Perilocity

3FN + FTC = Some Less Spam From Some ASNs

A research project I'm assisting at the University of Texas at Austin notes that:

On Tuesday 2 June 2009, the U.S. Federal Trade Commission (FTC) took legal steps that shut down the web hosting provider Triple Fiber network (3FN.net).

Looking at Autonomous Systems (ASNs) listed in the spam blocklist CBL,

VZ Port 587: Good Try

Back in February, Verizon announced it would start requiring outbound mail go through port 587 instead of port 25 during the next few months. It seemed like a good idea to squelch spam. Most other major ISPs did it. People applauded Verizon for doing it.

Unfortunately, it seems that if it had any effect it was short-lived. Looking at anti-spam blocklists on a daily basis, a couple of Verizon Autonomous Systems (ASes), AS-19262 and AS-701, do show dips in blocklist listings on the blocklist PSBL in March. But they don't last.

Spammers are very adaptable, partly because the botnets they use are adaptable. Good try, Verizon.

This information is from an NSF-funded academic research project at the University of Texas at Austin business school. Thanks to PSBL for the blocklist data.

-jsq

Windows Considered Not Ready for the Desktop

R. McDougall takes the high ground for open software:

0. Premise: free and open software will stay indefinitely. Full stop. You may argue eternally, but free software is the ultimate disruptive technology, moving up from the low ground, replacing complicated and ill-fitting proprietary alternatives at every turn, such as web-browsers, e-mail clients, video players, office software, etc., which at one point cost money, but now most people find that they can no longer justify spending money to buy an upgrade for more "Clippy the Happy Assistant". Proprietary software will only be able to stay relevant by searching out ever more niche applications, or by massive expenditure on research in high-end applications for which it will take time for the ideas and algorithms to filter down to the greater community, and thus a brief window of profitability will remain. Software patents are nothing but a destructive force to retard innovation, and with more and more of the technology and legal communities realizing this basic fact, software patents are about to go away forever.

I think he's being a bit optimistic about software patents, but no more so than Windows advocates claiming that open software is a flash in the pan. Then he gets into the undeniable stuff, chief of which is:

1.1 History's greatest playground for malicious software. With unpatched machines on the internet taking only minutes to become infested with viruses, or become a slave bot for massive illegal spamming operations, Windows is a blight on the Internet's infrastructure.

And it keeps getting better. He says he wrote it just as a game, but it pretty much spells out why I don't use Windows, plus why Windows is a menace to the Internet.

Doing It Wrong: Antivirus Software on Voting Machines

Xkcd has a point. And I like the teacher analogy.

Continuing to fiddle with models of how electronic voting might work while leaving in place demonstrably broken hardware and software produced by companies that over years have demonstrated they either don't understand the problem or have no intention of fixing it: that's fiddling while Rome burns.

-jsq

NSL: Internet Archive Exposes Lack of Security in National Security Letters

The Internet Archive has for a decade been a cornerstone of the Internet, and the FBI was foolish to try to break it:

The FBI has withdrawn an illegal National Security Letter seeking information from an online library and has lifted a gag order that until Wednesday prevented any discussion of the information request.

Lawyers from the American Civil Liberties Union and Electronic Frontier Foundation helped the Internet Archive push back against what they say was an overly broad and unlawful request for information on one of its users. The FBI issued its National Security Letter in November, but ACLU, EFF and Archive officials were precluded from discussing it with anyone because of a gag order they say was unconstitutional.

After nearly five months of haggling, the FBI eventually withdrew its NSL, which requested personal information about at least one user of the Internet Archive. Founded in 1996, the archive is recognized as a library by the state of California, and its collections include billions of Web records, documents, music and movies.

— Watchdogs prompt FBI to withdraw 'unconstitutional' National Security Letter, Nick Juliano, therawstory, Published: Wednesday May 7, 2008

The article goes on to say that the FBI has issued 200,000 National Security Letters, that almost none of those NSL have been challenged, yet every single time someone has challenged an NSL in court, the FBI has withdrawn it.

How do these NSL represent "Security"?

In any case, National Security Letters were authorized by the mis-named Patriot Act. Brewster Kahle has shown us how a real patriot acts:

CCTV Security Fad Fails

London probably has more security cameras per square inch than any other city, and:

The billions of pounds spent covering Britain with CCTV cameras has been an "utter fiasco" and failed to slash crime, Scotland Yard's surveillance chief has said.

Detective Chief Inspector Mick Neville said a Metropolitan Police pilot project found just three per cent of street robberies in London were solved using CCTV images.

