Hack­ers ‘steal entire 2011 cen­sus’ [The Tele­graph]

Most of the arti­cle is a slightly con­fused report on whether or not LulzSec actu­ally claimed to have got­ten the UK cen­sus data­base. How­ever, I think the real story is this bit here:

“The 2011 Cen­sus places the high­est pri­or­ity on main­tain­ing the secu­rity of per­sonal data. At this stage we have no evi­dence to sug­gest that any such com­pro­mise has occurred.”

The US defence con­trac­tor Lock­heed Mar­tin, which col­lected the 2011 cen­sus data, was also prepar­ing a state­ment. The com­pul­sory national sur­vey was car­ried out in march and gath­ered data includ­ing full names, dates of birth and addresses for every­one in the UK.

So the oh-so-secure per­sonal data for every­one in the UK was gath­ered by a US defense con­trac­tor? Not just an appendage of the Evil Empire, but a tightly inte­grated part of the Impe­r­ial Mil­i­tary? In what uni­verse is that secure? There’s the evi­dence of your com­pro­mise right there!

Cheap GPUs are ren­der­ing strong pass­words use­less Think that your eight-character pass­word con­sist­ing of low­er­case char­ac­ters, upper­case char­ac­ters and a sprin­kling of num­bers is strong enough to pro­tect you from a brute force attack? [ZDNet]

Yes, that’s really how the author defines a “strong pass­word.” For­tu­nately I, not being a com­plete idiot, would only use such a sim­ple pass­word if I wanted other peo­ple to know it and be able to remem­ber it eas­ily. Here’s an exam­ple of what I con­sider a strong pass­word, in this case gen­er­ated by 1Password:

VbNwGIzrJWzccJMKJaQKCWXr4^mlWjglMQ*ZkcyMdyDOJrp9Kh

EFF Pub­lishes Study On Browser Fin­ger­print­ing. Rubin­stien writes “The Elec­tronic Fron­tier Foun­da­tion inves­ti­gated the degree to which mod­ern web browsers are sus­cep­ti­ble to ‘device fin­ger­print­ing’ via ver­sion and con­fig­u­ra­tion infor­ma­tion trans­mit­ted to web­sites. They imple­mented one pos­si­ble algo­rithm, and col­lected data from a large sam­ple of browsers vis­it­ing their Panop­ticlick test site, which we’ve dis­cussed in the past. Accord­ing to the PDF describ­ing the study, browsers that sup­ported Flash or Java on aver­age sup­plied at least 18.8 bits of iden­ti­fy­ing infor­ma­tion, and 94.2% of those browsers were uniquely iden­ti­fi­able in their sam­ple. My own browser was uniquely iden­ti­fi­able from both the list of plu­g­ins and avail­able fonts, among 1,557,962 browsers tested so far.” [Slash­dot]

I vis­ited the test site with my default browser with Tor and NoScipt on, and it had this to say:

Within our dataset of sev­eral mil­lion vis­i­tors, only one in 10,791 browsers have the same fin­ger­print as yours.

Cur­rently, we esti­mate that your browser has a fin­ger­print that con­veys 13.4 bits of iden­ti­fy­ing information.

How­ever, it reports the user agent incor­rectly, as Tor is set to lie about what browser I’m using. When I turned Tor off and reloaded the test page, I got this instead:

Within our dataset of sev­eral mil­lion vis­i­tors, only one in 21,435 browsers have the same fin­ger­print as yours.

Cur­rently, we esti­mate that your browser has a fin­ger­print that con­veys 14.39 bits of iden­ti­fy­ing information.

If I’m not mis­taken, this means that the test site thinks I’m in the first group of browsers when I’m actu­ally in the sec­ond group.

Flaws in Tor anonymity net­work spot­lighted. At the Chaos Com­puter Club Con­gress in Berlin, Ger­many on Mon­day, researchers from the Uni­ver­sity of Regens­burg deliv­ered a new warn­ing about the Tor anonymizer net­work, a sys­tem aimed at hid­ing details of a com­puter user’s online activ­ity from spy­ing eyes.

