How to use Google Authenticator with OpenBSD, OpenSSH, and OpenVPN--and why you might not want to

I thought that Google Authenticator might be a quick and easy two-factor authentication solution for VPN access to my personal network, so I did some Google searches to see if that were so. I found quite a few sources describing how to set it up with systems that use Linux Pluggable Authentication Modules (PAM), but very little about using it with BSD Authentication on OpenBSD. The most promising link I came across was to an implementation of Google Authentication for OpenBSD that was last updated in early 2013, based on Google’s PAM code, but I couldn’t get it to work. It compiled and installed, and the googleauth code for generating a secret (and a very insecure way of generating a QR code to use to import it into the Google Authenticator application) worked fine, but I couldn’t successfully use it for console login, OpenSSH login, or OpenVPN login. I also found the standard OpenBSD port for openvpn_bsdauth, which compiled, installed, and worked successfully for password authentication by adding these lines to my OpenVPN configuration: ...

October 31, 2013 · 7 min

Capitalist vs. socialist bombs

While reading Ross Anderson’s massive tome, Security Engineering: A Guide to Building Dependable Systems (second edition), I came across this paragraph in section 19.7 on “Directed Energy Weapons” (p. 584): Western concern about EMP grew after the Soviet Union started a research program on non-nuclear EMP weapons in the mid-80s.  At the time, the United States was deploying 'neutron bombs' in Europe--enhanced radiation weapons that could kill people without demolishing buildings.  The Soviets portrayed this as a 'capitalist bomb' which would destroy people while leaving property intact, and responded by threatening a 'socialist bomb' to destroy property (in the form of electronics) while leaving the surrounding people intact. This reminded me of a science fiction story I read in Omni magazine at about the time in question, which Google reveals was "Returning Home" by Ian Watson in the December 1982 issue.  In the story, the Americans and the Soviets attacked each other, the Americans using neutron bombs which killed all of the Soviets, and the Soviets using some kind of bomb which destroyed essentially everything except the people.  The ending twist was that the surviving Americans ended up migrating to the Soviet Union and adopting the Soviet culture. Historical Comments wakawakwaka (2012-11-20): hey my skeptic friend can you take a look at the book written by johanna michaelsen who wrote the foreword to lauren stradford's satan underground? its really messed up...is their a way to investigate what really happened with her ? ...

September 23, 2012 · 2 min

TSA security loophole exploited

As this blog has reported on multiple prior occasions (in 2006, 2008, and 2009, at the very least), the fact that U.S. airport security separates the checking of the boarding pass by TSA from the use of a boarding pass to check in to board makes it easy to get through security with a boarding pass that matches your ID while flying under a boarding pass on a ticket purchased in a different name. Now, as The Economist (July 2, 2011) reports, Olajide Oluwaseun Noibi, a 24-year-old Nigerian American, has been arrested after successfully doing something along these lines to fly around the country, apparently on multiple occasions. Only Noibi wasn’t even using boarding passes valid for the flights he was on–he was caught with a boarding pass in another person’s name for a flight from a day prior. And he wasn’t caught because the boarding pass was detected at check-in–he had already successfully boarded the flight and was seated. He was only caught because of his extreme body odor and a fellow passenger complained, which led to his boarding pass being checked and found to be invalid. ...

