Wikileaks are for-hire mercenaries - Cryptome

Tuesday, December 7, 2010

Wikileaks has always been a commercial enterprise hiding behind a narcissistic "public interest" PR, says Cryptome operator John Young in a scathing critique of the site.

Whistleblower site Cryptome began publishing documents in 1996, incurring the wrath of UK and US governments. The archive endures. Young was invited to be the "public face" of Wikileaks at the formation of the venture, but declined. Now Young believes Wikileaks is selling its secrets for commercial gain. Speaking to US talk radio, Young compared Julian Assange to Henry Kissinger, and other "spook insiders" who have turned their insider knowledge into a lucrative sideline.

"What has been released has been much less voluminous than the attention about them," said Young. "The goal is to exaggerate the importance of Wikileaks".

From the earliest discussions, Young alleges, Wikileaks intended to pimp out the information for funds.

"Well, it only came up in the topic of raising $5 million the first year. That was the first red flag that I heard about. I thought that they were actually a public interest group up until then, but as soon as I heard that, I know that they were a criminal organisation.

"Assange is a narcissistic individual," claims Young. "Wikileaks is willing to sacrifice Bradley Manning and anyone else to advance their own interests."

In a posting to the nettime mailing list, Young added:

"The free stuff is meant [to] lure volunteers and promote high-profile public service, lipsticked with risk, with the enterprise funded by selling costly material sold on the black market of worldwide spying in the tradition of public benefit ops, ID, spies and ever more spies. No better customers for illicit information that [sic] those with depthless pockets.

"Soros and the Kochs have their lesser-known Internet promoters backing Wikileaks generously. And they expect good return on their investment, not just the freebies used to attract attention."

Writing last month, Young shared his disgust at Wikileaks' similar tactics to advertising-supported or state-supported media - which Young claims cannot be trusted by definition.

"Wikileaks lies as much as the media, indeed, exactly in the advertising format of the media. Its consumers like it for that very reason. It rides the wave of imaginary disgust with MSM and governments, but it has not modified the formula of braggardy and drama essential to capture eyeballs and through eyeballs, minds and hearts."

But Young includes all advertiser-supported media in the camp of the discredited ... and himself.

"Think Archive.org, think Wikipedia, think Google, think this list and your crafty mangy boil-ridden carcass. Mea culpa," he adds.

Financial vice tightens on Wikileaks, hacktivistas retaliate

The financial squeeze has been put onto Wikileaks, with MasterCard refusing to process donations to the whistleblower site and the suspension of the personal bank account of founder Julian Assange in Switzerland.

The withdrawal of payment facilities by MasterCard follows a similar decision by PayPal. Would-be supporters are only currently able to donate funds via Visa to a website hosted in Iceland.

Also, the Swiss post office's bank PostFinance has frozen a bank account run by Assange. The account held 31,000 euros of funds made up of a mixture of Assange's personal assets and donations to a legal defence fund, the BBC reports.

PostFinance said the account was suspended because Assange provided false residency details when he opened the account.

The move put the Swiss bank in the firing line of hacktivists from the loosely-banded Anonymous collective, who have launched a denial of service attack against postfinance.ch as part of a wider pro-Wikileaks and anti-censorship campaign that launched with an attack on a PayPal blog over the weekend.

Both attacks were prompted by the respective organisations' decisions to freeze accounts used by Wikileaks or Assange.

Wikileaks' decision to start publishing leaked US diplomatic cables late last month has created far more heat than its previous decisions to publish logs from the conflicts in Afghanistan and Iraq. It's tempting to speculate that US authorities are applying pressure on various banks and financial service firms in order to choke off sources of funding to the site.

Julian Assange was arrested by UK police on Tuesday, and is due to be questioned over allegations of rape made by Swedish authorities that he strongly denies. Assange, the subject of a European arrest warrant, surrendered himself into custody after making an appointment to turn himself into cops at a London police station.

Facebook revamp gives away even more info, warn pros

Security watchers have warned that Facebook's latest revamp will create the tendency to expose more user information.

The redesigned profile, launched earlier this week and due to be rolled out gradually over coming weeks, is designed to encourage punters to expose even more information about their day to day lives to the dominant social networking site, net security firm Sophos cautions.

For example, the About Profile page encourages users to share experiences, discover common interests, and to highlight meaningful relationships. The move will have the effect of highlighting the closest relationships and keenest interest a user might have. Previously this information would have probably been on a list, but not highlighted as especially important.

Sophos urges Facebook users to consider how much information they ought to share using the new service, warning that it may not just be their closest friends and contacts who get access to the sensitive information.

Adding features to facilitate sharing updates, interests and photos may be appealing to some Facebook users. However, people need to be wary about how much personal information theyre willing to give away online, said Carole Theriault, senior security consultant at Sophos.

Many Facebook users are online friends with complete strangers and so wed advise Facebook users to consider their privacy settings, make sure theyre only sharing information with people that they know and trust and to think carefully about how much personal information they want to make public.

The redesigned profile is one of a multitude of privacy and content-control issues that have arisen over Facebook, especially over recent months. Users have progressively been encouraged to share photos and comments among wider and wider groups (from friends only to only friend-of-friens, to anyone on Facebook, etc) by default via a series of changes, most notoriously a revamp of Facebook's privacy policy late last year. More recently a decision by the NHS to integrate its NHS Choices health information site into the Facebook Connect platform provoked a warning from online privacy firm Garlik that this would allow the tracking of users on the site.

Although it has never admitted as much, more detailed user information in profiles make Facebook a more attractive platform for advertisers; hence Facebook's direction of travel is always towards encouraging users to share more with a wider pool of people.

ASSANGE ARRESTED in London - in court later today

Wikileaks spokesman Julian Assange has been arrested by police in London and will appear in court later today.

A spokesman for Scotland Yard said: "Assange was arrested by appointment at a central London police station at 9.30 this morning.

"He will appear at City of Westminster magistrates later today."

Thirty-nine-year old Assange was arrested by the Met's Extradition Unit on behalf of Swedish authorities. He was arrested on a European arrest warrant issued by Sweden.

The Metropolitan Police said: "He is accused by the Swedish authorities of one count of unlawful coercion, two counts of sexual molestation and one count of rape, all alleged to have been committed in August 2010."

Assange arrested in London - to appear in court later today

Wikileaks spokesman Julian Assange has been arrested by police in London and will appear in court later today.

A spokesman for Scotland Yard said: "Assange was arrested by appointment at a central London police station at 9.30 this morning.

"He will appear at City of Westminster magistrates later today."

Thirty-nine-year old Assange was arrested by the Met's Extradition Unit on behalf of Swedish authorities. He was arrested on a European arrest warrant issued by Sweden.

The Metropolitan Police said: "He is accused by the Swedish authorities of one count of unlawful coercion, two counts of sexual molestation and one count of rape, all alleged to have been committed in August 2010."

Wernhart Guestbook Multiple SQL Injection Vulnerabilities

Wernhart Guestbook is a web-based application. Wernhart Guestbook is exposed to multiple SQL injection issues because it fails to sufficiently sanitize user-supplied data passed to the "LastName" parameter of the "insert.phtml" script and certain unspecified parameters to the "insert.phtml" and "select.phtml" scripts. Wernhart Guestbook version 2001.03.28 is affected.

Ref: http://www.securityfocus.com/bid/45084

10.49.32 - CVE: Not Available
Platform: Web Application - SQL Injection

MicroNetSoft RV Dealer Websites Multiple SQL Injection Vulnerabilities

MicroNetSoft RV Dealer Websites is an RV dealership website implemented in ASP. MicroNetSoft RV Dealer Websites is exposed to multiple SQL injection issues because it fails to sufficiently sanitize user-supplied data.

Ref: http://www.securityfocus.com/bid/45089

10.49.36 - CVE: Not Available
Platform: Web Application - SQL Injection

UK cops have warrant to cuff Assange, talking to his lawyer

Julian Assange's lawyer said he is talking to the Metropolitan Police this morning, after which he and his client will decide what to do next.

A European arrest warrant has been issued for Assange. Scotland Yard said this morning it would not be commenting until an arrest was made. This might be a job for them, or for another local force, depending where Assange is. Some reports suggest he could be arrested within hours.

His lawyer, Mark Stephens, told CNN he expected talks to end by mid-morning, after which they'd decide what to do.

Assange has reportedly kept British police aware of his whereabouts. He vehemently denies the allegations of sexual molestation. He has said he fears being extradited to the US - although US authorities have yet to charge him with any offence.

Assange holds Australian citizenship. Australian PM Julie Gillard also weighed in yesterday. Gillard said of Wikileaks: "The foundation stone of it is an illegal act," according to the Herald Sun.

Pressed by the opposition, she was unable to pinpoint which specific law Assange had broken.

Hacker brings enhanced security to jailbroken iPhones

A computer consultant is embarking where Apple has refused to go, adding a security measure known as ASLR to iPhones to make them more resistant to malware attacks.

Short for address space layout randomization, ASLR has been noticeably absent from all iOS devices since their inception, making possible the types of attacks that commandeered a fully patched iPhone at this year's Pwn2Own hacker contest. By randomizing the memory locations where injected code is executed, ASLR aims to thwart such exploits by making it impossible to know ahead of time where malicious payloads are located.

Starting with Windows Vista, Microsoft has baked ASLR into its operating system, and the recently released mobile version of Windows 7 is also endowed with the protection, said Charlie Miller, a principal security analyst at Independent Security Evaluators, who cited private conversations with Microsoft engineers. By comparison, Apple has built only limited ASLR into Mac OS X and has left it out of iOS altogether.

At a conference scheduled for next week, Stefan Esser, a security consultant and application developer for Germany-based SektionEins, plans to unveil a process for jailbreaking iDevices that automatically fortifies them with ASLR. It works by reordering the contents of dyld_shared_cache, a massive file that houses the libraries.

