Ref: http://www.securityfocus.com/bid/48402/discuss
11.27.21 CVE: Not Available
Platform: Web Application - SQL Injection
Universal Music websites suffered a breach that exposed the usernames and passwords of fans of bands who had signed up for updates on their favourite musicians.
Infamous hacktivist group Anonymous claimed responsibility for the hack as part of its AntiSec campaign, which aims to expose the weak spots in the internet security of big firms and government organisations. The group released a cache of files stolen from Universal as well as similar data extracted from Viacom, the Wall Street Journal adds.
In an email sent to a Reg reader on Monday, Universal admitted that email addresses, passwords and user's real names were exposed by an attack on the website of British indie rock band The Klaxons. No financial or credit card details were exposed, it added.
The circumstances of the breach suggest that the music label had stored passwords in plain text. Universal apologised for the breach and urged customers to change their passwords all around, especially if they had used the exposed login credentials on other sites. It also warned users to be wary of follow-up phishing attacks.
Chunlai Yang, a 49-year old Chinese-born American, has been charged with stealing proprietary software code.
Yang worked for CME Group which makes trading platforms for commodity derivative markets as a programmer.
CME has been monitoring his computer use since May. He has worked for the company since 2000.
He appeared in court in Chicago for a detention hearing. He remains in custody until another hearing on Friday, the FT reports.
CME told the paper that many of the files Yang downloaded contained source code which, if handed to competitors, "could cause great economic damage".
Chang was arrested on 2 July at CME's Chicago offices in a raid led by Special Agent Robert D Grant of the Chicago offices of the FBI. He was charged with one count of theft of trade secrets.
According to the FBI, Yang had been in email contact with the assistant director of the Logistics and Trade Bureau for the Zhangjiagang Free Trade Zone. One message included an attachment containing proprietary code.
The Feds also claim Yang had booked a flight to China leaving on 7 July.
A spokesman for CME said: "CME Group places a high value on protecting its intellectual property and trade secrets. As soon as the company became aware of and confirmed the suspicious activities of one of its employees, CME Group cooperated with law enforcement authorities and moved to terminate the individual's employment. As a result, the individual charged with theft of CME Group confidential information is no longer employed by CME Group. he company has found no evidence that customer information, trading data or required regulatory information was compromised.In light of the pending law enforcement proceedings, CME Group has no further comment on this matter."
Yang faces fines of $250,000 and up to 10 years in prison if found guilty.
The FBI statement is here.
The latest jailbreak for iPhones, published on Wednesday, exploits a zero-day bug in iOS that only users of jailbroken devices will be able to fix, security experts warn.
Version 3 of jailbreakme.com, which also works on iPad fondleslabs, takes advantage of a PDF-related vulnerability in iOS. Users of jailbroken devices can use PDF Patcher 2 to guard against the underlying flaw while users of regular devices will have to wait for a patch from Apple. Jailbroken devices allow the installing of apps besides those approved by the official Apple App Store.
Any web link could potentially be redirected to a malicious file that exploits the vulnerability to install malware instead of simply jailbreaking a device, so exploits do not have to rely on tricking punters into opening malicious PDF files.
"It's as serious as last time when jailbreakme.com was using a zeroday," notes Mikko Hyponnen of Finnish security firm F-Secure. "Last time nothing bad happened, as Apple patched fast."
Apple does not allow anti-virus software to be listed in the official iPhone AppStore, so there's no protection via this route until a patch for the underlying vulnerability is published by Apple.
The "temporary" vulnerability of unaltered iPhones and fondleslabs illustrates one security shortfall of the locked-down walled-garden approach practised by Apple. The more laissez-faire approach followed by Google with Android has seen an upswing in malicious code targeted against Droid phones, however. iPhone malware remains even rarer than the low levels of Droid Trojans in circulation but, even so, the potential for badness is still there.
The zombie machines which formerly powered the infamous Rustock botnet are down to half their original number, according to Microsoft.
Redmond ran a successful takedown operation back in March that effectively knocked out Rustock's command and control nodes. That meant that infected PCs were no longer being sent spam templates or other instructions while doing nothing to alter the fact that they were contaminated with malware.
Subsequent efforts, including the addition of Rustock botnet disinfection agents to the Microsoft Malicious Software Removal tool, have reduced the number of infected hosts by more than half.
Worldwide Rustock infection rates are down from a zombie count of 1.6 million in the middle of March to 703,000 in the week ending 18 June, the latest available figures. India, the US and Turkey are the most infected countries, but the malware itself remains widely spread across the world, as explained in a blog post here.
Microsoft has pledged to continue its clean-up efforts. In the meantime it is chasing leads on the owners and operators of the botnet. The Rustock control servers were rented by two Russians - Vladimir Alexandrovich Shergin and Dmitri A Sergeev - who have each become key suspects in the case.
Rustock began operation in 2006 and, at its peak, accounted for more than 13.8 billion spam emails daily, most of which punted unlicensed pharmaceutical websites. The take down operation was the second of its type. Microsoft was also heavily involved in the takedown of the Waledac botnet in March 2010.
A Special Edition of Microsoft's Security Intelligence Report provides more information on the Rustock threat and can be found here.
An internet fraudster was sentenced to two years prison yesterday for his part in a gang which pocketed hundreds of thousands of pounds from various web-based scams.
Michael Ugboaja, 48, of Beckton, was sentenced for his part in laundering 470,000.
The gang targeted a Canadian doctor on a dating site and persuaded her to hand over $100,000 (62,500) to a man she believed to be a diamond dealer.
An accountant from Melbourne, who was tricked by a series of emails and meetings, handed over A$1.7m (1.14m) in the belief he would receive a A$500m loan.
The Aussie beancounter had meetings in Dubai and England with different members of the gang and was even shown a trunk full of cash to convince him the scam was genuine.
A Swiss hotel owner lost 11,000 that he believed was being invested in oil.
Over four months, 470,000 was paid into an account opened by Ugboaja. He took the money out in cash and handed it to an unknown man in a supermarket carpark. The cash was never recovered.
The leaders of the gang have still not been traced.
The Metropolitan Police statement is here.
The Information Commissioner's Office said more companies should offer themselves up for voluntary audits.
According to the quango's annual report, a third of organisations offered the chance to be audited by the ICO accepted.
Of the 603 breaches last year, just 186 came from private companies. But only 19 per cent of these firms agreed to ICO audits.
The ICO promises its free data protection audits are not about "naming and shaming". The quango has written to some organisations offering the service.
But Kathryn Wynn, senior associate and data protection specialist at law firm Pinsent Masons said: "Companies should sort out their own procedures, and if necessary hire in outside help, before going to the ICO. Companies should have their house in order before calling in the regulator for a stamp of approval."
Wynn said organisations and companies should spend some time thinking about what to do if the worst did happen, as well as work hard to make sure it didn't.
She said: "Often the reaction to a breach is more important look at Sony no one can blame them for getting hacked, but you need to react properly afterwards."
A spokesman for the ICO said: "The ICO audit is designed to be constructive. We work with with organisations to find areas of concern and to improve general compliance. The scope of the audit is agreed in advance with companies. If we find a compliance issue we wouldn't necessarily take action."
Graham said the organisation had made good progress in cutting the number of overdue Freedom of Information requests the other part of the quango's responsibilities.
This year also saw the regulator impose its first non-compliance fines. The recipients were: Hertfordshire County Council 100,000; A4e Limited 60,000; Ealing Council 80,000; and Hounslow Council 70,000.
On European cookie law, Graham said the ICO would only take action against companies which take little action to comply.
You can watch Graham read the intro to the report or download it as a PDF at the ICO's website.
Prime Minister David Cameron has today backed calls for public inquiries into the "absolutely disgusting" phone hacking allegations against The News of the World.
Speaking in Westminster at his weekly PMQs, Cameron said he wanted inquiries not only into those claims against the News Corp-owned newspaper, but also to look at the original police investigation as well as consider broader journalistic methods employed by newspapers.
"We do need to have an inquiry, possibly inquiries, into what has happened," said Cameron.
"We are no longer talking here about politicians and celebrities, we are talking about murder victims, potentially terrorist victims, having their phones hacked into. It is absolutely disgusting, what has taken place, and I think everyone in this House and indeed this country will be revolted by what they have heard and what they have seen on their television screens."
However, he declined to back Labour leader Ed Milliband's call for the resignation of News International's CEO Rebekah Brooks, who edited the Sunday tabloid in 2002, when it is said that the phones of bereaved families were hacked.
The PM also batted away suggestions that News Corp's bid to buy BSkyB should be deferred to the Competition Commission.
Earlier today, Ofcom boss Ed Richards told The Register and other reporters that any recommendation to block Murdoch's bid to buy BSkyB could not be put forward until facts in the case are established.
"We will consider our position only once the police investigation is complete ... then well look at it, if we need to," said the chief communications watchdog.
An angry user hacked into PayPal UK's Twitter account on Tuesday night and changed the e-commerce company's avatar photo to a heap of steaming crap.
The hacker also posted several unflattering tweets ridiculing PayPal. The hacker appears to be an angry PayPal customer motivated by a dispute over a frozen PayPal account. The offending messages, removed after the rightful account-holders regained control of the account, have been preserved for posterity in a blog post by Sophos here.
PayPal said the breach had only affected its Twitter account and had nothing to do with its customer systems and data. Nonetheless the incident is embarrassing, especially since it appears that PayPal (an ebanking operation that ought to know better about such things) fell foul of either a phishing scam or weak password security.