July 3, 2011 · 1 min

Arizona Department of Public Service's security breach

LulzSec breached the security of the Arizona Department of Public Service (DPS) at some point in the past, and on June 23 around 4 p.m. Arizona time, posted some or all of what they had acquired. This included the names, email addresses, and passwords of several DPS officers as well as a number of internal documents which appeared to have been obtained from email attachments or perhaps from the compromise of end user systems. The documents included a PowerPoint presentation on gang tattoos that purported to be a way of identifying Islamic radicals, which was reminiscent of similar ludicrous law enforcement presentations from the 1980s about identifying Satanic cult members by their black clothing and occult symbols. (Some police departments still promote such nonsense, citing exposed fraud “Lauren Stratford” as a source). The documents also included a bulletin which expresses concern about the “Cop Recorder” iPhone application. On June 24, DPS posted a press release responding to the attacks, accusing LulSec of being a “cyber terrorist group”–a term better reserved for the use of criminally disruptive activities intended to cause physical harm or disruption of critical infrastructure, not embarrassing organizations that haven’t properly secured themselves. In the press release, DPS enumerates the steps they’ve taken to secure themselves and the safeguards they’ve put in place. It’s an embarrassing list which suggests they’ve had poor information security and continue to have poor information security. First, their press release has a paragraph suggesting that the damage is limited, before they’re probably had time to really determine that’s the case. They write: There is no evidence the attack has breached the servers or computer systems of DPS, nor the larger state network. Likewise, there is no evidence that DPS records related to ongoing investigations or other sensitive matters have been compromised. Just because they have “no evidence” of something doesn’t mean it didn’t happen–what records did they review to make this determination? Were they doing appropriate logging? Have logs been preserved, or were they deleted in the breach? Do they have centralized logging that is still secure? When did the compromise take place, and when did DPS detect it? The appearance is that they didn’t detect the breach until it was exposed by the perpetrators. What was the nature of the vulnerability exploited, and why wasn’t it detected by DPS in a penetration test or vulnerability assessment? LulzSec has complained about the number of SQL injection vulnerabilities they’ve found–was there one in DPS’s web mail application? Next, they report what they’ve done in response, and again make statements about how “limited” the breach was: Upon learning that a limited number of agency e-mails had been disclosed, DPS took action. In addition to contacting other law enforcement agencies, the Arizona Counter Terrorism Information Center (ACTIC) has been activated. Remote e-mail access for DPS employees remains frozen for the time-being. The security of the seven DPS officers in question remains the agency’s top priority and, since a limited amount of personal information was publicly disclosed as part of this breach. Steps are being taken to ensure the officers’ safety and that of their families. They’ve disabled the e-mail access that they believe was used in the breach–that’s good. Presumably the exposed officer passwords were discovered to be from this system. Perhaps they will not re-enable the system until they have a more secure mechanism that requires VPN access and two-factor authentication–or at least intrusion prevention, a web application firewall, and effective security monitoring. They’ve notified ACTIC–presumably in part because of their overblown claim that this breach constitutes “terrorism” and in part because there are some ACTIC personnel who have good knowledge of information security. And they’re doing something to protect the safety of officers whose personal information (including some home addresses) was exposed. In the final paragraph of the press release, they list some of the safeguards they have in place: ...

