Wordpress traces 2nd DDoS assault to China

Monday, March 7, 2011

Blogging service WordPress suffered a further series of denial of service assaults on Friday, days after recovering from a particularly debilitating attack.

WordPress.com, which serves 18 million sites, traced the vast majority of the attack traffic of the latest assault back to China. Analysis pointed to a Chinese language site as one of the principal targets of the attack.

This as-yet-unnamed site is blocked by Chinese search engine Baidu, prompting speculation that the attack might be politically motivated. However, a closer inspection of events led Wordpress to conclude that commercial motives were probably behind the attack, TechCrunch reports.

Separately the French finance ministry has admitted that it came under a sustained and targeted attack in December, targeting files related to the G20 summit that took place in Paris two months later. More than 150 computers at the ministry were affected, the BBC reports.

Paris Match magazine, which broke the story, quotes an anonymous official who told it: "We noted that a certain amount of the information was redirected to Chinese sites. But that [in itself] does not say very much."

WP Forum Server "topic" Parameter SQL Injection

WP Forum Server is a plugin for Wordpress. The plugin is exposed to an SQL injection issue because it fails to properly sanitize user-supplied input before using it in an SQL query. Specifically, the application fails to sanitize data supplied to the 'topic' parameter of the "/wp-content/plugins/forum-server/feed.php" script. WP Forum Server version 1.6.5 is affected.

Ref: http://www.htbridge.ch/advisory/sql_injection_in_wp_forum_server_wordpress_plugin.html

11.10.26 - CVE: Not Available
Platform: Web Application - SQL Injection

Charlie Sheen fake filth flick powers Facebook survey scam

Scammers have exploited actor Charlie Sheen's increasingly bizarre antics as a lure for the latest in a long line of survey scams on Facebook.

Would-be voyeurs/victims are typically exposed to the scam via messages promising links to a supposed homemade sex tape featuring Sheen and supposedly released by his ex-wife.

Surfers are invited to think the clip may feature Sheen's live-in girlfriends Bree Olson (a star of professionally made grumble flicks) and Natalie Kenly.

In reality, surfers are directed to a video player that resembles YouTube, before being exposed to a survey scam popup. Unlike many such scams the Sheen lure actually offers would-be marks video content, though unsurprisingly not the material they might have expected.

"The video you are sent to is a spoof from break.com that makes fun of Sheen by dubbing his voice over a fake sex video," reports Chester Wisniewski, a senior security advisor at net security firm Sophos.

A full write-up of the scam can be found here.

Google vanishes 'DroidDream' malware from citizen phones

Google has acknowledged that it removed "a number" of malicious malware applications from the Android Market on March 1, and it has now reached out over the airwaves to remove the apps from end users devices as well.

Last week, reports indicated that more than 50 Android apps had been loaded with info-pilfering software known as DroidDream. Google immediately responded by pulling the apps from the Market, but the company remained silent on the matter until tossing up a blog post on Saturday evening.

According to Google, the malware exploited known vulnerabilities that had been patched in Android versions 2.2.2 and higher. Google "believes" the attacker or attackers was only able to gather device-specific information, including unique used to identify mobile devices and the version of Android running on the device. But the company added that attackers could have accessed other data.

In addition to removing the apps from the Android Market, Google suspended the accounts of the developers involved and contacted law enforcement about the attack, and as it did on one previous occasion, the company used the "kill switch" that lets it remotely remove mobile apps that have already been installed by end users.

Google maintains a persistent connection to Android phones that let the company not only remotely remove applications from devices but remotely install them as well. The remote install tool is used when Android owners purchase apps via the new web incarnation of the Android Market. The Android Market Web Store lets you browse and purchase applications via a browser, as opposed to Android client loaded on handsets.

Apple maintains its own "kill switch" for the iPhone. In 2008, an iPhone hacker told the world that Apple had added an app kill switch to the iPhone, and Steve Jobs later confirmed its existence. "Hopefully, we never have to pull that lever," Jobs said, "but we would be irresponsible not to have a lever like that to pull."

On Saturday, Google also said that it is pushing a security update to all Android devices affected by the malware in question. If your device was affected, the company said, you will receive an email from android-market-support@google.com, and you'll get a notification on your phone that a package called Android Market Security Tool March 2011 has been installed. You may also receive a notification that the offending apps have been removed.

The company is taking additional measures to stop such attacks in the future, but it did not provide specifics. "We are adding a number of measures to help prevent additional malicious applications using similar exploits from being distributed through Android Market and are working with our partners to provide the fix for the underlying security issues," the blog post read.

DDoS takes out Korean, US defence websites

Prelude to cyberwar?

Distributed denial-of-service attacks were directed at 29 South Korean Government websites including those hosted for the President late last week.

Sites affected included those hosted by US forces, the military Joint Chiefs of Staff, the ministries of foreign affairs, defence and unification, parliament and the tax office.

The website of South Korean IT security company AhnLab warned visitors that attacks were aimed at its domestic site and system damage caused by malicious code had been discovered.

The incidents began at 10:00am local time and the Korean Government said it was working with internet security agencies and others to deal with the problem.

An official from the presidential office told BBC News that "there was a DDoS attack, but no damage was done".

In in July 2009, attacks against South Korea and the US were blamed on North Korea.

In that instance, there were no reports of financial damage or data breaches and the alleged attacks seemed aimed to paralyse websites.

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, US edition


Trojans still reigning in malware top 10

Trojan-based attacks continue to be the biggest malware treat, a report from GFI Software has shown.

Trojans account for six of the top 10 malware threats of February and the report also confirmed the supremacy of Trojan.Win32.Generic!BT as the number one bug, growing from last month to 22.97 per cent of total detections.

Once in a user’s system, these Trojans, associated with fake security programs, perform a scan of the computer and produce false warnings so that victims who take the bait buy malicious security software.

“These types of attacks notoriously cause a great deal of stress for the victim in addition to simply infecting their computer,” said Chris Boyd, senior threat researcher at GFI Labs.

GFI Labs also pointed to the growth of other forms of malware, which tend to be harder to detect. Among those are PDF exploits, which have shown a small increase since January.

“PDF exploits continue to be problematic, showing a small increase since January. February has also seen continued use of fake Java applet installs to infect PCs with malware,” Boyd said.

“With new attacks popping up every day, users need to always stay cautious and research programs they plan to download when there is any doubt.”

He also pointed to infected videogame patches distributed on P2P networks and phishing attempts on popular retailer Play.com.

This article originally appeared at itpro.co.uk

Copyright © ITPro, Dennis Publishing


Sony wins subpoenas revealing visitors to PS3 jailbreaker site

Sunday, March 6, 2011

A federal magistrate has awarded Sony a subpoena allowing the company to obtain the IP addresses of everyone who visited the personal website of PlayStation 3 jailbreaker George Hotz for the past 26 months.

Magistrate Judge Joseph C. Spero of San Francisco also granted Sony's request for subpoenas on Google, Twitter, and another service for information relating to accounts held by the 21-year-old Hotz, who goes by the moniker GeoHot. Thursday's move comes in a lawsuit Sony filed in January alleging that Hotz and more than 100 other other hackers violated US copyright law by showing others how to bypass technical measures built in to the game console so they would run games and software not authorized by Sony.

Together, the subpoenas allow Sony to obtain a wealth of information about people who aren't named in the complaint and have been accused of no wrongdoing. That includes the IP address of everyone who has visited www.geohot.com since January 2009 and the account names of anyone who has accessed a private video relating to the jailbreak on Hotz's YouTube account. Other subpoenas give Sony access to Tweets posted or published by Hotz, and information about his account on the PSX-Scene website.

In court documents, Sony rejected arguments submitted by the Electronic Frontier Foundation that the requests were overly broad and violated Hotz's Free Speech rights. Sony said it needed the information to learn the identity of those who have downloaded the circumvention devices from Mr. Hotzs website" and to assess how rampant the access to and use of these circumvention devices has been in California in order to rebut Mr. Hotzs suggestion that his illicit conduct was not aimed at the forum state.

Sony attorneys also said they intended to discover information regarding all persons who currently have access to a 'private video' uploaded by Mr. Hotz demonstrating his use of the circumvention devices on the PS3 System, and those who posted comments in response to the video. Hotz posted the video on January 7 and later designated it as private, so it could be viewed only by select people.

The Sony document said that Hotz has already agreed not to oppose the subpoenas in exchange for Sony narrowing the scope of some of them.

The subpoenas were reported earlier by Wired.com, which has more here.

South Korea blitzed by DDoSers

Multiple South Korean government websites have come under fire from a concerted denial of service attack.

Local net security firm AhnLab reports that the South Korea's presidential office, the foreign ministry, the national intelligence service, US Forces stationed in South Korea and banks are among the targets of the packet-flooding assault. In total as many as 40 websites were targeted by the attack. However only 29 were actually affected, the BBC reports.

Previous denial-of-service attacks on South Korean government and financial services websites, including a particularly severe assault in 2009, were initially blamed on North Korea before they were traced back to compromised systems in China.

North Korea is known to maintain an information warfare unit that targets enemies of the country, chiefly South Korea and the US. However it's unclear who's behind the latest assault, much less their motives.

March Patch Tuesday leaves IE unpatched for Pwn2Own hackers

Microsoft unlike its browser rivals will not be patching Internet Explorer before the upcoming Pwn2Own hacking contest next week.

A March Patch Tuesday pre-alert, published on Thursday, reveals that Redmond will be issuing three security bulletins next week, one of which affects a critical flaw in Windows and none of which relates to IE. The critical update affects Windows XP, Vista and Windows 7 while the two lesser risk ("important") bulletins cover a separate flaw in Windows and an update for the Office Groove 2007 software.

Net security firm Qualys said it expected the important update would cover a recently discovered MHTML Information Disclosure bug.

Redmond last patched IE in February, while Mozilla and Google each patched Firefox (more info here) and Chrome (here) respectively earlier this week ahead of the annual fun and games of the Pwn2Own hacking contest.

Four browsers IE, Firefox, chrome and Apple Safari are in the firing line in the Pwn2Own contest, which will run from 9 to 11 March as part of the CanSecWest security conference in Vancouver next week.

Android malware attacks show perils of Google openness

This week's discovery of malware that hijacked tens of thousands of Android cellphones shows the pitfalls of Google's decision to make the operating system the Wikipedia of mobile platforms that offers apps written by virtually anyone.