The PayPalUK hack follows a similar hijack of a Fox News Twitter account earlier this week.
Cops in southwest London have identified a skull found in the Richmond garden of TV star Sir David Attenborough as that of an 1879 murder victim.
The skull was discovered last year during excavations at the rear of the former Hole in the Wall pub in Park Road, close to where Julia Martha Thomas was killed by her Irish-born maid Kate Webster (pictured) in what became known as the "Barnes mystery".
Webster, who had a history of drunkeness and a long criminal record, murdered the widowed Thomas at No 2 Vine Cottages, Park Road, on 22 March 1879, following an argument.
In a "fit of rage", she pushed the 55-year-old down the stairs. Acting Detective Inspector David Bolton, who led the investigation, explained: "Realising she had injured her, she proceeded to strangle her to stop her from screaming and getting her [Webster] in trouble. Webster decided to do away with the body and used a razor to chop off the head. Having decapitated her, she used a razor, a meat saw and a carving knife to cut the body up. The dismembered body was put into a copper laundry vessel and she proceeded to boil up the body parts of Mrs Thomas."
Webster subsequently disposed of most of the body in the Thames, where it was discovered close to Barnes Bridge. Some of the remains ended up as a free meal to local kids, according to the Daily Mail, but what happened to the head remained a mystery.
Now, 132 years later, police have finally identified the unfortunate victim's skull. ADI Bolton reviewed original case files and census records, and deployed radiocarbon testing to provide "compelling evidence that the skull was indeed that of Mrs Thomas".
The West London Coroner, Alison Thompson, yesterday formally recognised the skull as belonging to Thomas, and "recorded a verdict of unlawful killing and the cause of death as asphyxiation and head injury".
Chief Superintendent Clive Chalk, Borough Commander of Richmond, said: "This is a fascinating case and a good example of how good old-fashioned detective work, historical records and technological advances came together to solve the 'Barnes mystery'."
As for Kate Webster's fate, she fled to Ireland, but was arrested and returned to England. She was tried at the Old Bailey, found guilty of murder and hanged at Wandsworth Prison on 29 July 1879.
Fifteen suspected members of Anonymous have been arrested following a joint Italian-Swiss police investigation, AFP reports.
Police reckon the group formed a cell that attacked the websites of the Italian government and prominent Italian companies, energy firms ENEL and ENI, as well as state broadcaster RAI. The group, reportedly led by a 26-year-old Italian living in Switzerland, were arrested and questioned prior to being released on bail pending further inquiries. Five of the suspects are juveniles, according to Swiss reports.
The arrests in Italy and Switzerland follow police actions in the UK, Spain, Turkey and the US.
Obituary Len Sassaman, a cryptographer and security researcher of high repute, has died aged 31. Sassaman maintained the Mixmaster remailer and he contributed to various other privacy projects, including OpenPGP. He also co-founded the annual CodeCon conference with Bram Cohen. He was security researcher and doctoral student at the Katholieke Universiteit in Leuven.
Len was a friend and roommate in San Francisco, in the year following the dot.com crash. The Register's West Coast Bureau at the time was wherever I happened to be Len provided a mascot.
It was a dire time for bright programmers. It got even worse after 9/11. Bram had been turned down for a job at Google because he didn't have a degree. Neither did Len. The pair persuaded Jamie Zawinski to open his DNA Lounge club during the day over one weekend, and invited practical demonstrations of working code from interesting people.
"Conferences cost a ridiculous amount of money, and hackers are treated like dirt," said Bram. That was the first CodeCon, and it was Len's energy and enthusiasm that pulled it together.
He'd already helped organise the campaign to free Dmitry Skylarov, a Russian cryptography student jailed at the request of Adobe after a demonstration of eBook security.
Len Sassaman
I had assumed Len was in his late twenties or early thirties; he was so widely read, and psychologically astute. I was shocked to learn he'd just turned 21.
He introduced me to the cypherpunks at one of their regular meetups at Stanford. I introduced him to Robert Anton Wilson, the author of the Illuminatus trilogy, and his favourite author.
One beautiful autumn afternoon, we drove in Len's sports car at breakneck speed down from Golden Gate Park to Aptos, where Wilson lived. The car's already overturned once, he said, but don't worry about speeding tickets. He showed me a Get Out of Jail Free card, which he assured me would work magic.
Some brilliant people are irritated by dumb questions. I learned a lot from Len, who was always a patient explainer. We were last in touch a year ago, when he was enraged at the entrapment of Bradley Manning. Len realised I hadn't met his wife Meredith, and renewed an invitation to Leuven.
They say when you turn 30, you realise how trivial conversations have been. And when you turn 40, you stop giving a flying fuck about how you should appear. Len's best years were ahead of him, and his departure is a terrible loss.
A former Flextronics exec is facing up to 30 years in prison for leaking details of Apple's iPhone 4 development as part of an insider trading scam.
Walter Shimoon, 39, of San Diego, California, has pleaded guilty to conspiracy and fraud charges. He was arrested in December.
Shimoon is accused of using his position at Flextronics to get secret information about Apple's iPad and iPhone 4 development both from within the company and from other component makers. This included sales forecasts and product specs.
The allegation is that he passed this information onto Primary Global Research, which in turn paid him thousands of dollars for the secrets.
A DOJ statement said Shimoon: "also provided inside information to a consultant who operated a research firm and then provided the information to certain money managers."
Shimoon will be sentenced on Friday 8 July.
Google has removed over 11 million .co.cc websites from its search engine results pages on the basis that most of them are far too "spammy".
The .co.cc space is not an officially authorised second-level domain like .co.uk or .com.au. Rather, it's offered independently by a Korean company (http://co.cc/) that just happens to own the domain name .co.cc.
Google classes the firm as a "freehost", and has exercised its right to block the whole domain "if we see a very large fraction of sites on a specific freehost are spammy or low-quality", according to Matt Cutts, head of Google's web spam team.
The company said in a recent blog post: "To help protect users we recently modified those [malware-scanning] systems to identify bulk subdomain services which are being abused. In some severe cases our systems may now flag the whole bulk domain."
According to a recent report (29-page PDF/2MB) from the Anti-Phishing Working Group, the .cc top-level domain hosted 4,963 phishing attacks in the second half of 2010, almost twice the number found under any other extension.
That was due to a large number of attacks originating from .co.cc addresses, the APWG said.
The .co.cc "registry" offers single sub-domains for free, and enables customers to bulk-register 15,000 addresses at a time for a mere $1,000, or about seven cents a name.
The company claims to have 11,383,736 registered domains and 5,731,278 user accounts. That would make it one of the largest domain extensions in the world, bigger than both .org and .uk by over two million domains.
The .cc top-level domain belongs to the Cocos (Keeling) Islands, a small Australian territory in the Indian Ocean. Regular .cc websites are unaffected by Google's changes.
Net security firms have lent their support to a new group that is seeking to provide cybercrime training for law enforcement officials as part of a wider fight against cybercrime.
McAfee and Trend Micro have both pledged to support the fledgling International Cyber Security Protection Alliance (ICSPA). The international business-led not-for-profit organization will be chaired by former Home Secretary, David Blunkett MP.
Security firms routinely collaborate with law enforcement and to provide technology and (less frequently) training without charge, so ICPSA seems to be more about formalising such relationships than doing anything new, as such.
Apple has reportedly begun the filtering of outbound messages sent via its MobileMe service.
The fruity one has applied inbound filtering to inbound emails as a precaution against spam since last year. Last month, however, it began filtering messages that users sent using the service for questionable reasons.
The upshot is that whatever email client a MobileMe user uses, their message will be blocked without notification, reportedly even if the offending content in question contains mild political criticism.
Reg reader Mike Conley, who was the first to tell us of the problem, said that one of three offending messages he sent was blocked because it mentioned the phrase "growing hostility against Frankfurt and Brussels". An email about civil unrest in Greece about the sovereign debt crisis/austerity budget was also dropped. Conley realised there was a problem because he sends messages to himself via bcc. He complained and one of the offending messages was transmitted only for the problem to reappear days later.
As a result, Conley has decided to stop using the service after having been a loyal fan for more than 10 years.
Conloy started a thread on the problem on an Apple user forum. The post was picked up by Reg reader Harris Upham, who confirmed that censorship seems to be taking place.
"I have a mobileme account myself, and I have tested this myself and I'm now convinced that mobileme is censoring outbound mail based on message body content," Upham told El Reg.
Generally speaking we're much more inclined to attribute this sort of thing to a technical screw-up rather than a deliberate policy. The alternative is truly chilly. All-American firm Apple has decided to sensor political debate occurring via email for reasons unknown, exactly the sort of behaviour routinely practiced in China and roundly condemned across the political spectrum in the West.
It's very likely there's some innocent explanation to this, but since Apple consistently refuses to speak to us on information security, we don't know what this might be. Enterprise email security firms we asked were unable to shed much light on the behaviour, presumably since it is restricted to Apple's user-base and only visible internally.
Microsoft has published code for the software that its roving vehicles use to collect wireless network information. The move is an apparent attempt to make Microsoft look good next to Google.
On Tuesday, the software giant proudly told the world that it had published some of the code used by the Microsoft vehicles that drive around slurping data on Wi-Fi access points and cell-tower locations. This data fuels the location-based services included with Windows Phones and other Microsoft products.
In the past, Google used its fleet of Street View vehicles to collect similar data. But at one point, Google admitted that it had been collecting not only network identifier but Wi-Fi payload data as well, and it no longer collect any Wi-Fi data.
