WPA Cracker

http://www.wpacracker.com/

An Introduction

WPA Cracker is a cloud cracking service for penetration testers and network auditors who need to check the security of WPA-PSK protected wireless networks.
WPA-PSK networks are vulnerable to dictionary attacks, but running a respectable-sized dictionary over a WPA network handshake can take days or weeks. WPA Cracker gives you access to a 400CPU cluster that will run your network capture against a 135 million word dictionary created specifically for WPA passwords. While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes, for only $17.

Facebook to launch child safety 'panic button'

Facebook has announced it is to launch a "panic button" application on its social networking site.

The button, aimed at children and teenagers, will report abuse to the Child Exploitation and Online Protection Centre (Ceop) and Facebook.
The application will also appear on their homepage to say that "they are in control online".
The launch follows months of negotiation between Ceop and Facebook, which initially resisted the idea.
Ceop, the government law enforcement agency tasked with tracking down online sex offenders, called for a panic button to be installed on social networking sites last November.
Bebo became the first network to add the button with MySpace following suit, but Facebook resisted the change, saying its own reporting systems were sufficient.
Pressure mounted on Facebook following the rape and murder of 17-year-old Ashleigh Hall by a 33-year-old convicted sex offender, posing as a teenage boy, who she met on Facebook.
Forty-four police chiefs in England, Wales and Scotland, signed a letter backing Ceop's call for a panic button on every Facebook page.
'Reassurance for parents' The agreement to launch a child safety application is the culmination of months of negotiation between Ceop and Facebook.
Jim Gamble, Ceop's chief executive, said in a statement: "Our dialogue with Facebook about adopting the ClickCeop button is well documented - today however is a good day for child protection.
"By adding this application, Facebook users will have direct access to all the services that sit behind our ClickCeop button which should provide reassurance to every parent with teenagers on the site."
Facebook's head of communications in the UK, Sophy Silver, told BBC News that the new app would integrate reporting into both Facebook and Ceop's systems.
"Both sides are happy of where we have got to," she said.
"We still have the Facebook reporting system and by having a pre-packaged application that users play an active part in, you not only help keep them safe, it makes all of their friends aware too, and acts as a viral awareness campaign.
"Ultimately though, this makes for a safer environment for users and that's the most important part," she added.
In addition to the online reporting application, a new Facebook/Ceop page is being set up, with a range of topics that, it is hoped, will be of interest to teenagers - such as celebrities, music and exams - and will link these subjects to questions about online safety.

http://news.bbc.co.uk

Quantum teleportation achieved over ten miles of free space

Quantum teleportation has achieved a new milestone or, should we say, a new ten-milestone: scientists have recently had success teleporting information between photons over a free space distance of nearly ten miles, an unprecedented length. The researchers who have accomplished this feat note that this brings us closer to communicating information without needing a traditional signal, and that the ten miles they have reached could span the distance between the surface of the earth and space.
  "Quantum teleportation" is quite different from how many people imagine teleportation to work. Rather than picking one thing up and placing it somewhere else, quantum teleportation involves entangling two things, like photons or ions, so their states are dependent on one another and each can be affected by the measurement of the other's state.
When one of the items is sent a distance away, entanglement ensures that changing the state of one causes the other to change as well, allowing the teleportation of quantum information, if not matter. However, the distance particles can be from each other has been limited so far to a number of meters.
Teleportation over distances of a few hundred meters has previously only been accomplished with the photons traveling in fiber channels to help preserve their state. In this particular experiment, researchers maximally entangled two photons using both spatial and polarization modes and sent the one with higher energy through a ten-mile-long free space channel. They found that the distant photon was still able to respond to changes in state of the photon they held onto even at this unprecedented distance.
However, the long-distance teleportation of a photon is only a small step towards developing applications for the procedure. While photons are good at transmitting information, they are not as good as ions at allowing manipulation, an advancement we'd need for encryption. Researchers were also able to maintain the fidelity of the long-distance teleportation at 89 percent— decent enough for information, but still dangerous for the whole-body human teleportation that we're all looking forward to.

By Casey Johnston
Science, 2010. DOI: 10.1038/NPHOTON.2010.87  (About DOIs).  

Single group did 66% of world's phishing

A single criminal operation was responsible for two-thirds of all phishing attacks in the second half of 2009 and is responsible for a two-fold increase in the crime, a report published this week said.
The Avalanche gang is believed to have risen out of the ashes of the Rock Phish outfit, which by some estimates was responsible for half the world's phishing attacks before fizzling out in late 2008. Driving the success of both groups is their use of state-of-the-art technology for mass-producing imposter websites and distributing huge amounts of crimeware for automating identity theft.

"Avalanche uses the Rock's techniques but improved upon them, introducing greater volume and sophistication," the report, released by the Anti-Phishing Working Group, stated.

Central to Avalanche's success is its use of fast-flux botnets to host phishing sites. The use of peer-to-peer communications makes it impossible for a single ISP or hosting provider to to pull the plug on the infrastructure. The gang also excels at launching attacks from a relatively small number of domain names that often appear confusingly identical to each other, such as 11f1iili.com and 11t1jtiil.com. Those abilities also fuel the success.
There were 126,697 phishing attacks during the second half of 2009, more than double the number in the first half of the year or from July through December of 2008, the APWG report said. Avalanche, which was first identified in December of 2008, was responsible for 24 percent of phishing attacks in the first half of 2009 and for 66 percent in the second half. From July through the end of the year, Avalanche targeted the more than 40 major financial institutions, online services, and job search providers.
Curiously, Avalanche may turn out to be a victim of its own success.
"During an Avalanche campaign, it was not unusual for the target institutions, the relevant domain name registrar(s), a domain name registry, and other responders and service providers to all be aware of the campaign and working on mitigation at the same time," the report stated. "As a result, Avalanche attacks had a much shorter average uptime than non-Avalanche phishing attacks, and community efforts partially neutralized the advantage of the fast-flux hosting."
White hats briefly shut down the Avalanche infrastructure in mid November, and ever since then phishing attacks generated by the group have dropped precipitously. Last month, the gang launched just 59 attacks, each one with a separate domain.

