Archive for the ·

Security

· Category...

Generate MD5 Checksums on Windows

no comments

How do you know, for sure, that the file you’ve download has been transferred correctly ? The UNIX (and by extension, internet) standard has, for years, been checking the md5 hash. Now, there’s plenty of info on the web about creating or checking MD5 or SHA-1 checksums for UNIX or Linux users, but not very much about doing the same on Windows.

If you want to create or verify MD5 or SHA-1 checksums on windows, have a look at Microsoft’s FCIV tool.

The File Checksum Integrity Verifier (FCIV) is a command-prompt utility that computes and verifies cryptographic hash values of files. FCIV can compute MD5 or SHA-1 cryptographic hash values. These values can be displayed on the screen or saved in an XML file database for later use and verification.

The FCIV utility has the following features:
* Supports MD5 or SHA1 hash algorithms (The default is MD5.)
* Can output hash values to the console or store the hash value and file name in an XML file
* Can recursively generate hash values for all files in a directory and in all subdirectories (for example, fciv.exe c:\ -r)
* Supplies an exception list to specify files or directories to hash
* Can store hash values for a file with or without the full path of the file

A BlackHat / DefCon Secure Communication Tip

no comments

From A Day in the Life of an Information Security Investigator, currently attending the Black Hat Technical Security Conference:

Here’s some early feedback for the folks connecting to wireless networks around BlackHat (and soon to be at DefCon).

Y’all aren’t taking this whole secure-communications thing too seriously.

Clear-text POP3/IMAP e-mail credentials are getting plucked out of the air by *cough* individuals *cough*. Some of these are coming from phones that folks are configuring to use the wireless LANs. Not a good idea.

It makes you wonder how many people go to these kinds of conference just to “be seen”…. It sounds like some of these individuals don’t know enough about security to even understand the subject matter you’d find at either BlackHat or DefCon !!

Looking for a Life Partner Who Looks Like Your Favorite Actor or Actress

1 comment

In a move that could stir up some controversy, Bharat Matrimony, one of most popular matrimonial website in India, has launched a facial recognition feature to help you search for a potential life partner who looks similar to your favorite film actor or actress.

You can either limit your partner search to a selected set of Bollywood actors and actresses or you may even upload someone else’s photo and the “facial search” feature promises to help find other profiles in the matrimony database that match the face in the picture.

This could become a privacy nightmare… If it works as advertised, it would let people locate any random person (that was a member of the Website) that they have a picture of, and get personal details about them.

ACMA blacklist leaked online

4 comments

Too many people knew of the existence of the blacklist. Too many people had motives to see it leaked. Of course, the government (via Senator Conroy)has denied its the ACMA blacklist, but they would say that wouldn’t they…

Blacklists are a flawed method of censorship; they are inaccurate and subjective. The subject matter (child pornorgrapohy) is transferred via other medium on the internet. The time and money being spent on this filter can be more usefully spent attacking those who are breaking the law with tools that work

And here’s a link for those of you who think you have nothing to hide.

The ACMA blacklist article on Wikileaks. Link to theie copy of the blacklist from there.


Mirrors

Can I mention his name :) There’s some text and PDF mirrors of the ACMA blacklist up already, including a MEGAUPLOAD text file of the ACMA blacklist.

By the way, there are serious issues at stake here.

There is a also PDF version of the ACMA blacklist at whatsup.



Update:

Update of Australian government secret ACMA internet censorship blacklist, 11 Mar 2009.

Update of Australian government secret ACMA internet censorship blacklist, 18 Mar 2009.

Wikileaks to Conroy: Go after our source and we will go after you

Easy to generate different password for each site

no comments

from The Next Web, a usefull methodology that will generate a different password for every site you visit.

Step 1) Pick one alphanumeric password you know you will always remember. Something like: “tuca3212″

Step 2) From now on just remember that above alphanumeric password and add the first 4 letters of every sites name before (or after) that above password.

Obviously, you can change the number of letters / characters you use in step 2, and don’t forget to allow for special characters (perhaps in Step 1 ??)

Madoff Fraud

1 comment

The Wall St Journal has plenty of stories on what’s shaping up to be the largest fraud case of all time:

Bernard L. Madoff, a former chairman of the Nasdaq Stock Market and a force in Wall Street trading for nearly 50 years, was arrested by federal agents Thursday, a day after his sons turned him in for running what they said their father called “a giant Ponzi scheme.”

The Securities and Exchange Commission, in a civil complaint, said it was an ongoing $50 billion swindle, and asked a judge to seize the firm and its assets. “Our complaint alleges a stunning fraud that appears to be of epic proportions,” said Andrew M. Calamari, associate director of enforcement in the SEC’s New York office.

