July 2012 - cypherpunks-legacy

Оплата после получения СЕРТИФИКАТА
by "СЕРТИФИКАТ" 19 Jul '12

19 Jul '12

Все виды сертификации АКЦИЯ Оплата после получения СЕРТИФИКАТА Только у нас СЕРТИФИКАТ СООТВЕТСТВИЯ (ГОСТ Р) ЗА 1 ДЕНЬ!!! (495) 227 94 43 www.сертификация-быстро.рф

1 0

News Blog: CJIS Executive Briefs Congress on Next Generation Identification Initiative (fwd)
by J.A. Terranson 18 Jul '12

18 Jul '12

Depressing reading... ---------- Forwarded message ---------- Date: Wed, 18 Jul 2012 21:28:15 -0000 From: FBI <fbi(a)subscriptions.fbi.gov> Reply-To: delivery(a)ic.fbi.gov To: sysadmin(a)mfn.org Subject: News Blog: CJIS Executive Briefs Congress on Next Generation Identification Initiative News Blog has been updated. You can access it at http://www.fbi.gov/news/news_blog/blog-collection/rss.xml CJIS Executive Briefs Congress on Next Generation Identification Initiative July 18, 2012 Jerome Pender, deputy assistant director of our Criminal Justice Information Services Division, updated members of the Senate Judiciary Committeebs Subcommittee on Privacy, Technology, and the Law on the status of the Bureaubs Next Generation Identification (NGI) program.

1 0

[WIKILEAKS] Use the New WikiLeaks Donation Gateway to Donate with Visa whilst You Can
by Eugen Leitl 18 Jul '12

18 Jul '12

----- Forwarded message from Wikileaks Press Office <press-office(a)wikileaks.org> -----

1 0

[cryptography] Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices
by Eugen Leitl 18 Jul '12

