UW Computer Security Research and Course Blog

From The Guardian, and on Slashdot.

Police in the United Kingdom may soon be be able to collect DNA samples from children if they exhibit behaviors that suggest they may commit crimes later in life, at least if Scotland Yard forensics director Gary Pugh has his way.

Pugh cites the importance of identifying future offenders, saying that “the number of unsolved crimes says we are not sampling enough of the right people.” Advocates of such programs, including the Institute for Public Policy Research, claim that most career criminals begin their lives of crime as early as 10 to 13 years old, and suggest that children from 5 to 12 years old should be profiled and sampled if they exhibit certain “risk factors.”

Even these advocates acknowledge that such treatment could have a “stigmatising” effect, but they do not seem to have any problem with gross violations of privacy in the name of improving public safety.  One concern that is not directly addressed in the article is the possibility that the negative attention such sampling and registration involves might even place more obstacles to a child’s chances of leading a normal life, perhaps even increasing the likelihood that they would turn to crime; a self-fulfilling prophecy, in other words.

Of course, an even greater issue that is sidestepped by the focus on children is the question of whether preemptive DNA sampling of any individual, adult or child, should be tolerated in any free society. Whether such programs are effective in reducing crime is not the only issue – the cost to individual liberty must also be considered. In my opinion, at least, personal freedom must always outweigh public safety, but I’m interested in hearing other ideas.

Summary:

As humans we are cursed by the need for a number of basic necessities. Among these include nutritious food, clean air, and of course water. In this brief post I will focus on the later of these.

While the importance of securing our computing systems and infrastructures cannot be stressed enough, the importance of ensuring that everyone has access to clean water far surpasses any other consideration simply because it is essential for our health and well-being. It would indeed be tragic to lose a life savings due to identify theft, but such loss pales in comparison to the health risks involved with contaminated or otherwise unsanitary water. Financial loss can be recovered, while the same cannot be said about the loss of life, life years, or the degraded quality of life in the years that one does have. Unfortunately, while some risks to our water supply seem far fetched and highly unlikely, others are very real and seemingly unavoidable. (Read on …)

Summary

Car GPS navigation systems are handy tool for finding one’s way on the road. With features like local points of interest, address book and SD card backup it would not be surprising if becomes a common everyday item soon. Here is a review for a GPS navigation system similar to the Magellan Maestro 4200:

(Read on …)

I’ve seen a few people on this blog cover various aspects of cellphone security, including the new iphone 3rd party support and GPS tracking, however I haven’t seen anything covering the most basic of cellphone features, voice communication. It seems to me there are just as many, if not more, security implications that arise by the simple act of eavesdropping or account spoofing as there are in the more modern functions of cell phones. (Read on …)

Being a frequent visitor to Japan and thus knowing its people and culture fairly well, I thought it’d be appropriate for me to conduct a review on the new ‘taspo’ RFID cards which Yoshi also mentioned a while back.  The ‘taspo’ cards are being introduced in Japan in an attempt to reduce underage smoking.  They are to be used with cigarette vending machines. 

(Read on …)

Summary:
In order to shop at Costco, one must have a membership and proof of that membership. When an individual purchases a membership at Costco, they and their spouse may use the membership at any Costco. Otherwise, no one else is allowed to use that me mbership. If you have ever been to Costco, you know that they check for membership cards at the door and when making purchases at the register. They do not, however, check the name on the membership against another ID to verify you are the person on the card. At the front door, they glance to make sure you have a card, so they do not ever examine the fine details at this stage.

(Read on …)

Summary

FairPlay is an encryption scheme (DRM) developed by Apple to  prevent users from further distributing playable content to other users. It  has been cracked numerous times in different ways to create unrestricted/unencrypted versions of the content. The technology has since  been renamed “Hymn”. (Read on …)

No need to go to great lengths to try to spoof finger print scanners on USB sticks. You can just tell the device that the data is public. Researches discovered this vulnerability in models from 9pay and A-Data fingerprint USB data sticks. The vulnerability lies in a fundamental design flaw: the signal to access the data comes from the PC, and is not computed on board the chip. This means all one has to do is send the correct signal and the stick happily discloses the data. This can be done with a very simple command from an opensource utility. The manufacturers commented admitting they were aware of the vulnerability, but that it was difficult enough that most people wouldn’t figure it out. A fine example of attempted security through obscurity.

(Read on …)

McAfee noticed Wednesday an ongoing attack that modifies web pages to redirect traffic to another site in China. This site then infects PC’s with a Trojan to steal personal information, including usernames/passwords for online banking. According to McAfee, “one gang” alone has infected about 12,000 sites, all over the globe. Apparently there may be different groups, because elsewhere in the article mention is made that hundreds of thousands of web pages have been compromised.

(Read on …)

Summary

The Husky Card is a University of Washington student’s lifeline.  It provides student identification, building access, public transportation, and access to monetary funds for use on and around campus. 

Starting in 2009, the Husky Card will get an upgrade to smart card technology.  This is in response to the local public transportation agencies’ ORCA (One Regional Card for All) project which implements an electronic fare system.  Following implementation of this system, Regional Transit will no longer accept the current U-PASS stickers and will require smart cards. (Read on …)