DocBug

Listing the guilty 

Here is the list of 65 US Senators that voted to grant the president the right to lock non-citiziens up indefinitely without the right to trial or to challenge the legality of their detention, that declared if they ever are given a trial then hearsay and evidence obtained through coercion may be used against them, and that gave amnesty to those who authorized or committed illegal torture and abuse.

I find it horrific that so many of those we've elected to protect our fragile democracy are so quick to grant powers that belong only to kings, dictators and despots.

Not in my backyard 

The front page of yesterday's SJ Merc includes a great graphic showing how almost all of San Jose would be off limits to all registered sex offenders if California's Proposition 83 is enacted by voters this November. The proposition would make it illegal for a registered sex offender to live within 2000 feet of a park or school (regardless of whether his or her crime involved children) and to wear a GPS ankle bracelet for life.

From my brief read of the law defining sexual registration (IANAL!) it looks like convicted criminals are forced to register if they're found guilty of rape or by order of the court for any other crime if the court finds that "the person committed the offense as a result of sexual compulsion or for purposes of sexual gratification." That's not a sympathetic bunch of people, and though I'm disturbed by the idea of treating people as guilty of FutureCrime (punish people for what they might do in the future) I can understand the motivation. But as the Merc story points out banishing registered sex offenders from most parts of the city will just lead to more sex offenders becoming homeless, cut off from the support groups and social network that helps keep them from committing crimes again.

BlackNet and fungible bits 

From a NYT article on the efforts of credit card companies to cut out child-pornography sites from their networks:

Among purveyors of child pornography, Mr. Christenson said, there is a “growing trend toward steering visitors of these sites to various alternative payment methods.”

Mr. Christie said one of those methods involved granting access to Web sites in return for explicit photographs of children. “That phenomenon is something that we are very concerned about,” Mr. Christie said.

Tim May's original BlackNet concept warned that modern crypto can make illegal trafficking in pure information nearly impossible to trace. The main obstacle to making BlackNet-like networks a reality at a consumer level has been handling payment: anonymous e-cash systems never really got traction, and non-anonynmous financial services leave a trail right to a criminal's door.

What remains is a system of barter, or "CryptoCredits" as the BlackNet post describes them. Back when it was written digital information wasn't all that fungible: there were a limited number of things that one could exchange in pure-digital form, and the BlackNet post mostly described a market for high-stakes digital goods like trade secrets and business intelligence. But bits have become much more fungible in the past thirteen years, and nowadays an illegal info-trader can find pure-digital goods at all levels of illegality. He might trade kiddie porn for digital movies, blackmail info for stolen credit card numbers, control over zombied PCs for World of Warcraft gold, or passwords to porn sites for validated spam addresses. He might even contract for specific services, ranging from mundane transcription of documents to decoding of CAPTCHAs to obtaining the phone records of an HP board member.

CNet review of Levi's RedWire DLX Jeans 

C|Net Asia has a review of Levi's RedWire DLX Jeans, which include a watch pocket for your iPod Nano and a mini joystick on the outside for controlling it. Looks like Levi's also groks that the iPod is as much a fashion accessory as it is an MP3 player, and matches accordingly:

The material is rather like a pair of Levi's 523s. Tough and with a yielding woven pattern. In affirmation of the MP3 player it carries, the DLX's detailing are colored a classic iPod white; from rivets to the button-fly and right down to the use of white embroidered threads.

(Thanks to Aileen for the link!)

Diebold's AccuVote-TS Voting Machine 

A few days ago Ed Felton announced he and his students had released a detailed security analysis of the Diebold AccuVote-TS voting machine. The executive summary and/or demonstration video is well worth a look, and the full research paper is a must-read for anyone interested in computer security.

By later that day, the president of Diebold Election Systems had issued a rebuttal. I'm a security dabbler, not an expert, but to my semi-trained eye the rebuttal looks like a bunch of smoke. I'm looking forward to hearing the Princeton authors' response [Update 9/22: posted here], but while I'm waiting for that here's my own take on it:

September 13, 2006 – “Three people from the Center for Information Technology Policy and Department of Computer Science at Princeton University today released a study of a Diebold Election Systems AccuVote-TS unit they received from an undisclosed source. The unit has security software that was two generations old, and to our knowledge, is not used anywhere in the country.

If they really believe their current systems are secure, they should put their machines up for independent external review so groups like Felton's wouldn't have to rely on leaked code and old machines for testing. I also notice this rebuttal nowhere says "yes, those were security flaws in the machines we distributed back in 2002, but we've fixed them since then." And many (though not all) of the security problems cited in the report are inherent in the system's basic architecture — it'll take more than a software update to fix them.

Normal security procedures were ignored. Numbered security tape, 18 enclosure screws and numbered security tags were destroyed or missing so that the researchers could get inside the unit.

