Category: Computer

Finance Ruins Everything

No Comments

Case in point, the hacking of the MTA in New York City, which was caused by lapses at a private equity (PE) owned software firm.

PE is not about building a good company, long term success, or security.  It’s about pump and dump, and security is a cost that you can cut to juice your numbers before they sell out the company.

It’s all pump and dump:

Oh look, a hack of the New York subway system.

A hacking group believed to have links to the Chinese government penetrated the Metropolitan Transportation Authority’s computer systems in April, exposing vulnerabilities in a vast transportation network that carries millions of people every day, according to an M.T.A. document that outlined the breach.

These hacks are becoming commonplace, but it’s not just because everything is connected to the internet. It turns out, hackers got in through commercial software.

To gain access to the M.T.A. and other systems, the hackers took advantage of vulnerabilities in Pulse Connect Secure, a widely used connectivity tool that offers workers remote access to their employers’ networks.

Pulse Connect Secure is owned by Ivanti, a software roll-up owned by private equity firms Clearlake Capital Group, L.P. and TA Associates. I’ve written about the dangers of private equity owning cybersecurity firms – Solar Winds was such a case. (In fact, Thoma Bravo partners – which owns Solar Winds – continues to snap up cybersecurity and compliance firms such as Proofpoint.)

I’ve gone through job reviews on Glassdoor and Indeed, and Ivanti seems to be a typical PE roll-up, ruining the product quality, offshoring jobs and firing people, and just generally destroying enterprise value. Here’s a typical review.

PE takeovers are frequently followed up by the collapse of the firms (usually) after the PE pukes have gotten their vigorish.

We really need to change bankruptcy laws so that these crooks aren’t able to leave someone else holding the bag.

A Little Late, Aaron Schwartz is Dead

No Comments

The Supreme Court has finally shot down the overbroad interpretation of the Computer Fraud and Abuse Act (CFAA) that was used to prosecute Aaron Schwartz to death.

I’d say, “About f%$#ing time,” but it’s at least 7 years too late: 

The Supreme Court’s decision on Thursday in Van Buren v. United States provides the court’s first serious look at one of the most important criminal statutes involving computer-related crime, the federal Computer Fraud and Abuse Act. Justice Amy Coney Barrett’s opinion for a majority 0f six firmly rejected the broad reading of that statute that the Department of Justice has pressed in recent years.

Among other things, the CFAA criminalizes conduct that “exceeds authorized access” of a computer. Crucially, the statute defines that term as meaning “to access a computer with authorization and to use such access to obtain … information … that the accesser is not entitled so to obtain.” The question in Van Buren was whether users violate that statute by accessing information for improper purposes or instead whether users violate the statute only if they access information they were not entitled to obtain. In this case, for example, a Georgia police officer named Nathan Van Buren took a bribe to run a license-plate check. He was entitled to run license-plate checks, but not for illicit purposes. The lower courts upheld a conviction under the CFAA (because he was not entitled to check license-plate records for private purposes). The Supreme Court disagreed, adopting the narrower reading of the CFAA, under which it is a crime only if users access information they were not entitled to obtain.

To be clear: Van Buren should be in jail for a very long time, but his crime is violation of people’s civil rights, abuse of power, and taking bribes, not computer hacking.

And Amy Coney Barret gets to the heart of the matter, that the government’s position would literally make tens of millions of people unwitting felons:

Finally, Barrett turns to a topic that dominated the amicus filings and much of the time at oral argument: the “breathtaking amount of commonplace computer activity” that the Government’s reading would criminalize. For Barrett, that reality “underscores the implausibility of the Government’s interpretation,” which provides (in words Justice Elena Kagan coined in an earlier case) “extra icing on a cake already frosted.” Barrett notes that extending the statute to “every violation of a computer-use policy” would make criminals of “millions of otherwise law-abiding citizens,” offering examples of such trivial conduct as “embellishing on online-dating profile” and “using a pseudonym on Facebook” – activities that violate website use restrictions and thus would fall within the government’s understanding of the CFAA.

If there is a lesson from all of this, it is that prosecutors will take the most outrageous and extreme view of any criminal statue that they come across.

There needs to be some serious reform here.

Supreme Court Sides With Google on API Copyright

No Comments

It should also be noted that the Supreme Court also slapped down the United States Court of Appeals for the Federal Circuit (CAFC, AKA, the “Patent Court”) once again.

This time, the Patent Court big-footed the normal appellate process, it does not normally handle copyright claims, and made an egregiously bad decision, which it pretty much always does, to boot.

Once the Supreme Court noticed, it was over but for the fat lady singing.

