STE WILLIAMS

Supercharge your infrastructure

Security biz RSA has reportedly warned its customers to stop using the default random-number generator in its encryption products – amid fears spooks can easily crack data secured by the algorithm.

All encryption systems worth their salt require a source of virtually unpredictable random values to create strong cryptographic keys and similar things; one such source is the NSA-co-designed pseudo-random-number generator Dual_EC_DRBG, or the Dual Elliptic Curve Deterministic Random Bit Generator, which is well known for being cryptographically weak: six years ago it was claimed that someone had crippled the design, effectively creating a backdoor [PDF] so that encryption systems that relied on it could be easily cracked.

RSA’s BSafe toolkit and Data Protection Manager software use Dual_EC_DRBG by default. Now the EMC-owned company “strongly recommends” customers pick another pseudo-random-number generator (PRNG) in their setups. This comes after documents leaked by whistleblower Edward Snowden allegedly show that the NSA nobbled Dual_EC_DRBG during its inception – which could allow the spook nerve-centre to crack HTTPS connections secured by RSA’s BSafe software, for example.

The suspect algorithm, championed by the NSA according to security expert Bruce Schneier, was given the seal of approval and published by the US government’s National Institute of Standards and Technology (NIST) in 2006. But a year later researchers at Microsoft highlighted fundamental flaws its design: crypto-prof Matthew Green lays out the history and faults of the PRNG here.

Since Snowden’s leaks came to light, NIST has denied weakening this particular PRNG – one of four approved for wider use in 2006 – at the behest of shadowy g-men. However, earlier this month, Schneier said NIST needs to go much further to restore confidence in its practices and procedures, especially when doubts linger about the robustness of Dual_EC_DRBG.

Cryptographers have known for literally years that Dual_EC_DRBG was slow and not especially effective, leading to criticism that RSA was wrong to pick it as a default option for BSafe – and the more paranoid to question its motives.

“Despite many valid concerns about this generator, RSA went ahead and made it the default generator used for all cryptography in its flagship cryptography library,” noted Green late last week. “The implications for RSA and RSA-based products are staggering. In a modestly bad but by no means worst case, the NSA may be able to intercept SSL/TLS connections made by products implemented with BSafe.”

“So why would RSA pick Dual_EC as the default? You got me,” shrugged Green, who is a research professor at Johns Hopkins University in Baltimore. “Not only is Dual_EC hilariously slow – which has real performance implications – it was shown to be a just plain bad random number generator all the way back in 2006. By 2007, when [cryptographers Dan] Shumow and [Niels] Ferguson raised the possibility of a backdoor in the specification, no sensible cryptographer would go near the thing.”

RSA’s CTO Sam Curry defended RSA’s choices in an interview with Ars Technica. RSA is reviewing all its products, he confirmed. Green was unimpressed by the RSA man’s claims.

Curry was quoted as explaining in an email: “The hope was that elliptic curve techniques — based as they are on number theory — would not suffer many of the same weaknesses as other techniques (like the FIPS 186 SHA-1 generator) that were seen as negative, and Dual_EC_DRBG was an accepted and publicly scrutinized standard.”

The NSA’s alleged weakening of encryption algorithms was part of a wider campaign aimed at making it easier for spooks to decrypt supposedly secure internet communications, first outlined in the New York Times two weeks ago. Other tactics include attempting to persuade technology companies to insert backdoors in their products, including it is claimed Microsoft’s Outlook.com, and running so-called man-in-the-middle attacks to hoover up the world’s online chatter and transactions. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/23/rsa_crypto_warning/

Supercharge your infrastructure

“The UK government has made a commitment to reintroduce exit checks by 2015. The Home Office will deliver on this commitment,” said the Home Office in July. Actually, it probably won’t, replied deputy prime minister Nick Clegg.

Home secretary Theresa May told Parliament’s home affairs committee in April that exit checks were tied up with the e-Borders scheme. And that tie-up is why, on this issue, it may be advisable to agree with Nick.

The UK dropped paper-based embarkation controls in 1994 for ferries and in 1998 for everyone else, as they were seen as a waste of time and money. However, this left no comprehensive way of checking if people overstay their visas and limits the government’s knowledge of people leaving the country. There have been plans to bring exit controls back since at least 2006. The reason this has not happened appears to be a classic example of government surveillance overreach.

e-Borders, a £1.2bn system usually preceded by the word “troubled”, was set up by the last government to track all international travel in and out of the UK. It was tied closely to the failed identity card scheme: the former would prove your membership of Club Blighty, while e-Borders would be the bouncer that might let you in or out, in return for your name, passport or ID card details, travel, reservation and payment details. These details would be collected by the carrier, handed over 24-48 hours in advance to the government for risk analysis, then kept for a decade for data mining.

For flights this could be achieved relatively easily, given airlines already ask for lots of data beforehand, and that e-Borders was developed from Project Semaphore, a small-scale pilot focused on a few high-risk flights.