The hack will come as good news to those who want to jailbreak their iDevices but don't want to make them unnecessarily more vulnerable. As things stand now, jailbreaking iPhones, iPod Touches and iPads diminishes another security protection known as DEP, or data execution protection, and another measure known as application sandboxing. It also introduces a command shell and other features that can enable attackers.

When you jailbreak it, it breaks a lot of security of a normal iPhone, Miller told The Reg. With Stefan's stuff, now maybe it's an option, if you're a security-conscious person, to still jailbreak your phone because you can pick up ASLR, which is going to make it a lot harder to do exploits.

Esser will present his method at the Power of Community security conference on December 17 in Seoul, South Korea. He said he also plans to release a tool titled antid0te, that simplifies the process.

This enables users with jailbroken iPhones to create their own set of dyld_shared_cache files that have completely different library load addresses from every other iPhone in the world, Esser wrote in an email. This is already a better ASLR than what exists on Snow Leopard because different applications can use different shared caches and therefore different load addresses.

The method also randomizes the base address of the dynamic linker and the main thread's stack, which also bests ASLR protections of OS X, he said.

First hour of a phishing campaign the most effective

Taking down sites after five hours pointless.

Half of the victims of phishing attacks respond within an hour of receipt of the scam message.

Calling this the ‘golden hour' of a phishing site's existence, Trusteer CTO Amit Klein noted that a typical phishing campaign takes at least one hour to be identified by IT security vendors. Within five hours, more than 80 per cent of the total pool of potential victims have responded, a figure that rises to 90 per cent after the first ten hours of a phishing attack.

He claimed that analysis of these figures shows that blocking a phishing site after five to ten hours is almost pointless. “A more effective model would prevent users from being directed to a phishing site or prevent them from entering their credentials if they do end up on a criminal site,” he said.

“As an industry, our goal should be to reduce the time it takes for institutions to detect they are being targeted by a phishing attack from hours to within minutes of the first customer attempting to access a rogue phishing page. We also need to establish really quick feeds into browsers and other security tools, so that phishing filters can be updated much more quickly than they are today. This is the only way to swiftly takedown phishing websites, protect customers and eliminate the golden hour.”

Talking to SC Magazine, Paul Wood, senior analyst at Symantec Hosted Services, said that phishing sites vary in how long they are online for, but like spam websites it is not long before they are taken offline, although spam sites do tend to last longer.

Talking about the capability of phishing websites being taken down quicker, Wood said that often a problem is that the site is hosted in another country.

See original article on scmagazineus.com

Secure Computing Magazine


Why WikiLeaks Is Good for America

A truly free press — one unfettered by concerns of nationalism — is apparently a terrifying problem for elected governments and tyrannies alike.

It shouldn’t be.

In the past week, after publishing secret U.S. diplomatic cables, whistleblower site WikiLeaks has been hit with denial-of-service attacks on its servers by unknown parties; its backup hosting provider, Amazon, booted it off its hosting service; while PayPal hassuspended its donation-collecting account, damaging its ability to raise funds. On Monday, MasterCard announced it was blocking credit card payments to WikiLeaks, saying the site was engaged in illegal activities, despite the fact it has never been charged with a crime.

Meanwhile, politicians in the U.S. have ramped up the rhetoric against the non-profit, calling for the arrest and prosecution and even assassination of its most visible spokesman, Julian Assange. Questions about whether current laws are adequate to prosecute him have prompted lawmakers to propose amending theespionagestatute to bring Assange to heel or even to declare WikiLeaks a terrorist organization.

WikiLeaks is not perfect, and we have highlighted many of its shortcomings on this web site. Nevertheless, it’s time to make a clear statement about the value of the site and take sides: WikiLeaks stands to improve our democracy, not weaken it. The greatest threat we face right now from Wikileaks is not the information it has spilled and may spill in the future, but the reactionary response to it that’s building in the U.S. that promises to repudiate the rule of law and our free speech traditions, if left unchecked.

Secrecy is routinely posited as a critical component for effective governance, a premise that’s so widely accepted that even some journalists, whose job is to reveal the secret workings of governments, have declared WikiLeaks’ efforts to be out of bounds.

Transparency, and its value, looks very different inside the corridors of power than outside. On the campaign trail, Barack Obama vowed to roll back the secrecy apparatus that had been dramatically expanded under his predecessor, but his administration has largely abandoned those promises and doubled-down on secrecy instead.

One of the core complaints against WikiLeaks is a lack of accountability. It has set up shop in multiple countries with liberal press protections in an apparent bid to stand above the law. It owes allegiance to no one government, and its interests do not align neatly with authorities’. Compare this, for example, to what happened when the U.S. government pressured The New York Times in 2004 to drop its story about warrantless wiretapping on grounds that it would harm national security. The paper withheld the story for a year and a half.

WikiLeaks’ role is not the same as the press’s, since it does not always endeavor to vet information prior to publication. But it operates within what one might call the media ecosystem, feeding publications with original documents that are not found nowhere else and insulating them against pressures from governments seeking to suppress information.

Instead of encouraging online service providers to blacklist sites and writing new espionage laws that would further criminalize the publication of government secrets, we should regard WikiLeaks as subject to the same first amendment rights that protect The New York Times. And as a society, we should embrace the site as an expression of the fundamental freedom that is at the core of our Bill of Rights, not react like Chinese corporations that are happy to censor information on behalf of their government to curry favor.

WikiLeaks does not bring radical transparency in its wake automatically. Sites like WikiLeaks work because sources, more often than not pricked by conscience, come forward with information in the public interest. WikiLeaks is a distributor of this information, if an extraordinarily prolific one, and helps guarantee it won’t be hidden by editors and publishers who are afraid of lawsuits or the government.

WikiLeaks has beaten back the attacks against it with the help of hundreds of mirror sites that will keep its content available, despite the best efforts of opponents. Blocking WikiLeaks, even if it were possible, could never be effective.

A government’s best and only defense against damaging spills is to act justly and fairly. By seeking to quell WikiLeaks, its U.S. political opponents are only priming the pump for more embarrassing revelations down the road.

Evan Hansen is Editor-in-Chief of Wired.com.


Pirate Party launches Australian Wikileaks mirrors

Joins 355 sites in international initiative.

Pirate Party Australia has joined an international mirroring initiative aimed at making it "impossible" to fully remove Wikileaks from the internet.

The political party today launched two sites, wikileaks.savetheinter.net and cablegate.savetheinter.net, joining 335 other "censorship resistant mirrors".

Both sites were hosted by DCP Networks in Sweden. A party spokesman said it planned to move the sites to an Australian data centre "as soon as feasible".

During the past week, Wikileaks and its Australian founder Julian Assange have come under fire for releasing classified US diplomatic cables to the public.

The site was booted from Amazon's cloud infrastructure last week, as it battled sustained denial of service attacks that exceeded 10 gigabits of traffic per second.

Attorney-General Robert McClelland said the release may have breached "a number of criminal laws", hinting that Australia would cooperate with the US to extradite Assange should he set foot in his home country.

Australian Greens Leader Bob Brown today urged the Government to make clear that Australian authorities would protect Assange's rights, and assure him that his citizenship is safe.

"Mr Assange has come across a great ream of documents which throw some light on US foreign policy. It is important that we know what drives governments to make decisions," Brown stated.

Pirate Party Australia spokesman Brendan Molloy said that it would maintain the mirrors "ad infinitum", noting that cost was the party's only constraint.

A local host would "prove that we can host such documents in Australia without any legal difficulty," he said.

Copyright © iTnews.com.au . All rights reserved.


WikiLeaked Cable Says 2009 Brazilian Blackout Wasnt Hackers, Either

SAO PAULO — Despite widespread speculation at the time, a massive power outage that left 18 out of the 26 Brazilian states in the dark for up to six hours last year was not the result of a cyberattack, according to a classified diplomatic cable published by WikiLeaks last week.

The Nov. 10, 2009, blackout came just two days after the CBS News magazine 60 Minutes reported that an earlier outage in the Brazilian state of Espirito Santo in 2007 was the work of hackers. And it came just one day after Threat Level reported that, no, it wasn’t.

The suspicious timing of the outage triggered widespread speculation that hackers — even if they weren’t responsible for the 2007 blackout — may have caused the newer one. With Rio set to host the 2016 summer Olympics, the incident prompted U.S. diplomats to meet with top officials at ONS, Brazil’s power authority, to find out what had happened.

The leaked cable, dated Dec. 1, 2009 and classified Secret, describes the strikingly open conversations that followed.

[ONS president Plinio de] Oliveira and [ONS statistical director Wilkens] Geraldes further ruled out the possibility of hackers because, following some acknowledged interferences in past years, GOB has closed the system to only a small group of authorized operators, separated the transmission control system from other systems, and installed filters. [Energy ministry chief of staff Jos] Coimbra confirmed that the ONS system is a CLAN network using its own wires carried above the electricity wires. Oliveira pointed out that even if someone had managed to gain access to the system, a voice command is required to disrupt transmission.

Coimbra said that while sabotage could have caused the outages, this type of disruption would have been deadly, and investigators would have found physical evidence, including the body of the perpetrator. He also noted that any internal attempts by system employees to disrupt the system would have been easily traceable, a fact known to anyone with access to the system.

The blackout was caused by short circuits on high-voltage lines leading from the Itaburi substation near Sao Paulo, and was exacerbated by a number of factors, according to the cable, which appears to confirm the public reports of the blackout.

But what of the “acknowledged interferences in past years”?

Raphael Mandarino Jr., Brazils director of Homeland Security Information and Communication, says it refers to a cyber-extortion attack launched by Eastern European hackers around 2005 or 2006. The attackers penetrated an administrative machine at ONS after the system administrator left the computer with a default password.

The intruders, Mandarino says, downloaded and deleted files on the machine, and then left a message demanding ransom money for the data’s return. The person responsible for the system’s maintenance arrived to work at 8:00 a.m., and initially thought the ransom note was a joke. It took one hour to take the threat seriously.

No money was paid, says Mandarino, and most of the destroyed files were recovered from a backup.

