The technology being evaluated is the Helios Online Voting Booth, usable at http://www.heliosvoting.org and outlined in the 2008 Usenix Secuirty paper available at the same site. The election system does not create novel cryptographic tools or algorithms, rather it provides a protocol for using existing cryptography to make an election that is universally verifiable and provides ballot casting assurance as well as voter secrecy. (Read on …)
As part of an “expose’” on cyber crime, BBC’s “Click” team took it upon themselves to hire a botnet. With the stated goal of demonstrating the power of “cyber criminals” in today’s world, the journalists purchased the use of ~22,000 compromised machines. As part of their demonstration, they directed massive amounts of spam to two specific test addresses, and finally, used their botnet to bring down a security firm’s backup website via DDoS. The DDoS attack was done with permission from the “victim” company (Prevx).
Now the BBC group is in a spot of legal trouble as their use of a botnet could potentially implicate them in the violation of the UK’s Computer Misuse Act. While BBC claimed that their use of the botnet was purely academic, and therefore not criminal, they did take control of non-consenting citizens’ home PCs. More importantly, in purchasing the use of a botnet, reportedly at somewhere between $300-$400 per machine, the news network essentially funneled a few million dollars into the hands of cybercriminals. And all so that they could demonstrate what many papers and news articles before them already had.
The journalists, at surface level, did a good job of keeping things academic and avoiding any sort of cybercrime. They spammed their own test e-mail accounts. They DDoS’d a prepared and willing target. They also put warning documentation on the infected machines, at experiment’s conclusion, explaining to their users that they had been infected, and how to best avoid future infections. Ultimately, however, by mere involvement with and commandeering of hijacked personal machines – and especially thanks to funding the true criminal party – they did indeed commit some level of criminal act. To what degree they are held responsible is now a matter for the British courts to decide.
This is just one more occurrence in a string of botnet-related legal issues. A similar issue plagued German malware researchers with the means to potentially dissolve the Storm worm’s botnet(s) (see http://cubist.cs.washington.edu/Security/2009/01/11/storm-worm-cracked-but-defenses-may-not-fly/). It seems that academicians of all types are running into a fundamental problem with this particular security threat: there is no way to legally study it “in the wild.” The moment a researcher connects to a botnet, takes control of it, or otherwise interacts with it, he or she risks legal consequences. Whether or not any charges stick is a different matter, and quite frankly, it will take some time before reasonable precedents clarify the legal “consensus,” but regardless these issues represent a significant impediment to progress in anti-botnet research.
Computer scientists at the Harvard School of Engineering and Applied Sciences recently deployed the first “practical, Web-based, secure, verifiable voting system.” After testing through 2008 and early 2009, the system, dubbed “Helios,” was used for the university presidential elections at the Belgian Université Catholique de Louvain (UCL) in the first week of March 2009. The system uses asymmetric cryptography and mixnets to provide anonymity, ballot integrity, and open, public verifiability. The system is designed to be used to what they call “low-coercion” elections, because they have not provided any way for users to change their vote at another time if the user has been coerced into voting a certain way. But, the system does provide cryptographic auditing that allows any voter to verify that their vote has been correctly recorded, and allows anyone to verify that all recorded votes have been correctly tallied, something standard elections in the USA don’t even guarantee.
Google Latitude is yet another product available by the well established makers of the Gmail internet based mail system. Latitude is a web based service, running in sync with a client side application Google Gears, which allows Google to pinpoint your exact coordinates in the world and then in turn display them to their Google Maps for you to see. As is the case with many of Google’s applications, this application functions on many different platforms including Windows, Windows Mobile, Android, iPhone, etc.
Latitude is able to detect your location via any means possible. This includes GPS, Wi-Fi access points and even cell towers. It does this by simply triangulating your position with any of these three resources it can. Once your position has been located this information is uploaded on your latitude account by Google and available to all whom you’ve opted to share your location with. This can pose potential security threats.
Most people renting an apartment use a common drop-box to pay the rent. Most often this is located in an easily accessible common are like the mailboxes or near the manager’s office. The setup to be discussed here is a box with a key lock. The box has a flap that opens with just enough room to slip in a folded check but, presumable, not enough to reach in.
Assets/Security Goals
Adversaries
Weaknesses
Potential Defenses/Conclusion
There are several solutions which could alleviate to a large extent these security risks. An overriding weakness of these solutions is that they are relatively expensive compared to the cheap cost of existing drop boxes and the biggest stake holders (the residents paying rent) are not in charge of choosing the solution (the building managers). Nevertheless, I will discuss some possible solutions. There are two basic levels of the solution. Limiting access to the box: general complex security measures like double door entrances, keys on more doors before getting to the drop-box area and the like, as well as only leaving checks out for a shorter period of time (perhaps collecting several times a day during payment periods. Making the drop box more secure: stronger boxes and locks would prevent access to the checks. Moreover, other methods such as direct delivery (in person) to the managers would eliminate most of these vulnerabilities. These solutions either compromise convenience (for example delivering directly to manager means that more coordination is required) or money (for example more expensive boxes or locks).
Apologies for reviewing the same technology. The other Google Voice review just appeared for me, which was after I wrote my own. I did check prior to starting this review, and it wasn’t up then.