Building an impregnable digital wall along the British border presented an immediate problem: the Common Travel Area shared by the UK, the Republic of Ireland, the Isle of Man and the Channel Islands. That could allow people to get around e-Borders through the Republic, but the last government had a solution – it would require ID cards or passports for travel between Great Britain and Northern Ireland.

Leaving aside the introduction of internal passport checks, e-Borders ran into choppy waters even before Labour left office, with arguments over the legality of demanding advance data, given the EU right of free movement for all citizens of member countries. In 2009, Britain solved this by making e-Borders voluntary for those travelling from elsewhere in Europe – rather undermining it, you might think.

After the 2010 election, the coalition government terminated the contract of e-Borders’ original supplier, Raytheon’s “Trusted Borders” consortium, for poor performance – and ditched both ID cards and the idea of GB-NI passport checks. But it retained the e-Borders system, and the idea that it would eventually cover all international travel.

The system has gathered data on 622 million passenger and crew movements since 2005, and is adding more than 148 million movements a year, with data from 141 carriers on more than 4,700 routes. But expanding a system designed to work with the highly controlled, data-rich environment of air travel to other forms of international transport has not been plain sailing. To leave aside maritime clichés temporarily, take the train.

Signal failures

Eurostar does not participate in e-Borders, and the first and only official check on passengers leaving St Pancras International comes from the French police, just beyond the usually empty UK border desks. Such “juxtaposed” border controls – letting Britain run checks on Continental soil, and vice versa – were first introduced at the Channel Tunnel in 1994 for the sake of convenience.

Le Shuttle, the vehicle train between Kent and Pas de Calais – which does not provide data to e-Borders either, although it is considering doing so for freight customers – has controls at both ends, letting travellers clear both borders before they board. Juxtaposed controls were extended to Eurostar in 2001 and some ferry ports in 2003 in an attempt to reduce asylum claims by preventing undocumented people getting to Britain.

So far, so convenient. But as if to make up for the lack of British checks outbound, on the return journey travellers from Brussels or Lille often have to put up with double checks, at the juxtaposed border controls and St Pancras too. This is due to the “Lille loophole”, highlighted by a July report from the independent chief inspector of borders and immigration, John Vine.

Under the Schengen agreement, there are no border controls between 26 European countries including Belgium and France. Britain is not in Schengen, and the juxtaposed British border officials have no right to carry out an immigration check on someone with a ticket from Brussels to Lille. But a Lille loopholer might try to stay on the train on to Britain – hence the double border checks, and Eurostar sometimes carrying out full ticket checks after Lille but before Calais, where over-stayers can be taken off the train while still in France.

Some of Vine’s report was redacted by Theresa May, including details of “an effective process in the UK to identify passengers who had not had their identity or credentials checked prior to boarding the service in Brussels or Lille.” Whether this refers to something whizzy like facial recognition, or to the fact that on double-checked trains the first set of border guards stamp tickets to let the second ones see who has already been checked, is therefore a mystery. Vine is currently working on an inspection of e-Borders itself.

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/24/uk_surrounded_by_eborder_wreckage/

Supercharge your infrastructure

Karsten Nohl, the security researcher who broke into SIM cards with a single text, has told The Register he is dismayed by the mobile industry’s lukewarm response to his revelations – and has revealed, for the first time, exactly how he did it.

Nohl thought exposing the flaws in SIM security would force the telcos to fix them. Theoretically, the two flaws would have worked in tandem to intercept calls and threaten the security of wireless NFC applications – such as pay-by-wave and other contactless payments.

The German expert now claims that the most serious of the two flaws has been deliberately ignored by an industry that wants to, allegedly, keep the backdoor ajar so that it can silently roll out software updates to handsets… a gaping access route that may not be closed until it’s too late.

Nohl discovered he could infiltrate SIM cards by sending specially formatted SMS messages, and found a flaw that would enable him to break out from the cards’ inbuilt security sandbox. Yet he was astonished to discover that despite publicly announcing patches and giving every impression of caring, the industry had – according to Nohl – actually done nothing to fix the problems.

“We thought our story was one of white-hat hacking preventing criminal activities,” Nohl told El Reg, lamenting that “as there is no crime, so no investigation”. Despite CNN reporting that his own flaw had been used to distribute a fix, Nohl told us that the JavaCard bug was “here to stay” and was so “obvious” that it has to be “a backdoor, gross negligence, or both”.

Safety by numbers

The first exploit, enabling an attacker to install an application in the secure storage area of a SIM card, has been examined in these pages before, but that only represents a threat if the injected software can break out of the JavaCard sandbox. Nohl claimed that was possible, but until now hasn’t explained exactly how.

JavaCard is an operating system, sharing only a name and some syntax with the Java language. JavaCard licensees get a reference implementation from Oracle and then add their own secret source code to differentiate their products, so not all manufacturers’ SIMs had this flaw – but many did.

