Brazilian Hacking Attempts Fail To Break Brazilian E-Voting, But Do Improve The Process

from the how-hard-was-that dept

We pointed out recently that Brazil was allowing groups of hackers and security experts to hack their e-voting machines, something that the e-voting industry has always resisted angrily. The e-voting companies have never been able to adequately explain why experts shouldn't be able to try to hack the machines, and all it did was lead to more distrust over the machines. However, the Brazil test has been concluded, and there's some good news: no one was able to crack the machines. However, with all the hack attacks, officials did learn a few things that are helping them to improve the overall process with the machines. It's really amazing that we still don't have something similar happening in the US.

16 Comments | Leave a Comment..

Guy Who Helped Mod Cable Modems Arrested By The FBI

from the freedom-to-tinker? dept

What a world we live in: if you tinker too much with the electronic equipment you buy, you might get charged with a crime. That seems to be what happened to a guy in Oregon who helps mod cable modems. Now, clearly, some people can and do use modded cable modems to access cable service that they haven't paid for, but there are plenty of legitimate reasons to hack your own hardware or to buy modded hardware. Just like unlocking a mobile phone should be perfectly legal, the same is true of unlocking a legally purchased cable modem. As the article linked above explains, most of the indictment seems to focus on the actions of others in this guy's forums, which should lead to an easy Section 230 dismissal (as he shouldn't be responsible for their actions). The only "questionable" issue for the guy is a request for certain information that could potentially have been used to gain unauthorized access -- but that's not evidence that he actually did so. All in all, this seems like an attempt to crack down on anyone interfering with artificial locks put on legally purchased hardware by the cable companies. And, if that's the case, why is the FBI involved at all? Shouldn't this just be a civil issue involving the cable companies?

76 Comments | Leave a Comment..

Brazil To Let Hackers Try To Crack E-Voting Terminals

from the good-for-them dept

One thing that never made much sense was how vehemently the big e-voting manufacturers fought pretty much every single attempt to let outside computer security experts try hacking their machines. They often made excuses about how this wouldn't be fair under "non-real-world conditions," but never explained how it would be bad to at least let these hacks proceed to learn from them and use them to strengthen the overall security of the machines. Thankfully, it looks like voting officials in other countries are a bit more open to this concept. Slashdot points out that Brazil opened up a "challenge" allowing security experts and other hackers to request to take part in a big hack attempt on e-voting equipment. Not only that, but the government is going to give $5,000 to whoever successfully hacks into one of the e-voting systems. This seems like a much smarter way to check the security on these machines than the previous method of very basic gov't oversight and the e-voting firms issuing a big "trust us," answer to every question.

6 Comments | Leave a Comment..

Craigslist's Dumb Lawsuit Against Spam Tools Provider

from the what-are-they-thinking? dept

It's hard to come up with an adjective to describe Craigslist's decision to sue Red Trumpet other than "dumb." Nothing good will come of this lawsuit for a variety of reasons, and Craigslist is asking for trouble in filing it. Now, I can understand why it sounded like a good idea. Last year, we wrote about the increasing problem of spam on Craigslist, highlighting how a variety of spammers had figured out ways around each attempt by Craiglist to stop the spam. And, yes, we absolutely agree that spam on Craigslist is a problem and a nuisance, and it's good that Craigslist is working hard to try to stop it. But that doesn't make this lawsuit make sense. The full lawsuit is below (it's a bit long), and highlights all of the different claims that Craigslist is making against Red Trumpet, a company that offers tools and services to help advertisers post messages on Craigslist (some of which may be spammy, though, certainly not all):

So what are the problems? Well, as Eric Goldman notes, Craigslist is "playing with fire" on a variety of legal doctrines, almost all of which could come back to bite Craigslist. For example, Craigslist is blaming Red Trumpet -- a service provider -- for the actions of its users in spamming the site. Think about that for a second. For the past couple of years, law enforcement officials have been trying to use that exact argument against Craigslist over things like prostitution posts on the site -- to which Craigslist has always put forth a strong defense that as a service provider (under Section 230 of the CDA) it's not liable for the actions of its users. Does Craigslist really want to try to establish a precedent that would chip away at Section 230 protections?

