Child abuse photo collector forgets to encrypt his USB stick - Bad security is a good thing

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Sometimes some good can come from poor computer security.

The Burton Mail reports that a 46-year-old British man was found guilty of downloading indecent images of children after he accidentally shared his USB memory stick with a work colleague.

According to reports, Nicholas Hill, of Belvoir Crescent, Newhall, handed a memory stick to a female colleague in order to get a recording of a TV programme, but as soon as his workmate plugged the USB drive into her computer she was shocked to be presented with an array of indecent photos.

Clearly, Hill had not encrypted the data on his USB flash drive.

When police were called they found "279 images in the mildest category and six which were slightly more serious" contained on the memory stick.

Hill's defence team said that he had been collecting such images for a number of years, and told a hearing at Derby Magistrates' Court that their client deeply regretted committing the offence, and was previously a "man of good character".

Presiding magistrate Jill Steiner put Hill on probation for three years, and ordered him to attend a community sex offenders' group work programme. If Hill buys computer equipment in future, he must allow it to be inspected by police officers - although he has said that he will access the net only from a public library in future.

Aside from serving probation, Hill has also been ordered to pay £85 costs. As he is currently between jobs, it was has been agreed that he can pay the fine in monthly installments.

Being a consumer of child abuse imagery only encourages others to supply more, and ultimately abuse the young innocent victims. Hopefully Hill will rebuild his life, and not engage in child abuse material again.

If that's the case then some small good will have come out of poor security.

Follow @gcluley

USB flash memory drive image from Shutterstock.

View the original article here

Facebook cookie complaints get the wrong end of the stick

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

The news wires are awash with stories about Facebook, cookies and privacy. The source of all this concern seems to be an article written by self-proclaimed "serial entrepreneur, writer and hacker" Nik Cubrilovic of Wollongong, New South Wales, Australia.

(Old-school network hackers will no doubt remember Wollongong from the University of Wollongong's eponymous and once-widespread TCP/IP software stack.

Newer-school hackers will remember Wollongong as the home of Ashley Towns, author of the first in-the-wild iPhone virus.)

Cubrilovic has enjoyed dramatic media success with his concerns about Facebook cookies, but I think he's been barking up the wrong tree.

The criticisms he makes against Facebook could - and perhaps should, though I don't intend to argue that issue here - be levelled against any website operator that sets long-lived cookies aimed at identifying repeat visitors.

Indeed, cookies are text-based key-value data pairs which are included in HTTP traffic precisely so that web servers can keep track of a a user's browsing session.

By design, HTTP is a stateless protocol. So, if you visit my web page twice in a row, those two requests are entirely independent.

By setting a unique cookie in your browser, which your browser will insert into all subsequent request headers, I can tie those two requests together on my server.

I might not know your identity, but I know it's the same person - or at least the same browser on the same PC - coming back for more. So I can target the content I serve based on your previous browsing history. It might not be you, but it very probably is.

Cookies also permit the concept of a website login: the cookie very conveniently acts as a temporary access ticket to your account, so you don't need to resubmit your login information on every page.

Cubrilovic's critique of Facebook cookies seems to boil down to this: when you login, Facebook sets a bunch of cookies which identify your user ID and authenticate you to act as that user for the current session.

But when you logout, Facebook doesn't unset all of the cookies set at login, so - argues Cubrilovic - you continue to identify yourself to Facebook in all subsequent traffic, even after you've logged out.

So what?

Any website which sets a long-lived unique cookie when you first visit the site can do just the same thing.

Try visiting Apple's website, for example. (I don't mean to criticise Apple, just to pick them as an example because I'm an Apple user, and I have an AppleID.)

On your first visit, Apple will set a browser cookie called s_vi, valid for five years, containing a random-looking string of hexadecimal digits. The value of this cookie is - at least as far as I can tell - unique to each brand-new visitor.

So, next time you login with your AppleID, Apple's backend systems can now tie your general-purpose s_vi cookie to your AppleID.

In other words, Apple "knows" who you are every time you subsequently visit using the same browser on the same PC, even if you never log in again. (More precisely, Apple knows who last logged in to its site from your browser, which very likely was you.)

Cubrilovic has therefore rediscovered that long-lived anonymous cookies, once they've been associated with an exact identity, stop being anonymous.

So, if you're worried about this sort of thing, routinely delete all cookies from your browser. This means that you dispose of all your no-longer-anonymous cookies.

Your favourite websites will no longer have cookie-based history about you, so you'll get newly-generated anonymous cookies next time you visit each of those sites.

Most browsers - Firefox, Chrome, Opera and Internet Explorer, for instance - have an "automatically delete cookies on exit" option. I recommend using it: you don't have to keep remembering to delete old cookies by hand.

Follow @duckblog

View the original article here