“That was the first serious attack, which resulted in the issue being discussed in all the public administration”, he said.

Among the measures suggested to avoid a repeat occurrence was the creation of stronger passwords — the one they created right after the incident was cracked in a penetration test after just one week — and the recommendation that no outsourced workers have access to the passwords. Those measures were distributed to all the governments branches and affiliates, including energy suppliers.

ONS’ Wilkens Geraldes, mentioned in the cable, referred inquiries to the agency’s PR team, which responded by saying that ONS has always had two different networks: The corporate network has suffered attacks, they say. But the utility operation network is isolated, and has yet to be breached from the outside.

In a broadcast Nov. 8, 2009, 60 Minutes cited unnamed sources in making the claim that a massive 2007 blackout that affected 3 million people was triggered by hackers targeting a utility companys control systems.

In truth, a utility companys negligent maintenance of high-voltage insulators on two transmission lines is what caused the outage, according to government regulators and others who investigated the incident for more than a year.

“I looked at the case as the top systems officer within the government, and I found nothing”, Mandarino reiterated this week, adding that he gave a taped interview to 60 Minutes rebutting the anonymous cyberwar claims, but CBS didn’t air it.

There are indeed attacks against the energy websites. There was a defacement attack in 2008. There have been attempts at denial of service. Nothing that affected public utilities,” he says. “It’s still very difficult, because the system is not online. We have some [facilities] like thermoelectric plants that are remotely controlled, but they’ve suffered no attacks.”

Top image: Sao Paolo endures a power outage in 1999.
Dario Lopez-Mills/AP


Feds arrest man who juiced Google's 'just be evil' search

Federal authorities on Monday arrested a website operator accused of selling counterfeit eyeglasses who subjected customers to foul-mouthed tirades when they complained about the quality of the goods.

GO FUCK YOURSELF COCKSUCKER ... I pee on your negative [comments] Vitaly Borker, 34, of Brooklyn, New York, allegedly wrote in an October 27 email to one customer. He went on to claim he'd direct an assistant to crush the man's glasses and then take the pieces of what is left of his glasses and use the label he sent to ship the powder back to him.

Borker's brusque email-side manner was documented in late November by The New York Times, which claimed that the vast number of consumer complaints caused his DecorMyEyes.com website to boost sales thanks to the resulting boost in its Google ranking. In other words, the nastier he got, the more prominent his site became.

Ive exploited this opportunity because it works, Borker was quoted as telling The NYT. No matter where they post their negative comments, it helps my return on investment. So I decided, why not use that negativity to my advantage?

Authorities who arrested Borker and searched his home allegedly found several firearms and ammunition, according to prosecutors. He has been charged with one count each of cyberstalking, making interstate threats, mail fraud and wire fraud. He is expected to be arraigned soon.

Google responded to the episode by announcing changes to its search algorithm that, in effect stops rewarding people for being evil. Google didn't disclose much about the fix other than to say engineers developed an algorithmic solution which detects the merchant from the Times article along with hundreds of other merchants that, in our opinion, provide an extremely poor user experience."

A PDF of the criminal complaint charging Borker is here.

WikiLeaks Assange To Meet With U.K. Police Over Swedish Warrant

WikiLeaks founder Julian Assange has agreed to meet with British police over an arrest warrant and extradition request from Sweden, according to reports from the U.K. press.

“Late this afternoon after close of business I got a call from the police who said that they had received an extradition request from Sweden,” said Mark Stephens, an attorney for Assange, in an interview with the BBC. “Their request is to interview Julian Assange. He’s not been charged with anything. We are in the process of making arrangements to meet with the police by consent in order to facilitate the taking of that question and answer that is needed.”

On Thursday the Swedish Supreme Court upheld a detention order against Assange in an ongoing investigation into his conduct during a visit to that country last August. Prosecutors are trying to determine whether to charge Assange with sex crimes over separate encounters he had with two women there. Both encounters, according to local reports, began asconsensual, but one woman told police that Assange refused to stop after the condom broke.

An Interpol “red notice” was issued for Assange on November 30. But the underlying Swedish probe has been marred by missteps, including an initial arrest warrant that was withdrawn hours after it leaked to the press, and technical deficiencies in a new warrant that was sent to British police last month, which have since been resolved.

Last week, lawyers for Assange shot back atprosecutorsand the alleged victims in the case. Australian attorney Jason Catlin, who has represented Assange, called out the alleged victims by name in an editorial at Crikey.com. “Both women,” he claimed, “boasted of their celebrity connection to Assange after the events that they would now see him destroyed for.” (Claes Borgstrom, an attorney representing the women, did not respond to an e-mail inquiry from Threat Level.)

And in London, Stephens told AOL News on Thursday that the offense under investigation isn’t rape at all, but rather something called “sex by surprise”, which he described as a minor — and uniquely Swedish — offense that carries a 5,000 kroner fine — about $715. .

“Whatever ’sex by surprise’ is, it’s only a offense in Sweden — not in the U.K. or the U.S. or even Ibiza,” Stephens said. “I feel as if I’m in a surreal Swedish movie being threatened by bizarre trolls.”

In an e-mail to Threat Level, Stephens said he got the “sex by surprise” language from his Swedish co-counsel, who told him that an appeals court had changed the “rape” language in the detention order to the lesser offense. He said that the defense team has been trying without success to get the details. “My Swedish co-counsel has had to make a formal request for the information,” Stephens wrote in an e-mail. “The prosecutor has ignored that request.”

The “sex by surprise” claim appears to be wrong. There is no such offense in Swedish law.The international arrest warrant is in an investigation into three separate offenses: rape, sexual coercion and sexual molestation, according to the Swedish public prosecutor’s office, which provides specific citations from the Swedish penal code on its website.

The official English translation of the penal code (.pdf) describes rape in substantially the same terms as in the U.S. The crime carries a minimum two year sentence, and a maximum of four or ten, depending on the seriousness. Sexual coercion is the lesser crime ofcoercingsomeone into sex without the use or threat of violence, and carries a maximum two year term.

The crime of “molestation” comes closest to what Stephens described. It can apply if a person “manifestly behaves indecently by word or deed … in a way that flagrantly violates a sense of propriety.” It carries a fine, or up to two years in prison.

Stephens points out that Assange left Sweden with the permission of the government. He says his client has repeatedly offered to cooperate with investigators, including answering questions remotely from Britain.

The Swiss bank PostFinance on Monday announced that it had closed the account Assange was using as his defense fund. “The Australian citizen provided false information regarding his place of residence during the account opening process,” the bank said in a statement. “Assange entered Geneva as his domicile. Upon inspection, this information was found to be incorrect. Assange cannot provide proof of residence in Switzerland and thus does not meet the criteria for a customer relationship with PostFinance.”

<em>With additional reporting from Kerstin Sjoden.</em>

Photo: Julian Assange, via Interpol.


Pig of a software to stop cybercrims in their tracks

Razorback aims to root out source of attacks, says Patrick Mullen.

An idea for detecting sophisticated threats that grew out of a casual conversation at an information security conference last year received a public airing at another one last week, its creators inspiring coders to pick up their tools to further the open source software to root out malicious hackers.

Sourcefire principal vulnerability research engineer Patrick Mullen pitched Razorback as a platform to enable organisations to craft their own responses to threats and their share those "nuggets" with others.

A nugget was a bit of code that enabled the software to collect or process data, issue alerts, store and correlate information, the Razorback community website said.

Razorback was known in the information security trade an intrusion detection system except, where most such software stopped an attacker cold, Sourcefire's sought to capture the information for later, offline processing and deeper inspection, Mullen said.

Sourcefire also made the popular Snort open-source network intrusion prevention software.

For instance, portable document format files could be parsed through Razorback and any suspect payloads run and weeded out or isolated for inspection, reporting or any other further action as required by the user.

Such could include feeding the information to a web proxy to deny future such payloads coming in on email to be executed over the web on the targeted network, Mullen said.

"[Enterprises] know they have attackers inside their networks and they're more concerned about being able to track their movements and contain them rather than stop an individual attack," Mullen said.

He said a scenario for trapping an internal attacker including to "take a router and redirect their traffic to keep them contained in a safe space and they can use their tools while they think they are running rampant".

He said he was initially "really shocked" by the call from network security professionals for a software such as Razorback because such systems usually stopped attackers at the firewall "but what Razorback does is provide the next level - further analysis to see what's going on in the network and clean up after attackers and be able to provide many more advanced types of detection".

Delegates to the Australian Information Security Association annual conference last week where Mullen was speaking heard that attackers sometimes spent years trawling through compromised systems before they were discovered.

Mullen said the threat landscape was becoming more diverse with file formats used to obfuscate attacks and the range of clients such as tablet PCs increasing in use and sophistication: "To provide full, in-depth coverage your detection system has to take all data coming in and simulate all the different clients it's protecting".

As part of its pitch for the hearts and minds of security developers, Sourcefire ran coding camps to bring them up to speed with the software's architecture and introduce them to the nuggets and data sources the framework supported.

"I'm looking forward to talking to more people in the field and finding what their opinions are with Razorback as well as any additional threats we're seeing and get in touch with people using the product and cleaning up the mess on a day to day basis."

Copyright © iTnews.com.au . All rights reserved.


SiteEngine "comments.php" SQL Injection Issue

SiteEngine is a PHP-based content manager. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data to the "module" parameter of the "comments.php" script before using it in an SQL query. SiteEngine version 7.1 is affected.

Ref: http://www.securityfocus.com/bid/45056

10.49.31 - CVE: Not Available
Platform: Web Application - SQL Injection

Columbia University Reverses Anti-Wikileaks Guidance

Days after Columbia University’s School of International and Public Affairs (SIPA) caused an uproar by warning its students against linking to Wikileaks or discussing the secret-spilling website’s latest cache of diplomatic cables online, the prestigious training ground for future diplomats has changed tack and embraced free speech.

