Tuesday, August 1, 2006

Bluetooth Security. Bluetooth Security. This paper, written by Colleen Rhodes, will explain what Bluetooth is, how it works, and some of the vulnerabilities and risks associated with it. By Colleen Rhodes. [Infosec Writers Latest Security Papers] 2:44:43 PM  PermaLink   / trackback []

Digital Cavity Search. Digital Cavity Search.   When you cross the border, customs agents have long had the right to search your car and your person without a warrant. It's essentially a rights-free zone. A recent court decision found that agents can also legally search through your laptop using forensic software, as agents did with Stuart Romm, a convicted sex offender busted for possession of child pornography when trying to get back into the United States. This ruling (.pdf) has spawned an interesting debate on Dave Farber's Interesting People mailing list about whether you are required to turn over your user password or your encryption key (you are using whole disk encryption, right?) to a government agent. (search for the term "border search"). The answer? Maybe, maybe not. But refusing to provide either would likely get your laptop one-way ticket to a long vacation in some government office. Whether it would ever fly home after that is unknown. While you are over there checking out the discussion, take the time to subscribe or grab the RSS feed someone created for the email list. I'm reminded of a story that John Gilmore tells of flying back in the days when airline screeners required you to turn on your laptop in front of them. When the agent told Gilmore to open his laptop and turn it on, Gilmore declined, telling the screener, "I'm not going to object to you searching me, but I'm not going to help you do it." Photo: Beatrice Murch [27B Stroke 6] 2:43:34 PM  PermaLink   / trackback []

Feds Appeal State Secrets Decision. Feds Appeal State Secrets Decision. The federal government asked an appeals court Monday to immediately hold a hearing on a lower court decision that allows an anti-eavesdropping lawsuit against AT&T to proceed, despite the government's arguments that the lawsuit would harm the national defense. In the request filed with the Ninth Circuit Court of Appeals, government lawyers argued that last week's landmark decision by Federal District Court Judge Vaughn Walker --a Republican appointee --usurped the executive branch's powers to wage war and keep the country safe. Walker refused to toss the Electronic Frontier Foundation lawsuit, saying that the existence of the program was no longer a secret since the Administration confirmed news reports that it was spying on some Americans' overseas communications without a warrant. That decision was one of the few times that a judge has not bowed down to the invocation of the state secrets privilege by the executive branch. While the privilege has a long history, the Bush Administration has used the legal equivalent of a "neutron bomb" widely to prevent information about secret CIA prisons, eavesdropping and FBI translation mistakes from being revealed in open court. Realizing that his decision would be controversial, Walker granted the government the right to appeal the non-dismissal immediately. The government reiterated to the Ninth Circuit that it believed any information about the program would harm national security. Adjudicating each of the plaintiffs'' claims would require confirmation or denial of the existence, scope, and potential targets of alleged intelligence activities, as well as AT&T's purported involvement in such activities. The declarations [ by the Director of National Intelligence and the head of the NSA] made clear that such information cannot be confirmed or denied without causing exceptionally grave damage to national security; indeed, the most basic factual allegation necessary for plaintiffs' case -- whether AT&T has engaged in certain conduct at the behest of the NSA -- can neither be confirmed nor denied by AT&T or the United States. The government also took issue with Judge Walker's reasoning that AT&T had to have been involved. The district court started with the fact that the President has announced the existence and rough contours of the Terrorist Surveillance Program. It then hypothesized - with no support in the record - that this program could not be undertaken without cooperation by members of the communications industry. The court next noted that AT&T is a large industry participant, cooperates with the Government when requested to do so through lawful means, and has stated that it engages in classified contracts. The court then put these points together in its own fashion, overrode the national security judgment of the Director of National Intelligence, and concluded that it should not be a state secret for AT&T to confirm through this litigation that, if true, it is indeed assisting the NSA in carrying out the Terrorist Surveillance Program. This determination by the district court represented a usurpation of the proper role of the Executive in the field of protection of information that is key to national defense. It is likely that the Ninth Circuit will grant the government's appeal and have a three judge panel hear the case. That decision could then be appealed either side to a full panel of appeals court judges and that decision could then be appealed to the Supreme Court. The EFF's suit relies heavily on evidence provided by former AT&T technician Mark Klein, who alleges he saw an NSA room in AT&T's San Francisco internet switching station. Klein provided documents that purportedly show how AT&T siphoned off traffic across its fiber-optic cables into that room. In May, Wired News published portions of those documents, which it acquired from a source not involved in the litigation. (Disclosure: Wired News has filed a motion to intervene in the case, asking the court to make public evidence, filed under seal, of AT&T's alleged wiretapping activities.) The case is Hepting vs. AT&T Corp. [27B Stroke 6] 2:41:08 PM  PermaLink   / trackback []

