My lousy Android experience

I’ve been a holdout on upgrading to a smart phone, in part because I haven’t paid over $100 for a mobile phone since they were the size of a brick. But after finding that I could get a Droid 2 Global on Verizon for $20 via Amazon Wireless a couple of months ago, I made the leap. My initial experience was negative–Amazon sent me a phone with instructions to go to Verizon’s web site to activate. Verizon’s website wanted me to enter a code from a Verizon invoice. No such invoice was included, and none of the numbers from the Amazon invoice worked. So I had to talk get through to a human being, at which point activation was fairly simple. But one more hurdle arose when I had to login to a Google account, which was an obstacle of my own creation–I use very long randomly generated passwords with special characters, and have independent Google accounts for different services, so I had to choose which one to use with the phone before I knew what all the implications would be. (I chose my GMail account, which has worked out OK.) I wanted to set the phone up to use my own email servers, and to connect over VPN to gain access. This proved to be an obstacle that took a few days to resolve, due to inadequacies and bugs in Droid applications. The default VPN client doesn’t support OpenVPN, so I had to gain root access to install an OpenVPN client. This turned out to be the only reason I needed root access on the phone, and I managed to get that working without much difficulty. The Email application, however, refused to send outbound mail through my mail server, which allows outbound port 25 client connections from internal hosts with no authentication but requiring TLS. This combination simply doesn’t work–I ended up setting up port 587 (submission port) with username/password authentication via Dovecot. Though I would have preferred using client certificate authentication, I couldn’t get it to work. I still run into periodic problems with Email refusing to send outbound messages for no apparent reason–and the server shows no attempts being made. There doesn’t seem to be a way to select an individual message in the outbox for an attempt to re-send. I managed to get contact and calendar synchronization working with my Mac, but I ended up exporting my iCal calendars to Google Calendar and using them as my primary calendars. Most of the correlation of contacts in the phone from multiple sources (e.g., Facebook, LinkedIn, and my Address Book) worked fairly well, but some contacts are duplicated due to name variations. Synchronization with LinkedIn is somewhat buggy, with first and last names showing up in contacts as “null null." The Calendar app is even more buggy–I’ve created events on the phone that disappear, I’ve seen error messages in Portuguese and events with names that appear to be leftover debugging messages. I was also surprised to see that spelling correction was performed, without any prompts, on events I imported into the Calendar app from GMail (it incorrectly turned an acronym, “JAD,” into the word “HAD”). I’ve received an SMS text message from one person which was identified as being from another person–looking at the specific contact information showed that the telephone number of the sender was associated with the correct contact, yet the name and photo displayed on the phone was of a different contact that had no association with that telephone number. The phone’s camera capability is pretty good, but when I connect the phone to my Mac, it launches iPhoto but doesn’t find any photographs. I have to import them manually by pointing iPhoto to the correct location on the SD card. I’ve seen the phone crash repeatedly, especially when using location services (Google Navigation, Maps, and Yelp have been repeat offenders). There also seems to be some caching of location information that gets out of sync with other location information. For example, I saw Yelp correctly show me nearby restaurants, but refuse to allow me to check in to the one I was sitting in because I was “too far away”–and Maps showed my location being somewhere else I had been earlier. In one case, thousands of miles away–an attempted Yelp check-in after returning from a vacation in Hawaii showed my location on the map as still being in Hawaii. In at least one case, I was unable to get my location to update for Yelp until I rebooted the phone. I’ve had issues doing things as simple as copying and pasting a URL from Firefox to Facebook or Twitter. I copy the URL, verify that it’s in the clipboard correctly, but when I go into Facebook or Twitter to paste it, it is truncated. The number of bugs I run into seems awfully high for very basic applications. The problem is no doubt in part due to the way development occurs between Google, Motorola, and Verizon, and Linux development, which also seems to be an obstacle to fixing security vulnerabilities. The May 2011 issue of CSO magazine reports that Coverity has done two scans of Android source code for the HTC Incredible, finding 359 defects (88 critical) on the first scan last November and 149 defects (106 unfixed from the previous scan) on a more recent scan. Accountability for the code is distributed across the aforementioned groups. (Also see this CNet story, or the Coverity report itself.) I wonder if I would run into problems like this with an iPhone. UPDATE (May 19, 2011): And now there’s a security vulnerability identified in version 2.3.3 of Android and earlier (I’m on 2.2, and can’t update until Verizon pushes an update), which potentially exposes contacts, calendar events, pictures, and other items stored in Google-hosted services, if users access those services via unencrypted WiFi. Although the connections to those services are over SSL-encrypted HTTP, there is a returned authToken that can be intercepted and used for subsequent logins to those services. I’ve never used my Droid on unencrypted WiFi networks, but I’ll now take extra care to make sure that I don’t. Version 2.3.4 fixes the problem for contacts and calendars but not for Picasa photos. UPDATE (November 16, 2011): It’s still been a horrible experience, and I still see regular crashes, particularly when using map and location-related applications. A new discovery today while traveling is that the World Clock widget does not know when Daylight Saving Time occurs–the option labeled “Daylight Savings[sic] Time: Adjust displayed time for Daylight Savings” appears to just set the clock forward one hour, not display the correct current time taking into account the date and whether Daylight Saving Time is in effect in the given location. I traveled to the east coast and saw that my World Clock widget time for New York was one hour ahead of the actual time in New York. It’s utterly ridiculous that this widget requires the user to check and uncheck this option manually when Daylight Saving Time is in effect or not–that’s exactly sort of simple task that computers are equipped to do on our behalf. ...

