Read posts about security

August 2

Something that really irks me (Punkadyne Labs (Punkwalrus))

In 1988, in the hallways and stairwells of whatever hotel EveCon 5 was at, someone had some posters that were aimed at FanTek security. Our new policy of making picture badges really made some people angry, and the whole "FanTek cons are run by security Nazis" rumors started. In reality, security was a response to several incidents that happened at EveCon 4 (badge copying being the big one) and other cons where people who weren't even with the convention were creating havoc. Based on a disaster at a Unicon where the hotel cracked down and shut down the convention for good, Bruce decided the best defense was proof of who was with his con, and who wasn't, making revoking the badges more a legal shield and a kind of smoking gun. But a lot of fandom didn't like having picture badges. They viewed it as a privacy threat.

"Who watches the watchmen?" was put up on posters, flyers, and in some cases, directly written on stuff. Maybe it was one guy, maybe it was a whole group of people who did this, I don't know.

That phrase still sticks with me. Having known FanTek security, I would say those fears were silly and unfounded, but... I can understand the paranoia. And now it's outside the conventions and into our daily life.

So, this article has been out for a while, but now it's gained more attention for some reason. It's bad enough that US Customs, The IRS, and TSA are "above the law." But these days they have so many more ways to screw you over. Most people don't care at this moment because I suspect many of them assume their innocence will protect them. Why should you care if you don't engage in criminal activity? You have nothing to hide, right? AC Grayling has a great article showing you why this has a major, major flaw. As civil liberties come under ever greater pressure, it's time we exposed the old lie that says the innocent have nothing to fear.

Most of you will fall asleep after the first paragraph, so I am going to point out the core problem behind thinking, "I have nothing to hide." You are assuming that the people investigating you are good, fair, and honest. They are not always good, fair, and honest. While I'd like to think so, they are as human as you and I are. And the moment we stop checking in on these people or let laws slide in their favor, the less power we will have to stop them later on.

Keep that in mind for a second. Now, think about the kinds of people who get jobs where they can dominate other people (cops, bureaucrats, soldiers, politicians, and so on). If you were the kind of person who wanted to dominate other people, you'd seek a job and lifestyle that allows you to do so. Makes sense, right? Now, maybe you'd want to be a police officer because you want to keep bad guys out of good people's lives. That's awesome. But suppose you are someone who just likes the feeling of crushing helpless people under you because you have some unresolved childhood issues. Suppose you're mentally unstable, and feel the only way to be normal is to FORCE people to respect you and ignore any faults you have. What's to stop you from being a cop? Well, you'd hope there are psychological tests, good cops reviewing other cops' behaviors, and the citizens reporting a bad cop. But the sheer size of such an organization means a few bad apples slip through the radar. Maybe some cops start out good, but after a few years on the force, stress breaks them down. There are lots of things that can make a protector of the citizens just go bad.

So let's take this recent issue, where US Customs can seize your laptop, PDA, cell phone, camera, or MP3 player with no course of compensation, they don't have to state a reason, and they can copy all the contents and do whatever with them. I really don't think there's that much difference between their actions and theft. And you have to know 99.99% of what their seize doesn't have anything to do with national security or anything that would amount to anyone getting hurt. But, see, that's the problem. Not just for you, who has lost your brand new laptop to the legal equivalent of a mafia protection racket, but to those who want money so their can keep their jobs and contracts with US Customs. In effect... there's a pressure to produce results. So much so, that if a bunch of "false positives" showed up, and the person couldn't defend themselves... who's going to stop them? After a while, those that "produce results" get favored over those goody-two-shoes who don't. This means that those who have ethics and morals will most likely quit in disgust. Leaving a vacancy for those who have no such qualms. And if you're a dick who likes abusing authority... there are always job openings in such an environment.

So now, even if you have "nothing to hide," they will try and make you feel like you do to "cooperate." This breeds fear and submission. And the process reinforces itself. Over time, you have an agency rampant with corruption, doing what they want, and keeping decent self-checking off the books.

