Parliamentarians in schoolboy prank set poor standards for electorate

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

MPs in the New South Wales Parliament couldn't resist perpetrating an online prank on one of their number earlier this week.

The victim of the prank was Andrew Gee MP, sitting member for Orange. Naked Security readers will remember Orange as the home of convicted Aussie hacker David Cecil, a.k.a. Evil, who clocked up a two-and-a-half year prison sentence earlier this year for offences relating to the unauthorised access to and modification of data.

Gee was up on his hind legs, orating to the House, when messages started coming from his Twitter account. He's deleted them now, but that hasn't expunged them from the record - the Sydney Morning Herald faithfully reported them on its light-hearted Friday back page, The Diary:

I'm talking about really good things now

So many memories being had

My shoes are shiny

Gee's iPad wasn't lost or stolen. It was lying in what I'm sure he imagined was supervised safety on the parliamentary furniture. He simply hadn't banked on the sort of "supervision" his party colleagues had in mind.

Tweets not yet eradicated by the embarrassed Mr Gee explain away his apparently magical Tweet-whilst-talking powers, laying the blame on Messrs Wollondilly and Drummoyne (those are the names of the seats, not the MPs!) and unnamed others.

Gee's boss, State Premier Barry O'Farrell, joined in online with a short but entirely pertinent Tweet to say:

@AndrewGeeMP & set your iPad lock

This, in turn, provoked the Member for Orange to observe:

But you wouldn't have thought you'd need to use it in such distinguished company.

A fair comment, perhaps.

In truth, though, you would (or at least should) have thought exactly that.

Computer security is no longer really suited to the idea of a trusted interior and a hostile exterior.

You should work on the assumption that bad things could happen at any time. Then take a defensive security posture to suit that assumption.

The Premier is right. Set your iPad lock. While you're about it, consider all the other security-oriented settings from which you and your users could benefit, and think about how to ensure that everyone is doing the right thing.

(Yes, that image to the right is a shameless plug for a Sophos product which helps you do just that :-)

And never mess with another guy's computer or mobile phone.

Wollondilly and Drummoyne, it seems, were careful not to put anything truly embarrassing or derogatory into Andrew Gee's mouth, with the result that little harm was done. But it would have been much better - and would have set much higher standards - if they'd resisted the temptation altogether.

I may sound like a bit of a wet blanket for saying that, but it's hard to take a position against hacking, cybercrime, identity theft and other serious online crimes if you're prepared to condone the unauthorised use of someone else's iPad simply because it suits your own sense of humour.

As it happens, Section 308D of the New South Wales Crimes Act of 1900 (as of 6 July 2012) specifies a penatly of up to ten year's imprisonment for Unauthorised modification of data with intent to cause impairment.

Gee's jesting chums may not quite have broken this law [*], but that doesn't matter.

They shouldn't have done what they did...and Gee shouldn't have made it easy for them.

Follow @duckblog
-

[*] Are you a lawyer? If so, why not leave us a comment letting us know how close you think these MP pranksters came to breaking the portentously-named Crimes Act of 1900?

View the original article here

SSL certificate safety bolstered by standards that lessen dependence on CAs

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Filed Under: Featured, Privacy

2011 was a bad year for certificate authorities (CAs) and the privacy of internet users as multiple successful attacks against CAs resulted in a reduction in confidence of the basic structure of trust that SSL/TLS depend on.

Last summer Moxie Marlinspike proposed a new system called Convergence that puts the decision about who to trust in the hands of users. There are some technical challenges with Marlinspike's approach and to date not many people have embraced the technology.

Within the last 6 months, two new proposals have come forward that look to make a more gradual, compatible transition away from the current model possible.

One proposed by Google engineers is called Public Key Pinning Extension for HTTP, while another similar idea backed by Marlinspike and Trevor Perrin is called Trust Assertions for Certificate Keys (TACK).

Some browsers like Google's Chrome have already implemented a similar approach called certificate pinning, but the implementation doesn't scale. Google Chrome ships with a set of pre-defined high-profile certificates installed for services like Gmail that are "pinned" and do not rely on CAs to validate.

This is how the DigiNotar CA breach was discovered. Users of Chrome and Gmail in Iran began getting warnings that their traffic was being intercepted by a man-in-the-middle attack through falsely signed certificates.

Hard coding certificates for more than a handful of sites is highly impractical though, and these new proposals address the scalability problem in an elegant way.

Initial contact to an HTTPS server will work the same as it does now, relying on CAs to verify you are talking to the right site. However for sites that would support these new extensions they could offer an extra digital signature of their certificate signed by the site owner.

Your browser could keep a copy of this signature and "pin" it to identify a known public key that represents that site.

Subsequent visits would then check the signature of any certificates presented not only with the CAs, but also against the copy of the public key you pinned from a previous visit.

This means an attacker wishing to perform a man-in-the-middle attack would not only have to compromise a certificate authority, but also compromise the private key possessed by the web site operator.

Ultimately it lessens our dependence on the security of CAs by putting more power in the hands of web site operators and individuals.

This diversification of trust is a necessary step toward more independent verification of trust and potentially eliminating the need for CAs in the future.

Both proposals are in draft form with the IETF and there are many technical details not covered here. If you want to understand the differences and specifics, I recommend reading the proposals themselves as they are not terribly long.

http://twitter.com/chetwisniewski

SSL Padlock and Push pin images courtesy of Shutterstock.

View the original article here