A PDF of the report is here. ®
By Dan Goodin

Thieves Flood Victim’s Phone With Calls to Loot Bank Accounts

Bank thieves have rolled out a new weapon in their arsenal of tactics — telephony denial-of-service attacks that flood a victim’s phone with diversionary calls while the thieves drain the victim’s account of money.

A Florida dentist lost $400,000 from his retirement account last year in this manner, and the FBI said the attacks are growing.

A spokeswoman for the Communication Fraud Control Association — a telecom industry organization — told Threat Level that although fraudulent transfers have been halted in a number of cases, the losses are increasing.

“I know it’s in the millions,” said Roberta Aranoff, executive director of the CFCA. “It has exceeded a million dollars easily.”

Last November, Robert Thousand Jr., a semi-retired dentist in Florida, received a flood of calls to several phones. When he answered them, he heard a 30-second recording for a sex hotline, according to the St. Augustine Record.

In December, he discovered that $399,000 had been drained from his Ameritrade retirement account shortly after he’d received the calls. About $18,000 was transferred from his account on Nov. 23, with a $82,000-transfer following two days later. Five days after that, another $99,000 was drained, followed by two transfers of $100,000 each on Dec. 2 and 4. The thieves withdrew the money in New York.

Thousand’s son, who shares his name, received similar harassing calls, though his financial accounts were not touched. Thousand did not respond to a request from Threat Level for comment.

The FBI says the calls were a diversionary tactic, meant to tie up Thousand’s line so that Ameritrade couldn’t reach him to authenticate the money transfer requests. FBI spokesman Bryan Travers said AT&T, Thousand’s phone carrier, contacted the agency’s New Jersey office to help investigate the matter. The agency has since seen at least 16 similar cases since November, most of them occurring in the last few weeks.

In some cases, the victims simply heard dead air when they answered their phone or heard a brief advertisement or other recorded message. Some victims had to change their phone numbers to halt the harassing calls.

The perpetrator who targeted Thousand created a number of VoIP accounts, which were used with automated dialing tools to flood the dentist’s home, business and cellphone with calls.

Generally in these cases, Travers said, the thief obtains the victim’s account information through some other means — perhaps through a phishing attack or other method — and then contacts the financial institution to change the victim’s contact information. In this way, the institution will call the thief instead of the victim to verify a money transfer request.

Many banks, however, now contact customers at their previous phone number when contact information on their account has changed.

But with these attacks, the institution’s calls are prevented from reaching the victim, whose phone is tied up with a flood of diversionary calls.

AT&T spokesman Marty Richter told Threat Level that the perpetrators then generally contact the financial institution posing as the victim to complain that a requested money transfer hasn’t gone through. When the institution discloses that it tried unsuccessfully to contact the victim to authenticate the transfer, the perpetrator says he’s been having phone troubles and verifies that the transfer should proceed.

Richter says that other telecommunication companies have been alerted to the problem and are warning customers when they call to complain about harassing calls that the issue may be related to their financial accounts. The victims are warned to place fraud alerts on their financial and credit bureau accounts and block any electronic fraudulent money transfers that may be in the works.

“This may appear to some people that they’re just having a connect issue with their phone carrier,” he said, “and we want to alert them that this may not be the case.”

Travers said that in most cases so far, the victims have acted quickly enough to prevent money from being drained from their accounts, but he says there may be many other cases that haven’t yet been reported to the FBI. He urged consumers who may have been victims to contact the FBI.

Read More http://www.wired.com/threatlevel/2010/05/telephony-dos/#ixzz0nt0tgdrn
By Kim Zetter

German court orders wireless passwords for all

BERLIN (AP) -- Germany's top criminal court ruled Wednesday that Internet users need to secure their private wireless connections by password to prevent unauthorized people from using their Web access to illegally download data.

Internet users can be fined up to euro100 ($126) if a third party takes advantage of their unprotected WLAN connection to illegally download music or other files, the Karlsruhe-based court said in its verdict.

"Private users are obligated to check whether their wireless connection is adequately secured to the danger of unauthorized third parties abusing it to commit copyright violation," the court said.

But the court stopped short of holding the users responsible for the illegal content the third party downloads themselves.

The court also limited its decision, ruling that users could not be expected to constantly update their wireless connection's security - they are only required to protect their Internet access by setting up a password when they first install it.

The national consumer protection agency said the verdict was balanced.

Spokeswoman Carola Elbrecht told the German news agency DAPD it made sense that users should install protection for their wireless connection and that at the same time it was fair of the court not to expect constant technical updates by private users.

The ruling came after a musician, who the court did not identify, sued an Internet user whose wireless connection was used to illegally download a song which was subsequently offered on an online file sharing network.

But the user could prove that he was on vacation while the song was downloaded via his wireless connection. Still, the court ruled he was responsible to a degree for failing to protect his connection from abuse by third parties.

About 26 million homes in Germany have wireless Internet access, according to Bitkom, the German Association for Information Technology, Telecommunications and New Media.

© 2010 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

PDF Exploits Explode, Continue Climb in 2010

Exploits of Adobe's PDF format jumped dramatically last year, and continue to climb during 2010, a McAfee security researcher said Wednesday.

Microsoft , meanwhile, recently said that more than 46% of the browser -based exploits during the second half of 2009 were aimed at vulnerabilities in Adobe's free Reader PDF viewer.

According to Toralv Dirro, a security strategist with McAfee Labs, the percentage of exploitative malware targeting PDF vulnerabilities has skyrocketed. In 2007 and 2008, only 2% of all malware that included a vulnerability exploit leveraged an Adobe Reader or Acrobat bug. The number jumped to 17% in 2009, and to 28% during the first quarter of 2010.

"In the last three years, attackers have found PDF vulnerabilities more and more useful, for a couple of reasons," Dirro said. "First of all, it's increasingly difficult for them to find new vulnerabilities with the operating system and within browsers that they can exploit across the different versions of Windows. And second, Reader is one of the most widely deployed applications that allows files to be accessed or opened within the browser."

Other factors for the jump in PDF exploits, argued Dirro, range from user belief that PDFs are safe to open, or at least safer to open than Microsoft Office documents, to the age of Adobe's code. "Quite a lot of PDF code was written years ago, and attackers are finding new security problems that no one thought of then," Dirro said. "That makes it difficult for Adobe to clean it up."

A recent discovery illustrated Dirro's point. Earlier this month, Belgium researcher Didier Stevens demonstrated how malicious PDFs could use a by-designed feature of the PDF specification to run attack code hidden in the file, and how to modify a warning message that Adobe Reader displays to further trick users into opening the document. Although some of what Stevens revealed has been publicly known for at least eight months, the technique has only been picked up by hackers in the last several weeks.

A major malware campaign using Stevens' tactics began Tuesday, with malicious PDFs attached to messages masquerading as instructions from companies' network administrators.

Microsoft also recently reported that PDF exploits remains a potent part of hackers' arsenals. In its newest Security Intelligence Report , Microsoft said that nearly half of all browser-based exploits in the second half of 2009 targeted Adobe's Reader. Three Reader vulnerabilities -- which were patched in May 2008, November 2008 and March 2009 -- accounted for more than 46% of all browser attacks.

McAfee rival Symantec has also tracked an explosion in PDF-based attacks. According to Symantec's latest Internet Security Threat Report , published last week, malicious PDFs were responsible for 49% of all Web-based attacks in all of 2009, compared to just 11% in 2008.

Like McAfee, Symantec also recorded a surge in reported Adobe Reader vulnerabilities. Of all browser plug-in bugs logged last year, 15% were in Reader's add-on for Internet Explorer, Firefox, Chrome and other Windows browsers. That was almost a four-fold increase from the 4% in 2008. And two of 2009's top five exploited vulnerabilities were in Adobe Reader.

Adobe declined to comment specifically about McAfee's and Microsoft's statistics on Reader vulnerabilities. Instead, a spokeswoman forwarded a statement the company has used before. "Given the relative ubiquity and cross-platform reach of many of our products, in particular our clients, Adobe has attracted -- and will likely continue to attract -- increasing attention from attackers," she said in an e-mail. "The majority of attacks we are seeing are exploiting software installations that are not up-to-date on the latest security updates."

The company's latest security move attempts to address the update issue; on April 13, Adobe switched on a service that silently updates customers' copies of Reader and Acrobat.

Adobe may be working on other ways to beef up Reader and Acrobat. According to one security researcher, Adobe will add sandboxing defenses to its PDF software this year. Sandboxing, perhaps best known as a technique used by Google 's Chrome browser, isolates processes from each other and the rest of the machine, preventing or hindering malicious code from escaping an application to wreak havoc or infect the computer with malware.

Adobe has acknowledged it will add sandboxing to Flash -- another of its products that is frequently targeted by exploits -- and has it at the top of its to-do list, according to Paul Betlem, senior director of Flash Player engineering.

Reader may, or may not, get sandboxing as well. When asked about the reports that Reader 10 would include sandboxing defenses, a company spokeswoman said Adobe had no announced plans but was "investigating how to get different features to work in a sandbox."

McAfee's Dirro said adding sandboxing to Adobe Reader would be a smart move. "It's one of the most useful ways to address a lot of different vulnerabilities," he said. "Sandboxing had proven to be fairly efficient at stopping attacks."

by Gregg Keizer
http://www.pcworld.com

Analysis of Attack on Google: Aurora Botnet Command Structure

Analysis of Attack on Google: Aurora Botnet Command Structure

Kneber_Spearphishing_Crimeware

kneber_spearphishing_crimeware-1

SHADOWS IN THE CLOUD: Investigating Cyber Espionage 2.0

SHADOWS IN THE CLOUD:  Investigating Cyber Espionage 2.0

Conducting Cybersecurity Research Legally and Ethically

Abstract

The primary legal obstacles to conducting cybersecurity are not outright prohibitions but rather the difficulty of determining which of a large set of complex statutes might regulate a given research project. Privacy, computer abuse, tort, and contract law are all potentially applicable. Moreover, even when the law permits a research activity, researchers may wonder whether it is ethically permissible. This paper seeks to clarify these issues by explaining the areas of law that are most generally applicable to cybersecurity researchers and offering guidelines for evaluating ethical issues that arise in this area of research.

http://www.usenix.org/event/leet08/tech/full_papers/burstein/burstein_html/

Wi-Fi 'Finders' Helping Thieves Locate and Steal Laptops

We don't recommend leaving your laptop in the car for any reason, but, if you must, make sure you turn off the Wi-Fi signal first. According to Network World, thieves are using devices meant to locate Wi-Fi networks to detect laptops and steal them. Apparently, just closing the screen won't prevent your laptop from being detected, either. Wi- Fi disconnection must be done manually, as it can take as long as a half-hour for a laptop to go into sleep mode.

The Wi-Fi "finders" that crooks use are often cheap and easily accessible. For less than $20, a start-up thief can purchase a ballpoint pen with a built-in Wi-Fi detector. Of course, the cheaper models aren't as accurate when locating the signals. (Using one in a full parking lot would be akin to searching for a needle in a haystack.) But for $50, you could purchase this Wi-Fi finder (pictured), which makes finding a laptop stuffed in the trunk of a car easy as pie.

What's our advice? Keep those laptops close at hand and make sure you only turn on the Wi-Fi signal when you'll be using it. [From: Network World]

Leaked intelligence documents:Facebook,Comcast, Microsoft

Leaked intelligence documents: Here's what Facebook and Comcast will tell the police about you!!!

Leaked Microsoft intelligence document: Here's what Microsoft will reveal to police about you

FTC: Identity Theft Is No. 1 Consumer Complaint

Are you really you? It’s hard to say.

That’s because identity theft was the top consumer complaint for 2009, the Federal Trade Commission reported Wednesday.

It was also the top complaint from the year before, although 5 percent fewer consumers reported it in 2009, the commission said.

Overall, of the 1.3 million complaints the agency received last year, 21 percent were for identity theft. Debt collection agencies ranked second, with 9 percent of complaints, according to the Consumer Sentinel Network Data Book released Wednesday.