Java, even the version used by JavaCard, is supposed to be “memory safe” in that there are no pointers with which one can read, or write to, arbitrary locations in memory. Cardlets (as JavaCard apps are known) can only reference data structures they create themselves, and there’s no mechanism for inter-cardlet communications.

What Nohl discovered was that by referencing a variable which referenced a variable which referenced an array he could bypass the bounds check that JavaCard is supposed to perform. Create an array of 10 elements, reference it from a distance and address the eleventh location, and secured memory is yours to explore – and rewrite – as you wish. Exploiting this to malicious ends is left as an exercise for the reader.

Nohl says he warned Gemalto, the world’s largest SIM card manufacturer – which is among those SIM-makers whose cards exhibit the flaw – about the existence of the bug. Gemalto, Nohl alleges, told him that it didn’t matter – only signed applications could be run so their ability to breach the sandbox was irrelevant.

But the researcher points out that in 2010 Gemalto was able to upgrade bank cards in the field after a calendar bug broke millions of German cards. Bank cards are not designed to be upgraded after being issued, and Nohl contends that a similar flaw was exploited then.

The Register put both of Nohl’s allegations to Gemalto, but it had not responded at the time of publication.

GSM standard

It’s the combination of SMS exploit (to gain the application key) and JavaCard flaw (to break out of the sandbox) that makes the situation worrying, along with Nohl’s contention that network operators have become overly reliant on the GSM standard and are losing the skills necessary to secure their systems.

“Smaller networks don’t even know what the SIM cards are configured to do,” he told us. He claimed that in the US, network operator Sprint isn’t authenticating or encrypting SIM updates at all, and that both Vodafone and Telefonica are still issuing SIM cards with the insufficiently secure 56DES cryptography.

We’ve asked Voda and Telefonica about Nohl’s claims, but only had a response from Vodafone UK by the time of publication: the telco said that (in the UK at least) strong encryption has been mandated for “many, many, years”.

This is still quite an obscure attack, requiring a hacker familiar with the memory layout (the soft mask) of the SIM, and one prepared to send the multiple SMS messages necessary to crack the software update key. For the moment the effort probably outweighs the payoff, but that will change as SIMs increasingly host banking and loyalty apps (as well as popular social networking services like Facebook Chat), making them a more attractive hacker target.

As Nohl put it: “Skills are underdeveloped because the crimes are underdeveloped … crime is even more convincing than anything.”

Until there’s a serious crime using this insecurity, the vulnerabilities in our SIM cards will probably remain. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/23/white_hat_sim_hacker_disillusioned_and_dismayed_by_operator_response/

Supercharge your infrastructure

Infamous US spy agency the NSA is looking to appoint a Civil Liberties Privacy Officer.

The challenging position is an internal posting, aimed at potential candidates who already work at the top secret spy agency. The new role parcels separate responsibilities of NSA’s existing Civil Liberties and Privacy (CL/P) protection programs in a single job function, as job ad 1039797 explains.

The NSA Civil Liberties Privacy Officer (CLPO) is conceived as a completely new role, combining the separate responsibilities of NSA’s existing Civil Liberties and Privacy (CL/P) protection programs under a single official. The CLPO will serve as the primary advisor to the Director of NSA for ensuring that privacy is protected and civil liberties are maintained by all of NSA’s missions, programs, policies and technologies. This new position is focused on the future, designed to directly enhance decision making and to ensure that CL/P protections continue to be baked into NSA’s future operations, technologies, tradecraft, and policies.

The NSA CLPO will consult regularly with the Office of the Director of National Intelligence CLPO, privacy and civil liberties officials from the Department of Defense and the Department of Justice, as well as other U.S. government, private sector, public advocacy groups and foreign partners.

Key responsibilities include advising NSA director Keith Alexander and the senior leadership team to ensure that all agency activities “appropriately protect privacy and civil liberties consistent with operational, legal, and other requirements.”

Another aspect of the job will include making sure “privacy protections are addressed as part of all internal strategic decision processes related to the agency’s operations, key relationships, tradecraft, technologies, resources or policies.”

The successful candidate ought to be “well known and highly regarded by US privacy and civil liberties protection professionals.” Substantial knowledge of telecommunications and internet privacy is required and legal experience is preferred.

The ongoing Snowden revelations about the NSA’s indiscriminate spying on private communications over the internet make the role particularly challenging. Anyone applying for the role would do well to familiarise themselves with the Electronic Frontier Foundation’s handy guide to decoding NSA doublespeak.

When senior NSA officials maintain that keeping track of phone conversations, for example, doesn’t count as surveillance, then any privacy officer is going to have a difficult job. In fact, we can think of few more difficult jobs since the post of Staff Rabbi to the Spanish Inquisition. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/24/nsa_privacy_officer/

Supercharge your infrastructure

The UK’s Get Safe Online campaign has failed to teach Brits how to secure their computers – so says the ex top cop who established the information security awareness effort in 2004.