The purpose of patents is two fold:  To encourage innovation, and to make the information contained in patents available to the public.

The patent troll friendly CAFC is doing exactly the opposite.

This time the Supreme Court ruled that using the application programming interface (API) is fair use.

An API is a series of rules which describe how a computer program is programmed, or how it interfaces with hardware, and for program compatibility, programs running on the same hardware, or the same operating system, or on a similar language.

It’s not a creative expression (copyright) but a functional description of the system, like the manual for a toaster.  The specific words in the manual are covered by copyright, but the idea that you slide a lever from left to right to set the doneness of your toast is not.

For example, we can look at a “Hello World” program in Java, where Oracle was asserting infringement: (This is also an example of why I don’t want to program in Java, it’s way to obscure and verbose)

import javax.swing.JFrame;  //Importing class JFrame
import javax.swing.JLabel;  //Importing class JLabel
public class HelloWorld {
    public static void main(String[] args) {
        JFrame frame = new JFrame();           //Creating frame
        frame.setTitle("Hi!");                 //Setting title frame
        frame.add(new JLabel("Hello, world!"));//Adding text to frame
        frame.pack();                          //Setting size to smallest
        frame.setLocationRelativeTo(null);     //Centering frame
        frame.setVisible(true);                //Showing frame
    }
}

If you want to create an application, or an operating system, which is what Google did, and allow for Java programmers to work in this without learning a completely new way of doing the same thing, then you have to use the same code words, things like “Jlabel”, “Jframe”, “setTitle”, etc. 

That’s what Google did, and what the makers of IBM clones did in the 1980s, and what third party spare parts manufacturers do when they make cheaper parts for your (increasingly computerized) car.

The Supreme Court said that it’s fair use, which is nice, but not as nice as if they had said that it was not subject to copyright:

It’s taken over a decade, but the Supreme Court has finally said that Google’s copying of the Sun Java API for Android was clearly fair use in a 6-2 ruling (Barrett did not take part since she was not on the Court when the case was heard). The background of this case is actually kind of important to understanding what just happened, so here’s a quick(ish) recap.

As you’ll probably know, this case began in 2010 when Oracle, which had just taken over Sun, sued Google for patent infringement. The patent parts were quickly tossed out and what remained was what referred to as a “sideshow” to the main event: a question about whether APIs could be covered by copyright. Pretty much all historical evidence, including an important Supreme Court ruling from the 1990s, said no, interfaces are not covered by copyright.

Oracle and friends then spent the next decade deliberately gaslighting basically everyone who doesn’t understand what an API is, and insisting that it’s the same as executable code. The district court, under Judge William Alsup, who somewhat famously taught himself Java to better understand the issues in the case (he already knew how to code and was a hobbyist programmer), correctly found that APIs are not subject to copyright as they represent a “system or method of operation” which is explicitly not covered by copyright, as per Section 102(b) of the Copyright Act.

Rather than go to the 9th Circuit (as it should have) the case went to the Federal Circuit, which hears all patent appeals. That was because the case began as a patent case, even though it no longer was. CAFC judges are somewhat infamous for never finding a patent issue they couldn’t screw up, and decided to extend that to copyright. In the ruling overturning the lower court, they made it clear that because they were code illiterate they could not understand the difference between executing code and an API, even though it’s like the difference between a novel and a dictionary.

The CAFC bigfooted the case, which is not surprising.  They also do things like change determinations of fact by the lower courts, something that is not supposed to be done by appellate courts, which are only supposed to adjudicate matters of law.

The case went back to the district court, where the jury this time sided with Google, this time saying that the use of the code was covered under fair use. That whole trial was a little weird, because reading between the lines, you could see that nearly all the arguments for why copying an API was fair use were really about why an API shouldn’t be covered by copyright at all (as per Alsup’s original ruling) and then squeezing that square peg into the round hole of fair use to make it work. Once again, however, CAFC got flummoxed by an API looking like code and overturned — which is quite crazy because CAFC had, in its first ruling, insisted that the jury should decide this issue (as a matter of fact) and then when the jury said “fair use” CAFC suddenly decided that it was a matter of law that it could overrule.

It’s taken over a decade, but the Supreme Court has finally said that Google’s copying of the Sun Java API for Android was clearly fair use in a 6-2 ruling (Barrett did not take part since she was not on the Court when the case was heard). The background of this case is actually kind of important to understanding what just happened, so here’s a quick(ish) recap.

So, basically, we have another set of incoherent, and weird rulings from the CAFC, and once it gets on the SCOTUS radar, they shoot it down.

