Uncategorized


Recently China implemented new restrictions on the use of Virtual Private Networks (VPNs), by introducing the requirement for VPN providers to be registered with the Chinese Government. VPNs are very popular in China as a means of getting around the Chinese Government’s internet monitoring and censorship programme that goes under the euphemism of the “Great Firewall of China”.   Given the ability of VPNs to break state censorship it is not surprising that the Chinese government has initiated a clamp-down on their use. The internet monitoring busting capabilities of VPNs is something that the UK Government may have to face in the near future following the introduction of the Investigatory Powers Act (IP Act) and the Digital Economy Act (DE Act).  Both of these will drive an increased use of VPNs in the UK. In the case of the IP Act VPNs are likely to be employed by internet users to […]

What Chance a UK Ban on VPNs?


Two recent news articles highlight issues with the database state and the fallacy of the “nothing to hide, nothing to fear” argument so often used to claim surveillance is not something the law abiding should be worried about. The first was a report in the Guardian that 17 people had been mistakenly arrested, due to incorrect telephone information or Internet records being provided to the Police or other public bodies investigating crime. The other was an article resulting from a Daily Mail investigation concerning people having county court judgements awarded against them, without them even knowing that proceedings had been issued against them or anything about the court case. In both these cases information has been processed on individuals without their knowledge and with not even basic checks on the accuracy of the information being made by the Police, security or court services.  This in itself scandalous given the serious […]

Data is There to be Processed – But as Cheaply ...


Campaign group NO2ID [1] says a provision tacked on to the Digital Economy Bill announced in the Queen’s Speech hides “a revolution in government”, “a Whitehall coup”. Little notice has so far been taken of the bland-sounding “use of data to deliver government services” [2], but the underlying proposals [3] would create new rules for information about individuals and companies held by government. Information given in confidence for one purpose, could be later taken by officials and used for another, without any specific political or legal authority.[5] This is to be embedded in a Bill mainly concerned with broadband provision and internet regulation. Guy Herbert, General Secretary of NO2ID said: The idea that information we give to government stops being ours and starts being official property won’t go away. In 2009 the last Labour administration sneaked something similar into the Coroners and Justice Bill – and had to withdraw it […]

“Whitehall coup” hidden in Queen’s Speech – Press Release



The Investigatory Powers Bill has been introduced to parliament in an attempt by the Home Office to rush it through the Commons before the European referendum. Contained within the Bill are new and broadly drafted powers that would enable police and intelligence to have general warrants to demand data from any organisation that stores it, and match, mine, share, and cross-reference it. Guy Hebert General Secretary of NO2ID says “These sweeping powers are in addition to the existing self-authorised powers over communications data for specific investigations already granted to a wide range of public bodies. General warrants could specify broad types of information and purposes, leaving the security forces free to demand any information from anyone about anyone as suits their mass surveillance brief. That’s so vague as to cover anything, from the computer network at your child’s school, to shopping records, details of phone downloads, messaging, or CCTV records” […]

Database state: authorities could demand your data from any organisation ...


An article on the Techdirt website about the ease with which a Smart Kettle can be hacked has highlighted the dire state of device security for the ‘Internet of Things’. The iKettle by allows users to remotely turn it on from anywhere using a Smartphone App.  However, researchers have pointed out that the Kettle is relatively easy to hack especially if the user has not configured the kettle properly.  The company that produces the iKettle has said its associated Android and iOS APPs would be upgraded to eliminate the security vulnerabilities.  However, there is still the wider problem of ‘Internet of Things’ devices opening up vulnerabilities in people’s home networks, especially where device security is an afterthought. The advice the researchers give is to not put ‘Internet of Things’ devices on your network unless you are absolutely sure they are secure.

Easily Hacked Kettle Highlights the Lack of ‘Internet of Things’ ...


4
Nikolaj Nielsen reports in the EU Observer that France is proposing that all travelling EU nationals should be required to give their fingerprints and possibly also have their faces scanned as part of the Smart Borders programme. Smart Borders was proposed in 2013 by the EU Commission to allow management of the external borders of the Schengen Member States.  Biometric scanning of visiting non-EU nationals was also included in the scheme.  It has been on hold for a while due to cost concerns; however, an updated plan for the scheme is expected before the end of the year. In a document submitted by the French delegation it is claimed that an expanded Smart Borders scheme is required to address terrorist threats and gives examples such as the Charlie Hebdo attack in Paris and the recent attack on an Amsterdam to Paris train to justify their proposal.  Further justifications include dealing […]

France Wants all Travelling EU Nationals Fingerprinted



2
A team at WP Engine have conducted an interesting analysis of some 10 million passwords that had been collected from various sources such as leaks and dumps of passwords.   Virtually none of the passwords were still in use so the researchers considered that it was ethical to use the dataset in their research. The analysis highlights that people tend to choose passwords based on defined patterns and what comes into their mind when asked for a password.  So it is not surprising that in the 50 most used passwords, the most common text-based password is the word password itself.  However, the use of patterns does often make guessing passwords very easy, especially for password cracking software such as HashCat which can make up to 300,000 guess at a password per second. Other patterns identified were people adding their year of birth to their name to create a password and an […]

What 10 million passwords reveal about the people who choose ...


