Friday, December 22, 2006

Happy Holidays

I Just wanted to wish everyone Happy Holidays. I have not been able to do much Blogging, as I have been out of town and Life has been very hectic. I hope to be able to write more often in the future.

Friday, October 20, 2006

McAfee, Symantec and vested interests

I found this to be an interesting article, as I do find it strange they want to hide the kernel so to speak and I'm really not sure why this guy supports that. It's my opinion that having something open makes it more secure, because more people get a chance to attack it and find ways to fix it.

Is it just me or does anyone see the irony in that Microsoft has had years of lax security that helped create the industry's that help protect those breaches, now late into the game Microsoft comes out with it's Onecare product line. So you have a company that is selling something that is flawed, and now are selling you the product to fix those flaws, anyone see a conflict of interest there?

http://blogs.zdnet.com/carroll/?p=1611&tag=nl.e622

McAfee, Symantec and vested interests Posted by John Carroll @ 9:25 am
Digg This!

Vested interests often force governments to continue with policies that are counter-productive, if not downright negative. Examples aren't hard to find. Even if congress had the will to confront the vested interests that protect all the various deductions in the US tax code and create something that is clean and simple, truckloads of lobbying dollars would be spent by tax preparation companies to block the changes. Mandatory minimum sentencing laws are strongly supported by the private companies that build and maintain many of America's prisons, even as those laws swell America's prison population to levels not typically found in nominally "free" nations. Likewise, the DEA and companies that support them can be expected to fight against any attempts to stop America's futile war on drugs, a war that sends Bolivian leaders into the arms of Hugo Chavez, funds both sides in Colombia's civil war (think Al Capone times 1 million) and provides a steady stream of cash to Afghani insurgents through sale of poppies - the raw material used in heroin.

Though Symantec and McAfee lobbying the EC on behalf of their ability to hook the Windows kernel doesn't wreak as much havoc as these other vested interests, as an instance of business interests using government to warp policy in selfish directions, it falls into the same category. This smells of companies trying to preserve the flaws in a product upon which they have built their businesses. Really, does anyone in these forums WANT third parties to have access to the Windows kernel? The fact that no one does is why McAfee/Symantec aren't trying to defend the inherent value of such access and opt instead for the "futility" argument. The core of the argument is that PatchGuard won't work and that hackers will find workarounds that McAfee will have to ride in and fix for Microsoft. Essentially, there's no point in Microsoft trying to protect the kernel because they will never make it bulletproof, anyway. Following that reasoning to its logical conclusion, Microsoft shouldn't bother to alter its software development processes so as to emphasize secure coding techniques, given that perfection is impossible, and from a business standpoint, deprives Symantec and McAfee of the opportunity to protect consumers from the consequences of those flaws. As noted, I'm not seeing many in ZDNet Talkbacks rushing to defend McAfee and Symantec in their quest, probably because they DON'T WANT Symantec and McAfee to have that kind of access.

If McAfee and Symantec want to do something useful, they should build products that help to to enforce the kernel protections represented by PatchGuard. What they should NOT be doing is trying to prevent Microsoft from locking down the kernel in the first place. People really should read this blog post by Stephen Toulouse, a program manager in Microsoft's Security Technology unit, as it clarifies considerably the situation as it pertains to kernel hooking past, present and future. http://www.stepto.com/default/log/displaylog1.aspx?ID=258

Some useful excerpts…

Regarding Microsoft's past encouragement of kernel hooks: Wrong. For the implementation of the 32 bit kernel of Windows, there existed undocumented and unsupported system hooks into the kernel. Their use was frowned upon, even inside Microsoft. It's simply not a safe practice to utilize these interfaces into the kernel. Regarding the termination of support for kernel hooks being something that is "new:" Wrong.

Kernel Patch Protection was implemented almost 2 years ago in Windows XP x64 edition and Windows Server 2003 x64 edition. Regarding supposed "insecurity" resulting from a ban on kernel hooks: What security vendors are misrepresenting, is that only through unrestricted access to modify the kernel at the highest level of privilege can they protect you.Of course, the referenced blog predates Microsoft's decision to enable in some as of yet undetermined fashion a means by which to enable kernel hooking "in a secure fashion."

On that note, consider the perils of such an approach as explained at the end of Mr. Toulouse's blog. First, you grant one, pretty soon you have to grant thousands. That's how many people are out there using these undocumented, unsupported interfaces into the kernel.