John Lyons, former crime reduction coordinator at the National Hi-Tech Crime Unit, said the Get Safe Online project had done “little to change attitudes”.

“If you lose money from your bank account the banks give it back to you. Nobody cares. Until it hurts you won’t get a change in behaviour,” Lyons said. He added that “upcoming security threats” are starting to put people in danger.

Lyons, now chief executive of the International Cyber Security Protection Alliance (ICSPA), was speaking at an event in London ahead of the publication of a white paper on emerging online threats, titled Scenarios for the future of cybercrime. The white paper is the first of its kind to emerge from the ICSPA’s Project 2020, which was put together with the EU’s European Cyber Crime Centre (EC3).

The study warns that attacks on computer networks could soon threaten critical infrastructure and that wearable technologies (from today’s gadgets to the future’s Google Glass-like contact lenses) will be – like anything electronic – hacked. Techniques developed to beat biology-based authentication systems, such as fingerprint recognition, will also be a major headache.

Trend Micro will accompany the publication with a series of ten 3 to 5-minute web videos to get people thinking about ways in which their systems could be compromised.

The production values for the videos, starring professionals actors, are very high and the overall feel from the preview was reminiscent of spy and torture serial 24, although we’re assured that the overall feel is more like a police procedural. The series attempts to reach a non-tech-savvy audience beyond the community of security experts and cops to promote security skills. The most obvious target audience is young adults, though backers of the scheme want to reach young kids.

Lyons added that the aim of the “accessible video” was to educate politicians and citizens, particularly youngsters who were still in primary and secondary education. He compared the campaign to public awareness campaigns designed to encourage people to quit smoking.

Troels Oerting, head of EC3, said he intended to talk to Euro officials about pushing the campaign through schools.

Rik Ferguson, global veep of security research at Trend Micro, added “people tend to adopt technologies and think about security issues later, if at all. Facebook is a prime example. We are aiming to change behaviours”.

He explained that the theme of the web video series was protecting one’s data, specifically showing people asserting control over their personal information, and what the internet of things will mean for sharing of our private details. He denied the hacking risks depicted in the web video will spread FUD by talking up security threats to technologies that are still at the very early stages of development (see the above reference to contact lenses – that’s their idea, not ours).

“We’re raising awareness about tech possibilities and associated risk,” he said. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/25/gets_safe_online_has_failed_to_change_behaviours/

Supercharge your infrastructure

Google has yanked an app that purported to give Android users the ability to use iMessage.

As is discussed by Jay Freeman here, there was a catch in the app. It didn’t “make iMessage run on Android”, but rather sent data off for pre-processing to a server in China.

And that meant users were being asked to submit their Apple ID and password to a third party – a no-no from any point of view (The Register would guess it’s a good idea for anyone that tried the application to run a password reset immediately).

As Freeman writes, the “sub-optimal” operation of the app went like this: “Every packet from Apple is forwarded to 222.77.191.206, which then sends back exactly what data to send to Apple (along with extra packets that I presume tell the client what’s happening so it can update its UI). Likewise, if the client wants to send a message, it first talks to the third-party server, which returns what needs to be sent to Apple. The data is re-encrypted as part of this process, but its size is deterministically unaffected.”

To convince the Apple iMessage servers it was legit, the app apparently disguised itself as a Mac Mini, as noted by developer Alan Bell on Twitter:

So it looks like that iMessage on Android hack is super sketch and is spoofing iMessage requests as a mac mini: pic.twitter.com/TYT6Djumdv

— Adam Bell (@b3ll) September 24, 2013

Bell also noted that a chunk of the APK file is obfuscated, while another Twitter user, developer Steve Troughton-Smith, asserted that the app also had the ability to background-download APK files.

Whether the app’s behaviours were clumsy or a deliberate attempt to harvest user credentials, it violated Google Play’s policies and has been dumped. The putative developer’s Website, huluwa.org, is also offline at the time of publication. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/24/dodgy_imessage_for_android_app_deepsixed_by_google/

SAN FRANCISCO, September 23, 2013 – Today, Interop, produced by UBM Tech, previews exhibitor announcements to break at next week’s Interop New York, taking place September 30 – October 4 at the Javits Convention Center. As the leading independent technology conference and expo series designed to inform and inspire the world’s IT community, Interop serves as a launch pad for vendors to introduce the most innovative technologies in business IT. To register or for more information, visit interop.com/newyork.

Click here for more articles from Dark Reading.
Click here to register to attend Interop.

“Interop New York exhibitors will showcase the most cutting-edge IT tools and solutions for increased business productivity,” said Jennifer Jessup, Interop General Manager. “We’re expecting big announcements from both the keynote stage and expo floor, and are proud that Interop proves to be a hub for news, setting the pace for the future of IT with opportunities to interact firsthand with the latest advancements in the marketplace.”