June 25, 2011 · 5 min

My lousy Android experience

I’ve been a holdout on upgrading to a smart phone, in part because I haven’t paid over $100 for a mobile phone since they were the size of a brick. But after finding that I could get a Droid 2 Global on Verizon for $20 via Amazon Wireless a couple of months ago, I made the leap. My initial experience was negative–Amazon sent me a phone with instructions to go to Verizon’s web site to activate. Verizon’s website wanted me to enter a code from a Verizon invoice. No such invoice was included, and none of the numbers from the Amazon invoice worked. So I had to talk get through to a human being, at which point activation was fairly simple. But one more hurdle arose when I had to login to a Google account, which was an obstacle of my own creation–I use very long randomly generated passwords with special characters, and have independent Google accounts for different services, so I had to choose which one to use with the phone before I knew what all the implications would be. (I chose my GMail account, which has worked out OK.) I wanted to set the phone up to use my own email servers, and to connect over VPN to gain access. This proved to be an obstacle that took a few days to resolve, due to inadequacies and bugs in Droid applications. The default VPN client doesn’t support OpenVPN, so I had to gain root access to install an OpenVPN client. This turned out to be the only reason I needed root access on the phone, and I managed to get that working without much difficulty. The Email application, however, refused to send outbound mail through my mail server, which allows outbound port 25 client connections from internal hosts with no authentication but requiring TLS. This combination simply doesn’t work–I ended up setting up port 587 (submission port) with username/password authentication via Dovecot. Though I would have preferred using client certificate authentication, I couldn’t get it to work. I still run into periodic problems with Email refusing to send outbound messages for no apparent reason–and the server shows no attempts being made. There doesn’t seem to be a way to select an individual message in the outbox for an attempt to re-send. I managed to get contact and calendar synchronization working with my Mac, but I ended up exporting my iCal calendars to Google Calendar and using them as my primary calendars. Most of the correlation of contacts in the phone from multiple sources (e.g., Facebook, LinkedIn, and my Address Book) worked fairly well, but some contacts are duplicated due to name variations. Synchronization with LinkedIn is somewhat buggy, with first and last names showing up in contacts as “null null." The Calendar app is even more buggy–I’ve created events on the phone that disappear, I’ve seen error messages in Portuguese and events with names that appear to be leftover debugging messages. I was also surprised to see that spelling correction was performed, without any prompts, on events I imported into the Calendar app from GMail (it incorrectly turned an acronym, “JAD,” into the word “HAD”). I’ve received an SMS text message from one person which was identified as being from another person–looking at the specific contact information showed that the telephone number of the sender was associated with the correct contact, yet the name and photo displayed on the phone was of a different contact that had no association with that telephone number. The phone’s camera capability is pretty good, but when I connect the phone to my Mac, it launches iPhoto but doesn’t find any photographs. I have to import them manually by pointing iPhoto to the correct location on the SD card. I’ve seen the phone crash repeatedly, especially when using location services (Google Navigation, Maps, and Yelp have been repeat offenders). There also seems to be some caching of location information that gets out of sync with other location information. For example, I saw Yelp correctly show me nearby restaurants, but refuse to allow me to check in to the one I was sitting in because I was “too far away”–and Maps showed my location being somewhere else I had been earlier. In one case, thousands of miles away–an attempted Yelp check-in after returning from a vacation in Hawaii showed my location on the map as still being in Hawaii. In at least one case, I was unable to get my location to update for Yelp until I rebooted the phone. I’ve had issues doing things as simple as copying and pasting a URL from Firefox to Facebook or Twitter. I copy the URL, verify that it’s in the clipboard correctly, but when I go into Facebook or Twitter to paste it, it is truncated. The number of bugs I run into seems awfully high for very basic applications. The problem is no doubt in part due to the way development occurs between Google, Motorola, and Verizon, and Linux development, which also seems to be an obstacle to fixing security vulnerabilities. The May 2011 issue of CSO magazine reports that Coverity has done two scans of Android source code for the HTC Incredible, finding 359 defects (88 critical) on the first scan last November and 149 defects (106 unfixed from the previous scan) on a more recent scan. Accountability for the code is distributed across the aforementioned groups. (Also see this CNet story, or the Coverity report itself.) I wonder if I would run into problems like this with an iPhone. UPDATE (May 19, 2011): And now there’s a security vulnerability identified in version 2.3.3 of Android and earlier (I’m on 2.2, and can’t update until Verizon pushes an update), which potentially exposes contacts, calendar events, pictures, and other items stored in Google-hosted services, if users access those services via unencrypted WiFi. Although the connections to those services are over SSL-encrypted HTTP, there is a returned authToken that can be intercepted and used for subsequent logins to those services. I’ve never used my Droid on unencrypted WiFi networks, but I’ll now take extra care to make sure that I don’t. Version 2.3.4 fixes the problem for contacts and calendars but not for Picasa photos. UPDATE (November 16, 2011): It’s still been a horrible experience, and I still see regular crashes, particularly when using map and location-related applications. A new discovery today while traveling is that the World Clock widget does not know when Daylight Saving Time occurs–the option labeled “Daylight Savings[sic] Time: Adjust displayed time for Daylight Savings” appears to just set the clock forward one hour, not display the correct current time taking into account the date and whether Daylight Saving Time is in effect in the given location. I traveled to the east coast and saw that my World Clock widget time for New York was one hour ahead of the actual time in New York. It’s utterly ridiculous that this widget requires the user to check and uncheck this option manually when Daylight Saving Time is in effect or not–that’s exactly sort of simple task that computers are equipped to do on our behalf. ...

May 14, 2011 · 8 min

Information security threat models, folk & expert

I’ve written a pair of blog posts for Global Crossing’s “Defense in Depth Security” blog based on recent work by Rick Wash and by multiple people at Intel including Timothy Casey about modeling the agents behind information security threats. The first post is about non-expert home computer users’ “folk models” of the threats from viruses and hackers,which makes the point that seemingly irrational decisions about security may in fact be completely rational based on their conceptual understanding of the threat they believe they are combatting. Only by changing their understanding of the threat, which requires not just information but appropriately salient information and the right incentives, are we likely to see changes in user behavior. I point out an example of a recent news story that might help provide both elements with regard to one type of vulnerability, open wireless access points. The second blog post, which will appear tomorrow, is about expert models of threat agents–the Intel Threat Agent Library. Intel created a large set of attacker personas and identified their attributes, for use in matching against vulnerabilities and prioritizing controls as part of a broader risk assessment process. I’m happy to discuss these further either here or at the Global Crossing blogs.

March 31, 2011 · 1 min

Global Crossing blogging

I’ve joined the team of Global Crossing bloggers–please check out my initial post at Global Crossing blogs, “Forget passwords!" (BTW, my friend and colleague Glen Walker independently wrote a blog post making a very similar recommendation.)

