Chinese Deny Hacks of Two Countries

China denies that the type of hacks it has been working on, military intrusions, is not what it has done to the Pentagon network.

Yesterday, China denied that in June it had attempted to access the Pentagon. This is not the first accusation.

Jiang Yu, a foreign ministry spokeswoman, denied the charges.

The Financial Times quoted American officials who said the People's Liberation Army (PLA) was behind the June hack. American officials interviewed clearly thought China was responsible.

The Pentagon network had been taken offline in response to the attacks.

The attack was against an unclassified email network in the Office of the Secretary of Defense.

A month previously, the Department of Defense claimed that the PLA maintains first-strike cyberwarfare units whose arsenals include computer viruses.

Although Jiang denied the charges, just last week, Angela Merkel, Germany's chancellor, accused China of the same type of hacks. Der Spiegel reported that government ministries as well as Merkel's office, had been infected with spyware planted by Chinese hackers.

Denmark Not Laughing Over Terror

According to the AP, Denmark arrested eight al-Qaida suspects planning an attack using explosives.

The suspects included six Danish citizens and two foreigners with residence permits who had been under surveillance for some time.

Denmark had participated in the U.S.-led coalition in Iraq.

The suspects ranged in age 19 to 29, and, although not identified by name, are of Afghan, Pakistani, Somali, and Turkish origin.

Germans Do Not Kowtow to New Threats

Graphic source: Michael Probst, AP.

Germany arrested three suspected Islamic militants on charges of alleged "imminent" acts and plotting "massive" attacks on U.S. military sites.

U.S. military installations, such as Ramstein Air Base, as well as "soft targets," such as nightclubs visited by American service personnel and German civilian targets were identified.

German federal prosecutor Monika Harms stated that the suspects had trained at terror camps in Pakistan and assembled 1,500 pounds of hydrogen peroxide for making explosives. The attacks could have been timed for anniversary of 9/11.

The potential to make bombs would have more explosive power than the ones used in the London and Madrid bombings, according to Joerg Ziercke, head of Germany’s Federal Crime Office.

The three suspects range in age from 22-29 and were considered suspicious by authorities since they had been observing a U.S. military facility. The trio included two German nationals and a Turk.

Their training at Pakistani camps were run by the Islamic Jihad Union, Sunni Muslims, arising from Central Asia and an offshoot of the Islamic Movement of Uzbekistan.

The band were drawing unemployment benefits since they had no gainful employment.

Germany’s elite GSG-9 anti-terrorist unit arrested the suspects in a large-scale investigation that included 300 agents.

Police had been monitoring their email for six months.

A pattern is emerging with these threats, as parliamentary debates were being undertaken in regards to continued involvement in Afhghanistan, this plot heated up, just as the Madrid bombings occurred to influence Spanish debates about Middle Eastern involvement.

Germany's attempt to stabilize Afghanistan against Islamic insurgents made it a target.

Germany is expected to keep troops in Afghanistan for several more years, despite the terrorist threats.

WeBWork, Web-based Interactive Homework Site

"WeBWorK is a web-based interactive system designed to make homework in mathematics and the sciences more effective and efficient."

I glanced at this which seemed worthwhile, although I am totally out of my bailiwick with the subject matter. It seems worth investigating though.

Video Glut

I read this recent report by a UC, San Diego professor who has warned that the U.S. economy may stall because of the massive upsurge in video posting. Unless the Net expands, according to the report, innovation may stall.

The report, "Point of Disconnect," by Profesoor Michael Kleeman a senior fellow at the USC Annenberg Center for Communication, seems counter-intuitive. Who is to say that videos do not add to efficiencies, and lead to more productivity. Many businesses are expanding into video and YouTube makes for an inexpensive video delivery mechanism.

Kleeman though seems to think that compression technology should be used more frequently, especially for video files, to reduce demands on the network.

The number of new videos uploaded daily to YouTube.com jumped from 20,000 at the beginning of 2006 to 65,000 daily at the beginning of this year.

But, if I were a SMB, I would employ YouTube for my training provider. I wanted to learn about Vista recently, and I found a number of handy Vista videos out there, all readily accessible on YouTube.