Below is a preview of announcements exhibitors will release from Interop New York:

AirWatch (Booth #513), the largest Enterprise Mobility Management (EMM) provider, will showcase AirWatch Workspacetrade, a secure containerized solution for all enterprise data including email, applications, content and browsing.

Chatsworth Products (CPI) will display its new F-Series TeraFrame Gen 3 Cabinet including CPI Passive Cooling Solutions, as well as Zone Cabling Enclosures. The TeraFrame Cabinet will feature CPI’s Glacier White finish, which is now a standard color for most products. Visit Booth #542 for hands-on interaction and more information.

Ciena (booth #419) will showcase its packet networking and converged packet optical solutions, and introduce new packet networking products designed to accelerate deployment of 10 Gigabit Ethernet services in the metro network.

Cisco’s CEO, John Chambers will discuss a hot industry topic and announce news from the keynote stage on opening day. Additionally, the company’s Enterprise Networking Group will announce exciting new updates appealing to retailers, hotels and other vertical markets, as well as to consumers.

Cube Optics launches a line of DWDM solutions permitting 100Gbps upgrades. They are enabling metro networks to evolve via a technologically seamless roadmap and are fully interoperable with existing and future equipment and deployable within the space and power constraints of existing infrastructure. Evolve to 100Gbps at Booth 648.

Elfiq Networks is pleased to announce the release of the company’s new Flex Multipath Routing Solutions, also referred to as FMR, designed for Enterprise and SMB businesses looking to optimize their bandwidth while lowering their costs by load balancing site-to-site WAN traffic between private and internet links.

FileCatalyst (booth 126) will unveil the latest version of its flagship accelerated and managed file transfer solution, FileCatalyst Direct 3.3. This release introduces the ability to streamline the transfer of large file sets using several concurrent connections and to dynamically pick up new files as they’re added in real time.

HP will announce big news around SDN at Interop NY next week, including new networking support and services.

Interface Masters announces an industry first, highest density modular sixteen segment Intelligent Active Bypass Switch, the Niagara 2822, that can handle 1Gb, 10Gb, and 40Gb Inline Network Monitoring Devices. Interface Masters also announces, Niagara 3225PT, a 25 segment passive TAP in a 1U. These will be presented at Booth #632.

NCP engineering (booth #729) will showcase the latest versions of its hybrid IPsec / SSL VPN gateway and centrally managed IPsec VPN client suite, which maximize enterprise security and remote access performance with elliptic curve cryptography. The company will also demo its Android IPsec VPN clients that optimize enterprises’ connections.

NEC plans to demonstrate its ProgrammableFlow Software-Defined Network suite, which includes the latest version of its data center-grade SDN controller. The company also plans to showcase its SDN ecosystem, which contains SDN-powered applications from multiple NEC partners.

NetSupport Inc is showcasing all new NetSupport Manager 12, Remote Control software; with the addition of Windows 8 / 8.1, and improved mobile device support. Together with a new look and feel, connectivity is enhanced by a unique PIN Connect feature and innovative GEO locate for geographical user grouping plus more.

Obsidian Strategics (#347) presents their Obsidian Longbowtrade products, which enable remote InfiniBand LAN fabrics to be transparently, securely and natively connected across standards-based metro or global area networks.

One Convergence will preview their Network Virtualization and Service Delivery solution for Openstack cloud environment. The software overlay based solution enables self-service multi-tenant networks and network services to be created, provisioned and managed on demand and provides significant value proposition for delivering L4 to L7 services.

Opengear (booth #638) continues its growth in integrating information and operational technology (IT-OT) through new remote management solutions that offer enhanced environmental monitoring, more robust memory capabilities, and faster out-of-band connectivity. Opengear’s popular ACM5000 product line will be on display and feature new iterations with strategic IT-OT functionality.

ScienceLogic (booth #511) announces a number of new powerful features for its IT monitoring solution,

including: the ability to take actions on groups of devices at the same time and new and enhanced monitoring for AWS, VMware, NetApp, F5, and others. ScienceLogic’s new release was selected to manage the InteropNet NOC.

SolarWinds, IT management software provider, will demonstrate SolarWinds Server Application Monitor 6.0, which offers IT professionals one complete solution for greater visibility across server, application and database environments with new Microsoft SQL Server monitoring, baseline thresholds and IT asset inventory management. Stop by booth #337 for more information.

Verax Systems at booth #137 will be demonstrating the latest version of their IT Management Suite, a set of pre-integrated, service-oriented applications covering end-to-end IT Management with short turn up times enabling IT departments to simplify, automate and reduce costs of IT management.