January 6, 2011 · 1 min

Robert B. Laughlin on "The Crime of Reason"

The 2009 Hogan and Hartson Jurimetrics Lecture in honor of Lee Loevinger was given on the afternoon of November 5 at Arizona State University’s Sandra Day O’Connor School of Law by Robert B. Laughlin. Laughlin, the Ann T. and Robert M. Bass Professor of Physics at Stanford University and winner of the 1998 Nobel Prize in Physics (along with Horst L. Stormer and Daniel C. Tsui), spoke about his recent book, The Crime of Reason. He began with a one-sentence summary of his talk: “A consequence of entering the information age is probably that we’re going to lose a human right that we all thought we had but never did …” The sentence went on but I couldn’t keep up with him in my notes to get it verbatim, and I am not sure I could identify precisely what his thesis was after hearing the entire talk and Q&A session. The main gist, though, was that he thinks that a consequence of allowing manufacturing to go away and being a society based on information is that “Knowledge is dear, therefore there has to be less of it–we must prevent others from knowing what we know, or you can’t make a living from it.” And, he said, “People who learn on their own are terrorists and thieves,” which I think was intentional hyperbole. I think his talk was loaded with overgeneralizations, some of which he retracted or qualified during the Q&A. It certainly doesn’t follow from knowledge being valuable that there must be less of it. Unlike currency, knowledge isn’t a fungible commodity, so different bits of knowledge have different value to different people. There are also different kinds of knowledge–know-how vs. knowledge that, and making the latter freely available doesn’t necessarily degrade the value of the former, which is why it’s possible to have a business model that gives away software for free but makes money from consulting services. Further, the more knowledge there is, the more valuable it is to know where to find the particular bits of knowledge that are useful for a given purpose, and the less it is possible for a single person to be an expert across many domains. An increasing amount of knowledge means there’s increasing value in various kinds of specializations, and more opportunities for individuals to develop forms of expertise in niches that aren’t already full of experts. Laughlin said that he is talking about “the human rights issue of the 21st century,” that “learnign some things on your own is stealing from people. What we think of as our rights are in conflict with the law, just as slavery is in conflict with human rights.” He said that Jefferson was conflicted on this very issue, sayng on the one hand that “knowledge is like fire–divinely designed to be copyable like a lit taper–I can light yours with mine, which in no way diminishes my own.” This is the non-rival quality of information, that one person copying information from another doesn’t deprive the other of their use of it, though that certainly may have an impact on the commercial market for the first person to sell their information. “On the other hand,” said Laughlin, “economics involves gambling. [Jefferson] favored legalized gambling. Making a living involves bluff and not sharing knowledge.” He said that our intellectual property laws derive from English laws that people on the continent “thought … were outrageous–charging people to know things." He put up a photo of a fortune from a fortune cookie, that said “The only good is knowledge, and the only evil ignorance.” He said this is what you might tell kids in school to get them to study, but there’s something not right about it. He then put up a drawing of Dr. Frankenstein and his monster (Laughlin drew most of the slides himself). He said, we’re all familiar with the Frankenstein myth. “The problem with open knowledge is that some of it is dangerous. In the U.S. some of it is off-limits, you can’t use it in business or even talk about it. It’s not what you do with it that’s exclusive, but that you have it at all." His example was atomic bomb secrets and the Atomic Energy Act of 1954, which makes it a federal felony to reveal “nuclear data” to the public, which has been defined very broadly in the courts. It includes numbers and principles of physics. Laughlin returned to his fortune cookie example, and said there’s another problem. He put up a drawing of a poker game. “If I peeked at one guy’s cards and told everyone else, the poker game would stop. It involves bluffing, and open access to knowledge stops the game.” He suggested that this is what happened last year with the world financial sector–that the “poker game in Wall Street stopped, everyone got afraid to bet, and the government handled it by giving out more chips and saying keep playing, which succeeded.” I agree that this was a case where knowledge–specifically knowledge of the growing amounts of “toxic waste” in major world banks–caused things to freeze up, it wasn’t the knowledge that was the ultimate cause, it was the fact that banks engaged in incredibly risky behavior that they shouldn’t have. More knowledge earlier–and better oversight and regulation–could have prevented the problem. Laughlin said “Economics is about bluff and secrecy, and open knowledge breaks it.” I don’t think I agree–what makes markets function is that price serves as a public signal about knowledge. There’s always going to be local knowledge that isn’t shared, not necessarily because of bluff and secrecy, but simply due to the limits of human capacities and the dynamics of social transactions. While