Its there, I'd use it.

Bush in Anbar

Graphic source: AFP

The fact that Bush visited Anbar province seemingly unconcerned about security and the insurgents is significant. Anbar is widely considered to be the heart of the Sunni insurgency but Bush came and went without incident. Petraeus must feel the U.S. has greatly reduced the threat from Sunni Arab militant groups such as al-Qaeda in Iraq.

Bank of India Hacked

The Bank of India site was hacked while displaying 22 malware exploits. Analogous to the January Super Bowl site hack, suspects are from a Russian group.

Sunbelt Software Inc. posted details of the hack once they found rogue code embedded in the site's HTML. The code, an IFRAME exploit, covertly redirected users to a hacker server with 22 pieces of malware installed then onto vulnerable PCs. By Sunbelt's tally, the malware included one worm, three rootkits, five Trojan downloaders, and several password stealers.

Roger Thompson, CTO of Exploit Prevention Labs Inc., posted a video of the hack (.wmv file download) that showed the massive infections and resulting system changes in a debugger window.

Alex Eckelberry, Sunbelt's CEO, thought this was the work of the Russian Business Network (RBN) gang. The RBN is characterized as "the baddest of the bad" by VeriSign iDefense.

The malware was installed through an exploit framework -- Webattacker, Mpack, Icepack -- as it was encrypted in the same way as Webattacker," Eckelberry stated.

Time For the World to Step Up to the Plate

The American surge has provided breathing room for the Iraqi government which has been in the news of late.

What I have been thinking about of late though is the role of diplomacy. The Iraq Study Group Report recommended diplomatic efforts, and the Democratic contenders have been stressing diplomacy in their criticisms of Bush's handling of the conflict in Iraq.

What successes have the Democratics had in enlisting foreign governments to get involved?

Which countries have jumped into the breach?

The Group recommended the U.N.'s involvement with Iran and the nuclear issue. Are there any developments on that front?

The Security Council, plus Germany, was to be involved. Has there been any progress since 2006?

If you haven't guessed by now, these are rhetorical questions.

I, like you, have not heard the Democratic contenders address the issue and the U.N.'s response has been tepid.

YouTube Emirate Founded

Graphic source: the Armoury of St. James. The unfolding emirate features a graphic of Saladin, who I picture here, but since the site does not credit a source I don't know if its borrowed or not.

Here is one of the ideas that can only happen in the wonderful, zany world of the Internet.

A hardy band of 'Netters, no, I didn't say nutters, announced that they are beginning a YouTube Emirate.

What is an emirate? This is the quality, dignity, office, or territorial competence of any Emir (prince, governor etc.). These folks think on a small scale apparently: the opposite of "if I were Emperor of the world," and then the person fills in the gaps of what they would do.

An emirate designates a political territory ruled by a dynastic Arab Monarch styled an emir. They are not too popular in the modern world as most emirates dissipated or were integrated into larger modern states. These are small time thinking folks.

The Arabic etymology suggests the term is generalized to indicate any province of a country that is administered by a member of the ruling class, e.g., a Sheikh of the royal family.

The basics of the idea then are to create a cyber small-time monarchical Arab state in YouTube-ville. Are you with me?

The group has gone so far as to write up a constitution, and by constitution they don't mean the French Revolution variety but an agreement to accept authority as Mohammed did some centuries ago.

Authority is a major point to this group: to wit, "There is to be one single leader of the Muslims on YouTube" (#2).

Sexism is important for this band as well since of that one leader it is stated to: "honor his authority" (#2).

The one authoritative leader has help though because there are two advisory committees. And what, pray tell, are the two top priorities that are needed to fill those committees? The "Disciplinary Committee" and the "Religious Consultants" are required (#3).

But perhaps the laws of the emirate are the high point of constitutional thinking here. From whence do laws of this mighty band arise? Of the laws governing the band it is stated: "All laws of the Qur'an and Islam must be followed and given precedence to this document. . . . The YouTube Terms of Service must be followed and given precedence to this document" (#5).

So let me get this straight: the Qur'an, and the YouTube Terms of Service, are held in equal regard as laws of this emirate?