The attack doesn’t quite make a surfer’s activ­ity an open book, but offers the abil­ity for some­one on the same local network—a Wi-Fi net­work provider, or an ISP work­ing at law enforce­ment (or a régime’s) request, for example—to gain a poten­tially good idea of sites an anony­mous surfer is view­ing. [Ars Tech­nica]

There are things users can do to pro­tect them­selves. From the article:

Users them­selves can guard against this type of fingerprint-based eaves­drop­ping rel­a­tively eas­ily, Her­rmann noted. Down­load­ing or request­ing more than one site at a time through the net­work will muddy the pat­tern enough that cer­tainty will be very dif­fi­cult for the eaves­drop­per to establish.

And from one of the comments:

This attack should be sig­nif­i­cantly less effec­tive as well if the tar­get in ques­tion is a fully func­tional and qual­ity relay­ing node. In that case other peo­ple access­ing through the node would ran­dom­ize things sig­nif­i­cantly, and their access would be impos­si­ble to dif­fer­en­ti­ate from a local user with­out the kind of phys­i­cal access that makes the entire thing moot.

A few days ago I found the notice on the left in the photo above in my apart­ment build­ing. The notice states that some­one from the local gov­ern­ment will be con­duct­ing an ille­gal search of my apart­ment build­ing tomor­row. This isn’t the first time some­thing like this has hap­pened. About ten years ago, a sim­i­lar notice appeared and I took the day off from work to keep the “inspec­tor” from get­ting into my apart­ment with­out a search warrant–which, nat­u­rally, he didn’t have. After a bit of the expected veiled threats and attempts at intim­i­da­tion and trick­ery that inspec­tor gave up and left, and I’m hop­ing that the one tomor­row will go as well.

The two pages of Korean text next to the notice are a trans­la­tion of the Bill of Rights, with the Fourth Amend­ment high­lighted. I found this on the web­site of a civil rights orga­ni­za­tion called Jews for the Preser­va­tion of Firearms Own­er­ship, which has trans­la­tions of the Bill of Rights into many dif­fer­ent lan­guages. Most of my neigh­bors were born in Korea, and many speak no Eng­lish, so I fig­ured it was likely they wouldn’t be aware that they have the right to refuse war­rant­less searches of their homes. Hope­fully read­ing the trans­la­tion of the rel­e­vant US law will help at least some of them stand up for them­selves and their liberty.

Update: This time around the inspec­tor took “get a war­rant” quickly and with­out mak­ing a fuss.

Cryp­tog­ra­phy Suc­cess Story. From Brazil: the moral, of course, is to choose a strong key and to encrypt the entire drive, not just key files. [Schneier on Secu­rity]

The files were encrypted using True­crypt and an unnamed algo­rithm, report­edly based on the 256-bit AES stan­dard. In the UK, Dan­tas would be com­pelled to reveal his passphrase under threat of impris­on­ment, but no such law exists in Brazil.

The Brazil­ian National Insti­tute of Crim­i­nol­ogy (INC) tried for five months to obtain access to the encrypted data with­out suc­cess before turn­ing over the job to code-breakers at the FBI in early 2009. US com­puter spe­cial­ists also drew a blank even after 12 months of efforts to crack the code, Brazil’s Globo news­pa­per reports.

I use True­Crypt to pro­tect the Win­dows lap­top I use for work. Unfor­tu­nately, the Mac ver­sion doesn’t sup­port whole disk encryption.

End-to-End Encrypted Cell Phone Calls.

Android app. (Slash­dot thread.)

[Schneier on Secu­rity]

From the article:

Red­Phone uses ZRTP, an open source Inter­net voice cryp­tog­ra­phy scheme cre­ated by Phil Zim­mer­mann, inven­tor of the widely-used Pretty Good Pri­vacy or PGP encryption.

[…]

TextSe­cure uses a sim­i­lar scheme devel­oped by cryp­tog­ra­phers Ian Gold­berg and Nikita Borisov known as “Off The Record” to exchange scram­bled text messages.

This means that you could talk securely to any­one using Zfone on a com­puter, and IM securely to any­one with Adium or another app that sup­ports the OTR protocol.

There’s also this rather impor­tant dis­tinc­tion from Skype, the “secu­rity” of which I’ve crit­i­cized before:

Whis­per Sys­tems’ apps aren’t the first to bring encrypted VoIP to smart­phones. But apps like Skype and Von­age don’t pub­lish their source code, leav­ing the rigor of their secu­rity largely a mat­ter of speculation.

