InfoSec Daily Podcast Episode 430 for July 18, 2011. Tonight's podcast is hosted by Rick Hayes, Beau Woods, Karthik Rangarajan, and Varun Sharma.
Announcements:
SANS Security 464 – Hacker Detection for Systems Administrators with Continuing Education Program – Russell Eubanks
Where: Atlanta, GA
When: Tue, Aug 09 to Wed, Aug 10
https://www.sans.org/mentor/details.php?nid=25573
#BruCon
When: Sept 19-22, 2011
Where: Brussels, Belgium
http://blog.brucon.org/2011/02/confirmation-of-brucon-dates.html
@DerbyCon
When: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/
SANS Mentoring: Forensics 408 – Computer Forensic Essentials
When: Wednesday, October 12, 2011 – Wednesday, December 14, 2011
Where: Atlanta, GA
Discount Code: ISDPod15 (15% discount)
http://www.sans.org/mentor/details.php?nid=25504
Hack3rCon 2011
When: October 21st-23rd, 2011
Where: the Charleston House Hotel and Conference Center
http://www.hack3rcon.org/
2011 Fall Information Security Conference
When: November 8 – 9, 2011
Where: Atlanta, GA (Loudermilk Conference Center)
http://www.gaissa.org
Stories:
Source:http://www.theregister.co.uk/2011/07/18/anonymous_social_network/
The story so far is that Anonymous – or someone associated with Anonymous, or someone cynically riding on the back of Anonymous, who knows? – has set up a site that will offer some kind of social network.
According to TechSpot, the idea (and the “Alpha” Website, anonplus.com) arose when Google+ allegedly banned an unknown number of Anonymous members.
The Anonplus site is couched in Anonymous’s usual grandiose phraseology – “they will know that we have arrived. There will be no oppression. There will be no more tyranny. We are the people and we are Anonymous.”
Fair enough. Anyone’s got the right to set up a social network if they want, and they have the right to claim to act on behalf of others, regardless of how accurate that claim may be.
But the idea of a completely anarchic, “no tyranny, no oppression” (defined in whose terms?) social network offers some interesting self-contradictions to resolve.
I’ll grant that the world of corporate social networks is a nightmare of “tyranny and oppression” – so much so that the success of Facebook and the excitement over Google+ mystifies me.
Facebook bans a Google+ ad at the drop of a hat, but turns into a nearly-immovable object if asked to help deal with abusive commenters (who, for example, infest tribute pages to the dead). Google+ demands an understanding of 37 different privacy statements. Social networks are not just tyrannical, they’re also a “confusopoly” whose success depends on nobody being able to decode the rules they’ve promised to follow.
Anonymous’s intervention – to me, a much more welcome intervention than the group’s inability to distinguish between targets, slapping the small and mighty with equal abandon and claiming equal credit whether they’ve defeated a flea-bite nobody or a US military operation – may or may not succeed, but it raises an interesting question.
What’s the line separating rules that are necessary for a social network to function from rules that are oppressive; and when does one become the other?
All social interactions are government by rules of some kind. They may be tight or loose, consensual or tyrannical, explicit or implicit, designed or evolved, but the rules exist, whether or not you follow them (or even acknowledge them).
If all you do is hold a conversation with someone, you will follow at least one rule – the two of you will hold the conversation in languages comprehensible to you both. The interaction won’t happen without that minimum rule.
“If we hack something, we publish it” is a rule for Anonymous – written or not. “There will be no tyranny” is a rule of interaction.
And even Anonplus.com must have, at minimum, one rule: “anybody may join”. The group itself has implied a second rule, that nobody be censored or blacked out.
Censorship provides a convenient handle on which I can hang a question about rules: censorship by whom? Sure, it’s clear that “Anonplus” won’t censor the statements or posts of its users – but what of those users who would wish to constrain, censor or silence other users?
Such people exist in every large group – whether they merely seek to shout down dissent or, since this is the Internet, if they seek to silence those they don’t like by hacking their profiles.
“We will not censor” is one rule, one which governs only part of the interaction: “You will not censor” is another – one which, in both its expression and enforcement, contains the potential for tyranny. The more difficult “do not hack other users’ profiles” holds even better tyrannical potential, since it involves questions of accusation, evidence, proof, appeal and enforcement.
These are merely a couple of simplistic examples. The greater the subtlety and complexity of the interaction, the more subtle and complex the rules that govern it.
Anonplus already has rules. To grow into something that has users – users outside its own inner circle – it faces a much tougher task. It must learn to walk a tightrope between the tyranny of rules and the tyranny of anarchy. If it succeeds, it will be a welcome coming-of-age.
A federal appeals court on Friday unanimously declined to block the government from using intrusive body scanners across airports nationwide, saying it is “not persuaded by any of the statutory or constitutional arguments” against them.
The US Court of Appeals for the District of Columbia Circuit was deciding a constitutional and procedural challenge to the Advanced Imaging Technology “nude” body scanners, which began rolling out in 2007 and are deployed to at least 78 airports nationwide. The Electronic Privacy Information Center asked the court to block usage of the devices—of which 500 more are to be rolled out this year—on grounds that they are an unconstitutional privacy invasion, ineffective, and unhealthy to airline passengers.