Therein lies the difference, according to Microsoft, which said on Tuesday that its software collects and retains only as much Wi-Fi access point data as is necessary to build its positioning database. "None of data collected is associated with personally identifiable consumer information," Windows Phone engineering team group program manager Reid Kuhn said.
Kuhn called the publication of the code part of Microsoft's "ongoing commitment to consumer privacy" and an "additional step to provide even more transparency about how we gather information through managed driving to provide location-based services."
We'll have to take Microsoft's word for it. The move comes with one major caveat: Microsoft is sharing only what it has determined are "relevant portions" of the source code. Also, you can look, but you can't touch, as the code is under a "custom license" that doesn't allow for much in the way of testing or modification.
But the gesture makes for healthy competitive sport, as it seems Microsoft is now using privacy and openness as one way to give Windows Phone a much-needed leg up against the rival Android mobile operating system from Google.
Last month, Microsoft revealed in a letter to the US Congress that it had stopped identifying specific mobile devices that use its location-tracking services.
Microsoft publicized its change as Google and Apple came under scrutiny from Congress and privacy advocates over the way iPhone and Android devices collect and store location data.
Cisco and other western companies are reportedly working with the Chinese government to install a network of one half-million surveillance cameras in the rapidly growing commercial and industrial metropolis, Chongqing.
Citing people familiar with the deal, The Wall Street Journal reports (subscription required) that Cisco will supply the networking equipment the massive surveillance system.
The government of Chongqing a city on the Yangtze river of between 12 and 32 million souls, depending on how you extend the metropolitain outline declined the WSJ's request for comment. So did the country's Ministry of Public Security and State Council Information Office.
Little has been published in the West about the surveillance-camera network, dubbed "Peaceful Chongqing". However, a notice on Chongqing Currents, a city-news site, reports that a Peaceful Chongqing "mobilization and deployment meeting" was held this March. The goal of the surveillance project is described as being to make Chongqing "a city with good security, harmonious peace and safety for investment, and to provide stable society for promotion of the harmonious urban and rural development."
The Wall Street Journal's low-tech explanation of high-tech surveillance networks such as "Peaceful Chongqing"
Perhaps interestingly and perhaps not Google's link to the original Peaceful Chongqing reference in Chongqing Currents now merely turns up a Chinese-language 404-error page. The reference to "good security, harmonious peace and safety for investment" is from a Google-cached version.
It's against US law to provide the Chinese government with crime-control products, due to legislation passed soon after the uprising that the world came to know as Tiananmen Square was crushed by Chinese troops. A more far-reaching and punative bill, "The United States-China Act of 1991", was passed by the House and Senate, but vetoed by then-President George W. Bush.
The difficulty with the law that did make it past W's desk is, of course, determining what it covers and what it doesn't. While the WSJ notes that, for example, fingerprinting equipment clearly falls under the law's strictures, networking equipment in support of a web of 500,000 surveillance cameras that train their cyclopian eyes on the public is a different matter.
Cisco, which first established Chinese operations in 1994 and now has over 3,000 employees in the country, flatly denies that the company has stepped over the line in the Middle Kingdom. "Cisco does not supply equipment to China that is customized in any way to facilitate ... surveillance of users," wrote Cisco general counsel Mark Chandler in a post entitled "Cisco Supports Freedom of Expression, an Open Internet and Human Rights" on the company blog last month.
Chandler's stand is entirely plausible even though "customized" is a bit of a wiggle word. That said, a repressive government with a history and practice of suppressing dissent and monitoring its citizens' behavior can turn even as seemingly innocuous an item as a Cat6 patch panel into a supporting player in Big Brother's telescreen future.
Peaceful Chongqing is schedule to go live "over the next two to three years," the WSJ reports.
Facebook has blocked a Google Chrome extension that let you export information about your Facebook "friends" so that data can be shuttled into competing services.
Known as Facebook Friends Exporter, the extension had become particularly popular of late as a means of moving "friends data" into Google's latest Facebook challenger Google+ and it was profiled in a recent Cnet story as a handy tool for Google+ converts.
Apparently, this caught the eye of the data police at Facebook. On Tuesday according to Mohamed Mansour, the independent developer of Facebook Friends Exporter Zuckerberg and company began blocking the extension. "Facebook is trying so hard to not allow you to export your friends," he said on the extension's homepage. "It will no longer work for many people."
Facebook did not immediately respond to a request for comment. But the extension would seem to violate its terms of service. "You will not collect users content or information, or otherwise access Facebook, using automated means (such as harvesting bots, robots, spiders, or scrapers) without our permission," the terms read.
Like many others, Mansour believes that Facebookers have an inherent right to data involving their friends. "Get *your* data contact out of Facebook, whether they want you to or not. You gave them your friends and allowed them to store that data, and you have right to take it back out! Facebook doesn't own my friends," reads the description of his extension.
Clearly, Facebook is determined to protect its most valuable asset: your so-called "social graph". The social networking outfit has long refused to provide a simple means of exporting friends-related data. Last November, Google launched a protest, preventing Facebook from accessing the Google Contacts API, which had allowed new Facebookers to import contact info from Gmail. Google said it would not allow access to the API until Facebook offered a similar API.
Which only shows you how valuable that data is. Information about your friends and acquaintances can be used to target ads both at Facebook and at Google. And Facebook knows that people come to its site primarily because that's where their friends are.
Facebook does allow you to export a list of your friends, but this is no more than a series of names. It does not include email addresses or other contact information. According to Mark Zuckerberg, users don't really "own" the email addresses of their Facebook friends.
"Email is a little bit different from social networks," he has said. "In an email program, if you have an address book, you put all the addresses in there, so that's very much your information. In a social network ... if you upload a photo album or a blog post, that's yours. But there's information that's clearly not yours, [such as] someone else's photo album. But then there's information that's somewhere in the middle maybe a photo you took but I tagged.
"What are my rights to that? What should I be able to do with your email address if we're friends and I can see your email address?"
It should be noted, however, that Facebook lets you export addresses to email services run by partners such as Microsoft and Yahoo!. And it lets you import email addresses from various third-party email services. Surely, you "own" those addresses.
Facebook Friends Exporter is designed to collect data about your Facebook friends that they have shared with you, including emails, phone numbers, and birthdays. You can export this data into a .CSV file or you can move it directly into Gmail. From there, it's a relatively easy leap to Google+. The extension can only be used with the English language version of Facebook.
On the extension's homepage, Mansour vowed to work around Facebook's block. "New version with a different design is currently deploying. You might have to do exports daily. It uses a different approach, and I will maintain this version," he said. "Just bear with me."
Plaintiffs in a federal lawsuit accusing CNET of facilitating “massive copyright infringement” by distributing peer-to-peer software dropped their case Monday.
The May lawsuit was lodged in Los Angeles by a handful of musicians and filmmaker Alkiviades David. They accused CBS Interactive CNET’s publisher of illicitly profiting from piracy by distributing 220 million copies of LimeWire over CNET’s Download.com site since 2008 accounting for 95 percent off all LimeWire downloads.
The case appeared to be nearing its demise last month when the plaintiffs submitted just six copyrights as being infringed. On the July 4 holiday, David quietly dropped the suit.
What remains to be seen are threats by David’s attorney, Adam Wolfson, who wrote in a filing that the case would be re-filed to represent more plaintiffs and “many thousands of songs and other copyrighted works.” (.pdf)
The now-defunct LimeWire service agreed in May to pay$105 million to settle accusations from the recording industry that LimeWire users committed a “substantial amount of copyright infringement.” In that lawsuit, the Recording Industry Association of America sought damages on 9,715 copyrighted recordings, and forced LimeWire of New York to shutter.
CBS has maintained it would “prevail” in the David case.
The Copyright Act allows for damages of up to $150,000 per infringement.
David claimed that CNET maintained a “business model to profit directly from the demand for infringing P2P clients.”
See Also:
A backdoor has been discovered in the source code of a widely used FTP package.
Version 2.3.4 of the source code for vsftpd billed as probably the most secure and fastest FTP server for Unix-like systems was replaced with a compromised version with an invalid signature. The dodgy tarball version of the code was uploaded onto the main download site and available for around three days before the hack was detected by Chris Evans, the author of vsftpd, on Sunday (3 July).
Evans has moved the main download to a new site, https://security.appspot.com/vsftpd.html, which is hosted by Google App Engine. The counterfeit code was poorly disguised and it is unlikely that too many of the tech-savvy users of vsftpd fell victim to the hack. Nonetheless the incident illustrates that code repositories can be poisoned and the importance of checking digital signatures as a safeguard against falling victim to such shenanigans.
Evans reckons the whole incident is more likely the result of a prank than a serious attempt to compromise corporate file transfer facilities.
"The backdoor payload is interesting," Evans writes. "In response to a :) smiley face in the FTP username, a TCP callback shell is attempted. There is no obfuscation.
"More interestingly, there's no attempt to broadcast any notification of installation of the bad package. So it's unclear how victims would be identified; and also pretty much guaranteed that any major redistributor would notice the badness. Therefore, perhaps someone was just having some lulz instead of seriously trying to cause trouble."
MPs have expressed serious concern about a lack of cyber-security plans detailed in the government's IT and communications strategy.
A Public Accounts Committee report warned that the "ambitious" plans laid out by the Cabinet Office in March this year needed further clarity.
"The strategy only makes one reference to cyber-security. This is particularly concerning given the move to more government services online," the report concludes.
