Day: October 7, 2005

Thanks to Entrust's identity blog for pointing us to this website describing research by Li Zhuang, Feng Zhou, and J. D. Tygar on the privacy of typed material in the presence of microphones. The site contains links to their paper, and will shortly be supplemented with raw versions of their experimental data and setup. Note that it will be changing its URL to keyboard-emanations.org.

We show that using a generic microphone, we can successfully recover almost all text typed on standard keyboards. Unlike previous research our method works even if we have no information about the typist, the keyboard, and no “training data” (examples of the typist typing known text). Simply put a microphone in a room with a typist, record 10 minutes of data, and our algorithms recover the typed text … including arbitrary text, such as passwords. Our work breaks even “quiet” keyboards that are designed not make sounds. Our results suggest that recovery is possible even if microphones are outside the room (using parabolic microphones).

Paper: Keyboard Acoustic Emanations Revisited (to appear at the November 2005 ACM Conference on Computer and Communications Security)

[tags: Privacy, Passwords, Accoustics, Privacy Threat Analysis]

As the following article by Ben Charney from eWeek shows, toolbars can make excellent pharming implements. I predicted this in one of my early blog postings, and of course it had to come true. Please note that I'm not hitting on Google – I'm pointing out a problem much broader than any one company or technology.

An Internet security specialist says a new threat forces computers to install faked Google software, which then goes phishing.

Phishing is where e-mails, IM (instant messages) or Web sites parody a legitimate company, and try to get users to provide personal information or financial account numbers and passwords.

I actually see this as pharming as much as phishing, since the toolbar resides on your PC and continues to harvest information. But hey! Maybe it does both at once!

The latest cases involve bogus Google software spread via IM, and appear to be a variety of the infamous CoolWebSearch phishing scheme, according to Foster City-Calif.-based FaceTime Security Labs. CoolWebSearch has never been spread via IM before.

In the recent cases, IM users unwittingly download a rogue tool bar, which is installed on a Web browser and provides easier access to an Internet search provider.

Tool bars also contain measures to block pop-up advertisements.

The only working feature on the fake Google Toolbar saves credit card details, according to Christopher Boyd, the security research manager of Foster City, Calif.-based FaceTime Security Labs. A bevy of others, including one to “enable pornographic ads,” do not work.

IM is increasingly a target of phishers, as the latest attacks show.

Some IM-related attempts date back to 2003.

Most recently, in early March, Yahoo Inc. confirmed that some of its Yahoo Messenger customers received a message that appears to be coming from a buddy-list contact.

Users can be lulled into directing a Web browser to a Yahoo Web page requesting log-in information for Yahoo accounts, according to an analysis by Akonix Systems Inc.

The cases in point appear similar to a rather infamous method of hijacking Web browsers known as CoolWebSearch, Boyd adds.

Instant messaging is increasingly a target of phishers, as the latest attacks show.

Some IM-related attempts date back to 2003. Most recently, in early March, Yahoo Inc. confirmed, came under attack through Yahoo Messenger, its IM service.

In the attack, users receive an IM message that often appears to be coming from a buddy-list contact.

The IM attempts to lull users into clicking on a URL, which then takes them to a spoofed Yahoo page requesting login information for their Yahoo accounts, according to an analysis by Akonix Systems Inc.

Let's work on holistic solutions that protect against these attacks and leverage progress made in one application across all others. As I told Mary Branscombe of the Guardian,

Improving site security with a better password system, or a toolbar that checks you are at the right site, can't fix a general security problem. “There are excellent people working on these things, but they can't counter current threats without changing the way computers behave in a distributed fashion,” Cameron says. “We need to work together.”

[tags: Identity Theft, Pharming, Yahoo, Toolbar]

Craig Burton has a Master of Infrastructure from Novell. A co-founder, he was the major force in transforming it from a hardware company to one of the most innovative software forces in the history of networking. Later he got his Doctorate in Infrastructure from the Burton Group, which he founded with Jamie Lewis, proposing the Network Services Model.

Today, he released a new single on his blog, which went like this:

(To a Marley reggae beat): I, I, I cry ubiquity…

Ubiquity rules.

Identity 2.0 is a tough problem. This is because it not only requires a new architecture, but because it requires that the user rethinks how identity works.

It's a shift from

Identity 1.0–server-based user name and password

to

Identity 2.0–network-based user verified credentials.

This is no small shift. It changes everything.

However,

It will only change everything when Identity 2.0 infrastucture becomes ubiquitous. Free. A given. Like air and sunshine.

Most would-be identity systems–OpenID, Ping, Sxip, Liberty to name a few–are not well designed to become ubiquitous. They each require that you buy into their architecture to work. You must adopt their protocols and system intrinsics. Open and Simple by itself just doesn't cut it.

What is needed is an architecture that is independent of mandated adoption.

This is part of the bueaty of Kim Cameron's Identity Metasystem. I can't emphasize the importance of such a design towards the objective of ubiquity.

I, I, I cry ubiquity.

By definition, a metasystem must be inclusive of the other underlying systems. So for those new to the discussion, InfoCards are not positioned against any of the systems Craig mentions. In theory you could have an InfoCard that represented an identity provider based on SXIP technology, or on Liberty technology or whatever else. In fact a number of people are thinking about building this type of offering.

Would the underlying systems have to add a bit of code? Yes.

But ubiquity and inclusiveness make such a potent combination that it would be well worthwhile.

[tags: Digital Identity, Identity Metasystem, Ubiquity, Identity 2.0, Craig Burton]