Black Hat and Defcon 2006: Security Fix Heads to Vegas. Black Hat and Defcon 2006: Security Fix Heads to Vegas. Security Fix is headed to Las Vegas for the better part of the next week to cover two back-to-back hacker conferences. The first is Black Hat USA 2006, which runs Wednesday and Thursday and caters to security professionals and researchers whose bosses can afford to foot the $1,200 to $1,600 registration fees. The other is Defcon, 72 straight hours of presentations and non-stop hacker fun starting Friday morning. Security researchers plan to detail more than a dozen new software and hardware security flaws at this year's Black Hat. While many of the presentations at Defcon will be retreads of those offered at Black Hat, no doubt there will be quite a few new security holes unveiled there as well. Last year's Black Hat was overshadowed by a talk given by Mike Lynn, who quit his job at Atlanta-based Internet Security Systems Inc. in order to present his research on serious security flaws in Cisco Systems routers, the networking devices responsible for directing much of the Internet's traffic (Lynn since landed a job working for Cisco arch-rival Juniper Networks. For more background on that controversy, check out the archives. Interestingly enough, Cisco has stepped up as a one of three "platinum" sponsors of this year's Black Hat (along with Microsoft and Ernst & Young); I couldn't find any mention of ISS as a sponsor of this year's con. Probably one of the more newsy and relevant talks at Black Hat this year will be given in part by another researcher who recently left ISS -- David Maynor, who is now a senior researcher at Secure Works (also headquartered in Atlanta). Maynor and Jon "Johnny Cache" Ellch will show how flawed software drivers in common wireless devices can open up almost any laptop to hijacking by the bad guys. Check back with Security Fix on Wednesday for an exclusive inside look at their research. Dan Larkin, unit chief of the FBI's Internet Crime Complaint Center, will be the keynote speaker on Day 1 of Black Hat, discussing "war stories and trends" in the government's ongoing battle with increasingly organized cyber criminals. The first session on Day 2 features the annual "Meet the Feds" panel. Featured speakers include David Thomas, chief of the FBI's counterterrorism/counterintelligence and criminal computer intrusion investigations; Jim Christy, director of the Defense Cyber Crime Institute (DCCI), and Linton Wells, principal deputy assistant secretary of defense (networks and Information integration) at the Department of Defense. Hackers at Defcon also will have a chance to meet the feds. Prior to last year's trip to Vegas, I spoke with Jack Holleran, formerly head of the National Security Agency's National Computer Security Center. Holleran is now retired and is one of countless folks helping to organize the two conferences along with Black Hat and Defcon founder Jeff Moss. When I spoke with Holleran recently, he recounted a notable "Meet the Feds" panel several years back. Someone on the panel invited anyone in the room to stand up if they had ever probed someone's network defenses without the target's permission. Holleran recalled that a good portion of the hackers in the room proudly stood up. Those standing were then asked to sit down if what had made them stand up wasn't so felonious as to land them in jail for a long time. Holleran said all but a handful of defiant young hackers took a seat. At that point, several law enforcement officials on the panel quickly pulled out cameras from beneath the table, pointed them at the crowd and began snapping away -- thus giving the feds photographs of potentially prosecutable attendees. Also at Black Hat '06, Dan Moniz and HD Moore will be showing how common cross-site scripting flaws in popular social networking sites like Myspace.com and Xanga.com could be combined with Web browser vulnerabilities to power an Internet worm capable of infecting millions of users in a very short time frame. Whether their demo goes off without a hitch is of little concern, as their concept is ripe for exploitation (cross-site scripting flaws are ubiquitous on most major Web sites, and new browser flaws are discovered every day). On Monday, HD wrapped up his Month of Browser Bugs, wherein he detailed a new, previously undocumented browser security flaw for each day in July. Security Fix will have an exclusive look at their research just prior to their talk on Thursday afternoon. Another talk likely to garner attention will be given by Jeremiah Grossman and TC Niedzialkowski, who will present research on how to hack private corporate Intranets using Javascript. Also, an entire track of Day 2 at Black Hat will feature various presentations on the growing threat from rootkits, tools that bad guys and malware are increasingly using to remain hidden and deeply entrenched on computers that they have infiltrated Those are just a few highlights from this year's jam-packed conference schedule. Check back all week for updates. [Security Fix] 2:37:36 PM  PermaLink   / trackback []