The patent court needs to be abolished.  The argument for it, that there needs to be a court with a specialized focus on patents is simply not justified by the results.

Instead, we have an institution that is completely captured by the patent bar, and has literally allowed for the patenting of a rainy day (Bilski v. Kappos,).

Just shut them down, and reassign the current judges to traffic court.

 

Ha Ha!

1 Comment

Right wing hate site Gab just got hacked, big time.

DDOSecrets, who previously had leaked racist and Islamophobic police training materials got almost everything, public posts, private posts, user info, passwords, etc.

These guys really do have spectacularly poor IT skills don’t they?

It’s the revenge of Bobby Droptables all over again

On the bright side, it save lots of aviation fuel.

Black helicopters are notorious fuel guzzlers: 

When Twitter banned Donald Trump and a slew of other far-right users in January, many of them became digital refugees, migrating to sites like Parler and Gab to find a home that wouldn’t moderate their hate speech and disinformation. Days later, Parler was hacked, and then it was dropped by Amazon web hosting, knocking the site offline. Now Gab, which inherited some of Parler’s displaced users, has been badly hacked too. An enormous trove of its contents has been stolen—including what appears to be passwords and private communications.

On Sunday night the WikiLeaks-style group Distributed Denial of Secrets is revealing what it calls GabLeaks, a collection of more than 70 gigabytes of Gab data representing more than 40 million posts. DDoSecrets says a hacktivist who self-identifies as “JaXpArO and My Little Anonymous Revival Project” siphoned that data out of Gab’s backend databases in an effort to expose the platform’s largely right-wing users. Those Gab patrons, whose numbers have swelled after Parler went offline, include large numbers of Qanon conspiracy theorists, white nationalists, and promoters of former president Donald Trump’s election-stealing conspiracies that resulted in the January 6 riot on Capitol Hill.

DDoSecrets cofounder Emma Best says that the hacked data includes not only all of Gab’s public posts and profiles—with the exception of any photos or videos uploaded to the site—but also private group and private individual account posts and messages, as well as user passwords and group passwords. “It contains pretty much everything on Gab, including user data and private posts, everything someone needs to run a nearly complete analysis on Gab users and content,” Best wrote in a text message interview with WIRED. “It’s another gold mine of research for people looking at militias, neo-Nazis, the far right, QAnon, and everything surrounding January 6.”

DDoSecrets says it’s not publicly releasing the data due to its sensitivity and the vast amounts of private information it contains. Instead the group says it will selectively share it with journalists, social scientists, and researchers. WIRED viewed a sample of the data, and it does appear to contain Gab users’ individual and group profiles—their descriptions and privacy settings—public and private posts, and passwords. Gab CEO Andrew Torba acknowledged the breach in a brief statement Sunday.

………

According to DDoSecrets’ Best, the hacker says that they pulled out Gab’s data via a SQL injection vulnerability in the site—a common web bug in which a text field on a site doesn’t differentiate between a user’s input and commands in the site’s code, allowing a hacker to reach in and meddle with its backend SQL database. Despite the hacker’s reference to an “Anonymous Revival Project,” they’re not associated with the loose hacker collective Anonymous, they told Best, but do “want to represent the nameless struggling masses against capitalists and fascists.”

It’s reassuring that all the Nazis so far seem to be Colonel Klink, but we cannot rely on that forever.

Sauce for the Gander

No Comments

After decades of merrily hacking into other people’s computers and snooping on people’s emails, it appears that the NSA has been hacked.

A group of hackers are trying to auction off malware that the spy organization has been using to spy on the rest of us:

A mysterious online group calling itself “The Shadow Brokers” is claiming to have penetrated the National Security Agency, stolen some of its malware, and is auctioning off the files to the highest bidder.

The authenticity of the files cannot be confirmed but appear to be legitimate, according to security researchers who have studied their content. Their release comes on the heels of a series of disclosures of emails and documents belonging mostly to Democratic officials, but also to Republicans. Security researchers believe those breaches were perpetrated by agents thought to be acting on behalf of Moscow.

The NSA did not answer Foreign Policy’s questions about the alleged breach on Monday. But if someone has managed to penetrate the American signals intelligence agency and post its code online for the world to see — and purchase — it would constitute a historic black eye for the agency.

………

The files posted over the weekend include two sets of files. The hackers have made one set available for free. The other remains encrypted and is the subject of an online auction, payable in bitcoin, the cryptocurrency. That set includes, according to the so-called Shadow Brokers, “the best files.” If they receive at least 1 million bitcoin — the equivalent of at least $550 million — they will post more documents and make them available for free.