The BBC news website reports that More than 11 million passwords stolen in the Ashley Madison website hack have been decoded by a password cracking group. Initially, it was thought that the hacked passwords were unbreakable because hashing with bcrypt had been employed which effectively scrambles the password.  However, an amateur password cracking group called Cynosure Prime has discovered that the site had at some point changed the way passwords were stored, which reduced the strength of the bcrypt protection.  As a result the group have been able to crack 11 million passwords scrambled since the changes were made. Exactly, why Ashley Madison changed the way passwords were stored is not known, but it is speculated that it was done to make accessing the site easier. In a previous Newsblog post it has been highlighted that it is often the case that the reputational and financial impact on companies from […]

Flaws found in Ashley Madison password protection


Anna Hodgekiss reports on the Mail Online that a sexual health clinic in London’s Soho has revealed the names of up to 780 HIV positive patients in an e-mail error. The error involved patients who had signed up to the Clinic’s Option E service when a monthly newsletter was sent out. It appears to have occurred when the newsletter was sent out using an open group circulation list rather than as a blind copy. The clinic tried to recall the message using Microsoft Outlook’s recall function and then sent another e-mail apologising for the error and asking recipients to delete the message. Comment from the Newsblog Editor: A mistake like this is easy to make on an e-mail client like Microsoft’s Outlook, where an e-mail list can easily be mistakenly copied into the wrong field and sent out as a CC (carbon copy) to all recipients, rather than as a […]

Hundreds of HIV-positive patients have their identities revealed in e-mail ...



In a very interesting article on the Slate website Kevin Bankston highlights that despite claims by some law enforcement officials that encryption is a tool that will allow criminals to evade justice, the use of strong encryption actually helps to reduce crime. Bankston points out that although it is true that criminals will make use of encryption technology to shield their activities, the use of the technology will overall prevent millions of crimes.  For example smartphone theft is at epidemic proportions, with millions being stolen annually which often involves robberies which are by definition violent crimes.  However, strong encryption will block the criminals from using the commonly available tools to unlock a smartphone, rendering it useless to them. The article also highlights that criminals are increasingly not just interested in the phone, but also the personal and other data contained on it which can for example, allow them to commit […]

Smartphone encryption will help cops more than it hurts them


Sally Adee discusses in an article in New Scientist magazine whether it is possible to permanently delete a social media profile. The article highlights the situation with the recently hacked Ashley Madison website (an adultery website) which guaranteed to remove all members date upon payment of a £15 fee.  However, the recent hacking of the site has highlighted that due to financial auditing requirements, credit card details and the name used to scrub the account have been retained.  This obviously defeats the point of the user paying to have their records removed. Many sites such as Facebook have ambiguous policies on deleting data and what data is actually deleted after a user deletes their account.  This is compounded by the fact that deleting digital records is not necessarily as straight-forward as it seems, as account information may be held in multiple data centres distributed across the world. The problem with […]

Is it Possible to Permanently Delete a Social Media Profile?




2
Ellen Nakashima reports in the Washington Post that the recently discovered hack (see previous post here) by the Chinese of the US Office of Personnel Management, has included a database holding sensitive security clearance information on US Government workers and contractors. Joel Brenner, a former US counter­ intelligence official said about the news, “This is potentially devastating from a counter­ intelligence point of view,”  “These forums contain decades of personal information about people with clearances . . . which makes them easier to recruit for foreign espionage on behalf of a foreign country.” Sir Tim Berners-Lee has previously highlighted the dangers of blackmail if foreign spy agencies get hold of data on persons with access to national security information, although in the context of the retention of web surfing and phone records – see here.

Chinese Hack has Compromised US Security Clearance Database


1
David Barrett reports in the Daily Telegraph that telephone masts which can listen to mobile phone conversations without the owner’s permission are being operated in Britain. The devices, technically known as IMSI catchers, but also referred to stingrays, trick handsets into thinking they are genuine mobile phone towers in order to monitor calls and other data including texts and emails.  They have been used in a number of foreign countries to target the communications of criminals, but are difficult to use in a targeted manner and will also hoover up data from innocent people’s mobile phones. Police have refused to discuss whether they are behind the installation of the masts, at least 20 of which were uncovered in London in an investigation by the Sky News television channel.

Fake Mobile Phone Masts Spy on your Calls


Maggie Ybarra reports in the Washington Times that FBI agents cannot identify any major terrorism cases they have cracked using the snooping powers in the US Patriot Act. The revelation is interesting given the claims of its supporters that powers provided by the act such a bulk phone data collection, were critical to national security and had to be retained. The Patriot Act expired on Monday (1st June) and some (see here) of its surveillance powers were incorporated into the USA Freedom Act which was approved by Congress on Tuesday (2nd June).  Amongst the powers transferred was the power to enable bulk phone data collection; however, on a positive note this data can now only be accessed with court permission.

FBI Admits That No Major Cases Cracked by Patriot Act ...