Interview with a Phisher

ha.ckers.org web application security lab - Archive » Phishing Social Networking Sites

Poisoned pet food

Having lived through the UK BSE in beef scare which essentially destroyed a large part of UK agriculture within a couple of years I find the reaction from regulators to the poisoned pet food scandal incomprehensible.

If company sells a billion dollars of pet food a year its brand is on the line with every tin that leaves the production line.

In the BSE episode the Tories made every effort to avoid enforcing regulations that would put costs on farmers. At every turn they tried to explain the problem as irrelevant, minor. Ministers made categorical statements about the safety of the beef that were clearly false because it was obvious that nobody knew whether the beef was safe or not.

When attempts to avoid regulation failled the new policy was essentially to shoot every cow in the country.

It does not take a great deal to learn from recent history. Why are politicians so incapable of doing so?

Alienware: Hangar18

I have been blogging on the collision between the computer industry and the consumer electronics industry for some time. Alienware's Hangar18 represents one of the most serious shots in that battle to date. There are plenty of premium media PCs on the market, and these days plenty that come in an appropriate form factor. This one is different, it has the receiver/amplifier built in.

Not sure that they have hit a home run however, looks to me as if they are more than a little light on connectivity. I don't see where I plug in my HDDVD, BluRay or DVD players. Where is the slot for XM or Sirius? And when will one of these devices come that is satellite TV capable?

How iTunes sucks

iTunes is not that bad as a music player but there are features that are distinctly substandard.

In particular the Windows version makes no attempt to provide Windows look and feel. Mac people whine incessantly about the lack of Mac look and feel on programs targetted at their platform, Apple should take the same pains when supporting Windows that they expect other to take for the Mac.

The Apple style Chrome looks distinctly ugly under Aero. More significantly the tab for setting prefferences is under 'Edit' on the far left rather than 'Settings' on the right. Until I managed to find preferences my list of complaints was rather longer.

The other principal gripe I have is that iTunes thinks in terms of tracks, not albums. In most cases this does not matter, but whenever a disk has tracks with multiple artists they end up fragmented in the display.

Another aspect of this problem is that none of the browser interfaces gives me a grid of album covers to choose from. Dealling at the track level may have made sense when 1Gb was a large collection, I have 10Gb and I am not done ripping yet. None of the current displays will show more than about five albums at a time. That is not a good use of my 4 million pixels of screen real estate.

Don't give me a shitty 'coverflow' whizbang display, not unless you have the basics done first. The coverflow display shows me fewer covers at a time, not more, 4 million pixels an I get to see 6 covers, only one front on. My monitor can easily show 200 cover icons at once, use that capability.

One of the main uses for such a view would be to fill in the missing covers after a ripping session.

Another thing I would like is a better way to handle the occasional rip that ends up damaged for some reason, perhaps the disk is dirty or scratched. I don't want to have to deal with these by checking each one after the fact, just keep track of the number of errors and let me search for disks with problems after doing a batch rip.

Idiots in action

CNN demonstrates how America has become the land of the lawsuit.

High school principals seem to be particularly prone to this type of autocratic idiocy. They spend their time dealling unfairly with children who can't complain, then they deal with the parents in the same way.

Tends not to be the sort of thing that happens to white middle class folk like myself who clearly have the means to impose an expensive lawsuit on the school if they can't get their way by complaining to the state representative, mayor etc.

The ACLU may not see a free speech issue, but there are plenty of claims that can be made, in particular defamation.

Slashdot | GPLv2 Vs. GPLv3

Stallman is touting the purpose of the GPL 3.0 changes as being to prevent the 'Tivoization' of software, to ensure that people have the ability to change code on appliances they buy.

Freedom to tinker is a justifiable goal, the problem is that the GPL3.0 changes go much further, in particular they prohibit the implementation of any form of trustworthy computing controls.