I used to work with a guy who was the "store auditor" at a company we worked at. He was "only" a manager of a large store in the chain, but had been with the company so long, and been in almost every department, he knew pretty much everything about the company. And so when a district manager wanted to get rid of someone, they'd call on him. He had a chilling phrase, "I can go into any store, and within a matter of minutes, find a legal justification for firing, and perhaps arresting a store manager." Usually, he was employed to be a "secret shopper," but in a few cases, he was used to solve difficult managers who had everything legal by the books, but a DM knew he was a bad apple. But you can't fire a guy for a hunch.

He was a decent guy, really, but he described how he could take even the most clean-cut, by-the-books manager in the chain, and break him down. "Nobody is 100% legal," he said. "Often, these are the easiest marks because they are so paranoid about their perfection, that they collapse easily when pressured." Tactics he used were often time sheets, where we didn't actually have a time clock, we just wrote in our hours. "If I were to tell you I sat on a bench outside your store for the last two weeks," he could say, "and marked which employee came in and out and when, including lunch breaks, would you swear in a court of law, that these times are accurate within the minute?" Of course, that would be ludicrous. But a perfectionist would sweat. "If I were to tell you that in just one week, one of your employees has worked almost TWO hours less than we paid him for, including opening the store late, closing early on so call 'slow days,' longer lunch breaks, chatting on the phone with someone who was not a customer according to phone logs... which employee do you think I am going to name?"

See how those questions work? They didn't actually accuse the manager of anything. They just try and break down his confidence and his fear of imperfection.

"If I were to tell you that we discovered no less than 50 illegal pornographic images in your web cache, despite your attempts to shred them, plus proof of illegal song downloading and watching a Youtube video of a football game you had no permission to rebroadcast, how do you respond?"

And planting evidence? Easy as pie. Who's going to stop them? "Oh, look, here's some naked underaged boys and girls from Thailand in your iPhone. Oh, no, you can't be allowed to see them, we have shipped this to our offices for your prosecution... Go ahead, pervert. Prove us wrong... prove they are not yours. No, you don't get a lawyer, but that proves your guilt right there: why would you need a lawyer when you are innocent?"

This, my friends, is a problem. And since 9/11, these people have been given more and more powers under the cloak of "national security." Yes, flying planes into towers and killing thousands was scary and just downright horrible. But you know what? None of these terrorists had laptops to seize, they got in the country 100% legally, were actually reported on numerous times and ignored, we had photo evidence of them at all stages, we supplied their people with weapons and military training, tought them how to fly planes on our dime, and had at least three successful bombing to date before that. And yet, they got through. They had more warning flags than anybody, really. So adding all this invasion of privacy crap is pointless and unconstitutional.

This "security theater" WILL let the terrorist win in the end. It will destroy America.

Last note: here's the Fourth Amendment to the US Constitution:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
You know why that's there? Directly experience of the American colonials, embodying as it did the protection against the utilization of the ''writs of assistance.'' These writs were permanent and even transferable, so a writ holder could even assign them to someone else. Any place could be searched at the whim of the writ holder, and searchers were not responsible for any damage or loss of property they caused. This put anyone who had such a writ pretty much above the law.

So in response to these unpopular writs, several of the colonies included a particular requirement for search warrants in their constitutions when they declared independence in 1776. Several years later, the Fourth Amendment also contained a particularity requirement that outlawed the use of writs of assistance (and all general search warrants) by the federal government.

This is so important, because without it, people could raid your stuff with no legal recourse for their actions. Oh, wait, that's what they are doing.

This sucks. Posted in: computers , customs , security , tsa
March 21

I have stuff to do, Easter... Saturday... (Punkadyne Labs (Punkwalrus))

Sunday I am still at home. I am thinking of walking to the local food store and binging on Easter candy until I puke. But Saturday, I hang out with [info]ninjacooter in DC, and then I go to [info]tth and [info]aylinn's house to eat boiled meat.