A couple years ago, the choice helped the OS gain traction against Apple's more entrenched iPhone by quickly building out the number of apps available in the Android Market. Once developers pay a $25 registration fee, Google gives them complete control over when and how they make their applications available to users. Contrast that with Apple's App Store, which the company rules with an iron fist.

The recent discovery of some 55 malware-tainted apps available in the Android Market shines a bright light on the dark side of its openness. The malware hid in legitimate titles that had been repackaged and distributed by three developers. Once installed, the apps exploited known vulnerabilities that gave the malware root access to a phone's most sensitive functions, according to this analysis from Lookout, which provides antimalware apps for Android, Blackberry and Windows Mobile handsets.

A separate analysis provided by antivirus firm Kaspersky Labs said that DreamDroid, as the malware has been dubbed, connected to a server controlled by the attackers, where it appeared to access a list of applications to download and install on the already infected device. In other words, DreamDroid is a classic trojan backdoor downloader. The infected apps were downloaded by phones that numbered in the tens of thousands to hundreds of thousands, according to Market figures.

The mass infections are already prompting commentary comparing Android to Microsoft Windows.

The openness of the platform and the availability of alternative application markets makes Android-based devices more difficult to secure, security researcher Vanja Svajcer wrote on Sophos's Naked Security blog. The whole situation reminds me of Windows some years ago. One keeps wondering if history is repeating again?

If there's any vetting of apps submitted to the Android Market, there's no mention of it on Google's webpages, and the company's PR department didn't respond to questions asking about what kind of scrutiny it gives to software available in its Market. As The Reg has reported before, Google can remotely remove apps on users' Android phones, but by then a handset would already be infected.

And besides, as Lookout CTO and co-founder Kevin Mahaffey noted to The Reg: The really nasty thing about root exploits is that once you're root you can do things that disable the remote removal tool. In other words, Google's kill switch can itself be killed.

The episode demonstrates the ugly predicament confronting consumers of smartphone apps. One choice is to opt for the heavy-handed control exercised by Apple's App Store. You may not be able to run Flash-based software, use the alternative browser of your choice, or do any number of other things you want to do, but so far the marketplace, despite being around a lot longer, hasn't presented the kind of security menace we saw this week in Google's apps bazaar.

The Android Market's freewheeling nature, on the other hand, is more appealing to many because it feels more more. More like a stroll down the streets of New York, as opposed to a parade in a Steve Jobs version of Disney Land. Yeah, Android's openness is fun, but only until someone gets hurt.

Man sentenced for breaching former employer's computers

A Texas man has been ordered to pay restitution of $16,600 and a $5,000 fine after admitting he breached the server of an engineering firm that fired him and deleted sensitive files.

Ismael Alvarez of Andrews, Texas, was also sentenced to five years of probation and one year of home confinement.

In December, federal prosecutors accused Alvarez of accessing a protected computer owned by Gray Wireline Service and deleting about 68 files, many of which contained proprietary reports related to oil and natural gas wells. During the breach, which happened a few weeks after Alvarez was fired, he created a directory titled RENEGAGE RULES. Renegade is the name of a Gray Wireline competitor.

FBI agents tracked down Alvarez through the IP address used to access the Gray Wireline server. It corresponded to the account his used with his ISP.

Alvarez, who had worked for the company for more than seven years, joins a long list of disgruntled employees who sought revenge by breaching their employees' computer systems.

Developer: Google took a week to pull infected apps

Malware outbreak left to fester despite warning from developer

An Android developer has hit out at Google for the time it took to react to a malware attack on hijacked apps in its Market store.

There is continuing confusion over the severity of a rash of Android malware that forced Google to remove at least 21 apps from its Market, but developers have claimed Google could have reacted much more quickly after being informed of the threat more than a week ago.

The problem was brought to light by Reddit blogger Lompolo, who found the DroidDream virus in two apps listed on the official Market store.

After further investigation, the infected app count quickly rose to 21, while analysts at Lookout Mobile Security put the number of infected apps as high as 50.

The virus was been packaged into apps that were stolen from their original developers and reposted in the Market with the virus included.

Google finally contacted me and apologised for the delayed response, but there really should be a faster/easier way to get Google to act on it!

“I randomly stumbled into one of the apps, recognised it and noticed that the publisher wasn’t who it was supposed to be,” said Lompolo.

“Super Guitar Solo, for example, is originally Guitar Solo Lite. I downloaded two of the apps and extracted the APKs [Android Package files], they both contained what seems to be the 'rageagainstthecage' root exploit.”

While news of the virus emerged yesterday, the developer of the original app said he had known about the problem for more than a week, and received no response from Google despiting flagging the rogue apps as infected imposters.

“I'm the developer of the original Guitar Solo Lite,” the developer posted under the Reddit user name Coding Caveman. “I noticed the rogue app a bit more than a week ago because I was receiving crash reports sent from the pirated version of the app.

“I notified Google about this through all the channels I could think of: DMCA notice, malicious app reporting and Android Market Help.

"After yesterday's media coverage, Google finally contacted me and apologised for the delayed response, but there really should be a faster/easier way to get Google to act on it!"

Google has not issued a statement regarding the issue, but told PC Pro it was looking into the security problem, and three accounts that were posting the apps appear to have been removed from the Market.

According to Lompolo and Android security websites, the virus not only sends personal information such as the device number to overseas servers, but also opens a back door.

A full list of apps that might be affected can be found at the Lookout Mobile Security website, but the flaw used to root the operating system was fixed in Android 2.2.2 and 2.3, so anyone who has updated need only remove rogue applications.

This article originally appeared at pcpro.co.uk

Copyright © PC Pro, Dennis Publishing


Google in Android Market malware purge

Fifty impostors shown the door.

Google has removed dozens of apps from its Android Market after discovering they were malware that compromised users' personal data.

More than 50 apps were found to be infected with malware capable of gaining root access to a device, harvesting data and installing additional malicious code, computer security researchers said Wednesday. Before being pulled from the marketplace, the malicious apps were downloaded by at least 50,000 Android users within a four-day period.

A Google spokesman declined to comment.

The malicious apps were pirated versions of popular, legitimate apps that cybercriminals bundled with malware and republished in the Android Market under different application and publisher names. They were posed by the publishers with handles “Kingmall2010,” “we20090202,” and “Myournet,” all of whom have been suspended.

The first batch of 21 malicious apps, which came from the publisher Myournet, was discovered by a user of the news aggregation site Reddit. Researchers at mobile security provider Lookout discovered a second lot that was posted by Kingmall2010 and alerted Google, said its chief technology officer Kevin Mahaffey.

Google then discovered a third set that was posted by we20090202.

It removed the malicious apps within minutes of being notified, Mahaffey said.

“It's impressive how quickly they responded to these issues,” he said.

Even though the apps were posted from different developer accounts, the way the malware was packaged indicated they came from the same person, Mahaffey said.

Flip to the next page to peer inside the workings of the Android malware.

Copyright © SC Magazine, US edition


Manning to face death penalty

Aiding the enemy charge a capital offence.

UPDATE: US Government charges against Bradley Manning included illicitly accessing several secret databases in Iraq and Afghanistan and violating a Microsoft Sharepoint and Exchange database.

Bradley Manning faces the death penalty as charges against the US Army private were revealed yesterday.

The US Government said it would not seek the death penalty in the case of Manning, alleged to have leaked secret State Department cables to whistleblower site Wikileaks, but the decision was out of its hands, reported Wired's Threat Level security blog.

The charges were:

  • Aiding the enemy (capital offence)
  • Theft of public property or records (five counts)
  • Computer fraud (two counts)
  • Transmitting defence information in violation of the Espionage Act (eight counts),
  • Wrongfully causing intelligence to be published on the internet knowing it would be accessible to the enemy
  • Violating Army computer security regulations (five counts)

“The new charges more accurately reflect the broad scope of the crimes that private first class Manning is accused of committing,” said US military spokesman John Haberland.

Wired speculated the charges could impact the extradition of Wikileaks publisher Julian Assange from Britain for questioning in Sweden over alleged sex crimes there.

His supporters argued that Assange could be rendered out of Swedish hands to face the death penalty in the US if he was extradited.

"The assertion was considered an exaggeration at the time since even Manning was not facing a capital offence," wrote Wired reporter Kim Zetter.

"But the issue is sure to figure more prominently now in Assange’s appeal of UK court’s extradition order."

Manning has been kept in conditions his supporters claim amount to torture since his arrest last May.

The Manning charge sheet [PDF] is at Threat Level.

Copyright © SC Magazine, US edition


Android Market Apps Hit With Malware

The inevitable has happened with the Android marketplace: Google pulled nearly two dozen apps Wednesday that were infected with malware capable of rooting devices and stealing data. The company is investigating dozens of others.

Users have downloaded as many as 200,000 of the free apps following their market appearance days ago. The apps ranged from games of chess to photo editors to those named “Super Sex Positions.” Google confirmed that they pulled the apps from the 2-year-old market early Wednesday.

“This is the first time there has been a widespread attack. This is the first time we’ve seen it in the real official Android marketplace,” Chris Wysopal, chief technology officer at Veracode, said in a telephone interview.

Wysopal, who said plenty of apps have been infected in overseas markets, added that it was inevitable that the Android app market would become home to malicious apps. He said the infected apps could insert software into a phone anonymously and make the phone click ads or send premium SMS messages.

There was no immediate evidence that any of the potential exploits actually happened.

Wysopal suggested that Google should begin vetting apps like Apple does for its platform.

“This was inevitable. The model has to be that the applications need to be vetted before they are available for download,” he said.

Google declined to address Wysopal’s statement on the record. But it provided its developers’ conditions agreement and a CNET story about the security of Android and Apple apps.

The Android attackers, meanwhile, downloaded legitimate applications and uploaded similar pirated versions back to the market with malware.

Dave Marcus, director of security research at McAfee Labs, said in an e-mail that “in terms of attacks and malware, it doesn’t get any worse than root access, which this malware has.”

Google is remotely removing the apps from Android devices. Security experts said phone owners who have downloaded the apps should wipe and “reset” their phones to their original state.