Last week, the SIPA Office of Career Services sent an email to students saying that an alumnus who works at the U.S. State Department had recommended that current students not tweet or post links to Wikileaks, which is in the process of releasing 250,000 U.S. diplomatic cables — many of them classified — because doing so could hurt their career prospects in government service.

“Engaging in these activities would call into question your ability to deal with confidential information, which is part of most positions with the federal government,” the Office of Career Services wrote.

Now, SIPA Dean John H. Coatsworth has clarified the school’s policy and issued a ringing endorsement of free speech and academic freedom.

“Freedom of information and expression is a core value of our institution,” Coatsworth wrote in an email to the SIPA community Monday morning (full email below). “Thus, SIPA’s position is that students have a right to discuss and debate any information in the public arena that they deem relevant to their studies or to their roles as global citizens, and to do so without fear of adverse consequences.”

SIPA Professor Gary Sick, the prominent Middle East expert who served on the National Security Council under Presidents Ford, Carter, and Reagan, went even further in repudiating the memo.

“If anyone is a master’s student in international relations and they haven’t heard of WikiLeaks and gone looking for the documents that relate to their area of study, then they don’t deserve to be a graduate student in international relations,” Sick told Wired.com in an interview.

Still, the school says it will pass on any official State Department Wikileaks guidelines, if and when it gets them.

Over the weekend State Dept. spokesperson P.J. Crowley denied that there is a formal policy warning students against reading, linking, or discussing the Wikileaks cable online. SIPA’s original warning attributed the no-commenting on the released cables to an unnamed State Department alumnus.

Neither Coatsworth’s office nor a State Dept. spokesperson immediately returned requests for comment.

Despite the numerous stories that the leaked cables have inspired, the federal government is calling the leaks dangerous to national security and ‘illegal.’ Following outrage from the government, both Amazon and PayPal suspended services to Wikileaks in the past week, while federal government IT systems, including the Library of Congress’s, have started blocking access to the site.

The original Career Services warning provoked a spirited debate on and off campus about free speech and academic freedom.

In the interview, Sick said the Career Services warning was most likely a well-meaning attempt to remind students that what they post on social networking sites can affect their career prospects. But, he said, asking international affairs graduate students not to use the internet to discuss Wikileaks is, well, “absurd.”

Not only is such a request likely to be ignored, but it sends the wrong message to students, according to Sick.

Sick has criticized the Wikileaks release as an “ego trip for [Wikileaks chief] Julius Assange,” and said that many of the cables pose a real risk to U.S. interests. But, he said, trying to prevent international relations students from reading or discussing them is naive at best.

“It doesn’t hurt to remind students that things they say in public can be documented and can affect their career prospects,” Sick said. “But The New York Times and Fox News are all reporting their interpretations of the Wikileaks documents. Scholars and students always want to go to the source, not take someone else’s word for it.”

Telling students that they can’t read or discuss the primary documents is “absolutely contrary to any decent practice in international affairs or any other field of study,” Sick said.

And anyway, he said, “It’s too late. The barn door is wide open. The internet is full of this stuff and it’s not going to go away. They can only make it worse by trying to crack down on this and push it back down the rabbit hole.”

In a blog post over the weekend entitled, “Am I a Criminal?” Sick elaborated: “Note to the US government: We know this is bad for you. Dont make it worse by criminalizing everyone who studies international politics.”

Full email from SIPA Dean John H. Coatsworth:

December 6, 2010

Dear SIPA Community,

Last Tuesday, SIPA’s Office of Career Services received a call from a former student currently employed by the U.S. Department of State who pointed out that the U.S. government documents released during the past few months through WikiLeaks are still considered classified. The caller suggested that students who will be applying for federal jobs that require background checks avoid posting links to these documents or making comments about them on social media sites such as Facebook or through Twitter.

OCS emailed this cautionary suggestion to students, as it has done many times with other information that could be helpful in seeking employment after graduation. We know that many students today share a great deal about their lives online and that employers may use that information when evaluating their candidacy. Subsequent news stories have indicated that the Department of State has issued guidelines for its own employees, but has not issued any guidelines for prospective employees.

Freedom of information and expression is a core value of our institution. Thus, SIPA’s position is that students have a right to discuss and debate any information in the public arena that they deem relevant to their studies or to their roles as global citizens, and to do so without fear of adverse consequences. The WikiLeaks documents are accessible to SIPA students (and everyone else) from a wide variety of respected sources, as are multiple means of discussion and debate both in and outside of the classroom.

Should the U.S. Department of State issue any guidelines relating to the WikiLeaks documents for prospective employees, SIPA will make them available immediately.

Sincerely,
John H. Coatsworth
Dean

Original email from Office of Career Services:

From: Office of Career Services
Date: Tue, Nov 30, 2010 at 3:26 PM
Subject: Wikileaks – Advice from an alum
To: “Office of Career Services (OCS)”

Hi students,

We received a call today from a SIPA alumnus who is working at the State Department. He asked us to pass along the following information to anyone who will be applying for jobs in the federal government, since all would require a background investigation and in some instances a security clearance.

The documents released during the past few months through Wikileaks are still considered classified documents. He recommends that you DO NOT post links to these documents nor make comments on social media sites such as Facebook or through Twitter. Engaging in these activities would call into question your ability to deal with confidential information, which is part of most positions with the federal government.

Regards,
Office of Career Services

See Also:

  • PayPal Freezes WikiLeaks Account
  • WikiLeaks Attacks Reveal Surprising, Avoidable Vulnerabilities
  • Salaries of WikiLeaks Staffers to Be Revealed in New Report
  • Lieberman Introduces Anti-WikiLeaks Legislation
  • Cable Traffic: WikiLeaks, Facebook, and You
  • Newspapers Reveal Diplomatic Cables Provided By WikiLeaks

Operation Ore decision a 'serious miscarriage of justice' - lawyer

The solicitor who brought the Operation Ore appeal that was finally rejected today has questioned whether the British courts had the expertise to consider deeply technical cases.

Chris Saltrese, the solicitor who brought the case on behalf of Anthony O'Shea, told us today that in his view, the verdict was "not based on the evidence".

Speaking on the dismissal of O'Shea's appeal against his conviction for incitement to distribute an indecent photograph of a child, he told us: "This is a disappointing judgment but not unexpected.

"The Court of Appeal decided to hear a two week case in two days by not hearing the evidence," he claimed.

"As a result, the Court overlooked the key issues in the written submissions. It substituted its own version of the significant evidence."

"The Court's version did not include the core evidence on which the appeal was based.

The House of Lords Science and Technology Committee has recommended that the Government review the availability of independent specialist advice in court cases involving internet-related crime, Saltrese said. "The conduct of this case suggests that such a step may now be timely.

"Landslide [the database in which O'Shea's details were found] was not a child pornography portal. It was an internet vehicle through which criminal webmasters processed stolen credit-card information," Saltrese continued. "The evidence is clear but was overlooked by the Court.

"We would stress that we remain convinced that Operation Ore in general, and this case in particular, was seriously flawed and a miscarriage of justice."

O'Shea would now have to consider his next steps, Saltrese said.

From the authorities' point of view, the verdict vindicates Operation Ore. Jim Gamble, ACPO lead for child protection, told the Reg earlier today: Todays decision by the Court of Appeal draws a line under the efforts of a small number of individuals who, over the past ten years, have perpetuated conspiracy theories about Operation Ore."

Juniper gobbles Altor Networks in $95m startup snack

Juniper Networks has acquired partner Altor Networks for $95m in cash, to beef up the security of networks and virtualized servers using its switches.

Altor, which was founded in 2007, is located in Redwood Shores, California, and has created a firewall and intrusion protection system combination that was designed from the ground up to be used in virtualized networks linking virtualized servers to each other.

The company was founded by Amir Ben-Afraim, the former head of business development at firewall maker Check Point Software and a few companies back the lead software engineer at mainframe maker Amdahl, which was devoured by the gaping maw of Japanese server giant Fujitsu many years ago.

Altor lured away Moshe Litvin, who was formerly chief architect at Check Point, to be vice president of engineering on the Altor Virtual Firewall, which plunks into a virtual machine on an x64 server and is used to secure VMs as they flutter around a network using live migration features in server hypervisors.

While there are plenty of server workloads that are not currently virtualized and some that may never be virtualized, Web, application, email, and collaboration servers are being aggressively virtualized. A physical hardware appliance that doesn't understand virtual machines (whether it is a firewall/intrusion protection system or an application caching accelerator) is not something that is going to appeal to customers in this new virtual world.

Juniper said in a statement that it bought Altor not just for its virtualized firewall and intrusion protection system, but also because of the monitoring and compliance tools wrapped around the firewall. These features are important to companies implementing cloudy infrastructure, whether it is for internal clouds or among service providers transforming themselves from traditional hosters (where they sell whole or partitioned servers) to peddlers of flexible cloud capacity (which has workloads scaling up and down and moving around, making many customers especially concerned about security and monitoring).

The Altor virtual firewall runs atop VMware's ESX Server hypervisor, just like rival Cisco Systems' Virtual Security Gateway, which was announced back in September. VMware is, in fact, a partner of Altor's, as is Juniper, which participated in the virtual firewall maker's Series B funding back in March through its Junos Innovation Fund.

Altor raised $10m in that second round, with Juniper and DAG Ventures as well as Accel Partners and Foundation Capital, Altor's founding sugar daddies, kicking in dough. Altor raised $6m from those two equity firms in April 2008 as well as $1.5 in initial seed money as Altor was founded. The company has not divulged its sales and profits, if it has any, nor the number of customers it has.

Juniper has not yet said how it will make use of the Virtual Firewall that it gets from the Altor acquisition, but it would be interesting to see the company deploy the software inside switches (where appropriate) as well as within the server infrastructure. Juniper already sells appliances for intrusion detection and prevention as well as integrated security gateways, SSL virtual private networking appliances, and access control gateways.

It may turn out that Juniper doesn't need Altor for its Virtual Firewall so much as it needs the expertise to turn these physical hardware appliances into virtual ones that run atop ESX Server, so it can sell both physical and virtual security devices.

