Archive for 2012/06/08

http://torrentfreak.com/student-fined-for-running-movie-tv-show-subtitle-download-site-120608/

Content vs infrastructure

It’s essentially an argument about using other people’s stuff without their permission. At some point, we have to remember who lays the golden eggs. It isn’t librarians

http://www.theregister.co.uk/2012/06/08/eu_orphan_blessing/

Wishful thinking

http://www.theregister.co.uk/2012/06/08/eu_google_antitrust_remedy_by_july/

Barnes & Noble has lodged a complaint over the ebook settlement proposed by the Department of Justice, claiming that it will be bad news for booksellers and the American public.

The bookseller, which has been competing in the market with its Nook ereader, said that the DoJ’s antitrust case against Apple and five publishing houses over pricing of ebooks was an attempt to regulate “a nascent technology industry that it little understands”.

More:
http://www.theregister.co.uk/2012/06/08/barnes_noble_complaint_ebook_case/

Independent researchers Gleb Gritsai, Alexander Zaitsev, Sergey Scherbel, Yuri Goltsev, Dmitry Serebryannikov, Sergey Bobrov, Denis Baranov, Andrey Medov from Positive Technologies have identified multiple vulnerabilities in the Siemens WinCC application. In evaluating these reported vulnerabilities, Siemens identified an additional vulnerability that is included in this advisory. Siemens WinCC 7.0 SP3 web server and web applications are affected.

These vulnerabilities may allow an attacker to gain unauthorized access, read from, or write to files and settings on the target system.
Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.

Much more:
http://www.us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdf

Threats to our information-centric society continue to grow apace with the number of users and devices that connect to the Internet. In order to disrupt this trend, we must find relevant models and adopt a coordinated approach to protecting people and systems online.

This paper represents a solid first step in establishing the Internet health model as an organizing framework and identifying priority areas for future research. We urge the global policy and technology communities to develop an Internet health model that both protects individuals and balances the security and privacy needs of citizens, governments, and organizations worldwide.

Much more:
http://www.ewi.info/system/files/Internethealth_0.pdf

Internet community won’t accept any type of regulation

http://www.zdnet.com/blog/violetblue/cispa-vote-delayed-internet-defense-league-call-to-action/1378

If you’ve been reading along with this blog, you know that I think antitrust enforcement has gone too far. New examples pop up every day, but perhaps none more bizarrely circular than the one that has reentered the news cycle today: the eBook antitrust lawsuit, wherein the United States Department of Justice (DOJ) is beating up on book publishers for working together to get some leverage against Amazon.

Don’t get me wrong, I’m a proud member of Amazon Prime and the UPS guy is the most frequent visitor to my home. But Amazon is the closest thing to a monopoly that the world of books has ever seen.

More:
http://www.zdnet.com/blog/law/antitrust-enforcement-gone-wild-ebook-edition/119

The term of art among company executives was one Putman had never heard before: “share of stomach.”

“It was a mind-bending paradigm shift for me. We weren’t trying to get share of market. We weren’t about trying to beat Pepsi or Mountain Dew. We were about trying to beat everything.”

Putman embraced the challenge with gusto. In the interview, he recalled giving a presentation in which he showed a chart illustrating how consumption of milk had dropped over time while consumption of a sugary soda — he can no longer remember which product — had risen.

When he pointed to the place where the two lines crossed — the moment in which soda surpassed milk — Putman remembers swelling with pride.

In the interview, Putman said he is also unsettled by the thought that he contributed to soda drinking among young people.

It is long-standing Coca-Cola policy not to directly market any of its products to children younger than 12. The company has never advertised on weekend cartoon shows, for example, and Putman said he was never given data on consumption rates among children 11 or younger.

Still, he said, “magically, when they would turn 12, we’d suddenly attack them like a bunch of wolves.”