Here are some of the offending apps:

  • Falling Down
  • Super Guitar Solo
  • Super History Eraser
  • Photo Editor
  • Super Ringtone Maker
  • Super Sex Positions
  • Hot Sexy Videos
  • Chess
  • Hilton Sex Sound
  • Screaming Sexy Japanese Girls
  • Falling Ball Dodge
  • Scientific Calculator
  • Dice Roller
  • Advanced Currency Converter
  • App Uninstaller
  • Funny Paint
  • Spider Man

See Also:

  • Iran: Computer Malware Sabotaged Uranium Centrifuges
  • Bank of America Employee Charged With Planting Malware on ATMs
  • Take From ATM Malware Caper Exceeded $200000
  • New ATM Malware Captures PINs and Cash Updated
  • New Malware Re-Writes Online Bank Statements to Cover Fraud
  • New York Times Reforms Online Ad Sales After Malware Scam
  • Spoofed Cell Phone Texts Post Malware Threat
  • Cybercrooks Trick Gawker Into Serving Malware-Laced Ad
  • Researcher Demonstrates ATM ‘Jackpotting’ at Black Hat Conference
  • TSA Worker Gets 2 Years for Planting Logic Bomb in Screening

Nude Airport Scanners: Are They Safe?

Part 1:
Are They Constitutional?Part 2:
Are They Safe?

Part 3: Do They Work? March 8

John Sedat, a biochemistry and biophysics professor, says he’s not going to get on an airplane again — at least not until the TSA rethinks its deployment of hundreds of body scanners that hit travelers with a tiny amount of radiation.

“I’m not going to go through these machines. And I’m not going to be groped either,” the 68-year-old University of California, San Francisco, scientist said in a recent telephone interview. “Us older people are probably only one mutation away from melanoma. I’m not going to go through these machines and basically ask for the problem. We all know the older you get the more sensitive you are to sunlight and X-rays.”

Sedat is the most outspoken member of a small community of scientists raising health alarms over a type of ”advancedimagingtechnology” scanner installed at U.S. airports. Already controversial on privacy grounds, the AIT scanners allow airport screeners to see through apassenger’sclothing to check for concealed explosives and weapons. They’re the subject of a high-profile lawsuit by theElectronic Privacy Information Center set to be heard by the U.S. Court of Appeals for the District of Columbia Circuit on March 10.

The EPIC lawsuit argues that the machines are invasive, ineffective and unsafe. “I view this as an uncontrolled radiological experiment,” said John Verdi, an EPIC attorney on the case.

For Sedat, the alleged safety issue is the important one. Of concern to him and other health critics are thebackscatterX-ray body scanners produced by Rapiscan Systems, which the TSA began rolling out last year. They constitute about half of the AIT machines deployed.

Unlike the competing millimeter-wave technology produced byL-3 Communications, the $180,000 Rapiscan machines expose travelers to a small X-ray dose.The TSA and Rapiscan say the machines are safe. But in an April letter to the White House, Sedat and fellow UCSF academics argued the government did not adequately study the backscatter X-ray devices.TheTSA has ordered 500 of the Rapiscan devices at about $180,000 each. About 250 of them are already in use across the country.

“As longstanding UCSF scientists and physicians, we have witnessed critical errors in decisions that have seriously affected the health of thousands of people in the United States” (.pdf), they wrote, noting the failure of the Centers for Disease Control to recognize the risks of blood transfusions at the outset of the AIDS epidemic. “These unfortunate errors were made because of the failure to recognize potential adverse outcomes of decisions made at the federal level.”

Rapiscan provides these radiation dose comparisons. The scale is in

The TSA declined to be interviewed for this story. But in court documents and on its website, the administration refers to a host of studies suggesting the machines are safe.”The potential health risks from a full-body screening with a general-use X-ray security system are minuscule,” John McCrohan, the FDA’s deputy director for radiological initiatives, wrote the White House in October in response to the San Francisco scientists’ concerns.

The Johns Hopkins University Applied Physics Laboratory, which analyzed the Rapiscan 1000 at the company’s Los Angeles office, published the leading and most often-cited study (.pdf) in October.The 49-pagereport,released in a redacted form,concludes that the machines leak virtually no radiation to TSA staff and nearby passengers, and expose the traveler being scanned to only a fraction of the maximum exposure level deemed medically safe.

“You would have to go through the scanner 1,000 times to equate to one medical X-ray,” said Peter Kant, Rapiscan’s executive vice president, summarizing the study. “You get twice as much radiation when eating a banana than when going through the scanner.”

Sedat counters that the mechanical beam’s intensity level has not been published, making it impossible to evaluate the safety claims. “I want a real hard number in terms of photons per some unit of area,” he said. “The one physical quantity that is crucial for determining what dose a person is getting, that data is missing.”

Moreover, standard medical X-ray machines disperse radiation throughout the body, whereas the airport scanners penetrate to about skin level. That means there is a high concentration of radiation on a single organ — the skin — which was not accounted for in the Johns Hopkins report, Sedat said.

The “correct way” to test any such technology, he said, is to use mice “and appropriate tissue-culture cells and see if there is a biological response.”

“That kind of stuff has never been done,” he said.

Arizona State University physicist Peter Rez, a leading authority on X-ray technology, agrees on that point: More studies should be conducted before the machines become even more widely deployed to U.S. airports.

It’s a debate that plays out in the statistical hinterlands. Many critics of the technology agree that the increased cancer risk to any individual traveler is infinitesimal. But U.S. airports handle 700 million passengers annually — a large enough number that a small uptick in overall cancer risk can scale to a real-life concern.

Left: Backscatter X-ray scan. Right: millimeter-wave scan.

If the scientist critics are right, then it boils down to the cold calculus of whether more lives are saved by the marginal increase in security than are put to risk by the marginal dangers of the technology.

“Your probability of getting blown up by a terrorist is probably lower than getting cancer from these,” Rez said.

David Brenner, who heads the Center for Radiological Research at Columbia University, said he might favor the X-ray scanners if the government used a safer alternative that performs the same function: namely, the millimeter wave scanners, which “as far as we know, have no known safety issues associated with them.”

“I have argued that it is reasonable to suggest that X-ray backscatter scanners are ’safe’ for an average individual, and probably so even for a child, a radiosensitive individual, or a very frequent flier,” he said in an e-mail interview. “So I would agree with Hopkins and the FDA. But I have also argued here that the move from using these scanners as a secondary screening measure to their use as a primary screening measure, with the potential for up to one billion whole-body X-ray scans per year in the U.S., may profoundly change the likely … long-term population cancer risk.”

“As I said before, if there were no alternatives, X-ray backscatter systems might still be reasonable, in terms of balancing benefits and risks,” he wrote.

Rapiscan and its parent OSI Systems, and their subcontractors have donated a combined $1.75 million to federal politicians in the past decade, according to data provided by the MapLight Foundation, of Berkeley, California. Rapiscan and OSI also spent $2.2 million in lobbying from 1998 to 2010, MapLight found. (Here is spreadsheet forpolitical and lobbying expenditures (.xls)for L-3 Communications and for Rapiscan-OSI.)

The company even retained former Department of Homeland Security chief Michael Chertoff as a lobbyist. Chertoff has emerged as a huge proponent of airport body scanners. He wrote in a Washington Post editorial last year that the government should “fund a large-scale deployment” of the devices. His opinion piece, which touted that the devices detect explosives and plastics, did not mention Chertoff’s previous work for the company.

Kant, Rapiscan’s executive vice president, stands behind the scanners.

“I feel completely safe,” he said, “with my family going through these.”


WordPress cdnvote "cdnvote-post.php" Multiple SQL Injection Vulnerabilities

WordPress is a web-based blogging application. The application is exposed to multiple SQL injection issues because it fails to properly sanitize input in the "dnvote_post_id" and the "cdnvote_point" parameters of the "cdnvote-post.php" script. cdnvote version 0.4.1 is affected.

Ref: http://www.securityfocus.com/archive/1/516587

11.9.24 - CVE: Not Available
Platform: Web Application

Review: Core Security Technologies Core Impact Professional

Not a cheap penetration testing tool, but given its performance it can be excellent value. The premise behind this product has always been efficient penetration testing. That is what it does, what it focuses on, and how its developers present it to the market. This philosophy has worked well for Core.Impact Professional is, at first blush, an extremely capable pen testing tool. But it really is a lot more. Integration with a vulnerability scanner is an option and it can do a penetration scan or one can select individual exploits. This allows a tiered approach to pen testing for large organisations. Operational personnel can perform regularly scheduled penetration scans and vulnerability specialists can pick up after the scan and perform more in-depth analysis.Core Impact Professional covers network vulnerabilities, email, Wi-Fi and web applications. Client-side vulnerabilities also can be simulated, allowing a full picture of exploitable vulnerabilities in today's enterprises. The depth into which a penetration tester can go with this product is another solid benefit. Since exploit scripts are accessible and written in a standard language, the tester can modify them or create entirely new ones. This allows development of tests for zero-day exploits as they are discovered.Documentation is complete. Allowed IP ranges are embedded in the product on a per-customer basis, limiting the likelihood that the tool will be used improperly by a rogue employee. We have used Impact Professional in the SC Lab for the past few years and have found its performance to be first rate even on underpowered platforms. For pen testers on the go, laptop installation is no problem. That said, it will use all the resources that one allows it, so if installed on a large, powerful computer, it works with blazing speed. We also have used it successfully in a VMware vSphere 4.x environment.
This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


Twitter crime up 20%

Illicit activity on Twitter spiked during 2010.

The crime rate on Twitter shot up by 20 per cent last year, after a lull towards the end of 2009.

In the second half of 2010, crime on Twitter reached two per cent, against just 1.6 per cent in the first half of the year, research by Barracuda Labs found.

The crime rate was defined as the percentage of accounts created every month that were eventually suspended for malicious or suspicious activity, or otherwise misused.

The study looked at the activity of over 26 million Twitter accounts.

The rise in Twitter crime comes at a time when concerns about social media security are increasing.

“Attackers focus on where they can get the most eyeballs and profit, and today that means social networks and search engines,” said Dr Paul Judge, chief research officer at Barracuda Networks.

“As a community we often point to the need for user education as the missing component; however, the levels of social engineering involved in today's attacks suggest that we must continue to elevate our technological approaches.”

Judge said the research community needed to come up with some innovative defences, which industry should work to push out sooner rather than later.

Free profile security

In line with the research, Barracuda released a free Profile Protector designed to safeguard users from threats circulating on Facebook and Twitter.

The application analyses user-generated content posted to profiles and can block or remove malicious or suspicious content, such as bad links posted on Facebook and Twitter pages and news feeds.