You know, I still think of Easter weekend as Balticon weekend, even though they haven't done this weekend for years.

Oh, and happy Ostara/Spring Equinox to my pagan friends! Blessed be! I told you the dragon wouldn't eat the sun...

Lastly, enjoy a small thing I wrote for [info]grayhawkfh on his LJ. I couldn't log in from work, the browser would accept my login, but wouldn't authenticate me, and I didnt have time to figure out why. This entry here was posted via Logjam on a Linux box. I will vouch for the event: someone did dump hundreds of rubber balls down a stairwell at some Castlecon in the early 1990s (before the Frederick era). The thing that made this noteworthy was the stairwell at that tower was staight: you could be on floor 15 and see the first floor straight ahead. I can imagaine if you fell down those stairs, there would be no turn to stop you from reaching the bottom a bruised sack of broken skin, meat, and shattered bone in a growing pool of blood. Posted in: candy , castlecon , cons , convention , easter , rubber balls , security
January 18

Three tips to protect your WordPress installation [ma.gnolia] (Put together quickly (Haligan)) by MichaelBiven

Three tips to protect your WordPress installation

Here are three easy but important ways to protect yourself if you run a WordPress blog.

Saved By: Michael Biven | View Details | Give Thanks

Tags: , ,

Posted in: plugins , security , wordpress
January 10

AJAX Web Browser? (Martin Gordon's Blog (cptncelchu)) by Martin

When I first saw the headline that the Opera Browser is headed to the iPhone (later confirmed as false), I joking thought that Opera would be releasing a JavaScript web browser that ran in Safari. On second thought, I realized that a JavaScript browser could be used to bypass proxies by requesting pages from the server and passing them to the client via AJAX.

A quick Google search reveals one JavaScript browser called Accent JavaScript Browser, but it was released in 2001 and says it only runs in IE. A quick test of the browser in Firefox on the Mac shows that it doesn't work too well and that the buttons are only a proxy for the client-side JS functions. I also found another "browser", but I couldn't get this one to work in Safari or Firefox.

So far I'm 0/2 on working AJAX browsers. If a working one did exist, would it even be possible to use it for bypassing proxies? I have no need for this functionality, I just thought that it could be a pretty neat loophole.

Technorati Tags: , , , , ,

Posted in: ajax , development , javascript , security , thoughts
October 29

Jailbreakers Fix iPhone TIFF Exploit (Martin Gordon's Blog (cptncelchu)) by Martin

Enabling third-party applications on your iPhone has never been easier. Just visit jailbreakme.com on your iPhone/iPod touch (hereafter "iPhone"), and thanks to a TIFF exploit in MobileSafari, the website will jailbreak the phone and install Installer.app. As an added bonus, the process will patch the exploit it used to hack your iPhone in the first place. And who said all hackers were bad?

Technorati Tags: , , , , , ,

Posted in: hacking , iphone , ipod , os x , security
October 17

iPhone SDK Announced (Martin Gordon's Blog (cptncelchu)) by Martin

From the Apple Hot News weblog (for lack of a better term):

Let me just say it: We want native third party applications on the iPhone, and we plan to have an SDK in developers’ hands in February.

I knew this had to come eventually, it was just a matter of when. The timing of a February launch is a bit strange only because a demo of the SDK (Software Development Kit) at January's consumer-oriented Macworld is inevitable. What was Apple's reason for waiting so long?

We are working on an advanced system which will offer developers broad access to natively program the iPhone’s amazing software platform while at the same time protecting users from malicious programs.