trading on private knowledge can result in huge profits, trading the private knowledge itself can be classified as insider trading and is illegal. (Though perhaps it shouldn’t be, since insider trading has the potential for making price signals more accurate more quickly to the public.) Laughlin showed a painting of the death of Socrates (by Jacques-Louis David, not Laughlin this time), and said that in high school, you study Plato, Aristotle, and Descartes, and learn that knowledge is good. But, “as you get older, you learn there’s a class system in knowledge.” Plato etc. is classified as good, but working class technical knowledge, like how to build a motor, is not, he claimed. He went on to say, “If you think about it, that’s exactly backwards.” I’m not sure anyone is ever taught that technical knowledge is not valuable, especially these days, where computer skills seem to be nearly ubiquitous–and I disagree with both extremes. From my personal experience, I think some of my abstract thinking skills that I learned from studying philosophy have been among the most valuable skills I’ve used in both industry and academia, relevant to both theoretical and practical applications. Laughlin said that “engines are complicated, and those who would teach you about it don’t want to be clear about it. It’s sequestered by those who own it, because it’s valuable. The stuff we give away in schools isn’t valuable, that’s why we give it away.” In the Q&A, a questioner observed that he can easily obtain all sorts of detailed information about how engines work, and that what makes it difficult to understand is the quantity and detail. Laughlin responded that sometimes the best way to hide things is to put them in plain sight (the Poe “purloined letter” point), as needles in a haystack. But I think that’s a rather pat answer to something that is contradictory to his claim–the information really is freely available and easy to find, but the limiting factor is that it takes time to learn the relevant parts to have a full understanding. The limit isn’t the availability of the knowledge or that some of it is somehow hidden. I’d also challenge his claim that the knowledge provided in schools is “given away.” It’s still being paid for, even if it’s free to the student, and much of what’s being paid for is the know-how of the educator, not just the knowledge-that of the specific facts, as well as special kinds of knowledge-that–the broader frameworks into which individual facts fit. Laughlin went on to say, “You’re going to have to pay to know the valuable information. Technical knowledge will disappear and become unavailable. The stuff you need to make a living is going away.” He gave as examples defense-related technologies, computers, and genetics. He said that “people in the university sector are facing more and more intense moral criticism” for sharing information. “How life works–would we want that information to get out? We might want to burn those books. The 20th century was the age of physics, [some of which was] so dangerous we burned the books. It’s not in the public domain. The 21st century is the age of biology. We’re in the end game of the same thing. In genetics–e.g., how disease organisms work. The genetic structure of Ebola or polio.” Here, Laughlin seems to be just wrong. The gene sequences of Ebola and polio have apparently been published (Sanchez, A., et al. (1993) “Sequence analysis of the Ebola virus genome: organization, genetic elements and comparison with the genome of Marburg virus,” Virus Research 29, 215-240 and Stanway, G., et al. (1983) “The nucleotide sequence of poliovirus type 3 leon 12 a1b: comparison with poliovirus type 1," Nucleic Acids Res. 11(16), 5629-5643). (I don’t claim to be knowledgeable about viruses, in the former case I am relying on the statement that “Sanchez et al (1993) has published the sequence of the complete genome of Ebola virus” from John Crowley and Ted Crusberg, “Ebola and Marburg Virus: Genomic Structure, Comparative and Molecular Biology."; in the latter case it may not be publication of the complete genome but is at least part.) Laughlin talked about the famous issue of The Progressive magazine which featured an article by Howard Moreland titled “How H-Bombs Work.” He showed the cover of the magazine, which read, “The H-Bomb Secret–How we got it–why we’re telling it.” Laughlin said that the DoJ enjoined the journal from publishing the article and took the issue into secret hearings. The argument was that it was a threat to national security and a violation of the Atomic Energy Act. The judge said that the rule against prior restraint doesn’t apply because this is so dangerous that “no jurist in their right mind would put free speech above safety.” Laughlin said, “Most people think the Bill of Rights protects you, but this case shows that it doesn’t.” After the judge forbid publication, it was leaked to a couple of “newspapers on the west coast,” after which the DoJ dropped the case and the article was published. According to Laughlin, this was strategy, that he suspects they didn’t prosecute the case because the outcome would have been to find the AEA unconstitutional. By dropping the case it kept the AEA as a potential weapon in future cases. He said there have only been two cases of the criminal provisions of the AEA prosecuted in the last 50 years, but it is “inconceivable that it was only violated twice. The country handles its unconstitutionality by not prosecuting.” The U.S., he said, is like a weird hybrid of Athens and Sparta, favoring both being open and being war-like