"The government has committed to increase the use of new technologies and sharing of information, which rely on the internet. ERG [the Cabinet Office's Efficiency and Reform Group] should clarify in its implementation plan how cyber-security will be integrated into its strategy for ICT."
The parliamentary committee added that the Cabinet Office needed to be clear about how many cyber-security professionals there were working within government.
It pointed out that the US government had recently admitted it needs to "double its capability to meet a shortfall in skills" in that area of IT.
An implementation plan is expected to be published by the Cabinet Office next month, but the committee warned that Francis Maude's department would not be able to deliver the strategy without backing from ministers across government.
It also needs to convince tech suppliers to respond positively to the changes, which could yet meet opposition.
On a related note, the report called on the Cabinet Office to explain in more detail how it plans to encourage small UK businesses to get involved in government IT procurements.
It also stressed concerns about British citizens being left behind because of the Cabinet Office's bold "digital-by-default" plans.
"The government plans to move more public services online and, rightly, to stress the importance of designing services around the needs of the user. However, approximately nine million people have never used the internet, and they must not be excluded," it said.
"ERG and other relevant departments should withhold sign-off of additional online services until they are satisfied that the service is designed for users."
It said the efficiency reform group should continue to make online services accessible via libraries, which have recently faced closures and cuts, as well as through post offices and other public spaces.
Part of the strategy involves the creation of a single domain for taxpayers to access public services online.
A prototype is currently being developed by a small team of coders based in Lambeth in South London. The project is yet to secure any further funding for future development, however.
Similarly, the Cabinet Office's plans to introduce a new "ID assurance" scheme which may hook into a post-Directgov website as early as summer 2012 could require a new Act to be passed in Parliament.
All of which underlines the committee's warning that Maude's department cannot go it alone with its tech strategy.
Pressure on the News of the World over phone-hacking allegations intensified still further on Tuesday after allegations surfaced that journalists at the paper intercepted the voicemail messages of murdered schoolgirl Milly Dowler.
Hacks working for the NoTW allegedly deleted voicemail messages sent to Dowler at the time she went missing in March 2002, interfering with police inquiries into her disappearance in the process. The deletion of phone messages, an action apparently taken to free up space for extra messages, gave her family false hope that she might be alive in addition to hampering a police investigation, The Guardian reports.
Police would be interested in preserving voicemail messages to murder victims not least because of the possibility that the murderer themselves might leave a message in an attempt to cover their tracks.
Scotland Yard is investigating the allegations as part of its re-opened inquiry into phone hacking by the paper. Previously these allegations have largely centred on charges that hacks at the paper used private investigators to hack into the voicemail messages of celebrities and public figures in a hunt for gossip.
The Dowler hack allegations are, to put it mildly, far more serious and are likely to place renewed pressure on senior managers at the paper at the time including then-editor of the paper, Rebekah Brooks, now Rupert Murdoch's chief executive in the UK. Her deputy at the time, Andy Coulson, resigned as the prime minister's media adviser in January at the same time police re-opened an investigation into phone hacking at the News of the World. Brooks ran a controversial name-and-shame child abusers campaign during her stint editing the paper.
In the days after Milly's abduction, the Dowler family spoke of their hope that their daughter might still be alive in an exclusive interview with the News of the World.
The Dowlers' family lawyer, Mark Lewis, described the News of the World's alleged activities as "heinous" and "despicable". The family intends to sue the paper for damages.
Dowler, 13, was abducted on her way home to Walton-on-Thames, Surrey, on 21 March 2002. Police initially thought that she might have run away from home. The deletion of mobile family messages gave substance to this suggestion and served to cloud the picture about what happened to her in the crucial first few days after she was abducted. Levi Bellfield, 43, was jailed for life for murdering Dowler last month. Former bouncer Bellfield was previously convicted of murdering two other young women, Marsha McDonnell and Amelie Delagrange: both crimes happened in the two years after Dowler's murder.
Evidence that News of the World hacks may have intercepted and deleted messages sent to Dowler comes from a collection of notes kept by Glenn Mulcaire, the disgraced PI jailed for hacking into the voicemail messages of royal aides at the behest of the News of the World.
The paper made little attempt to hide its activities at the time of Milly's abduction. For example, it ran a story in early April that year about a woman allegedly pretending to be Dowler who left her number as a point of contact when she applied for a job with a recruitment agency. Police at the time realised that tabloid hacks must have had access to Dowler's voicemail in sourcing the story but saw it as an isolated incident and decided to do nothing, The Guardian reports.
In a statement over the latest mobile phone hacking allegation, News International (which publishes the NotW) said: "We have been co-operating fully with Operation Weeting since our voluntary disclosure in January restarted the investigation into illegal voicemail interception. This particular case is clearly a development of great concern and we will be conducting our own inquiry as a result."
A Twitter account, some already-public data, some Apple survey server admin logins: the more people get on board the Antisec campaign, the more laughable their achievements become.
The group managed a brief flurry yesterday by hijacking a Fox News Twitter account to circulate an Obama assassinated rumour, and picked up publicity (and the usual no comment) by grabbing admin logins from an Apple survey server.
But its crowning achievement went almost unreported: someone going by the tag f1esc posted files to The Pirate Bay described as AU election data. The 600 MB release got the usual back-slapping under the #Antisec Twitter tag.
The alleged cracker showed the same geopolitical ignorance as emerged in the previous Australian government hack (in which a local council was endowed with national status); in this case, the Australian election data actually concerned the 2011 New South Wales state election.
And the data was already public. It was downloaded from an electoral ftp site specifically designed to publish the results of the election, and was set up in March 2011.
Although local journalist Darren Pauli Tweeted the data source yesterday, the claim that the data dump represented a hack stayed high on the list of retweets by Antisec followers far into the night.
The FTP site is still active, so psephologists can rest easy.
Engineers and ground controllers at the European Space Agency are overjoyed to announce that they have managed to bring an unexpectedly defunct, critical science satellite orbiting the Earth back to life by hacking it.
Forget user logins, this is real hacking
The satellite in question is known as "Samba", and is one of four sent up in 2000 to carry out specialist analysis of the solar wind. A loss of any of the quartet can be enough to invalidate the data from the others, so when Samba's vital Wave Experiment Consortium (WEC) instrument cluster went down in March, ESA controllers at Darmstadt in Germany were very upset.
"When everything goes as planned, flying a mission can be routine," says ESA's Manfred Warhaut, Head of Mission Operations. "But when unexpected trouble occurs, and there's nothing in the manuals, you really want to have an experienced and talented team on hand to solve the problem."
Warhaut and his fellow satellite experts feared that there had been a paralysing short circuit aboard the spacecraft, but managed to use a piece of dormant software in its computers to find out that in fact all five power switches on the WEC had locked closed a condition that was considered unrecoverable according to the manual. The satellite simply was not supposed to be able to come back from that situation.
But as all hackers know, most kinds of system can be made to do things they aren't supposed to. The ESA's team managed in the end to hack Samba and get it to fire up its WEC again.
"The solution was based on a 'dirty hack' jargon referring to any non-standard procedure but we really had no other option," says Jrgen Volpp, Cluster operations manager.
According to an ESA statement, "Cluster has since returned to normal operation".
Hackers claim to have broken into Apple's systems before posting a list of names and password hashes online.
The FT, in a story careful to make a number of caveats, attributes the hack on what would appears to be Apple's business intelligence unit on infamous and recently disbanded prankster hackers LulzSec. None of this has been confirmed and Apple is yet to say anything about the supposed hack.
Both LulzSec and Anonymous have targeted security consultancies and multinationals such as Sony over recent weeks, partly out of mischief and partly to expose poor security practices. The Apple attack might be taken to fit with that broad aim.
Anonymous linked to the supposed Apple data dump before, saying that "Apple could be target, too. But don't worry, we are busy elsewhere".
The whole situation is confusingly sketchy and all we can say for sure is that internal users of Apple's survey site ought to change their password, especially if they used login credentials likely to be exposed by a brute-force dictionary attack on the exposed password hashes.
The hack is limited to a problem with the survey site, so iTunes users, for example, should rest easy that their login credentials have not been exposed.
A Twitter account maintained by Fox News has been hacked to post fake "Obama assassinated" stories.
The @foxnewspolitics account was seized to post a succession of bogus updates (example below) on the false story that Obama was shot and killed while supposedly campaigning at a Ross' restaurant in Iowa.
The obviously compromised account has more than 33,000 followers. Such hacks are often an attempt to trick surfers into visiting links for more information that actually land on sites running fake anti-virus scans. No malware payload or links have yet appeared in this case, though that could easily change.
It is unclear who pulled off the attack but it bears the hallmarks of an attack carried out for bragging rights and using password-guessing, possibly by a group of LulzSec wannabes. The timing of the hack early on Monday morning (US time) coincides with US Independence Day.
Scammers have wasted little time in exploiting the launch of Google+ to mount a spam campaign ultimately designed to promote penis pills and other unlicensed pharmaceutical sales from dodgy websites.
Supposed Google+ invitations intercepted by net security firm Sophos last weekend actually point to online pharmacies. The messages look similar to genuine Google+ invites but clicking on the links leads to sites selling Viagra and Cialis rather than an opportunity to connect via Google's nascent social networking site.
Quite who would decide to buy Viagra from a random site in these circumstances is unclear but cybercrooks obviously reckon the ploy is worth a punt. The sites spamvertised are offering a special July 4 (US Independence Day) promotion.
