China has 2 million people monitoring the internet

According to Chinese state media, the country hires two million people to run and monitor its "Great Firewall".

Beijing News has reported that many employees are performing keyword searches and checking tens of millions of messages being posted each day.

The number of employees highlights just how low tech and human intensive the operations are.

Even then, staff are unable to prevent comments that are deemed by the government to be undesirable from being published and reposted.

The "web police" are hired by the government's propaganda arm, as well as by commercial sites.

China has more than 500 million internet users, making it the world's largest online population.

If a western country wanted to set up a similar operation it would have its work cut out to justify it.

According to our estimates, if David Cameron wanted to establish a "great firewall of Britain" he would have to hire roughly 210,000 people to keep up. Of course, British labour is not cheap, so it might be worth considering outsourcing such an operation to China.

by Nick Farrell via TechEye - Latest Security headlines

The jolly japes of Steve Wozniak

Apple co-founder Steve Wozniak said that he is a hacker to his core and loves to play pranks on friends and family.

Woz told Network World he had fun with light-hearted forays into hacking computer and telecommunications networks several decades ago.

He said that people with imagination in engineering are naturally drawn to the idea of finding ways to bypass security controls.

But Woz added that he never once hacked a computer for real and his break-ins were done in the spirit of exploration, never for profit or malice.

One prank involved some experimentation into a shared computer system where he left nine pages of Polish jokes.

Once he read an article about how tone signalling could be used to manipulate telephone networks to set up calls. Woz worked out the exact frequencies and tried them out on the telephone system. He used his skills to explore the network but did not steal or avoid paying bills.

He admitted he used to sneak into at least one eminent Stanford institution's lab every Sunday when it was supposed to be closed, to find electronics and science manuals.

Many of Woz's break-ins were combined with a prank. Once he guessed his stepson's password for the Macintosh and made the files he found hard to access. He and his wife teamed up on the kid to leave a folder marked "from Mom".

by Nick Farrell via TechEye - Latest Security headlines

Google Earth helps clear landmines

The HALO Trust has revealed just how useful Google Earth can be for the organisation's work clearing landmines.

Teams in Afghanistan, Kosovo and Zimbabwe are regularly using Google Earth to build maps for donors and governments, as well as collating information about areas which are affected by landmines.

Executive director Guy Willoughby explained in a Google blog post: "Google Earth Pro makes it easier for the HALO team to do the dangerous and detailed work of finding and mapping at-risk areas.

"Because it’s based on the same technology as Google Maps and Earth, it’s easy for our teams to use and create maps without IT or GIS expertise. It’s a tool that is familiar to our employees and something they use in their daily lives, so we can start mapping right away."

The Trust notes GPS references to landmines, which are then imported into Earth Pro for plotting the locations. Satellite imagery from Google Earth is used to mark and map dangerous areas, which are then passed on to families who live nearby, as well as donors, NGOs, governments and clearance crews.

"When donors view the vivid interactive maps of our project areas, with mines so close to schools, farms and houses, they understand why the HALO Trust's work is so critical," Willoughby writes.

Using accurate maps translates into safer conditions for clearance teams. Using Google tech and with the aid of donors, the organisation thinks it will be able to make Kosovo completely free of mines.

by A staff writer via TechEye - Latest Security headlines

NSA, GCHQ break encryption, collaborate with top tech companies

The United States' National Security Agency has collaborated with technology companies and internet service providers to build the typically accepted standards of web security itself, and reportedly has the means to brute force encryption standards it itself had a hand in building.



New revelations from the Snowden cables reveal the NSA has cracked most encryption that was considered a safeguard for commerce and banking systems around the world, and the very same encryption that was supposed to protect sensitive data like medical records, as well as email, web searches, online chats, and phone calls - of Americans and others, globally.



Beginning in 2000, according to the New York Times, the NSA went about building supercomputers that were capable of breaking complex codes and encryption. Additionally, the secretive but bloated agency collaborated with US technology companies to build backdoors directly into their products and services.



These new revelations fly in the face of strings of denials from US internet companies after the initial Snowden leaks. Microsoft, Facebook, Apple and the gang were all adamant that there were no delibate backdoors built into software or hardware. Whether they were willing collaborators or had their hands forced in the name of "national security" is up in the air.