This was a very simple fraud, as Madoff’s hedge fund was a straight-forward ponzi scheme: if you gave him a million dollars to invest he’d simply give the money away to existing clients telling them it was profit. As with all ponzi schemes the last people in are the losers. What kept this one going for so long was that most of Madoff’s investors recapitalised their profits and handed them back to him to invest (at 10% ROI why wouldn’t you?)

Two of his investors said that among his clients, Mr. Madoff was considered a money-management legend; they would joke that if Mr. Madoff was a fraud, he’d take down half the world with him.

A former securities analyst is quoted as having had about $11 million invested with Mr. Madoff. It’s one thing when high nett-worth individuals wake up to find they have lost everything: There’s the temptation to suggest they should have taken more car, or were greedy in th first place. However, whats really frightening about this fraud is that reputable hedge funds and banks also had large investments with Madoff. These organisations will have charged their customers large fees to carry out risk analysis and due diligence on their portfolios and then just handed all the cash to a con-man to invest on their behalf. Sounds like the making of a class-action suit…..

As Dim Post suggests, I’m starting to see why some people keep all their money in a mattress.

Circumventing Internet Censorship #1

no comments

AlwaysVPN, a free virtual private networking service, is promoted as a way for anyone to browse the web or trading files over a public net connection. And, by the way, it also lets anyone on the outside of a U.S.-only service like Hulu or Pandora get around that often arbitrary restriction.
Hotspot Shield is a similar service, but AlwaysVPN has the edge in not installing any toolbars (although it does put ads across the top of your browser), working on all three major platforms, and, according to lifehacker, having better performance.

AlwaysVPN is a free download, and installation and startup of AlwaysVPN is a simple right-click affair in Windows, but OS X users will have to configure a third-party VPN client, and Linux users will have to compile from source.

Related Links:
Response to “Christian Lobby Welcomes ISP Filtering Moves”

Response to “Christian Lobby Welcomes ISP Filtering Moves”

1 comment

The Australian Christian Lobby have issued a press release welcoming the Australian ISP Filtering Moves PDF. Here’s my response

Hi Jim,
I doubt you remember me, but we’ve met twice at Shellharbour COC and you also spoke at a course I was attending , ran by Warwick Marsh of the Fatherhood Foundation. I’d just like to make some comments about the recent press release titled “Christian Lobby Welcomes ISP Filtering Moves”.

While it is important that safeguards are put in place to protect children and the community from illegal, abusive and degrading material available over the Internet, we need to be sure that what is put in place DOES work and is not just a panacea aimed at solving the political problem (we christians DO have a lot of clout in Canberra) rather than the real issue of unsupervised uncontrolled access to the internet by minors.

Iin 1999, the Coalition Government (with Senator Richard Alston as Minister for Communications and the Arts) passed amendments to the Broadcasting Services Act (see http://www.austlii.edu.au/au/legis/cth/num_act/bsasa1999449/). This was accompanied by a Ministerial directive to the ACMA (then ABA) to establish NetAlert (see http://www.netalert.gov.au/ ), and for NetAlert to carry out periodic assessments of the “state of the art” of filtering technology.

Since that time, NetAlert and the Department have commissioned separate studies by the CSIRO, Ovum, and most recently RMIT (study available at http://www.netalert.gov.au/advice/publications/reports/a_study_on_server_based_internet_filters/executive_summary/%20%20background.html ) and Enex Testlab (study available at http://www.acma.gov.au/webwr/_assets/main/lib310554/isp-level_internet_content_filtering_trial-report.pdf ).

All of the studies have uniformly demonstrated that online censorship technology:
* slows down Internet access;
* inaccurately blocks content which should not be blocked;
* inaccurately fails to block content which should be blocked;
* is ineffective at inspecting or blocking “Peer to Peer” traffic that comprises over 60% of Australia’s Internet traffic (see http://www.ipoque.com/resources/internet-studies/internet-study-2007); and
* fails to accurately distinguish between legal and illegal content even when specifically configured with lists of illegal content under laboratory conditions.

The most recent trials, conducted in Tasmania by Enex Testlab earlier this year, found that the most accurate product tested incorrectly blocked 3% of innocent material (See http://www.itnews.com.au/News/81637,sageau-slams-cost-of-content-filtering.aspx) and incurred a “slowdown” performance penalty in excess of 70%, and failed to reliably block the ACMA’s prohibited content list.

It beggars disbelief that the Minister for Broadband would be interested in pursuing these systems whilst at the very same time advocating for a $20B National Broadband Network (NBN) intended to increase Internet speeds.

And to what avail ? Any Australian can obtain encrypted Virtual Private Network (VPN) access from the United States for less than $5 per month (https://vpnout.com/ and http://www.secureix.com/personal.shtml are just two providers of this service). The irony is that this is the IDENTICAL technology used by Christians who are persecuted for their Faith to hide their activities from hostile Governments. In short, an effective, guaranteed bypass of any effort by any National Government to filter Internet content.

