ManyMedia

Holding a position as an incumbent or primary telecom carrier bestows certain monopoly-ish benefits including limited (or no) competition in connection choices to homes and certain businesses. A person representing a home or business needs a phone or cable connection in order to obtain a connection to the Internet.

This privileged position implies a certain duty of care for their customers by the carriers. That duty, however, is sometimes misplaced. For example, storing customer passwords in the clear, as text that anyone could read, is not a “best practice” in security circles. It came as a shock that TrendMicro wrote of about this practice by noted telecom company Orange (Telecom) in France:

The showstopper however is the vulnerability on the orange.fr website which was posted today. According to 2fingers over at HackersBlog a SQL injection vulnerability was discovered by fellow hacker Unu, that exposes not only the account details of almost a quarter of a million customers, but also their passwords in clear text…

Why is this important? The article continues:

Recently published research showed that 61% of people use the same password for multiple sites, so this kind of compromise represents real risk for many people.

HackersBlog state that they have alerted the folks over at orange.fr but have not yet received a response.

If Orange was truly storing passwords in a clear text file, the rest of their security practices should rightly be questioned. This practice applies to all providers: take care, use best practices to protect your customers.

This post should also serve as a reminder to everyone that’s a customer of an Internet Service Provider: periodically change and protect your passwords.

Identity, Network, Policy, Scenarios best practices, password, plain text, security, telecom

From New Scientist: Copper coated, frequency-tuned, AND lets GSM and 3G cell phone signals through…

A type of wallpaper that prevents Wi-Fi signals escaping from a building without blocking mobile phone signals has been developed by a British defence contractor. The technology is designed to stop outsiders gaining access to a secure network by using Wi-Fi networks casually set up by workers at the office.

Did I mention that you can turn the wallpaper on and off? How fashionable.

Devices, Network filter, security, SOHO nets, wi-fi

The companies bearing the cost of insecure technologies are finally stepping up to the table… the Business Roundtable.

The complaints by the Business Roundtable, a trade group for executives of 150 of America’s largest corporations, reflect exasperation by companies over the expense and hassle of keeping their computer networks safe for consumers. The group cites estimates from the nation’s banks and savings institutions that attacks by viruses and worms cost that industry more than $1 billion a year.

In its campaign starting Wednesday, the Business Roundtable urges technology companies to improve software design, make software products easier to manage and continue to offer support for products after updated versions are on the market. The group also acknowledges that executives and corporate directors should be involved in making companies’ networks more secure.

‘Up until now, the IT suppliers have deflected criticism and redirected criticism to end users,’ said Marian Hopkins, director of the group’s security task force. ‘It’s time that IT suppliers and manufacturers stepped up to the plate.’

A former White House official responsible for cybersecurity, Paul Kurtz, noted the significance of the Business Roundtable, whose members include traditional manufacturers, pressing for better security. Most previous such proposals have involved leading technology firms; the Roundtable’s members include Coca-Cola, Alcoa, Boeing, Burlington Northern, Deere and General Motors.

‘These are Rust Belt companies. Now you have traditional industry saying this is important,’ said Kurtz, now head of the Washington-based Cyber Security Industry Alliance. He said Internet security ‘requires good products from suppliers and good maintenance on the part of the users.’

Content, Network banks, cybersecurity, security, software, task force, virus, worm

Secure phones: now available, a bit pricey.

Berlin-based Cryptophone, a unit of privately held GSMK, developed the phone by inserting an encryption software inside a standard handheld computer phone. This ensures that calls can only be decoded by a similar handset or a computer running the software.

But the phone is seen as a mixed blessing in some European countries. While the benefits for business managers exchanging sensitive information are obvious, such a device could potentially have the side effect of helping criminals.

Security specialists in the Netherlands said the device could threaten criminal investigation by the Dutch police, which is one of the world’s most active phone tappers, listening in to 12,000 phone numbers every year.

But privacy lobbyists say the new handset is a “freedomphone” much more than a “terrorphone.”
“It’s a tremendous step forward, because the level of surveillance by authorities is breathtaking,” said Simon Davies, director of Privacy International in Britain.

Devices cell phone, crypto, encryption, mobileTech, privacy, security, self-determination

Ah, unintended consequences. Just as the long arm of the law helped support prohibition some years ago, a new form of speakeasy is now cropping up to assist information and file sharers, who are widely seen as being under attack.