A 2010 GCHQ memo speaking of the NSA's work said: "For the past decade, N.S.A. has led an aggressive, multipronged effort to break widely used Internet encryption technologies. Cryptanalytic capabilities are now coming online. Vast amounts of encrypted Internet data which have up till now been discarded are now exploitable”.



$250 million a year is reportedly spent on a program which "covertly influences" technology company product designs, the Guardian reports, while the influence and capabilities of the agency against encryption is said to be closely guarded. Analysts were warned not to ask about, or speculate on, sources or methods.



The British spy agency, GCHQ, is itself largely bankrolled by the US taxpayer. It was earlier revealed that other English-language countries Canada, Australia, and New Zealand were allied with the USA's spying efforts - and although there was bluster from other European countries, protecting national business or security secrets was what had them irate. These latest leaks suggest even those were compromised, despite any international agreements.



The Guardian claims a GCHQ team has worked its way into encryptic traffic from top service providers - listed as Hotmail, Google, Yahoo, and Facebook.



The New York Times article is here while the Guardians' is here.



"Secure" email company Lavabit - which Edward Snowden is suspected of using to transmit information to Guardian journalists - shut itself down in light of the last round of leaks. Its CEO said if the public knew what he knew about email communications, they may be less likely to use it.



Likewise, popular law blog Groklaw decided to pull the plug, citing concerns about being able to properly provide anonymity where anonymity was necessary.



The latest revelations - that the United States and its allies are aggressively pursuing all online communications, including those that are encrypted - could be cited as a further reason for activists, the privacy minded, or civil liberties groups to withdraw from the internet, and there is a greater risk self censorship than ever before.

by A staff writer via TechEye - Latest Security headlines

VPNs caught in Cameron's porn filter

Popular mobile operator GiffGaff, which runs on the O2 network, includes at least one Virtual Private Networks (VPNs) in British prime minister David Cameron's deeply unpopular 'porn filter' dragnet.



TorrentFreak found that some VPNs have already been automatically blocked under the guise of an 'adult filter' of some - but not all - mobile providers. Exchanged between VPN provider iPredator and GiffGaff show that the former has been placed on a blacklist because it could potentially allow children to get around age restrictions.



VPNs are a way to route traffic away from ISPs and through independent providers, and have gained popularity in oppressive regimes that impose censorship on their citizens. Although they can certainly be used to access pornographic material, it is understood that, for many, this is not the primary purpose of a VPN.



A statement from GiffGaff explains:



"The response received from head office have confirmed that websites or services that offer, inter alia, a method for younger members to access over 18 content, without age verification; such as VPN services, are blocked by our network provider (O2) and are not controlled by GiffGaff.



"O2, along with other major mobile operators in the UK, have signed up to the code of practice with the UK's Independent Mobile Classification Body which sets forth guidelines in terms of content management and the protection, amongst others, of customers and members below the age of 18.



"In section 2.8 of our terms and conditions it states that we have the right to restrict access due to age which all of our members have agreed to abide by when joining the service.



"GiffGaff reserves the right to restrict access to certain services due to age restrictions".



This is the same reason Cameron used to justify a censorship programme which would see new customers actively have to opt-in to receiving adult services. The proposal was put forward to protect children, however, the terms of censored content are vague: as well as pornography, websites that are classified as "violent material," "extremist related content," "anorexia and eating disorder websites," "suicide related websites," "alcohol", "smoking," "web forums," and "esoteric material" are all included under policy.



Although those over 18 can enable such material, critics say the terms are deliberately vague and can be applied to a wide range of material.



For example, the Oxford English Dictionary defines "esoteric" as "intended for or likely to be understood by only a small number of people with a specialized knowledge or interest".



However, internet activists have a long history of dodging centrally imposed sanctions - indeed, the content industry's bureaucratic attempts to shut down piracy, through policy or otherwise, has turned into a game of whack-a-mole. When one is blocked or shut down, another appears, as in streaming websites. Proxy websites are made available, hosted outside a nation state's borders, making them more difficult to censor or control.



TechEye recommends a scan through the Streisand Effect's Wikipedia page.

by A staff writer via TechEye - Latest Security headlines

Huge DoS attack hits China

A massive denial-of-service attack took down much of China’s internet on Sunday. The attack was described as the biggest DoS attack ever faced by the Chinese government.