Next, Craigslist is making a really weak DMCA claim here. It's claiming that its various anti-spam technologies (captchas, phone verification, etc.) act as "technological protection measures" that Red Trumpet is circumventing... and thus running afoul of the DMCA's anti-circumvention rules. But the circumvention has nothing to do with violating Craigslist's "copyright," though the lawsuit makes a half-hearted attempt to claim that it does.

Then, there's the trademark claims. There are a few different ones, but it argues that Red Trumpet is violating Craigslist's trademark by mentioning Craigslist on its website and in its ads. While again, you can see why this is annoying to Craigslist, if the company is accurately describing services it provides (the ability to post on Craigslist) it's difficult to see the "confusion" being caused. The ad in question doesn't appear to imply any endorsement at all by Craigslist. And, does Craigslist really want to open up a can of worms concerning trademarks being used in ads? After all, there must be a ton of posts on Craigslist that mention trademarks.

Finally, there's Craigslist claiming that Red Trumpet violates the Computer Fraud and Abuse Act by accessing its site despite violating its terms of use. Does this sound familiar? It's the same argument that was used to try to punish Lori Drew, and was recently tossed out by a judge. Basically, it's claiming that if you happen to violate the terms of use of a site, and then still access the site, you've effectively "hacked" into the site. This is a really bad reading of the law, which is why it was good that the Drew ruling got tossed out. So why is Craigslist trying to re-establish that as a rule?

Yes, clearly, Craigslist is upset about the spam on the site -- and it should be. Plenty of users are upset about it, and Craigslist wants to help those users, help itself and stop the spam. But this particular lawsuit, with these claims, seem highly problematic -- such that even if Craigslist wins, the precedents it sets could come back to haunt Craigslist... and many other parts of the internet as well. Is Craigslist really so desperate to stop spam that it's willing to do all this other damage as well?

39 Comments | Leave a Comment..

US Prosecutor Wants To Appeal Lori Drew Ruling

from the really?--give-it-up... dept

This is incredible. Apparently the US prosecutor in the bogus Lori Drew case, which the judge finally tossed out in August is looking to appeal the decision. It's up to the US Solicitor General as to whether or not that actually happens, but just the fact that the prosecutor is still pushing this case is ridiculous. It was clearly an attempt to twist a law (unauthorized computer access) well beyond what it was meant to cover in an attempt to bring Drew up on charges because people didn't like the end result of what happened, even though she didn't break the law. The judge tossed it out because of how ridiculous it was. Also, apparently the cases that the prosecutor relied on in pushing the original case have now been rejected as well, making the argument even more tenuous. What a waste of time for a US prosecutor.

23 Comments | Leave a Comment..

Intelligence Analyst Charged With Hacking For Logging Into An Account Sent To Him Via Email

from the where's-the-hacking? dept

Wired has the odd story of a government intelligence analyst who has been charged with unauthorized access to a protected gov't computer involved in an investigation he was not authorized to access. But the problem is that the whole reason he logged in was because he had the login information emailed to him -- and he claims it went to a bunch of other intelligence analysts as well. Given that the login info was widely emailed around, due to what appears to be a breach in security protocol, it seems rather silly to then charge him with any kind of unauthorized access, and have him facing criminal charges. The real question should be why the guy was emailed the login info in the first place.

31 Comments | Leave a Comment..

Lori Drew Case Officially Dropped

from the good-news dept

While this should come as no surprise -- since the judge basically said two months ago that he was planning to dismiss the ruling against Lori Drew -- it's worth noting that official ruling dismissing the case has been handed down:

The reasoning of the opinion is that whatever unauthorized access means, it cannot mean mere violation of Terms of Service without more. Such a reading of the statute would render the statute unconstitutionally void for vagueness because it would give the government almost unlimited power to prosecute any Internet user and wouldn't give citizens sufficient notice as to what of their Internet conduct was criminal.

Phew. Whatever you think of Drew's behavior, it was absolutely wrong to try to twist a totally unrelated law to find something to charge her with.

Of course, now, in the wake of this debacle, Missouri passed a new law making online harassment a potential felony, and the first case under that law has been filed.