Browser add-on blocks Google Ana­lyt­ics. Google has released an add-on for Web browsers that blocks infor­ma­tion from being sent to its Ana­lyt­ics ser­vice. [Mac­Cen­tral]

This is rather point­less, as Tor blocks Google Ana­lyt­ics, and any other form of spy­ing on the Inter­net. Any­one who wants their brows­ing to be pri­vate is using it, which means that the peo­ple com­plain­ing about Google Ana­lyt­ics track­ing their activ­ity are only announc­ing their own igno­rance or stu­pid­ity (or both).

Brows­ing the web with­out Tor and com­plain­ing about pri­vacy is like stand­ing on a crowded side­walk and then com­plain­ing that peo­ple can see you.

Gov’t, cer­tifi­cate author­i­ties con­spire to spy on SSL users?.

SSL is the cor­ner­stone of secure Web brows­ing, enabling credit card and bank details to be used on the ‘Net with impunity. We’re all told to check for the lit­tle pad­lock in our address bars before hand­ing over any sen­si­tive infor­ma­tion. SSL is also increas­ingly a fea­ture of web­mail providers, instant mes­sag­ing, and other forms of online communication.

Recent dis­cov­er­ies by Wired and a paper by secu­rity researchers Christo­pher Soghoian and Sid Stamm sug­gests that SSL might not be as secure as once thought. Not because SSL itself has been com­pro­mised, but because gov­ern­ments are con­spir­ing with Cer­tifi­cate Author­i­ties, key parts of the SSL infra­struc­ture, to sub­vert the entire sys­tem to allow them to spy on any­one they wish to keep tabs on.

[Ars Tech­nica]

The weak­nesses of SSL are well known, which is why peo­ple who know any­thing about secu­rity don’t trust Cer­tifi­cate Author­i­ties, but in the past this has just been known as some­thing that gov­ern­ments were prob­a­bly doing. Now we have the first bit of evi­dence that they’re actu­ally doing it. I don’t think this will make any dif­fer­ence in the long run–after all, nobody cared when, after years of sus­pi­cion, the US gov­ern­ment admit­ted to using cell phones as track­ing and lis­ten­ing devices–but hope­fully at least a few peo­ple will read this and rec­og­nize that the gov­ern­ment can and does spy on them.

Brief: TSA sub­poe­nas blog­gers to find source of secu­rity doc leak.

The Trans­porta­tion Secu­rity Admin­is­tra­tion is attempt­ing to find the source of a leak of a sen­si­tive secu­rity direc­tive that fol­lowed a failed air­line bomb­ing attempt on Christ­mas Day. Two travel blog­gers have revealed that they have been sub­poe­naed to pro­vide infor­ma­tion that may lead to the source of the leak.

Shortly after an attempted “under­wear” bomber was dis­cov­ered on North­west Air­lines Flight 253 from Ams­ter­dam to Detroit on Decem­ber 25, the Trans­porta­tion Secu­rity Admin­is­tra­tion issued imme­di­ate, tem­po­rary changes to secu­rity pro­ce­dures in an attempt to pre­vent sim­i­lar inci­dents. The par­tic­u­lar details of those changes were issued in an inter­nal secu­rity direc­tive, intended only for TSA employ­ees. How­ever, copies of the direc­tive were leaked to sev­eral blog­gers and quickly spread around the ‘Net.

Writ­ers Chris Elliott and Steven Frischling both received copies of the secu­rity direc­tive from anony­mous sources, and both pub­lished the text of the direc­tive after mass con­fu­sion set in among hol­i­day trav­el­ers affected by the sud­den changes in secu­rity pro­ce­dures. It appears that the TSA is not pun­ish­ing either for pub­lish­ing the doc­u­ment; rather, they are try­ing to find the source of the leak.

“The DHS & TSA are tak­ing this mat­ter seri­ously, and that tells me that they are pay­ing atten­tion to secu­rity in detail,” Frischling wrote on his blog. So far, nei­ther has admit­ted to know­ing the iden­tity of the source of the TSA directive.

The leak is some­what embar­rass­ing for the TSA, though, in light of a recent leak of the entire con­tents of the TSA’s “Stan­dard Oper­at­ing Pro­ce­dures” man­ual online. That dis­clo­sure was due to improper redact­ing of the doc­u­ment, which the TSA later claimed to be out of date.

[Ars Tech­nica]

The les­son to be learned here is that if you find your­self in pos­ses­sion of infor­ma­tion which would embar­rass the gov­ern­ment, don’t pin a giant tar­get on your­self by post­ing it to your blog. Instead, use Tor to upload it anony­mously to Wik­ileaks.