It began early Sunday and in a couple of hours it picked up to the point that it started to affect users. The attack targeted the .cn registry which was eventually knocked out for two to four hours. Lucliky, most .cn sites weathered the storm, relying on registry records stored by service providers.

The attack appears to have stopped and Chinese users are now able to access all websites smoothly, apart from those that discuss democracy, dissidents, Tibet, the Tiananmen Square massacre and a few thousand other things communists don’t like to talk about.

The big question is who was behind the attack. Although things are relatively quiet on the international front, China is embroiled in a few internal PR disasters, including the trial of Bo Xilai and a crackdown on social media. The Great Firewall of China is good at filtering embarrassing internet searches, but it was never designed with security in mind. Well, at least not this sort of security.

CloudFlare says the attack could have been carried out by a single individual, despite its sophistication and apparent success, reports the WSJ .

by Nermin Hajdarbegovic via TechEye - Latest Security headlines

Groklaw's Pamela Jones: "For me, the internet is over"

Groklaw's founder, Pamela Jones, has decided to pull the plug on the website, citing surveillance conerns in the wake of the NSA spying revelations.

Jones explained her reasoning in final Groklaw post, opening: "The owner of Lavabit tells us that he's stopped using email and if we knew what he knew, we'd stop too. There is no way to do Groklaw without email. Therein lies the conundrum."

Lavabit was a secure email service which is thought to have been used by Edward Snowden . Its CEO shut Lavabit down after pressure from the US government rather than continue to run a compromised service.

"The conclusion I've reached is that there is no way to continue doing Groklaw, not long term, which is incredibly sad," Jones wrote. "And the simple truth is, no matter how good the motives might be for collecting and screening everything we say to one another, and no matter how "clean" we all are ourselves from the standpont of the screeners, I don't know how to function in such an atmosphere. I don't know how to do Groklaw like this."

Groklaw has been an important community for law and in particular, the close intersection of technology and law.

It sometimes used anonymous tip-offs. Because the United States stores emails sent from outside the country - with encrypted emails stored for five years, Jones writes - readers from around the world could become compromised or exposed.

Jones said she plans to "get off of the internet to the degree it's possible", and that after thinking the situation through, she "can't stay online personally" not that privacy is being proved impossible.

"I find myself unable to write," Jones said. "I've always been a private person. That's why I never wanted to be a celebrity and why I fought hard to maintain both my privacy and yours."

"Oddly, if everyone did that, leap off the Internet, the world's economy would collapse, I suppose. I can't really hope for that. But for me, the internet is over."

In a tweet, Privacy International said: "The mere threat of surveillance is enough to self-censor".

by A staff writer via TechEye - Latest Security headlines

Facebook denies hacker $500 exploit reward

Idiots at Facebook were humiliated by a hacker after they tried spin out the news the software was flawed.

Facebook has a policy that it will pay a minimum $500 bounty for any security flaws that a hacker finds.

Khalil, a systems information expert from Palestine, found a vulnerability that allows anyone to post to another user's timeline whether they're friends or not. He tried to report it to Facebook's security team twice.

He even warned them that he could post to Zuckerberg's wall, but they told him that it was not a bug and to go away.

So Khalil posted an Enrique Iglesias video to Sarah Goodin's wall. Goodin was a woman that Zuckerberg went to college with.

The security team still claimed that since you can't see that post unless you're a friend of sarah, it is not a bug.

So he posted onto Mark Zuckerberg's wall details of the security hole. Khalil was very nice about it and said he was sorry for violating his privacy.

In less than a minute his Facebook account was suspended and he was contacted by a Facebook engineer requesting all the details of the exploit.

They claimed that he had not given enough technical information for them to take action on it. Why do we have the impression that this one was bumped up to someone's supervisor?

However, they said that by proving to them the hack existed, Facebook could not pay him for the vulnerability because his actions violated Facebook's Terms of Service.

Of course, it's all his fault, the security team couldn't have said, "Yeah we see what you're talking about we need some more technical information." Khalil tried at least two times to contact them and both times they told them to go forth and multiply. So in other words the guy finding the exploit loses out by forcing someone at Facebook to realise it was a flaw.

In effect, the hacker was punished for his good faith - when it could have been possible to sell it on to a third party and make more cash that way.

by Nick Farrell via TechEye - Latest Security headlines