Xi3 Corporation will showcase its ecofriendly, small form factor desktop computers, servers and data center solutions in booth #401 at Interop NY 2013, including the new Z3ROtrade Pro Computer and X7A Modulartrade Computer, and the forthcoming Xi3 microSERV3Rtrade, as well as Xi3’s Motorized dataCENT3Rtrade and its FreeForm dataCENT3R.

Zoom Video Communications and AVer Information Inc. announce their technology partnership combining Zoom’s cloud HD meeting platform with AVer’s sub-$1000 EVC100 endpoint to bring affordable, interoperable video conferencing to large corporations, SMBs and universities. This move democratizes enterprise-grade video conferencing for businesses looking to cut costs and streamline communications. #605.

These sponsors and vendors will join 120 exhibitors on the Expo show floor, open both Wednesday and Thursday, 11:00 am to 5:00 pm. In addition, Interop New York presents a robust conference program with keynote presentations and six presentation tracks, including Cloud Computing Virtualization, Mobility and Business of IT. Interop features the InteropNet and includes two full days of workshops, as well as the InformationWeek CIO Summit and the Mac iOS IT Conference. For a full schedule and to build your own agenda, see the Interop Session Scheduler.

Watch Interop video updates on YouTube.

Follow Interop on Twitter; tag tweets #Interop.

Like Interop on Facebook.

Add Interop to your circle on Google+.

Post Interop photos to Instagram.

About Interop

Interop provides the knowledge and insight to help IT and corporate decision-makers bridge the divide between technology and business value. Through in-depth educational programs, workshops, real-world demonstrations and live technology implementations in its unique InteropNet program, Interop provides the forum for the most powerful innovations and solutions the industry has to offer. Interop Las Vegas is the flagship event held each spring, with Interop New York held each fall, and annual international events in Mumbai and Tokyo, all produced by UBM Tech and partners. For more information about these events, visit www.interop.com.

About UBM Tech

UBM Tech is a global media business that provides information, events, training, data services, and marketing solutions for the technology industry. Its media brands and information services inform, educate and inspire decision makers across the entire technology market–serving engineers and design professionals, software and game developers, solutions providers and integrators, networking and communications executives, and business technology professionals. UBM Tech’s industry-leading media brands include EE Times, Interop, Black Hat, InformationWeek, Game Developer Conference, Byte, CRN, and DesignCon. The company’s information products include research, education, training, and data services that accelerate decision making for technology buyers. UBM Tech also offers a full range of marketing services based on its content and technology market expertise, including custom events, content marketing solutions, community development and demand generation programs designed to help vendors identify and participate in technology buying decisions. UBM Tech is a part of UBM (UBM.L), a global provider of media and information services with a market capitalization of more than $2.5 billion.

Article source: http://www.darkreading.com/interop-new-york-sponsors-exhibitors-la/240161697

The biometrics team of Germany’s well-known Chaos Computer Club (CCC) claims it has “cracked” Apple’s Touch ID system.

Touch ID is the fingerprint sensor and the associated software that provides a biometric lock for the brand new iPhone 5s.

Fingerprint readers have been common add-ons to laptops for many years, but never really caught on.

Here’s why.

Firstly, fingerprints aren’t secret.

All of us inadvertently leave good-quality prints on many surfaces, such as glass, metal and hard plastics.

Additionally (in many countries in the post-9/11 world) many of us deliberately, often unavoidably, have allowed the authorities, our employers and even businesses such as banks to take high-quality copies of our prints, and to keep them pretty much for ever.

Secondly, you can’t change fingerprints if there’s a breach, like you can an ephemeral password.

Thirdly, fingerprint sensor technology has been found wanting in the past, with glue, gelatin and even photocopies with a very thick layer of toner being used as copies that would pass muster as a real finger.

Fourthly, when you’re logging into your laptop, being able to use your fingerprint doesn’t add an awful lot of convenience.

You’ve already got a perfectly servicable keyboard in front of you when you open up your laptop, on which you are probably going to type your username anyway, so why not just stick with what you know: a typed-in password?

Fifthly, there’s something unappealing to many people about using biometric data such as fingerprints, DNA or retina scans for anything but the most serious matters of identification.

Biometric objections typically lie somewhere between the visceral and the spiritual, which makes them hard to quantify.

But it is perfectly understandable (laudable, even) to be uneasy about using “something you are” as a way of identifying yourself, especially if it’s merely to use a piece of computer hardware you already own outright.

Nevertheless, despite these objections, Apple’s Touch ID is supposed to be – may yet still be! – the biometric implementation that will change all this.

It’s built in to the new iPhone 5s, right in the button you press to start everything up anyway; it seems to work reliably, so it doesn’t lock you out all the time; and it doesn’t store digital copies of your fingerprints centrally where they might leak to the world in a data breach.

Better yet, it means you don’t need to type in a complicated password on the iPhone’s fiddly on-screen keyboard.

Best of all, it works conveniently even for people who would rather do without a regular passcode altogether, so for many users, it might succeed entirely on the basis that “something’s better than nothing.”