Credit card fraud was the top complaint when it comes to identity theft, followed by fraud related to government benefits, utilities, phones and loans.

The FTC did not verify the complaints lodged with it. It said 72 percent of those reporting identity theft also notified a police department.

The complete 101-page report (.pdf) is available here.

By David Kravets

New Russian botnet tries to kill rival

'Kill Zeus' removes rival software from PCs, giving Spy Eye access to usernames, passwords

IDG News Service - An upstart Trojan horse program has decided to take on its much-larger rival by stealing data and then removing the malicious program from infected computers.

Security researchers say that the relatively unknown [Spy Eye toolkit] added this functionality just a few days ago in a bid to displace its larger rival, known as Zeus.

The feature, called "Kill Zeus," apparently removes the Zeus software from the victim's PC, giving Spy Eye exclusive access to usernames and passwords.

Zeus and Spy Eye are both Trojan-making toolkits, designed to give criminals an easy way to set up their own "botnet" networks of password-stealing programs. These programs emerged as a major problem in 2009, with the U.S. Federal Bureau of Investigation estimating last October that they have caused $100 million in losses.

Trojans such as Zeus and Spy Eye steal online banking credentials. This information is then used to empty bank accounts by transferring funds to so-called money mules -- U.S. residents with bank accounts -- who then move the cash out of the country.

Sensing an opportunity, a number of similar Trojans have emerged recently, including Filon, Clod and [Bugat], which was discovered just last month.

Spy Eye popped up in Russian cybercrime forums in December, according to Symantec Senior Research Manager Ben Greenbaum.

With its "Kill Zeus" option, Spy Eye is the most aggressive crimeware, however. The software can also steal data as it is transferred back to a Zeus command-and-control server, said Kevin Stevens, a researcher with SecureWorks. "This author knows that Zeus has a pretty good market, and he's looking to cut in," he said.

Turf wars are nothing new to cybercriminals. Two years ago a malicious program called Storm Worm began attacking servers controlled by a rival known as Srizbi. And a few years before that, the authors of the Netsky worm programmed their software to remove rival programs Bagle and MyDoom.

Spy Eye sells for about $500 on the black market, about one-fifth the price of premium versions of Zeus. To date, it has not been spotted on many PCs, however.

Still, the Trojan is being developed quickly and has a growing list of features, Greenbaum said. It can, for example, steal cached password information that is automatically filled in by the browser, and back itself up via e-mail. "This is interesting in its potential, but it's not currently a widespread threat at all," he said.

By Robert McMillan
http://www.computerworld.com

Facebook ‘Cash Scam’ Continues to Grow Even Bigger

Over the past few years social networking sites such as Facebook and Twitter have given unprecedented access to people’s private lives. More and more personal information is revealed through photos, status updates and conversations that are all being documented online. Last week, the Serious Fraud Office of London (SFO) warned that Facebook and Twitter are being used to harvest users’ personal financial details,

“The public should be aware of the predatory nature of fraudsters and be careful about revealing personal information on social-networking sites, as this has become a primary method of harvesting information and targeting victims,” SFO said.

In a joint venture between London police and Financial Services Authority, over 10,000 people were notified that their names were on a “master list” that contained a range of personal information, that might include: names, address, phone number, place of business, income and relationship status. While this is the only reported list, it’s quite possible thousands more were already victims of this latest cash scam.

Facebook users may not mention all that personal information on their Facebook page, however, they may have it listed on a combination of networking sites. For example, a Facebook user will list their name and location along with photos on Facebook. The scammer can take that information and then look you up on LinkedIn and Twitter to find out your personal website, job, position, average income, number of years employed, education level and parlay all that information into a “cash scam.”

Fraudsters are using this information to set up “boiler rooms” and contact people on this master list. Boilers rooms look to employ high pressure sales tactics to push unwanted, over priced, or sometimes non-existent stock to unsuspecting buyers. Boiler rooms are nothing new, but using Facebook to gather leads and target people is becoming a serious problem.

The FSA is clearly trying to stay ahead of the scam, “By writing to people now, we can raise awareness of this type of fraud and help protect people from losing money to these criminals,” FSA said. While multiple efforts are being taken to stop these criminals, these cash scam continue to grow and more boiler rooms continue to operate off shore. It’s up to the individual to be aware of such fraud and report any phone calls that you suspect could be criminal.

In the mean time, keep your friends close, your Facebook account closed to outsiders, and don’t allow just anyone to view your personal details on your Facebook page.

posted by Mr.404

Census of Files Available via BitTorrent

BitTorrent is popular because it lets anyone distribute large files at low cost. Which kinds of files are available on BitTorrent? Sauhard Sahi, a Princeton senior, decided to find out. Sauhard's independent work last semester, under my supervision, set out to measure what was available on BitTorrent. This post, summarizing his results, was co-written by Sauhard and me.

Sauhard chose a (uniform) random sample of files available via the trackerless variant of BitTorrent, using the Mainline DHT. The sample comprised 1021 files. He classified the files in the sample by file type, language, and apparent copyright status.

Before describing the results, we need to offer two caveats. First, the results apply only to the Mainline trackerless BitTorrent system that we surveyed. Other parts of the BitTorrent ecosystem might be different. Second, all files that were available were equally likely to appear in the sample -- the sample was not weighted by number of downloads, and it probably contains files that were never downloaded at all. So we can't say anything about the characteristics of BitTorrent downloads, or even of files that are downloaded via BitTorrent, only about files that are available on BitTorrent.

With that out of the way, here's what Sauhard found.

File types

46% movies and shows (non-pornographic)
14% games and software
14% pornography
10% music
1% books and guides
1% images
14% could not classify

Movies/Shows

For the movies and shows category, the predominant file format was AVI, and other formats included RMVB (a proprietary format for RealPlayer), MPEG, raw DVD, and some multi-part RAR archives. Interestingly, this section was heavily biased towards recent movies, instead of being spread out evenly over a number of years. In descending order of frequency, we found that 60% of the randomly selected movies and shows were in English, 8% were in Spanish, 7% were in Russian, 5% were in Polish, 5% were in Japanese, 4% were in Chinese, 4% could not be determined, 3% were in French, 1% were in Italian, and other infrequent languages accounted for 2% of the distribution.