Internet file-sharers are operating much like any society that falls under attack. And the very technologies they are using as shields have long been employed by legitimate businesses to protect their data from prying eyes and hackers.

‘The software that users are moving toward, it has characteristics that businesses need — which is a high degree of privacy, a high degree of security and the ability to handle large files,’ said Clay Shirky, a professor of interactive telecommunications at New York University.

Three years after the Recording Industry Association of America’s lawyers succeeded in shutting down the Napster file-trading service, the music industry’s jihad against unauthorized digital music distribution is reaping an unintended consequence: better, easier-to-use software for exchanging data securely — and even anonymously — on the Internet.

‘Thanks to the RIAA, ease of use surrounding encryption technologies, which was never a big deal before, is a big deal now,’ Shirky said.

Content anonymous, encryption, file sharing, knowledge management, P2P, privacy, RIAA, security

Impacts of DRMs on innovation, competition, & security

• Hal Varian, SIMS, UC Berkeley (moderator)
• David Farber, Computer Science, University of Pennsylvania
• John Manferdelli, Microsoft Corp.
• Lucky Green, cypherpunks.to
• Alex Alben, RealNetworks, Inc.

John: Not one-size fits all. Rights live in the file: persistent protection, share assets in different settings. DRM, Enterprise Rights Management, Personal rights mgmt, Privacy rights mgmt. Different use and attack models. Enterprise doesn’t have mass market concerns. All have in common: not to restrict what people can use computers for: can’t impose policy (DRM changes w/ time and application), opt-in & user control, widespread permissions w/ negotiated equilibrium (including privacy models)). Misconceptions: don’t censor or disable w/out permission, don’t lock out vendors or formats, user control, noone owns machine key, won’t be perfect. Interoperable. Enemy of good security is demand. Tech providers don’t know policy directions.

Lucky Green: Trusted computing & using DRM to stifle competition. Why should you trust entitles that may not trust you? Fall 2000 received invite to Trusted COmputing Platform. offering Secure Boot (to know what OS, under OS, compromising hardware? not building DRM system. Our OS platform doesn’t have all that our customer demands (streaming media), must have DRM to deploy. Hardware and software-based, conspiring to keep customers in the dark. Assuring that your computer will disobey your wishes and obey whatever DRM system it’s instructed or enabled to. Keeps people from competing with each other. Plugging “analog” hole: feeding speaker back into computer, one of several trends; prevents use of unlicensed software, PC as core of home entertainment, new market opportunities in gov sector also among trends. Upcoming hard/software DRM in office productivity: “We came at this thinking about music, but then we realized that email and docs were far more interesting domains.” (Bill Gates) “You could create Word docs that could be read only in the next week.” (Steven Levy, MSNBC) How does the law help TC stifle competition? automated agreement in restraint of trade? Vendors say it’s an illegal circumvention device. (Question: What would fed prosecutor call…) Consequences of uniquitous, Don’t create interoperable software or spend time in prison. DRM is voluntary-? on by default (Palladium), use of gas in a car is similarly optional.

Dave Farber: marvellous religions war, no articulation about real capabilities and limitations. Stop having religious discussions. DRM is not new, generally thought of as software, easy to break. Some now have hardware, multix had protection of documents. Discussions, SecureBoot not in new stuff. ARPAnet was not designed to survive a nuclear attack. FCC: get out of spectrum and other regulatory roles where it’s messed things up. Security (lack of perfect) at acceptible levels is important for individuals, corporations, nations. Relevantly secure system difficult to keep DRM out, esp if you don’t have boot privileges (in computer environment). Essentially saying you can’t build or market if not perfect, bad trade off. Interested in preventing access to his personal info, should have worn his TIA t-shirt. DRM has important role in protecting his info. Mechanismis to enable him, will eventually have to be decided by legislature, courts, marketplace. “Disney problem” (not speaking for FCC): terrible tendency to listen to people w/ inferior solutions (how good? pretty good.) Causes a conflict to engage FBI to track, unwillingness of media companies to pay for protection (distressing). Is far from convinced about fair use that can’t have a reasonable, rational balance that gives different forms of fair use and still have rights management systems. Not encouraging DRM, but can happen. Need research, articulation as to what can be found.

