watching you watching us . .

Archive for September, 2011

Securing Freedom, What Tactics Should and Currently are Being Used to Combat Criminal Exploitation of the Internet, and is it Legal or Proportionate ?

A few recent broadcasts not too be missed..

Stephen Grey investigates the use of computer hacking by the police and security agencies to combat criminal exploitation of the internet and asks if it is legal.

“.. RIPA .. range of surveillance powers.. unspecified hardware/software, keyloggers..

software installed on suspect computers could be considered breaking section 3 of Computer Misuse Act, by altering data..

lack of clarity from authorities, Article 8 Human Rights Act, scope of states power must be disclosed and made clear what authorities will or won’t use ..

William Hague, who speaks for the government on computer security issues, said: “Any export of goods that could be used for internal repression is something we would want to stop” .. He also admitted the law governing software exports was a grey area ..”

UK firm denies ‘cyber-spy’ deal with Egypt
Stephen Grey, File on 4, BBC Radio 4, 20 September 2011
http://www.bbc.co.uk/news/technology-14981672 – (Full Broadcast) – last access 23 September 2011

~

Excellently delivered by Eliza, offering public insight into reasons behind securing freedom and perceived hypocrisy.

Her second Reith lecture of 2011, the former director-general of the British Security Service (MI5), Eliza Manningham-Buller, discusses policy priorities since 9/11. She reflects on the Arab Spring, and argues that the West’s support of authoritarian regimes did, to some extent, fuel the growth of al-Qaeda.

The Reith Lectures – Securing Freedom: 2011 : Freedom
Eliza Manningham-Buller, BBC Radio 4, 20 September 2011
http://www.bbc.co.uk/iplayer/episode/p00k4053/The_Reith_Lectures_Eliza_ManninghamBuller_Lecture_3_Freedom/ – (Full Broadcast) – last access 23 September 2011

Her first and the previous Reith Lecture:

The Reith Lectures – Securing Freedom: 2011 : Security
Eliza Manningham-Buller, BBC Radio 4, 13 September 2011
http://www.bbc.co.uk/iplayer/episode/b014fcyw/The_Reith_Lectures_Securing_Freedom_2011_Eliza_ManninghamBuller_Security/ – (Full Broadcast) – last access 23 September 2011

/cobramark3

Advertisements

New CESG initiative builds on IISP Skills Framework in drive for greater professionalism in Information Assurance

“.. As part of the UK Government’s investment in cyber security, a consortium comprising the IISP (Institute of Information Security Professionals), CREST (Council for Registered Ethical Security Testers) and Royal Holloway’s Information Security Group (ISG) has been appointed by CESG to provide certification for UK Government Information Assurance (IA) professionals. The consortium has been awarded a licence to issue the CESG Certified Professional Mark based on the IISP Skills Framework, as part of a certification scheme driven by CESG, the IA arm of GCHQ ..

step forward in professionalising key Information Assurance roles needed by the public sector. It is also an important development along the path of securing the UK against cyber attack and protecting government and individuals’ data. CESG looks forward to continuing close co-operation with the IISP, CREST and Royal Holloway in delivering this IA Certification Service ..”

New CESG initiative builds on IISP Skills Framework in drive for greater professionalism in Information Assurance
PR-Inside, 22 September 2011
http://www.pr-inside.com/new-cesg-initiative-builds-on-iisp-r2823053.htm – last access 23 September 2011 – (Full article)

New CESG initiative builds on IISP Skills Framework
Forensic Focus, 22 September 2011
http://www.forensicfocus.com/index.php?name=News&file=article&sid=1730 – last access 23 September 2011 – (Full article)

/cobramark3


Some Current Law addressing the Distribution and Creation of Malware and Viruses

“.. In the UK, the introduction of malware is covered by section 3 of the Computer Misuse Act [2]. The Act states that a crime is committed if a person “does any act which causes an unauthorized modification of the contents of any computer” and the perpetrator intends to “cause a modification of the contents of any computer” which may “impair the operation of any computer”, “prevent or hinder access to any program or data held in any computer” or “impair the operation of any such program or the reliability of any such data” ..

Malware is generally distributed unintentionally subsequent to its initial creation. Thus an ICP or an ISP would not be found criminally liable under either the Computer Fraud and Abuse Act or the Computer Misuse Act for most cases of dissemination ..”