CALEA challenge. CALEA challenge. CDT, EFF, the Media Access Project, Sun, and Pulver.com have asked the judges on the D.C. Circuit Court of Appeals to all sit together to reconsider the June 9 opinion upholding the FCC[base ']s creative interpretation of CALEA. In order for such a reconsideration request to be granted, the petition has to concern a [base "]question of exceptional importance.[per thou] That[base ']s certainly present here [~] the D.C. Circuit[base ']s June ruling allowing the FBI to serve as a gatekeeper for online applications doesn[base ']t fit with the statute and poses enormous threats to innovation. Remember, everyone has to comply with lawful wiretapping/interception requests. Compliance is not the issue here. The additional cost-shifting burden imposed by CALEA is to require that things be built so that they are easily tappable by law enforcement. In 1994, Congress unquestionably exempted the internet (both access to the internet and applications used online) from CALEA obligations. (That[base ']s why there[base ']s an awful CALEA rewrite in circulation now [~] DOJ wants to change the law.) Even though the statutory language is clear, the FCC decided to interpret the statute to include elements that had specifically been left out by Congress. The FCC did this by saying that the statute was ambiguous [~] when it isn[base ']t [~] and by arguing that because [base "]interconnected VoIP[per thou] services are [base "]replacements for a substantial portion[per thou] of traditional telephone services they must be covered by CALEA. Their position was/is specious, in my view, because CALEA specfically excludes [base "]information services.[per thou] And [base "]information services[per thou] include internet access and online applications. But backing up the frame from the statutory arguments (which the petition admirably presents in visual/analogy form several times) reveals a crucial and enormous legal issue. Congress hasn[base ']t expressly delegated power to the FCC to [base "]regulate the internet.[per thou] Who gets to do this [base "]regulation[per thou] is very important to the future of this country. In the absence of an express delegation, no deference to the agency[base ']s views is required. The D.C. Circuit is the group we depend on to rein in the Commission when it gets adventurous [~] or succumbs to pressure. The FCC is far from independent of the wishes of the Executive Branch, particularly when it comes to national security and law enforcement desires. Incrementally, in a thousand definitional nuances and statutory-creep extensions, the Commission is becoming the de facto internet regulator. Surely we[base ']d want to have told them to do this; surely we would have thought through the consequences of such a step. Because we haven[base ']t, it would be wrong for a court to defer to what they have to say when it comes to the regulation of the internet. Particularly when it comes to getting FBI guys involved in designing new online applications. read more [Public Knowledge - Policy Blog] 2:35:15 PM  PermaLink   / trackback []

US social networking ban could unfairly block some sites. US social networking ban could unfairly block some sites. 'Loose' law draws criticism The US House of Representatives has voted by an overwhelming majority to ban social networking sites in schools and libraries. Critics have warned that the ban could apply to a wide variety of sites, some of them of vital educational value. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 2:32:26 PM  PermaLink   / trackback []

McAfee Preps Patch for Vulnerability. McAfee Preps Patch for Vulnerability. Flaw in the company's SecurityCenter app could allow users to run code on a remote machine. [PC World: Latest Technology News] 2:30:51 PM  PermaLink   / trackback []

Keep DOPA Out of Schools. Keep DOPA Out of Schools. Recently passed by the House, the Deleting Online Predators Act (DOPA) requires public schools and libraries to block access to social networking sites and other communication tools as a condition for receiving certain government funding. Protecting children online is important, but letting federal bureaucrats arbitrarily censor legitimate speech is the wrong way to go. Cutting off social networking's legitimate uses is bad enough, but DOPA also gives the FCC wide latitude to define the block-list. It potentially covers IM, blogs, wikis, discussion forums, and other sites far beyond MySpace. Despite its limited exceptions, DOPA will restrict children's and adults' online research, distance learning, and use of community forums, among other activities. Two Congressionally-commissioned studies say education, not blocking access, is a more effective way to keep kids safe online. In fact, by hampering educators ability to teach Internet safety skills, DOPA may put children more at risk. This isn't the first time Congress has meddled with school and library computers. EFF fought hard against the Children's Internet Protection Act, which required use of Web filtering. If DOPA passes, where might this slippery censorware slope lead next? DOPA has been referred to the Senate Commerce Committee and is unlikely to move forward until after the August recess. We'll keep you updated and fight to keep DOPA out of schools. [EFF: Deep Links] 2:29:43 PM  PermaLink   / trackback []

Privacy-protected web search with Ixquick. Privacy-protected web search with Ixquick. In response to growing concerns over search engine privacy, the metasearch engine Ixquick has announced it will permanently delete all personal search details gleaned from its users from their log files. From their press release: As digital technology increasingly pervades our world, more and more personal details are being stored electronically, many of them by search engines. While you are searching the internet, these engines register the time of your searches, the terms you used, the sites you visited and your IP address. In many cases this IP address makes it possible to trace the computer, and in turn the household, that carried out the search. hese personal details are often retained for long periods by search engines and are of interest to commercial parties, governments and even criminals. [base "]Many search engines openly use this data for commercial purposes. It seems only to be a question of time before the data gets misused,[per thou] alleges Van Eesteren. [base "]Therefore we have decided to permanently delete all personal search records. If the data is not stored, users privacy can[base ']t be breached[per thou]. Ixquick[base ']s Meta Search feature enables the user to simultaneously search 11 of the best search engines. However, Ixquick does not share the user[base ']s personal data with these individual search engines in any circumstances. In addition, as of this week, Ixquick will delete the users[base '] IP addresses and [OE]unique user IDs[base '] from its own [OE]Log Files[base ']. [base "]Therefore, any user can use Ixquick.com to search in a combination of the best search engines secure in the knowledge that they can enjoy complete protection of their privacy,[per thou] continues Mr. van Eesteren. [via John Battelle] [michaelzimmer.org] 2:27:14 PM  PermaLink   / trackback []