24 Comments | Leave a Comment..

Charges Dropped Against Student Who Alerted University To Security Flaws

from the don't-hack-and-tell dept

Last year, we wrote about a student at Carleton University in Canada who was arrested for hacking, after he wrote up a 16-page paper telling the school how poor its computer security was, and had some suggestions on how to fix it. It does sound like, in the process of figuring this out, the guy did hack into some accounts to prove that the vulnerability was there -- but there doesn't seem to be any evidence that he did anything with the access. And the fact that he wrote up a detailed paper on it and alerted the university certainly suggests his intentions were benevolent. So it was a bit disturbing that he was arrested. However, Allan Lussier-Meek writes in to let us know that charges against the guy were recently dropped after he agreed to go through a community service program. It's still not entirely clear why he needed to do that. This really does seem like blaming the messenger.

28 Comments | Leave a Comment..

This Is Investigative Reporting? News Corp. Allegedly Hacked Into Phones, Paid Off People To Silence Them

from the hmm... dept

We keep being told that only newspapers can do "real" investigative reporting, even though we've seen plenty of evidence of others doing quite impressive investigative reporting without having a background in journalism. And, now, we find out that some investigative reporting by those "real" journalists apparently involved breaking the law, violating individuals' privacy... and then paying people off to keep quiet about it. At least that's the charge from The Guardian against Rupert Murdoch's News Corp. According to the Guardian's report (and, yes, the Guardian is a real newspaper and appears to have done a nice investigative job here -- we're not saying newspapers can't do good investigative reporting), there's growing evidence that a lot of folks involved in Murdoch's News Group Newspapers were involved in hiring people to hack into thousands of mobile phones to record and transcribe phone calls between various politicians and celebrities, and also involved tricking "government agencies, banks, phone companies and others... into handing over confidential information." And? When that evidence started to come out, they apparently paid up a bunch of hush money and convinced a court to seal the files. Again, this isn't to implicate all newspapers (the fact that another newspaper figured this out is great). But the idea that newspaper investigative reporting is somehow "pure" once again seems to be in question.

33 Comments | Leave a Comment..

Judge Tosses Out Lori Drew Ruling

from the wow dept

The Lori Drew verdict finding her guilty of computer hacking because she may have broken MySpace's terms of service (without even having read them) was a classic example of prosecutors trying to stretch the law to punish someone who did something they didn't like, but which wasn't against the law. The implications of the ruling were quite troubling, in that they could turn almost anyone into a criminal if prosecutors wanted to charge them as such. For months, though, the judge in the case has been weighing whether or not to overturn the ruling. It's not clear why it took so long, but the judge has in fact acquitted Drew on the three charges she was found guilty of by the jury. This is good news all around. No matter what you think of Drew and what she did, prosecutors twisted the law in a way that would have set an amazingly dangerous precedent. It will be interesting to see if there's an appeal, but for now, this is undeniably good news.

68 Comments | Leave a Comment..

Palin Email Hacker Says Emails Were Public Record... So No Crime?

from the legal-twists-and-turns dept

Last year, we noted two separate problems with trying to prosecute the guy accused of figuring out Sarah Palin's Yahoo email account password and posting it to the internet. First, the Justice Department has stood behind a position that opened emails are not private, based on a very literal reading of the law (you can check the link to understand the reasoning). Second, the law used to charge the guy specifically said that it was only a felony if it was used to further a criminal activity. That is, the hacking, by itself, wouldn't be seen as a crime unless it was a part of a larger criminal activity -- which it wasn't. Prosecutors changed the charges earlier this year to address that -- claiming that the criminal activity was a violation of Palin's privacy.

The accused guy, David Kernell, and his lawyers are trying a variety of different defenses (not surprisingly, of course), including claiming that Palin's privacy was not violated, because Palin's emails were a public record because (due to a separate lawsuit) a court had ruled that Palin was required to preserve her Yahoo account email. Because of this, the argument goes, the emails are part of the public record (which, given the first DOJ definition above, could fit under the DOJ's interpretation of the law). It's difficult to see this line of reasoning succeeding directly, as it seems to defy common sense, so it would be surprising if a judge bought into it.

33 Comments | Leave a Comment..

Should Police Be Arrested For Illegal Hacking For Setting Up Fake Facebook Profile?

from the we-should-be-fair,-right? dept

In the Lori Drew case, she was convicted for "computer hacking" because she violated MySpace's terms of service by setting up a profile of a fake person. And for this, she deserves years in jail? Well, if that's the case, reader Roni Evron wants to know if some police officers are going to face the same charges after they set up a fake Facebook profile in order to bust up an after-prom high school party. Apparently, they set up a fake Facebook profile and friended a bunch of the kids at school, who apparently were "cavalier about accepting people into their network of friends." That, of course, is fine... but it's basically the same thing that Drew was arrested and convicted of doing.

