Archive for August, 2007
U.S. to Expand Domestic Use of Spy Satellites {response}

Robert Block at bobby.block@wsj.com, wrote an article at the Wall Street Journal about US Defense spy satellites being turned toward the people of the United States. Perhaps this is not really a new phenomenon. I suspect that in the past it was done without asking and without anyone knowledge. Now unchecked spying by the government is legalized. There is a trend of legalizing misconduct that is justified by what a small elite believe is the greater good. If you think I am just a paranoid conspiracy theorist do your own reading, find out for your self don’t take my word for it. Start here: http://www.themoneymasters.com/order.htm#books

If I am not mistaken abuse of government power is one of the reasons that the original 13 colonies in America rebeled against the British Empire. They were paying taxes but had NO say in what was going on in England or even on their own land: “Taxation without Representation.” The founding fathers were so serious about guarding against the unchecked power of government that they created the 2nd amendment, right to bear arms:

“A well regulated militia being necessary to the security of a free State, the right of the People to keep and bear arms, shall not be infringed”

Now we face abuse of power on an entirely different level, but abuse of power all the same.

Liberties are given away wholesale with NO regard for the Constitution. As a security person, I appreciate national security, but NOT at the expense of liberty. At the very least programs that spy on the people should have checks and balances. But there are no organizations dedicated to protecting privacy and liberties with the same level of influence as the executive branch, CIA, and NSA.

The neo-conservative view of going to war to “protect our freedoms” is only valid if there is freedoms left to protect. Make no mistake, I am no liberal who wants to create bigger government to help the poor and less fortunate. I just don’t trust the government enough to give them more power than they already have. Government should be small and managed by the people, not the other way around.

I fear that humanity has created a very efficient system whose function (regardless of what it says) is to exact total control over its heard of consumner citizens.

“Where liberty dwells, there is my country.”
–Benjamin Franklin, letter to Benjamin Vaughn, March 14, 1783

Legal Hacking Cases

The official Certified Ethical Hacking course material identifies three types of hackers:

Black Hats: criminal hackers

Grey Hats: hackers that find exploits because they want to (not for good or bad intentions)

White Hats: hired penetration testers

The media and many parts of the information security profession lumps all ‘hackers’ into one big box labeled “criminals”.  I used to think this way as well until I went to Defcon.  It was a real eye opener.  I saw hackers who want to do something good for the consumners.  I saw several government agencies attempting to hire the best and brightest hackers and of course, I saw hackers that may very well have been working on the darkside.  The point is that “hacking” itself is the just a technique to find, and exploit weakness in a given system.  It is not intrinsically evil.  Hacking is just a method, the intent of the user determines whether or not there is a adverse effect on individuals, organizations or a given society.

Contrary to popular conservative/traditional beliefs the world is not black and white.  There are cases in which hacking is legal.  Just take a look at these legal hacking cases:

Ethical Hacking.  Involves getting formal permission from the “target” prior to hacking.

Hackthissite.  Hack this site is one of many sites that allow users to freely hack their way in.  This is done for fun, for learning or just for the heck of it.  Typically, there are rules and guidelines that are create so that the user and the host can benefit from the learning experience. 

Reverse Engineering is Legal.  Cases of reverse engineering have been deemed as legal in the U.S. in many other industries.  The legalities for reverse engineering software are still being shaped by a new breed of cases. 

1999-2002: DVD Copy Control Association (DVD-CCA) vs. Bunner, et al.  The DVD-CCA attempts to sue anyone distributing a descrambler software that was created by reverse engineering their product.  They even attempt to sue anyone linking to sites giving out the descrambler.  initial case 2 | eef involvement |  Bunner and other won the case  *note: there were not even the ones who reverse engineered the product

The attempt to Legalize Intrusions for Corporations.  In 2002, Rep. Howard Berman (D-Calif) tried to pass a law called the Peer to Peer Privacy Prevention Act (2002) which would have created section 514 of U.S.C 17 Chapt 5 allowing companies to legally hack into computers to find pirated software and intellectual property and use that information in a court of law against the assailant.  Article on Peer to Peer Prevention Act

 

 

Quantum Key Distributions (part 1)

The NIST has an page that talks about Quantum Key Distribution:

Quantum encryption systems use lasers to generate individual pulses of light called photons. Each photon is sent in one of two modes, either vertical/horizontal, or plus 45 degrees/minus 45 degrees. Within each mode, one orientation represents the digital value 0, and the other represents the digital value 1. To visualize how this works, imagine that each photon is a tiny envelope moving perpendicular to the ground (vertical=1), parallel to the ground (horizontal=0), tilted at 45 degrees to the right (plus 45 degrees =1) or tilted 45 degrees to the left (minus 45 degrees=0). NIST 

Its almost scary how much has been done in relatively so little time in the “Information Age” and its only just the beginning.  
 