May 14, 2011 · 8 min

Information security threat models, folk & expert

I’ve written a pair of blog posts for Global Crossing’s “Defense in Depth Security” blog based on recent work by Rick Wash and by multiple people at Intel including Timothy Casey about modeling the agents behind information security threats. The first post is about non-expert home computer users’ “folk models” of the threats from viruses and hackers,which makes the point that seemingly irrational decisions about security may in fact be completely rational based on their conceptual understanding of the threat they believe they are combatting. Only by changing their understanding of the threat, which requires not just information but appropriately salient information and the right incentives, are we likely to see changes in user behavior. I point out an example of a recent news story that might help provide both elements with regard to one type of vulnerability, open wireless access points. The second blog post, which will appear tomorrow, is about expert models of threat agents–the Intel Threat Agent Library. Intel created a large set of attacker personas and identified their attributes, for use in matching against vulnerabilities and prioritizing controls as part of a broader risk assessment process. I’m happy to discuss these further either here or at the Global Crossing blogs.

March 31, 2011 · 1 min

Global Crossing blogging

I’ve joined the team of Global Crossing bloggers–please check out my initial post at Global Crossing blogs, “Forget passwords!" (BTW, my friend and colleague Glen Walker independently wrote a blog post making a very similar recommendation.)

January 6, 2011 · 1 min

Robert B. Laughlin on "The Crime of Reason"

The 2009 Hogan and Hartson Jurimetrics Lecture in honor of Lee Loevinger was given on the afternoon of November 5 at Arizona State University’s Sandra Day O’Connor School of Law by Robert B. Laughlin. Laughlin, the Ann T. and Robert M. Bass Professor of Physics at Stanford University and winner of the 1998 Nobel Prize in Physics (along with Horst L. Stormer and Daniel C. Tsui), spoke about his recent book, The Crime of Reason. He began with a one-sentence summary of his talk: “A consequence of entering the information age is probably that we’re going to lose a human right that we all thought we had but never did …” The sentence went on but I couldn’t keep up with him in my notes to get it verbatim, and I am not sure I could identify precisely what his thesis was after hearing the entire talk and Q&A session. The main gist, though, was that he thinks that a consequence of allowing manufacturing to go away and being a society based on information is that “Knowledge is dear, therefore there has to be less of it–we must prevent others from knowing what we know, or you can’t make a living from it.” And, he said, “People who learn on their own are terrorists and thieves,” which I think was intentional hyperbole. I think his talk was loaded with overgeneralizations, some of which he retracted or qualified during the Q&A. It certainly doesn’t follow from knowledge being valuable that there must be less of it. Unlike currency, knowledge isn’t a fungible commodity, so different bits of knowledge have different value to different people. There are also different kinds of knowledge–know-how vs. knowledge that, and making the latter freely available doesn’t necessarily degrade the value of the former, which is why it’s possible to have a business model that gives away software for free but makes money from consulting services. Further, the more knowledge there is, the more valuable it is to know where to find the particular bits of knowledge that are useful for a given purpose, and the less it is possible for a single person to be an expert across many domains. An increasing amount of knowledge means there’s increasing value in various kinds of specializations, and more opportunities for individuals to develop forms of expertise in niches that aren’t already full of experts. Laughlin said that he is talking about “the human rights issue of the 21st century,” that “learnign some things on your own is stealing from people. What we think of as our rights are in conflict with the law, just as slavery is in conflict with human rights.” He said that Jefferson was conflicted on this very issue, sayng on the one hand that “knowledge is like fire–divinely designed to be copyable like a lit taper–I can light yours with mine, which in no way diminishes my own.” This is the non-rival quality of information, that one person copying information from another doesn’t deprive the other of their use of it, though that certainly may have an impact on the commercial market for the first person to sell their information. “On the other hand,” said Laughlin, “economics involves gambling. [Jefferson] favored legalized gambling. Making a living involves bluff and not sharing knowledge.” He said that our intellectual property laws derive from English laws that people on the continent “thought … were outrageous–charging people to know things." He put up a photo of a fortune from a fortune cookie, that said “The only good is knowledge, and the only evil ignorance.” He said this is what you might tell kids in school to get them to study, but there’s something not right about it. He then put up a drawing of Dr. Frankenstein and his monster (Laughlin drew most of the slides himself). He said, we’re all familiar with the Frankenstein myth. “The problem with open knowledge is that some of it is dangerous. In the U.S. some of it is off-limits, you can’t use it in business or even talk about it. It’s not what you do with it that’s exclusive, but that you have it at all." His example was atomic bomb secrets and the Atomic Energy Act of 1954, which makes it a federal felony to reveal “nuclear data” to the public, which has been defined very broadly in the courts. It includes numbers and principles of physics. Laughlin returned to his fortune cookie example, and said there’s another problem. He put up a drawing of a poker game. “If I peeked at one guy’s cards and told everyone else, the poker game would stop. It involves bluffing, and open access to knowledge stops the game.” He suggested that this is what happened last year with the world financial sector–that the “poker game in Wall Street stopped, everyone got afraid to bet, and the government handled it by giving out more chips and saying keep playing, which succeeded.” I agree that this was a case where knowledge–specifically knowledge of the growing amounts of “toxic waste” in major world banks–caused things to freeze up, it wasn’t the knowledge that was the ultimate cause, it was the fact that banks engaged in incredibly risky behavior that they shouldn’t have. More knowledge earlier–and better oversight and regulation–could have prevented the problem. Laughlin said “Economics is about bluff and secrecy, and open knowledge breaks it.” I don’t think I agree–what makes markets function is that price serves as a public signal about knowledge. There’s always going to be local knowledge that isn’t shared, not necessarily because of bluff and secrecy, but simply due to the limits of human capacities and the dynamics of social transactions. While trading on private knowledge can result in huge profits, trading the private knowledge itself can be classified as insider trading and is illegal. (Though perhaps it shouldn’t be, since insider trading has the potential for making price signals more accurate more quickly to the public.) Laughlin showed a painting of the death of Socrates (by Jacques-Louis David, not Laughlin this time), and said that in high school, you study Plato, Aristotle, and Descartes, and learn that knowledge is good. But, “as you get older, you learn there’s a class system in knowledge.” Plato etc. is classified as good, but working class technical knowledge, like how to build a motor, is not, he claimed. He went on to say, “If you think about it, that’s exactly backwards.” I’m not sure anyone is ever taught that technical knowledge is not valuable, especially these days, where computer skills seem to be nearly ubiquitous–and I disagree with both extremes. From my personal experience, I think some of my abstract thinking skills that I learned from studying philosophy have been among the most valuable skills I’ve used in both industry and academia, relevant to both theoretical and practical applications. Laughlin said that “engines are complicated, and those who would teach you about it don’t want to be clear about it. It’s sequestered by those who own it, because it’s valuable. The stuff we give away in schools isn’t valuable, that’s why we give it away.” In the Q&A, a questioner observed that he can easily obtain all sorts of detailed information about how engines work, and that what makes it difficult to understand is the quantity and detail. Laughlin responded that sometimes the best way to hide things is to put them in plain sight (the Poe “purloined letter” point), as needles in a haystack. But I think that’s a rather pat answer to something that is contradictory to his claim–the information really is freely available and easy to find, but the limiting factor is that it takes time to learn the relevant parts to have a full understanding. The limit isn’t the availability of the knowledge or that some of it is somehow hidden. I’d also challenge his claim that the knowledge provided in schools is “given away.” It’s still being paid for, even if it’s free to the student, and much of what’s being paid for is the know-how of the educator, not just the knowledge-that of the specific facts, as well as special kinds of knowledge-that–the broader frameworks into which individual facts fit. Laughlin went on to say, “You’re going to have to pay to know the valuable information. Technical knowledge will disappear and become unavailable. The stuff you need to make a living is going away.” He gave as examples defense-related technologies, computers, and genetics. He said that “people in the university sector are facing more and more intense moral criticism” for sharing information. “How life works–would we want that information to get out? We might want to burn those books. The 20th century was the age of physics, [some of which was] so dangerous we burned the books. It’s not in the public domain. The 21st century is the age of biology. We’re in the end game of the same thing. In genetics–e.g., how disease organisms work. The genetic structure of Ebola or polio.” Here, Laughlin seems to be just wrong. The gene sequences of Ebola and polio have apparently been published (Sanchez, A., et al. (1993) “Sequence analysis of the Ebola virus genome: organization, genetic elements and comparison with the genome of Marburg virus,” Virus Research 29, 215-240 and Stanway, G., et al. (1983) “The nucleotide sequence of poliovirus type 3 leon 12 a1b: comparison with poliovirus type 1," Nucleic Acids Res. 11(16), 5629-5643). (I don’t claim to be knowledgeable about viruses, in the former case I am relying on the statement that “Sanchez et al (1993) has published the sequence of the complete genome of Ebola virus” from John Crowley and Ted Crusberg, “Ebola and Marburg Virus: Genomic Structure, Comparative and Molecular Biology."; in the latter case it may not be publication of the complete genome but is at least part.) Laughlin talked about the famous issue of The Progressive magazine which featured an article by Howard Moreland titled “How H-Bombs Work.” He showed the cover of the magazine, which read, “The H-Bomb Secret–How we got it–why we’re telling it.” Laughlin said that the DoJ enjoined the journal from publishing the article and took the issue into secret hearings. The argument was that it was a threat to national security and a violation of the Atomic Energy Act. The judge said that the rule against prior restraint doesn’t apply because this is so dangerous that “no jurist in their right mind would put free speech above safety.” Laughlin said, “Most people think the Bill of Rights protects you, but this case shows that it doesn’t.” After the judge forbid publication, it was leaked to a couple of “newspapers on the west coast,” after which the DoJ dropped the case and the article was published. According to Laughlin, this was strategy, that he suspects they didn’t prosecute the case because the outcome would have been to find the AEA unconstitutional. By dropping the case it kept the AEA as a potential weapon in future cases. He said there have only been two cases of the criminal provisions of the AEA prosecuted in the last 50 years, but it is “inconceivable that it was only violated twice. The country handles its unconstitutionality by not prosecuting.” The U.S., he said, is like a weird hybrid of Athens and Sparta, favoring both being open and being war-like and secretive. These two positions have never been reconciled, so we live in an unstable situation that favors both. He also discussed the case of Wen Ho Lee, a scientist from Taiwan who worked at Los Alamos National Laboratory, who took home items that were classified as “PARD” (protect as restricted data), even though everyone is trained repeatedly that you “Don’t take PARD home.” When he was caught, Laughlin said, he said “I didn’t know it was wrong” and “I thought they were going to fire me, so I took something home to sell.” The latter sounds like an admission of guilt. He was put into solitary confinement for a year (actually 9 months) and then the case of 50 counts of AEA violations was dropped. Laughlin characterized this as “extralegal punishment,” and said “we abolish due process with respect to nuclear data.” (Wen Ho Lee won a $1.5 million settlement from the U.S. government in 2006 before the Supreme Court could hear his case. Somehow, this doesn’t seem to me to be a very effective deterrent.) Laughlin said that we see a tradeoff between risk and benefit, not an absolute danger. The risk of buildings being blown up is low enough to allow diesel fuel and fertilizer to be legal. Bombs from ammonium nitrate and diesel fuel are very easy to make, and our protection isn’t hiding technical knowledge, but that people just don’t do it. But nuclear weapons are so much more dangerous that the technical details are counted as absolutely dangerous, no amount of benefit could possibly be enough. He said that he’s writing a book about energy and “the possible nuclear renaissance unfolding” (as a result of need for non-carbon-emitting energy sources). He says the U.S. and Germany are both struggling with this legal morass around nuclear information. (Is the unavailability of nuclear knowledge really the main or even a significant issue about nuclear plant construction in the United States? General Electric (GE Energy) builds nuclear plants in other countries.) Laughlin said that long pointy knives could be dangerous, and there’s a movement in England to ban them. Everybody deals with technical issue of knowledge and where to draw lines. (Is it really feasible to ban knives, and does such a ban constitute a ban on knowledge? How hard is it to make a knife?) At this point he moved on to biology, and showed a photograph of a fruit fly with legs for antennae. He said, “so maybe antennae are related to legs, and a switch in development determines which you get. The control machinery is way too complicated to understand right now.” (Really?) “What if this was done with a dog, with legs instead of ears. Would the person who did that go to Stockholm? No, they’d probably lose their lab and be vilified. In the life sciences there are boundaries like we see in nuclear–things we shouldn’t know.” (I doubt that there is a switch that turns dog ears into legs, and this doesn’t strike me as plausibly being described as a boundary on knowledge, but rather an ethical boundary on action.) He said, “There are so many things researchers would like to try, but can’t, because funders are afraid.” Again, I suspect that most of these cases are ethical boundaries about actions rather than knowledge, though of course there are cases where unethical actions might be required to gain certain sorts of knowledge. He turned to stem cells. He said that the federal government effectively put a 10-year moratorium on stem cell research for ethical reasons. Again, these were putatively ethical reasons regarding treatment of embryos, but the ban was on federally funded research rather than any research at all. It certainly stifled research, but didn’t eliminate it. Next he discussed the “Millennium Digital Copyright Act” (sic). He said that “people who know computers laugh at the absurdity” of claiming that computer programs aren’t formulas and are patentable. He said that if he writes a program that “has functionality or purpose similar to someone else’s my writing it is a violation of the law.” Perhaps in a very narrow case where there’s patent protection, yes, but certainly not in general. If he was arguing that computer software patents are a bad idea, I’d agree. He said “Imagine if I reverse-engineered the latest Windows and then published the source code. It would be a violation of law.” Yes, in that particular example, but there are lots of cases of legitimate reverse engineering, especially in the information security field. The people who come up with the signatures for anti-virus and intrusion detection and prevention do this routinely, and in some cases have actually released their own patches to Microsoft vulnerabilities because Microsoft was taking too long to do it themselves. He said of Microsoft Word and PDF formats that they “are constantly morphing” because “if you can understand it you can steal it.” But there are legal open source and competing proprietary software solutions that understand both of the formats in question–Open Office, Apple’s Pages and Preview, Foxit Reader, etc. Laughlin said, “Intentional bypassing of encryption is a violation of the DMCA.” Only if that encryption is circumvention of “a technological measure that effectively controls access to” copyrighted material and the circumvention is not done for the purposes of security research, which has a big exception carved out in the law. Arguably, breakable encryption doesn’t “effectively control access,” though the law has certainly been used to prosecute people who broke really poor excuses for encryption. Laughlin put up a slide of the iconic smiley face, and said it has been patented by Unisys. “If you use it a lot, you’ll be sued by Unisys.” I’m not sure how you could patent an image, and while there are smiley face trademarks that have been used as a revenue source, it’s by a company called SmileyWorld, not Unisys. He returned to biology again, to talk briefly about gene patenting, which he says “galls biologists” but has been upheld by the courts. (Though perhaps not for many years longer, depending on how the Myriad Genetics case turns out.) Natural laws and discoveries aren’t supposed to be patentable, so it’s an implication of these court decisions that genes “aren’t natural laws, but something else.” The argument is that isolating them makes them into something different than what they are when they’re part of an organism, which somehow constitutes an invention. I think that’s a bad argument that could only justify patenting the isolation process, not the sequence. Laughlin showed a slide of two photos, the cloned dog Snuppy and its mother on the left, and a Microsoft Word Professional box on the right. He said that Snuppy was cloned when he was in Korea, and that most Americans are “unhappy about puppy clones” because they fear the possibility of human clones. I thought he was going to say that he had purchased the Microsoft Word Professional box pictured in Korea at the same time, and that it was counterfeit, copied software (which was prevalent in Korea in past decades, if not still), but he had an entirely different point to make. He said, about the software, “The thing that’s illegal is not cloning it. If I give you an altered version, I’ve tampered with something I’m not supposed to. There’s a dichotomy between digital knowledge in living things and what you make, and they’re different [in how we treat them?]. But they’re manifestly not different. Our legal system[’s rules] about protecting these things are therefore confused and mixed up.” I think his argument and distinction was rather confused, and he didn’t go on to use it in anything he said subsequently. It seems to me that the rules are pretty much on a par between the two cases–copying Microsoft Word Professional and giving it to other people would itself be copyright infringement; transforming it might or might not be a crime depending on what you did. If you turned it into a piece of malware and distributed that, it could be a crime. But if you sufficiently transformed it into something useful that was no longer recognizable as Microsoft Word Professional, that might well be fair use of the copyrighted software. In any case in between, I suspect the only legally actionable offense would be copyright infringement, in which case the wrongdoing is the copying, not the tampering. He put up a slide of Lady Justice dressed in a clown suit, and said that “When you talk to young people about legal constraints on what they can do, they get angry, like you’re getting angry at this image of Lady Law in a clown suit. She’s not a law but an image, a logos. … [It’s the] root of our way of relating to each other. When you say logos is a clown, you’ve besmirched something very fundamental about who you want to be. … Legal constraints on knowledge is part of the price we’ve paid for not making things anymore.” (Not sure what to say about this.) He returned to his earlier allusion to slavery. He said that was “a conflict between Judeo-Christian ethics and what you had to do to make a living. It got shakier and shakier until violence erupted. War was the only solution. I don’t think that will happen in this case. [The] bigger picture is the same kind of tension. … Once you make Descartes a joke, then you ask, why stay?” He put up a slide of a drawing of an astronaut on the moon, with the earth in the distance. “Why not go to the moon? What would drive a person off this planet? You’d have to be a lunatic to leave.” (I thought he was going to make a moon-luna joke, but he didn’t, unless that was it.) “Maybe intellectual freedom might be that thing. It’s happened before, when people came to America.” He went on to say that some brought their own religious baggage with them to America. Finally, he said that when he presents that moon example to graduate students, he always has many who say “Send me, I want to go." And that’s how his talk ended. I was rather disappointed–it seemed rather disjointed and rambling, and made lots of tendentious claims–it wasn’t at all what I expected from a Nobel prizewinner. The first question in the Q&A was one very much like I would have asked, about how he explains the free and open source software movement. Laughlin’s answer was that he was personally a Linux user and has been since 1997, but that students starting software companies are “paranoid about having stuff stolen,” and “free things, even in software, are potentially pernicious,” and that he pays a price for using open source in that it takes more work to maintain it and he’s constantly having to upgrade to deal with things like format changes in PDF and Word. There is certainly such a tradeoff for some open source software, but some of it is just as easy to maintain as commercial software, and there are distributions of Linux that are coming closer to the ease of use of Windows. And of course Mac OS X, based on an open source, FreeBSD-derived operating system, is probably easier for most people to use than Windows. I think there was a lot of potentially interesting and provocative material in his talk, but it just wasn’t formulated into a coherent and persuasive argument. If anyone has read his book, is it more tightly argued? ...

November 7, 2009 · 20 min

Bad spammer neighborhoods

I’ve been collecting data about IPs that have been attempting to spam my mail server for the past few months, and today I decided to take a look at what neighborhoods of /24 networks are the most heavily populated with spamming IPs. Here’s the list of the top ten “worst neighborhoods” trying to send me spam, mostly with dictionary attacks against my domain. These are all blocked by the CBL, so none of this spam actually gets through, but it ties up my bandwidth. I’ve put an asterisk (*) next to the ranges that are probably actually smaller than /24s based on the distribution of IPs. Does anybody have a tool that already exists to identify likely bad ranges to block based on the distribution of known bad IPs? All I did here was count IPs within a /24, but it would be nicer to identify the likely ranges of badness at both a more fine-grained and broader level. Note that these bad neighborhoods may be neighborhoods of poorly secured machines, or they may be neighborhoods of malicious machines. Either way, the providers are not doing a good job of cracking down on malicious activity from their networks. 1. 64.32.26.0/24 (25 IPs) 45 46 51 52 54 66 68 73 81 90 100 102 104 111 113 126 155 157 163 168 194 199 204 236 242 AS 46844 | 64.32.26.0 | ST-BGP - SHARKTECH INTERNET SERVICES Upstream provider: AS 7922 | 64.32.26.0 | COMCAST-7922 - Comcast Cable Communications, Inc. *2. 89.232.105.0/24 (24 IPs) 21 24 29 32 48 57 59 63 64 68 76 89 93 94 97 101 103 107 114 117 126 129 137 139 AS 28840 | 89.232.105.0 | TATTELECOM-AS Tattelecom.ru/Tattelecom Autonomous System Upstream provider: AS 6854 | 89.232.105.0 | SYNTERRA-AS SYNTERRA Joint Stock Company 64.32.26.0 3. 208.84.243.0/24 (20 IPs) 13 30 63 68 78 92 99 123 148 150 175 176 179 185 196 199 216 219 226 250 AS 40260 | 208.84.243.0 | TERRA-NETWORKS-MIAMI - Terra Networks Operations Inc. Upstream provider: AS 22364 | 208.84.243.0 | AS-22364 - Telefonica USA, Inc. *4. 83.149.3.0/24 (17 IPs) 5 6 12 14 16 18 21 22 25 28 30 40 42 47 48 51 63 AS 31213 | 83.149.3.0 | MF-NWGSM-AS OJSC MegaFon Network Upstream providers: AS 12389 | 83.149.3.0 | ROSTELECOM-AS JSC Rostelecom AS 20485 | 83.149.3.0 | TRANSTELECOM JSC Company TransTeleCom *5. 76.164.227.0/24 (16 IPs) 138 155 159 174 182 186 194 199 202 206 210 218 222 230 238 246 AS 36114 | 76.164.227.0 | RDTECH-ASN - R & D Technologies, LLC Upstream providers: AS 6473 | 76.164.227.0 | WCIXN4 - WCIX.Net, Inc. AS 35937 | 76.164.227.0 | MARQUISNET - MarquisNet LLC 6. 76.164.232.0/24 (15 IPs) 13 21 24 33 36 38 40 43 48 57 198 206 218 232 234 AS 36114 | 76.164.232.0 | RDTECH-ASN - R & D Technologies, LLC Upstream providers: AS 6473 | 76.164.227.0 | WCIXN4 - WCIX.Net, Inc. AS 35937 | 76.164.227.0 | MARQUISNET - MarquisNet LLC 7. 77.120.128.0/24 (15 IPs) 20 37 50 85 93 104 107 112 159 162 187 232 239 248 252 AS 43011 | 77.120.128.0 | DATASVIT-AS ISP Datasvit AS Number Upstream provider: AS 25229 | 77.120.128.0 | VOLIA-AS Volia Autonomous System *8. 78.138.170.0/24 (12 IPs) 66 68 77 78 160 166 178 189 190 193 202 211 AS 28840 | 78.138.170.0 | TATTELECOM-AS Tattelecom.ru/Tattelecom Autonomous System Upstream provider: AS 6854 | 89.232.105.0 | SYNTERRA-AS SYNTERRA Joint Stock Company 64.32.26.0 9. 77.232.143.0/24 (12 IPs) 33 37 40 63 69 104 175 182 190 215 218 251 AS 42145 | 77.232.143.0 | BSTV-AS OOO Bryansk Svyaz-TV Upstream provider: AS 20485 | 77.232.143.0 | TRANSTELECOM JSC Company TransTeleCom *10. 95.154.113.0/24 (12 IPs) 140 178 181 185 193 195 197 206 218 246 248 254 AS 44724 | 95.154.113.0 | OCTOPUSNET-AS Octopusnet LTD Upstream provider: AS 34470 | 95.154.113.0 | PTKOM-AS PortTelekom Autonomous system