Note that there is no requirement for complicated software to use these services, VPN clients are installed by default on all common Operating System platforms. Australians who wish to hide themselves from Government Internet censorship efforts are only a few clicks away from that anonymity.

As a Christian, I have a more serious objections to this “clean feed” option (which, BTW, will erect an online Government censorship regime in Australia for the first time). As alluded to above, I am conscious of the fact that Christians elsewhere are persecuted for their Faith. While we currently have Christian or moderate people at the head of our major parties, this may not remain the case. This “clean feed” will be Australia’s answer to the Chinese Government’s Golden Shield Project ( http://en.wikipedia.org/wiki/Golden_Shield_Project also known as the Internet Wall of China).

For the “clean feed” to have any chance of success, it would need to be illegal under Australian law to disseminate copies of the blacklist of sites or whatever techniques were used to block internet traffic (just as it is in China). Once this is in place, would we know whether, say, http://godtube.com was blocked or just ‘unavailable’ ? Well, actually, we could know, by using the methods described above, but we would be breaking the law to do so.

As a Christian Parent, I am in favor of anything that prevents the spread of Child Pornography. However, Senator Conroy’s propoosal will not succeed at stopping those who traffic in this filth, while costing an enormous amount of time and money.

Thanks for reading this far.

Is the post 9/11 World Turning against Photography ?

no comments

Photographer Thomas Hawk was thrown out of the San Francisco Museum of Modern Art last week for the crime of taking photos. Normally, this is SOP, due to copyright and privacy issues. The problem this time is that the Museum has posted publicly that it now allowed photography (search for cameras), Hawk had confirmed the rule directly with the museum, and Hawk had subsequently joined as a paid member of the museum due to the open photography policy.

Hawk’s full post here, but the short story is that Hawk was accosted by Simon Blint, Director of Visitor Relations at the Museum and escorted off the premises by a couple of paid goons, despite others in the museum taking pictures. Hawk’s crime may have been the use of a serious camera (a DSLR), but he had gone out of his way to confirm he was ok to take pictures, and had become a paid up member of the Museum. If the policy did indeed prevent DSLR’s (that there would be a split is odd) then this should have been related clearly along the way, when it wasn’t. This leaves leaves no excuse for what happened to him.

However, as Hawk points out, it is not just about museum photography…

Over the course of the past year I’ve heard hundreds of stories where photographers were unjustly targeted for taking pictures. While the “photography steals your soul,” superstition seems to be long gone, a whole litany of replacements have taken it’s place. I’ve seen people branded as pedophiles for shooting at public parks or their neighborhood swimming pool. I’ve seen people claiming 9/11 makes checking photography necessary. I’ve seen train stations and malls and shopping centers and museums and parks and public buildings and architecture increasingly turn against the photographer. And when this happens and when people see something that has happened to them at one point or another happening to someone else it resonates.

10 Reasons Enterprises Aren’t Ready to Trust the Cloud

no comments

from gigaom…. To summarise,

  1. It’s not secure. Certain companies and industries have to maintain strict watch on their data at all times, either because they’re legally obligated to or because they’re super paranoid.
  2. It can’t be logged, required for compliance purposes.
  3. It’s not platform agnostic. If you need to support multiple platforms, as most enterprises do, then you’re looking at multiple clouds. That can be a nightmare to manage.
  4. Reliability is still an issue. Even inside an enterprise, data centers or servers go down, but generally the communication around such outages is better and in many cases, fail-over options exist.
  5. Portability isn’t seamless. The so-called “cloud” is in fact made of up several clouds, so getting your data from one to another isn’t as easy as IT managers would like. The platform issues (above) can leave data in a format that few or no other cloud accepts, and there are bandwidth costs associated with moving data from one cloud to another.
  6. It’s not environmentally sustainable. As a recent article in The Economist pointed out, the emergence of cloud computing isn’t as ethereal as it might seem. Moving data center operations to the cloud and off corporate balance sheets is kind of like chucking your garbage into a landfill rather than your yard; The problem is still there but you no longer have to look at it.
  7. Cloud computing still has to exist on physical servers. The data still resides on servers somewhere, and the physical location of those servers is important under many nation’s laws. For example, Canada is concerned about its public sector projects being hosted on U.S.-based servers because under the U.S. Patriot Act, it could be accessed by the U.S. government.
  8. The need for speed still reigns at some firms, but data in the cloud means problems with latency inherent in transmitting data across the country or globe.
  9. Large companies already have an internal cloud. Many big firms have internal IT shops that act as a cloud to the multiple divisions under the corporate umbrella. Not only do these internal shops have the benefit of being within company firewalls, but they generally work hard — from a cost perspective — to stay competitive with outside cloud resources, making the case for sending computing to the cloud weak.
  10. Bureaucracy will cause the transition to take longer than building replacement housing in New Orleans. Big companies are conservative, and transitions in computing can take years to implement. A good example is the challenge HP faced when trying to consolidate its data center operations.