Games/Software

For the games and software category, there was no clearly dominant file type, but common file types for software included ISO disc images, multi-part RAR archives, and EXE (Windows executables). The games were targeted for running on different architectures, such as the XBOX 360, Nintendo Wii, and Windows PC’s. In descending order, we found that 74% of games and software in the sample were in English, 12% were in Japanese, 5% were in Spanish, 4% were in Chinese, 2% were in Polish, and 1% were in Russian and French each.

Pornography

For the pornography category, the predominant encoding format was AVI, similar to the movies category. However, there were significantly more MPG and WMV (Windows Media Video) files available. Also, most pornography torrents included the full pornographic video, a sample of the video (a 1-5 minute extract of the video), as well as posters or images of the porn stars in JPEG format. Also, as these videos are not typically dated like movies are, it is difficult to make any remarks regarding the recency bias for pornographic torrents. Our assumption would be that demand for pornography is not as time-sensitive as demand for movies, so it is likely that these pornographic videos constitute a broader spectrum of time than the movies do. In descending order, we found that 53% of pornography in our sample was in English, 16% was in Chinese, 15% was in Japanese, 6% was in Russian, 3% was in German, 2% was in French, 2% was unclassifiable, and Italian, Hindi, and Spanish appeared infrequently (1% each).

Music

For the music category, the predominant encoding format for music was MP3, there were some albums ripped to WMA (Windows Media Audio, a Microsoft codec), and there were also ISO images and multi-part RAR archives. There is still a bias towards recent albums and songs, but it is not as strongly evident as it is for movies—perhaps because people are more willing to continue seeding music even after it is no longer new, so these torrents are able to stay alive longer in the DHT. In descending order, we found that 78% of music torrents in our sample were in English, 6% were in Russian, 4% were in Spanish, 2% were in Japanese and Chinese each, and other infrequent languages appeared 1% each.

Books/Guides

The books/guides and images categories were fairly minor. We classified 15 torrents under books and guides—13 were in English, 1 was in French, and 1 was in Russian. We classified 3 image torrents—one was a set of national park wallpapers, one was a set of pictures of BMW cars (both of these are English), and one was a Japanese comic strip.

Apparent Copyright Infringement

Our final assessment involved determining whether or not each file seemed likely to be copyright-infringing. We classified a file as likely non-infringing if it appeared to be (1) in the public domain, (2) freely available through legitimate channels, or (3) user-generated content. These were judgment calls on our part, based on the contents of the files, together with some external research.

By this definition, all of the 476 movies or TV shows in the sample were found to be likely infringing. We found seven of the 148 files in the games and software category to be likely non-infringing—including two Linux distributions, free plug-in packs for games, as well as free and beta software. In the pornography category, one of the 145 files claimed to be an amateur video, and we gave it the benefit of the doubt as likely non-infringing. All of the 98 music torrents were likely infringing. Two of the fifteen files in the books/guides category seemed to be likely non-infringing.

Overall, we classified ten of the 1021 files, or approximately 1%, as likely non-infringing, This result should be interpreted with caution, as we may have missed some non-infringing files, and our sample is of files available, not files actually downloaded. Still, the result suggests strongly that copyright infringement is widespread among BitTorrent users.

One in four children sent pornography, says surveyOne in four children have sent or been sent inappropriate material including pornography via email,

Photo: GETTY

One in four children have sent or been sent inappropriate material including pornography via email, according to a survey.
The research also found that one in 20 children, aged between six and 15, had communicated with a stranger via webcam and one in 50 have actually met a stranger they first contacted online.

The report, which surveyed 500 children, found that many children are getting away with behaviour online that they wouldn’t get away with in the real world, largely because of their parents’ lack of understanding and awareness of their internet habits and of safety precautions.
More than six out of 10 children (62 per cent) said they lie to parents about what they have been looking at online and over half (53 per cent) delete the history on their web browser so their parents can’t see what they have been looking at.

The survey, by TalkTalk, the broadband provider, also found that and one in nine (11 per cent) have either bullied someone online or been bullied online themselves.

In December, the Government announced that every primary schoolchild in the country will be taught about the dangers of the internet and how to safely surf online.

The “Click Clever, Click Safe’ campaign comes in response to a report by Prof Tanya Byron, the child psychologist and broadcaster, who was asked by the Government to consider how to protect children online.

Prof Tanya Byron, who oversaw the TalkTalk research, said: “It’s crucial that parents educate themselves about what’s going on online and what their kids are doing there.”

By Urmee Khan, Digital and Media Correspondent

A story in yesterday's London Sunday Times that will not amuse the Chinese government says that the UK security service MI5 is claiming that undercover intelligence officers from the Chinese People’s Liberation Army and the Ministry of Public Security have approached UK businessmen at trade fairs and exhibitions with the offer of "lavish gifts" such as cameras and not so lavish gifts such as memory sticks that contain malware meant to remotely access their computers.

The Times says that the information is in a 14-page MI5 document it has seen. According to the Times, the document states that the Chinese government "represents one of the most significant espionage threats to the UK," and that, "Any UK company might be at risk if it holds information which would benefit the Chinese."

The Times also says that the Chinese are also targeting UK businessmen the good old fashion way as well - i.e., through offers of sex and money.

Accepting free memory sticks at trade fairs - international or otherwise - is pretty dumb, and I am surprised that companies at trade fairs even offer them any more because of the obvious risk. You may recall that a few years ago, thumb drives with malicious code were found lying around the US Department of Justice just waiting for some curious person to plug them into the DOJ's network.

I suppose that some people just can't pass up something that is "free."

POSTED BY: Robert Charette
http://spectrum.ieee.org/

Security researchers blast credit card verification system

Some credit card companies use a system called 3-D Secure (3DS) that adds an extra step to transactions that are carried out on the Internet. Visa and MasterCard tout their security, but researchers are questioning their efficacy.