The possibilities are unimaginable.  I thought it was a bit extreme when I read an Author C. Clarke sci-fi novel called, Light of Other Days in which people can send messages directly from brain to brain (some sort of brain to brain Internet) via a device that sends messages on a subatomic level.  Now it doesn’t sound so strange anymore (well, ok, its still strange but it seem possible now).
 

Here are some mind blowing articles about quantum entanglement:
 

Quantum Teleportation of data (actually it’s the instantaneous transfer of quantum states, but teleportation sounds cooler)
      The thing is that it has already being done:
      http://news.nationalgeographic.com/news/2004/08/0818_040818_teleportation.html
      http://www.research.ibm.com/quantuminfo/teleportation/
      http://www.sciam.com/article.cfm?chanID=sa006&articleID=ABBA5449-E7F2-99DF-3ACFAC15B16FEC60&colID=30
      http://techreport.com/onearticle.x/12870
 

Quantum Entanglement as an explanation for so called psychic phenomenon:
      Highly controversial as parapsychology is the “leprosy” of
      science.  Just a hypothesis but interesting:
      http://www.deanradin.com/NewWeb/EMblurbs.html

Michigan Security Expert

Looking for Michigan Secuiryt Experts:

Michigan Information Security Experts –
Information System Security Association/Michigan

Nearly every state has a local ISSA Chapter.  These chapters have pools to security experts ranging from forensics, to network security to system security engineering.  Lansing, Michigan Information System Security Association (ISSA) President MaryAnn MacIntosh [contact Michigan ISSA]

InfraGard/Michigan

Major cities usually have an InfraGard group consisting of FBI/DHS and public/private security experts and organizations who protect the infrastructure of critical organizations in U.S. cities.  

ASIS Detroit, MI, ASIS Western Michigan, ASIS Flint, MI,

ASIS is like a physical security version of the ISSA. 

Small towns such as Tawas, Oscada, and Alpena in Michigan would be wise to start their own chapter of similar security experts or out source from Flint, MI or out of state with organizations such as Academic Security Innovations. 

Point and click Gmail hacking at Black Hat

This hack uses sniffing on a network:
The attack is actually quite simple. First Graham needs to be able to sniff data packets and in our case the open Wi-Fi network at the convention fulfilled that requirement. He then ran Ferret to copy all the cookies flying through the air. Finally, Graham cloned those cookies into his browser – in easy point-and-click fashion – with a home-grown tool called Hamster.

The counter to this is to NEVER login at open networks (particularly the blackhat and for the love of all things holy and good NEVER login without encryption at the defcon)

td daily – gmail hack @ blackhat

FCC Commissioner: US playing “Russian roulette with broadband and Internet”

 Micheal Copp of the FCC Commissioner made a great point at the YearlyKos convention. 

Most American probably think that everything is fine with American broadband, but the truth is we are WAY behind.  And its is due to big business’ strangle hold on the growth and proserity of our access to the Internet.  There seems to be a “price collusion” between Verison, AT&T, Comcast and other major broadband/telecos in which they keep the prices at a certain level and block out smaller competition. 

I wouldn’t call it a conspiracy, but I think they’ve gotten so powerful that they are able to sway federal, state and local government policy in their favor by sending their lobbyists with million dollar warchest.

“In a speech at the YearlyKos convention, [Micheal] Copps spoke like a man with a fire in his guts. He’s proud of America but “worried” by the path that it has gone down with respect to broadband Internet and media consolidation, which he sees as ideas joined at the hip.

In both cases, “a small number of corporate gatekeepers” now control the public’s access to information, an arrangement that threatens to “invert the democratic genius of the Internet.” When the Internet first exploded onto the scene, people hailed it as a revolutionary communications tool that would allow for the creation of a truly democratic media in which anyone with a message could get the word out to others. Now, Copps notes that most connections to the Internet are controlled by massive corporations who seem eager to prevent any neutrality safeguards from being placed on the networks they manage.”