The Weeklies: 39

[Ehtyar]

Weekly News

Hi all. This is the new way news posts will be done, please leave any constructive feedback you like.

The malware challenge begins tomorrow.

Starting from October 1, 2008 and ending October 26, 2008 we will be running a malware analysis challenge at http://www.malwarechallenge.info. In the challenge participants will download a malware sample to analyze. The site will have a list of questions for participants to answer and send in. We will judge the answers and those scoring the highest will win prizes.

We have some great prizes donated by some very cool companies. To only name some, Hex-Rays is donating a copy of IDA Pro and No Starch Press is donating a copy of Chris Eagle's IDA Pro book. Addison-Wesley and KoreLogic Security are also donating prizes (yet to be announced).

Full Story

PCMag's top 10 most mysterious cyber-crimes.

The most nefarious and crafty criminals are the ones who operate completely under the radar. In the computing world security breaches happen all the time, and in the best cases the offenders get tracked down by the FBI or some other law enforcement agency.

But it's the ones who go uncaught and unidentified. Attempting to cover your tracks is Law-Breaking 101; being able to effectively do so, that's another story altogether.

Full Story

Nevada to require all email containing personally identifiable information to be encrypted from October 1.

On Oct. 1, the state of Nevada will be requiring the encryption of all transmissions, such as e-mail, for all businesses that send personal, identifiable information over the Internet. The statute was signed into law in 2005 and is about to kick in as an enforceable law next month. Three years flies when you're raking in chips at casinos and enjoying the rising popularity of poker.

The Nevada law is stated as such:

    NRS 597.970 Restrictions on transfer of personal information through electronic transmission. [Effective October 1, 2008.]

    1. A business in this State shall not transfer any personal information of a customer through an electronic transmission other than a facsimile to a person outside of the secure system of the business unless the business uses encryption to ensure the security of electronic transmission.

Full Story

The seven deadliest social networking hacks according to Dark Reading, as though we needed another reason to stay away from it.

It started with a stolen Facebook photo attached to an inflammatory profile. It led to online harassment, death threats, and emails to the victim’s boss questioning the victim’s character. But an online personal attack against Graham Cluley earlier this year is one example of how easy it is to use a social network to damage the identity of an individual -- or an entire company.

Cluley’s case shows just how rapidly social networks can spread a smear campaign or personal attack -- and how it can quickly spread to the victim’s professional life. Cluley, who is a senior technology consultant with Sophos, recently met another victim who experienced a similar attack on Facebook, Kerry Harvey. He says it was apparently an acquaintance of Harvey’s who built a phony Kerry Harvey Facebook profile that branded her occupation as a “prostitute,” complete with her cellphone number. (See ID Theft Victim Branded a 'Prostitute' .)

Full Story

New York offers "enhanced" drivers license containing RFID chip, permitting travel to Canada, Mexico, and the Caribbean without a passport.

You can now get an enhanced New York State driver license that will allow you to travel by land and sea to Canada, Mexico, and the Caribbean without a passport.

The only obvious differences on the new Enhanced Driver License (EDL) are the word "enhanced," an American flag, and a heart for organ donors.

Inside the new license is a radio frequency identification (or RFID) chip.

Full Story

The DHS is in the testing phase of a system to detect "hostile thoughts" at border security checkpoints. Yet another reason to avoid US travel it would seem.

Project Hostile Intent as it was called aimed to help security staff choose who to pull over for a gently probing interview - or more.

Commentators slated the idea that sensors could spot people up to no good from their pulse rate, breathing, skin temperature, or fleeting facial expressions. One likened it to the "pre-crime" units that predict criminal behaviour in the movie Minority Report.

Full Story

Yahoo's Zimbra email client is sending passwords in plaintext.

Passwords used to access Yahoo mail through the Zimbra client are sent over the Internet in clear text, a Canadian programmer says.

Holden Karau stumbled upon this problem while participating in the Yahoo University Hack Day at the University of Waterloo last week.

"The Yahoo imap server's used by the Yahoo Desktop don't support SSL and the password was being transmitted in plain text," Karau wrote in a blog post on Friday.

Full Story

A UCLA group has found the 46th Mersenne prime comprised of 13 million digits.

Mathematicians at UCLA have discovered a 13 million-digit prime number, a long-sought milestone that makes them eligible for a $100,000 prize.

The group found the 46th known Mersenne prime last month on a network of 75 computers running Windows XP. The number was verified by a different computer system running a different algorithm.

Full Story

Microsoft and Nokia will be including jQuery in the next version of their development environments.