This is at best short sighted. Freedom to tinker means that I get to tinker with my machines, not the authors of spyware, keyboard loggers and other malware. Freedom to tinker does not mean freedom to bypass copyright protection controls.

We need to take a deeper look at how the technology works here to understand that the issue is not the ability to run code, it is the ability to access particular decryption keys. All trustworthy computing does is provide a hardware subsystem that gates access to particular pieces of information to code running in a particular operating system partition that has software protections to control the executables that can run.

What the open source community should be asking for is not what Stallman is demanding: a complete prohibition on trustworthy computing technologies. That demand has far more to do with Stallman's own peculiar political views.

Instead the open source community should demand that open source systems allow other code to be run, albeit not necessarily have access to the encryption keys. So someone could take the Tivo code, recompile it, add features and run it on the Tivo box. But the modified code would not then be able to access the keys used to control access to protected content.

Slashdot Insurance

I can't read the Slashdot Story New Fuel Cell Twice As Efficient As Generators. Its been Slashdotted.

Which is a pity because in the scope of things the bandwidth required to support a Slashdotting is a significant but temporary quantity that most ISPs or hosting providers can easily withstand, particularly if the site is running on a virtual host.

Golfers used to buy 'hole in one' insurance to pay for the cost of buying a round of drinks should they score one. We need the same for Slashdot. Hosting companies would simply add a 'Slashdot' box to their order form and for a few cents more the blogger could ensure that they can continue to be seen in the case of a sudden (temporary) increase in popularity.

What Larry Flynt is looking for

Larry Flynt has put out another of his million dollar offers for evidence of sexual scandal in Washington D.C.

Reports in the Establishment media suggest that Flynt is on a simple fishing expedition. It seems more likely that his objective is to join the dots between the Washington DC madam scandal and the Abramoff/Wilkes/GOP corruption scandal.

In particular it has been alleged in a number of indictments in the Cunningham/Wilkes corruption scandal that Wilkes and Wade entertained senior members of Congress in the WaterGate hotel at parties where poker, alcohol and prostitutes were provided.

Quite a few people have wondered if there is a link here to the ongoing Palfrey 'D.C. Madam' case. Did she provide the prostitutes? It appears that prosecutors might think so.

Of course the total lack on interest in this particular story by the Establisment media raises questions itself. The allegations are made in federal court indictments in cases that have already led to Congressman Cunningham going to jail for taking $2.5 million in bribes. Instead we are told about how much Democratic candidates have spent on haircuts.

How terrorists can bypass immigration

Like many Canadian airports it is now possible to pass through US immigration in Dublin when flying to the states. But unlike the Canadian scheme the Irish one does not cover customs.

This leads to a major security problem on arrival in Chicago. The airport is built for only two types of arrival: domestic and international. There is no third category for passengers who have passed immigration but not customs.

So when passengers from Ireland arrive at Chicago they mix with the other passengers who have not passed through immigration and then present their stamped customs declaration form to bypass the queues at immigration.

The customs form has no binding to the passenger presenting it. So all it takes to bypass immigration is to arrange to fly to Chicago on an international flight which is scheduled to arrive before a flight from Ireland, hang out in the rest rooms until the Irish flight is in, then present a customs form with a fake stamp to bypass the immigration desk. Alternatively put a passenger with a US passport on the flight from Ireland, on arrival in Chicago they pass their customs form to the terrorist and then pass through immigration as normal.

It would probably cost something to refit Chicago and other airports to handle this situation securely. But the costs are small compared to the $22 billion or so that RealID is going to cost.

Dan Froomkin - 50 More Years in Iraq? - washingtonpost.com

By comparing Iraq to Korea, Bush has effectively admitted that the situation is a stalemate and neither side can expect victory.

As far as the US polity is concerned anything short of victory is a defeat.

The statement has effectively made McCain, Romney and Giuliani unelectable. Even the likes of Rush Limbaugh are not going to argue for fifty more years of war in Iraq.