Good thing this statement is still in draft form. I am no expert on statements like this but I suspect there are difficulties when any group maintains that a religious book and an American company's agreement with its customers are equal.

We do have a problem when folks are so inspired by past failures, Islamic Empires, but try to wed those notions to 21st century technology.

Is it just me or am I alone in appreciating the irony? Thanks to the U.S.A., and specifically an American company giving away free technology--based as it is on Western research in an open, free, scientific, and secular society--some people have allowed their fantasies to spiral exponentially.

I hope the emirate enjoys the blessings of the U.S.A.

Egyptian "Students" Nabbed

Mohamed with Megahed behind him in court. Graphic source: AP.

Most likely, this is another cell nabbed but they will have their day in court. The Egyptian "students" at the University of South Florida were indicted on explosives charges and carrying pipe bombs across state lines. One of the Egyptians also did some teaching to the other "student" apparently; he faces terrorism charges for allegedly teaching the use of explosives.

The pair was speeding 4 August in South Carolina when they were stopped near a Goose Creek, South Carolina Navy base. The men also possessed pipe bombs.

Youssef Samir Megahed, 21, is an engineering student; Ahmed Abdellatif Sherif Mohamed, 24, is an engineering graduate student and teaching assistant, he faces terrorism charges for teaching and demonstrating how to use the explosives.

The indictment alleges that Mohamed taught and demonstrated the making and use of an explosive and destructive device with the intent that such information be used for . . . an activity that constitutes a federal crime of violence, according to the written federal prosecution statement.

Enemy combatants had been held at the Navy base so the FBI is investigating whether there was a terrorism link.

Mohamed was charged with distributing information relating to explosives which seems like a non-offense to me. Information should be available, and is, to anyone who seeks it out. The possession of destructive devices and weapons of mass destruction, is something else, and rightfully is a terrorism-related statute. The crime carries a maximum of 20 years in prison.

Both indictees face with charges of transporting explosives in interstate commerce without permits, which carries a 10-year prison penalty.

Local authorities carried the ball here initially and their suspicions resulted in a more vigorous case.

The local sheriff in South Carolina said the explosives were "other than fireworks."
The four-week investigation resulted in charges that followed several searches in Tampa, including a storage facility, and a park where the explosives might have been tested.

Both Mohamed and Megahed are here legally on student visas. Neither of their names though appear on USF's engineering website for students.

This looks like astute local police enforcement if the indictments hold up in court.

Germans Avoid Stepping On Terror Toes

Wolfgang Schaeuble, graphic source: BBC.

The Germans owe terrorists an apology for violating their privacy with spyware.

No, this is not a genuine headlline but Interior Minister Wolfgang Schaeuble faces strong opposition in plans to spy on terror suspects by deploying malicious emails.

The emails contain Trojans, software that furtively installs itself, allowing agents to search the hard drives.

I suppose the opposition Free Democrats, Gisela Piltz, would apologize to suspects since this is an unacceptable intrusion into privacy. Justice Minister Brigitte Zypries, of the Social Democrats (SPD), has also voiced concern about the possible infringement of privacy laws.

If privacy were a larger concern most Trojans would be eliminated from desktops: like that is going to happen. So many products on the web contain Trojans I hardly think terror suspects deserve that much consideration. And, for those of us who take pre-emptive measures, it really does not matter. There are those times I wish governments would stop looking out for us. This is one of those times.

Governments Hacked

Graphic source, CNN, 19 September 1996.

Computer Sweden reports today that hacks compromised embassy and government email accounts worldwide. The countries effected by this breach are the foreign ministry of Iran, the Kazakh and Indian embassies in the U.S., Uzbeki embassies and consulates worldwide, the Russian embassy in Sweden, and login details for email accounts at the U.K. visa office in Nepal.

The usernames and passwords for more than 100 email accounts were posted online.

Freelance security consultant Dan Egerstad posted the information.

Egerstad told Computer Sweden that he never used the information to log in to any of the compromised accounts in order not to break any laws.

The story indicates the sorry state of security by governments worldwide. As annoying as Egerstad may seem, this is an indication that greater vigilance is needed online. The range of countries hacked also indicates that there is little likelihood that there is an ulterior, financial, or political motive, to the hacks.