65 Comments | Leave a Comment..

Prosecutors Still Want To Pretend Lori Drew Was Convicted Of Harming Megan Meier

from the this-is-sickening dept

The prosecutors in the Lori Drew trial continue to make a mockery of the law. After pushing to give Drew the maximum three years in jail not because of what she was convicted for, but because she "has become the public face of cyberbullying," prosecutors are now demanding that Megan Meier's parents speak at the sentencing hearing, claiming they are Drew's victims. Except... that's simply not true. Drew was convicted merely of having "hacked" into MySpace's computers, because she broke their terms of service by not using her real name (even though she didn't even sign up for the account). The fact that Megan Meier later committed suicide has nothing to do with what Lori Drew was actually convicted of doing. The only reason to allow them to speak at the sentencing is to push for an emotional reason for the sentencing rather than a legal one. The whole thing is a rather disgusting display of a prosecutor abusing the law to punish someone who he believes did wrong, but who did not actually break the law. Whether you believe what Drew did was horrific or not, there's simply no excuse for abusing the law in this manner.

96 Comments | Leave a Comment..

Prosecutors Want To Give Lori Drew 3 Years In Jail For Symbolic Reasons

from the sickening dept

As the sentencing phase of the Lori Drew trial moves forward, prosecutors are asking for three years in jail, well beyond what she should get based on normal sentencing guidelines. So, why? It's not because of anything she actually did, but because of what she represents:

"Defendant has become the public face of cyberbullying. A probationary sentence might embolden others to use the Internet to torment and exploit children."

It's hard to have any more direct proof that this case has never been about what Lori Drew actually did and whether it was a crime, but about some grandstanding prosecutors looking to create a PR campaign. Even worse, the prosecutors seem to be focusing on the cyberbullying issue even though that's not what the trial was even about. She was convicted of computer fraud in giving a false name to MySpace, violating its terms of service. The actual "cyberbullying" isn't what she's on trial for at all. It's really rather despicable to see the legal process twisted, in a Salem Witch Trial type of show, in which the sentencing recommendation has no relation to the actual conviction.

99 Comments | Leave a Comment..

Guy Convicted Of Hacking For Uploading Naked Picture Of Himself

from the that-doesn't-seem-right... dept

The ruling against Lori Drew was quite problematic, because it twisted a computer hacking law to convict a woman who had done something else, which was distasteful, but not illegal (at the time). It looks like others are doing the same thing... and succeeding. An appeals court has upheld a hacking conviction against a man whose "hacking" seems to have consisted of uploading a naked photo of himself to the website Adult Friendfinder from his work computer. How is that "unauthorized use" of a computer under the statute in question? Well, the court says that it's unauthorized use because he was using the computer to solicit prostitution -- and that's a crime, therefore, it's unauthorized. By this rather troubling reasoning, just about anyone who commits a crime on a computer can now also get hit with this law against hacking, because their use, by definition, would be "unauthorized." About the only good thing in the decision is that the court tossed out the lower court's ruling that the guy had "stolen" money from his employer by using the computer for non-work purposes.

28 Comments | Leave a Comment..

When You Put The Military In Charge of 'Cyberdefense', Don't Be Surprised They Want To Go On The Offensive

from the uh,-we're-going-to-need-lots-of-bombs dept

A US Air Force officer says that America should build a military botnet and go on the offensive, so the system acts as a deterrent against future attacks. Who would be attacked? According to the BBC, "he argues that if a computer owner has failed to use anti-virus software and install the latest security patches, that machine may be a legitimate military target." Wow. So not having anti-virus software makes it okay for the military to attack any computer? Why stop there? Why not just blow the thing up, if it is indeed a "legitimate military target"? If these are the sorts of strategies that the military sees for cybersecurity -- which the officer has called "carpet bombing in cyberspace" -- perhaps we'd be better off with somebody else heading up the efforts.

Carlo Longino is an expert at the Insight Community. To get insight and analysis from Carlo Longino and other experts on challenges your company faces, click here.