When making a purchase, online shoppers are confronted with a validation check that requires them to supply a password—in addition to the standard security code that is on the card itself—in order to prove that they are the real owner of a credit card. Systems built on 3DS are better known by their brand names, which include Verified by Visa and MasterCard SecureCode.

Security researchers say that these validation systems—which are used by over 200 million cardholders—suffer from serious security deficiencies. Although the failings of 3DS and its lack of conformance with best practices are well-documented, it has still been widely adopted by online retailers because it allows them to deflect the liability for fraud back to the credit card companies.

Some of the credit card companies take advantage of 3DS by wrapping their implementations of the validation system in draconian terms of service that force users to agree to accept full liability for credit card fraud. To make matters worse, some retailers don't allow consumers to opt out. The 3DS Activation During Shopping (ADS) functionality often ropes in users and gets them to sign up without fully realizing that they are doing.

In a paper presented at the Financial Cryptography conference, researchers Ross Anderson and Steven Murdoch reveal the dark underbelly of 3DS and show how the service is detrimental to consumers.

"From the engineering point of view, [3DS] does just about everything wrong, and it's becoming a fat target for phishing," wrote Anderson in an entry at the University of Cambridge security research blog. "This is yet another case where security economics trumps security engineering, but in a predatory way that leaves cardholders less secure."

The standard method of integrating 3DS verification in a website involves using HTML iframes. This is highly problematic, because it means that users won't be able to rely on the security features of their browser—such as certificate highlighting in the browser URL bar—to easily distinguish between phishing sites legitimate 3DS verification. The inability to visually ascertain whether the certificate is valid exposes users to the possible risk of man-in-the-middle attacks.

Another problems with 3DS that is highlighted in the report is that it fails to specify a consistent mechanism for verification. Individual implementors are free to determine the means for verification on their own, and often make really poor choices. For example, the report says that one bank requires cardholders to enter their ATM PIN during the verification process. This is a pretty shoddy security practice that encourages consumers to engage in risky practices that will expose them to significant risk from phishing scams.
Fixing the problems

The widespread and growing adoption of 3DS is difficult to combat because it offers built-in incentives for merchants and banks by making it easy for them to shift liability to the consumer. The researchers say that the time has come for better technology and regulatory intervention.

Financial institutions have aggressively embraced the concept of electronic passwords in some countries—such as the UK—because passwords aren't covered by the laws that protect consumers from the consequences of transactions that are carried out with forged signatures. The security researchers say that the banks should only get to shift the liability to the consumer when transactions are validated by a trustworthy payment device—a piece of hardware, similar to a CAP calculator, that connects to the user's computer and implements a two-factor authentication model.
Further reading

* Paper (PDF) (cl.cam.ac.uk)
* PCWorld (news.yahoo.com)

By Ryan Paul
http://arstechnica.com

How Unique is your browser

Is your browser configuration rare or unique? If so, web sites may be able to track you, even if you limit or disable cookies.

Panopticlick tests your browser to see how unique it is based on the information it will share with sites it visits. Click below and you will be given a uniqueness score, letting you see how easily identifiable you might be as you surf the web.

Only anonymous data will be collected by this site.
Check HERE

Pentagon Searches for ‘Digital DNA’ to Identify Hackers

One of the trickiest problems in cyber security is trying to figure who’s really behind an attack. Darpa, the Pentagon agency that created the Internet, is trying to fix that, with a new effort to develop the “cyber equivalent of fingerprints or DNA” that can identify even the best-cloaked hackers.

The recent malware hit on Google and other U.S. tech firms showed once again just how hard it is to pin a network strike on a particular person or group. Engineers are pretty sure the attack came from China, and it sure was sophisticated enough to come from a state military like China’s. But it’s hard to say conclusively that the People’s Liberation Army launched the strike.

It’s the kind of problem Darpa will try to solve with its “Cyber Genome” project. The idea “is to produce revolutionary cyber defense and investigatory technologies for the collection, identification, characterization, and presentation of properties and relationships from collected digital artifacts of software, data, and/or users,” the agency announced late Monday.

These “digital artifacts” will be collected from “traditional computers, personal digital assistants, and/or distributed information systems such as ‘cloud computers’,” as well as “from wired or wireless networks, or collected storage media. The format may include electronic documents or software (to include malicious software - malware).”

Ultimately, Darpa wants to develop the “digital equivalent of genotype, as well as observed and inferred phenotype in order to determine the identity, lineage, and provenance of digital artifacts and users.”

“In other words,” The Register’s Lew Page notes, “any code you write, perhaps even any document you create, might one day be traceable back to you - just as your DNA could be if found at a crime scene, and just as it used to be possible to identify radio operators even on encrypted channels by the distinctive ‘fist’ with which they operated their Morse keys. Or something like that, anyway.”

The Cyber Genome project kicks off this week with a conference in Virginia.

[Photo: NASA]

By Noah Shachtman

Imperva, a data security firm, said it had analysed around 32 million passwords that had been exposed in a recent hack of the RockYou website.

In December last year a hacker breached the site's company database and gained access to the unencrypted usernames and passwords of all its 32 million users.
After studying the security breach Imperva has come up with a list of the most commonly used passwords which website users should avoid.

“Everyone needs to understand what the combination of poor passwords means in today’s world of automated cyber attacks: with only minimal effort, a hacker can gain access to one new account every second—or 1000 accounts every 17 minutes,” said Amichai Shulman, Imperva’s chief technical officer.

“Employees using the same passwords on Facebook that they use in the workplace bring the possibility of compromising enterprise systems with insecure passwords, especially if they are using easy to crack passwords like ‘123456’,” he added.

“The problem has changed very little over the past 20 years. It’s time for everyone to take password security seriously; it’s an important first step in data security.”

The ten most commonly used passwords analysed in the study were:

1. 123456

2. 12345

3. 123456789

4. Password

5. iloveyou

6. princess

7. rockyou

8. 1234567

9. 12345678

10. abc123

The Internet is about to get a lot safer!

DNS, the Domain Name System, is one of the major pillars of the Internet. It’s a critical service, and without it we would all have to use IP addresses instead of handy domain names like “Pingdom.com” when we want to visit websites, send emails, and so on.