The Altor acquisition closed today, so the deal is done.

Anonymous attacks PayPal in 'Operation Avenge Assange'

Anonymous has launched a broad-ranging campaign in support of Wikileaks, starting with a DDoS assault on a PayPal website.

The denial of service attack lasted for eight hours and resulted in numerous service disruptions, Panda Security reports.

The group, spawned from anarchic message board 4chan, first came to prominence with a long running campaign against the church of Scientology, its beef with the Hubbard faithful centering on their attempts to censor content from the net.

PayPal's decision to stop processing donations for Wikileaks following its controversial publication of US diplomatic cables as well as the withdrawal of hosting services by Amazon are seen on 4chan and elsewhere as attempts to censor the whistle-blowing site, a development Anonymous intends to oppose. It said on its website:

While we dont have much of an affiliation with WikiLeaks, we fight for the same reasons. We want transparency and we counter censorship. The attempts to silence WikiLeaks are long strides closer to a world where we can not say what we think and are unable to express our opinions and ideas.

We can not let this happen. This is why our intention is to find out who is responsible for this failed attempt at censorship. This is why we intend to utilize our resources to raise awareness, attack those against and support those who are helping lead our world to freedom and democracy.

Operation Avenge Assange will incorporate a combination of political lobbying (writing to MPs etc), a consumer boycott of PayPal as well as practical support (mirroring) and advocacy for Wikileaks. The traditional denial of service attacks will also come into play with an assault against the ThePayPalblog.com.

Google acquires DRM henchmen with Widevine buy

Monday, December 6, 2010

Google has bought DRM software outfit Widevine for an undisclosed sum.

The company, which agreed to purchase Seattle-based Widevine last Friday, said it plans to fold the Widevines digital rights management tech presumably into its newborn television platform, Google TV.

By forging partnerships across the entire ecosystem, Widevine has made on demand services more efficient and secure for media companies, and ultimately more available and convenient for users, said Google product management veep Mario Queiroz.

We are committed to maintaining Widevines agreements and will provide direct, quality support for their existing and future clients and we plan to build upon Widevines technology to enhance both their products and our own.

Widevines tech is currently used on around 250 million web-connected televisions and devices to help film studios prevent their video content from being streamed by pirates. Its customers include Best Buy, LoveFilm and NetFlix.

Indian feds' site besmirched in tit-for-tat Pak hack attack

Pakistani hackers have responded to attacks by their Indian counterparts by defacing the website of India's federal crime investigation bureau over the weekend.

The Central Bureau of Investigation (CBI) website was pulled offline for rebuilding following an assault by a group calling itself the Pakistani Cyber Army on Friday.

The group warned that mass defacement attacks against Indian websites would follow in the event of attacks by Indian hackers against Pakistani sites, The Times of India reports.

The Pakistani attacks come as a reprisal against a hack attack on 35 Pakistani Government websites early last week. Sites including those run by the Pakistan Navy, the National Accountability Bureau, and the ministries of foreign affairs, education and finance were all hit in the assault.

All of the affected websites reportedly ran on the same server.

A crew called the Indian Cyber Army carried out the mass attack, which it claimed was a cyber-protest about the Mumbai terrorist attacks of November 2008 which left 175 dead.

Stuxnet expert nuke-boffin killing: Iran claims arrests

Iranian authorities claim to have arrested suspects over the murder of a nuclear scientist in the country last Monday.

Motorcylists placed bombs on the windows of cars as the targets of the attack were driving to work, in two identical but separate attacks last Monday. Each device was detonated seconds later leaving little chance of escape.

One blast killed Majid Shahriari, a professor at the nuclear engineering faculty at the Tehran University, and severely wounded his wife. The second bomb injured nuclear physicist Fereidoun Abbasi, who was fortunate to escape with his life.

Shahriari, a quantum physicist by trade, reportedly headed the team Iran has established to eradicate the Stuxnet worm from industrial facilities involved in its controversial nuclear program.

Iranian Intelligence Minister Heidar Moslehi claimed that the country had made an unspecified number of arrests over the assassinations, which he blamed on Western intelligence agencies.

Details on the supposed arrests were notably vague; it may be that the announcement, and follow-up comment by Iranian President Mahmoud Ahmadinejad along the same lines, were intended primarily for domestic consumption.

Stuxnet is a sophisticated worm that selectively targets industrial control systems from Siemens, allowing compromised systems to be reprogrammed and therefore sabotaged. The Iranian president confirmed last week that the worm sabotaged uranium-enrichment centrifuges at the centre of the country's controversial nuclear program.

Alleged Russian spam-lord hauled into US court

A Russian who allegedly at one time ran a network of compromised machines responsible for a third of global spam appeared in federal court in Wisconsin on Friday to deny the charges.

Oleg Y Nikolaenko, 23, a resident of Moscow, faces charges that he forged email spam messages in violation of the US CAN-SPAM Act, following his arrest in Las Vegas' Bellagio Hotel last month.

Prosecutors allege that the Russian was responsible for pumping out a staggering 10 billion spam messages per day, touting penis pills and counterfeit goods using the infamous Mega-D botnet network.

Nikolaenko (pictured in a CNN story here) entered a not guilty plea. He was denied bail after prosecutors successfully arguing he presented a flight risk if released.

The prosecution is taking place in Wisconsin because local agents there bought a specimen purchase of Viagra through a Canadian Pharmacy operation allegedly promoted by Nikolaenko's junk mails, AP reports. The pills unsurprisingly turned out to counterfeit.

Federal investigators got a lead on Nikolaenko after arresting one of his alleged clients, a dodgy businessman promoting sales of counterfeit Rolex watches through junk mail. Australian Lance Atkinson, who ran the Affking email marketing and counterfeiting scam business until he was collared in 2008, is allegedly pointing the finger of blame towards Nikolaenko as part of a plea bargaining deal according to this KrebsOnSecurity report.

The electronic trail of the subsequent investigation led back through command and control servers in Australia onto Gmail accounts and electronic payment records tied back to Nikolaenko, as explained in greater depth by Gary Warner's CyberCrime & Doing Time blog here.

The Mega-D zombie network was infamous as a source of spam prior to a January 2009 takedown operation mounted by security firm FireEye, which failed to kill off the botnet entirely but did at least drastically reduce its output since. Security vendors welcomed the arrest of Nikolaenko as the final nail in the Mega-D coffin, while warning other spam-spewing zombie networks have risen to take its place.

Joe Stewart, director of malware analysis at security tools firm SecureWorks, commented: "Before being disrupted by FireEye, Mega-D rivalled Cutwail and Rustock as one of the top three spam botnets in the world. In 2009, the botnet was capable of sending 16 billion spam messages per day.

"Between FireEye's efforts and the arrest of Nikolaenko, Mega-D has finally been put out of commission. However, other botnets are already filling the void left by Mega-D, showing that we still have a long way to go in the fight against spam."

AVG Free update wipes out some Windows 7 machines

Popular antivirus package leaves some Windows 7 PCs unable to reboot

A faulty update to the free AVG antivirus package is preventing some Windows 7 machines from booting.

The update for AVG Free Edition 2011 requests users restart their system, only for them to be confronted with the following message when they attempt to restart: "STOP: c0000135 The program can't start because %hs is missing from your computer. Try reinstalling the program to fix this problem."

AVG has withdrawn the faulty update, but admits that customers who have already installed the software may have trouble getting their PC to start. The company claims only some machines running the 64-bit version of Windows 7 are affected by the bug.

AVG's support forum suggests a number of workarounds, including booting affected PCs in Safe Mode and running a System Restore, before reinstalling AVG.

People who can't get their PC to boot at all are advised to follow a rather more complex workaround, involving AVG's Rescue CD utility.

The company claims it will eventually "release some tool to help in fixing the systems affected by this bug".

 

This article originally appeared at pcpro.co.uk

Copyright © PC Pro, Dennis Publishing


Wikileaks attempts "mass mirror"

Wants at least 50 servers.

Wikileaks said it was attempting to create "censorship resistant mirrors" of its now Swiss-hosted Cablegate site after sustained denial of service attacks since last week.

"Wikileaks is currently under heavy attack," a short statement on its website read.

The site said it would only publish a list of mirrors once it had "at least 50".

Wikileaks moved its site to a Switzerland-based address after its U.S. domain name provider pulled the plug.

EveryDNS.net announced it had stopped providing domain name system services to wikileaks.org, blaming repeated distributed denial of service (DDoS) attacks which it said had the stability of its service for other customers.

Wikileaks said it was on the wrong end of a 10Gbps DDoS strike last week, following an initial attack on the day it began releasing its controversial government communications.

“A 24 hour termination notification email was sent to the email address associated with the wikileaks.org account,” a statement from EveryDNS.net read.

“In addition to this email, notices were sent to Wikileaks via Twitter and the chat function available through the wikileaks.org website. Any downtime of the wikileaks.org website has resulted from its failure to use another hosted DNS service provider.”

Wikileaks subsequently revealed over Twitter it had switched domains. The organisation was also forced to remove its files from Amazon servers after being booted off the cloud service.

Wikileaks founder and editor-in-chief Julian Assange is believed to have moved the files back to another service provider in Sweden.

The site has inspired both derision and praise after leaking various cable communications, one of which implicated China in a hack on Google.

This article originally appeared at itpro.co.uk

Copyright © ITPro, Dennis Publishing


PayPal Freezes WikiLeaks Account

Saturday, December 4, 2010

In potentially the most significant attack on WikiLeaks to date, PayPal on Friday froze the account of the German foundation accepting donations for the secret spilling website, claiming that WikiLeaks was in violation of PayPal’s terms of service.

“PayPal has permanently restricted the account used by WikiLeaks due to a violation of the PayPal Acceptable Use Policy, which states that our payment service cannot be used for any activities that encourage, promote, facilitate or instruct others to engage in illegal activity,” reads a statement on PayPal’s website. “Weve notified the account holder of this action.”