Second, the more exceptions you grant, the more you dilute the protection. Attackers will simply morph their attacks to try and mimic the "safelist" to get an exception – this may be as simple as malicious software “bundling” third party software in order to disable the protection.

Third, because the OS was still designed to be run with the unmodified kernel, you still have the problem of code running at highest possible privilege crashing the system or causing performance problems.

Fourth, by granting an exception list you introduce a huge performance problem into the kernel, as you force it to check a safelist with every single operation.

Fifth, how would the logistics for adding and removing exceptions work? Would it only be done in software updates? Service Packs? Would someone sue because we weren't fast enough implementing them into a safelist?

That last issue is particularly worrisome for Microsoft, and constitutes the problem with selectively allowing people to have access to the kernel. If McAfee and Symantec get access, you can expect most security companies to want comparable access, and once that happens, the question becomes: how big do you have to be to have access? Pandora's box, truly.

Like prison construction companies encouraging policies that lock up as many people as possible (let's not call them prisoners; let's call them "customers"), McAfee and Symantec are trying to encourage an architecture that "needs" the fixes of a McAfee and Symantec. In so doing, they show how self-interest and government controls over software design collide to create "solutions" that have little to do with benefitting consumers.

Wednesday, October 18, 2006

Big Brother Double Double Plus Good


For awhile in Canada some ISP's have been keeping records on their own. I'm not really sure how I feel about this issue, as I can see the reasons for wanting to combat crime, yet I'm very worried that in the effort to do this we become what we are trying to combat and civil rights that people courageously fought for sometimes losing their life for could be compromised in this well meaning attempt.

In the end this is the question I'm struggling with I the act of fighting terrorism and cyber-crime/crime are we becoming what we are fighting against? Basically in the act of trying to prevent actions from happening do we create the circumstances in which they can thrive?

I look forward to any comments people have on this issue.

FBI director wants ISPs to track users

By Declan McCullagh

FBI Director Robert Mueller on Tuesday called on Internet service providers to record their customers' online activities, a move that anticipates a fierce debate over privacy and law enforcement in Washington next year. "Terrorists coordinate their plans cloaked in the anonymity of the Internet, as do violent sexual predators prowling chat rooms," Mueller said in a speech at the International Association of Chiefs of Police conference in Boston. ISP snooping time line

In events that were first reported by CNET News.com, Bush administration officials have said

Internet providers must keep track of what Americans are doing online.

June 2005: Justice Department officials quietly propose data retention rules.

December 2005: European Parliament votes for data retention of up to two years.

April 14, 2006: Data retention proposals surface in Colorado and the U.S. Congress.

April 20, 2006: Attorney General Alberto Gonzales says data retention "must be addressed."

April 28, 2006: Rep. Diana DeGette proposes data retention amendment.

May 16, 2006: Rep. James Sensenbrenner drafts data retention legislation--but backs away from it two days later.

May 26, 2006: Gonzales and FBI Director Robert Mueller meet with Internet and telecommunications companies.

June 27, 2006: Rep. Joe Barton, chair of a House committee, calls new child protection legislation "highest priority."
"All too often, we find that before we can catch these offenders, Internet service providers have unwittingly deleted the very records that would help us identify these offenders and protect future victims," Mueller said. "We must find a balance between the legitimate need for privacy and law enforcement's clear need for access." The speech to the law enforcement group, which approved a resolution on the topic earlier in the day, echoes other calls from Bush administration officials to force private firms to record information about customers.


Attorney General Alberto Gonzales, for instance, told Congress last month that "this is a national problem that requires federal legislation." Justice Department officials admit privately that data retention legislation is controversial enough that there wasn't time to ease it through the U.S. Congress before politicians left to campaign for re-election. Instead, the idea is expected to surface in early 2007, and one Democratic politician has already promised legislation.

Law enforcement groups claim that by the time they contact Internet service providers, customers' records may have been deleted in the routine course of business. Industry representatives, however, say that if police respond to tips promptly instead of dawdling, it would be difficult to imagine any investigation that would be imperiled. It's not clear exactly what a data retention law would require. One proposal would go beyond Internet providers and require registrars, the companies that sell domain names, to maintain records too. And during private meetings with industry officials, FBI and Justice Department representatives have cited the desirability of also forcing search engines to keep logs--a proposal that could gain additional law enforcement support after AOL showed how useful such records could be in investigations.

