Zeroday 01100100011010010

Charlie Nesson explains in this article just how far the RIAA has perverted the American legal system.
It should be noted the $750 statutory minimum is just that. A minimum. It can go as high as $30,000 per infringement.
The defendant in this trial has had to endure 7 years of legal troubles over allegedly downloading 7 songs. This is something to think about. The RIAA is asking for over $1M because of downloaded songs which have a market value of roughly $7. I have to agree with Paula Samuelson that at most damages of 3x should apply to crimes of this nature. Not only is this proportional to the actual crime but would force RIAA to go after higher stakes players who are actually reproducing physical copies of CDs.

A summarized version exists here.

I’ve switched over to Hpricot for HTML parsing in my various ruby projects. This was a long time coming and the performance is impressive. I happened to catch a page with ASPX viewstate on it and was faced with the following error:

ran out of buffer space on element

There are various pages out there which detail the work around and the rumor is that the memory cap is to ensure that the script doesn’t end up consuming everything on the machine. The work around is as follows:

Hpricot.buffer_size = 262144

Judge Nancy Gertner held that a person can not be readily identified merely by an IP address with any “reasonable degree of technical certainty”. This is something that most of the technical community has claimed for years as the RIAA made countless fishing expeditions using universities as unwitting accomplices. It is refreshing to see a judge at the Federal level understand this concept.

“[T]he Court finds that compliance with the subpoena as to the IP addresses represented by these Defendants would expose innocent parties to intrusive discovery,”

Crime does occur on the Internet. However for the last few years many of us have watched with horror as the RIAA violated due process and reasonable expectations of privacy while trying to prosecute these crimes. It is hoped by this author that in the near future the RIAA will conform to the laws of this country by using actual law enforcement instead of unlicensed private investigators and petitioning the court with actual evidence instead of the equivalent of a “lead”.

Clearly the weight of the judicial system is starting to tilt back in favor of the people but it is too soon to celebrate. No judge has yet stepped up to declare 17 U.S.C. § 504(c)(2) to be unconstitutional. With maximum statutory damages set at $30,000 per infringement the defendants absolutely must have representation in the courts. Yet the RIAA end run around this crucial aspect perverts that which is “fundamental to the American scheme of justice.”

Fellow Free Culturist Kevin Driscoll calls out Soulja Boy in this Youtube recording after he received a takedown notice for a video entitled “Crank dat ROFLCon” (I think this is another copy). The irony here is that Kevin is also a grad student at MIT studying hip hop and music video. The video in question literally shows part of his ROFLCon presentation where Kevin explains the phenomenon of Soulja Boy and his rise in popularity due to spreadable media. Has Soulja Boy truly forgotten his roots? Kevin makes the claim that Soulja Boy would never have risen to fame without the thousands of remixes created showing people dancing to “Crank dat” and posted virally all over the Internet. For evidence see [1,2,3,4,5] as a very short list of the thousands out there. Does Kevin have a point? I have to agree that the takedown of his particular video seems strange and could in fact be the result of his label taking actions on his behalf. If Soulja Boy reads this he should email Kevin and let him know that he doesn’t intend to be played by his label and will tell them to back down from aggressive takedowns.

In a 1963 Supreme Court decision Justice Hugo Black opined that every defendant in a criminal case must have access to a lawyer. The right to a fair trial in an adversarial system such as US law depended on both sides having competent representation. Today a story broke about the recent RIAA cases here in Boston where a judge is mirroring the same sentiments. What is interesting about this is the cases in question are civil and not criminal. The RIAA has opted for civil prosecution in the majority of the file sharing lawsuits and for good reason. Civil cases have lax rules surrounding evidence and the defendant is not guaranteed a right to counsel. Judge Gertner remarked that “there is a huge imbalance in these cases. The record companies are represented by large law firms with substantial resources. [The] … counsel representing the record companies have an ethical obligation to fully understand that they are fighting people without lawyers… to understand that the formalities of this are basically bankrupting people, and it’s terribly critical that you stop it….” [warning: pdf]

Maybe its time for another “Gideon” to petition the US Supreme Court. How many thousands have capitulated to the RIAA because they can’t afford an attorney? Despite being tried in a civil court aren’t these cases criminal in nature? Judge Gertner seems to suggest that defendants in RIAA cases are not receiving fair trials which is supposed to be guaranteed by the 6th Amendment. While the 6th Amendment is about criminal law the spirit of it seems to suggest cases where the defendants lives are on the line. At the time of the framing I doubt any civil case could deprive citizens of all their money and possessions. The RIAA’s end run around our legal system is denying defendants “meaningful access to the courts”. How long will this country allow the RIAA to make a mockery of our legal system?

