Matt Blaze solves Randi's "million dollar challenge" for remote viewing

Well, he remote viewed the answer, but only used his superhuman crypto skills; nothing paranormal. Bit commitment schemes are pretty useful in cryptography.  But, you have to do them correctly.

...one of James Randi's "million dollar
paranormal challenges" is protected by a surprisingly weak (dictionary-
based) commitment scheme that is easily reversed and that suffers from
collisions. For details, see my blog entry about it:  Matt Blaze: James Randi owes me a million dollars

Matt made a great observation in his message about this that goes along with my recent post about Crypto Maxims I can say that many of the crypto APIs I have seen are either too complicated to get right unless you are an expert, or they allow easy access to crypto primitives such that programmers are often compelled to make mistakes by oversimplifying a complex solution and not knowing what they are missing. Getting more of this information out of academic papers and into the hands of practitioners and API / framework designers would be a big win for the security field.

It occurs to me that the lack of secure, practical crypto primitives and
protocols that are intuitively clear to ordinary people may be why
cryptography has had so little impact on an even more important problem
than psychic debunking, namely electronic voting. I think "intuitive
cryptography" is a very important open problem for our field.

Holograms: Feel-good security

I always wondered how something that obviously does not add much additional cost to low-cost items could offer any real protection.  Turns out they don't. 

A great quote below too.

Fake Holograms a 3-D Crime Wave

It turns out, they're aren't as secure as they are sparkly.

Groupthink and the inertia of ideas

This was posted to the cryptography mailing list as an example of how long it can take for experts to believe evidence.  Ulcers for years were thought of to be caused by stress (and many people still think so to this day) but are now known to be caused by bacteria Helicobacter pylori.  I just read about how if 40 years ago someone had even suggested that a condition such as ulcers was caused by an infection it would have been heresy.  However, they are finding even now that HPV is linked to cervical cancer and there could be other links between viruses/bacteria and other conditions. 

History of Ulcer Diagnosis and Treatment | CDC Ulcer

History of Ulcer Diagnosis and Treatment

I bet you thought WEP couldn't get any worse...

WEP has been cracked _again_ and read the description--it is a devastating break.  Crypto by committee, especially when not done by expert cryptographers with a well-defined threat model, is really, really bad.  This page also summarizes some of the previous weaknesses of WEP.

I hope you have switched to WPA or an alternative by now if you care about wireless privacy and keeping people off of your network.

If this isn't enough to run a VPN like OpenVPN or IPSec (although I don't favor IPSec anymore for many reasons; that's another crypto by committee with its own problems).

aircrack-ptw

We were able to extend Klein's attack and optimize it for usage against WEP. Using our version, it is possible to recover a 104 bit WEP key with probability 50% using just 40,000 captured packets. For 60,000 available data packets, the success probability is about 80% and for 85,000 data packets about 95%. Using active techniques like deauth and ARP re-injection, 40,000 packets can be captured in less than one minute under good condition. The actual computation takes about 3 seconds and 3 MB main memory on a Pentium-M 1.7 GHz and can additionally be optimized for devices with slower CPUs. The same attack can be used for 40 bit keys too with an even higher success probability.

AACS Crack overview

Excellent high-level description of what went into the AACS crack.  This arms race is even funnier now that the replacement key has been cracked _before_ it has been released.  Media industry:  you lost the battle against your customers before it was started.

-Jason

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of "Hal Finney"
Sent: Saturday, May 05, 2007 11:25 AM
To: [email protected]; [email protected]
Subject: Re: Yet a deeper crack in the AACS

> Article "AACS cracks cannot be revoked, says hacker"
>
> http://arstechnica.com/news.ars/post/20070415-aacs-cracks-cannot-be-revoked-says-hacker.html
>
> Excerpt: "The latest attack vector bypasses the encryption performed 
> by the Device Keys -- the same keys that were revoked by the WinDVD 
> update -- and the so-called 'Host Private Key,' which as yet has not 
> been found. This was accomplished by de-soldering the HD DVD drive's 
> firmware chip, reading its contents, and then patching it. Once that 
> was done, the firmware was soldered back onto the drive."

This article was not too accurate, and further progress has been made.
At this point it is possible to remotely patch the firmware of a
particular kind of HD-DVD drive so that it will provide certain
information without the usually required authentication. This makes it
easy to retrieve the per-disk "Volume ID", which must be combined with
the widely-published Processing Key to generate the media keys that can
decrypt content. If this Processing Key is invalidated on future
releases, this hack will not be useful until new keys are discovered.
It provides only part of the picture.

The hack was a real accomplishment because firmware updates had to be
authenticated with what was apparently something like an AES-based
CBC-MAC. The hackers had to figure this out without much background in
cryptography and working only with dumps of the firmware that used a
somewhat obscure embedded CPU. They had to figure out what CPU was
being used, find a disassembler for it, and examine assembly language
dumps to deduce that crypto was involved, recognize AES, and see how to
create their own checksums that would make their firmware updates
succeed.
Just goes to show the motivation and hard work that hackers bring to
these efforts, largely for the love of the challenge.