However, DNS has a huge flaw. Because DNS lacks security features it has been relatively easy for hackers to trick DNS servers with false information. By tricking DNS servers, hackers have been able to hijack entire websites. Needless to say, attacks such as these are a security nightmare and can be used for a large variety of malicious purposes such as site defacement, phishing, malware installations, and more.

For example, last December (on the 17th) visitors to Twitter.com were redirected to a completely unrelated website for over an hour. All because of compromised DNS servers.

In a step to counter these kinds of threats, a set of security extensions called DNSSEC have been developed. However, actually deploying these security extensions and making them part of the Internet’s DNS infrastructure has proven a long and arduous process with many delays. DNSSEC adoption today is in all practicality pretty much non-existent.

DNS security, the story so far

DNSSEC stands for Domain Name System Security Extensions, and just as its name implies, it adds a layer of security on top of the otherwise unsecure DNS. DNSSEC protects the integrity of DNS data and makes sure that it comes from a verified source.

With DNSSEC, site owners like for example Twitter can certify that they are the true originator of the Twitter.com domain and are therefore a credible source, and end users looking up domain names can verify that the result they get back is from a trusted source (e.g. the real Twitter).

One of the main problems so far has been that for DNSSEC to be a practical viability, it needs to be incorporated in the root zone, in the DNS root servers of the Internet. They are the core DNS servers that all other DNS servers depend on, like the roots of a tree or the foundation of a building. This so far hasn’t been the case.

But next week, this important step is finally about to happen. Or rather, it will start to happen,

DNS security extensions in the root zone

Next week we will enter a testing phase where ICANN, the main organizing body of the Internet, and Verisign, the registry of .com and .net, start adding DNSSEC to the various DNS root servers on the Internet.

Since the root servers are so critical the rollout will be incremental and is planned to last well into May, with plenty of testing of the results in the meantime to make sure that there are no problems. After all, breaking the root zone would essentially break the entire Internet.

Fortunately there isn’t any one single point of failure. There are 13 sets of root servers, numbered from A to M. In total there are about 200 root servers, spread all over the world.

Above: Map of root server locations. (From root-servers.org.)

Providing the testing goes well, the security changes to Internet’s DNS root servers will be made permanent on July 1. At this point security in the root zone will be switched on and we will have taken a big step toward a more secure Internet.

This is actually Big News. There will still be a lot of work to be done to get the entire DNS infrastructure to properly support DNSSEC on all levels, and this will take time, but once DNSSEC is included in the root zone, DNSSEC adoption is predicted to get a huge boost.

Posted in Main on January 19th, 2010 by Pingdom

Would You Have Spotted the Fraud?

Pictured below is what’s known as a skimmer, or a device made to be affixed to the mouth of an ATM machine and secretly swipe credit and debit card information when bank customers slip their cards into the machines to pull out money. Skimmers have been around for years, of course, but thieves are constantly improving them, and the device picture below is a perfect example of that evolution.

This particular skimmer was found Dec. 6, 2009, attached to the front of a Citibank ATM in Woodland Hills, Calif. Would you have been able to spot this?



This is fairly professional job: Notice how the bulk of the electronics fit into the flap below the card acceptance slot. Also, check out the tiny pinhole camera (pictured below), ostensibly designed to switch on and record the victim’s movements as he or she enters their PIN at the ATM.



Also check these pics:

http://twitpic.com/4pko1
http://twitpic.com/4pknu

found on http://www.krebsonsecurity.com

UPDATE:Police catch Facebook-taunting fugitive

LONDON - An escaped British convict whose online antics drew an international Internet fan base has been caught after nearly four months on the run, police said Wednesday.

Craig "Lazie" Lynch, 28, was caught by Scotland Yard in southern England on Tuesday night. The force confirmed only that he had been arrested and gave few other details.

Lynch was serving time for burglary at a minimum security prison in Suffolk, eastern England. He escaped on Sept. 23 and has spent much of his time since posting defiant photos of himself mocking the police on the Internet.

The ensuing media attention drew as many as 40,000 fans to his Facebook page and other associated fan sites, spawning T-shirts and even a tribute song.

Lynch's page could not be located Wednesday.

Suffolk Constabulary said that Lynch had been charged with escaping from custody and was due to appear in court later Wednesday.

Online scammers try to hijack Haiti donation bandwagon

People are rushing to help out the millions affected by this week's Haitian earthquake. Scammers are also rushing to take advantage of that generosity.

News of the this week's devastating earthquakes in Haiti spread quickly across the Internet as people looked for ways to help in the recovery efforts from home. As usual, scammers have seized the opportunity to take advantage of search engine trends by setting up fake charity sites and sending out spam soliciting donations that will go anywhere but Haiti.

Scammers pop up anytime something significant happens, whether it's a natural disaster or the death of a celebrity, trying to redirect users to their just-registered domains to infect people with malware. Disasters such as the Haiti quakes, though, have the added benefit of concerned citizens wanting to donate money—indeed, as we learned during Hurricane Katrina, large numbers of ignorant Internet users were duped by fake donation sites and ended up sending their money to those with ill intentions instead of charities that could help those in need. And not all of them are obvious scams, either—one e-mail circulating in the UK claims to come from the British Red Cross and even displays the real Red Cross address in London, but directs users to a different domain when they try to click through.

It's bad enough that several organizations have issued warnings this time around, urging those looking to donate to do their research and choose reputable charities. For example, the Better Business Bureau has a quick guide on what to look for when donating money to Haiti recovery efforts. The Federal Bureau of Investigation also has a fraud alert on its site, warning people to be wary of unsolicited e-mails, those soliciting on social networking sites, and those who claim to be making donations to a charity on your behalf. The takeaway from both the BBB and the FBI is to only donate to charities that you know and trust, and if you need help, there's a list where you can research relief organizations that are accredited by the BBB.

If you don't have time or energy to do the research, however, we'll provide a few suggestions for you. The most obvious choice is to donate to the Red Cross, which has told various news outlets that it has already exhausted all of its supplies in Haiti and that there are far more people in need of help. However, the Red Cross website isn't the only place you can donate anymore—the organization says you can donate a quick $10 just by texting the word "Haiti" to 90999. There's also Doctors Without Borders/Médecins Sans Frontières, an international organization created by doctors that provide relief efforts around the world.