and secretive. These two positions have never been reconciled, so we live in an unstable situation that favors both. He also discussed the case of Wen Ho Lee, a scientist from Taiwan who worked at Los Alamos National Laboratory, who took home items that were classified as “PARD” (protect as restricted data), even though everyone is trained repeatedly that you “Don’t take PARD home.” When he was caught, Laughlin said, he said “I didn’t know it was wrong” and “I thought they were going to fire me, so I took something home to sell.” The latter sounds like an admission of guilt. He was put into solitary confinement for a year (actually 9 months) and then the case of 50 counts of AEA violations was dropped. Laughlin characterized this as “extralegal punishment,” and said “we abolish due process with respect to nuclear data.” (Wen Ho Lee won a $1.5 million settlement from the U.S. government in 2006 before the Supreme Court could hear his case. Somehow, this doesn’t seem to me to be a very effective deterrent.) Laughlin said that we see a tradeoff between risk and benefit, not an absolute danger. The risk of buildings being blown up is low enough to allow diesel fuel and fertilizer to be legal. Bombs from ammonium nitrate and diesel fuel are very easy to make, and our protection isn’t hiding technical knowledge, but that people just don’t do it. But nuclear weapons are so much more dangerous that the technical details are counted as absolutely dangerous, no amount of benefit could possibly be enough. He said that he’s writing a book about energy and “the possible nuclear renaissance unfolding” (as a result of need for non-carbon-emitting energy sources). He says the U.S. and Germany are both struggling with this legal morass around nuclear information. (Is the unavailability of nuclear knowledge really the main or even a significant issue about nuclear plant construction in the United States? General Electric (GE Energy) builds nuclear plants in other countries.) Laughlin said that long pointy knives could be dangerous, and there’s a movement in England to ban them. Everybody deals with technical issue of knowledge and where to draw lines. (Is it really feasible to ban knives, and does such a ban constitute a ban on knowledge? How hard is it to make a knife?) At this point he moved on to biology, and showed a photograph of a fruit fly with legs for antennae. He said, “so maybe antennae are related to legs, and a switch in development determines which you get. The control machinery is way too complicated to understand right now.” (Really?) “What if this was done with a dog, with legs instead of ears. Would the person who did that go to Stockholm? No, they’d probably lose their lab and be vilified. In the life sciences there are boundaries like we see in nuclear–things we shouldn’t know.” (I doubt that there is a switch that turns dog ears into legs, and this doesn’t strike me as plausibly being described as a boundary on knowledge, but rather an ethical boundary on action.) He said, “There are so many things researchers would like to try, but can’t, because funders are afraid.” Again, I suspect that most of these cases are ethical boundaries about actions rather than knowledge, though of course there are cases where unethical actions might be required to gain certain sorts of knowledge. He turned to stem cells. He said that the federal government effectively put a 10-year moratorium on stem cell research for ethical reasons. Again, these were putatively ethical reasons regarding treatment of embryos, but the ban was on federally funded research rather than any research at all. It certainly stifled research, but didn’t eliminate it. Next he discussed the “Millennium Digital Copyright Act” (sic). He said that “people who know computers laugh at the absurdity” of claiming that computer programs aren’t formulas and are patentable. He said that if he writes a program that “has functionality or purpose similar to someone else’s my writing it is a violation of the law.” Perhaps in a very narrow case where there’s patent protection, yes, but certainly not in general. If he was arguing that computer software patents are a bad idea, I’d agree. He said “Imagine if I reverse-engineered the latest Windows and then published the source code. It would be a violation of law.” Yes, in that particular example, but there are lots of cases of legitimate reverse engineering, especially in the information security field. The people who come up with the signatures for anti-virus and intrusion detection and prevention do this routinely, and in some cases have actually released their own patches to Microsoft vulnerabilities because Microsoft was taking too long to do it themselves. He said of Microsoft Word and PDF formats that they “are constantly morphing” because “if you can understand it you can steal it.” But there are legal open source and competing proprietary software solutions that understand both of the formats in question–Open Office, Apple’s Pages and Preview, Foxit Reader, etc. Laughlin said, “Intentional bypassing of encryption is a violation of the DMCA.” Only if that encryption is circumvention of “a technological measure that effectively controls access to” copyrighted material and the circumvention is not done for the purposes of security research, which has a big exception carved out in the law. Arguably, breakable encryption doesn’t “effectively control access,” though the law has certainly been used to prosecute people who broke really poor excuses for encryption. Laughlin put up a slide of the iconic smiley face, and said