A representative of the International Association of Chiefs of Police said he was not able to provide a copy of the resolution. Preservation vs. retention At the moment, Internet service providers typically discard any log file that's no longer required for business reasons such as network monitoring, fraud prevention or billing disputes. Companies do, however, alter that general rule when contacted by police performing an investigation--a practice called data preservation.

A 1996 federal law called the Electronic Communication Transactional Records Act regulates data preservation. It requires Internet providers to retain any "record" in their possession for 90 days "upon the request of a governmental entity." Because Internet addresses remain a relatively scarce commodity, ISPs tend to allocate them to customers from a pool based on whether a computer is in use at the time. (Two standard techniques used are the Dynamic Host Configuration Protocol and Point-to-Point Protocol over Ethernet.)

In addition, Internet providers are required by another federal law to report child pornography sightings to the National Center for Missing and Exploited Children, which is in turn charged with forwarding that report to the appropriate police agency. When adopting its data retention rules, the European Parliament approved U.K.-backed requirements saying that communications providers in its 25 member countries--several of which had enacted their own data retention laws already--must retain customer data for a minimum of six months and a maximum of two years.

The Europe-wide requirement applies to a wide variety of "traffic" and "location" data, including: the identities of the customers' correspondents; the date, time and duration of phone calls, VoIP (voice over Internet Protocol) calls or e-mail messages; and the location of the device used for the communications. But the "content" of the communications is not supposed to be retained. The rules are expected to take effect in 2008.

CNET News.com's Anne Broache contributed to this report.

http://news.zdnet.com/2100-1009_22-6126877.html

Tuesday, October 17, 2006

Big Brother 1984 Double Plus Good


I don't know about you, but I find this a bit scary, it seems like in response to our fears we see enemies everywhere, is it just me or does it feel like Big Brother maybe just maybe might be making a comeback, and folks it's not 1984.

OTTAWA - Federal government departments are profiling some access requesters, a veteran Ottawa researcher charged Monday.

Testifying before a parliamentary committee, Ken Rubin revealed that he learned recently he has been the subject of just such a profile.

Documents Rubin obtained from the Canadian Border Services Agency revealed a memo prepared in January 2004 for then-public safety minister Anne McLellan outlining an access request that Rubin had filed for information concerning the department's Advance Passenger Information project. In the memo, which the department told Rubin was never transmitted all the way to the minister, the department outlines details of telephone calls officials had with Rubin, other access requests he had filed and the fact that he had volunteered to help Maher Arar and his wife get information about their case.

At the time, Arar was still under suspicion by the government of being a terrorist and was on a watch list along with his wife and children.
The memo was released to Rubin earlier this month under the Access to Information Act after he filed a complaint.
''This is unacceptable,'' Rubin told the committee. ''Matching up my background data and work and separate access requests should not be used to create a profile and discuss my access usage or that of other requesters. I do not consider this kind of data being prepared and shared internally or going, or potentially going, to a minister, a positive part of, or within the spirit of the Access to Information Act.''

New Democrat MP Pat Martin said he was shocked to learn that a government department had prepared a profile of an access requester.
''I think it is an absolute bombshell that they are not only asking the identity, which I think undermines the integrity of the whole system, but they are asking about confidential personal information.''

Jason Kenney, parliamentary secretary to Prime Minister Stephen Harper, said Rubin's testimony about being profiled corresponds with some of the testimony that the committee has already heard about the way the privacy of some access requesters has been treated in the past.
''This would be, I guess, the third concrete instance that we know about. There seems to be sufficient evidence to conclude that this practice of furnishing names to political staff has happened in the past. Just how widespread or how frequent, we just don't know.''

The comment came as the committee wrapped up another day of hearings into reports that the government appears to have broken the privacy law by disclosing the name of Canadian Press reporter Jim Bronskill during a telephone conference call in which public servants from several departments discussed which reporters were working on stories related to security and to pandemic preparedness.

The information was then sent to several officials in the prime minister's office who had not participated in the call, including communications director Sandra Buckler. None of those officials reported a possible violation of the privacy act.
Privacy Commissioner Jennifer Stoddart is investigating.
Kenney could not say Monday whether the government has reviewed the minutes of the weekly security conference call to ascertain whether there were other instances of the names of access requesters being discussed.