Much more:

http://www.washingtonpost.com/national/health-science/former-coke-executive-slams-share-of-stomach-marketing-campaign/2012/06/07/gJQAKwgKMV_story.html

http://news.cnet.com/8301-1023_3-57449802-93/49-percent-of-online-seniors-use-facebook/

That’s where it’ll establish itself first

http://arstechnica.com/business/2012/06/porn-gambling-and-malware-bitcoin-as-the-nets-wild-west/

Previously:

Chinese Government Understands That Increased Anonymity Leads To Less Accountability
http://vrritti.com/2012/06/07/chinese-government-understands-that-increased-anonymity-leads-to-less-accountability/

http://arstechnica.com/tech-policy/2012/06/police-mobile-software-hack-defeating-anti-theft-measure/

http://arstechnica.com/security/2012/06/apache-killer-dos-tool/

http://arstechnica.com/tech-policy/2012/06/big-content-wants-to-bring-sopa-style-policies-to-canada/

The first WiFi products running over the 60GHz band will not include routers

http://arstechnica.com/information-technology/2012/06/7gbps-wireless-transfers-and-streaming-no-router-required/

The company is marketing it as a mobile smart television platform that can handle 1080p video and casual games

More:
http://arstechnica.com/gadgets/2012/06/3-3-hdmi-dongle-android-pocket-tv-funded-within-1-week-on-kickstarter/

Will time and again position himself as merely a facilitator, not an actor

Recently I hear from people that have gotten visits from the dutch FBI/BKA equivalent called “Nationale Recherche”. Apparently some of the people that work there are making house calls while investigating – I kid you not – my involvement with the Occupy movement. As much as I feel I am an authoritative source with regard to my involvement in anything, I have yet to be asked any questions. So I don’t know how serious this is, nor whether this is part of a broader investigation into me, into Occupy or into something else entirely.

It’s probably nothing and I know I don’t have to, but I hope you’ll allow me to use this space to clarify some things anyway. If only to preserve precious government resources and to make sure other people don’t have to be bothered answering questions about me anymore.

Dear people at the Nationale Recherche, (…)

Quote: If you read some of the things I’ve said over the years, you won’t be surprised to hear that I am a longtime fan of the people at Adbusters, a “global network of culture jammers and creatives working to change the way information flows, the way corporations wield power, and the way meaning is produced in our society”. They are the people behind the original call to occupy Wall Street.

Quote: So when the Occupy Amsterdam encampment went up, I was one of the people that went there to see if we could get a decent internet connection up at the tents at Beursplein in Amsterdam.

Quote: I don’t think of myself as a law-enforcement priority and neither should you, really. We all benefit if you spend your time investigating more important things, such as actual crime. If you still have further questions, I’d prefer it if you just ask me and not various other people, some of whom truly have not a clue what my link to Occupy is. Also: if you absolutely must ask others about me, it would be swell if you could refrain from threatening them or their employers.

Quote: To prevent the spending of further tax euros: I have also helped transport a modest amount of internet bandwidth at the recent Ter Apel refugee action camp to facilitate streaming audio from there. Please don’t start bothering people about this when you become institutionally aware of it sometime in 2013.

Much more:
http://rop.gonggri.jp/?p=500

Previously:
http://vrritti.com/?s=gonggrijp&submit=Search

http://www.guardian.co.uk/media/2012/jun/08/leveson-inquiry-george-osborne

On 30th April 2012, The Pirate Bay website was the 39th most popular website in the United Kingdom. Shortly after that day, more and more Internet Service Providers started to implement website blocking remedies as a result of a blocking order by the UK court of law. The two largest broadband providers — BT, and TalkTalk — have yet to impose their server-side blocks to prevent access to the Swedish-based site.

On 30th April 2012:

Today, after only partially implemented website blocking measures, The Pirate Bay has become the 69th most popular website in the United Kingdom:

http://www.alexa.com/topsites/countries;2/GB

See also:
http://vrritti.com/?s=pirate+bay+block&submit=Search

http://arstechnica.com/science/2012/06/full-moon-affects-large-hadron-collider-operations/

The spy malware achieved an attack unlike any cryptographers have seen before. ”There were mathematicians doing new science to make Flame work”

The Flame espionage malware that infected computers in Iran achieved mathematic breakthroughs that could only have been accomplished by world-class cryptographers, two of the world’s foremost cryptography experts said.