“The petitioners argue that using AIT for primary screening violates the Fourth Amendment because it is more invasive than is necessary to detect weapons or explosives,” the appeals court noted. “As other circuits have held, and as the Supreme Court has strongly suggested, screening passengers at an airport is an ‘administrative search’ because the primary goal is not to determine whether any passenger has committed a crime but rather to protect the public from a terrorist attack.”
The court said that whether an administrative search is unreasonable is a balancing test on how much it intrudes upon an individual’s privacy, and how much that intrusion is needed for the promotion of “legitimate” government interests.
“That balance clearly favors the government here,” the court ruled 3-0. The court added that an “AIT scanner, unlike a magnetometer, is capable of detecting, and therefore of deterring, attempts to carry aboard explosives in liquid powder form.” The three-judge appellate panel did not address limited research suggesting that the machines might not detect explosives or even guns taped to a person’s body.
However, the appellate court, which is one stop from the Supreme Court, said that the Transportation Security Administration breached federal law in 2009 when it formally adopted the airport scanners as the “primary” method of screening. The judges said the TSA violated the Administrative Procedures Act for failing to have a 90-day public comment period, and ordered the agency to undertake one.
Generally, under the APA, agency decisions must go through what is often termed a “notice and comment” period if their new rules would substantially affect the rights of the public—in this case air passengers. The Environmental Protection Agency often undertakes “notice and comment” periods for proposed pollution regulations.
The court did not penalize the TSA for its shortcomings. The TSA argued to the court in March that a public comment period would thwart the government’s ability to respond to “ever-evolving threats.”
Judge Douglas Ginsburg, writing for the majority, said the TSA must allow for the 90-day notice-and-comment period because of the new “substantive obligations” on airline passengers.
“It is clear that by producing an image of the unclothed passenger, an AIT scanner intrudes upon his or her personal privacy in a way a magnetometer does not. Therefore, regardless whether this is a ‘new substantive burden,’ the change substantively affects the public to a degree sufficient to implicate the policy interests animating notice-and-comment rulemaking," Ginsburg wrote.
“Indeed, few if any regulatory procedures impose directly and significantly upon so many members of the public. Not surprisingly, therefore, much public concern and media coverage have been focused upon issues of privacy, safety, and efficacy, each of which no doubt would have been the subject of many comments had the TSA seen fit to solicit comments upon a proposal to use AIT for primary screening.”
The court declined to address whether the TSA could have skirted the notice-and-comment under a so-called “good cause exception.” That allows agencies to bypass public input when it is “impractical, unnecessary or contrary to the public interest.”
Despite TSA breach, the court would not stop scanner usage. Doing so, Ginsburg wrote, would “severely disrupt an essential security operation.”
Marc Rotenberg, the president of EPIC, the group that brought the challenge, said the decision means the “TSA is now subject to the same rules as other government agencies that help ensure transparency and accountability.”
He said “Many Americans object to the airport body scanner program. Now they will have an opportunity to express their views to the TSA and the agency must take their views into account as a matter of law.”
That said, the court acknowledged “the steps the TSA has already taken to protect passenger privacy, in particular distorting the image created using AIT and deleting it as soon as the passenger has cleared.” During oral arguments in the case in March, Department of Justice lawyer Beth Brinkmann said the government is moving toward adopting new technology that produces a broad outline of a passenger instead of a virtual nude image.
Regarding health concerns, “the agency has commissioned two studies of the safety of the scanners,” Ginsburg wrote. The judge added that the studies—which were not generally accepted in the scientific community—concluded that “the scanners emit levels of radiation well within acceptable limits.”
Ginsburg added that the scanners are optional. “More telling, any passenger may opt-out of AIT screening in favor of a patdown,” he wrote. Ginsburg’s ruling did not address accusations that passengers opting for a patdown are often groped or harassed by TSA security officials.
Source: https://www.infosecisland.com/blogview/15201-Defense-Research-Lab-Back-Online-After-Attacks.html
In early July two government research labs and a defense contractor were the targets of attacks against their information systems.
Nearly two weeks after an Advanced Persistent Threat (APT) attack caused officials to take systems offline at the Energy Department’s Pacific Northwest National Laboratory (PNNL), nearly all systems have been restored to normal operating parameters.
The unauthorized access events also occurred at the Battelle Corp – a government contractor that manages PNNL, and the Thomas Jefferson National Laboratory
“Access to the Internet from PNNL’s network computers was re-enabled late Thursday afternoon. Additionally, most of PNNL’s external websites are operational,”said lab spokesman Geoff Harvey.
Systems at Battelle and the Jefferson labs were restored previously. Officials indicate the labs only suffered a low level exfiltration, and that no sensitive materials were compromised in the attacks.
Attacks against critical defense entities is a growing area of concern the nation seeks to bolster detection and mitigation strategies.
Source: http://www.new-times.co.uk/sun/
The Sun/News of the world PWNED by AntiSec, “We have owned Sun/News of the World – that story is simply phase 1 – expect the lulz to flow in coming days.”
By STAFF REPORTER
Published: Today
Murdoch, aged 80, has said to have ingested a large quantity of palladium before stumbling into his famous topiary garden late last night, passing out in the early hours of the morning.
"We found the chemicals sitting beside a kitchen table, recently cooked," one officer states. "From what we can gather, Murdoch melted and consumed large quantities of it before exiting into his garden."
Source:http://www.informationweek.com/news/government/security/231002015