18 Jul '12

----- Forwarded message from Jeffrey Walton <noloader(a)gmail.com> -----

1 0

EDRi-gram newsletter - Number 10.14, 18 July 2012
by Eugen Leitl 18 Jul '12

18 Jul '12

----- Forwarded message from EDRi-gram <edrigram(a)edri.org> -----

1 0

[liberationtech] Open Secure Telephony Network (OSTN)
by Eugen Leitl 18 Jul '12

18 Jul '12

----- Forwarded message from ilf <ilf(a)zeromail.org> -----

1 0

Secrecy News -- 07/18/12
by Eugen Leitl 18 Jul '12

18 Jul '12

----- Forwarded message from Steven Aftergood <saftergood(a)fas.org> -----

1 0

[tahoe-lafs-weekly-news] TWN 36
by Eugen Leitl 18 Jul '12

18 Jul '12

----- Forwarded message from Patrick R McDonald <marlowe(a)antagonism.org> -----

1 0

One Secret That Stops Hackers: Girlfriends
by Eugen Leitl 18 Jul '12

18 Jul '12

http://www.informationweek.com/news/security/management/240003767 One Secret That Stops Hackers: Girlfriends The majority of hackers "age out" of hacking as they get older and find girlfriends, families, and other responsibilities. Why not invest in educating young hackers sooner, instead of locking them up later? Mathew J. Schwartz | July 16, 2012 11:43 AM Want to put a stop to hacking? The solution is simple: Get hackers girlfriends. To be sure, that prescription is tongue-in-cheek, but it speaks to a hacking truth: Based on arrests of alleged Anonymous, LulzSec, TeamPoison, and other hacktivist group participants--not to mention many cyber-crime gangs--it's the rare participant who's over the age of 25--or even 19. Clearly, the early 20s are an inflection point in most hackers' lives, when they transition from engaging in criminal activity to becoming law-abiding citizens. Accordingly, might outreach programs, perhaps involving older ex-hackers, help keep them out of jail? They might even steer would-be hackers into lucrative professions that put their skills to better use, such as penetration testing. The question of whether outreach programs would be effective requires working backwards, starting with the reason hackers--who are overwhelmingly male--stop hacking. That's typically because they get girlfriends, jobs, children, or other responsibilities. "We see a lot of adolescent hackers just 'aging out,' and there are relatively few who remain life-course persistent," says cyberpsychology expert Grainne Kirwan, a lecturer in psychology at Ireland's Dun Laoghaire Institute of Art, Design and Technology, in a phone interview. While conducting research for her criminology Ph.D., Kirwan interviewed about 20 hackers and found that the majority stopped hacking due to their changing life circumstances. "The chances are by the time they turn 18 or 19 they'll age out, and if they haven't stopped then, by the time they get married, settle down, and have kids, they won't have time to do this type of behavior anyway," she explains. "As they get older, their moral development gets better, and they don't have the ability to commit crimes anyway." Kirwan said the aging-out phenomenon isn't limited to young hackers. "What we know from general criminology research is that offenders age out, and that they tend to age out when they start to settle down, find a significant other, and [other] factors that will reduce the likelihood of their wanting to offend," she says. The prevalence of minors who hack hasn't gone unnoticed in law enforcement circles. Speaking earlier this year at the RSA conference in San Francisco, Eric Strom, unit chief for the Cyber Initiative and Resource Fusion Unit Cyber Division at the FBI, said the bureau believes that in general, hacktivist groups are run by a small number of people who combine "technical knowhow and the ability to impress upon younger people" the desire to launch certain types of attacks. But, he said, "the challenges of going after the larger group [of participants] is that most of them are minors." How should law enforcement address that, especially when those kids' parents likely think their son is upstairs doing his homework, not launching a law orbit ion canon distributed denial-of-service (DDos) attack? To answer that question, it helps to know why hackers hack. In fact, most hackers--who are older minors or young adults--"are desperately trying to assert their own independence, and believe they can make a change in the world that their parents can't," says Kirwan. "They kind of forget that it's their parents' generation who invented hacking." Many kids involved in hacking view their activities as a benign form of protest, when the laws--as currently written--can criminalize some types of related behavior. "They are sitting at their computer and saying, 'I'm not committing a crime,' because it doesn't feel like committing a crime," explains Kirwan. The FBI's Strom said the bureau tries to draw a clear line between online protests and online attacks. "Certainly if they're just complaining about something, they have every right to do that--and we don't have any problem with that," said Strom. But if they hack into a system or go after someone in law enforcement and their family, that's a different story. Also, there can be seeming inconsistencies between what's legal in the real world as opposed to online. "In the western world, we generallyb& encourage political activism, even when it might have a negative effect on business," said Grady Summers, vice president of Mandiant, speaking at this year's RSA conference. For example, workers can picket their place of business over poor working conditions, and people can protest in front of foreign embassies or set up Occupy Wall Street camps that may impact local businesses. But by comparison, "the digital equivalent of that--a DDoS attack that takes a site offline for a few hours--is clearly criminal," he said. Should the laws pertaining to DDoS attacks, when launched for protest purposes, be changed? Regardless of wrong or right, in today's "must-be-seen-as-tough-on-crime" political arena, it's unlikely that related laws or jail times would ever be curtailed. Furthermore, do we really have a full enough understanding of exactly why people hack? "What do we really know about hackers engaged in bad stuff? Do we have a proper, accurate, working taxonomy of people involved in cyber-criminal activity, cyber espionage, cyber warfare, and so on?" said Darkmarket author Misha Glenny, speaking at this year's RSA conference. "Who are the masterminds behind the attacks? Are they suave social engineers, are they highly skilled hackers, or are they psychopathic characters who combine both attacks?" Another question concerns whether many hackers might also have Asperger's syndrome, a form of autism characterized by having difficulties with social interaction, and often also an affinity for obsessive or repetitive routines. Kirwan says a connection between hacking and Asperger's has been noted anecdotally because "it's a facet of some of the most publicized cases." For example, both the lawyers for NASA hacker Gary McKinnon and accused LulzSec member Ryan Cleary have said their clients have the disorder. The Asperger's theory would handily explain why many kids hack, as well as why they're so good at it. "People who have Asperger's syndrome are less likely to find full-time employment or to settle down with a family," says Kirwan. "Another trait for people with Asperger's is they will find out everything they know about something they like." But she cautions against trying to reduce the cause of hacking to just a developmental disorder. "I certainly don't want to do a tarring with one brush," she says. Keeping the potential Asperger's connection in mind, if most hackers do simply age out, could prevention programs be put in place to help deter minors before that happens? For example, why not turn to older, more mature ex-hackers to educate younger hackers about the risks, or to try and help them put their talents to a legalband, given the state of the information security job market, likely quite remunerative--use? "Putting the two together seems like it would reduce the crime, but the next step is to test that and see if that's what really happens," says Kirwan. Unfortunately--at least where Kirwan's hacking studies are concerned--hacking interviews and research conducted for her Ph.D. have given way to the responsibilities of a full teaching load. "It would be fantastic if I could buy out a bunch of my time and work on a project like this," she says. "But we'd need the funding to do that, and at the moment, that funding doesn't seem to be around." So here's to a show of hands from businesses and government agencies that don't want to get taken down by hacktivists: Rather than locking up hackers after the fact, who wants to fund better hacking research and practical hacking-prevention campaigns? Black Hat USA Las Vegas, the premiere conference on information security, features four days of deep technical training followed by two days of presentations from speakers discussing their latest research around a broad range of security topics. At Caesars Palace in Las Vegas, July 21-26. Register today.