Google+ opened its door on an invitation-only basis on June 28. Members were allowed to invite their friends to join the site for a short time around a day after the launch until Google suspended the feature, citing extreme demand. The suspension of the invitation feature may have contributed to increasing the potency of last weekend's spam campaign.
A full write-up of the scam, reckoned to be the first of its type to target Google+, can be found in a blog post by Sophos here.
A lawyer for copyright troll Righthaven is declaring under penalty of perjury that an update to his computer’s browser prohibited him from electronically submitting a legal filing by an angry judge’s deadline.
And it was no ordinary filing U.S. District Judge Roger Hunt was demanding.
Nevada’s chief judge two weeks ago ordered Righthaven, which sues bloggers and websites for infringement of Las Vegas Review-Journal articles, to explain why the litigation factory made “dishonest statements to the court.” Hunt wanted the answer by June 28, but Righthaven’s Las Vegas-based lawyer filed a reply a day late.
The reason it was untimely, Righthaven attorney Shawn Mangano said, was because an “automatic software update for the internet browser” on his computer caused the browser to stop working with the federal judiciary’s electronic filing system, known in legal circles as CM/ECF.
“This automatic software update caused my internet browser to be incompatible with the court’s CM/ECF electronic filing system. While the CM/ECF system was accessible to me, it did not permit any files to be attached for submission,” (.pdf) Mangano wrote.
The judiciary’s filing service is generally compatible with the major browsers, including Internet Explorer, Safari, Firefox and Chrome. Mangano did not respond for comment.
Mangano’s filing was in response to a June 14 order in which Hunt called Righthaven’s litigation effort “disingenuous, if not outright deceitful.” (.pdf)
Hunt demanded Righthaven explain why Hunt should not sanction it for trying to “manufacture standing.” Standing is a legal concept that has enabled Righthaven to bring 200-plus lawsuits for infringing the copyrights of Stephens Media, which owns the Review-Journal.
Hunt wanted Righthaven to explain why it failed to disclose, under a rule of civil procedure, that Las Vegas-based Stephens Media had a “pecuniary interest” (.pdf) in the outcome of Righthaven cases.
An internal accord between Righthaven and Stephens Media granted the Review-Journal’s owner and Righthaven each a 50 percent stake in any settlements or verdicts.
What’s more, Righthaven said in its lawsuits that it owned the copyrights it was suing over. But the internal memo disclosed in the case showed that Stephens Media retains “an exclusive license to exploit the Stephens Media assigned copyrights for any lawful purpose whatsoever and Righthaven shall have no right or license to exploit or participate in the receipt of royalties from the exploitation of the Stephens Media assigned copyrights other than the right to proceeds in association with a recovery.”
With that, Judge Hunt dismissed Righthaven’s suit against the Democratic Underground blog because, he ruled, “a copyright owner cannot assign a bare right to sue.”
Several other cases have been dismissed for the same reason, and many more are likely.
Mangano told Judge Hunt he didn’t think it was necessary to disclose the financial link contained in the so-called Strategic Alliance Agreement between Righthaven and Stephens Media, which invested $500,000 in Righthaven.
“I reasonably viewed any contingent payment to Stephens Media under the SAA as constituting an indirect interest that required a two-step payment process assuming any case resulted in a recovery. Simply put, receipt of settlement funds through settlement or recovery by the enforcement of a judgment would be made to Righthaven,” he wrote. “Righthaven would then be contractually obligated under the SAA to subsequentlypay Stephens Media any recovered sums over and above costs incurred.”
Mangano said he has started “taking corrective action” and has filed “amended disclosures” in 80 pending cases in Nevada and 34 in Colorado.
Photo: FindYourSearch/Flickr
See Also:
Stephens Media, the Las Vegas–based media chain, is fighting to keep its latest business model alive: copyright-trolling.
After standing on the sidelines while professional content-troll Righthaven fights in court, the newspaper company that seeded the venture joined the fray late Tuesday, telling a federal judge who questioned the business model’s latest iteration that the litigation factory is not a “sham.”
Stephens Media invested $500,000 a year ago in an upstart called Righthaven and authorized the venture to sue bloggers and websites for infringement of Las Vegas Review-Journal articles. But Stephens Media, which owns the Las Vegas Review-Journal and a host of other outlets, is running into a judicial brick wall, and it has nothing to do with the copyright allegations lodged in more than 200 suits in Nevada and dozens elsewhere.
Stephens Media told Chief U.S. District Judge Roger Hunt of Nevada that it revised the business arrangement, and ceded its content to Righthaven to cure any standing issues.
But the problem with the latest, revised model is that Stephens Media wants to have its cake and it eat too.
The media outlet, which did not respond Wednesday for comment, is seeking essentially risk-free dividends on the back of the Copyright Act, which allows for damages of up to $150,000 an infringement. Righthaven and its chief executive, Steve Gibson, would assume the litigation risks and costs, and Stephens media would get a 50 percent cut from any settlements or verdicts.
Sounds like a cash cow, in theory anyway.
But Stephens Media didn’t foresee the legal train wreck that seemingly has stopped Righthaven’s trolling in its path.
The roadblock is that several judges have recently cried foul on the business model, ruling Righthaven has no legal standing to bring the cases. That’s because Stephens Media kept ownership of the copyrights in the articles, which meant Righthaven had no right to sue over the work.
Now Righthaven and Stephens Media have reworked their agreement — a contract or “assignment” that Gibson, and now Stephens Media, say grants Righthaven standing to sue.
“Such limitations on an assignment do not invalidate or make it a sham,” (.pdf) Stephens Media attorney Colby Williams told Judge Hunt in a court filing.
Yet under the latest plan, Stephens Media still does not give up its copyright — meaning it wants to reap the benefits of risk-free payouts while continuing to retain ownership of the works in question.
Under the latest terms, which a different Nevada federal judge last week ruled did not give Righthaven standing, Stephens Media assigns its copyrights to Righthaven, but with a number of caveats. Under the deal, Righthaven is required to give Stephens Media 30 days’ notice if it plans to capitalize on those works for any other purpose than bringing an infringement action. And Stephens Media reserves the right to re-acquire for $10 any copyright it had ceded to Righthaven.
In effect, the arrangement prevents “Righthaven from ever exploiting or reproducing the work,” U.S. District Judge Philip Pro of Nevada ruled in dismissing a Righthaven case last week.
But Stephens Media isn’t giving up. It is demanding Judge Hunt bless the latest strategy, in an ongoing case against the Democratic Underground blog.
Hunt, without examining the latest Righthaven-Stephens Media agreement, ruled two weeks ago that the companies were attempting to “manufacture” standing and dismissed Righthaven’s lawsuit against the Democratic Underground, which was targeted for posting four paragraphs from a 34-paragraph story published by the Review-Journal.
Kurt Opsahl, the EFF attorney representing the Democratic Underground, said in a telephone interview that the latest iteration “doesn’t solve the problem. It does not give the clear ownership that Righthaven and Stephens Media are asserting.”
See Also:
Illustration: Electronic Frontier Foundation
The U.S. Supreme Court ended its 2010-2011 term Monday, deciding a slew of technology and civil rights issues, some of which have far-reaching implications for the Freedom of Information Act, intellectual property, warrantless searches of private residences, the “state secrets” privilege and freedom of speech.
The cases we tracked from October involved regulation of videogame sales, the limits of the Copyright Act’s first-sale doctrine and the power of the government to collect sensitive data on employees. Another case asked whether convicted defendants have a right to sue under a civil-rights statute to obtain modern DNA testing in an attempt to prove their innocence.
Here is a summary of rulings in cases we followed:
Oral argument Nov. 8
Decided 4-4 Dec. 13
Question presented: Does the first-sale doctrine apply to imported goods manufactured abroad?
Answer: No
The court answered the question in the negative, but voted 4-4 with Justice Elena Kagan recused. That means there’s no nationwide precedent, but the ruling stands for the case before it.
That case concerned Costco, which was selling the Omega Seamaster watch for about $1,300, well below the $2,000 recommended U.S. price. Omega, of Switzerland, had copyrighted the watch design in the United States by imprinting the company’s emblem on the underside of the timepiece. Omega sued Costco for copyright infringement, because it was obtaining the watches from unauthorized dealers in Europe, which sold them far cheaper than U.S. Omega distributors.
But under the U.S. Copyright Act, the first-sale doctrine generally allows the purchaser of a copyrighted work to resell the work without the copyright holder’s permission. That’s why we have used bookstores, record stores, GameStop and even eBay.
That didn’t stop the Supreme Court from upholding the 9th U.S. Circuit Court of Appeals, which sided with Omega. The justices, in an unsigned opinion, ruled that the first-sale doctrine did not apply to Omega watches (.pdf) because they were made overseas. That meant Costco can be held liable for copyright infringement for the unauthorized resale of Omega’s watches because Costco purchased them via unauthorized channels.
Costco had appealed the 9th Circuit’s decision, pointing out that the ruling effectively urges U.S. manufacturers to flee (.pdf) the United States to acquire complete control over distribution of their goods in the American market. The Obama administration had taken Omega’s side, saying the Copyright Act “does not apply outside the United States.” (.pdf)
Oral argument Oct. 13
Decided 6-3 March 7
Question presented: Do convicts have a right to to sue under a federal civil rights for post-conviction DNA testing?
Answer: Yes
The case concerned condemned Texas inmate Henry Skinner, who was convicted of the 1995 murder of his girlfriend and her two sons. Skinner claimed breaches of his Fourth Amendment due process right and Eighth Amendment right to be free from cruel and unusual punishment, because he hasnt been allowed a test of the DNA found at the crime scene.
