisclosed piracy-detection functionality. Users will now find that Windows XP installs are labeled as genuine, non-genuine or "not sure." While Microsoft has not responded to requests for comment, it's quite obvious what is going on here: Microsoft has added "not sure" as a way of cutting down on the number of false positives associated with WGA. As many as one in five PCs were failing WGA checks, but this new setting should both reduce this and give Microsoft the chance to investigate further the kinds of things that are landing folks in the "not sure" category. Although the Windows Genuine Advantage Notification tool is "optional," Microsoft is in the process of pushing out the tool as a "critical" and thus automatic update (affectionately dubbed WGA Notifications 1.7 KB905474). The update has been known about for over a month, but users are just now seeing it show up as a critical update to Windows XP. 8:28:12 PM

Administrivia: Now we have a overheated CPU ( 60 degrees centigrade ) OK, if the DDOS attack wasn't enough. Now our server went down with a temperature overload. We were up to 60 degrees centigrade when we shut down. The CPU and a broken fan have been replaced. 7:39:01 PM

Administrivia: Our data-center was hit by a DDOS attack today. Sorry for being either very slow or off the net for a while recently. The data-center we are part of was hit by a DDOS (Distributed Denial Of Service) attack recently. At the moment it looks to be under control, but we are keeping an eye on things. 5:19:59 PM

Google Sharpens Malware Alerts for Webmasters. Google Sharpens Malware Alerts for Webmasters. Google improves the way it notifies sites that they are afflicted with malware. [PC World: Latest Technology News] 4:14:00 PM

© Copyright 2007 Paul Hardwick. Last update: 3/4/07; 2:39:22 AM.