1 0

NSA Mimics Google, Pisses Off Senate
by Eugen Leitl 18 Jul '12

18 Jul '12

http://www.wired.com/wiredenterprise/2012/07/nsa-accumulo-google-bigtable/ NSA Mimics Google, Pisses Off Senate By Cade Metz July 17, 2012 | 6:30 am | Categories: Database Software Follow @cademetz The Senate Armed Service Committee isnbt exactly pleased with the NSAbs Google-like database. Image: jim.greenhill/Flickr In 2008, a team of software coders inside the National Security Agency started reverse-engineering the database that ran Google. They closely followed the Google research paper describing BigTable b the sweeping database that underpinned many of the Googlebs online services, running across tens of thousands of computer servers b but they also went a little further. In rebuilding this massive database, they beefed up the security. After all, this was the NSA. Like Google, the agency needed a way of storing and retrieving massive amounts of data across an army of servers, but it also needed extra tools for protecting all that data from prying eyes. They added b cell levelb software controls that could separate various classifications of data, ensuring that each user could only access the information they were authorized to access. It was a key part of the NSAbs effort to improve the security of its own networks. But the NSA also saw the database as something that could improve security across the federal government b and beyond. Last September, the agency open sourced its Google mimic, releasing the code as the Accumulo project. Itbs a common open source story b except that the Senate Armed Services Committee wants to put the brakes on the project. In a bill recently introduced on Capitol Hill, the committee questions whether Accumulo runs afoul of a government policy that prevents federal agencies from building their own software when they have access to commercial alternatives. The bill could ban the Department of Defense from using the NSAbs database b and it could force the NSA to meld the projectbs security tools with other open source projects that mimic Googlebs BigTable. The NSA, you see, is just one of many organizations that have open sourced code that seeks to mimic the Google infrastructure. Like other commercial outfits, the agency not only wants to share the database with other government organizations and companies, it aimed to improve the platform by encouraging other developers to contribute code. But when the governmentbs involved, therebs often a twist. The U.S. government has a long history with open source software, but there are times when policy and politics bump up against efforts to freely share software code b just as they do in the corporate world. In recent years, the most famous example is NASAbs Nebula project, which overcame myriad bureaucratic hurdles before busting out of the space agency in a big way, seeding the popular OpenStack platform. That said, the Accumulo kerfuffle is a little different. In trying to determine whether Accumulo duplicates existing projects, the bill floated by the Senate Armed Services committee uses such specific language, some believe it could set a dangerous precedent for the use of other open source projects inside the federal government. The NSA at bInternet Scaleb Originally called Cloudbase by the NSA, Accumulo is already used inside the agency, according to a speech given last fall by Gen. Keith Alexander, the director of the NSA. Basically, it allows the NSA to store enormous amounts of data in a single software platform, rather than spread it across a wide range of disparate databases that must be accessed separately. Accumulo is whatbs commonly known as a b NoSQLb database. Unlike a traditional SQL relational database b which is designed to run on a single machine, storing data in neat rows and columns b a NoSQL database is meant for storing much larger amounts of data across a vast array of machines. These databases have become increasingly important in the internet age, as more and more data streams into modern businesses b and government agencies. With BigTable, Google was at the forefront of the NoSQL movement, and since the company published its paper describing BigTable in 2006, several organizations have built open source platforms mimicking its design. Before the NSA released Accumulo, a search outfit called Powerset b now owned by Microsoft b built a platform called HBase, while social networking giant Facebook fashioned a similar platform dubbed Cassandra. And this is what bothers the Senate Armed Services Committee. The Senate Armed Services Committee oversees the U.S. military, including the Department of Defense and the NSA, which is part of the DoD. With Senate bill 3254 b National Defense Authorization Act for Fiscal Year 2013 b the committee lays out the U.S. military budget for the coming year, and at one point, the 600-page bill targets Accumulo by name. The bill bars the DoD from using the database unless the department can show that the software is sufficiently different from