It's possible that the ability to modify firmware will lead to more
successes for the hackers in the future, perhaps helping them to break
into future versions of software players to extract their embedded keys.
I peruse the doom9.org forums from time to time, where this work took
place right out in the open, before the public eye. Definitely some
smart people involved there.

Hal Finney

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to
[email protected]

CryptoMaxims for crypto applications

This is a great idea.  A member of the cryptography mailing list started a wiki to develop a list of Maxims for Cryptography.  I often see security practitioners criticize others for not knowing about some obscure "don't do this" from the scientific literature; but nobody ever maintains a running list of the state-of-the-art knowledge of "dos and don'ts" to help people avoid future mistakes. 

Although there is something to be said for people who don't keep up with the latest in a security field of study from practicing it -- and for us to be wary of those who do so. 

CryptoMaxims - Security Wiki

This page is about proper use of cryptography.

DNSSEC explained and criticized

Ouch.

Matasano Chargen » A Case Against DNSSEC, Count 2: Too Complicated To Deploy

dnssec is the worst design-by-committee effort i’ve ever seen, both in terms of how late it is, how fuzzy the goals have been, how often the goals have changed, and how complicated and heavy it is now that it is trying to be all-things-to-all-people. (Paul Vixie)

Untrusted apt repositories may be harmful

Something to keep in mind the next time you take a shortcut and add a new repository to get the latest & greatest software for your linux distro.  Sometimes it is better to apt-get source <pkg name> and run run debian rules binary to get your own packages.  Of course, that's not quite working for me with Thunderbird 2 right now...

Ubuntu Untrusted Repository "gift" on Flickr - Photo Sharing!

Antivirus bakeoff public results

This site does comparitive testing of a host of leading Antivirus software and publishes the results online.  AVG did fairly poorly in the latest polymorphic tests from Feb 2007 compared to others and in DOS viruses.

http://www.av-comparatives.org/

7 habits of highly effective IT people

His original intent was specifically to discuss program management skills (at Microsoft), but I think this general framework is a good one for any effective IT person.  I employ several of these in my security work and of course any of them can always be improved.

J.D. Meier's Blog: 7 Habits of Highly Effective Program Managers

* Habit 1, Frame problems and solutions.
* Habit 2, Sell visions.
* Habit 3, Deliver incremental value.
* Habit 4, Manage communication.
* Habit 5, Connect with customers.
* Habit 6, Execute.
* Habit 7, Leverage the system.

Notable security quote: On the advice of experts

If you're sick and you go to a doctor, do you tell the doctor "you'd better come up with some very clear arguments if you want me to follow your advice"?  Do you tell your doctor "you'd better build a strong case before I will listen to you"?  I would hope not.  That would be silly.
Doctors are medical professionals with a great deal of training and expertise in the subject.  They can speak with authority when it comes to your health.  So why do people with no training in security think that they can freely ignore the advice of security professionals without any negative consequences?

-- David Wagner
April 22, 2007, cryptography mailing list

Hmmm.  I've _never_ had this happen to me in my security career...

More notable security quotes

Great list of quotes on another security blog to add to the periodic quotes I come across.

Musings on Information Security :: Quotable security quotes

Right-wing "Judicial Activism"

I'm sure the "liberal media" is not going to cry foul that the high court is engaging in "judicial activism".  Justice Ginsburg pretty much calls them on it though:

People For the American Way - Latest 5-4 Ruling Further Proof of the Alito Effect

“In her dissent, Justice Ruth Bader Ginsburg accused the majority of straying far ‘from interpretation of Title VII with fidelity to the Act's core purpose.’

Cheney proves he can be even more shortsighted and evil

Crooks and Liars » Cheney Criticizes Geneva Convention in Commencement Address

I'd say that's perfectly emblematic of this administration: In the context of moral and ethical circumstances, dismiss as irrelevant the standards held by the entire rest of the world.

I think that C & L misses the most disturbing aspects of Cheney's remarks: 

1. It's not that the sentiments go against what the rest of the world believes; they go against what _our founding fathers_ believed.  The rule of law; presumption of innocence.  But, the administration sees nothing wrong with presuming that just because we captured "them", "they" are "killers".  What about all of those FBI and CIA stings that netted...nothing...but violated civil liberties.  What about those imprisioned and released months or years later without any charges?  Were they "killers"?  If not, why deny them legal protections? 
   
2. And the most disturbing thing (and what truly shows how evil Cheney and his ilk are) is that they see nothing wrong with depriving violaters of the law of any due process or human rights.  And they justify it with a childish "well, they did it first!" or "they wouldn't do that for you".  That's the point!  If we are going to profess to have the moral high ground, then we can't debase ourselves to their supposed level on a whim.  That's relativistic morality.  And is what is going to be putting our troops and captives in danger even more so in the future.
   

I would love to see a realistic episode of 24 where Jack Bauer tortures a "terrorist" suspect only to find that the person was innocent.  There was a situation this season where a CTU worker was somewhat tortured and turned out to be innocent but they did not dwell on it enough to make the point about the dangers.