Summary:
ComputerWorld had an article about Google Voice. Google Voice is a new service offered by Google to make people’s phones more usable. Google Voice will automatically transcribe a user’s voicemail into text form, using speech recognition software. Because the transcription is done with software, there may be some mistakes in the text versions. The transcriptions will be made available in the user’s inbox. The service can also e-mail or SMS the messages to you. If I user desires the service can be turned off.
Google Voice builds on the technology of GrandCentral, a company that Google bought a few years ago. This technology allows a user to have a single number for all of their phones. When this number is dialed, all of the associated phones also ring. In this way, a user can be contacted regardless of which phone (home, work, cell, etc…). Google Voice will initially be offered to current users of GrandCentral.
The recently released ITunes 8.1 closed two major security gaps from the previous version. According to Apple, until the latest release, maliciously crafted podcasts could cause ITunes to ask user for credentials but send the username and password to a destination other than Apple’s server. Furthermore, a bug in the ITunes DAAP protocol allowed attackers to send messages with specific Content-length fields causing an infinite loop, and thus a denial of service, to Windows users.
Reference: ZDNet
The Telegraph, a famous daily newspaper in the UK, was hacked into by a Romanian hacking group last week. The group exposed a weakness in the way the website queried its database for property searches and was able to obtain around 700,000 subscriber email addresses and passwords in plaintext via a SQL injection attack. The Telegraph took down the site and is in the process of rewriting the code to fix the problem, and is telling subscribers to change their passwords for that site and other sites.
It is unknown exactly what exact SQL injection string was used to gain access to the database of user emails and passwords, but SQL injection attacks are not terribly difficult attacks to defend against. Considering the email addresses and passwords were stored in plaintext, and considering the wide range of methods to protect code from SQL injection, it is likely this attack was only possible because the coders of the website were careless and did not think much about security risks when designing the website.
(Read on …)
Original article: http://arstechnica.com/security/news/2009/02/airforce-engineers-develop-bittorrent-sniffer.ars
The Air Force Institute of Technology has a new method for passive BitTorrent tracking. The system attempts to read the header of BitTorrent packets, and compare the hash in the packet to a known set of bad hashes. If a bad hash is matched, then the system logs it for future investigation. The system uses programmable FPGAs, and sniffing capacity tops out at 100Mbps.
Recent developments in traffic shaping / packet analysis have been largely spurred by large ISPs’ desire to limit user’s consumption of high-bandwidth services such as BitTorrent. Complaints towards users of BitTorrent include high bandwidth usage, as well as accusations of illegally sharing copyrighted material.
However, packet inspection at any level raises a number of privacy concerns, as systems at the ISP level would definitively be reading the data that flows through their network from an end user’s machine. This can either be malicious or not — it really depends on how ISPs use it. It seems like ISPs are highly motivated to keep traffic down so that they can keep their networks from becoming congested. However, no ISP customer can ever exceed the maximum amount of bandwidth that they are advertised to get. It seems like the ISPs are not being forthcoming about the real amount of bandwidth that they want customers to use.
Bandwidth isn’t the only issue, with litigation being handed out to file sharers. It’s in the ISP’s best interest to stay out of any legal issues they can, which also provides a good motivator for packet shaping BitTorrent traffic. However, given millions of motivated BitTorrent users versus companies with relatively limited resources, they are fighting an uphill battle that will not end up in their favor. This Air Force sniffing technology can’t detect encrypted BitTorrent packets, which compromise 25% of the BT traffic out there. As well, with projects such as OneSwarm, people can set up much more anonymous sharing networks between friends. The only way for corporations to survive file sharing is to adapt, like the Norwegian state broadcasting company did when it started offering its broadcasts as full, unencrypted downloads on its own hosted BitTorrent tracker.
Photo programs that could organize, recognize, and cluster people’s photos are neat because it allows the user to search for pictures. The face recognition technology has also been used to identify people. The way the system works is that the computer will find the faces on the pictures, then search for objects in the pictures that look like eyes, a nose, etc. Apple and Google also developed their own photo programs that are nifty; the programs are capable of matching different pictures and find ones with the same person in it.
According to the Technology Review article, these programs does its job pretty well; for example, the Apple program can learn as the user tells it which matching are right and which are wrong. Scarily, Google’s program, Picasa, which has pictures stored on Google database, will cluster the pictures according to the faces, let the users tag those clusters with names and allow them to further match it to the corresponding people’s email addresses. It is a little bit unsettling that “before [we] know it, Google is asking [us] to identify all those other faces in [the] photographs” fulfilling its corporate mission “to organize the world’s information and make it universally accessible and useful” while that is not what we want from a photo-sharing website.
The photo recognition system starts to be used after the September 11 attack. Obviously this is done to help screen out terrorists at security checkpoints, such as airports and federal facilities. This can be helpful for the airport security officers to concentrate more on other details of the passengers, rather than on their face. The question now is whether this system has high enough accuracy to identify people by their face, regardless of their other facial features, such as beards or wigs.
One obvious concern with widely available face recognition is privacy. Due to real-name tagging and the fact that email addresses are unique, Google’s Picasa is able to create a global database linking people’s email addresses, names and photos recognized as a particular person together. This is not a new privacy issues; having facial recognition tools adds to the information that is exposed on the web.
One simple way to minimize the exposure or potential violation of your own privacy is to not use these tools. Although, unfortunately, like all new tools which exposes more information about us on the web, there will be hype regarding privacy management. This should be no different.
Source: http://www.technologyreview.com/computing/22234/page1/
Xia Cam and Devy Pranowo