Most of the over $1 million in contributions WikiLeaks has drawn in the last year have come through its PayPal account, which belongs to the Wau Holland Foundation, a German non-profit group that manages the bulk of WikiLeaks’ money.

Attempting to donate to Wau Holland though PayPal on Friday night produced the message “This recipient is currently unable to receive money.”

PayPal’s move comes amid mounting U.S. pressure against WikiLeaks over its cache of over 250,000 State Department diplomatic cables. Struggling with denial-of-service attacks on its servers earlier this week, WikiLeaks moved to Amazons EC2 cloud-based data-storage service, only to be summarily booted off on Wednesday. Then on Thursday its domain-name service provider, EveryDNS, stopped resolving WikiLeaks.org, after the DNS provider was battered by the DoS attacks.

There was an element of theater to WikiLeaks’ supposed struggles against electronic censorship this week. WikiLeaks kept its domain hosting at EveryDNS even after the company warned WikiLeaks that it was pulling the plug. And though WikiLeaks has no shortage of hosting options outside of U.S. influence, founder Julian Assange selected Amazon instead, in what he described Friday as a test of the company’s commitment to free speech.

The attack on WikiLeaks’ money flow, in contrast, is the real deal, and has the potential to genuinely impact the organization.

PayPal’s public statement doesn’t detail the “illegal activity” WikiLeaks promotes, but presumably it’s the leaking of classified information. Sometimes such leaks are indeed illegal. And sometimes classified leaks — legal or not — reveal warrantless wiretapping of Americans, secret CIA prison networks,and massive government waste hidden in black budgets. PayPal hasn’t articulated a reason it’s newfound intolerance for WikiLeaks wouldn’t apply equally to the New York Times and the Washington Post.


WikiLeaks Attacks Reveal Surprising, Avoidable Vulnerabilities

Some online service providers are in the cross hairs this week for allegedly abandoning WikiLeaks after it published secret U.S. diplomatic cables and drew retaliatory technical, political and legal attacks. But the secret-spilling site’s woes may be attributable in part to its own technical and administrative missteps as well as outside attempts at censorship.

Struggling with denial-of-service attacks on its servers earlier this week, WikiLeaks moved to Amazon’s EC2 cloud-based data-storage service only to be summarily booted off on Wednesday, ostensibly for violations of Amazon’s terms of service. Then on Thursday its domain-name service provider, EveryDNS, stopped resolving WikiLeaks.org, amid a new DoS attack apparently aimed at the DNS provider.

While WikiLeaks was clearly targeted, its weak countermeasures drew criticism from network engineers. They questioned its use of a free DNS service such as EveryDNS, as well as other avoidable errors that seem to clash with WikiLeaks’ reputation as a tech-savvy and cautious enterprise hardened to withstand any concerted technical attack on its systems.

“If they wanted to help users get past their DNS problems, they could tweet for assistance, tweet their IP addy and ask to be re-tweeted, ask owners of authorities to set up wikileaks.$FOO.com to ‘crowd source’ their name, etc.,” observed one poster to the mailing list for the North American Network Operating Group. “So at the very least, they are guilty of not being imaginative.”

“IMHO it is a gambit to ask for money,” wrote another.

WikiLeaks’ downtime was short-lived, with the site announcing Friday on Twitter that it was operational on WikiLeaks.de, WikiLeaks.fi, WikiLeaks.nl and WikiLeaks.ch — the country codes respectively for Germany, Finland, the Netherlands and Switzerland. The scattering followed a Thursday outage of WikiLeaks.org and the “Cablegate” subsite, that occurred when EveryDNS cut off the secret-spilling site.

Unlike the incident this week in which Amazon unceremoniously booted WikiLeaks from its servers, the latest outage appears to have had less to do with censorship than with WikiLeaks’ inattention to the more-mundane side of running an organization.

More WikiLeaks Cablegate Coverage
  • Russias Shadow War on Georgia, WikiLeaked December 3, 2:16 PM
  • WikiLeak: Pakistanis Sabotage U.S. Mercs, Gear, Diplos December 2, 9:27 PM
  • WikiLeaked Cable Confirms U.S. Secret Somalia Op December 2, 2:44 PM
  • WikiLeaks Hasnt Broken U.S. Intelligence. Yet. December 1, 6:42 PM
  • Did North Korea Really Give Iran Mega-Missiles? December 1, 1:11 PM

  • WikiLeaks Attacks Reveal Surprising, Avoidable Vulnerabilities December 4, 12:02 AM
  • Lieberman Introduces Anti-WikiLeaks Legislation December 2, 11:32 PM
  • Salaries of WikiLeaks Staffers to Be Revealed in New Report December 1, 11:51 PM
  • Interpol Issues Red Notice for Arrest of WikiLeaks Julian Assange November 30, 10:42 PM
  • WikiLeaks Cablegate: The Taiwanese Animated Version November 30, 10:30 AM

EveryDNS is a free, donation-supported service run by New Hampshire’s Dyn Inc. Like thousands of other DNS providers it does the small but crucial job of mapping a user-friendly internet domain name, like wired.com, to a numeric IP address that actually means something to the internet’s underlying infrastructure.

It’s unclear why WikiLeaks went with a free provider, instead of paying for bulletproof DNS that could withstand attack. But according to EveryDNS, the distributed denial-of-service attacks that have been dogging WikiLeaks were threatening to overrun EveryDNS’s servers, which serve some 500,000 sites.

The company responded by notifying WikiLeaks on Wednesday that it was going to drop the organization in 24 hours, according to a statement on EveryDNS’ website. It reached out to WikiLeaks on the e-mail address associated with the account, on Twitter, and even visited the group’s encrypted chat room to try and pass word to the staff.

That should have been more than enough time for WikiLeaks to move its DNS. Instead, Thursday night, visitors could no longer reach WikiLeaks.org.

“Any downtime of the wikileaks.org website has resulted from its failure to, with plentiful advance notice, use another DNS solution,” reads EveryDNS’s statement.

Rather than tweeting the IP addresses of WikiLeaks hosts, which would allow visitors to continue to reach the site uninterrupted, WikiLeaks initially used the outage to encourage donations, tweeting instead: “WikiLeaks.org domain killed by US everydns.net after claimed mass attacks KEEP US STRONG https://donations.datacell.com/”.

And a follow-up tweet noted: “You can also easily support WikiLeaks via http://collateralmurder.com/en/support.html”.

WikiLeaks fans on Twitter discovered and circulated WikiLeaks’ working addresses on their own, until about three hours after the outage began, when the organization tweeted: “WIKILEAKS: Free speech has a number: http://88.80.13.160″.

WikiLeaks followed that up by promoting WikiLeaks.ch as an alternative address, but that domain, too, turned out to be resolved by EveryDNS, which shut it down.

WikiLeaks had the four regional domains working on Friday, resolving to hosts in Sweden and France. Domain-registration records show that WikiLeaks still has control of the WikiLeaks.org, but for whatever reason, the organization still has EveryDNS set as its name server for that domain.

The incident isn’t the first time WikiLeaks has suffered from a bureaucratic snafu. On June 12, WikiLeaks secure submission page stopped working when the site failed to renew its SSL certificate, a basic web protection that costs less than $30 a year and takes only hours to set up.

And for years WikiLeaks promised would-be leakers that they’d enjoy the protection of strong journalist shield laws in Sweden, where WikiLeaks maintains some of its servers. It wasn’t until August of this year that it emerged that WikiLeaks hadn’t registered as a media outlet in Sweden, and thus wasn’t protected.

That latter disclosure sent founder Julian Assange to Stockholm in August in an effort to correct the oversight. His romantic entanglements on that trip led to an ongoing sex-crime investigation and the issuance this week of an Interpol “red notice” putting Assange on the international police agency’s wanted list.

Photo: Julian Assange
Lily Mihalik/Wired.com


Video Barbie in FBI Cross Hairs

A Barbie doll tricked out with a video camera concealed in her necklace could be used by predators to create child pornography, warns the FBI in a recent cybercrime alert.

In the alert, mistakenly released to the press, the FBI expressed concern that the toy’s camera, which can capture 30 minutes of video and rivals a Canon 7D in quality (see above), could be used to lure children and surreptitiously film child pornography. Barbie and other dolls have been used in the past by sexual predators to attract victims.

According to ABC News, which obtained a copy of the memo, the FBI appears to have opened an investigation into the doll.

Mattel, the maker of Barbie Video Girl, noted in a statement that the FBI didn’t say it knew of any cases where the Barbie camera had been used for such nefarious purposes.

But a sheriff’s spokesman told ABC News that the FBI alert will be helpful for drawing attention to investigators collecting evidence at a crime scene.

“When we’re doing a search warrant looking for media that a child pornographer may have used, we’re gonna have to put Barbie on the list just like any other cameras [and] computers,” said Sgt. John Urquhart from the King County Sheriff’s Department in Washington state.


Popular sites caught sniffing user browser history

Boffins from Southern California have caught YouPorn.com and 45 other sites pilfering visitors' surfing habits in what is believed to be the first study to measure in-the-wild exploits of a decade-old browser vulnerability.

YouPorn, which fancies itself the YouTube of smut, uses JavaScript to detect whether visitors have recently browsed to PornHub.com, tube8.com and 21 other sites, according to the study. It tracked the 50,000 most popular websites and found a total of 46 other offenders, including news sites charter.net and newsmax.com, finance site morningstar.com and sports site espnf1.com.

We found that several popular sites including an Alexa global top-100 site make use of history sniffing to exfiltrate information about users' browsing history, and, in some cases, do so in an obfuscated manner to avoid easy detection, the report states. While researchers have known about the possibility of such attacks, hitherto it was not known how prevalent they are in real, popular websites.

To cover its tracks, YouPorn encodes its JavaScript to hide the sites it searches for and decodes it only when used. Other websites dynamically generate the snoop code to prevent detection by simple inspection. Still others rely on third-party history-stealing libraries from services that include interclick.com and meaningtool.com.

The scientists detected the history stealing by concocting their own version of Google's Chrome browser with a JavaScript information flow engine that uses a dynamic source-to-source rewriting approach.

The 46 sites exploit a widely known vulnerability that currently exists in all production version browsers except of Apple's Safari, which earlier this year became the first major browser to insulate users against the threat. Google Chrome, which is based on the same Webkit engine, soon followed. Beta versions of Mozilla Firefox and Microsoft Internet Explorer also fix the problem, but production versions of those browsers are still wide open.

The exploit works by using JavaScript to read cascading style sheet technologies included in virtually every browser that causes visited links to appear in purple rather than blue. Developers have known of the weakness for a decade or more but until recently said it couldn't be easily repaired without removing core functionality.

The study also detected code on sites maintained by Microsoft, YouTube, Yahoo and About.com that perform what the scientists called behavioral sniffing. They employ JavaScript that covertly tracks mouse movements on a page to detect what a user does after visiting it.

A PDF of the paper, which was written by Dongseok Jang, Ranjit Jhala, Sorin Lerner, and Hovav Shacham, is here.

Researchers bypass Internet Explorer Protected Mode

Researchers say they have devised a way to carry out stealthy drive-by exploits even when victims are using recent versions of Internet Explorer with a feature known as Protected Mode.

The attack, described in a paper released by Verizon Business, requires the attacker to have an exploit for a vulnerability that's not currently patched. It works only against machines that have the Local Intranet Zone enabled, as is the default for domain-joined workstations.

Protected Mode, which was introduced in version 7 of IE, is intended to prevent exploit code from accessing sensitive parts of the Windows operating system, such as those that create files or change registry settings. But the Verizon Business researchers said they figured out a reliable way to bypass the measure that requires no interaction on the part of the victim.

The attack combines the facts that sockets are not subject to Mandatory Integrity Control and that sites in the Local Intranet Zone are rendered with Protected Mode disabled, the paper states.

The new malicious web page will be rendered in the Local Intranet Zone and the rendering process will now be executing at medium integrity. By exploiting the same vulnerability a second time, arbitrary code execution can now be achieved as the same user at medium integrity. This provides full access to the users account and allows malware to be persisted on the client, something which was not possible from low integrity whilst in Protected Mode.

A PDF of the paper is here.

Viacom Says YouTube Ruling Will Completely Destroy Copyright

Viacom appealed Friday its unsuccessful $1 billion copyright lawsuit against Google’s YouTube in a case testing the depths of copyright-infringement protection under the Digital Millennium Copyright Act of 1998.

Viacom, on behalf of its MTV, Comedy Central, Black Entertainment Television, Paramount Pictures and Nickelodeon units, is seeking to overturn a June ruling that, if it survives, is a boon for internet freedom — and a decision that would make it more difficult for rights holders to protect their works.

The media concern told the New York-based 2nd U.S. Circuit Court of Appeals on Friday that, if the lower decision stands, “it would radically transform the functioning of the copyright system and severely impair, if not completely destroy, (.pdf) the value of many copyrighted creations.”

The June 23 decision at issue by U.S. District Judge Louis L. Stanton of New York said internet companies, even if they know they are hosting infringing material, are immune from copyright liability if they promptly remove works at a rights holder’s request under what is known as a takedown notice.

Stanton disagreed with Viacom’s claims that YouTube had lost the so-called “safe harbor” protection of the DMCA. Viacom maintains Google does not qualify, because internal records showed Google was well aware its video-hosting site was riddled with infringing material posted by its users.

Stanton ruled that YouTubes “mere knowledge” of infringing activity “is not enough.”

“To let knowledge of a generalized practice of infringement in the industry, or of a proclivity of users to post infringing materials, impose responsibility on service providers to discover which of their users postings infringe a copyright would contravene the structure and operation of the DMCA,” the judge wrote.

Stanton ruled that YouTube, which Google purchased in 2006 for $1.8 billion, had no way of knowing whether a video was licensed by the owner, was a “fair use” of the material “or even whether its copyright owner or licensee objects to its posting.”

The DMCA, which was heavily lobbied into existence by the Hollywood studios, has been a boon for internet freedom. But it has been a bust in other areas.

Among its provisions, the DMCA prohibits the circumvention of encryption technology that protects copyrighted works. The law, adopted in 1998, makes it unlawful to market DVD copying devices, for example, and also paved the way for a Southern California man to be charged on allegations of modding Microsoft’s Xboxes.

Still, the DMCAs “safe harbor” privilege comes with another price. The law demands intermediaries such as YouTube to take down content in response to a notice from rights holders, without evaluating the claim for reasonableness or accuracy, or considering the fair use rights of users. And on Thursday, Google said it would expedite the process of content removal.

Photo: Mark Roquet/Flickr

See Also:

  • 10 Years Later, Misunderstood DMCA is the Law That Saved the Web …
  • DMCA Muscle Kills DVD Copying, for Real
  • Apple v. EFF: The iPhone Jailbreaking Showdown
  • Prosecutors Seek to Block Xbox Hacking Pioneer From Trial
  • Google Wins Viacom Copyright Lawsuit
  • Accusations Fly in Viacom, YouTube Copyright Fight
  • Judge Orders YouTube to Give All User Histories to Viacom

Siberian crooks dev'd custom malware in ATM slurp heist scheme

Russian cybercrooks contracted a virus writer to develop custom-made malware before launching a plot to loot compromised ATM machines.

Although the gang mostly from Yakutsk, a mid-sized city close to the Artic Circle in Siberia were ultimately caught, the sophistication, planning and investment that went into their plot ought to be a wake-up call for the banking industry.

The Moscow-based leader of the gang contacted a virus writer through an underground forum and paid him 100,000 rubles ($3,200) to create malware capable of infecting ATMs, security site Host Exploit reports.

A series of corrupt banking industry insiders had already been recruited by the gang. One leading member of the gang worked as a system admin for a bank, a role that gave him the opportunity to distribute the malware on ATMs. He needn't have worried too much about his bosses getting wind of the scheme because one of his cohorts was the bank's head of IT. Once in place, the malware allowed the gang to obtain bank card details and associated PIN codes for later fraud.

Other members of the group were to act as money mules, cashing out funds from compromised accounts, before funds were distributed. Fortunately officers from the Ministry of the Interior got wind of the scam and arrested the gang before the devilish scheme came to fruition. Police mounted a series of raids leading to arrests as well as the seizure of malware samples, credit card records and computer equipment used to carry out the alleged scam. The alleged virus writer was also captured in the round-up.

A Google translation of a Russian Ministry of the Interior statement on the case can be found here.

Anti-virus skulduggery - upgrade licence clock shock slammed

Anti-virus vendors AVG and Symantec have been criticised for sharp practices in selling consumer antivirus upgrades.

Every year security vendors bring out new versions of their products with improved engines and better technologies (behaviour blocking, improved speed performance and cloud-based-detection, for example). Marketing emails or product pop-ups from Symantec (which markets its Norton line of security software to consumers) and AVG encourage users to upgrade at a discount but with an allegedly hidden catch.

If consumers upgrade early in response to these emails, they lose the remaining licence period for their existing software. A Which? investigation said that although AVG and Symantec reset the clocks when users upgrade, the practice is not uniform across the industry. Other vendors, such as Panda Security, transfer across the remaining licensing period.

Meanwhile, McAfee said it doesn't send out reminders about upgrading until users' yearly subscriptions are about to expire.

Symantec defended its practices, arguing that the conclusions reached by Which? were misleading because they ignored the warnings it provides to consumers who upgrade early, among other reasons.

Symantec considers Which? Computings press release entitled Anti-virus companies antisocial practices misleading to customers for several reasons.

Firstly, Which? has not clarified the distinction between product upgrades and subscription renewals, and we believe the press release may mislead customers into believing that they will lose subscription time when they renew their current product or download the latest version of their product.

Secondly, Which? suggests incorrectly that customers who upgrade to a different product prior to the expiration of the time remaining on their existing product subscription are not informed that any time remaining on their existing product subscriptions will not be added to their upgrade.

Symantec gives customers the option of renewing their Norton product subscriptions or purchasing upgrade products containing additional security features.

More details on the Which? investigation can be found here.

Supermarket techie in mega loyalty-point blag

A London IT worker has been found guilty of fraud offences related to scamming supermarket Sainsbury's out of loyalty points worth 70,000.

James Stevenson, 45, of Muswell Hill, was a lead analyst programmer for Sainsbury's and used his position to set up several different accounts to collect the Nectar reward points.

Stevenson was found guilty last month of fraud by false representation for using the dodgy points to buy 8,120 worth of shopping, the Tottenham Journal reports.

He also admitted an offence of theft for transferring loyalty points with a theoretical value of 73,207.80 to accounts which he controlled. Given how slowly such points accrue, we're assuming millions of pounds' worth of purchases would normally be required to build up such a hefty total.

The judge has released Stevenson on bail to spend Christmas with his family while pre-sentencing reports are prepared.

But he warned that a custodial sentence was the likely outcome. Stevenson had run the scam since 2002.

Unreleased Lady Gaga songs nabbed in audacious hack

Friday, December 3, 2010

A pair of Germans allegedly used malware to break into computers used by managers and agents of more than 50 music stars including Lady Gaga and Justin Timberlake.

The two as yet unnamed hackers - a 17-year-old from Duisburg and a 23-year-old from Wessel, both in the Ruhr Area of Western Germany - used unspecified malware to spy on email, private photos and early copies of unreleased songs.

The duo allegedly attempted to profit from their crime by offering unreleased tracks for sale on the net. The compromised computers were more likely those used by the entourages and contacts of stars rather than singers themselves, but this point is also somewhat unclear.

The pair also allegedly attempted to run an extortion scam against American singer Ke$ha using stolen naked pictures of her, The Daily Telegraph reports. Reports in the German media suggest the would-be blackmailers were perhaps more interested in coercing Ke$ha into arranging a public DJ battle.