"Cut & Run" Sadr Suspends Militia Violence

Graphic Source: AP

The bizarre Shiite cleric Moktada al-Sadr suspended violent attacks for six months. He is making this move to reign in the rogue elements of his Mahdi Army militia’s operations. The good news is that attacks on American troops are suspended. My hope here is that while this hiatus intervenes, American troops can perform their genuine mission in Iraq, counter-insurgency, and vigorously rooting out elements in Sadr's militia. The suspension by Sadr, is his bowing to pressure hours after his fighters waged running street battles with Iraqi government forces.

Karbala, holy to Shiites, was the scene of battles between Shiite factions which left 52 dead.

Retail Security Flaws

Retail point-of-sale (POS) systems present security flaws for consumer credit card data, according to Neal Krawetz, founder of Hacker Factor Solutions.

Krawetz outlined numerous relatively easily vulnerabilities in POS technologies.

In the last year, no company has responded to Krawetz' inquiry.

One of the most basic limitations of POS is need for standards at the payment level. The Payment Card Industry (PCI) data security standard required by all major credit card companies requires businesses to take several measures for protecting cardholder data. However, PCI standards are not available for POS devices or software.

POS terminals that read credit card information, perform card transactions, and receive the confirmation code are easy targets for hackers. According to Krawetz POS terminals often store a relatively high volume of easily accessible credit card data. Most systems purge the data automatically when power is turned off or when transactions are tallied at the end of the day, but this does not occur in every instance.

Krawetz recommends asking the vendor whether payment card data is purged when power is removed from the POS system, finding out how much data can be retained in the device's permanent storage, and how to manually purge the data. Also, companies need to find out whether the data on POS devices is encrypted, whether the permanent storage can be removed, and whether the POS system forces users to change default settings. In addition, companies should find out if the POS device allows back-door access to the data and whether it has any logging functions for tracking activity.

These are serious concerns and I applaud Krawetz for describing them. I would hope the financial industry would take note.

Vista SP1 Beta Only a Few Weeks Away

Graphic source: Odd-Magne Kristoffersen.

Microsoft Corp. confirmed reports that the first service pack for Windows Vista will be out sometime in the first quarter next year.

The first major update to Vista will contain a number of tweaks to speed up the operating system and fix nagging reliability problems, according to David Zipkin, a senior product manager for Windows Vista.

The SP1 beta will be released by the end of September, though it will be limited to no more than 15,000 Microsoft partners and customers. Another beta or release candidate will be distributed to a larger pool of testers before SP1's final release, which is slated for sometime before March 31.

Beta copies of SP1 have already leaked to pirate sites.

The Microsoft message here is to wait for Vista if you haven't implemented it yet; and, XP is still viable because Microsoft will update a Version 3 of XP at the same time.

SP1 will include 19 major changes. Among the most important is to downplay what many find annoying, the User Account Control (UAC) security feature, to be less intrusive. Copying and unzipping files in Vista should be much faster as should the ability of Vista PCs to wake up from standby or hibernate modes. The Bitlocker drive encryption, which formerly could only encrypt the C: drive, can now be used to encrypt other partitions and hard drives.

As for XP SP3, the main new feature is Network Access Protection (NAP), now available only in Vista. NAP reports the security status of a PC to a Windows Server, which can quarantine the PC and block any network traffic to and from the computer if it appears compromised.

SP1 will come in the form of a 50MB .exe file.

This is a mid-level update, not too adventurous, not unnecessary.

ICANN Whois No Privacy Reforms

The Internet Corporation for Assigned Names and Numbers (ICANN) has not setteled differences over proposed privacy changes to the WHOIS database. There has been no progress on how to reform the way WHOIS data is handled.

The WHOIS registry is the domain name systems' legacy database; it contains names and contact information of all those who register Internet domains. The contents of the database have been publicly accessible to anyone who wanted it.

Companies, intellectual property holders, and law enforcement authorities favor open access to the WHOIS database on the grounds that it helps them go after phishers, trademark infringers, copyright violators and others. Privacy advocates oppose unrestricted WHOIS access on the grounds that it could expose individual domain registrants to spam and unwanted surveillance.