This article originally appeared at itpro.co.uk

Copyright © ITPro, Dennis Publishing


Man sentenced for breaching former employer's computers

A Texas man has been ordered to pay restitution of $16,600 and a $5,000 fine after admitting he breached the server of an engineering firm that fired him and deleted sensitive files.

Ismael Alvarez of Andrews, Texas, was also sentenced to five years of probation and one year of home confinement.

In December, federal prosecutors accused Alvarez of accessing a protected computer owned by Gray Wireline Service and deleting about 68 files, many of which contained proprietary reports related to oil and natural gas wells. During the breach, which happened a few weeks after Alvarez was fired, he created a directory titled RENEGAGE RULES. Renegade is the name of a Gray Wireline competitor.

FBI agents tracked down Alvarez through the IP address used to access the Gray Wireline server. It corresponded to the account his used with his ISP.

Alvarez, who had worked for the company for more than seven years, joins a long list of disgruntled employees who sought revenge by breaching their employees' computer systems.

Sony wins subpoenas revealing visitors to PS3 jailbreaker site

Saturday, March 5, 2011

A federal magistrate has awarded Sony a subpoena allowing the company to obtain the IP addresses of everyone who visited the personal website of PlayStation 3 jailbreaker George Hotz for the past 26 months.

Magistrate Judge Joseph C. Spero of San Francisco also granted Sony's request for subpoenas on Google, Twitter, and another service for information relating to accounts held by the 21-year-old Hotz, who goes by the moniker GeoHot. Thursday's move comes in a lawsuit Sony filed in January alleging that Hotz and more than 100 other other hackers violated US copyright law by showing others how to bypass technical measures built in to the game console so they would run games and software not authorized by Sony.

Together, the subpoenas allow Sony to obtain a wealth of information about people who aren't named in the complaint and have been accused of no wrongdoing. That includes the IP address of everyone who has visited www.geohot.com since January 2009 and the account names of anyone who has accessed a private video relating to the jailbreak on Hotz's YouTube account. Other subpoenas give Sony access to Tweets posted or published by Hotz, and information about his account on the PSX-Scene website.

In court documents, Sony rejected arguments submitted by the Electronic Frontier Foundation that the requests were overly broad and violated Hotz's Free Speech rights. Sony said it needed the information to learn the identity of those who have downloaded the circumvention devices from Mr. Hotzs website" and to assess how rampant the access to and use of these circumvention devices has been in California in order to rebut Mr. Hotzs suggestion that his illicit conduct was not aimed at the forum state.

Sony attorneys also said they intended to discover information regarding all persons who currently have access to a 'private video' uploaded by Mr. Hotz demonstrating his use of the circumvention devices on the PS3 System, and those who posted comments in response to the video. Hotz posted the video on January 7 and later designated it as private, so it could be viewed only be select people.

The Sony document said that Hotz has already agreed not to oppose the subpoenas in exchange for Sony narrowing the scope of some of them.

The subpoenas were reported earlier by Wired.com, which has more here.

WordPress comes under 'extremely large' web attack

WordPress came under massive attack on Thursday, causing disruptions for many of the sites that rely on the webhosting platform to publish their content.

WordPress.com is currently being targeted by a extremely large Distributed Denial of Service attack which is affecting connectivity in some cases, Sara Rosso, a representative of WordPress owner Automatic, said in a statement released to customers. The size of the attack is multiple Gigabits per second and tens of millions of packets per second.

The attack later subsided, but the vast amount of junk data being thrown at the company's servers while the DDoS, or distributed denial-of-service, attack was ongoing made it hard to defend against using standard countermeasures.

Rosso said WordPress was working with its upstream providers to mitigate any further attacks. She also said WordPress will be making our VIP sites a priority in this endeavor.

While significantly smaller than Google-owned Blogger and other hosts, WordPress is nonetheless a crucial platform for a large amount of the Web's population. In July Drupal estimated WordPress powered 8.5 percent of websites.

You have no idea how hard it was to get this post up, as WordPress.com, our blog host, is currently under a denial of service attack, TechCrunch reported. Its been almost impossible to access the TechCrunch backend for the past 10 minutes and users are receiving a 'Writes to the service have been disabled, we will be bringing everything back online ASAP' error message.

Antivirus provider Sophos also reported difficulties in posting stories to its Naked Security blog, but said traffic to its main website was unaffected because it used a different provider.

Android malware attacks show perils of Google openness

This week's discovery of malware that hijacked tens of thousands of Android cellphones shows the pitfalls of Google's decision to make the operating system the Wikipedia of mobile platforms that offers apps written by virtually anyone.

A couple years ago, the choice helped the OS gain traction against Apple's more entrenched iPhone by quickly building out the number of apps available in the Android Market. Once developers pay a $25 registration fee, Google gives them complete control over when and how they make their applications available to users. Contrast that with Apple's App Store, which the company rules with an iron fist.

The recent discovery of some 55 malware-tainted apps available in the Android Market shines a bright light on the dark side of its openness. The malware hid in legitimate titles that had been repackaged and distributed by three developers. Once installed, the apps exploited known vulnerabilities that gave the malware root access to a phone's most sensitive functions, according to this analysis from Lookout, which provides antimalware apps for Android, Blackberry and Windows Mobile handsets.

A separate analysis provided by antivirus firm Kaspersky Labs said that DreamDroid, as the malware has been dubbed, connected to a server controlled by the attackers, where it appeared to access a list of applications to download and install on the already infected device. In other words, DreamDroid is a classic trojan backdoor downloader. The infected apps were downloaded by phones that numbered in the tens of thousands to hundreds of thousands, according to Market figures.

The mass infections are already prompting commentary comparing Android to Microsoft Windows.

The openness of the platform and the availability of alternative application markets makes Android-based devices more difficult to secure, security researcher Vanja Svajcer wrote on Sophos's Naked Security blog. The whole situation reminds me of Windows some years ago. One keeps wondering if history is repeating again?

If there's any vetting of apps submitted to the Android Market, there's no mention of it on Google's webpages, and the company's PR department didn't respond to questions asking about what kind of scrutiny it gives to software available in its Market. As The Reg has reported before, Google can remotely remove apps on users' Android phones, but by then a handset would already be infected.

And besides, as Lookout CTO and co-founder Kevin Mahaffey noted to The Reg: The really nasty thing about root exploits is that once you're root you can do things that disable the remote removal tool. In other words, Google's kill switch can itself be killed.

The episode demonstrates the ugly predicament confronting consumers of smartphone apps. One choice is to opt for the heavy-handed control exercised by Apple's App Store. You may not be able to run Flash-based software, use the alternative browser of your choice, or do any number of other things you want to do, but so far the marketplace, despite being around a lot longer, hasn't presented the kind of security menace we saw this week in Google's apps bazaar.

The Android Market's freewheeling nature, on the other hand, is more appealing to many because it feels more more. More like a stroll down the streets of New York, as opposed to a parade in a Steve Jobs version of Disney Land. Yeah, Android's openness is fun, but only until someone gets hurt.

South Korea blitzed by DDoSers

Multiple South Korean government websites have come under fire from a concerted denial of service attack.

Local net security firm AhnLab reports that the South Korea's presidential office, the foreign ministry, the national intelligence service, US Forces stationed in South Korea and banks are among the targets of the packet-flooding assault. In total as many as 40 websites were targeted by the attack. However only 29 were actually affected, the BBC reports.

Previous denial-of-service attacks on South Korean government and financial services websites, including a particularly severe assault in 2009, were initially blamed on North Korea before they were traced back to compromised systems in China.

North Korea is known to maintain an information warfare unit that targets enemies of the country, chiefly South Korea and the US. However it's unclear who's behind the latest assault, much less their motives.

WordPress cdnvote "cdnvote-post.php" Multiple SQL Injection Vulnerabilities

WordPress is a web-based blogging application. The application is exposed to multiple SQL injection issues because it fails to properly sanitize input in the "dnvote_post_id" and the "cdnvote_point" parameters of the "cdnvote-post.php" script. cdnvote version 0.4.1 is affected.

Ref: http://www.securityfocus.com/archive/1/516587

11.9.24 - CVE: Not Available
Platform: Web Application

Judge Lets Sony Unmask Visitors to PS3-Jailbreaking Site

A federal magistrate is granting Sony the right to acquire the internet IP addresses of anybody who has visited PlayStation 3 hacker George Hotz’s website from January of 2009 to the present.

Thursday’s decision by Magistrate Joseph Spero to allow Sony to subpoena Hotz’s web provider (.pdf) raises a host of web-privacy concerns.

Respected for his iPhone hacks and now the PlayStation 3 jailbreak, Hotz is accused of breaching the Digital Millennium Copyright Act and other laws after he published an encryption key and software tools on his website that allow Playstation owners to gain complete control of their consoles from the firmware on up.

Sony also won subpoenas (.pdf) for data from YouTube and Google, as part of its lawsuit against the 21-year-old New Jersey hacker, as well as Twitter account data linked to Hotz, who goes by the handle GeoHot.

Bluehost maintains Hotz’s geohot.com site. The approved subpoena requires the company to turn over “documents reproducing all server logs, IP address logs, account information, account access records and application or registration forms” tied to Hotz’s hosting. The Bluehost subpoena also demands “any other identifying information corresponding to persons or computers who have accessed or downloaded files hosted using your service and associated” with the www.geohot.com website, including but not limited to the “geohot.com/jailbreak.zip file.”

Photo: itBox24/Flickr

Sony told Spero, a San Francisco magistrate, that it needed the information for at least two reasons.

One is to prove the “defendant’s distribution” of the hack.The other involves a jurisdictional argument over whether Sony must sue Hotz in his home state of New Jersey rather than in San Francisco, which Sony would prefer. Sony said the server logs would demonstrate that many of those who downloaded Hotz’s hack reside in Northern California — thus making San Francisco a proper venue for the case.

The DMCA prohibits the trafficking of so-called “circumvention devices” designed to crack copy-protection schemes. The law does not require Sony to prove that Hotz received payment for the hack, which was designed to allow PlayStation 3 owners the ability to run home-brewed software or alternative operating systems like Linux. It builds on a series of earlier jailbreaks that unlocked less protected levels of the PlayStation’s authentication process.

Jailbreaking a console is also a prerequisite to running pirated copies of games, which Sony emphasizes in its lawsuit.