A investigation over the release of bootleg songs featuring US singer Kelly Clarkson involving US and German authorities led to the arrest of the pair, who have been questioned but not yet charged over the case. It seems the duo may have made unwise comments on internet forums, leading investigators to them.

Half of phish marks respond to scams within one 'golden hour'

Half the victims of phishing emails respond to fraudulent emails within an hour of the receipt of scam messages, according to to a study by transaction security firm Trusteer.

Within five hours, more than 80 per cent of the total pool of potential victims have responded, a figure that rises to 90 per cent after the first 10 hours of a phishing attack.

The findings have implications for the fight against fraudulent websites that attempt to hoodwink the unwary into handing over online banking credentials or similar sensitive information. Banks and information security suppliers need to work together to identify, block and take down scam websites as quickly as possible or else the damage may already be done.

"The fact that so many internet users visit a phishing website within such a short period of time means that blocking a phishing website which is sometimes a cracked legitimate site within the [first] golden hour has become absolutely critical," Trusteer chief technology officer Amit Klein said. "Blocking a phishing site after five to 10 hours is almost irrelevant."

Trusteer's Rapport browser lock-down transaction technology is offered as a voluntary download by 50 banks worldwide, including NatWest and HSBC in the UK, so it has a commercial interest in stressing the need for pro-active defences against phishing attacks.

This point is worth bearing in mind but does not negate the findings of its research or, in particular, its conclusion that the swift take-down of phishing sites is essential in combating this type of banking fraud.

Wikileaks' DNS pulls plug, citing collateral DDoS damage

Domain name provider EveryDNS has pulled the plug on Wikileaks after giving the site 24 hours' notice that it could not put up with the denial of service attacks the site was attracting.

The DNS provider said that it had sent messages by email and via Twitter and through the chat function of its website to warn Wikileaks that it was in breach of its terms and conditions and was at risk of termination. No response was received. Messages were sent 10pm EST 1 December. Services were terminated at 10pm 2 December.

The provider said: "Any downtime of the wikileaks.org website has resulted from its failure to use another hosted DNS service provider."

EveryDNS said:

Specifically, the services were terminated for violation of the provision which states that "Member shall not interfere with another Member's use and enjoyment of the Service or another entity's use and enjoyment of similar services". The interference at issues arises from the fact that wikileaks.org has become the target of multiple distributed denial of service (DDOS) attacks. These attacks have, and future attacks would, threaten the stability of the EveryDNS.net infrastructure, which enables access to almost 500,000 other websites.

The temporary loss of its website will have little impact on Wikileaks. Various Wikileak mirror sites are available and the files are also on BitTorrent and elsewhere.

Wikileaks' various media partners are also hosting the cables; today's "revelation" is that British troops in Afghanistan were over-stretched and under-resourced.

Meanwhile Wikileaks spokesman Julian Assange, currently in the UK, is wanted for sex offences in Sweden where many Wikileaks operations are based. He is the subject of an Interpol Red Notice, which is a procedure used to "seek the arrest or provisional arrest of wanted persons with a view to extradition". The Mail predicts he will be arrested in the next few days. Police sources inform the Reg that the Red Notice has little relevance in intra-European cases, where a European warrant is required. Assange lost an appeal against issue of such a warrant yesterday.

The colourful leakmeister is believed to have given police his address when he arrived in Britain several weeks ago.

EveryDNS explains why it ended Wikileaks' services.

Google to sandbox Flash in Chrome

Security beefed up around troublesome Adobe Flash Player.

Google is working on sandboxing Adobe's Flash Player to better protect users of the Chrome browser.

Adobe's products have come under fire as "easy pickings" for online attackers, and the company has already sandboxed its own Reader software.

The Chrome Flash sandbox has now been released on the developers channel for users of Windows XP, Vista and 7. It uses the same system as Chrome's current sandbox tech, which blocks applications from accessing "sensitive resources," said software engineers Justin Schuh and Carlos Pizano, in a post on the Google Chrome blog.

Now, that system is being extended to the third-party app. "This implementation is a significant first step in further reducing the potential attack surface of the browser and protecting users against common malware," they added.

"In particular, users of Windows XP will see a major security benefit, as Chrome is currently the only browser on the XP platform that runs Flash Player in a sandbox."

Google said its developers were working on ways to use the system to protect against more types of attacks, and would eventually roll out the sandbox for Flash on other platforms.

 

This article originally appeared at pcpro.co.uk

Copyright © PC Pro, Dennis Publishing


Lieberman Introduces Anti-WikiLeaks Legislation

Senator Joseph Lieberman and other lawmakers on Thursday introduced legislation that would make it a federal crime for anyone to publish the name of a U.S. intelligence source, in a direct swipe at the secret-spilling website WikiLeaks.

“The recent dissemination by Wikileaks of thousands of State Department cables and other documents is just the latest example of how our national security interests, the interests of our allies, and the safety of government employees and countless other individuals are jeopardized by the illegal release of classified and sensitive information,” said Lieberman in a press release. “This legislation will help hold people criminally accountable who endanger these sources of information that are vital to protecting our national security interests.”

The so-called SHIELD Act (Securing Human Intelligence and Enforcing Lawful Dissemination) would amend a section of the Espionage Act that already forbids publishing classified information on U.S. cryptographic secrets or overseas communications intelligence — i.e., wiretapping. The bill would extend that protection to information on HUMINT, human intelligence, and make it a crime “to publish the names of human intelligence informants” used by military or intelligence agencies, according to the press release.

Lieberman (ID-CT) has been going after WikiLeaks with a fury he once reserved for Stubbs the Zombie, pressuring first Amazon, and then data-visualization company Tableau, to blacklist the secret spilling site in the wake of this week’s State Department leak.

Based on the description in the press release (.pdf) from the Homeland Security and Governmental Affairs Committee, which didn’t respond to queries from Wired.com, Lieberman’s proposed solution to WikiLeaks could have broad implications for journalists. It might make it a crime, for example, for a journalist to report that former Panamanian dictator Manuel Noriega was once a paid CIA asset.

One thing it won’t do is put WikiLeaks, or founder Julian Assange, in any new legal jeopardy over the “Cablegate” database, the Afghan war logs, or the organization’s other recent high-profile leaks. That’s because the Constitution imposes a total ban on ex post facto criminal laws.

WikiLeaks first started getting heat over U.S. intelligence sources when it published a detailed and mostly classified log of 77,000 events in the U.S.-led war in Afghanistan last July. Though it took some steps to keep informant’s names from the release, some of the published records nonetheless contained the names of Afghan informants, whom the Pentagon and various NGOs have said face potentially deadly reprisal from the Taliban. Months later, though, there have been no confirmed reports of anyone coming to harm from that leak.

WikiLeaks was more cautious with the 400,000 entry Iraq war logs it published in October, using an automated script to redact names from the data dump. And with the quarter-million State Department cables, WikiLeaks is trickling out the documents about 80 at a time, and apparently manually purging the names of U.S. sources as it goes.

But on Thursday a German politician admitted that he’d passed confidential information to U.S. diplomats, after a WikiLeaks cable describing an anonymous, well-placed U.S. informant in Germany set off a mole-hunt within that country’s Free Democratic Party.

The SHIELD Act is co-sponsored by senators John Ensign (R-NV) and Scott Brown (R-MA). The text of the bill wasn’t sent out with the announcement, nor is it on any of the lawmakers’ websites, or in Congress’ Thomas database. Maybe someone will leak it.


Feds Warrantlessly Tracking Americans Credit Cards in Real Time

Federal law enforcement agencies have been tracking Americans in real-time using credit cards, loyalty cards and travel reservations without getting a court order, a new document released under a government sunshine request shows.

The document, obtained by security researcher Christopher Soghoian, explains how so-called “Hotwatch” orders allow for real-time tracking of individuals in a criminal investigation via credit card companies, rental car agencies, calling cards, and even grocery store loyalty programs. The revelation sheds a little more light on the Justice Department’s increasing power and willingness to surveil Americans with little to no judicial or Congressional oversight.

For credit cards, agents can get real-time information on a person’s purchases by writing their own subpoena, followed up by a order from a judge that the surveillance not be disclosed. Agents can also go the traditional route — going to a judge, proving probable cause and getting a search warrant — which means the target will eventually be notified they were spied on.

The document suggests that the normal practice is to ask for all historical records on an account or individual from a credit card company, since getting stored records is generally legally easy. Then the agent sends a request for “Any and all records and information relating directly or indirectly to any and all ongoing and future transactions or events relating to any and all of the following person(s), entitities, account numbers, addresses and other matters…” That gets them a live feed of transaction data.

DOJ powerpoint presentation on Hotwatch surveillance orders of credit card transactions

It’s not clear what standards an agent would have to follow to get a “Hotwatch” order. The Justice Department told Sogohian the document is the only one it could find relating to “hotwatches” — which means there is either no policy or the department is witholding relevant documents.

The Justice Department did not return a call for comment.

Every year, the Justice Department does have to report to Congress the numbers of criminal and national security wiretaps undertaken, as well as the number of National Security Letters issued. Tens of thousands of NSLs are issued yearly — most with gag orders that forbid ISPs or librarians from ever saying they have ever been served with such a subpoena.

But the Justice Department does not report or make public the number of times it got real time or historic cell phone location information, nor how often it is using these so-called “hotwatch” orders.

Photo courtesy <a href=”http://www.flickr.com/photos/thetruthabout/“>TheTruthAbout</a>.

See Also:

  • Feds: Privacy Does Not Exist in Public Places
  • Caught Spying on Student, FBI Demands GPS Tracker Back
  • FBI Use of Patriot Act Authority Increased Dramatically in 2008
  • FBI Spyware: How Does the CIPAV Work? UPDATE
  • Court OKs Warrantless Cell-Site Tracking

Most Recent Post

MORE ON ARCHIVE
Widget by Mad Tomato

Help Me Expose This Article in Bulk!

Bookmark & Share

- OR -

SELECT YOUR PREFERRED ONE:

Bookmark and Share