One of the better proposals was one to shield the contact information of individual domain registrants while making that of commercial registrants publicly accessible. Also, access to shielded WHOIS information could be provided on a one-time basis or on an as-needed basis to those who could demonstrate a valid reason for access to the information. A warrant should reveal all if need be.

There are those who would avail themselves of a proxy, for good or for ill, and law enforcement will always need to be vigilant and perform their appointed tasks to discern the difference.

Chinese Wife Who Has the Aegis

Several Japanese homes of the Maritime Self Defense Force (JMSDF) and a destroyer were raided over a computer data leak. This leak may effect the Aegis missile defense system, the sea-based Standard Missile-3 interceptor system, and the reconnaissance satellite data exchange Link 16 system.

Police were alerted when conducting an immigration-related investigation into the Chinese wife of a JMSDF officer. During the search they came across the data, which included the radar and transmission frequencies of the Aegis system. The officer wasn't authorized to be in possession of the data so the investigation was begun.

He apparently came into possession of the data while swapping pornography with another JMSDF officer, according to a Japanese news source, the Yomiuri Shimbun newspaper.

Aegis is an American defense initiative.

Japan would like access to technical details of the F22A Raptor, one of the most technically advanced jets in the U.S. fleet. The U.S. has not accepted the request yet.

I guess this means you can't always trust a wife, or who you can swap pornography with.

Extra-Internetality

During the era of Colonialization, an accused person had the right to be returned to their home country, a British citizen would return to England, for trial: extraterritoriality.

The colonized country would have their laws and persons often violated as a result.

Currently, Yahoo Inc. asked in a 51-page defense filing in the Northern District of California, a federal court, to dismiss a human rights lawsuit. I believe Yahoo is wrong.

Yahoo's Hong Kong subsidiary, Yahoo Hong Kong Ltd., (YHKL), provided information about dissidents to the Chinese government and subsequently a lawsuit was filed against Yahoo by the World Organization for Human Rights USA.

What is clear is that the information supplied led to the persecution, torture and imprisonment of four Chinese dissidents.

Writer Wang Xiaoning was charged on incitement to subvert state power. Wang was sentenced to 10 years in prison in September 2003. Yahoo gave his e-mail account information and IP address to the Chinese government.

Yahoo's defense is that it doesn't condone the suppression of their rights and liberties by their government, it had no control over laws passed by the People's Republic of China (PRC) and the ways in which those laws were enforced.

I disagree. China does not adhere to international norms and standards and this position makes it more likely that information turned over to Chinese authorities, as opposed to information that might convict child-molesters, and others accused of heinous crimes in the West, might be misused. Yahoo's defense is disingenious.

Would anyone consider China to be a paragon of free speech?

Senator: Surge Is A Success

Senator Mitch McConnell stating the key August news story.

Good Enough for My Grandfather

Philadelphia could spend $47M over 20 years for water billing improvements. The latest of a two decades long effort to replace Philadelphia's aging water billing system could reach nearly $47 million.

Philadelphia Controller Alan Butkovitz released a 29-page report that detailed the costs since 1987 of replacing the city's 30-year-old proprietary Cobol mainframe billing system that still relies on punch cards.

Yes, punch cards, you read that correctly.

Costs have already exceeded $35 million and could reach $46.7 million, the controller's report stated.

Last January, an attempt began to replace the old water billing system with commercial off-the-shelf software for water billing called Basis2 from Prophecy International Pty. of Adelaide, Australia. Most of the previous plan to use Oracle Corp. applications was scrapped.

The Oracle applications cost $18.9 million, twice more than it initially expected to, without getting a working system.

Now, the Prophecy software and related costs will total $6.7 million, bringing the Prophecy and Oracle costs to $25.6 million.

The controller's total cost of $46.7 million includes years of work prior to 2002 when the Oracle work started. There was project creep between 1987 and 2002 which enlarged the initial costs.

I find this appallingly expensive, wasteful, and inefficient but typical of how money was wasted in dead-end projects. The non-innovative East attitude seems to be, if it was good enough for my grandfather, it is good enough for me.