Binary Intelligence

Web sites that strip personally identifiable information about their users and then share that data may be compromising their users' privacy, according to researchers at the University of Texas at Austin.

They took a close look at the way anonymous data can be analyzed and have come to some troubling conclusions. In a paper set to be delivered at an upcoming security conference, they showed how they were able to map out the connections on public social networks such as Twitter and Flickr. They were then able to identify people who were on both networks by looking at the many connections surrounding their network of friends. The technique isn't 100 percent effective, but it may make some users uncomfortable about whether they should allow their data to be shared in an anonymous format.

Web site operators often share data about users with partners and advertisers after stripping it of any personally identifiable information such as names, addresses or birth dates. Arvind Narayanan and fellow researcher Vitaly Shmatikov found that by analyzing these "anonymized" data sets, they could identify Flickr users who were also on Twitter about two-thirds of the time, depending on how much information they have to work with.

From NetworkWorld.com.

CanSecWest is currently going on, and I am not there. No complaints however, as I am finishing up a week long training class in X-Ways Forensics. (Verdict: top notch. Check out the program.)

Catching up on the news tonight, I found these quotes from an interview with Charlie Miller (winner of the PWN to OWN contest against OS X) very interesting:

Did you consider reporting the vulnerability to Apple?

I never give up free bugs. I have a new campaign. It’s called NO MORE FREE BUGS. Vulnerabilities have a market value so it makes no sense to work hard to find a bug, write an exploit and then give it away. Apple pays people to do the same job so we know there’s value to this work. No more free bugs.

I have heard this rumbled about for a while. There is no disputing that there is a market for bugs, and it is sort of refreshing to hear someone be upfront about their reasons for finding bugs. A lot of people like to pretend that this work is done for "the good of the community". Really, there are a few reasons white hats find the bugs: a) To keep private to add value to their pentests, b) to release to the public to show off their skillz and c) to sell.

I don't see any shame in that. Why should companies like Apple, MS, etc. expect customers to do their work for them? What is the value?

You talked earlier about the value of vulnerabilities. Was it a surprise that he (Nils) basically gave up three “high-value” bugs for $5,000 each?

It’s clear he’s incredibly talented. I was shocked when I saw someone sign up to go after IE 8. You can get paid a lot more than $5,000 for one of those bugs. I’ve talked to a lot of smart, knowledgeable people and no one knows exactly how he did it. He could easily get $50,000 for that vulnerability. I’d say $50,000 is a low-end price point.

For the amount of time he spent to do what he did on IE and Firefox, he could have found and exploited five or 10 Safari bugs. With the way they’re paying $5,000 for every verifiable bug, he could have spent that same time and resources and make $25,000 or $30,000 easily just by going after Safari on Mac.

Other thing that jumped out at me was some of the comments about targeting Macs.

Why Safari? Why didn’t you go after IE or Safari?

It’s really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don’t do. Hacking into Macs is so much easier. You don’t have to jump through hoops and deal with all the anti-exploit mitigations you’d find in Windows.

Take that quote, combine it with some recent commentary about the number of security professionals using Macs, and with meterpreter now being ported to the Mac (complete with the ability to take pics with built in iSight cameras), and times might get interesting. Going to my above statement about one of the main reasons for tracking down bugs being to show of your skillz, it makes one wonder how many infosec people one could bag at a con...

This story is kind of funny, but kind of sad.

MARCH 18--Meet Michelle Owen. Concerned that an ex-boyfriend had used her laptop to search for child pornography, the Indiana woman asked police to search the computer for illegal images, but had her plan backfire when cops discovered two videos of her engaged in illicit acts with a dog. Owen, 24, was charged last week with two felony bestiality counts in connection with the video files, which a detective found in the laptop's "recycle bin." At the time Owen asked cops to search the computer, she was locked up in the Johnson County Jail on a public intoxication charge (which violated the terms of her release in a prior drunk driving case). According to a police affidavit, a copy of which you'll find here, a cop told Owen that he had found videos of her on the laptop and asked if she "knew what those files might be." Owen, pictured in the below mug shot, replied, "The one with the dog." Cops believe that the dog in question, Toby, is a beagle. After asking if she was "going to be charged with this," Owen said that the videos "were just something she did when she was drunk and barely remembers it," adding that she tried to "delete them the next day when she was sober."

From TheSmokingGun.com

"We've found a way to identify documents even when there was nothing additional printed on them," said Alex Halderman, now an assistant professor at the University of Michigan, who was part of the Princeton team. "This is like an invisible serial number printed on every piece of paper ever made."

Two blank pieces of paper may look identical, but if you hold them to a light, you can see that in fact they're unique mashups of fibers. The researchers said that they can measure this unique texture using a standard 1,200 dpi scanner and some custom software they've written.

By turning the page by 90 degrees and scanning it again and again, the researchers can pluck out subtle distinctions in the paper's texture and create a unique digital map of its surface. "You scan it four times and then the software is able -- from these four scans -- to figure out what the surface texture of the document looks like," said William Clarkson, a Princeton graduate student. "Then it can extract essentially a fingerprint of the document."

From ComputerWorld.com

Saw this article today that had me shaking my head. Turns out Apple rejected an update to a twitter update due to the fact that a curse word shows up on the trend list.

Just wanted to bring up an impressive experience I had today with a vendor.