“We have confirmed that Flame uses a yet unknown MD5 chosen-prefix collision attack,” Marc Stevens and B.M.M. de Weger wrote in an e-mail posted to a cryptography discussion group earlier this week. “The collision attack itself is very interesting from a scientific viewpoint, and there are already some practical implications.”

Much more:
http://arstechnica.com/security/2012/06/flame-crypto-breakthrough/

http://arstechnica.com/tech-policy/2012/06/ssns-on-p2p-the-feds-found-businesses-that-leaked-private-information/

http://news.cnet.com/8301-1009_3-57449375-83/u.n-could-tax-u.s.-based-web-sites-leaked-docs-show/

http://gizmodo.com/5916805/report-intel-is-planning-targeted-tv-advertising-with-facial-recognition

http://www.infowars.com/facebook-deletes-account-demands-my-passport/

See also:

#OccupyWallStreet demonstrates that there are many ways to intentionally, accidentally or unconsciously but automatically disrupt the free flow of information
http://vrritti.com/2011/10/03/occupywallstreet-demonstrates-that-there-are-many-ways-to-intentionally-accidentally-or-unconsciously-but-automatically-disrupt-the-free-flow-of-information/

http://www.infowars.com/despair-as-collapse-accelerates-my-shotgun-is-full-and-well-equipped-i-hope-i-dont-need-to-use-it/

The paper underlines the fact that UK courts “publish very little information on the cases they are dealing with and their outcomes.” It noted that current information disseminated online was of little or no use to the public.

“Poor communication and lack of information are key drivers of dissatisfaction among victims of crime about how the criminal justice system operates.”

Citing the website TrackMyCrime pioneered in Somerset and Avon in the south of the UK, the IPPR said that similar systems should be introduced elsewhere.

The website allows victims to access the current status of the crime against them online in the same way they might log into a bank or mobile phone account. Any new information registered on the police system is automatically sent to the TrackMyCrime site and users subsequently receive notifications to their email address.

Much more:
http://www.rt.com/news/crime-thinktank-tracking-online-032/

https://asp.trackmycrime.police.uk/

Because the Dutch do not master any other major language

Dutch language news article:

http://www.nu.nl/internet/2829932/gokpolitie-richt-zich-websites.html

http://tvnz.co.nz/technology-news/fbi-investigate-linkedin-password-theft-4920081

Says BT customers are currently ‘safe’ and that he found proxy sites to ‘work a treat’. Doesn’t seem to understand why there are laws in the first place and why there is something like a court of law 

But it is not fault of the ISPs. Failing to comply with the court order would have found the companies in contempt of court, which could lead to heavy fines if not prosecution.

“The main U.K. internet providers were ordered by the high court to block access to specific IP addresses and URLs used by The Pirate Bay website,” the spokesperson said.

Be Broadband explained on its company blog that it was “obliged to comply” and had no choice in the matter. ”We wouldn’t choose to do this voluntarily but we need to comply with U.K. laws just like any U.K. business.”

But remember: the court order applies only to the ISPs named in the suit. Affected broadband customers are not legally prevented from circumventing the blocks. Many ‘proxy’ sites were set up, including one by the U.K. Pirate Party.

(As an O2 customer, I can confirm this works a treat).

The two largest broadband providers — BT, and TalkTalk — have yet to impose their server-side blocks to prevent access to the Swedish-based site.

TalkTalk has until June 13 to comply. BT was granted extra time by the High Court and said it would announce its next move “in due course.” It’s possible that the U.K. telecoms giant could reach an agreement with the British Phonographic Industry (BPI), the U.K. record industry’s trade association, in the meantime.

It was the BPI who brought the case to court. Let’s not water this down: it’s the BPI you should blame for your freshly-squeezed glass of censorship.