other databases that mimic BigTable. But at the same time, the bill orders the director of the NSA to work with outside organizations to merge the Accumulo security tools with alternative databases, specifically naming HBase and Cassandra. The bill indicates that Accumulo may violate OMB Circular A-130, a government policy that bars agencies from building software if itbs less expensive to use commercial software thatbs already available. And according to one congressional staffer who worked on the bill, this is indeed the case. He asked that his name not be used in this story, as hebs not authorized to speak with the press. At this point, the staffer says, the committee isnbt concerned with the man power the NSA required to built the database. But it doesnbt want the government using Accumulo if there are larger, more active communities developing projects such as a HBase and Cassandra. He says that the committee encouraged the NSA to build its security controls into existing open source projects, but that the agency declined to do so. The NSA press office could not immediately provide someone to officially discuss the matter. But for Gunnar Hellekson b the chief technology strategist in U.S. Public Sector group at Red Hat, the open source software outfit b the committee has gone too far. He was pleased to see a senate bill that has such intimate knowledge of open source software b a rarity on Capitol Hill b but he argues that since Accumulo has already been built and open sourced, the committee has no business intervening. b When Accumulo was written, it was definitely doing new work,b he tells Wired. b Some of its differentiating features are being handled by other pieces of software. But other core concepts are unique, including the cell-level securityb&. Thatbs are incredibly important feature, and to do it properly is incredibly complicated.b Not All Open Source Projects Are Created Equal The bill benefits HBase and Cassandra b two very popular open source projects. But it certainly undermines the progress of Accumulo, and thatbs a particular worry for Oren Falkowitz, one of the developers of the database, who has left the NSA to start Sqrrl, a company that seeks to build a business around Accumulo in much the same way Red Hat built one around the Linux operating system. Like Hellekson, Falkowitz argues that since Accumulo already open source b and its backed by the Apache Software Foundation, a major open source steward b it doesnbt violate government policy. b The launch of sqrrl validates the success of Apache Accumulo as a project,b he says, pointing out that sqrrl has received funding from two well-known venture capital firms. b Accumulobs technical strengths are not limited to government use cases, and already, webve seen interest and adoption of Accumulo by financial, healthcare, and a broad range of other commercial firms.b He also argues that Accumulo is still quite different from other BigTable mimics. BigTable and other similar database splits massive amounts of data into tiny pieces and spreads them across potentially tens of thousands of servers. But unlike any other platform, Falkowitz says, Accumulo lets you tag each tiny piece of data so that it can only be accessed by certain outside servers. This is useful not only to the NSA, he says, but to other government organizations and health care outfits legally required to separate data in this way. b Basically, each [data object] has an extra label thatbs attached to it, and you can use that to authenticate and authorize users against each object,b Falkowitz says. b Most systems do that at the columns or the rows level of the database.b Red Hatbs Hellekson b who has blogged about the issue on multiple occasions b goes further, arguing that the bill could undermine the progress of open source projects well beyond Accumulo. The bill doesnbt just ask that the DoD prove that the Accumulo project is no more costly than the likes of HBase and Cassandra. It wants proof that Accumulo is a b successful Apache Foundation open source database with adequate industry support and diversification.b b It doesnbt take much imagination to see that same badequacy criteriab applied to all open source software projects,b Hellekson writes. b Got a favorite open source project on your DoD program, but no commercial vendor? Inadequate. Only one vendor for the package? Lacks diversity. Proprietary software doesnbt have a burden like this.b If the bill passed with the current Accumulo language intact, the onus is on the chief information officer of the Department of Defense to determine whether Accumulo can be used within the department. But whatever the verdict, it would not bar the NSA from using the database b just the rest of the DoD. Open source is a complicated thing. Especially inside the government. Cade Metz Cade Metz is the editor of Wired Enterprise. Got a NEWS TIP related to this story -- or to anything else in the world of big tech? Please e-mail him: cade_metz at wired.com. Read more by Cade Metz

1 0