The set of files available for free contains a series of tools for penetrating network gear made by Cisco, Juniper, and other major firms. Targeting such gear, which includes things like routers and firewalls, is a known tactic of Western intelligence agencies like the NSA, and was documented in the Edward Snowden files. Some code words referenced in the material Monday — BANANAGLEE and JETPLOW — match those that have appeared in documents leaked by Snowden. Security researchers analyzing the code posted Monday say it is functional and includes computer codes for carrying out espionage.

If this hack is real, my guess is that they got in through backdoors that the NSA itself insisted on.

My Next Computer is not Going to Be Windows 10

No Comments

The latest Microsoft operating system is a privacy horror show:

By default, Microsoft gets to see your location, keystrokes and browser history — and listen to your microphone, and some of that stuff is shared with “trusted [by Microsoft, not by you] partners.”

You can turn this all off, of course, by digging through screen after screen of “privacy” dashboards, navigating the welter of tickboxes that serve the same purposes as all those clean, ration-seeming lines on the craps table: to complexify the proposition so you can’t figure out if the odds are in your favor.

Oh, and if you’ve already chosen to use Firefox as your default browser, Microsoft overrides your decision when you “upgrade” and switches you to the latest incarnation of the immortal undead monster formerly known as Internet Explorer.

See also here, where they note that you cannot shut the service off except by getting deep into dodgy operating system functions, and it listens to everything that you say.

A ain’t gonna go Mac though:  I hate walled gardens, so it’s probably some flavor of Linux for me next time around.

And the Arms Race Begins

No Comments

Facebook creates ad blocker proof ads, and the ad blockers block those ad blocker proof ads.

I use an Adblock plus.

Ads frequently serve up malware.

I also serve ads at my site.

I understand the moral ambiguity here:

As you may have noticed over the last few days — I sure did — Facebook recently incorporated a sneaky change to the way its ads are displayed that disguised them as ordinary content and circumvented ad blocking software in browsers. Ads crowded the streams of even the most vigilant users.  But this hell on earth was not to last: two days and change later, the Adblock Plus community has found a way to block them again.

Expect more back and forth on this.

My standard disclaimer the ads on my site apply:

Also, please note, this should be in no way construed as an inducement or a request for my reader(s) to click on any ad that they would not otherwise be inclined to investigate further. This would be a violation of the terms of service for Google™ Adsense™.

My Money Is This Being the NSA

No Comments

A highly sophisticated malware has been discovered more than 5 years after its release into the wild.

It’s level of sophistication indicates that it was produced by a state actor:

Security experts have discovered a malware platform that’s so advanced in its design and execution that it could probably have been developed only with the active support of a nation-state.

The malware—known alternatively as “ProjectSauron” by researchers from Kaspersky Lab and “Remsec” by their counterparts from Symantec—has been active since at least 2011 and has been discovered on 30 or so targets. Its ability to operate undetected for five years is a testament to its creators, who clearly studied other state-sponsored hacking groups in an attempt to replicate their advances and avoid their mistakes. State-sponsored groups have been responsible for malware like the Stuxnet- or National Security Agency-linked Flame, Duqu, and Regin. Much of ProjectSauron resides solely in computer memory and was written in the form of Binary Large Objects, making it hard to detect using antivirus.

Because of the way the software was written, clues left behind by ProjectSauron in so-called software artifacts are unique to each of its targets. That means that clues collected from one infection don’t help researchers uncover new infections. Unlike many malware operations that reuse servers, domain names, or IP addresses for command and control channels, the people behind ProjectSauron chose a different one for almost every target.

 “The attackers clearly understand that we as researchers are always looking for patterns,” Kaspersky researchers wrote in a report published Monday. “Remove the patterns and the operation will be harder to discover. We are aware of more than 30 organizations attacked, but we are sure that this is just a tiny tip of the iceberg.” Symantec researchers, in a report of their own, said they were aware of seven organizations infected.

 Jumping air gaps

 Part of what makes ProjectSauron so impressive is its ability to collect data from computers considered so sensitive by their operators that they have no Internet connection. To do this, the malware uses specially prepared USB storage drives that have a virtual file system that isn’t viewable by the Windows operating system. To infected computers, the removable drives appear to be approved devices, but behind the scenes are several hundred megabytes reserved for storing data that is kept on the “air-gapped” machines. The arrangement works even against computers in which data-loss prevention software blocks the use of unknown USB drives.

………

The main purpose of the malware platform was to obtain passwords, cryptographic keys, configuration files, and IP addresses of the key servers related to any encryption software that was in use. Infected groups include government agencies, scientific research centers, military organizations, telecommunication providers, and financial institutions in Russia, Iran, Rwanda, China, Sweden, Belgium, and possibly in Italian-speaking countries.

