Hop 255

Australian Government to Act on Zombies

The Australian Government, in cooperation with some of that countries largest ISPs, is to act to advise users if they are infected by botnets. The relevant Minister's press release is here.

VoIP Threat Taxonomy

This VoIP Security Threat Taxonomy aims to define the many potential security threats to VoIP deployments, services, and end users. Part of the challenge of devising effective VoIP security protections requires first identifying these threats in the first place. Voipsa's overall goal of this project is to help ground VoIP security awareness in the industry, press, and general public. Meanwhile Skype has let an external expert review its security.

SMS, DOS and Wireless Hacks

The possibility of DOS wireless attacks using SMS is written up here. Meanwhile over here you can see a hacker's screen in action as they hack a wireless network. Then again technology is a two edged sword.

Google and Wifi

Red Herring writes up the news that Google website has downloadable application to make access to Google more secure over Wifi. Google's FAQ site is here. Presumably useful for GMail users.

Privacy Breaches

A disconcerting and growing list of privacy breaches recorded here at the Privacy Rights Clearing House. The data include the date, name of breached party, the type of breach and the number of people impacted.

the ZombieMeter

CipherTrust's ZombieMeter is up and running. Cute idea to do it 24x7 and I hope the other security companies follow suit with something similar. Symantec puts out a similar indicator on bot infected computers but every six months. CipherTrust also have data on the first three weeks of May which hopefully they will keep updated in a time series.

Skype blocking and "DOS attack"

A couple of posts on Skype worth reading at Skypejournal. One on UAE allegedly blocking the Skype website which the author supposes is either to prevent bypass of the PSTN rates or because calls are encrypted making them harder to tap. UAE is one of the more progressive countries in the region in terms of telecom policies and Dubai is trying to become a high tech hub.  So if they are doing it, for whatever reason, it doesn't really make sense in terms of their overall ICT and economic strategy for the country. Makes you wonder what happens in those countries which have a more centralised system through which all traffic must pass. One of the people commenting at Skypejournal suggests users in the UAE try the EFF's TOR but that is probably blocked as well.  Easier for expats to get a friend or relative to top up their account if that is the only barrier. Paradoxically, Skpejournal also covers Andrew Ferguson's blogging of his suggested POTS denial of service scheme for annoying Spammers.  A very funny post by Andrew and even funny recording of his call to a spammer. But as Skypejournal points out there is too much potential for misuse here in relation to the PSTN.  How long before governments other than UAE not kindly disposed towards VoIP competition (or PSTN tapping bypass) start pointing to legitimate public policy concerns. Time for Skype to hire some government relations types and send them to the WGIG meetings and the other international forums where governments discuss these issues.

Economics of Security

Fourth Workshop on the Economics of Information Security to be held at the Kennedy School of Government, at Harvard University (2-3 June) website with papers. Some of the papers look interesting with new ideas and suggested approaches to econometric modeling but, in the main, they rely on the same data reported in the media on the cost of spam, phishing, viruses and so forth.  Having said that, there are those that do their own little case studies on things like the propensity of users to sell their private information. But even the most elegant econometric models look shaky, if the how the underlying data was arrived at is not transparent and with no published methodology. And a lot of the data cited falls into that category.

Phishiest Countries

Netcraft produce some of the best data about the Internet from the largest database of its kind. Best known for its secure server survey they throw light on everything from denial of service attacks by botnets through to how well the Vatican website coped over the weekend with the wave of requests. Recently they have made available a free toolbar which guards against "phishing".  With data from the toolbar, matched against their other survey data, they now also produce a league table, most aptly named, of the world's phishiest countries.  Syria leads the way with 4 phishing sites from only 58 in the entire country!

spoofing

Interesting project at MIT's ANA attempting to measure spoofing vulnerabilities on a global basis.