Could Microsoft be learning the way things work on the web? That big software company in Redmond will include JavaScript framework jQuery in its development environment. At the same time, Nokia announced that it will use jQuery for its mobile-browser development. That’s two more big companies to join Google, Amazon and thousands of other sites using jQuery.

Microsoft has long struggled to keep up with advances in JavaScript. In July the company announced an Ajax roadmap, which looked like Microsoft was going to eventually re-create all the features already in popular frameworks. Instead, Microsoft is going to incorporate someone else’s code, and it’s open source code at that.

Full Story

Ehtyar.

[f0dder]

Bigger headlines for each item, please, otherwise it looks pretty nice imho.

[Ehtyar]

Ready for next time, thanks f0dder

Ehtyar.

[housetier]

Ehtyar I like this format much better! Thank you going through the trouble of compiling the news :-)

Could you also put a summary in the title? like "Weeklies 40: malware challange, mysterios cybercrimes, state-wide encryption.." something along those lines. I know it won't be easy to find such short summaries...

[tomos]

Thank you going through the trouble of compiling the news :-)

-housetier (September 30, 2008, 07:16 AM)

yes, thanks a lot Ethyar !!
I'm much more informed since you started as I dont read news elsewhere

[Deozaan]

Encrypting e-mail sounds like a good idea!

[Ehtyar]

Thanks so much for the positive response guys! I've already created a new template comprising of input from f0dder and mouse man.
House man, I totally agree with your suggestion, though the permitted length of the title is not enough to summarise the entire weeks articles. Mouse man suggested I try a table a contents, but since that would add a substantial amount of work to this undertaking, I'd like to get your impression of the new template before I take such a drastic step.
Deo, I've been using Enigmail with GnuPG for probably over a year now, and while I sign all emails by default, I've not once had the opportunity to encrypt an email to a recipient other than myself. It sounds good in practice, but very few people are quite as tinfoil-hat-happy as we

Ehtyar.

[Deozaan]

Deo, I've been using Enigmail with GnuPG for probably over a year now, and while I sign all emails by default, I've not once had the opportunity to encrypt an email to a recipient other than myself. It sounds good in practice, but very few people are quite as tinfoil-hat-happy as we

Ehtyar.

-Ehtyar (September 30, 2008, 04:43 PM)

I think nearly all data transmitted across the tubes should be encrypted. It just makes sense.

If it was a normal part of the process to set up your Outlook mail with encryption, everybody would be doing it. It just needs to be made more available, instead of requiring strange applications like Enigmail and GnuPG.

Maybe I should just set up my e-mail to be encrypted and say to everyone: "From now on if you want to communicate with me via e-mail, you'll have to set up encryption. Otherwise, have fun trying to understand what I'm saying."

My problem is that I love Gmail too much. I don't suppose Gmail supports this kind of e-mail encryption?

[Ehtyar]

FireGPG has specific support for GMail. I installed it a while back but never used it.
Microsoft will never support GnuPG in outlook. They likely support S/MIME but that's fairly old hat, and only used by corporations etc. If Microsoft were to support encryption in the way we'd like to use it, you can bet it would be a proprietary system, and it would cost you money (anyone remember code signing?).

Ehtyar.

[housetier]

I've not once had the opportunity to encrypt an email to a recipient other than myself.

-Ehtyar (September 30, 2008, 04:43 PM)

You have now.

[zridling]

Very nice, Ehtyar. And since your curiosities are interesting, several articles I would have passed over.

[Lashiec]

Curiosity question: Why the "40" in the thread title?

[Ehtyar]

Curiosity question: Why the "40" in the thread title?

-Lashiec (October 01, 2008, 12:02 PM)

It's the 40th week of the year.

Ehtyar.

[4wd]

I wonder if the "Hostile Thoughts" detector will be picking up:

1) "The b@st@rds⁵ just confiscated my laptop!  I'm gonna kill⁴ them!"
2) "A bl**dy 6 hour wait just to get through customs?!"
3) "There's that idiot that kept elbowing me on the plane!  Boy is he going to get it!"
4) "Oh damn!  I'm $50 over my Duty-Free allowance..."
........

Considering most people's reactions, mind-state won't yet be normalised after an international flight, I really fail to see how this is going to work with any accuracy at all.

Of course, Business Class and above now get beds, decent screen/headphones and somewhere to plug in their laptop.

Whereas Cattle Class have to make do with no sound, (even if you could hear it above the background noise), screens with dead pixels/off colour/etc, the moron in front reclining his seat halfway through your meal, worry about DVT, no power for your laptop (even if there was room to use it), etc, etc.