I don’t know the specific targets, but the locations appear top indicate that the source of the hack is somewhere in the Fort Mead-DC-Langley axis.

It’s Called Paper

2 Comments

The Department of Homeland Security is looking at ways to safeguard electronic voting machines from hackers.

It’s really pretty simple, you eliminate the purely electronic machines, and go with optically scanned machines, which will give you a count in roughly the same time, and then you do a manual recount of a small portion of the precincts.

If you want to retain purely electronic machines, I’d suggest that you require that the software be open source, so that it can be audited.

Instead, they will probably shovel money at Diebold and their ilk:

The Obama administration is weighing new steps to bolster the security of the United States’ voting process against cyberthreats, including whether to designate the electronic ballot-casting system for November’s elections as “critical infrastructure,” Jeh Johnson, the secretary of Homeland Security, said on Wednesday.

In the wake of hacks that infiltrated Democratic campaign computer systems, Mr. Johnson said he was conducting high-level discussions about “election cybersecurity,” a vastly complex effort given that there are 9,000 jurisdictions in the United States that have a hand in carrying out the balloting, many of them with different ways of collecting, tallying and reporting votes.


………

Mr. Johnson said he was considering communicating with state and local election officials across the country to inform them about “best practices” to guard against cyberintrusions, and that longer-term investments would probably have to be made to secure the voting process.

“There are various different points in the process that we have to be concerned about, so this is something that we are very focused on right at the moment,” Mr. Johnson said.

His comments were the latest evidence that recent cyberintrusions have caused alarm in the administration about the potential for hacking to disrupt the election, and how to respond.

Seriously, this sh%$ ain’t rocket science.

Use paper ballots, and make selected public hand recounts of a small randomly selected group of sites.

It’s really that simple.

Whiskey Tango Foxtrot?

No Comments

In a fit of political pandering, Governor Andrew Cuomo has issued an executive order banning sex offenders from playing Pokemon Go while declining a law intended to facilitate prosecution of child rape into law:

Governor Anthony Cuomo, never afraid to take quick and decisive action on the issues facing New York, announced today that all 3,000 of New York’s sex offenders will be prohibited from “downloading, accessing, or otherwise engaging in any internet-enabled gaming activities, including Pokémon Go.”

 “Protecting New York’s children is priority number one and, as technology evolves, we must ensure these advances don’t become new avenues for dangerous predators to prey on new victims,” said Cuomo in a statement. “These actions will provide safeguards for the players of these augmented reality games and help take one more tool away from those seeking to do harm to our children.”

 To that end, Cuomo will have the Division of Criminal Justice Services provide a current list of sexual offenders to Niantic Inc., the creator of Pokémon Go, as well providing the same list to Apple and Google. Parole officers will also be trained in how to check and see whether their parolees have been playing any internet-enabled games.

 ………

 Meanwhile, left sitting on Cuomo’s desk at the end of this year’s legislative session was a bill that would have lengthened the statute of limitations on sexual-abuse cases by five years; given officials a six-month window to revisit old cases; and eliminated the difference in how public and private organizations (i.e., the Catholic Church) would be treated when it comes to child-sexual-abuse cases.

The cause of this?  A grandstanding state senator who found that some Pokeman were located within a few blocks of sex offenders’ houses ……… in New York City.

You can find anything within a few blocks of sex offenders’ houses ……… in New York City.

The stupid,  it burns.

Free at Last, Free at Last, Thank God Almighty We Are Free at Last!

No Comments

Today, the Windows 10 free upgrade offer and its associated nagware ends. I am so ready to be done with this crap:

Microsoft has offered its free upgrade to Windows 10 for one year to the day now. Although most users interested in the upgrade have probably already taken it, anyone who has been putting off the move to Windows 10 has mere hours left to install the new OS.

The free upgrade to Windows 10 officially ends July 29 11:59 PM UTC-10. That translates to 2:59 AM PDT and 5:59 AM EST July 30. According to a Microsoft representative, all upgrades must be completely finished prior to this time.

BTW, if you are interested, there are a number of law suits suits against Microflaccid’s remarkably persistent and deceptive attempts to force an upgrade on unsuspecting users.

Whiskey Tango Foxtrot? The Clinton Campaign is now Trying to Red Bait Trump?

2 Comments

It appears that the Clinton campaign is now trying to claim that the DNC hacked emails are a campaign by the Russian FSB to benefit Donald Trump’s campaign.

The idea of casting Trump as some sort of Manchurian Muscovite Candidate is completely nonsensical, and the claims in this article has claims from anonymous experts who present no concrete proof for their accusations:

An unusual question is capturing the attention of cyberspecialists, Russia experts and Democratic Party leaders in Philadelphia: Is Vladimir V. Putin trying to meddle in the American presidential election?

 Until Friday, that charge, with its eerie suggestion of a Kremlin conspiracy to aid Donald J. Trump, has been only whispered.

 But the release on Friday of some 20,000 stolen emails from the Democratic National Committee’s computer servers, many of them embarrassing to Democratic leaders, has intensified discussion of the role of Russian intelligence agencies in disrupting the 2016 campaign.

As an aside here, I would note that it’s right for people to be shocked here, because the US never meddles in other nations elections. (And, as Sir William Schwenck Gilbert wrote, “Married men never flirt.”)

The emails, released first by a supposed hacker and later by WikiLeaks, exposed the degree to which the Democratic apparatus favored Hillary Clinton over her primary rival, Senator Bernie Sanders of Vermont, and triggered the resignation of Debbie Wasserman Schultz, the party chairwoman, on the eve of the convention’s first day.

 Proving the source of a cyberattack is notoriously difficult. But researchers have concluded that the national committee was breached by two Russian intelligence agencies, which were the same attackers behind previous Russian cyberoperations at the White House, the State Department and the Joint Chiefs of Staff last year. And metadata from the released emails suggests that the documents passed through Russian computers. Though a hacker claimed responsibility for giving the emails to WikiLeaks, the same agencies are the prime suspects. Whether the thefts were ordered by Mr. Putin, or just carried out by apparatchiks who thought they might please him, is anyone’s guess.

 On Sunday morning, the issue erupted, as Mrs. Clinton’s campaign manager, Robby Mook, argued on ABC’s “This Week” that the emails were leaked “by the Russians for the purpose of helping Donald Trump” citing “experts” but offering no other evidence. Mr. Mook also suggested that the Russians might have good reason to support Mr. Trump: The Republican nominee indicated in an interview with The New York Times last week that he might not back NATO nations if they came under attack from Russia — unless he was first convinced that the countries had made sufficient contributions to the Atlantic alliance.

The accusations are repulsive, and they reek of desperation, and they are every bit as offensive as Donald Trump’s suggestion that Ted Cruz’ dad was involved in the assassination of JFK.

This is not the image that the Clinton campaign wants to promulgate.

I would also note that if the folks at the DNC were doing their job properly the emails would have been rather anodyne.

This really is the equivalent of the unmasked villain at the end of a Scooby Doo episode saying, “I would have gotten away with it too, if it weren’t for your meddling kids.”

Microflaccid Screws the Pooch

No Comments

A court in France has ruled that Windows 10 illegally invades user privacy, as well as being too insecure:

A French regulator has issued Microsoft a formal warning over Windows 10, saying the operating system collects excessive amounts of personal data, ships that information illegally out of the EU, and has lousy security.

The warning comes from the Commission Nationale de l’Informatique et des Libertés (CNIL), an independent data privacy watchdog with the power to levy fines against companies. The CNIL has been investigating Windows 10 since its launch and has now drawn up a damning list of criticisms.

“The CNIL has decided to issue a formal notice to Microsoft Corporation to comply with the Act within three months,” said the group on Wednesday.

………

Chief among the regulator’s concerns is the amount of information Windows 10 slurps up about its users and sends back to Microsoft’s servers. While all recent flavors of Windows send some information back to Redmond, Windows 10 harvests much more and the CNIL considers this intrusive and also not needed to run the OS.

It could also be breaking the law. The collapse of the Safe Harbor agreement last year didn’t stop this flow of data from French users back to the US, and the CNIL is concerned that Microsoft made no attempt to comply with the law. The watchdog estimates that there are at least 10 million Windows users in the Euro nation.

This in addition to buying Nokia’s cell phone business, where they wrote down over 7 billion dollars , and then they sold off the Nokia brand.

And then there is the whole ribbon thing in the more recent versions of Office.

Why is this company still a going concern?

So Now Clippy will Be In Charge of My Online Job Search

No Comments

Microsoft is buying LinkedIn:

Microsoft is buying LinkedIn for $26.2 billion, a deal in which one of the world’s biggest social networks will join a software and computing giant as it tries to broaden its reach in online services.

Under the agreement the two companies announced Monday, LinkedIn will continue to operate independently, and LinkedIn chief executive Jeff Weiner will report to Microsoft chief executive Satya Nadella. The deal with Microsoft values each of LinkedIn’s shares at $196; LinkedIn’s stock was up nearly 47 percent at the end of Monday trading.