As Apple itself very proudly points out on its website:

You check your iPhone dozens and dozens of times a day, probably more. Entering a passcode each time just slows you down. But you do it because making sure no one else has access to your iPhone is important. With iPhone 5s, getting into your phone is faster, easier, and even a little futuristic. Introducing Touch ID — a new fingerprint identity sensor.

Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password.

The only fly in the ointment now is that it looks as though Touch ID isn’t “highly secure,” after all.

It’s perhaps not as futuristic as Apple thought, either: the CCC hackers say that they used a technique documented in CCC materials back in 2004.

Greatly simplified, the fingerprint cloning process works like this:

• Take a hi-res (2400dpi) photograph of the fingerprint.
• Digitally invert the image so that the valleys of the print are black.
• Laser print (1200dpi) the image with a very thick toner setting.
• Smear white woodglue (or latex) over the printout and allow to set.
• Carefully peel off the glue or latex sheet.
• Breathe on the surface so it’s slightly moist and conductive.
• Unlock phone.

So last decade!

The really intriguing aspect of the claim is that the CCC guys didn’t start with a photograph taken directly from a finger, which would typically require some sort of co-operation (or heavy inebriation) on the part of the victim.

They say that they used:

…the fingerprint of the phone user, photographed from a glass surface.

The next question is, will they, can they, claim the crowdsourced prizes on offer for doing what they say they did?

And the final question: should you use Touch ID?

I’m the wrong person to ask, because I’d probably say, “No!” on the basis of point 5 alone – a visceral sense that I’d simply rather not do so, especially since I know how to type perfectly well.

My advice, then, is to consider points 1, 2 and 3 above.

If you’re happy in the face of those objections, and you aren’t fussed by point 5, then…

…hey, it’s better than no passcode at all!

Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/kPZenY6Vgx4/

No, LinkedIn most certainly does not sink its marketing fangs into users’ private email accounts and suck out their contact lists – well, at least, not without users’ permission – the company said over the weekend.

Blake Lawit, Senior Director of Litigation for LinkedIn, on Saturday responded to a class action lawsuit brought last week by four users who claimed that the professional networking site accesses their email accounts – “hacks into,” to use the diction of the lawsuit – without permission.

Lawit’s statement denies the plaintiffs’ accusations:

We do not access your email account without your permission. Claims that we “hack” or “break into” members’ accounts are false.
We never deceive you by “pretending to be you” in order to access your email account.
We never send messages or invitations to join LinkedIn on your behalf to anyone unless you have given us permission to do so.

On Tuesday, four LinkedIn users in the US filed the complaint, which alleges that the company “hacks into” users’ email accounts, downloads their address books, and then repeatedly spams out marketing email, ostensibly from the users themselves, to their contacts.

The suit charges LinkedIn with fuzzily-worded requests and notifications when it comes to just what, exactly “growing” a user’s network entails.

On the screen labelled “Grow your network on LinkedIn”, presented when a new user signs up for the free service, LinkedIn works its marketing sneakiness, the suit says, getting into a user’s email account without a password and then snapping up contacts and the email address for anybody with whom he or she has ever swapped email:

LinkedIn is able to download these addresses without requesting the password for the external email accounts or obtaining consent.

If a LinkedIn user has logged out of all their email applications, LinkedIn requests the username and password of an external email account to ostensibly verify the identity of the user.

However, LinkedIn then takes the password and login information provided and, without notice or consent, LinkedIn attempts to access the user’s external email account to download email addresses from the user’s external email account.

If LinkedIn is able to break into the user’s external email account using this information, LinkedIn downloads the email addresses of each and every person emailed by that user.

The suit mentions “hundreds” of user complaints about the practice on LinkedIn’s own site.

It’s not difficult to see why users might well be appalled, given some of the situations they describe on the site’s help center thread on the topic.

One user, Cynthia Hubbard, describes LinkedIn invitations getting sent out “at [her] alleged behest” to a coworker with whom she “had a great deal of trouble”, to five individuals from opposing in-house counsel and corporate defendants in a lawsuit she was involved in, and to a worker’s compensation client she referred to another law firm and whom she would never personally invite to her contact list, among others.

One reader commented on my coverage last week that he or she had read an account on another posting of this story, about a psychologist whose professional email messages to patients had triggered invitations to connect that were actionable malpractice breaches for which he could face disciplinary action.

In his statement, Lawit says that LinkedIn most certainly gives users the choice to share email contacts and that the company “will continue to do everything we can to make our communications about how to do this as clear as possible.”

From what I can suss out, LinkedIn does tell users what it’s up to, but the language is hidden away and is a far cry from “as clear as possible.”

Users have been decrying LinkedIn’s practices for months, at the very least, without any satisfaction.