So in that case, it will probably be running with really good accuracy.......god¹ knows I've wanted to kill⁴ the b@st@rd⁵ sitting in front of me often enough...and the little sh!t sitting behind me who keeps kicking the seat

1 - Disclaimer: In no way is this meant to imply anything religious on my part.  And I'm sure that if he wasn't fictitious² he would not condone the use of force to reinforce your point of view.
2 - Disclaimer: In no way is this meant to imply that god is fictitious...unless you're an atheist³.
3 - Disclaimer: If you are an atheist, then I in no way imply anything religious in this post at all
4 - Disclaimer: I mean this in the most generic sense.
5 - Disclaimer: The word 'bastard' is an accepted Australian colloquialism as ruled by an Australian Court of Law....live with it.
6 - Disclaimer: Everything I've said here needs to be taken with half a teaspoon of salt, two cups of self-raising flour, 1^1/4 cup of milk, 2 teaspoons of sugar, 2 teaspoons of butter.  Mixed then baked.
7 - Disclaimer: If you're really going to take everything I say or do seriously then I honestly don't think you should read my posts.

[housetier]

4wd: what are you talking about? It makes no sense to me. No sense at all.

[4wd]

4wd: what are you talking about? It makes no sense to me. No sense at all.

-housetier (October 02, 2008, 04:44 AM)

You didn't read the initial post by Ehtyar?

Item number 6 is about the future ability by the U.S. DHS to detect "Hostile Thoughts" at border control.

I just pointed out that given the rather unsatisfactorily soothing environment provided by airlines in Cattle Class, (Economy if you must), it's most likely that most people arriving by said means are likely to have "hostile thoughts".

The disclaimers were just to remain politically correct ²

But it did get you thinking, even if it was only to say to yourself, "That character is a loon¹."

1 - Disclaimer: I'm not implying that loons are....well....loony.  Honestly, some of my best friends are birds.
2 - Disclaimer Notice: Being an Australian I have a rather dry, (and some would say strange), sense of humour - this can probably be blamed on the weather since I happen to live on the driest continent on the planet.

[housetier]

Yes with context it makes more sense indeed. thanks for clearing that up!

[Ehtyar]

The new format will include numbering, and I will ask replies to reference the post they're responding to by number.

Ehtyar.

[4wd]

The new format will include numbering, and I will ask replies to reference the post they're responding to by number.

-Ehtyar (October 02, 2008, 07:08 AM)

The very first line of my post was:

I wonder if the "Hostile Thoughts" detector will be picking up:

As easy as typing /host in Firefox to search the thread to see what I was referring to.

Honestly, I don't see how adding a number is going to help unless people have actually read the thread in the first place, (not having a go at you houseteir, just a general observation).

Much better would be anchors in the initial post that followups could point a URL at.  Probably beyond the ability of the board software.

So I guess, by default, numbers are the poor man's¹ method.

1 - Disclaimer: Not implying the Ehtyar is any way, shape or form poor - just that given a choice, he chose the poor one..........errrrr........that didn't come out right.........oh crap, I'm in the same country.........quick! HIDE!
Disclaimer: Brain numb........04:12 in the morning.........can't think of anything..........ignore me......................please.

[tomos]

So I guess, by default, numbers are the poor man's¹ method.

1 - Disclaimer: Not implying the Ehtyar is any way, shape or form poor - just that given a choice, he chose the poor one..........errrrr........that didn't come out right.........oh crap, I'm in the same country.........quick! HIDE!
Disclaimer: Brain numb........04:12 in the morning.........can't think of anything..........ignore me......................please.

-4wd (October 02, 2008, 01:13 PM)

hey, 4wd, you're pretty good at the numbers thing yourself

[Ehtyar]

Much better would be anchors in the initial post that followups could point a URL at.  Probably beyond the ability of the board software.

-4wd (October 02, 2008, 01:13 PM)

Yes, and yes.

1 - Disclaimer: Not implying the Ehtyar is any way, shape or form poor - just that given a choice, he chose the poor one..........errrrr........that didn't come out right.........oh crap, I'm in the same country.........quick! HIDE!
Disclaimer: Brain numb........04:12 in the morning.........can't think of anything..........ignore me......................please.

-4wd (October 02, 2008, 01:13 PM)

LOL, it's all good, come to the IRLDD and you're forgiven

hey, 4wd, you're pretty good at the numbers thing yourself

-tomos (October 02, 2008, 02:47 PM)

LOL!

Ehtyar.