The two companies cater to similar customers. Under Nadella’s tenure, Microsoft has sought to become a cloud-computing powerhouse that largely serves businesses. LinkedIn also primarily targets professionals and is the United States’ 11th-largest website by traffic and visitors, according to the online index Alexa. In a sign of LinkedIn’s importance to corporations, executives have been known to publish blog posts on the platform that act as corporate statements.

Monday’s deal will allow Microsoft to infuse its professional software and services with LinkedIn’s technology, a move that could give users of Windows, Microsoft Office and even the company’s personal assistant, Cortana, access to new features and elevate Microsoft’s suite of enterprise products. Meanwhile, by tapping into Microsoft Office’s user base of 1.2 billion people, LinkedIn hopes to become a central player in many companies’ day-to-day business, increasing engagement with the platform.

LinkedIn is kind of a roach motel, and deleting your account difficult, but thanks to Kevin Drum, here is the primer on how to deactivate your account.

Considering what Microflaccid tid to Skype, expect the crapification of LinkedIn to commence.

H/t DC at the Stellar Parthenon BBS

This Has Fail Written All Over It

No Comments

Some whiz kid (as in urine for brains) at Google has decided that they can simply profile you well enough to do know who you are:

Google will begin testing an alternative to passwords next month, in a move that could do away with complicated logins for good.

The new feature, introduced to developers at the company’s I/O conference, is called the Trust API, and will initially be tested with “several very large financial institutions” in June, according to Google’s Daniel Kaufman.

Kaufman is the head of Google’s Advanced Technology and Projects group, where the Trust API was first created under the codename Project Abacus. Introduced last year, Abacus aims to kill passwords not through one super-secure replacement, but by mixing together multiple weaker indicators into one solid piece of evidence that you are who you say you are.

Among the pieces of evidence that Google suggests the Trust API could use are some obvious biometric indicators, such as your face shape and voice pattern, as well as some less obvious ones: how you move, how you type and how you swipe on the screen. With the service continually running in the background of the phone, it can keep track of whether those indicators match how it knows you use your phone.

Individually, it would be ludicrous to use any of those methods to secure web services. Even facial recognition, now built in to many Android phones, is significantly less secure than a fingerprint scanner, according to Google’s own metrics. But combining them can, the company suggests, result in something more than 10 times as secure as a fingerprint.

This is a verification system that would fail when, for example, you have a migraine coming on, or when you have fallen and broken your wrist, or when you are shaken up following a car crash, then you cannot unlock your phone.

I understand why Google likes this,  “With the service continually running in the background of the phone,” it means that they can invade your privacy, and sell your data to identity thieves even more efficiently.

For the rest of us, it does not make a whole lot of sense.

Ez a Mechayeh!

No Comments

In July, Microflaccid’s offer for a free upgrade to Windows 10 expires, and it means that those f%$#ing pop up windows will be going away:

There was one issue that went unspoken in Microsoft’s announcement on Thursday that the free Windows 10 upgrade offer would end on July 29. What would the company do about all those annoying, almost malware-like, pop-up notifications to upgrade to Windows 10 that appeared on the PCs of Windows 7 and 8.1 users? The answer is they will disappear.

“Details are still being finalized, but on July 29th the Get Windows 10 app…will be disabled and eventually removed from PCs worldwide,” Microsoft told WinBeta in a written statement.

Hallelujah

The company warned that it may take some time to disable the upgrade pop-ups on computers worldwide.

Hallelujah is right.

I am sick to death of Microsoft’s nags to install its f%$#ing spyware.

*It’s Yiddish, “איז אַ מחיה,” and it means that it is a great joy.

Yet Another of My Cousin’s* Brilliant Ideas

No Comments

As you may be aware, Senators Richard Burr (R-NC) and Dianne Feinstein* (D-CA) have proposed a bill requiring that all encryption include a back door for the authorities. It appears that the bill as written also outlaws things like MP3 and JPEG files:

The proposed bill put forward by Senators Richard Burr (R-NC) and Dianne Feinstein (D-CA) to force US companies to build backdoors into their encryption systems has quickly run into trouble.

Less than 24 hours after the draft Compliance with Court Orders Act of 2016 was released, more than 43,000 signatures have been added to a petition calling for the bill to be withdrawn. The petition, organized by CREDO Action, calls for Congress to block the proposed law as a matter of urgency.

Meanwhile, in the technical world, experts have been going through the legislation and pointing out glaring holes in the draft bill. Bruce Schneier, the guy who literally wrote the books on modern cryptography, noted that the bill would make most of what the NSA does illegal, unless No Such Agency is willing to backdoor its own encrypted communications.