He claimed the vast swathes of money spent on cameras had been wasted because criminals don't fear the cameras.

— Billions spent on CCTV have failed to cut crime and led to an 'utter fiasco', says Scotland Yard surveillance chief, Just 3% of street robberies in London solved, By DANIEL BATES, Daily Mail, Last updated at 13:48pm on 6th May 2008

Needless to say, there are numerous efforts planned to make the cameras pay anyway.

The basic problem is:

But Mr Neville also castigated the police and claimed officers can't be bothered to seek out CCTV images because it's "hard work".

CCTV is not the only security fad that hasn't panned out:

For every 800 DNA samples being added by the police - including those taken from innocent people - only one crime is being solved.

We'll see if either of these white elephant programs get terminated. I'm not holding my breath.

-jsq

Paypal Says Old IE is Like Car Without Seat Belt: EV SSL blocking

The eBay-owned company, which runs a Web-based payment system that allows the transfer of funds between bank accounts and credit cards, said browsers that do not have support for blocking identity theft-related Web sites or for EV SSL (Extended Validation Secure Sockets Layer) certificates are considered "unsafe" for financial transactions.

"In our view, letting users view the PayPal site on one of these browsers is equal to a car manufacturer allowing drivers to buy one of their vehicles without seat belts," said PayPal Chief Information Security Officer Michael Barrett.

...

Barrett only mentioned old, out-of-support versions of Microsoft's Internet Explorer among this group of "unsafe browsers," but it's clear his warning extends to Apple's Safari browser, which offers no anti-phishing protection and does not support the use of EV SSL certificates.

— BPayPal Plans to Ban Unsafe Browsers, By Ryan Naraine, EWeek.com, 2008-04-17

Now on the one hand, I think EV SSL is color-coded checklist security candy:

European Parliament Votes for Internet Freedom and Security

Sometimes a legislative body gets the picture and shows some spine:

Despite last minute attempts by the French government to divide them, European MEPs today voted decisively against "three strikes", the IFPI-promoted plan to create a class of digital outcasts, forbidden from accessing the Net if repeatedly accused by music companies of downloading infringing content.

In a vote held today, hundreds of MEPs supported language which declared termination of Internet access to be in conflict with "civil liberties and human rights and with the principles of proportionality, effectiveness and dissuasiveness", all core values of the European Union.

... And Guy Bono, the author of the report, had this to say in the plenary:

"On this subject, I am firmly opposed to the position of some Member States, whose repressive measures are dictated by industries that have been unable to change their business model to face necessities imposed by the information society. The cut of Internet access is a disproportionate measure regarding the objectives. It is a sanction with powerful effects, which could have profound repercussions in a society where access to the Internet is an imperative right for social inclusion."

— European Parliament to Sarkozy: No "Three Strikes" Here, Posted by Danny O'Brien, EFF, April 10th, 2008

The European Parliament voted for social inclusion, participation, and human rights over profits for a tiny group of companies. That wasn't hard. Even if the vote had gone the other way, it wouldn't have produced any real security for the tiny group, and the way it did go, it produces far more security for everyone else. Maybe the U.S. can get the message.

-jsq

Censorship as Security: GoDaddy Delists Cop Rating Web Site

This is security?

A new web service that lets users rate and comment on the uniformed police officers in their community is scrambling to restore service Tuesday, after hosting company GoDaddy unceremonious pulled-the-plug on the site in the wake of outrage from criticism-leery cops.

— GoDaddy Silences Police-Watchdog Site RateMyCop.com, By Kevin Poulsen, ThreatLevel, March 11, 2008 | 8:42:42 PM

Heaven forbid we should have public oversight of public servants.

This is customer service?

New School: New Book by Adam Shostack

Adam Shostack, whose group blog Emergent Chaos I quote frequently in this blog, has a new book coming out with co-author Andrew Stewart: New School of Information Security.

We think there's an emerging way of approaching the world, which we call the New School.

We start with a look at some persistent issues like spam and identity theft. From there, we look at why the information security industry hasn't just fixed them, and some of the data sources which we rely on and how poor they are. We then look at some new source of data, and new ways of interpreting them, and close with some very practical steps that any individual or organization can take to make things better.

— The New School of Information Security, Adam Shostack, Emergent Chaos, 10 March 2008

I haven't read the book yet, since it's not published yet, but if it's like the material he posts in his blog, it's a good thing.

One of his commenters doesn't get it: