Zeroday 01100100011010010

Wireless Mic Research

zeroday — Tue, 23 Apr 2013 04:21:51 +0000

During Source Boston I became fascinated by the idea of using SDR to listen in on wireless mics. It occurred to me that corporate meetings in hotels with lots of sensitive information are probably vulnerable to that type of eavesdropping. I looked into encrypted wireless mics but they are very expensive and I can’t imagine a lot of people outside of the Fortune 10, military, and some parts of the government can afford them.
My first find was a page of wireless mics that were in the 700Mhz range and now banned by the FCC for intruding upon emergency communications. [1] @0xabad1dea pointed out rather quickly this wasn’t the list I thought it was. But I had also scraped together another list from product pages I’d browsed the previous evening.
G1 Band 470-530 Mhz
H4 Band 518-578 Mhz
J5 Band 578-638 Mhz
L3 Band 638-698 Mhz

Once I get a better grasp of GnuRadio I can probably cobble together a wireless mic scanner for the next conference I visit. Or maybe just hang around hotel lobbies and look for stray conversations.

[1] http://www.fcc.gov/encyclopedia/wireless…

Is Korean Law Driving Policy at Blizzard?

zeroday — Wed, 07 Jul 2010 04:13:14 +0000

US customers of game maker Blizzard are up in arms tonight as news of a new policy is set to require all posts on the Blizzard forum to use their Real ID system. That means that every post is accompanied by the real first and last name of the user. People are unsure what to make of this and I haven’t seen any communication from Blizzard stating why they are making this change.
I’m going to make the suggestion that South Korea’s Real Name System [is a driving force behind this decision]*. In 2009 South Korea’s government created a law that was meant to curb online defamation by insisting that all users who comment on sites with greater than 100,000 users per day must use their real name. The first US company to feel the effects of this law was Google. South Korea insisted the Youtube comments require all users to post with their real first and last name. Google got around this law by forbidding anyone with a South Korean IP address from posting to Youtube. Recently South Korea backed down and exempted Youtube from the Real Name system.
Given these facts it might not make sense why South Korea might enforce the Real Name system on Blizzard. My guess would be that the government is very aware of the immense popularity of Starcraft in South Korea. Some have joked it is their national sport. South Korea even has professional SC leagues with sponsors and packed arenas. I don’t think Blizzard can take the Google approach here and just ban South Korean users from posting to their forums. The South Korean market must make a ton of profits for Blizzard and unlike Google they don’t have revenue coming in from other sources.

* edit: fixed that sentence

Pax Musicana

zeroday — Sun, 21 Feb 2010 21:59:28 +0000

Over the years friends have asked what I have against music services like iTunes. A week or two ago the term Pax Musicana crept into my subconscious and it captures the issue perfectly. My general disdain for digital services like iTunes, Amazon Kindle, and the like is that I am locked into a service and should I decide to wander to the next big thing I would have to rebuild my collection from scratch. I would have to abandon all the value I stored in that service because they refuse to let me take my purchases with me.
The term Pax Musicana came to me as a concept of what these services should be. If I buy a song from one vendor my “license” to listen/download/stream that song should extend to all legitimate online services. Billboard.biz even has an article advising ISPs to start music/media stores to lock customers in and reduce their churn rate. The dying copyright bastions like Sony, EMI, Warner, Vivendi, et al are laughing their collective asses off because consumers who wish to stay legal have to repurchase the same album from iTunes, Walmart, or wherever they go next instead of repurchasing when media formats change (cassette -> cd, etc). The article implies that disgruntled customers will stick around just so they don’t lose the value they invested into those songs.
Sure they could export those mp3s to their computers but what exactly is the point? As we all move into the cloud it would make more sense for users to have the ability to log in and stream their music from wherever they are in the world. And should they decide that the next big thing in music store surpasses their current one all their licenses should move with them.
The music industry has made a big deal about the sale of music being more a licensing agreement than a transfer of property. You don’t own the album you just paid for so much as have a right to listen to the music (privately). As we extend this metaphor to movies and books this concept becomes far more powerful.
When a friend of mine got a Barnes and Noble Nook for his birthday I had to hold my tongue as he showed it off. None of the titles he purchased on his Kindle would transfer over. I suppose pax mediacana would be more apt for this post’s title but it doesn’t have quite the same ring.
Interestingly the Wikipedia article on the original term “pax romana” says that the “Romans regarded peace not as an absence of war, but the rare situation that existed when all opponents had been beaten down beyond the ability to resist.” So perhaps we are there already. It seems that consumers today are so beaten that they will accept whatever terms are dictated to them. They buy media online without thought to the limitations of how far that media can travel with them. They sign (click) away all their rights to resell the media when it is no longer interesting to them (see First Sales Doctrine). I hope this changes soon. Until it does don’t expect a penny from me in terms of this disposable media. It simply isn’t worth it.