Hal Varian: What are the available biz models: Advertise yourself, advertise other stuff, bundle, subscription/versioning/non-linear pricing, low prices and high quality for authentic version, micropayment, DRM. Choosing rights: seller should choose bundle of rights to max value or product, more rights implies more value but perhaps fewer sales, tradeoff (video rentals, DVD sales, library and book purchases, etc). (new techno-threat evolves into mass market.) Home copying: maximizing value models for different places or settings vs. one copyable price (may lose value to sharing, small value); change numbers and variables w/in model for different results. Crippleware not the best answer: reduces value. Competition can compete away copy protection (early Lotus 123). Innovation: 3 types of protection: non-refillable ink carts, cell phones w/ certain batteries, CDs don’t allow ripping. 3 types of innovation: printing integrated circuits, generator in a shoe, Elvis remix at world cup,”too much conversation” in Nike ad. Customers may want to use products in innovative ways. (See VonHipple paper at MIT)

Question: double edge sword technology, but also double-ended; doesn’t want to be at mercy while gov holds one end and he’s responsbile for other end. Farber: you can always buy a mac.

Alex Alben, Real Networks: Property class: bundle of sticks (rights), can be parsed by time, number of plays, ID of user, location, type of device… expectations may not apply. Does enhancing value of rights necessarily diminish personal use rights? “We need to maintain both personal use and copy protection in order to create a marketplace that works. CD’s life: assume 10 years, 7.5 cents per month (didn’t follow his math.) Roles and responsibilities of key actors; content owners: release product & create licensing, consumers: use products consistent w/ personal use. Tech companies: enable new business models, make DRM transparent. Gov: don’t regulate, don’t madate, don’t choose winners. Thinkers: create intellectual framework for new paradigms of digital distribution. Giving CDs away is not legal personal use, must disabuse consumers. Challenges: crafting a fair use exemption, limiting application of DMCA to protect media, not garage door owners or print cartridges (injunction issued in Lexmark case). Travesty! Broadcast flag: RN supports, News & local should not be marked, fair use w/in broadly defined “home net” must be allowed, no limits on physical copies, gov regulation aka Hollings approach is not good idea (“thin edge of wedge”) Reasonable rules required, as industry. DRM is here, abstract concept, can be used for good or ill, need to craft best balance.

Questions from panelists to each other JM: technology should be out of the way. Lucky: most rational consumers believe that uses DMCA has been put were not in scope at time legislation was passed. however as DRM is being pushed will agree, cell batteries programmed to charge less each time, proprietary batteries (Alex: recharge your shoes), courts believe that DRM is legitimate: unless law is changed, careful what you ask for. Farber: need language for policy to accept or reject. Get rid of consumer (the term). Shoes will be confiscated at airport.

Questions from audience: Engineer: values assumed in panel have vastly inflated values, budget for billing and DRM doesn’t exist. RN: forward-investing, subscription in 30-day increments. Dierdre M: concern for locking down characteristics, rights expression language and vertical integreation, how will consumers have a voice? no competition really. Alex: standards bodies, costs to join, not open to press but should be (CPTWG). Don’t want to put this in hands of politicians. Companies’ solutions and standards not always appropriate. Hal: competition is for attention. People will look elsewhere, threat to incumbents. Hal Abelson, MIT to John: will XrML be available on royalty-free basis (MS doen’t own it), reasonable and non-discriminatory terms? MS is backing a standard that is not necessarily royalty free. Pam Samuelson: patents on DRM technologies (intertrust, content guard), competition and innovation (Intertrust bought by Sony/Phillips), as to open source developers or smaller players? Dave F: interesting battles, big problems, lots of patents aren’t worth paper they’re written on. More than two with patents, old tech as prior art. John M: intertrust/MS being sued, can’t talk about that, Doesn’t think Content guard is in suit, publishers will decide but it’s gotta settle down first. MS is minority share in Content guard. Don’t know what else to say, will muddle through. Lucky G: patents intended to prevent competitors competing. Underlying tech, open source generally works on open licensing models, not compatible. Patent comes to mind: Palladium (now called something else), MS has stated developers could use but no public stmt as to open licensing to open source model. John M: technology is not based solely on that patent, MS has not announced any licensing offers. From floor: questions related to trusted computing, wrapping data objects, unavailable to competitors, increase security level but tension between policies and strength… what’s going on? Lucky: mumbled. from floor: why didn’t Lucky ask why no interop w/ RN servers? Alex: investments in server, ads, controls, siphoning off by others. from floor: HDTV & RN? concern for legacy devices, broadcast digital signal, narrow concerns, failure by FCC, intervention/disruption by Internet, Tauzin’s concern for broadcast flag, but no longer in time w/ consumer demands. Farber: more complicated than that. What they wanted was digital TV, broadcast industry would use it for something else.