July 25, 2009 · 4 min

How Twitter got compromised

TechCrunch has published “The Anatomy of the Twitter Attack," a detailed account of how “Hacker Croll” used people’s password-selection habits, use of multiple online applications, publicly available online information about people, and flawed “I forgot my password” mechanisms to gain access first to individuals’ personal webmail accounts and then to Twitter’s internal systems. It’s a good idea to use randomly generated passwords, stored in a password safe, so that they’re different with every service you use. It’s also a good idea to split personal and corporate accounts. Lately I’ve taken to using randomly generated information for my “I forgot my password” answers, as well, and keeping that in my password safe just like another password. The “secret questions” for password recovery are a vulnerability when so much personal information is being shared on the Internet. That’s how Sarah Palin’s email account was compromised last year, as well. ...

July 24, 2009 · 2 min

DHS still a mess, five years on

One of the main points of the creation of the Department of Homeland Security in 2004 was to centralize oversight over a wide array of agencies with responsibility for the safety and security of the United States and its territories. The 9/11 Commission made 41 specific recommendations to Congress, and one of those was “create a single, principal point of oversight and review for homeland security.” But that’s one that hasn’t been accomplished–DHS oversight by Congress is through 86 separate committees and subcommittees (see chart below, click on it for the full-sized image). The Center for Public Integrity and the Center for Investigative Reporting have joined forces to investigate the effectiveness of the Department of Homeland Security’s efforts since its creation, and will be publishing a series of reports over the next several months which should prove quite interesting.

July 16, 2009 · 1 min

Bad military botnet proposal still being pushed

I just came across an April 2009 BBC story which shows that USAF Col. Williamson is still promoting his idea of building a U.S. military botnet to engage in offensive denial of service attacks against foreign targets on the Internet. But I haven’t seen him respond to any of the criticisms of his bad idea, including in the online forum of the journal where he published it. I think a more effective idea would be to adjust the computer crime statutes to provide immunity to prosecution (or at the very least an affirmative defense to criminal charges) for private responses to attacks that meet certain criteria, so that ISPs, security researchers, and competent individuals could engage in offensive actions against compromised machines to disable malicious software or take them off the network. Perhaps some kind of licensing or bonding would do the trick, and ISPs could put an exception into their acceptable use policies for entities that met the criteria. That’s also my partial response to this more recent BBC story about “what rules apply in cyber-wars” which led me to find the Williamson article.

June 27, 2009 · 1 min

Tracking cyberspies through the web wilderness

Yesterday’s New York Times has an interesting article about how security researchers at the University of Toronto have helped uncover online spy activity, apparently conducted by the Chinese government, against the Dalai Lama’s office in India. One odd comment in the article: “And why among the more than 1,200 compromised government computers representing 103 countries, were there no United States government systems?" I find this particularly odd in that I’ve seen compromised U.S. government systems plenty of times in my information security career, including spam issued from military computers. I don’t find it plausible that the U.S. government has recently improved the security of all of its computers and networks so that there are no more compromised systems. In the context of the article, it’s discussing more specifically compromises due to the particular spy ring being monitored. The preceding sentences point out that they weren’t able to determine with certainty who was running it, and the immediately preceding sentence asks, “Why was the powerful eavesdropping system not password-protected, a weakness that made it easy for Mr. Villeneuve to determine how the system worked?" The question should actually have asked why it wasn’t encrypted, rather than “password-protected,” but the possibilities suggested to me here are that (a) this particular activity is being run by amateurs or (b) this particular activity was intentionally detectible as either (i) a distraction from other, more hidden activity or (ii) to put the blame on China by somebody other than China. ...

May 12, 2009 · 2 min

The Cybersecurity Act of 2009

There’s FUD spreading about Sec. 14 of the Cybersecurity Act of 2009, maintaining that it amounts to an effective repeal of the 4th Amendment for the Internet. That’s not so–the scope is restricted to “threat and vulnerability information” regarding the Internet, which I interpret to mean network service provider knowledge about compromised systems, botnets, etc., much of which is no doubt already being voluntarily shared with the government as is permissible under the Electronic Communications Privacy Act of 1986, when, in the course of a provider’s normal service monitoring, it becomes aware of possible criminal activity. I expect I’ll have more to say after I have a chance to read through the whole bill (PDF).

April 5, 2009 · 1 min
Mastodon Verification