[disclosure] I’m on the board of advisors for this conference

SOURCE Boston 2009 is taking place on March 9th-13th at our new location,
the Seaport Hotel in downtown Boston.

—====/ Confirmed Speakers /=========———


// Keynotes //
Marcus Ranum
Peter Kuper
Amit Yoran

Call for Papers for SOURCE Boston 2009!
Speakers wishing to participate should complete a proposal by
November 30th.

—====/ Training /=========———

This year, we will be adding two days of training (March 9th-10th)

1. Hardware Hacking – Joe “Kingpin” Grand

2. Mobile Device Programming – Christien Rioux

3. Practical Security Architecture – Rob Cheyne

4. Applied Security Visualization – Raffael Marty

—====/ Extras /=========———


Security Business Competition Professional Networking Events

Lightning Talks Expert Panels

The backlash over DRM has finally started to gather serious momentum. Everyday consumers started a campaign to give the highly anticipated game Spore one-star ratings on Amazon. Thousands of Amazon users labeled Spore a poor choice because of the SecuROM DRM system that is forced onto PC users machines that purchase the game. EA has backpedaled a bit and eased the restrictions on the number of installs per machine. They have even made a verbal (but unenforceable) promise to disable the DRM system by patch should they ever end of life the product. But so far EA refuses to give in to consumer demand that they simply get rid of the DRM system. They hold on to the claim that DRM helps reduce piracy. Yet 30 seconds of searching on a popular torrent site shows not only Spore but a cracked copy that totally removes all DRM from the game.

This is possibly the most insulting bit for consumers. People who are pirating the game actually enjoy more freedom in the sense that their system does not have SecuROM permanently installed onto the hard drive. In the recent class action suit the defendants publicly document how the DRM used in Spore remains installed even after the game has been removed from the users computer. SecuROM also operates at “Ring 0″ which is to say the core of the kernel layer which is clever in that it is hard to bypass the program yet dangerous because anything that goes wrong will completely destroy the users session. All of these facts are not made plain to consumers before purchasing the game. Only after they have purchased the game and start installation will they have the chance to read about the DRM system in the EULA. [warning: pdf] Retailers almost never allow returns on software once opened which leaves consumers who don’t agree with the surprise DRM in a very bad position.

So how can EA help end DRM? They can look at what is happening around them and try to understand how miserable their own customers are with the DRM choices they are making. If recent events are any indication they will either start pirating the games or simply stop supporting EA with their purchases. EA can also look at recent history and see the reactions of consumers to retailers who renounce DRM. When online music retailers started renouncing DRM (Amazon and Apple) consumers responded very positively. Not only that but the entire industry started to follow their lead. It is wonderful when smaller producers like Stardock announce intentions on these matters but it will take someone the size of EA to make it an industry trend.

I received what was obviously spam this morning with the subject “VideoTube.com: The Best!”
Because I work on the Youtomb project this sort of caught my attention. The message simply read “eX-eX-eX girlfriend!” and there was a zipped attachment. I detached the file and moved it to one of my test boxes. Once there I unzipped it and ran “strings” on it.

It is definitely some sort of windows based botnet package but I don’t have the time to really investigate it. Leaving behind the strings output to help anyone who runs into this today or in the near future. The first line of intelligible strings output did make me laugh

hi, botnet Jack here
CloseHandle
CreateProcessA
ExitProcess
GetEnvironmentVariableA
GetModuleFileNameA
GetShortPathNameA
GetThreadContext
ReadProcessMemory
ResumeThread
SetThreadContext
VirtualAllocEx
WriteProcessMemory
lstrcatA
lstrcpyA
KERNEL32.dll

Tomorrow is Beansec! For those of you who haven’t heard Zach Lanier has joined us as a full time host of the event. I am semi-retiring for this semester due to classroom obligations but will try to show up for the first half hour or so. I’ll definitely be back in the spring semester!

If you haven’t done so already add the Beansec calendar feed to your favorite scheduling program to make sure you don’t miss out.

Still not sure what Beansec is? Let me explain:
BeanSec! is an informal meetup of information security professionals, researchers and academics in the Greater Boston area that meets the third Wednesday of each month. Unlike other meetings, you will not be expected to pay dues, “join up”, present a zero-day exploit, or defend your dissertation to attend.

It is a great way to meet other security folks from the area in a relaxed atmosphere with absolutely no vendor pitches or formal presentations. Beansec is food, booze and security geeks. Here is a peek at last months Beansec where we had about 30 or so people show up.

The August 08 Beansec was a great success! We filled the entire club with people till well past 10pm. A special thanks goes out to Zach Lanier and Dan O’Neill who picked up the tab for drinks and food in Hoff’s absence. If you see them online or in person make sure you say “thanks” too!