The Texas state and federal courts — hearing Skinners habeas corpus pleas — refused to allow post-conviction testing of biological evidence, including blood, hair, fingernail clippings and vaginal swabs. The lower courts held that, under Texas law, a convict must prove, by a preponderance of the evidence, that he or she would not have been prosecuted or convicted had DNA testing been performed. To get DNA testing, a Texas inmate must also demonstrate that his failure to seek such testing at trial was not a strategic decision.
With nowhere else to turn, Skinner sued local prosecutors under a federal civil rights statute, and the Supreme Court halted his execution to determine whether he could gain DNA access via that legal avenue. The states claimed that such legal jockeying was a backdoor attempt to rewrite both state and federal death-penalty law.
At least 22 states told the justices that granting Skinner DNA testing through a civil rights suit would undermine their individual statutes, which spell out when an inmate is entitled to it.
“To allow this type of procedural legerdemain would both diminish the sovereign interests of the states and at the same time impose a significant burden on the states’ limited law enforcement resources,” attorneys general from the 22 states wrote.
Justice Ruth Bader Ginsburg, writing for the majority, ruled only that inmates could sue under the civil rights statute to press a claim that they were unconstitutionally denied DNA testing in state court. Whether testing is actually granted is another story.
The justices, Ginsburg wrote, ruled in 2009 that inmates have no “freestanding right” to access genetic evidence. But Ginsburg said that decision “left slim room for the prisoner to show that the governing state law denies him procedural due process.” (.pdf)
Skinner’s civil right claim is pending.
Oral argument Oct. 5
Decided 8-0 Jan. 19
Question presented: Must U.S. government contractors undergo the same background checks as federal employees?
Answer: Yes
The justices were weighing a lower-court decision surrounding the concept of so-called “informational privacy.” The 9th U.S. Circuit Court of Appeals struck down intrusive background checks on nearly three dozen NASA contractors as being an invasive, unconstitutional “broad inquisition.”
The Supreme Court reversed, with Justice Kagan recused. As solicitor general, she urged the court to rule in favor of the Obama administration, which the court obliged. The high court found there was no breach in the contractors’ privacy rights. The checks were “reasonable, employment-related inquiries that further the government’s interests in managing its internal operations,” Justice Antonin Scalia concluded for the court.
The checks sought information from any and all sources about the contractors’ sex lives, finances and any drug use. The contractors being investigated were not privy to classified information.
The NASA contractors worked at the Jet Propulsion Laboratory in Pasadena, California, where it generally engages in the scientific study of the Earth and solar system.
Oral argument Jan. 19
Decided 8-0 March 1
Question presented: The Freedom of Information Act exempts the government from disclosing law enforcement records if they “constitute an unwarranted invasion of personal privacy.” Does that personal exemption apply to a corporation, in this case AT&T?
Answer: No
The Supreme Court, with Kagan recused, reversed the 3rd U.S. Circuit Court of Appeals, which was the outcome the Obama administration had urged when Kagan was solicitor general.
The case concerned trade group CompTel’s FOIA request in 2005 for records AT&T forwarded to the FCC’s enforcement bureau concerning AT&T’s admitted overpricing of telecom equipment and services to Connecticut schools under the graft-ridden E-Rate program.
The FCC, against AT&Ts objections, said the records could be released because the company has no “personal privacy.” AT&T appealed to the circuit court, which said corporations were, indeed, “persons” subject to protection from disclosure.
“Corporations, like human beings, face public embarrassment, harassment and stigma,” the appeals court ruled last year. The FCC appealed.
“This is not to say that corporations do not have correspondence, influence, or tragedies of their own, only that we do not use the word ‘personal’ to describe them,” (.pdf) Chief Justice John Roberts wrote for the court.
Oral argument Jan. 18
Decided 9-0 May 23
Question presented: Can the government simultaneously claim a party owes it money and invoke the “state secrets” privilege to prevent a courtroom defense to that claim?
Answer: No
The Court of Appeals for the District of Columbia Circuit ruled it could, a decision the justices reversed.
The dispute concerned the government’s assertion of the state-secrets privilege, a privilege more often used in lawsuits surrounding terrorism and national security cases. The privilege, which has been used repeatedly by the Bush and Obama administrations, often requires the courts to toss a lawsuit once the government makes the assertion that the case would endanger national security. It was first recognized by the Supreme Court in a McCarthy-era lawsuit.
Before the justices was an appeal in a long-running case by the two defense contractors.
The government wanted them to repay as much as $3 billion for the scuttled A-12 Avenger stealth fighter program. The government demanded the money back after Defense Secretary Dick Cheney claimed in 1991 that the companies were in default on a 1988 contract to build eight of the planes for $4.4 billion.
Justices Scalia found that, if the government is going to withhold evidence by citing the privilege, it is not entitled to monetary damages (.pdf) in contractual disputes.
The justices, without questioning the government’s privilege, ruled it would not be fair for the government to win monetary awards if the government was not required to turn over evidence to the other side.
Oral argument Jan. 12
Decided 8-1 May 16
Question presented: Can police create their own emergency, “exigent circumstance,” to bypass the need for a warrant to enter a private residence?
Answer: Yes
The Kentucky Supreme Court had answered “no” in a legal flap to which the nation’s highest court has given little guidance — resulting in conflicting precedents on the topic across the nation.
“The Kentucky Supreme Court held that the exigent circumstances rule does not apply in the case at hand because the police should have foreseen that their conduct would prompt the occupants to attempt to destroy evidence,” Justice Samuel Alito wrote for the majority. “We reject this interpretation of the exigent circumstances rule. The conduct of the police prior to their entry into the apartment was entirely lawful. They did not violate the Fourth Amendment (.pdf) or threaten to do so. In such a situation, the exigent circumstances rule applies.”
The appeal concerned a 2005 crack cocaine sting operation in Lexington, in which an informant purchased the illicit substance from a suspect outside an apartment complex. The suspect then walked through a breezeway of the complex, and officers on foot lost track of him.
The police smelled marijuana outside an apartment, which was not the apartment the suspect had entered. They knocked and yelled ‘police,’ heard some noise inside and kicked down the door to let themselves in on a belief that drug evidence was possibly being destroyed. The suspect they were looking for was not there, but three others were arrested for marijuana and cocaine possession.
One defendant, Hollis King, challenged his arrest, claiming it was based on an illegal entry. He pleaded guilty on the condition of an appeal and was sentenced to 10 years.
In dissent, Justice Ruth Bader Ginsburg said the police needed a warrant before entering the apartment.
“The court today arms the police with a way routinely to dishonor the Fourth Amendments warrant requirement in drug cases,” Ginsburg wrote. “In lieu of presenting their evidence to a neutral magistrate, police officers may now knock, listen, then break the door down, never mind that they had ample time to obtain a warrant.”
Oral argument Nov. 2
Decided 7-2 June 27
Question presented: May the states ban the sale or rental of violent videogames to minors?
Answer: No
The case the justices decided concerned a 2005 California ban adopted by state lawmakers. The 9th U.S. Circuit Court of Appeals of San Francisco in 2008 overturned the law, saying there’s not sufficient evidence that violent videogames harm youngsters under 18, and that the games were protected by the First Amendment.
Hearing California’s appeal, the high court agreed with the lower court, with Justice Antonin Scalia writing the majority.
“Our cases have been clear that the obscenity exception to the First Amendment does not cover whatever a legislature finds shocking, but only depictions of ’sexual conduct,’” Scalia wrote. He added that the videogame law “abridges the First Amendment rights (.pdf) of young people whose parents (and aunts and uncles) think violent videogames are a harmless pastime.”
Six other states and several local governments had adopted similar bans — which provide for a $1,000 fine for sellers. Every court that has heard a challenge to all these laws has struck them down on First Amendment grounds.
In dissent, Justice Clarence Thomas wrote that the First Amendment does not grant minors a right “to access speech,” and that the law “is not facially unconstitutional under the First Amendment.”
California’s law, which was never in force, affected games involving “killing, maiming, dismembering, or sexually assaulting an image of a human being.”
See Also:
Marijuana photo: Laughing Squid/Flickr
Microsoft photo: Nils Geylen/Flickr
The hacking group Lulz Security ended its 50-day reign of terror this weekend, but law enforcement’s hunt for its members will go on. Last week, FBI agents raided an Iowa woman’s home because of her connections to the group.
At about 11 am last Thursday, 29-year-old Laurelai Bailey heard a knock at her Davenport, Iowa home. She found around eight FBI agents swarming at her doorstep, search warrant in hand. But the agents politely “told me they weren’t there to arrest me,” Bailey tells us in an interview.
Instead, they had some questions about hackers Bailey had been hanging out with online. They told Bailey they were investigating a February attack against the security firm HBGary by an elite group of hackers associated with the hacktivist collective Anonymous. Those hackers would later break away from Anonymous to form Lulz Security, who attacked the FBI, PBS, and the CIA in a well-publicized spree before calling it quits this weekend amid increasing pressure and the arrest of a purported member in England.
Bailey’s conversation with the feds lasted about five hours, during which she told them everything she knew. But Bailey says she knew nothing that anyone couldn’t find out themselves, using leaked chat logs and Google. The feds also asked if she could infiltrate the group.