It’s easy, in a case like this, to blame users for not reading the fine print. That logic holds that free services are only free from a financial standpoint, but you pay, one way or the other, to keep them alive, including letting a service like LinkedIn vacuum up your contacts for marketing purposes.

There’s merit to that argument.

Then again, there’s no excuse for tucking your marketing practices away where they’re not obvious to users.

The hallmark of clear communication is that you don’t wind up with pages full of comments from outraged, surprised users. And that is exactly what LinkedIn is dealing with now, with the added problem that all that user surprise and outrage has festered and is now boiling up into the legal realm.

Follow @LisaVaas

Follow @NakedSecurity

Image of email access and checking email courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/SYJZ6LKmdiM/

A coalition of US groups that advocate for teenagers is crying foul over proposed changes to Facebook policy that would rubber-stamp the use of teenagers’ names, images and personal information to endorse products in advertisements.

The coalition, which includes over 20 public health, media, youth, and consumer advocacy groups, sent a letter to the Federal Trade Commission (FTC) on 17 September asking that the government take a closer look at how the proposed changes will expose teenagers to the same “problematic data collection and sophisticated ad-targeted practices that adults currently face.”

The changes to Facebook’s Statement of Rights and Responsibilities will give the site permission to use, for commercial purposes, the name, profile picture, actions, and other information of all of its nearly 1.2 billion user base, including teens.

The group also objects to new language, directed at 13-17 year-old users, that says that if you’re a teenager, and you’re on the site, Facebook assumes it has consent from your parent or legal guardians to use your information.

The proposed language:

If you are under the age of eighteen (18), or under any other applicable age of majority, you represent that at least one of your parents or legal guardians has also agreed to the terms of this section (and the use of your name, profile picture, content, and information) on your behalf.

Joy Spencer, who runs the Center for Digital Democracy’s digital marketing and youth project, said parents, for one, should be worried about the proposed privacy policy changes:

These new changes should raise alarms among parents and any groups concerned about the welfare of teens using Facebook. By giving itself permission to use the name, profile picture and other content of teens as it sees fit for commercial purposes, Facebook will bring to bear the full weight of a very powerful marketing apparatus to teen social networks.

The coalition for teens is just the latest to join in the hue and cry over the proposed privacy policy changes.

On 4 September, the top six privacy organisations in the US – the Electronic Privacy Information Center, Center for Digital Democracy, Consumer Watchdog, Patient Privacy Rights, U.S. PIRG, and the Privacy Rights Clearinghouse – sent a joint letter to politicians and regulators asking that some of Facebook’s proposed changes be blocked.

Facebook had issued the proposed changes as part of an agreement that was made in settlement of a class-action lawsuit.

However, the changes would actually weaken the privacy policy’s wording, this earlier letter claims, and would violate a 2011 privacy settlement with the FTC.

Furthermore, the amended language regarding teens “eviscerates” limits on commercial exploitation of the images and names of young Facebook users, the letter states.

It reads:

The amended language involving teens – far from getting affirmative express consent from a responsible adult – attempts to “deem” that teenagers “represent” that a parent, who has been given no notice, have consented to give up teens’ private information. This is contrary to the Order and FTC’s recognition that teens are a sensitive group, owed extra privacy protections.

Facebook was supposed to update its policy two weeks ago but has delayed the decision following the six consumer watchdog groups’ petition of the FTC to block the changes.

In an emailed statement to the LA Times, Facebook said that it put on the brakes in order to get this thing right:

We want to get this right and are taking the time to review feedback, respond to any concerns, and clarify the explanations of our practices. We routinely discuss policy updates with the FTC and are confident that our policies are fully compliant with our agreement.

In my opinion, Facebook won’t get it right until it embraces the radical notion of opt-in as opposed to making users continually jump through hoops to opt out of having their personal information used in ever new ways.

As far as deemed consent goes, it’s ludicrous to presume that teens on Facebook are a) there with their parents’ blessing and b) that that presumed blessing somehow includes letting their child’s likeness be plastered onto every money-generating shill that Facebook advertisers can cook up.

The proposed changes predate last week’s truly awful incident, when a Facebook advertiser got hold of two images of a gang-rape and suicide victim and used them in dating ads.

That dating company has since gone offline, its Facebook account has been shuttered, and Facebook has apologized.

The proposed changes go beyond teens’ images, of course, to encompass all their personal data, including their posted activities. Do we really think that the online history of children should be fair game for Facebook, when even adults leave often breathtakingly embarrassing, not to mention career-threatening, trails?

As far as images in particular go, perhaps the case I mention is only tangentially related to the proposed privacy policy changes. Maybe it just comes to mind because it tastelessly featured images of a teen who met a horrific fate.

Maybe it comes to mind because the images of children, to my mind, should be considered too precious to play games with, or perhaps even to generate profits from.

Follow @LisaVaas

Follow @NakedSecurity

Image of girl on phone courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ITxCxBnJ9js/