it has been patented by Unisys. “If you use it a lot, you’ll be sued by Unisys.” I’m not sure how you could patent an image, and while there are smiley face trademarks that have been used as a revenue source, it’s by a company called SmileyWorld, not Unisys. He returned to biology again, to talk briefly about gene patenting, which he says “galls biologists” but has been upheld by the courts. (Though perhaps not for many years longer, depending on how the Myriad Genetics case turns out.) Natural laws and discoveries aren’t supposed to be patentable, so it’s an implication of these court decisions that genes “aren’t natural laws, but something else.” The argument is that isolating them makes them into something different than what they are when they’re part of an organism, which somehow constitutes an invention. I think that’s a bad argument that could only justify patenting the isolation process, not the sequence. Laughlin showed a slide of two photos, the cloned dog Snuppy and its mother on the left, and a Microsoft Word Professional box on the right. He said that Snuppy was cloned when he was in Korea, and that most Americans are “unhappy about puppy clones” because they fear the possibility of human clones. I thought he was going to say that he had purchased the Microsoft Word Professional box pictured in Korea at the same time, and that it was counterfeit, copied software (which was prevalent in Korea in past decades, if not still), but he had an entirely different point to make. He said, about the software, “The thing that’s illegal is not cloning it. If I give you an altered version, I’ve tampered with something I’m not supposed to. There’s a dichotomy between digital knowledge in living things and what you make, and they’re different [in how we treat them?]. But they’re manifestly not different. Our legal system[’s rules] about protecting these things are therefore confused and mixed up.” I think his argument and distinction was rather confused, and he didn’t go on to use it in anything he said subsequently. It seems to me that the rules are pretty much on a par between the two cases–copying Microsoft Word Professional and giving it to other people would itself be copyright infringement; transforming it might or might not be a crime depending on what you did. If you turned it into a piece of malware and distributed that, it could be a crime. But if you sufficiently transformed it into something useful that was no longer recognizable as Microsoft Word Professional, that might well be fair use of the copyrighted software. In any case in between, I suspect the only legally actionable offense would be copyright infringement, in which case the wrongdoing is the copying, not the tampering. He put up a slide of Lady Justice dressed in a clown suit, and said that “When you talk to young people about legal constraints on what they can do, they get angry, like you’re getting angry at this image of Lady Law in a clown suit. She’s not a law but an image, a logos. … [It’s the] root of our way of relating to each other. When you say logos is a clown, you’ve besmirched something very fundamental about who you want to be. … Legal constraints on knowledge is part of the price we’ve paid for not making things anymore.” (Not sure what to say about this.) He returned to his earlier allusion to slavery. He said that was “a conflict between Judeo-Christian ethics and what you had to do to make a living. It got shakier and shakier until violence erupted. War was the only solution. I don’t think that will happen in this case. [The] bigger picture is the same kind of tension. … Once you make Descartes a joke, then you ask, why stay?” He put up a slide of a drawing of an astronaut on the moon, with the earth in the distance. “Why not go to the moon? What would drive a person off this planet? You’d have to be a lunatic to leave.” (I thought he was going to make a moon-luna joke, but he didn’t, unless that was it.) “Maybe intellectual freedom might be that thing. It’s happened before, when people came to America.” He went on to say that some brought their own religious baggage with them to America. Finally, he said that when he presents that moon example to graduate students, he always has many who say “Send me, I want to go." And that’s how his talk ended. I was rather disappointed–it seemed rather disjointed and rambling, and made lots of tendentious claims–it wasn’t at all what I expected from a Nobel prizewinner. The first question in the Q&A was one very much like I would have asked, about how he explains the free and open source software movement. Laughlin’s answer was that he was personally a Linux user and has been since 1997, but that students starting software companies are “paranoid about having stuff stolen,” and “free things, even in software, are potentially pernicious,” and that he pays a price for using open source in that it takes more work to maintain it and he’s constantly having to upgrade to deal with things like format changes in PDF and Word. There is certainly such a tradeoff for some open source software, but some of it is just as easy to maintain as commercial software, and there are distributions of Linux that are coming closer to the ease of use of Windows. And of course Mac OS X, based on an open source, FreeBSD-derived operating system, is probably easier for most people to use than Windows. I think there was a lot of potentially interesting and provocative material in his talk, but it just wasn’t formulated into a coherent and persuasive argument. If anyone has read his book, is it more tightly argued? ...