“This is the most braindead piece of legislation I’ve ever seen,” Schneier – who has just been appointed a Fellow of the Kennedy School of Government at Harvard – told The Reg. “The person who wrote this either has no idea how technology works or just doesn’t care.”

He pointed out that it isn’t just cryptographic code that would be affected by this poorly written legislation. Schneier, like pretty much everyone, uses lossy compression algorithms to reduce the size of images for sending via email but – as it won’t work in reverse and add back the data removed – this code could be banned by the law, too. Files that can’t be decrypted on demand to their original state, and files that can’t be decompressed back to their exact originals, all look the same to this draft law.

In the, “Has no idea how technology works or just doesn’t care,” issue, I will go for both.

This bill is a mindbogglingly stupid idea.

*Full disclosure, my great grandfather, Harry Goldman, and her grandfather, Sam Goldman were brothers, though we have never met, either in person or electronically.

Live in Obedient Fear, Citizen

No Comments

In Seattle, police raided the apartment of a privacy activist.

They got a warrant by noting that the IP address of the activist was tied to child porn, but they did not tell the judge that the activist was running a Tor node, which meant that he was not the origin point, and had no way to know the content of the material:

One week after Seattle police searched the home of two well-known privacy activists for child porn and found nothing, critics are questioning why the department failed to include a key piece of information in its application for a warrant—the fact that the activists operated a Tor node out of their apartment, in order to help internet users all over the world surf the web anonymously.

 “You knew about the Tor node,” said Eric Rachner, a cybersecurity counsultant and co-founder of Seattle’s Center for Open Policing, addressing the police department on Twitter, “but didn’t mention it in warrant application. Y’all pulled a fast one on the judge… you knew the uploader could have been literally anyone in the world.”

 At 6 a.m. on March 30, Seattle police showed up at the Queen Anne apartment of Jan Bultmann and David Robinson with a search warrant to look for child porn, based on a tip that traced an illicit video to their IP address. Six officers arrived with two vans and spent over an hour doing forensic searches on the computers in the home. One officer stood in the bedroom and watched as Robinson got dressed.

 They didn’t find anything. Bultmann and Robinson, both board members of the Seattle Privacy Coalition, were released after being detained in a van, but they were left shaken and upset.

 ………

 Bultmann and Robinson had publicly advertised that they operated a Tor exit relay node—a node in the global Tor network, whose purpose is to give users the ability to browse the web anonymously. They said they operated the node as a service to dissidents in repressive countries, knowing full well that criminals might use it as well, much like any other communication tool. Tor stands for “the onion router,” a mechanism by which information is encrypted in layers as it passes through multiple, randomized nodes in the network.

In the aftermath of the search, the question was whether Seattle police had done their technical due diligence: Did they recognize that Bultmann and David were operating a Tor node? If so, did they realize that a tip about child porn coming from that IP address, absent any other evidence, likely meant someone else in another part of the world had uploaded the material and it had been randomly routed through their node?

 ………

 “It’s like raiding the mailman’s house for delivering an illegal letter with no return address,” said one commenter on the tech website YCombinator. “Sure, it could have been sent by the mailman, but it could have been sent by anyone. There isn’t any more reason to suspect the exit node operators than anyone else in the whole world who could also have used the exit node.”

 The warrant application (PDF), signed by King County Superior Court Judge Bill Bowman, makes no mention of the Tor node, much less Bultmann and Robinson’s public roles as privacy activists. Nor does a warrant application dated February 24 to obtain subscriber records related to the address from Wave G, the Internet service provider. Both documents suggest that Bultmann and Robinson are ordinary web users with a private home connection.

 ………

 SPD spokesperson Sean Whitcomb said the department understands how Tor works and that before executing the search, officers knew that Bultmann and Robinson operated the Tor node out of their apartment. “Knowing that, moving in, it doesn’t automatically preclude the idea that the people running Tor are not also involved in child porn,” Whitcomb told NPR. “It does offer a plausible alibi, but it’s still something that we need to check out.”

 But in a statement today, the department said its detectives didn’t know about the Tor node when they filed the warrant application on March 28. If true, this means detectives took notice of the Tor node after the judge approved the warrant, then carried out the exhaustive early-morning search two days later anyway.

 Robinson questions whether police deliberately delayed checking the IP address against the public list of Tor nodes in order to avoid sharing exculpatory information with the judge. He believes a sound investigation would have checked the IP address as soon as the tip came in. “Why spoil a perfectly good warrant with facts?” he asked.

Of course, there will be on consequences for the police who deceived the judge.

There never is.