Act Of War ?


Well, this is becoming very interesting and maybe not in a really good way. This brings about a few questions, is this just rhetoric? Or are they serious and do they mean to go to war?


I Don't know the answers, yet I do know the world just become much more unstable and dangerous, and this is more dangerous than the old cold war days at least then the people who had control, it could be argued were somewhat rational.


N. Korea: Sanctions are war declaration By JAE-SOON CHANG, Associated Press Writer




North Korea said Tuesday it considered U.N. sanctions aimed at punishing the country for its nuclear test "a declaration of war," as Japan and South Korea reported the communist nation might be preparing a second explosion.

The North broke two days of silence about the U.N. resolution adopted after its Oct. 9 nuclear test with a statement on the official state news agency, as China warned Pyongyang against stoking tensions.

"The resolution cannot be construed otherwise than a declaration of a war" against the North, the statement said. North Korea is known officially as the Democratic People's Republic of Korea.

The chief U.S. nuclear envoy, Assistant Secretary of State Christopher Hill, said the North's response was "not very helpful."

"I think there is a fundamental misunderstanding about what the international community feels about its actions," Hill said in Seoul after a meeting with his South Korean and Russian counterparts.

Hill said he could not confirm South Korean and Japanese reports that the North may be preparing another nuclear explosion, but said a second test would force the international community "to respond very clearly."

North Korea "is under the impression that once they make more nuclear tests that somehow we will respect them more," Hill told reporters after a meeting with U.S. and Russian counterparts. "The fact of the matter is that nuclear tests make us respect them less."

In its statement, North Korea said it would not be intimidated.

The communist nation "had remained unfazed in any storm and stress in the past when it had no nuclear weapons," the statement said. "It is quite nonsensical to expect the DPRK to yield to the pressure and threat of someone at this time when it has become a nuclear weapons state."

Chun Yung-woo, South Korea's top nuclear envoy, dismissed the statement as "the usual rhetoric that they have been using at the time of the adoption of the Security Council resolution."

China has long been one of North Korea's few allies, but relations have frayed in recent months by Pyongyang's missile tests and the nuclear explosion last week.

Chinese Foreign Ministry spokesman Liu Jianchao warned Pyongyang against aggravating tensions, saying the North should help resolve the situation "through dialogue and consultation instead of taking any actions that may further escalate or worsen the situation."

The United States pressed on with a round of diplomacy in Asia aimed at finding consensus on how to implement U.N. sanctions on the North. Secretary of State Condoleezza Rice was expected to go to Japan on Wednesday before traveling to South Korea and China.

Hill stressed that the international community should make the North pay a "high price" for its "reckless behavior."

Japanese Foreign Minister Taro Aso said his government had "information" about another possible blast, and a senior South Korean official said there were signs that the North could be preparing a second test — but emphasized that it was unlikely to happen immediately.

"We have yet to confirm any imminent signs of a second nuclear test," the official said on condition of anonymity because of the sensitivity of the information.

China, whose support for the measures is key to whether they will have any effect on neighboring North Korea, has begun examining trucks at the North Korean border to comply with new U.N. sanctions endorsed over the weekend.

South Korea has said it would implement the U.N. sanctions, but also has been cautious about allowing sanctions to shake regional stability. Seoul has also indicated that it has no intention of halting key economic projects with the North, despite concerns that they may help fund the North's nuclear and missile programs.

"Sanctions against North Korea should be done in a way that draws North Korea to the dialogue table," South Korean Prime Minister Han Myung-sook said Tuesday, according to Yonhap news agency. "There should never be a way that causes armed clashes."

In Washington, U.S. National Intelligence Director John Negroponte's office said Monday that air samples gathered last week contain radioactive materials that confirm that North Korea conducted an underground nuclear explosion.

In a short statement posted on its Web site, Negroponte's office also confirmed that the size of the explosion was less than 1 kiloton, a comparatively small nuclear detonation. Each kiloton is equal to the force produced by 1,000 tons of TNT.

It was the first official confirmation from the United States that a nuclear detonation took place, as Pyongyang has claimed.

___

Associated Press writers Bo-Mi Lim and William Foreman in Seoul, Audra Ang in Beijing and Kana Inagaki in Tokyo contributed to this report.