“I think the these subpoenas, the information they seek, is inappropriate,” said Corynne McSherry, a staff attorney with the Electronic Frontier Foundation. In a letter to Magistrate Spero, she termed the subpoenas “overly broad.” (.pdf)

The judge also signed off on a Google subpoena seeking the logs for Hotz’s Blogger.com blog, geohotps.3.blogspot.com.

A YouTube subpoena, also approved, seeks information connected to the “geohot” account that displayed a video of the hack being used: “Jailbroken PS3 3.55 with Homebrew.”The subpoena demands data to identify who watched the video and “documents reproducing all records or usernames and IP addresses that have posted or published comments in response to the video.”

A fourth subpoena is directed at Twitter, demanding the disclosure of all of Hotz’s tweets, and “documents sufficient to identify all names, addresses, and telephone numbers associated with the Twitter account.”

Sony has threatened to sue anybody who posts the hacking tools or the encryption key. It is seeking unspecified damages from Hotz.

A hearing on whether Hotz will be tried in San Francisco or New Jersey is set for next month in San Francisco federal court.

See Also:

  • Sony to Inspect PlayStation Hacker’s Hard Drive
  • Sony Lawyers Expand Dragnet, Targeting Anybody Posting PlayStation …
  • LG Accuses Sony of Patent Infringement With PS3
  • Hacker Challenging Court Order to Surrender Computer Gear to Sony
  • Lawyer: PlayStation 3 Jailbreak Code Is a ‘Google Search Away
  • Sony Threatens to Terminate Service of PS3 Jailbreakers

March Patch Tuesday leaves IE unpatched for Pwn2Own hackers

Microsoft unlike its browser rivals will not be patching Internet Explorer before the upcoming Pwn2Own hacking contest next week.

A March Patch Tuesday pre-alert, published on Thursday, reveals that Redmond will be issuing three security bulletins next week, one of which affects a critical flaw in Windows and none of which relates to IE. The critical update affects Windows XP, Vista and Windows 7 while the two lesser risk ("important") bulletins cover a separate flaw in Windows and an update for the Office Groove 2007 software.

Net security firm Qualys said it expected the important update would cover a recently discovered MHTML Information Disclosure bug.

Redmond last patched IE in February, while Mozilla and Google each patched Firefox (more info here) and Chrome (here) respectively earlier this week ahead of the annual fun and games of the Pwn2Own hacking contest.

Four browsers IE, Firefox, chrome and Apple Safari are in the firing line in the Pwn2Own contest, which will run from 9 to 11 March as part of the CanSecWest security conference in Vancouver next week.

Developer: Google took a week to pull infected apps

Malware outbreak left to fester despite warning from developer

An Android developer has hit out at Google for the time it took to react to a malware attack on hijacked apps in its Market store.

There is continuing confusion over the severity of a rash of Android malware that forced Google to remove at least 21 apps from its Market, but developers have claimed Google could have reacted much more quickly after being informed of the threat more than a week ago.

The problem was brought to light by Reddit blogger Lompolo, who found the DroidDream virus in two apps listed on the official Market store.

After further investigation, the infected app count quickly rose to 21, while analysts at Lookout Mobile Security put the number of infected apps as high as 50.

The virus was been packaged into apps that were stolen from their original developers and reposted in the Market with the virus included.

Google finally contacted me and apologised for the delayed response, but there really should be a faster/easier way to get Google to act on it!

“I randomly stumbled into one of the apps, recognised it and noticed that the publisher wasn’t who it was supposed to be,” said Lompolo.

“Super Guitar Solo, for example, is originally Guitar Solo Lite. I downloaded two of the apps and extracted the APKs [Android Package files], they both contained what seems to be the 'rageagainstthecage' root exploit.”

While news of the virus emerged yesterday, the developer of the original app said he had known about the problem for more than a week, and received no response from Google despiting flagging the rogue apps as infected imposters.

“I'm the developer of the original Guitar Solo Lite,” the developer posted under the Reddit user name Coding Caveman. “I noticed the rogue app a bit more than a week ago because I was receiving crash reports sent from the pirated version of the app.

“I notified Google about this through all the channels I could think of: DMCA notice, malicious app reporting and Android Market Help.

"After yesterday's media coverage, Google finally contacted me and apologised for the delayed response, but there really should be a faster/easier way to get Google to act on it!"

Google has not issued a statement regarding the issue, but told PC Pro it was looking into the security problem, and three accounts that were posting the apps appear to have been removed from the Market.

According to Lompolo and Android security websites, the virus not only sends personal information such as the device number to overseas servers, but also opens a back door.

A full list of apps that might be affected can be found at the Lookout Mobile Security website, but the flaw used to root the operating system was fixed in Android 2.2.2 and 2.3, so anyone who has updated need only remove rogue applications.

This article originally appeared at pcpro.co.uk

Copyright © PC Pro, Dennis Publishing


Twitter crime up 20%

Illicit activity on Twitter spiked during 2010.

The crime rate on Twitter shot up by 20 per cent last year, after a lull towards the end of 2009.

In the second half of 2010, crime on Twitter reached two per cent, against just 1.6 per cent in the first half of the year, research by Barracuda Labs found.

The crime rate was defined as the percentage of accounts created every month that were eventually suspended for malicious or suspicious activity, or otherwise misused.

The study looked at the activity of over 26 million Twitter accounts.

The rise in Twitter crime comes at a time when concerns about social media security are increasing.

“Attackers focus on where they can get the most eyeballs and profit, and today that means social networks and search engines,” said Dr Paul Judge, chief research officer at Barracuda Networks.

“As a community we often point to the need for user education as the missing component; however, the levels of social engineering involved in today's attacks suggest that we must continue to elevate our technological approaches.”

Judge said the research community needed to come up with some innovative defences, which industry should work to push out sooner rather than later.

Free profile security

In line with the research, Barracuda released a free Profile Protector designed to safeguard users from threats circulating on Facebook and Twitter.

The application analyses user-generated content posted to profiles and can block or remove malicious or suspicious content, such as bad links posted on Facebook and Twitter pages and news feeds.

This article originally appeared at itpro.co.uk

Copyright © ITPro, Dennis Publishing


Judge Allows Sony to Unmask Anybody Who Visited GeoHot Site

A federal magistrate is granting Sony the right to acquire the internet IP addresses of anybody who has visited PlayStation 3 hacker George Hotz’ website from January of 2009 to the present.

Thursday’s decision (.pdf) by Magistrate Joseph Spero to allow Sony to subpoena Hotz’ web provider raises a host of web privacy concerns.

The subpoena to Bluehost, which maintains Hotz’ geohot.com site, is part of Sony’s lawsuit against the 21-year-old New Jersey hacker. Respected for his iPhone hacks and now the PlayStation 3 jailbreak, Hotz is accused of breaching the Digital Millennium Copyright Act and other laws after he published on his website an encryption key and software tools that allow Playstation owners to gain complete control of their consoles from the firmware on up.

Sony also won subpoenas (.pdf) for data from YouTube and Google, as well as Twitter account data linked to Hotz, who goes by the handle GeoHot.

The Bluehost subpoena requires requires the company to turn over “documents reproducing all server logs, IP address logs, account information, account access records, and application or registration forms” tied to Hotz’ hosting. The subpoena also demands “any other identifying information corresponding to persons or computers who have accessed or downloaded files hosted using your service and associated” with the www.geohot.com website, including but not limited to the “geohot.com/jailbreak.zip file.”

Photo: itBox24/Flickr

Sony told Spero, a San Francisco magistrate, that it needed the information for at least two reasons.

One is to prove “defendant’s distribution” of the hack.The other involves a jurisdictional argument over whether Sony must sue Hotz in his home state of New Jersey rather than San Francisco, which Sony would prefer. Sony said the server logs would demonstrate that many of those whom downloaded Hotz’ hack reside in Northern California — thus making San Francisco a proper venue for the case.

The DMCA prohibits the trafficking of so-called “circumvention devices” designed to crack copy protection schemes. The law does not require Sony to prove that Hotz received payment for the hack, which was designed to allow PlayStation 3 owners the ability to run home-brewed software or alternative operating systems like Linux. It builds on a series of earlier jailbreaks that unlocked less protected levels of the PlayStation’s authentication process.

Jailbreaking a console is also a prerequisite to running pirated copies of games, which Sony emphasizes in its lawsuit.

“I think the these subpoenas, the information they seek, is inappropriate,” said Corynne McSherry, a staff attorney with the Electronic Frontier Foundation. In a letter to Magistrate Spero, she termed the subpoenas “overly broad.” (.pdf)

The judge also signed off on a subpoena to Google seeking the logs for Hotz’ Blogger.com blog, geohotps.3.blogspot.com.

A subpoena to YouTube, also approved, seeks information connected to the “geohot” account that displayed a video of the hack being used: “Jailbroken PS3 3.55 with Homebrew.”The subpoena demands data to identify who watched the video and “documents reproducing all records or usernames and IP addresses that have posted or published comments in response to the video.”

A fourth subpoena is directed at Twitter, demanding the disclosure of all of Hotz’ tweets, and “documents sufficient to identify all names, addresses, and telephone numbers associated with the Twitter account.”

Sony has threatened to sue anybody who has posted the hacking tools or the encryption key. It is seeking unspecified damages from Hotz.

A hearing on whether Hotz will be tried in San Francisco or New Jersey is set for next month in San Francisco federal court.

See Also:

  • Sony to Inspect PlayStation Hacker’s Hard Drive
  • Sony Lawyers Expand Dragnet, Targeting Anybody Posting PlayStation …
  • LG Accuses Sony of Patent Infringement With PS3
  • Hacker Challenging Court Order to Surrender Computer Gear to Sony
  • Lawyer: PlayStation 3 Jailbreak Code Is a ‘Google Search Away
  • Sony Threatens to Terminate Service of PS3 Jailbreakers

South Korea blitzed by DDoSers

Multiple South Korean government websites have come under fire from a concerted denial of service attack.

Local net security firm AhnLab reports that the South Korea's presidential office, the foreign ministry, the national intelligence service, US Forces stationed in South Korea and banks are among the targets of the packet-flooding assault. In total as many as 40 websites were targeted by the attack. However only 29 were actually affected, the BBC reports.

Previous denial-of-service attacks on South Korean government and financial services websites, including a particularly severe assault in 2009, were initially blamed on North Korea before they were traced back to compromised systems in China.