“They wanted to know if I could get close to them,” Bailey says. “I told them these people hate me… it wouldn’t do any good.” Bailey says Lulz Security hackers hold a grudge against her for leaking logs from the secret chat room in which they planned the HBGary hackwhich she says she did in retaliation for them harassing some of her friends. (We later published an article based on the logs.) When the interview was over, the agents carted off a couple of her hard drives, her camera and other computer equipment.
According to Bailey, the agents who interviewed her were specifically interested in a member of Lulz Security who goes by the handle “Kayla.” “Anytime I mentioned her, they seemed particularly interested,” Bailey says.
Little is known for sure about Kayla: She was instrumental in the HBGary attack and was a founding member of Lulz Security. She’s claimed to be a 16-year-old girl, though rumors persist that she’s actually a 20-something guy from New Jersey. Others speculate Kayla is Taiwanese, or actually a sockpuppet controlled by many different people. Her purported Twitter account is made up of infuriatingly opaque status updates about going partying and going on vacation. The most recent: “right gonna go get rdy bye twitter ”.
Bailey says Kayla is “friendly” but mysterious, limiting their exchanges mostly to public tweets.
But Bailey insists she was never a member of LulzSec, nor has she ever engaged in illegal hacking. In the chat logs she leaked, she is seen chatting freely with the hackers as the HBGary hack unfolded, offering advice, kibitzingeven giving suggestions for a logo. But she says she became close to the hackers through her involvement with Crowdleaks, a Wikileaks-focused news website. She claims she was in the room during the HBGary hack simply acting as a reporter for Crowdleaks.
Although she’s not worried about getting in trouble with the law, the raid has already screwed up her life in another way. After she chatted with a friend online about the raid last week, the record of their chat was leaked in a document which portrayed her as a member of LulzSec “snitching” on her fellow hackers. The document included her real name and contact information, and the association with Lulz Security caused her to lose her job in tech support.
“They fired me because I was apparently making the company look bad,” Bailey said.
The raid of what appears to be an insignificant figure in the Lulz Security universe offers a glimpse into how the authorities are going about catching the notorious hackers. It’s not just complicated computer forensics, which will likely lead to dead ends if the hackers were smart enough to cover their tracks. Everyone LulzSec hackers have come into contact with over their entire hacking careers will be swept up in the investigation. Though Bailey said she had no smoking gun to offer the feds, someone might.
See Also:A federal judge has found that Google can be held liable for damages for secretly intercepting data on open Wi-Fi routers. The ruling is a serious legal setback for the search giant over activity it has engaged in across the United States for years.
That decision, the first of its kind, was handed down late Wednesday by a Silicon Valley federal judge presiding over nearly a dozen combined lawsuits seeking damages from Google for eavesdropping on open Wi-Fi networks from its Street View mapping cars. The vehicles, which rolled through neighborhoods across the country, were equipped with Wi-Fisniffing hardware to record the names and MAC addresses of routers to improve Google location-specific services. But the cars also secretly gathered snippets of Americans’ data.
“The court finds that plaintiffs plead facts sufficient to state a claim for violation of the Wiretap Act. In particular, plaintiffs plead that defendant intentionally created, approved of, and installed specially-designed software and technology into its Google Street View vehicles and used this technology to intercept plaintiffs’ data packets, arguably electronic communications, from plaintiffs’ personal Wi-Fi networks,” U.S. District Judge James Ware ruled. “Further, plaintiffs plead that the data packets were transmitted over Wi-Fi networks that were configured such that the packets were not readable by the general public without the use of sophisticated packet-sniffer technology.” (.pdf)
Judge Ware’s ruling is important not only to Google, but to the millions who use open, unencrypted Wi-Fi networks at coffee shops, restaurants or any other business that tries to attract customers by providing Wi-Fi. The decision comes on the heels of a Federal Trade Commission antitrust probe into Google’s search and ad businesses, and comes as attorneys general from several states are settling an inquiry into the Wi-Fi affair.
Google, in seeking a dismissal, claimed it is was not illegal to intercept data from unencrypted, or non-password-protected Wi-Fi networks. Google said open Wi-Fi networks are akin to “radio communications” like AM/FM radio, citizens’ band and police and fire bands, and are “readily accessible” to the general public — a position rejected by Ware.
Christian Jenkins, an Ohio attorney on the case against Google, said in a telephone interview that the decision means Google’s actions were an “invasion of privacy.”
“We would not have signed up for this case if we didn’t think that’s what the judge would decide,” he said. “This sends a very, very simple message. Don’t intercept peoples’ e-mail. Period.”
Google said it didn’t realize it was sniffing packets of data on unsecured Wi-Fi networks in about a dozen countries over a three-year period until German privacy authorities began questioning last yearwhat data Google’s Street View cars were collecting. Google, along with other companies, use databases of Wi-Fi networks and their locations to augment or replace GPS when attempting to figure out the location of a computer or mobile device.
Google told the public the affair was a “mistake,” and that it only collected “fragments” of data as its Street View cars drove through neighborhoods. Google said it has not reviewed the data, which now remains under courthouse lock and key.
Google said in a statement that the lawsuit is “without merit,” and that the judge “should have dismissed the wiretap claim.” The Mountain View, California company said it was “exploring our options,” which include litigating the case or settling.
According to the Wiretap Act, amended in 1986, it’s not considered wiretapping “to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public,” according to the text of the federal wiretapping statute.
But Judge Ware said that interpretation did not apply to open, unencrypted Wi-Fi networks and instead applied only to “traditional radio services.”
“The matter before the court presents a case of first impression as to whether the Wiretap Act imposes liability upon a defendant who allegedly intentionally intercepts data packets from a wireless home network,” Ware ruled.
No hearing date has been set.
Photo: dspain/Flickr
See Also:
Cybercrims are switching tactics from traditional email-based mass security threats to lower volume targeted attacks, according to a report by Cisco Security Intelligence Operations.
A survey of more than 360 IT bods across 50 organisations found that in the past year the cost of email-based hacks - financial, stolen credentials, remediation - fell from $1bn to $300m but but scam and malicious attacks grew from $50m to $200m.
"The business activity caused by highly-personalised targeted attacks is growing rapidly, tripling in the last year," stated the report.
A number of high profile victims include RSA, Google and Sony,
Proliferation was compounded by the shift toward mobility, uncontrolled endpoints and IT policies focusing on identifying classic threats in messages or malicious downloads.
Spam message volumes fell by 80% from 300 billion to 40 billon a day as law enforcement agencies, along with security and IT industry firms worked together to "shut down or limit the largest spam-sending botnets and their associates".
Targeted attacks, which typically use some form of malware, are aimed at a specific user or user group - customers of a bank - containing high levels of personal info gleaned from dossiers collated on social networking sites, press releases or company correspondence.
"[These] are difficult to protect against and have the potential to deliver the most negative impact to victims," said the report, adding that the value per victim is roughly 40 times higher than a mass security attack.
"Spearphishing attack campaigns are limited in volume but offer higher user open and click through rates. With these constraints, cybercriminals are increasingly focusing on business users with access to corporate banking accounts to make sure they're seeing a sufficient return per infection." it added.
The cost to organisations not limited to financials or remediation of injected hosts but to the brand reputation of the victim.
"With the number of targeted attacks expected to increase cybercriminal activity will continue to evolve, as will its impact," the report concluded.
The properly paranoid can now relax, BeenVerified is available for Android and iPhone platforms: so you can check out the history of anyone you meet instantly - if they're American, anyway.
The service has been around as a website for a while, checking different publicly available sources of information and compiling a report on any individual based on their name and State of residence. Gizmodo notes the mobile release, and interestingly argues that the app is in no way creepy despite the promotional video which makes it look pretty disturbing:
BeenVerified Commercial from BeenVerified on Vimeo.
BeenVerified is the company behind "Sex Offender Tracker", which purports to show a real-time radar giving the location of local sex offenders, though the reviews suggest the information isn't always accurate.
Gizmodo's point is that we're all just going to have to get used to everyone we meet knowing everything there is to know about us, something explored delightfully in Gary Shteyngart's Super Sad True Love Story, but not necessarily a world in which many of us would be comfortable.
But unless we adopt Eric Schmidt's idea of changing identities every now and then we'll have to modify that old saying: There's no strangers in this world, only people on whom you've not yet run a background check.
A request by Google to throw out a lawsuit that alleges the company violated US federal wiretap law has been rejected by a judge in San Francisco.
This means Google can be sued for its Street View vehicles' Wi-Fi data slurp, reports The Wall Street Journal.
Plaintiffs from a number of states in the US are seeking class-action status in their lawsuit. They charge that Google fully intended to intercept information from wireless networks using its Street View cars.
It's alleged that Google violated the Federal Wiretap Act when it slurped up personal data including email messages and passwords from unsecured Wi-Fi networks.
US District Judge James Ware said the plaintiffs had provided sufficient statements to allow their case to be heard in court.
Google's request to the judge to reject part of the lawsuit was granted, however. He threw out allegations that the company violated some state wiretap statutes as well as a unfair competition statute claim.
"We believe these claims are without merit and that the court should have dismissed the wiretap claim just as it dismissed the plaintiffs' other claims. We're still evaluating our options at this preliminary stage," Google said in a statement to the WSJ.
In the early hours of this morning, Microsoft's Windows Phone group program manager Reid Kuhn penned a well-timed blog post, in which he noted the "high level of public interest in how and why companies collect Wi-Fi access point information."
Redmond published "relevant portions of the source code" for its own data-slurping software in an effort to appear "transparent" about the company's methods.