November 7, 2009 · 20 min

Bad spammer neighborhoods

I’ve been collecting data about IPs that have been attempting to spam my mail server for the past few months, and today I decided to take a look at what neighborhoods of /24 networks are the most heavily populated with spamming IPs. Here’s the list of the top ten “worst neighborhoods” trying to send me spam, mostly with dictionary attacks against my domain. These are all blocked by the CBL, so none of this spam actually gets through, but it ties up my bandwidth. I’ve put an asterisk (*) next to the ranges that are probably actually smaller than /24s based on the distribution of IPs. Does anybody have a tool that already exists to identify likely bad ranges to block based on the distribution of known bad IPs? All I did here was count IPs within a /24, but it would be nicer to identify the likely ranges of badness at both a more fine-grained and broader level. Note that these bad neighborhoods may be neighborhoods of poorly secured machines, or they may be neighborhoods of malicious machines. Either way, the providers are not doing a good job of cracking down on malicious activity from their networks. 1. 64.32.26.0/24 (25 IPs) 45 46 51 52 54 66 68 73 81 90 100 102 104 111 113 126 155 157 163 168 194 199 204 236 242 AS 46844 | 64.32.26.0 | ST-BGP - SHARKTECH INTERNET SERVICES Upstream provider: AS 7922 | 64.32.26.0 | COMCAST-7922 - Comcast Cable Communications, Inc. *2. 89.232.105.0/24 (24 IPs) 21 24 29 32 48 57 59 63 64 68 76 89 93 94 97 101 103 107 114 117 126 129 137 139 AS 28840 | 89.232.105.0 | TATTELECOM-AS Tattelecom.ru/Tattelecom Autonomous System Upstream provider: AS 6854 | 89.232.105.0 | SYNTERRA-AS SYNTERRA Joint Stock Company 64.32.26.0 3. 208.84.243.0/24 (20 IPs) 13 30 63 68 78 92 99 123 148 150 175 176 179 185 196 199 216 219 226 250 AS 40260 | 208.84.243.0 | TERRA-NETWORKS-MIAMI - Terra Networks Operations Inc. Upstream provider: AS 22364 | 208.84.243.0 | AS-22364 - Telefonica USA, Inc. *4. 83.149.3.0/24 (17 IPs) 5 6 12 14 16 18 21 22 25 28 30 40 42 47 48 51 63 AS 31213 | 83.149.3.0 | MF-NWGSM-AS OJSC MegaFon Network Upstream providers: AS 12389 | 83.149.3.0 | ROSTELECOM-AS JSC Rostelecom AS 20485 | 83.149.3.0 | TRANSTELECOM JSC Company TransTeleCom *5. 76.164.227.0/24 (16 IPs) 138 155 159 174 182 186 194 199 202 206 210 218 222 230 238 246 AS 36114 | 76.164.227.0 | RDTECH-ASN - R & D Technologies, LLC Upstream providers: AS 6473 | 76.164.227.0 | WCIXN4 - WCIX.Net, Inc. AS 35937 | 76.164.227.0 | MARQUISNET - MarquisNet LLC 6. 76.164.232.0/24 (15 IPs) 13 21 24 33 36 38 40 43 48 57 198 206 218 232 234 AS 36114 | 76.164.232.0 | RDTECH-ASN - R & D Technologies, LLC Upstream providers: AS 6473 | 76.164.227.0 | WCIXN4 - WCIX.Net, Inc. AS 35937 | 76.164.227.0 | MARQUISNET - MarquisNet LLC 7. 77.120.128.0/24 (15 IPs) 20 37 50 85 93 104 107 112 159 162 187 232 239 248 252 AS 43011 | 77.120.128.0 | DATASVIT-AS ISP Datasvit AS Number Upstream provider: AS 25229 | 77.120.128.0 | VOLIA-AS Volia Autonomous System *8. 78.138.170.0/24 (12 IPs) 66 68 77 78 160 166 178 189 190 193 202 211 AS 28840 | 78.138.170.0 | TATTELECOM-AS Tattelecom.ru/Tattelecom Autonomous System Upstream provider: AS 6854 | 89.232.105.0 | SYNTERRA-AS SYNTERRA Joint Stock Company 64.32.26.0 9. 77.232.143.0/24 (12 IPs) 33 37 40 63 69 104 175 182 190 215 218 251 AS 42145 | 77.232.143.0 | BSTV-AS OOO Bryansk Svyaz-TV Upstream provider: AS 20485 | 77.232.143.0 | TRANSTELECOM JSC Company TransTeleCom *10. 95.154.113.0/24 (12 IPs) 140 178 181 185 193 195 197 206 218 246 248 254 AS 44724 | 95.154.113.0 | OCTOPUSNET-AS Octopusnet LTD Upstream provider: AS 34470 | 95.154.113.0 | PTKOM-AS PortTelekom Autonomous system

July 25, 2009 · 4 min

How Twitter got compromised

TechCrunch has published “The Anatomy of the Twitter Attack," a detailed account of how “Hacker Croll” used people’s password-selection habits, use of multiple online applications, publicly available online information about people, and flawed “I forgot my password” mechanisms to gain access first to individuals’ personal webmail accounts and then to Twitter’s internal systems. It’s a good idea to use randomly generated passwords, stored in a password safe, so that they’re different with every service you use. It’s also a good idea to split personal and corporate accounts. Lately I’ve taken to using randomly generated information for my “I forgot my password” answers, as well, and keeping that in my password safe just like another password. The “secret questions” for password recovery are a vulnerability when so much personal information is being shared on the Internet. That’s how Sarah Palin’s email account was compromised last year, as well. ...

July 24, 2009 · 2 min
Mastodon Verification