What the Law Says about Distributing a Virus or Malware
Craig S Wright, InfoSec Island, 20 September 2011
https://www.infosecisland.com/blogview/16567-What-the-Law-Says-about-Distributing-a-Virus-or-Malware.html – last access 22 September 2011 – (Full article)

~

“.. The Japanese parliament has quietly passed legislation to make the creation or distribution of a virus or similar malware a criminal offense ..

the distribution of a virus created, for example, in the US, in Japan by a Japanese citizen, would come within the scope of the criminal law ..

what happens if the malware distribution takes place without the knowledge of the user of the computer, such as when a botnet is involved..

Legislators in Japan are less concerned about the semantics, however, as they say this is the country’s response to support the International Convention on Cybercrime, a treaty ratified by more than 30 countries and which mandates international co-operation in investigating crimes in cyberspace ..”

Creating or distributing malware in Japan is now a crime
InfoSecurity Magazine, 20 June 2011
http://www.infosecurity-magazine.com/view/18782/creating-or-distributing-malware-in-japan-is-now-a-crime/ – last access 22 September 2011 – (Full article)

/cobramark3


Phishing Web-Based Email Services with HTML 5

Just came across a research paper from May 2011, thanks to Joe Sylve for the work.

“.. overview of a new technique that could be used for phishing web-based email services such as Google’s Gmail and Yahoo’s Mail ..”

Phishing Web-Based Email Services with HTML 5
Joe Sylve
Department of Computer Science, University of New Orleans, 11 May 2011
http://dl.dropbox.com/u/17627038/papers/html5phishing.pdf – last access 22 September 2011 – (Full article)

/cobramark3


Hacked Dutch security firm, DigiNotar has filed for voluntary bankruptcy and the SSL certificate debacle

Hacked Dutch security firm, DigiNotar has filed for voluntary bankruptcy..

“Hacked security firm closes its doors”
BBC News UK, 20 September 2011
http://www.bbc.co.uk/news/technology-14989334 – last access 21 September 2011 – ( Full Article )

Related:
“SSL certificate debacle includes CIA, MI6, Mossad and Tor”
Chester Wisniewski, NakedSecurity, 5 September 2011
http://nakedsecurity.sophos.com/2011/09/05/ssl-certificate-debacle-includes-cia-mi6-mossad-and-tor/ – last access 21 September 2011 – ( Full Article )

/cobramark3


Skype for iPhone and iPod Touch: iOS Vulnerability allows comprimising the device address on reciveing a text message, just add JavaScript

Exploit in Skype on an iPhone or iPod touch, allows comprimise of your device’s address book simply by the attacker sending you a chat message. When the exploit code in the message is run, the victim’s iPhone will automatically make a new connection to a server, grabbing a larger payload, to execute and upload the iPhones entire address book file to the server.

“.. Type some JavaScript commands into the user name of a Skype account, use it to send a chat message to someone using the latest version of Skype on an iPhone or iPod touch, and load a small program onto a webserver. Within minutes, you’ll have a fully-searchable copy of the victim’s address book.

.. failure by Skype to sanitize potentially dangerous JavaScript commands from the text that gets sent in chat messages ..

It’s already been 48 hours since this vulnerability was first documented, and the vulnerable app is still available in the iTunes Store. It will be interesting to see how long it takes Apple and Skype to close the gaping hole ..”

“Skype for iPhone makes stealing address books a snap”
Dan Goodin, Malware, The Register UK, 20 September 2011
http://www.theregister.co.uk/2011/09/20/skype_for_iphone_contact_theft/ – last access 21 September 2011 – ( Full Article )

/cobramark3


Review of Disclosure in Criminal Proceedings (Judiciary of England and Wales)

” This is a review (“the review”) conducted at the request of and for the Lord Chief Justice, prompted by concerns as to the operation of the disclosure regime contained in the Criminal Procedure and Investigations Act 1996, as amended (“the CPIA”). ”

Review of Disclosure in Criminal Proceedings (Judiciary of England and Wales)
The Rt Hon. Lord Justice Gross
September 2011

Full Report: http://www.judiciary.gov.uk/Resources/JCO/Documents/Reports/disclosure-review-september-2011.pdf

/cobramark3


The UK Forensic Science Society: Launch of the Digital Forensic Component Standards

The Society has announced the extension of its accreditation scheme to include two new Component Standards to address digital forensics:

  • Computer Network Evidence Recovery and Analysis
  • Digital Evidence Analysis Recovery and Preservation

These two new Standards plus the Core Standard of Interpretation, Evaluation and Presentation of Evidence (IEPE) make up the new Digital Component Standards.

http://www.forensic-science-society.org.uk/Accreditation/Launchofdigitalstandards

Launch event in the afternoon on 19th October 2011:
http://www.forensicsciencesociety.co.uk/Events/2011/Digital%20Launch

/cobramark3