57 Comments | Leave a Comment..

If Criminals Are Smart Enough To Hack Old Nokia's, Can't They Keep A Secret?

from the thankfully-criminals-are-dumb dept

If you have an old Nokia 1100 phone, maybe it's time to dust it off and try selling it in Germany where hackers claim to have figured out a way to use certain Nokia phones to steal authentication codes for bank transactions. There are a few reports that these old phones (if they were made in a very specific factory, not just any old model...) are selling for ridiculous amounts -- ranging from $700 to $30,000 -- presumably because the handsets are so hard to find and are valuable to hackers prone to crime. So far, Nokia says it can't imagine any way for these old phones to be hacked for banking fraud. But not surprisingly, security vendors are quick to point out the plausibility of this type of phone hacking -- since security firms can obviously benefit from unfounded fears that encourage consumers to buy security software regardless of the actual need for it. Is it really that hard to ask a security vendor what the likelihood would be for a criminal to actually succeed in such a scam? Hopefully, the odds of actually stealing any money with these ancient phones are approaching zero -- especially now that the tools to implement the fraud are known and apparently getting quite expensive. Perhaps the real suckers in this story are the gullible hackers who are buying old phones in shady forums for prices that are well more than the phones are worth?

16 Comments | Leave a Comment..

Australian Law Enforcement Wants The Right To Hack Computers

from the the-modern-wiretap dept

As technology changes, so does the demands of law enforcement officials to figure out better ways to spy on your use of that technology. For example, efforts to wiretap Skype conversations has been a popular subject among law enforcement around the world. Down in Australia, the police are now looking for the right to hack your computer. At the very least, it would require a warrant, but a judge could authorize the police to hack into your computer and monitor it for up to 7 days at a time and not tell the owners for up to three years (depending on the circumstances -- and it would require several approved extensions for it to last that long). Not surprisingly, this is rather controversial, and security companies in particular have made it clear they want no part of this (i.e., they won't create backdoors) and fully expect their products to block such hacking attempts. How long until new legislation is proposed that forces security vendors to change their minds about that as well?

29 Comments | Leave a Comment..

Facebook's Lack Of Hacking Resolution System For Nigerian Scammers

from the seems-like-a-problem dept

In the past week, you may have seen various news stories about Nigerian scammers hacking into Facebook, and then sending their "friends" messages, saying they're stranded in London without money. It is, of course, just the latest improvement on the venerable old Nigerian 419 scam, this time upgraded to use hacked/phished Facebook accounts to trick trusting friends into coughing up their money. However, one of the biggest issues is raised by Yehuda Berlinger, who points out that for those who are hacked, Facebook doesn't seem to have any reasonable way to contact them and fix the problem. Considering how much of your "identity" might be tied up in your social networking profile, you would think that a company like Facebook would have a ready made system in place to handle such "emergency" situations.

15 Comments | Leave a Comment..

Chinese Windows Users Accuse Microsoft Of Hacking Their Computers

from the a-successful-antipiracy-day,-huh? dept

Part of Microsoft's big antipiracy day festivities was to talk about how it was ramping up efforts to crack down on unauthorized copies of its software in China (again, despite the fact that unauthorized copies in China are part of what helped establish Microsoft software as the de facto standard there). The efforts in China include more use of what Microsoft likes to call "Windows Genuine Advantage" -- which is really a DRM system known mostly for falsely accusing legitimate buyers of being pirates. Approximately half a million legitimate buyers were accused of piracy, leading many to suggest that WGA is quite similar to a rootkit, making your computer not function properly, all in the name of stopping piracy.

Over in China, it appears that they're not at all happy about WGA. Last year, a student there sued Microsoft for privacy violations in sending info back to Redmond via WGA, and in response to Microsoft's "get tough on piracy" campaign, apparently a bunch of folks in China are publicly denouncing WGA as being an illegal intrusion on their computers. They're accusing the company of trying to control computers without permission and of "hacking" their systems. Microsoft's response, of course, would be that legitimate buyers have nothing to worry about -- even though that doesn't quite seem to be the case. Still, it's difficult to feel all that sympathetic for the complainers -- as they should have known what they were getting with Windows. If they don't like it, there are other options on the market.

20 Comments | Leave a Comment..