I don't think needing to digitally sign every app is in all parties' best interests. Developers have another hurdle to cross to get apps out there, Apple needs to expend resources validating every app, and consumers lose out due to both of these additional costs. I don't see Apple blocking out unsigned apps completely, and I don't want responsibility to be placed on users to determine the safety of an app. Instead, I think we'll see Apple restricting what APIs an application has access to based on their signed status. This could be an extension of the new Sandboxing feature in Leopard:

Sandboxing
Enjoy a higher level of protection. Sandboxing prevents hackers from hijacking applications to run their own code by making sure applications only do what they’re intended to do. It restricts an application’s file access, network access, and ability to launch other applications. Many Leopard applications — such as Bonjour, Quick Look, and the Spotlight indexer — are sandboxed so hackers can’t exploit them.

The news item is short on details, so all we can do is speculate at this point. What is certain, however, is that this is undoubtedly good news, and the first good press the iPhone has gotten in a while.

Technorati Tags: , , , , ,

Posted in: apple , development , iphone , security , software
September 25

QuarkRuby: Ruby on Rails Security Guide [ma.gnolia] (Put together quickly (Haligan)) by MichaelBiven

QuarkRuby: Ruby on Rails Security Guide

Saved By: Michael Biven | View Details | Give Thanks

Tags: ,

Posted in: ruby on rails , security
August 17
July 26

Mac OS X: locking your screen, without a screen saver password (Kilala.nl (Cailin Coilleach)) by Cailin Coilleach

This afternoon my buddy Edmond came up to me with an interesting predicament. He runs Mac OS X on his Macbook and would like to:
A) have a password-less screen saver
B) have the ability to lock his screen with a password

Usually one simply uses screen saver passwords to achieve goal B, but Ed was adamant that he wanted A as well. Not something you often see, right? Initially I thought it wouldn't be possible, but then I had a flash of insight. It's possible! Here's how...

1. Open "System Preferences". Go into "Security".
2. Uncheck the box marked "Require password to wake...".
3. Open "Keychain Access". Open its preferences window.
4. Check the box marked "Show status in menu bar".
5. A padlock appears in your menu bar.

From now on you can lock your screen by clicking on the padlock and selecting "Lock screen". And you can still use your screen saver and go back into the OS without a password. The only downside to this is that one can also wake up your system from sleep without a password. Not something I'd like to have if my laptop was ever stolen.

Posted in: lock , mac os x , password , screen saver , security
March 7

Your Requests Are Safe With Us [ma.gnolia] (Put together quickly (Haligan)) by MichaelBiven

Your Requests Are Safe With Us

Rails plugin for handling CSRF attacks.

Tags: , , ,

Posted in: csrf , plugin , rails , security
March 6
February 18

SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc [ma.gnolia] (Put together quickly (Haligan)) by MichaelBiven

SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc

A quick update to Apple's latest security update.

Tags: , , ,

Posted in: apple , os x , security , updates
February 1

Microsoft Brain Drain 2007 and a Vista Non-Vulnerability (Martin Gordon's Blog (cptncelchu)) by Martin

Two very important people are leaving Microsoft. First is Bryan Lee, former VP in the entertainment and device division, who oversaw the Zune launch. Second is Jim Allchin, former Co-President of the platform and services division. The latter had an excellent blog post on a day in his post-Microsoft life. Neither are going to competitors, however, instead both are going to "pursue personal interests," as the Reuters article linked above puts it.

In other Microsoft news, a so-called "vulnerability" has been found in Vista. The vulnerability involves having voice commands from a third-party being played over speakers and doing nasty things to a PC. I don't really see this is as a new problem, as it could have been done on any other OS that had voice recognition (e.g., XP or OS X). The easy solution is to disable voice commands (who really uses them anyway?), but a more long-term solution for people who do want voice commands is to have it require a passcode to be said before the OS runs a command.

Technorati Tags: , , , , , , , , , ,

Posted in: microsoft , news , operating systems , people , security , vista , windows
January 25

F-Secure World Map [ma.gnolia] (Put together quickly (Haligan)) by MichaelBiven

F-Secure World Map

Tags: , , , ,

Posted in: f-secure , map , security , threat , virus