North Korea is known to maintain an information warfare unit that targets enemies of the country, chiefly South Korea and the US. However it's unclear who's behind the latest assault, much less their motives.

March Patch Tuesday leaves IE unpatched for Pwn2Own hackers

Friday, March 4, 2011

Microsoft unlike its browser rivals will not be patching Internet Explorer before the upcoming Pwn2Own hacking contest next week.

A March Patch Tuesday pre-alert, published on Thursday, reveals that Redmond will be issuing three security bulletins next week, one of which affects a critical flaw in Windows and none of which relates to IE. The critical update affects Windows XP, Vista and Windows 7 while the two lesser risk ("important") bulletins cover a separate flaw in Windows and an update for the Office Groove 2007 software.

Net security firm Qualys said it expected the important update would cover a recently discovered MHTML Information Disclosure bug.

Redmond last patched IE in February, while Mozilla and Google each patched Firefox (more info here) and Chrome (here) respectively earlier this week ahead of the annual fun and games of the Pwn2Own hacking contest.

Four browsers IE, Firefox, chrome and Apple Safari are in the firing line in the Pwn2Own contest, which will run from 9 to 11 March as part of the CanSecWest security conference in Vancouver next week.

Android malware attacks show perils of Google openness

This week's discovery of malware that hijacked tens of thousands of Android cellphones shows the pitfalls of Google's decision to make the operating system the Wikipedia of mobile platforms that offers apps written by virtually anyone.

A couple years ago, the choice helped the OS gain traction against Apple's more entrenched iPhone by quickly building out the number of apps available in the Android Market. Once developers pay a $25 registration fee, Google gives them complete control over when and how they make their applications available to users. Contrast that with Apple's App Store, which the company rules with an iron fist.

The recent discovery of some 55 malware-tainted apps available in the Android Market shines a bright light on the dark side of its openness. The malware hid in legitimate titles that had been repackaged and distributed by three developers. Once installed, the apps exploited known vulnerabilities that gave the malware root access to a phone's most sensitive functions, according to this analysis from Lookout, which provides antimalware apps for Android, Blackberry and Windows Mobile handsets.

A separate analysis provided by antivirus firm Kaspersky Labs said that DreamDroid, as the malware has been dubbed, connected to a server controlled by the attackers, where it appeared to access a list of applications to download and install on the already infected device. In other words, DreamDroid is a classic trojan backdoor downloader. The infected apps were downloaded by phones that numbered in the tens of thousands to hundreds of thousands, according to Market figures.

The mass infections are already prompting commentary comparing Android to Microsoft Windows.

The openness of the platform and the availability of alternative application markets makes Android-based devices more difficult to secure, security researcher Vanja Svajcer wrote on Sophos's Naked Security blog. The whole situation reminds me of Windows some years ago. One keeps wondering if history is repeating again?

If there's any vetting of apps submitted to the Android Market, there's no mention of it on Google's webpages, and the company's PR department didn't respond to questions asking about what kind of scrutiny it gives to software available in its Market. As The Reg has reported before, Google can remotely remove apps on users' Android phones, but by then a handset would already be infected.

And besides, as Lookout CTO and co-founder Kevin Mahaffey noted to The Reg: The really nasty thing about root exploits is that once you're root you can do things that disable the remote removal tool. In other words, Google's kill switch can itself be killed.

The episode demonstrates the ugly predicament confronting consumers of smartphone apps. One choice is to opt for the heavy-handed control exercised by Apple's App Store. You may not be able to run Flash-based software, use the alternative browser of your choice, or do any number of other things you want to do, but so far the marketplace, despite being around a lot longer, hasn't presented the kind of security menace we saw this week in Google's apps bazaar.

The Android Market's freewheeling nature, on the other hand, is more appealing to many because it feels more more. More like a stroll down the streets of New York, as opposed to a parade in a Steve Jobs version of Disney Land. Yeah, Android's openness is fun, but only until someone gets hurt.

Developer: Google took a week to pull infected apps

Malware outbreak left to fester despite warning from developer

An Android developer has hit out at Google for the time it took to react to a malware attack on hijacked apps in its Market store.

There is continuing confusion over the severity of a rash of Android malware that forced Google to remove at least 21 apps from its Market, but developers have claimed Google could have reacted much more quickly after being informed of the threat more than a week ago.

The problem was brought to light by Reddit blogger Lompolo, who found the DroidDream virus in two apps listed on the official Market store.

After further investigation, the infected app count quickly rose to 21, while analysts at Lookout Mobile Security put the number of infected apps as high as 50.

The virus was been packaged into apps that were stolen from their original developers and reposted in the Market with the virus included.

Google finally contacted me and apologised for the delayed response, but there really should be a faster/easier way to get Google to act on it!

“I randomly stumbled into one of the apps, recognised it and noticed that the publisher wasn’t who it was supposed to be,” said Lompolo.

“Super Guitar Solo, for example, is originally Guitar Solo Lite. I downloaded two of the apps and extracted the APKs [Android Package files], they both contained what seems to be the 'rageagainstthecage' root exploit.”

While news of the virus emerged yesterday, the developer of the original app said he had known about the problem for more than a week, and received no response from Google despiting flagging the rogue apps as infected imposters.

“I'm the developer of the original Guitar Solo Lite,” the developer posted under the Reddit user name Coding Caveman. “I noticed the rogue app a bit more than a week ago because I was receiving crash reports sent from the pirated version of the app.

“I notified Google about this through all the channels I could think of: DMCA notice, malicious app reporting and Android Market Help.

"After yesterday's media coverage, Google finally contacted me and apologised for the delayed response, but there really should be a faster/easier way to get Google to act on it!"

Google has not issued a statement regarding the issue, but told PC Pro it was looking into the security problem, and three accounts that were posting the apps appear to have been removed from the Market.

According to Lompolo and Android security websites, the virus not only sends personal information such as the device number to overseas servers, but also opens a back door.

A full list of apps that might be affected can be found at the Lookout Mobile Security website, but the flaw used to root the operating system was fixed in Android 2.2.2 and 2.3, so anyone who has updated need only remove rogue applications.

This article originally appeared at pcpro.co.uk

Copyright © PC Pro, Dennis Publishing


Twitter crime up 20%

Illicit activity on Twitter spiked during 2010.

The crime rate on Twitter shot up by 20 per cent last year, after a lull towards the end of 2009.

In the second half of 2010, crime on Twitter reached two per cent, against just 1.6 per cent in the first half of the year, research by Barracuda Labs found.

The crime rate was defined as the percentage of accounts created every month that were eventually suspended for malicious or suspicious activity, or otherwise misused.

The study looked at the activity of over 26 million Twitter accounts.

The rise in Twitter crime comes at a time when concerns about social media security are increasing.

“Attackers focus on where they can get the most eyeballs and profit, and today that means social networks and search engines,” said Dr Paul Judge, chief research officer at Barracuda Networks.

“As a community we often point to the need for user education as the missing component; however, the levels of social engineering involved in today's attacks suggest that we must continue to elevate our technological approaches.”

Judge said the research community needed to come up with some innovative defences, which industry should work to push out sooner rather than later.

Free profile security

In line with the research, Barracuda released a free Profile Protector designed to safeguard users from threats circulating on Facebook and Twitter.

The application analyses user-generated content posted to profiles and can block or remove malicious or suspicious content, such as bad links posted on Facebook and Twitter pages and news feeds.

This article originally appeared at itpro.co.uk

Copyright © ITPro, Dennis Publishing


WordPress cdnvote "cdnvote-post.php" Multiple SQL Injection Vulnerabilities

WordPress is a web-based blogging application. The application is exposed to multiple SQL injection issues because it fails to properly sanitize input in the "dnvote_post_id" and the "cdnvote_point" parameters of the "cdnvote-post.php" script. cdnvote version 0.4.1 is affected.

Ref: http://www.securityfocus.com/archive/1/516587

11.9.24 - CVE: Not Available
Platform: Web Application

WordPress comes under 'extremely large' web attack

WordPress came under massive attack on Thursday, causing disruptions for many of the sites that rely on the webhosting platform to publish their content.

WordPress.com is currently being targeted by a extremely large Distributed Denial of Service attack which is affecting connectivity in some cases, Sara Rosso, a representative of WordPress owner Automatic, said in a statement released to customers. The size of the attack is multiple Gigabits per second and tens of millions of packets per second.

The attack later subsided, but the vast amount of junk data being thrown at the company's servers while the DDoS, or distributed denial-of-service, attack was ongoing made it hard to defend against using standard countermeasures.

Rosso said WordPress was working with its upstream providers to mitigate any further attacks. She also said WordPress will be making our VIP sites a priority in this endeavor.

While significantly smaller than Google-owned Blogger and other hosts, WordPress is nonetheless a crucial platform for a large amount of the Web's population. In July Drupal estimated WordPress powered 8.5 percent of websites.

You have no idea how hard it was to get this post up, as WordPress.com, our blog host, is currently under a denial of service attack, TechCrunch reported. Its been almost impossible to access the TechCrunch backend for the past 10 minutes and users are receiving a 'Writes to the service have been disabled, we will be bringing everything back online ASAP' error message.

Antivirus provider Sophos also reported difficulties in posting stories to its Naked Security blog, but said traffic to its main website was unaffected because it used a different provider.

Firesheep hack catches out Mr Demi Moore

Ashton Kutcher's Twitter profile was hacked on Wedesday to spout pro-SSL graffiti.

Instead of the usual updates of the life of Mr Demi Moore, the aplusk account regaled its 6.4 million followers with security warnings, such as the one below.

Ashton, you've been Punk'd. This account is not secure. Dude, where's my SSL?

The actor was attending the TEF awards (the tech world's equivalent of the Oscar's at the time). The most likely explanation for the mischievous hack is that Kutcher made a Twitter or Firefox update using an open wireless connection at the show.

This, in turn, allowed someone to capture his login credentials before posting messages in his name, probably using a tool called Firesheep.

Firesheep neatly illustrates a well-known risk that previously had received little mainstream attention. Both Twitter and Facebook as well as browser developers are moving towards mandating logins through more secure SSL links, but this process is taking time, presumably prompting aplusk's high-profile hacker to push the message out a bit further a harmless celebrity hack.

Alternatively Kutcher himself may have simulated the hack to try and make a point about Web 2.0 security.

More on the prank (if that's what it is) can be found in a blog post by net security firm Sophos here.

Teen cybercrime forum boss jailed

Thursday, March 3, 2011

A UK teenager who ran a prolific cybercrime forum from home has been jailed for five years.

Nick Webber, 19, maintained the Ghostmarket.net market which boasted 8,000 memberships and facilitated a range of crimes including the sale of stolen credit card and personal details.

Police recovered the details of thousands of credit cards from Webber's machines when he was busted in October 2009 after trying to use a counterfeit credit card to pay for a hotel stay. Confronted by mounds of evidence Webber, from Southsea, Hampshire, pleaded guilty to fraud.

Southwark Crown Court heard that members of the gang may have defrauded banks and individuals anywhere between 12m and 20m, depending on whose estimates you believe. In court, Ghostmarket.net was described as a supermarket for cybercrooks, providing guides on how to commit cybercrimes as well as a marketplace for stolen wares.

The personal details of around 65,000 victims were traded through the site.

Even after his release on bail, Webber continued to engage in cybercrime, an aggravating feature that led to a far tougher sentence than might otherwise have been the case.

Three other convicted suspects were convicted in the same case. Gary Kelly, 21, from Manchester, was also jailed for five years after he also pleaded guilty to the same fraud charges as Webber along with conspiracy to make or supply articles for use in fraud and conspiracy to cause unauthorised modification to computers.

Ryan Thomas, 18, from Beaconsfield in Buckinghamshire, who acted as the site admin for Ghostmarket.net, was jailed for four years. Shakira Ricardo, 21, from Swansea, was imprisoned for 18 months after she pleaded guilty to conspiracy to commit fraud and handling criminal property, the BBC reports.

Webber and Thomas jumped bail soon after their initial arrests in December 2009 before they were captured in Majorca and returned to the UK, The Guardian adds.

Bradley Manning Charged With 22 New Counts, Including Capital Offense

The Army has filed 22 new counts against suspected WikiLeaks source Bradley Manning, among them a capital offense for which the government said it would not seek the death penalty.

The charges, filed Tuesday but disclosed only Wednesday, are one charge of aiding the enemy, five counts of theft of public property or records, two counts of computer fraud, eight counts of transmitting defense information in violation of the Espionage Act, and a count of wrongfully causing intelligence to be published on the internet knowing it would be accessible to the enemy. The aiding the enemy charge is a capital offense which potentially carries the death penalty. Five additional charges are for violating Army computer security regulations.

The new charges more accurately reflect the broad scope of the crimes that Pvt. 1st Class Manning is accused of committing, spokesman Capt. John Haberland said in a statement.

According to the Army, the prosecution team will not seek the death penalty for the capital offense. But under the Uniform Code of Military Justice, the presiding judge ultimately decides what charges to refer to court-martial and whether to impose the death penalty.

The capital offense charge could have an impact on the extradition case of WikiLeaks founder Julian Assange, who is currently battling attempts to extradite him from England to face sex-crime allegations in Sweden. Assange’s attorneys have argued that if extradited to Sweden, the U.S. could seek to extradite him to this country, where he could be charged with a capital offense.

The assertion was considered an exaggeration at the time since even Manning himself was not facing a capital offense. But the issue is sure to figure more prominently now in Assange’s appeal of UK court’s extradition order.

If convicted of all charges, Manning would face a life sentence in prison, assuming the convening authority takes the death penalty off the table. Before the latest charges, the maximum potential jail time he had faced was 52 years.

Manning was arrested last May after he told a former hacker that he passed thousands of classified and sensitive documents to WikiLeaks. He has been in custody at the Marine Corps brig in Quantico, Virginia, awaiting a mental-health hearing requested by his attorney. Depending on the result, the case could then proceed to an Article 32 hearing — the military equivalent of a grand jury investigation.

Updated 6:45 EST

See Also:

  • Assange Opposed Quick Publication of Cables Out of Concern for Bradley Manning
  • Suspected Wikileaks Source Described Crisis of Conscience Leading to Leaks
  • U.S. Intelligence Analyst Arrested in Wikileaks Video Probe

Google in Android Market malware purge

Fifty impostors shown the door.

Google has removed dozens of apps from its Android Market after discovering they were malware that compromised users' personal data.

More than 50 apps were found to be infected with malware capable of gaining root access to a device, harvesting data and installing additional malicious code, computer security researchers said Wednesday. Before being pulled from the marketplace, the malicious apps were downloaded by at least 50,000 Android users within a four-day period.

A Google spokesman declined to comment.

The malicious apps were pirated versions of popular, legitimate apps that cybercriminals bundled with malware and republished in the Android Market under different application and publisher names. They were posed by the publishers with handles “Kingmall2010,” “we20090202,” and “Myournet,” all of whom have been suspended.

The first batch of 21 malicious apps, which came from the publisher Myournet, was discovered by a user of the news aggregation site Reddit. Researchers at mobile security provider Lookout discovered a second lot that was posted by Kingmall2010 and alerted Google, said its chief technology officer Kevin Mahaffey.

Google then discovered a third set that was posted by we20090202.

It removed the malicious apps within minutes of being notified, Mahaffey said.

“It's impressive how quickly they responded to these issues,” he said.

Even though the apps were posted from different developer accounts, the way the malware was packaged indicated they came from the same person, Mahaffey said.

Flip to the next page to peer inside the workings of the Android malware.

Copyright © SC Magazine, US edition


Manning to face death penalty

Aiding the enemy charge a capital offence.

Bradley Manning faces the death penalty as charges against the US Army private were revealed yesterday.

The US Government said it would not seek the death penalty in the case of Manning, alleged to have leaked secret State Department cables to whistleblower site Wikileaks, but the decision was out of its hands, reported Wired's Threat Level security blog.

The charges were:

  • Aiding the enemy (capital offence)
  • Theft of public property or records (five counts)
  • Computer fraud (two counts)
  • Transmitting defence information in violation of the Espionage Act (eight counts),
  • Wrongfully causing intelligence to be published on the internet knowing it would be accessible to the enemy
  • Violating Army computer security regulations (five counts)

“The new charges more accurately reflect the broad scope of the crimes that private first class Manning is accused of committing,” said US military spokesman John Haberland.

Wired speculated the charges could impact the extradition of Wikileaks publisher Julian Assange from Britain for questioning in Sweden over alleged sex crimes there.

His supporters argued that Assange could be rendered out of Swedish hands to face the death penalty in the US if he was extradited.

"The assertion was considered an exaggeration at the time since even Manning was not facing a capital offence," wrote Wired reporter Kim Zetter.

"But the issue is sure to figure more prominently now in Assange’s appeal of UK court’s extradition order."

Manning has been kept in conditions his supporters claim amount to torture since his arrest last May.

A full list of the charges is available at Threat Level.

Copyright © SC Magazine, US edition


Rogue AV pimps finally show love for alternative browsers

For years, ads pimping malware disguised as legitimate antivirus programs have gone to great lengths to mimic the look and feel of Microsoft's Internet Explorer browser and Windows operating system. Now Mozilla Firefox, Google Chrome, and Apple Safari are getting the same treatment.

A security researcher from Zscaler has recently uncovered a campaign that's tailored to the browser that the intended victim is using. Those with IE will see the same tired graphic depicting a Windows 7 security alert, but look what happens when the visitor is using Firefox.

Not only does the image contain internal Firefox elements in the source code, it also spoofs the security warning the browser shows when users attempt to navigate to an address known to be malicious, said Julien Sobrier, a senior security researcher at Zscaler.

When the intended mark visits the page with Chrome, the ruse looks altogether different. The first screen shows a warning window bearing the browser's distinctive logo and the words Chrome Security has found critical process activity on your system and will perform fast scan of system files.

The user then sees what purports to be a Chrome window showing a virus scan.

Not to be left out, Safari is also spoofed, although with significantly less effort. The initial warning looks like this:

But the scan page defaults to the look and feel of IE.

The ads are an attempt to trick visitors into believing they have infections that can be cured by the software being offered in the ad. By customizing the screens to the browser, it stands to reason, malware mongers stand a better chance of succeeding.

I've seen malicious pages tailored in the past, but they were mostly fake Flash updates or fake codec upgrades for Internet Explorer and Firefox, Sobrier wrote in an email. I've never seen targeted fake AV pages for so many different browsers.

Some of the sites that redirect to the scam include columbia.faircitynews.com, www.troop391.org, jmvcorp.com. When successful, the redirected page pushes the file InstallInternetDefender_xxx.exe, where xxx is a number that changes frequently. At time of writing, it was detected as malicious by just 9.5 percent of the major (legitimate) AV packages, according to a VirusTotal scan.

No doubt, Reg readers are savvy enough to spot scams like this, but what about poor Aunt Mildred, who has being told by a well-meaning relative to never, ever use the heavily targeted IE? Makes you realize why fake AV can be such a huge revenue generator.

Sobrier, who blogged about his findings here, first spotted the customized ads on Monday.

Android Market Apps Hit With Malware

The inevitable has happened with the Android marketplace: Google pulled Wednesday nearly two dozen apps infected with malware capable of rooting devices and stealing data. Dozens of others are being investigated.

There were as many as 200,000 downloads of the free apps following their market appearance days ago. The apps ranged from games of chess to photo editors to ones named “Super Sex Positions.” Google confirmed they pulled the apps from the 2-year-old market early Wednesday.

“This is the first time there has been a widespread attack. This is the first time we’ve seen it in the real official Android marketplace,” Chris Wysopal, chief technology officer at Veracode, said in a telephone interview.

Wysopal, who said plenty of apps have been infected in overseas markets, added that it was inevitable that the Android app market would become home to malicious apps. He said the infected apps had the capability of inserting software into a phone anonymously, and could make the phone click ads or send premium SMS messages.

There was no immediate evidence that any of the potential exploits actually happened.

Wysopal suggested that Google should begin vetting apps like Apple does for its platform.

“This was inevitable. The model has to be that the applications need to be vetted before they are available for download,” he said.

Google declined to address Wysopal’s statement on the record. But it did forward its developers’ conditions agreement and a CNET story about the security of Android and Apple apps.

The Android attackers, meanwhile, downloaded legitimate applications and uploaded similar pirated versions back to the market with malware.

Dave Marcus, director of security research at McAfee Labs, said in an e-mail that “in terms of attacks and malware, it doesn’t get any worse than root access, which this malware has.”

Google is remotely removing the apps from Android devices. Security experts said phone owners who have downloaded the apps should wipe and “reset” their phones to their original state.