Gonzales grilled by fellow classmates in WaPo open letter

Ouch.  Several of the signatories are from Seattle.  Cheers for saying what needs to be said.

Alberto’s Harvard Class (’82) Places Ad in Washington Post.

As
lawyers, and as a matter of principle, we can no longer be silent about
this Administration’s consistent disdain for the liberties we hold
dear. Your failure to stand for the rule of law, particularly when
faced with a President who makes the aggrandized claim of being a
unitary executive, takes this country down a dangerous path.


Your country and your President are in dire need of an attorney who
will do the tough job of providing independent counsel, especially when
the advice runs counter to political expediency. Now more than ever,
our country needs a President, and an Attorney General, who remember
the apt observation attributed to Benjamin Franklin: "Those who would
give up essential Liberty to purchase a little temporary Safety,
deserve neither Liberty nor Safety." We call on you and the President
to relent from this reckless path, and begin to resto

Falwell controversy timeline

Ahh.  Wonder who will take his place to continue the divisive self-righteous condemnations?  What will we all do...

There is a short timeline of many of the controversial public incidents with Falwell at The Carpetbagger Report.

The Carpetbagger Report » Blog Archive » Jerry Falwell dies at age 73

Seattle City Light Billing Scam Warning

This kind of thing was going on long before "phishing" was coined. It's the same thing in a different technology medium.

FOR IMMEDIATE RELEASE CONTACT: Scott Thomsen
April 25, 2007 phone: 206/615-0978
pager: 206/386-4233

BILL COLLECTION SCAM TARGETS WEST SEATTLE
Customers Urged to Protect Credit Card Information from Con Artists

SEATTLE - Seattle City Light is urging its customers to be on guard against telephone con artists posing as utility bill collectors who appear to be targeting customers with Asian surnames in the West Seattle area.

In the past few days, several customers reported they received phone calls from people claiming to be City Light employees. One customer’s account was fraudulently tapped for more than $3,000.

In the scam, the callers claim there is a problem with payment of the customer's bill by check and demand credit card information to resolve the matter. This is similar to incidents reported to City Light in January and earlier this month.

Carol Dickinson, director of customer relations and account services, said City Light wants to help its customers protect themselves from such scams.

"We do not make outbound calls to customers asking for money to pay their bill or to ask for credit card payments or personal account information as part of our daily work," Dickinson said. "We respect customer privacy and take security of customer account and payment information seriously. We take many proactive steps to ensure that customer information is kept safe."

City Light sends at least two written warnings to customers who are about to have their power turned off, asking them to contact the utility directly to make a payment.

City Light also would like to remind customers:

• Seattle City Light never asks customers over the telephone for credit card information to pay their bills.


• Seattle City Light does not call customers on weekends.

Seattle City Light employees carry identification with the City Light logo and will always display it when asked.

All City Light customers are advised to take down the name and telephone number of anyone who calls and represents themselves as a City Light employee. Also, before customers provide any credit information, they should call City Light at 684-3000 to verify that the request is legitimate. If a customer believes he or she has been contacted by a con artist, they are urged to contact the Seattle Police Department at (206) 625-5011 to report the incident.

Hitchens and Hannity on the Hot Seat

This is pretty funny, to Hannity:  "You seem to have never read any of the arguments against your viewpoint".  Hannity's immediate response was, "Yes I have.  I've read them all."  Oh brother.

Crooks and Liars » Hitchens vs. Hannity on Religion and God

The ACLU defends YOUR rights too

This is also one that puzzles me.  I think it is primarily that some people dislike some of the causes that the ACLU has taken up (e.g. against ridiculous religious wackos trying to instill their brand of religion or morality as the law of the land) and so they discard the whole organization out of pocket.  But their slogan, "Freedom can't defend itself" speaks to exactly what they are here for:  to defend The Bill of Rights.  You know, the Bill of Rights is what gives the religious people their freedom to practice religion.  Too bad they don't see that the ACLU is also fighting for their rights too.

Card-carrying genuine patriotism at Pandagon

In terms of venerable institutions that are the target of right wing rage, the one that always puzzled me the most is the ACLU. I mean, I don’t doubt why it’s the target of so much hatred—wingnuts are well-known for thinking the word “freedom” looks good on a bumper sticker but shoudn’t actually be practiced as a matter of policy—but I’m shocked that even mainstream Republican politicians indulge in blatant disdain for an institution that defends the most fundamental principles of our democracy. The facade that Republicans care about individual liberty completely falls apart when Bush Sr. use the term “card-carrying member of the ACLU” as an insult.

By the way, our founding fathers were primarily Deists; we are not a Christian nation. 

Founding Fathers were primarily Deists, Holmes says | University Relations

The predominant theology of the early Colonial period was Deism, the idea that God created the world but then had no further role in its functioning, Holmes explained to the audience.

“It’s wrong to see [Washington] as other than a Christian,” Holmes said. He added that the best description of Jefferson’s religion was Unitarian while noting the author of the Declaration of Independence called the concept of the Trinity “Greek arithmetic.”