My speech at the Works in Progress of Intellectual Property Conference

zeroday — Sat, 03 Oct 2009 03:08:42 +0000

My notes for the talk I gave to a group of distinguished law professors at the Seventh Annual Works in Progress Intellectual Property (WIPIP)

I am not a law professor
i am and am not a hacker.

the term hacker has undergone significant change in the last two decades so the meaning is ambiguous these days.
let me give you this definition and for the sake of the next 4 mins of my talk consider it to the the authoritative one

hackers are computer users who are adept enough to bend the function of a program to their will.

security researchers are much like the hackers of the 1990′s but unlike what the term has come to mean lately.

when researchers find security flaws in software they will generally contact the manufacturer. they are met with one of three responses:
1) disregard
2) deference
3) contempt

When met with contempt they have been threatened with law suits using a variety of novel legal theories. Reading though our history is like walking through a catalogue of existing IP frameworks. Patent, Trademark, Copyright, Contract and Criminal have all been used in response to an individual making claims that a product contains a security flaw.

examples:
In 2007 Chris Paget of security firm IOActive was going to give a talk at a security conference about the insecurity of HID badges. These badges are ubiquitous in corporate America and the issues he discovered need to be discussed. HID forced his talk to be canceled with the threat of patent infringement.

A few years earlier in 2005, researcher Mike Lynn had discovered a security flaw in Cisco routers. These devices are largely responsible for the backbone of the Internet. Interestingly Cisco had already fixed the flaw yet filed a TRO against Lynn to prevent him from talking about his work to a group of like minded peers at a security conference. In the aftermath of this incident Lynn had to agree to a permanent injunction forbidding him from ever talking about it again.

Lessig famously said that on the Internet “Code is Law”. I would like to reverse that turn of phrase for the real world.
“Law is code”
It is compiled by legislators and debugged by judges

And in this sense what the companies we write about in our paper did was impressive. They hacked the law. The bent these disparate legal frameworks to their will and used seemingly unrelated laws to silence researchers who were making claims that their product was flawed.

what our paper proposes to do is patch the law so that legal hackers can not continue to subvert the legal system anymore. And with that I’ll turn it over to Derek to explain how that would work. [pdf]

Repercussions of bad German laws on security research

zeroday — Sun, 20 Sep 2009 18:43:30 +0000

This month I’m conducting some research into web hosting security issues and ran into the aftermath of the German law passed in 2007 banning security research publication. The policy has had the effect of silencing security researchers from that country. While investigating issues in PHP security I came upon the Month of PHP Bugs website and when I attempted to download a proof of concept to illustrate what type of security issues PHP had back in 2007 I got an explanation from security researcher Stefan Esser explaining why he no longer feels comfortable publishing results to the Internet.

Instead of summarizing his explanation I’m going to repost it here:

Dear Visitor,

since Friday 10th, August 2007 a new and very troubling law is enforced in
germany.

It is no longer legal to create and/or distribute so called hacking tools in
germany. This includes port scanners like nmap, security scanners like nessus
or simple proof of concept exploits like the MOPB exploits. They are now illegal
because someone COULD use them to commit crimes.

Until today I had hoped that our Bundespresident would stop this insane law with
a last minute veto, but now it is official and our government has rendered germany
more or less defenseless against the threats from outside germany.

Unfortunately our government has been deaf to the warnings from lots of experts
that tried to explain how important these so called hacking tools are not only
for the current generation of security consultants to do their daily job, but
also how important they are for the education of the next generation of
researchers and consultants.

If you do not know how to attack, you will never know how to defend yourself.

Yours,
Stefan Esser

This is incredibly frustrating for someone like me who is doing legitimate research into security problems that are plaguing the Internet. Security research is a rare and valuable skill set which should be cultivated not destroyed. Yet the German law is likely driving away people from this profession due to the impossibility of publication on the Internet without fear of criminal charges. At best the researchers who are turning away in Germany are finding other less beneficial avenues to explore. At worst they are publishing underground only.

I had largely forgotten about this law being passed in 2007 because I too had assumed the President in Germany would come to his senses and repeal it. Germany has had a remarkable history with hackers (see Chaos Computer Club) so it is very surprising they went in this direction.

Some old articles about this:
ars technica
article about aftermath

I need to do some more follow up on this but so far the results look grim.

SECRE.TS

zeroday — Sat, 22 Aug 2009 02:52:59 +0000

I started developing a random idea over the holidays but never finished it. I’m releasing its description here with the hope that someone will steal and then implement it :)

a hybrid social media platform using rss feeds, twitter style messaging and public, private, and group key pair cryptography. it also solves the paradox of eventual decryption through the use of one time pads and very precise randomization.

secre.ts enables the user to share cryptographically protected messaging to allow use over untrusted publicly accessible networks like the Internet.

As a messaging solution secre.ts produces the greatest assets of email like services with the most secure traits of a virtual private network connection. vpn solutions are fragile connections and cumbersome on both bandwidth and the processor. secre.ts hybrid approach consumes processor but the messages are broadcast in public so connectivity is hugely increased and bandwidth isn’t impacted because the messages are received in cleartext.

Musings on Cara Duckworth’s Post

zeroday — Mon, 10 Aug 2009 04:43:02 +0000

Some opinions about the Tenenbaum case, for those interested:

OPINION: The RIAA stands for Recording Industry Association of America

OPINION: The RIAA has filed many cases against file sharers as civil actions and not criminal

OPINION: In the US, civil actions do not guarantee the defendant representation by an attorney

OPINION: The RIAA has compared copyright infringement to stealing many times in the press

OPINION: Copyright infringement and shoplifting are two distinct and separate crimes

OPINION: 30 average songs could be contained in 2 CD’s

OPINION: The average cost of 2 CD’s in a store is < $100

OPINION: In Massachusetts the fine for shoplifting under $100 is a fine up to $250 the first time

OPINION: There is a huge discrepancy between the punishment for shoplifting and infringing an equal amount of music

Project EquillibRIAA

zeroday — Wed, 05 Aug 2009 23:10:54 +0000

For the last few years I’ve talked quietly of a project to connect artists with the victims of lawsuits in the name of their bands. After the verdict handed down by the latest case of Sony vs. Tenenbaum I think it is time to put this plan to action. I’ve emailed Joel and received a list of the bands he was sued for and what I’d like to do is draw national attention to the public interfaces these bands have set up for
themselves.

I’ve created a public document which contains a list of the bands and any Twitter, Myspace, Facebook, or other public forums the bands have set up for themselves. I could use help tracking down some of the missing links in this list. In some cases the bands no longer exist but members of the original band still live on in other bands or on their own.

To be clear the purpose of this project is not to harass these musicians. It is to remove the wedge of the RIAA from artists and their fans and ask them to communicate. The one question I’d like to see the artists answer is “Do you support the actions the RIAA has taken on behalf of your band in destroying the life of Joel Tenenbaum?”

Joel is being fined $22,500 for each of the 30 songs that he downloaded
from KaZaa. His total fine is $675,000 for an activity that a majority of the Internet users in this country have and still participate in. This isn’t to say that we should advocate copyright infringement but that we shouldn’t agree with the penalties associated with infringement.

This project is still being assembled and I would appreciate any feedback and help the FC community can muster. I’d like to coordinate a massive feedback storm requesting comment via Twitter, Myspace, etc so these artists can’t escape without saying something. Anything. What we need is dialog from musicians about what is happening to their fans.

The working spreadsheet of bands and their online identities is here:
http://spreadsheets.google.com/ccc?key=0…

If you would like access to edit the spreadsheet please email me (oliver.day@gmail) and I will add you to the access list.

Friendless at Facebook

zeroday — Tue, 21 Jul 2009 08:12:18 +0000

I finally met someone whose privacy settings were as high as mine. If Facebook has a privacy setting I have it pushed to the highest possible value. The end result is that I’m practically a ghost on the popular social media website. You won’t find me using search functionality and I have absolutely no public footprint. Last night I decided to friend some of the researchers working with myself and Prof Bambauer on an academic paper about shielding security researchers due out this fall.
The two of us appeared to be unable to “friend” each other because of our high privacy settings. I wasn’t really sure how to proceed. We tried messaging each other a few more times in an effort to prove to Facebook our intentions but to no avail. One of us would have to sacrifice a bit of our privacy in order to allow for this seemingly obvious functionality.

Since I initiated I went ahead and dropped my guard a bit and allowed anyone from the Harvard network to see me (thankfully she is an alum!) Of course now that we are friends the curtains have been drawn again around my profile but this is definitely one of the more interesting experiences I’ve had with Facebook.

While I’m glad they offer me so many privacy settings they really need to think about this particular edge case where two privacy loving individuals happen to want to friend each other.

James Atkinson is speaking at MRL Thursday (June 25) at 6:30 PM

zeroday — Wed, 24 Jun 2009 01:49:26 +0000

Midnight Research Labs Boston will have a special guest speaker: Mr.
James Atkinson, who will be giving his “Kill Your Cordless Phone” talk.

***This talk will be announced and open to the general public, and WILL
REQUIRE AN RSVP as space is limited. Given the size and layout of MRLB,
we’ll be doing a bit of re-arranging to accommodate attendees.***

Please RSVP to rsvp001 at n0where.org

Here’s a brief bio on Mr. Atkinson (more at http://tscm.com/biojma.html)