Here are some of the offending apps:
*Falling Down
*Super Guitar Solo
*Super History Eraser
*Photo Editor
*Super Ringtone Maker
*Super Sex Positions
*Hot Sexy Videos
*Chess
*Hilton Sex Sound
*Screaming Sexy Japanese Girls
*Falling Ball Dodge
*Scientific Calculator
*Dice Roller
“Advanced Currency Converter
*App Uninstaller
*Funny Paint
*Spider Man

See Also:

  • Iran: Computer Malware Sabotaged Uranium Centrifuges
  • Bank of America Employee Charged With Planting Malware on ATMs
  • Take From ATM Malware Caper Exceeded $200000
  • New ATM Malware Captures PINs and Cash Updated
  • New Malware Re-Writes Online Bank Statements to Cover Fraud
  • New York Times Reforms Online Ad Sales After Malware Scam
  • Spoofed Cell Phone Texts Post Malware Threat
  • Cybercrooks Trick Gawker Into Serving Malware-Laced Ad
  • Researcher Demonstrates ATM ‘Jackpotting’ at Black Hat Conference
  • TSA Worker Gets 2 Years for Planting Logic Bomb in Screening

Facebook to share home addresses, phone numbers

To the dismay of some, Facebook will indeed introduce a new feature that gives users the option of sharing their home addresses and cellphone numbers with third-party application developers.

Facebook managers are still working out specifics, but under a plan the company outlined late last month, the site would allow users to plug their address and phone number into applications they run on their accounts. The information would be shared only after a user specifically grants permission, and the information could be removed at any time by making a few changes in the user's settings panel.

Facebook already forbids people under 13 to use its services. The company still hasn't decided whether it users under the age of 18 will be permitted to share their address and phone number at all. Facebook also hasn't decided when the new capability will be rolled out.

The plan is being watched carefully by US Representatives Edward Markey and Joe Barton, co-chairs of the House Bi-Partisan Privacy Caucus. When Facebook first announced its intentions in January to allow address and phone number sharing, they objected to the plan, despite its opt-in nature. They said it was problematic given the sensitivity of personal addresses and mobile phone numbers compared to other information users provide Facebook.

Markey and Barton, a Massachusetts Democrat and a Texas Republican respectively, voiced their objections in a February 2 letter to CEO Mark Zuckerberg, but by then the criticism was so stiff that Facebook had already put the plan on hold.

Last week, Facebook VP for Global Public Policy Marne Levine sent a response (PDF) to the congressmen reiterating that the additional information would be shared only with a user's explicit permission.

We allowed applications to ask users for that information, through a permissions screen, represented below, that provided clear and conspicuous notice to the user regarding what information the application is seeking, Levine wrote. Nor did we require or encourage users to grant such access.

Levine went on to explain that users of certain third-party apps, such as those that send text messages to cellphones or deliver printed photos, might benefit from the feature.

The congressmen say the plan is still unsatisfactory.

I don't believe that applications on Facebook should get this information from teens, and I encourage Facebook to wall off access to teen's contact information if they enable this new feature, Markey wrote in a press release. Facebook has indicated that the feature is still a work in progress, and I will continue to monitor the situation closely to ensure that sensitive personal user data, especially those belonging to children and teenagers, are protected.

People are right to be wary of Facebook. Too many times over the past few years, the social network has betrayed a better-to-beg-for-forgiveness-than-ask-for-permission approach to sharing users' personal information by repeatedly relaxing its privacy policies without first getting explicit approval for the changes. That's not what's happening this time.

It's still questionable whether it's a good idea to share intimate information with a site that generates billions of dollars brokering it to world+dog. But that's life in the 21st Century. Facebook appears to have learned its lesson this time around. Now that the site is seeking informed consent before turning on the feature, it's up to users to decide if they want to use it.

Whether users are too generous with permission screens, as we've worried about in the past, is something better sorted out by Darwinian evolution than politicians.

Nude Airport Scanners: Are They Safe?

Part 1:
Are They Constitutional?Part 2:
Are They Safe? Part 3: Do They Work? March 8

John Sedat, a biochemistry and biophysics professor, says he’s not going to get on an airplane again — at least not until the TSA rethinks its deployment of hundreds of body scanners that hit travelers with a tiny amount of radiation.

“I’m not going to go through these machines. And I’m not going to be groped either,” the 68-year-old University of California, San Francisco, scientist said in a recent telephone interview. “Us older people are probably only one mutation away from melanoma. I’m not going to go through these machines and basically ask for the problem. We all know the older you get the more sensitive you are to sunlight and X-rays.”

Sedat is the most outspoken member of a small community of scientists raising health alarms over a type of ”advancedimagingtechnology” scanner installed at U.S. airports. Already controversial on privacy grounds, the AIT scanners allow airport screeners to see through apassenger’sclothing to check for concealed explosives and weapons. They’re the subject of a high-profile lawsuit by theElectronic Privacy Information Center set to be heard by the U.S. Court of Appeals for the District of Columbia Circuit on March 10.

The EPIC lawsuit argues that the machines are invasive, ineffective and unsafe. “I view this as an uncontrolled radiological experiment,” said John Verdi, an EPIC attorney on the case.

For Sedat, the alleged safety issue is the important one. Of concern to him and other health critics are thebackscatterX-ray body scanners produced by Rapiscan Systems, which the TSA began rolling out last year. They constitute about half of the AIT machines deployed.

Unlike the competing millimeter-wave technology produced byL-3 Communications, the $180,000 Rapiscan machines expose travelers to a small X-ray dose.The TSA and Rapiscan say the machines are safe. But in an April letter to the White House, Sedat and fellow UCSF academics argued the government did not adequately study the backscatter X-ray devices.TheTSA has ordered 500 of the Rapiscan devices at about $180,000 each. About 250 of them are already in use across the country.

“As longstanding UCSF scientists and physicians, we have witnessed critical errors in decisions that have seriously affected the health of thousands of people in the United States” (.pdf), they wrote, noting the failure of the Centers for Disease Control to recognize the risks of blood transfusions at the outset of the AIDS epidemic. “These unfortunate errors were made because of the failure to recognize potential adverse outcomes of decisions made at the federal level.”

Rapiscan provides these radiation dose comparisons.

The TSA declined to be interviewed for this story. But in court documents and on its website, the administration refers to a host of studies suggesting the machines are safe.”The potential health risks from a full-body screening with a general-use X-ray security system are minuscule,” John McCrohan, the FDA’s deputy director for radiological initiatives, wrote the White House in October in response to the San Francisco scientists’ concerns.

John Sedat

The Johns Hopkins University Applied Physics Laboratory, which analyzed the Rapiscan 1000 at the company’s Los Angeles office, published the leading and most often-cited study (.pdf) in October.The 49-pagereport,released in a redacted form,concludes that the machines leak virtually no radiation to TSA staff and nearby passengers, and expose the traveler being scanned to only a fraction of the maximum exposure level deemed medically safe.

“You would have to go through the scanner 1,000 times to equate to one medical X-ray,” said Peter Kant, Rapiscan’s executive vice president, summarizing the study. “You get twice as much radiation when eating a banana than when going through the scanner.”

Sedat counters that the mechanical beam’s intensity level has not been published, making it impossible to evaluate the safety claims. “I want a real hard number in terms of photons per some unit of area,” he said. “The one physical quantity that is crucial for determining what dose a person is getting, that data is missing.”

Moreover, standard medical X-ray machines disperse radiation throughout the body, whereas the airport scanners penetrate to about skin level. That means there is a high concentration of radiation on a single organ — the skin — which was not accounted for in the Johns Hopkins report, Sedat said.

The “correct way” to test any such technology, he said, is to use mice “and appropriate tissue-culture cells and see if there is a biological response.”

“That kind of stuff has never been done,” he said.

Arizona State University physicist Peter Rez, a leading authority on X-ray technology, agrees on that point: More studies should be conducted before the machines become even more widely deployed to U.S. airports.

It’s a debate that plays out in the statistical hinterlands. Many critics of the technology agree that the increased cancer risk to any individual traveler is infinitesimal. But U.S. airports handle 700 million passengers annually — a large enough number that a small uptick in overall cancer risk can scale to a real-life concern.

Left: Backscatter X-ray scan. Right: millimeter-wave scan.

If the scientist critics are right, then it boils down to the cold calculus of whether more lives are saved by the marginal increase in security than are put to risk by the marginal dangers of the technology.

“Your probability of getting blown up by a terrorist is probably lower than getting cancer from these,” Rez said.

David Brenner, who heads the Center for Radiological Research at Columbia University, said he might favor the X-ray scanners if the government used a safer alternative that performs the same function: namely, the millimeter wave scanners, which “as far as we know, have no known safety issues associated with them.”

“I have argued that it is reasonable to suggest that X-ray backscatter scanners are ’safe’ for an average individual, and probably so even for a child, a radiosensitive individual, or a very frequent flier,” he said in an e-mail interview. “So I would agree with Hopkins and the FDA. But I have also argued here that the move from using these scanners as a secondary screening measure to their use as a primary screening measure, with the potential for up to one billion whole-body X-ray scans per year in the U.S., may profoundly change the likely … long-term population cancer risk.”

“As I said before, if there were no alternatives, X-ray backscatter systems might still be reasonable, in terms of balancing benefits and risks,” he wrote.

Rapiscan and its parent OSI Systems, and their subcontractors have donated a combined $1.75 million to federal politicians in the past decade, according to data provided by the MapLight Foundation, of Berkeley, California. Rapiscan and OSI also spent $2.2 million in lobbying from 1998 to 2010, MapLight found. (Here is spreadsheet forpolitical and lobbying expenditures (.xls)for L-3 Communications and for Rapiscan-OSI.)

The company even retained former Department of Homeland Security chief Michael Chertoff as a lobbyist. Chertoff has emerged as a huge proponent of airport body scanners. He wrote in a Washington Post editorial last year that the government should “fund a large-scale deployment” of the devices. His opinion piece, which touted that the devices detect explosives and plastics, did not mention Chertoff’s previous work for the company.

Kant, Rapiscan’s executive vice president, stands behind the scanners.

“I feel completely safe,” he said, “with my family going through these.”


Most Recent Post

MORE ON ARCHIVE
Widget by Mad Tomato

Help Me Expose This Article in Bulk!

Bookmark & Share

- OR -

SELECT YOUR PREFERRED ONE:

Bookmark and Share