Monday, July 22, 2002

Re: Crackers -- aka hackers -- providing useful information Recently, while doing research on how to use the ELF (extensible linker format, or executable and linker format, depending on what you read) I discovered that the most useful information was put out by the cracker community. I found three papers that gave detailed information on how to use ELF features including example code. In one case, the intent was to allow `parasites' to be embedded in a UNIX program; in another the author was exploring binary encryption as a means of preventing forensic analysis of an attack. In the third case, the paper described ways to allow a parasite to access shared library functions. I'm not sure what to make of this. On the one hand, I don't want anyone running `parasites' on my computers. On the other hand, this information saved me a lot of digging and experimentation. Fred Gilham [Fred Gilham via risks-digest Volume 22, Issue 17] 17:50 # G!

UK - Act to redress mobile phone theft UK - Act to redress mobile phone theft. (Baker & Mackenzie Elaw Alerts) The Mobile Telephones (Re-programming) Act received its second reading in the House of Commons on July 22, 2002 and was given royal assent on July 25, 2002. The Act creates offences in relation to the re-programming of the unique electronic identifiers used in mobile phones. It also makes it an offence to interfere with the operation of unique identifiers by use of an electronic chip. [Quick Links Computercrime Cybercrime] 15:43 # G!

Wrong number costs Gateway $3.6 million A federal court has awarded a Pensacola business $3.6 million in damages from Gateway, which had accidentally distributed the wrong phone number for customer complaints to more than 275 Gateway stores. The error dated back to 1999, when someone at Gateway erred by using the 800 prefix instead of the correct 888 prefix for the company's toll-free customer complaint line. The wrong number was also posted on Gateway's Web site, listed on Internet billings and included on a form distributed to more than 100,000 Gateway customers. Mo' Money, which manufactures and distributes promotional items, said it contacted Gateway six days after the calls began, but that it took the computer company more than two years to fix the problem. "It was a nightmare," says Mo' Money president Cliff Mowe. "We had as many as 8,000 extra calls a month, and these were all angry people You couldn't get them off the line because the only number they had was ours. You'd have to explain it and go through it, and a lot of times they'd call you right back anyway." [Associated Press, 19 Jul 2002; NewsScan Daily, 20 July 2002] http://apnews.excite.com/article/20020719/D7KS83F82.html ["NewsScan" via risks-digest Volume 22, Issue 17] 15:41 # G!

Finger-printing children in schools, without parental involvement [Note the return of an old favourite: "People who have nothing to hide - why would they worry?" PH] Row over finger-printing in schools Source: http://news.bbc.co.uk/hi/english/education/newsid_2144000/2144188.stm Tens of thousands of children are being finger-printed in school -- often without the consent of their parents, a human rights group has complained. Prints are taken for a library lending system which the makers say makes lending more efficient and less vulnerable to abuse. But the pressure group Privacy International says the practice is illegal and breaches the human right to privacy. [Dangerous] One of the makers of the technology, Micro Librarian Systems (MLS), say they have sold about 1,000 systems to schools in the UK and abroad. Simon Davies, of the campaign group Privacy International says the practice is "dangerous, illegal and unnecessary". He says the use of the technology should be banned in schools. "It dehumanizes our children and degrades their human rights," he said. "Such a process has the effect of softening children up for such initiatives as ID cards and DNA testing. It's clearly a case of 'get them while they're young'. They are seen as a soft target for this technology". [Encrypted] The group says it has been contacted by parents who are angry that they have not been asked for to give their consent for the finger-printing. Manufacturers MLS say it would be very difficult for a third party to access the prints and make use of them. The company's technology director Stephen Phillips said: "The system does not store the actual finger-print, but a map of it which takes in the print's key features. "The image is then compressed and encrypted, so it would take a lot of effort to use it. "People who have nothing to hide - why would they worry?" Mr Phillips said the company advised schools to consult or inform parents before they used the technology. He said only two parents had complained about the use of the technology to the company. Privacy International says it expects there to be legal challenges to the use of the technology in schools. [Also commented on by Gary Barnes. PGN] [Peter Houppermans via risks-digest Volume 22, Issue 18] 15:37 # G!