The main attack the Princeton paper talks about is one where a criminal (possibly working as a poll worker) infects the memory card used to set the list of races and candidates with a virus, or alternatively substitutes the real memory card with an infected one. Then the virus is automatically loaded onto the machine when the election parameters are set — before any numbered security tape is placed. Security tape only protects from a voter trying to infect a machine on election day, not from a substitute when the machines are still being configured for the next day's election.

A virus was introduced to a machine that is never attached to a network.”

Remember before the Internet, when viruses were things that were transmitted from floppy to floppy? That's what this virus does. And the election definition files and software upgrades are both transmitted via these memory cards, so if an infected machine gets a definition update then any machine that gets the update from that same card afterwards will also get the virus.

“By any standard - academic or common sense - the study is unrealistic and inaccurate.”

I suppose that could be, but he's said nothing to make me think it's the case.

“The current generation AccuVote-TS software – software that is used today on AccuVote-TS units in the United States - features the most advanced security features, including Advanced Encryption Standard 128 bit data encryption, Digitally Signed memory card data, Secure Socket Layer (SSL) data encryption for transmitted results, dynamic passwords, and more.”

None of these security measures matter for the attacks described in the report. To give an analogy, the Princeton report was all about how Diebold keeps leaving the windows wide open, and this paragraph is bragging about how strong the deadbolt is on the front door.

“These touch screen voting stations are stand-alone units that are never networked together and contain their own individual digitally signed memory cards.”

This is the first statement that addresses anything in the Princeton report, as the machine they studied did not have digitally-signed memory cards. Assuming he's not just, well, lying out his ass, that'd help against one of the attacks they mention. However, as the report points out in section 5.1, there are still many other attacks that are inherent in the design of the Diebold system's basic architecture that can't be fixed with simple software modifications like this. For example, a criminal could replace the EPROM chip on the motherboard directly.

“In addition to this extensive security, the report all but ignores physical security and election procedures. Every local jurisdiction secures its voting machines - every voting machine, not just electronic machines. Electronic machines are secured with security tape and numbered security seals that would reveal any sign of tampering.”

Actually, they talk about the physical security and election procedures at length in their report. For example, they point to a recent study of the AccuVote DRE election processes showing that more than 15% of polling places reported at least one problem with seals (see Figure III-16, p. 67). They also point out the difficulty in dealing with an attack where a voter simply unlocks the machine and does nothing more than break the seal, in an attempt to invalidate votes cast in a district that tends to favor his opponent. And, just to add insult to injury, Felton today posted that the lock on the Diebold voting machines can be opened by a hotel minibar key. Some physical security.

“Diebold strongly disagrees with the conclusion of the Princeton report. Secure voting equipment, proper procedures and adequate testing assure an accurate voting process that has been confirmed through numerous, stringent accuracy tests and third party security analysis.”

"Third party" in this case still means companies hired by the manufacturer, and reporting directly to the manufacturer. The system isn't made available for truly independent security analysis.

“Every voter in every local jurisdiction that uses the AccuVote-TS should feel secure knowing that their vote will count on Election Day.”

Translation: nothing to see here, please pay no attention to the huge gaping hole in our security and our reputation.

Breaking iTunes Music Store DRM 

A couple weeks ago QTFairUse was ported to iTunes 6. Yes, it was just in time for Apple to release iTunes 7, but it looks like it's also working at least for on music purchased with iTunes 7 as well.

Unfortunately, it's Windows only (and still a little unstable I gather), but hopefully this means JHymn will soon be updated to work on the latest iTunes. Then maybe I'll actually start purchasing from the iTunes Music Store again...

Don't Download This Song 

Check out Weird Al's latest hit "Don't Download This Song". Video e-card and, of course, downloadable MP3 are available at www.dontdownloadthissong.com. (Via DrWex at Copyfight)

Comments enabled again 

My apologies for comments being broken for so long on this site. Spammers were pounding the comments script, and we had to remove it entirely just to keep the server from being brought to its knees. (I still get around 1000 attempts per day, even though the script has been gone a month or more.)

Comments are now working again, with a new JavaScript hack that disguises the script name itself. It's an easy hack to get around, but I'm hoping not enough people are using this particular hack that spammers have found it worth it to automate a work-around.

Amazon e-book reader 

Engadget has the dish on the new "Amazon Kindle" eBook reader being developed by Amazon, complete with wireless for instant eBook purchases and what looks like an eInk display. (Let's hear it for people who regularly troll for new FCC Filings reports!)

Subliminals in my spam 

This may be old hat to some of you, but it was new to me — I just got an email spam that includes subliminals. The whole ad is an animated GIF designed such that the word BUY! flashes over the email for a split second every 30 seconds (including briefly as the email loads). I doubt this'll actually make the spam any more effective (and in this case it's a stock-push-scam, so the spammer-scammer won't know either), but it's interesting to see what they're up to these days.