All in all, who’s affected? A lot of people.

At first it was 10 million who faced the block. Then it was revised to 16.5 million, or more than a quarter of the U.K. population.

Let’s take a look at the numbers again.

So far, Virgin Media with around 4.3 million customers, Sky Broadband with 3.2 million customers, and Orange Broadband with 713,000 customers have cut access to the site. An O2 spokesperson confirmed the total number of O2 and Be customers stands at 617,000 customers.

BT’s 8 million customers are currently safe, but TalkTalk’s 4 million customers will see access cut this coming week.

By the time all the blocks are in place, the total tally could reach more than 20.8 million users, which amounts to a third of the U.K. population.

More:
http://www.zdnet.com/blog/london/goodbye-pirate-bay-o2-forced-to-block-access/5116

I’m running through the LinkedIn password hashes right now, so I thought I’d do a live blog of the steps I’m doing. As I do each step, I’ll update this blog live. When you reach the end, chances are good I’ll be updating it again in a few hours.

I left a bunch of stuff running over night, and have about 50% of all the passwords cracked. To summarize what I did:

First, I did a dictionary crack of some very large dictionaries. This took seconds, and got a large number of passwords. I’ll rerun the numbers later, but it’s like a third of all the passwords.

Second, I did a brute-force up to 6 characters. It appears LinkedIn has a minimum length of 6, so you won’t find shorter passwords. This took 18 minutes. Going to 7 characters will take 3 days to complete, so I’m letting that run on a separate machine while I do shorter jobs on the main machine.

Third, I did “mutated dictionary” attacks. I used several basic dictionaries, such as the RockYou list, as well as the dictionaries that come with such tools as Cain+Able, John-the-Ripper (JtR), and a list of Facebook names. I ran through all the mutations in the “rules” directory that comes with Hashcat. This found quite a few new passwords not found by the other techniques.

Fourth, I’m doing what Hashcast calls a “hybrid” attack that combines a dictionary either prefixed or followed by a brute-force. For example, right now, I’m runnign a job that does all the words in the RockYou dictionary followed by six lower-case/digits/numbers.

The first jobs took little time, so I rapidly updated this blog post as I did every little thing. Since then, updates have been coming slower as the two computers spend more time crunching numbers.

Much more:

http://erratasec.blogspot.nl/2012/06/linkedin-vs-password-cracking.html

The 23-year-old has been in jail since May 2010.

Manning’s attorney, David Coombs, is seeking documents that assess the impact of the WikiLeaks scandal on the American government but said he had hit “roadblock after roadblock” in his quest to obtain them, reported the American Armed Forces Press Service.

Coombs accused the government of providing the requested records too slowly, in a piecemeal fashion or not at all.

The prosecution, acting for the CIA, said that Coombs’ requests were “unreasonable” and irrelevant. Lead prosecutor, army Major Ashden Fein claimed that the defence was delaying the trial, and was attempting to “greymail” the government by demanding classified material that the government would be reluctant to release.

Manning faces 22 charges, and the defence team hopes to get 10 of them dismissed before the trial starts.

Charges against the 23-year-old include: “aiding the enemy”; “wrongfully causing intelligence to be published on the internet knowing that it is accessible to the enemy”, “theft of public property or records”; “transmitting defense information”; and “fraud and related activity in connection with computers”.

More:
http://www.theregister.co.uk/2012/06/07/bradley_manning_pretrial_hearing/

http://www.last.fm/passwordsecurity

http://www.wired.com/wiredenterprise/2012/06/google-apps-contracts-steeled-for-europeans/

Most “real time” traffic reports are outdated by the time they’re delivered, or they’re so scattershot that they have nothing to do with the course you’ve set. But BMW thinks it may have a better solution in the form of a new service called Advanced Real-Time Traffic Information (ARTTI) that promises to deliver traffic info faster and more accurately.

http://www.wired.com/autopia/2012/06/inrix-real-time/