To defend Microsoft's database that's being built to serve up location-based services for its Windows Phone 7 and Bing products, Kuhn pointed out that such a data slurp was industry-wide.
"The mobile phones we use for these surveys are only capable of observing the same data points about Wi-Fi access points that any phone, computer or other device connecting to Wi-Fi access points can observe," he said.
However, he also insisted that "the software does not intercept wireless data transmissions from consumers' computers (so called 'payload' data). The software neither observes nor records any information that may contain user content transmitted over a network. At Microsoft, we place a priority on privacy and take steps to help ensure that our products and services protect consumers information."
So that's alright then.
It appears that the NHS will move security for its million-plus users to in-cloud services from Zscaler.
The deal has not officially been announced but news is leaking out, such as in an agenda item entitled "Zscaler Web Security Service Within N3" for an N3 user conference happening now.
There is also a Satisnet Zscaler seminar which is described thus: "Within 45 minutes you will be able to understand why Zscaler has a vast array of UK customers from NHS to retail and financial institutions reaping the benefits from their web and email technology."
Privately owned Zscaler was founded in 2007 by Jay Chaudhry and has no VC funding. It has 50 or so data centres around the globe providing low-latency traffic-scanning services in the cloud for its customers.
Its thinking is that mobile users need protecting when outside company firewalls and security perimeters. If the perimeter becomes the cloud then users don't need in-device security products such as McAfee or Norton anti-virus products.
Our understanding is that NHS chose the Zscaler technology for several reasons, with one being network bandwidth concerns.
One commonly-encountered problem is that of users going to YouTube to play videos. Among other capabilities, Zscaler's technology enables realtime bandwidth-throttling for such sites.
The Information Commissioner's Office is working with Connecting for Health to try to get the NHS to take data security seriously.
The news comes as another five NHS bodies sign undertakings with the regulator to improve processes.
Information Commissioner Christopher Graham said: "The health service holds some of the most sensitive personal information of any sector in the UK. Millions of records are constantly being accessed and we appreciate that there will be occasions where human error occurs. But recent incidents such as the loss of laptops at NHS North Central London which we are currently investigating suggest that the security of data remains a systemic problem.
"The policies and procedures may already be in place but the fact is that they are not being followed on the ground. Health workers wouldn't dream of discussing patient information openly with friends and yet they continue to put information on unencrypted memory sticks or fax it to the wrong number."
Graham said the NHS needs a culture change to ensure data is properly looked after.
Basildon and Thurrock University Hospitals recently had to apologise for sending patient records to the wrong fax number. Dunelm Medical Practice also admitted fax misuse and disclosing two patients' discharge letters.
East Midlands Ambulance Service lost an unencrypted memory stick with patient records on it.
Ipswich Hospital NHS Trust admitted to having left 29 patient records containing sensitive information in a public place and Lancashire Teaching Hospitals NHS Trust also owned up to serial fax abuse.
The full ICO undertakings can be downloaded here.
The family of a 15-year-old Xbox player was raided by heavily armed police after a disaffected online opponent made a hoax emergency call claiming there was a home invasion in progress.
According to news reports, SWAT, or special weapons and tactics, police entered the Naples, Florida, residence of Hunter Gelinas after receiving a false report that he had been stabbed and his family was being held captive. The reports blamed the stunt on a fellow Xbox user the youth had met online.
They had a whole SWAT team at my door and I came out of my room and they've got their guns pointed at me, Gelinas told WINK TV news. Attempts by The Register to reach him weren't successful. A spokeswoman for the Collier County Sheriff's Office confirmed the hoax emergency call and was looking in to exactly how it was made.
The incident is the latest to highlight the real-world perils that can follow virtual rivalries that start on Microsoft's Xbox Live network or other services. In 2007, security expert Kevin Finisterre of Digitalmunition found the Xbox account of a girlfriend had been banned shortly after he had accused several online opponents of cheating during a heated game of Halo 2. He later concluded that the ban was the work of people who relied on social engineering to convince support personnel to help the attackers take control of the accounts.
Eight months later, celebrity Xbox gamer Colin Fogel lost control of his Xbox Live account by thieves he suspects of using similar techniques. He said it was the third time his account had been commandeered.
News reports claim that Tuesday's attack against Gelinas happened after someone hacked his Xbox. The more likely explanation is that opponents pieced together enough data available online to learn his name and location and called in the hoax emergency to authorities.
This conjecture is supported by documents posted online eight days ago that list Gelinas's address, phone number, and the names of various family members. Such doxing in which a target's personal information is publicly documented is a common technique hackers use in coordinating or carrying out attacks.
I got ur ip !!!!!!!!!!! the unknown poster wrote. With cain and abel ima type it in my mIRC serceveer.
Indeed, Xboxes have long been known to leak users' IP addresses, and the password recovery tool known as Cain and Abel, as documented in tutorials such as this one, are a favorite way for people with little skill to quickly exploit the weakness. Using the information included in the document, a detailed snapshot of Gelinas quickly emerged, including the value and purchase history of his home and his father's occupation.
So-called swatting attacks, in which hackers use caller ID spoofing to orchestrate SWAT raids on people they don't like, were all the rage a few years ago but seemed to fall out of vogue after police vigorously pursued suspects in several high-profile cases.
Reports of one being used against the Florida family suggest they haven't gone away. Xbox Live users operating under the assumption they're anonymous may want to keep that in mind the next time they're tempted to talk smack against an opponent.
A federal judge has found that Google can be held liable for damages for secretly intercepting data on open Wi-Fi routers, dealing the search giant a serious legal setback for activity it has engaged in across the United States for years.
That ruling, the first of its kind, was handed down late Wednesday by a Silicon Valley federal judge presiding over nearly a dozen combined lawsuits seeking damages from Google for eavesdropping on open Wi-Fi networks from its “Street View” mapping cars. The vehicles, which strolled through neighborhoods across the country, had been equipped with Wi-Fisniffing hardware to record the names and MAC addresses of routers to improve Google location-specific services.
“The court finds that plaintiffs plead facts sufficient to state a claim for violation of the Wiretap Act. In particular, plaintiffs plead that defendant intentionally created, approved of, and installed specially-designed software and technology into its Google Street View vehicles and used this technology to intercept plaintiffs’ data packets, arguably electronic communications, from plaintiffs’ personal Wi-Fi networks,” U.S. District Judge James Ware ruled. “Further, plaintiffs plead that the data packets were transmitted over Wi-Fi networks that were configured such that the packets were not readable by the general public without the use of sophisticated packet sniffer technology.”
Judge Ware’s ruling is important not only to Google, but to the millions who use open, unencrypted WiFi networks at coffee shops, restaurants or any other business trying to attract customers.
Google, in seeking a dismissal, claimed it is was not illegal to intercept data from unencrypted, or non-password-protected Wi-Fi networks. Google said open WiFi networks are akin to “radio communications” like AM/FM radio, citizens’ band and police and fire bands, and are “readily accessible” to the general public a position rejected by Ware.
Google said it didn’t realize it was sniffing packets of data on unsecured Wi-Fi networks in about a dozen countries over a three-year period until German privacy authorities began questioning what data Google’s Street View cars were collecting. Google, along with other companies, use databases of Wi-Fi networks and their locations to augment or replace GPS when attempting to figure out the location of a computer or mobile device.
According to the Wiretap Act, its not considered wiretapping “to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public,” according to the text of the federal wiretapping statute.
But Judge Ware said that interpretation did not apply to open, unencrypted Wi-F networks and instead applied only to “traditional radio services.”
“The matter before the court presents a case of first impression as to whether the Wiretap Act imposes liability upon a defendant who allegedly intentionally intercepts data packets from a wireless home network,” Ware ruled.
No hearing date has been set.
Google did not immediately respond for comment.
(Will be updated)
Photo: dspain/Flickr
Arabic | Bulgarian | Chinese | Croatian | Czech | Danish | Dutch | Finnish | French | German | Greek | Hebrew | Hungarian | Italian | Japanese | Korean | Latvian | Lithuanian | Norwegian | Polish | Portuguese | Romanian | Russian | Serbian | Slovak | Spanish | Swedish | Thai | Turkish | Ukrainian
"The strongest case for information disclosure is when the benefit of releasing the information outweighs the possible risks. In this case, like many others, the bad guys already won. Exploits are already being used in the wild and the fact that the rest of the world is just now taking notice doesn't mean that these are new vulnerabilities. At this point, the best strategy is to raise awareness, distribute the relevant information, and apply pressure on the vendor to release a patch." - H D Moore
Hacking Expose! is an underground project aimed to put internet security issue under the spotlight. The information found here are simply a security alarm for internet users, administrators and those who forget to pass their scripts through a security check.
We will not expose problems that pose a high exploitation risk on the website in cause.
We will not save or distribute private data belonging to the affected websites or of their customers.
In most of the cases we will contact the website administrator about their website’s vulnerability.
We will do a full disclosure if the vulnerability isn’t patched in useful time or if it’s been patched after the admin is contacted. We reserve the right not to contact the webmaster before the vulnerability is posted in some cases .
Problems that affect software or problems like cross site scripting will be immediately posted without any warning to the software vendor/webmaster.
We reserve the right not to answer the messages received from the affected companies or those through which vulnerabilities are reported.
For reported vulns. we will always give credits to the one who reported it.
We can’t guarantee that vulns received on the email contact at hacking.expose[at]gmail[dot]com have not already been used for malicious purposes prior to our posting them on our website and we are not to be held responsible for the deeds committed by the ones who reported these vulns.