Content, Events, Policy DRM, patents, privacy, regulations, rights management, security, trust

…you unleash the fastest virus known so far onto a global network with a lot of Microsoft SQL servers? A big mess. Happened to Microsoft too–seems not all of their servers were updated properly either. Kinda hard to keep up, eh Bill? Ah, the cost of controlling the network: you take the swords and arrows piercing your promises. CERT has a tech advisory, in case you still need info.

Of course, not everyone thinks CERT’s disclosure policies are a good idea:

In the e-mail, noted security researcher Mark Litchfield wrote that his company would no longer submit information on security flaws to the CERT center. Such a submission, he wrote, is “an act of good faith” intended to give information technology administrators the information they need to patch their systems. But Litchfield said he felt “a betrayal of trust” because CERT had “leaked (the information) to certain organizations and government departments” before passing it on to IT workers.

Ah, Homeland Security. Batten down the hatches! Engage in secrets, mistrust, covert betrayals, and misinformation so our government can save the world, one “network” at a time!

Do I digress? No. Single point of control = single point of failure. In times of network problems, diversity of networking technologies helps us weather the storms. While the government isn’t pushing Microsoft per se, the FCC does seem to be pushing for monopoly control, which enables single point of control (and, perhaps not coincidentally, programs like the TIA database).

Network CERT, FCC, Microsoft, security, virus

Many of us know that Korea (.kr) is the source of a large proportion of spam. It was with some amusement, this morning, that I noticed a lesser number of unwanted emails in my inbox, followed by stories of the SQL worm that affected Microsoft servers worldwide:

• First article pointed out by Adam Peake of Glocom in Japan, Korea’s MIC Issues Emergency Alert Against Computer Hacking:
  

  The Ministry of Information and Communication (MIC) issued emergency alerts Friday warning domestic personal computer (PC) users to be on guard against being used for distributed denial-of-service (DDoS) assaults. The ministry said it was raising the alarm after it received reports international hackers were using Korea as a springboard to launch their electronic attacks on other computers.

  It said that starting from Jan. 5, the Korea Information Security Agency (KISA) has been receiving a large number of reports from U.S. and Australian media companies that their systems were being disrupted by Korean PC infiltrated by DDoS software.

• AP News also ran a story, Virus Overwhelms Global Internet Systems:
  

  Bank of America Corp., one of the nation’s largest banks, said many customers could not withdraw money from its 13,000 ATM machines because of technical problems caused by the attack. A spokeswoman, Lisa Gagnon, said the bank restored service to nearly all ATMs by late Saturday afternoon and that customers’ money and personal information had not been at risk.

  Millions of Internet users in South Korea were stranded when computers at Korea Telecom Freetel and SK Telecom failed. Service was restored but remained slow, officials said. In Japan, NHK television reported heavy data traffic swamped some of the country’s Internet connections, and Finnish phone company TeliaSonera reported some problems. …

  The virus-like attack, which began about 12:30 a.m. EST, sought out vulnerable computers on the Internet to infect using a known flaw in popular database software from Microsoft Corp. called “SQL Server 2000.” The attacking software was scanning for victim computers so randomly and so aggressively, sending out thousands of probes a second, that it saturated many Internet data pipelines.

More info on the problem is available, both at Microsoft (http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-039.asp) and at CERT (http://www.cert.org/advisories/CA-2003-04.html). I’d think that any sys admin who chose to run MS servers would be aware of the special, well-documented, and ongoing need for extra care in monitoring the need for and applying patches, but apparently this isn’t so. As Walt Kelly said some 30 years ago, “We have met the enemy… and he is us”

There’s a thread following this on Dave Farber’s Interesting People archive. Of special note are comments by Karl Auerbach (regarding vulnerability of cross-linking communications systems) and Rich Wiggins (Microsoft isn’t mirrored? How shortsighted!).

Content, Network CERT, ddos, KISA, Korea, Microsoft, security, servers, spam, virus