There are a number of other donation memes spreading around Facebook and Twitter, most of which ask you to SMS something to a number to donate $5 or $10. We caution you, however, to be wary of these unless you hear it directly from a reputable organization (such as the Red Cross, as mentioned above)—there's no telling how much you're actually charging back to your own phone bill or what services you may inadvertently sign up for.

While you wait for your donations to go through, you can head over to Google Maps to catch updated satellite images of the destruction areas. Google is also offering a KML overlay for Google Earth as part of its partnership with GeoEye.

1 in 6 Massachusetts Residents Estimated Affected By Data Breaches from 2008 Through 2009

The Boston Globe had a sobering story over the weekend where it estimated that 1 in 6 Massachusetts residents were affected by some type of data breach over the past two years.

According to the Globe, its review of state recorded data breaches showed that at least 1 million state residents had their data compromised through credit card theft, unauthorized medical information disclosures, or other types of confidential data breaches. The Globe story also provides a list of some of the more prominent data breaches reported to the state from June to November 2009 - there were 13 of them affecting over 88,000 residents.

In 2007, Massachusetts passed a law requiring institutions such as banks, stores, universities, etc., must inform consumers and state regulators about security breaches that might result in identity theft. Since then, some 807 data breaches have been reported to state officials by the end of November 2009 the Globe says.

The Globe said that 60% of the disclosed data breaches were caused by criminal acts, while 40% were due to negligence.

However, the Massachusetts disclosure law has some loopholes that were exposed by the Hannaford episode in 2008 which may result in an under reporting of unauthorized data disclosures.

In addition, according to this paper by Sasha Romanosky et al. at the Heinz School of Public Policy and Management at Carnegie Mellon University, disclosure laws such as the one in Massachusetts don't do much in the way of reducing identify theft.

Given the number of data breaches, it is almost a certainty that someone in Massachusetts has had their personal data disclosed more than once. If anyone has had this happen to them, I would be very interested in hearing about it.

The Globe also writes that, "On March 1, new state regulations will require organizations to take stronger measures to ensure data security. Institutions that hold such personal data will have to write an official security program and train employees to follow it. In addition, organizations will have to encrypt all personal data stored on laptops, flash drives, or other portable devices, or that is transmitted over the public Internet or wireless networks."

It will be interesting to see how long after the 1st of March it will be before a data breach is disclosed to state officials that violates these new rules. I would be surprised if it takes more than 3 months

POSTED BY: Robert Charette

New airport scanners break child porn laws

A 12-month trial at Manchester airport of full body scanners only went ahead last month after under-18s were exempted. Photograph: Paul Ellis/AFP/Getty Images

The rapid introduction of full body scanners at British airports threatens to breach child protection laws which ban the creation of indecent images of children, the Guardian has learned.

Privacy campaigners claim the images created by the machines are so graphic they amount to "virtual strip-searching" and have called for safeguards to protect the privacy of passengers involved.

Ministers now face having to exempt under 18s from the scans or face the delays of introducing new legislation to ensure airport security staff do not commit offences under child pornography laws.

They also face demands from civil liberties groups for safeguards to ensure that images from the £80,000 scanners, including those of celebrities, do not end up on the internet. The Department for Transport confirmed that the "child porn" problem was among the "legal and operational issues" now under discussion in Whitehall after Gordon Brown's announcement on Sunday that he wanted to see their "gradual" introduction at British airports.

A 12-month trial at Manchester airport of scanners which reveal naked images of passengers including their genitalia and breast enlargements, only went ahead last month after under-18s were exempted.

The decision followed a warning from Terri Dowty, of Action for Rights of Children, that the scanners could breach the Protection of Children Act 1978, under which it is illegal to create an indecent image or a "pseudo-image" of a child.

Dowty told the Guardian she raised concerns with the Metropolitan police five years ago over plans to use similar scanners in an anti-knife campaign, and when the Department for Transport began a similar trial in 2006 on the Heathrow Express rail service from Paddington station.

"They do not have the legal power to use full body scanners in this way," said Dowty, adding there was an exemption in the 1978 law to cover the "prevention and detection of crime" but the purpose had to be more specific than the "trawling exercise" now being considered.

A Manchester airport spokesman said their trial had started in December, but only with passengers over 18 until the legal situation with children was clarified. So far 500 people have taken part on a voluntary basis with positive feedback from nearly all those involved.

Passengers also pass through a metal detector before they can board their plane. Airport officials say the scanner image is only seen by a single security officer in a remote location before it is deleted.

A Department for Transport spokesman said: "We understand the concerns expressed about privacy in relation to the deployment of body scanners. It is vital staff are properly trained and we are developing a code of practice to ensure these concerns are properly taken into account. Existing safeguards also mean those operating scanners are separated from the device, so unable to see the person to whom the image relates, and these anonymous images are deleted immediately."

But Shami Chakrabarti, of Liberty, had concerns over the "instant" introduction of scanners: "Where are the government assurances that electronic strip-searching is to be used in a lawful and proportionate and sensitive manner based on rational criteria rather than racial or religious bias?" she said.

Her concerns were echoed by Simon Davies of Privacy International who said he was sceptical of the privacy safeguards being used in the United States. Although the American system insists on the deletion of the images, he believed scans of celebrities or of people with unusual or freakish body profiles would prove an "irresistible pull" for some employees.

The disclosures came as Downing Street insisted British intelligence information that the Detroit plane suspect tried to contact radical Islamists while a student in London was passed on to the US.

Umar Farouk Abdulmutallab's name was included in a dossier of people believed to have made attempts to deal with extremists, but he was not singled out as a particular risk, Brown's spokesman said.

President Barack Obama has criticised US intelligence agencies for failing to piece together information about the 23-year-old that should have stopped him boarding the flight.

Brown's spokesman said "There was security information about this individual's activities and that was shared with the US authorities."

by
Alan Travis, home affairs editor
guardian.co.uk