BillDay.com

Diebold Accidentally Leaks Results Of 2008 Election Early

PS April Fools!

Apple has released the latest iPhone software update, version 1.1.4.

During installation you are presented with the following “Important Information” for this release:

iPhone Software
Version 1.1.4

This version of the software includes bug fixes and supersedes all previous versions.

For feature descriptions and complete instructions, see the users guide for your iPhone at:
http://www.apple.com/support/manuals/iphone/

For more information about iPhone, go to:
http://www.apple.com/iphone/

To troubleshoot your iPhone, or to view additional support information go to:
http://www.apple.com/support/iphone

For detailed information on Security Updates, please visit this website:
http://www.info.apple.com/kbnum/n61798

Regular old security and bug fix update, or preparation for next week’s iPhone SDK and enterprise features announcements? You be the judge.

BTW, has anyone noticed the flaw in “The Great Thing” iPhone ad Apple has been running lately?

Hint: Think about cell coverage in the back bowls of most ski areas…

Investor’s Business Daily’s recent “Columbine To Va. Tech To NIU: Gun-Free Zones Or Killing Fields?” article by John R. Lott, Jr is spot-on:
Gun-free zones are magnets for bad guys.

I applaud the Oklahoma House of Representatives for considering a bill that would allow properly vetted concealed weapon license holders to carry on college and university campuses.

As Article 2, Section 26 of the Oklahoma State Constitution declares:

The right of a citizen to keep and bear arms in defense of his home, person, or property, or in aid of the civil power, when thereunto legally summoned, shall never be prohibited

It is your right to defend yourself and your family. I’d go one step further and say it’s your responsibility, too. If your Oklahoma Council on Law Enforcement Education and Training certified gun safety instructor, your county sheriff, and the Oklahoma State Bureau of Investigation have tested your knowledge of the Oklahoma Self Defense Act, verified your safe handling and use of a handgun, run extensive local, state, and federal criminal and mental health background checks, and processed your properly submitted concealed weapons license application to prove you are otherwise eligible (all of these steps are required for one to be issued an Oklahoma license), why should you be denied your basic right to self defense just because you walk onto a college campus?

Thank you, Rep. Murphey and the House Judiciary and Public Safety Committee, for submitting and approving in committee Oklahoma House Bill 2513 which would allow license holders to defend themselves on campus. Now please stay the course and get this through the system and into law. This won’t stop crazies on campus completely, but it could certainly help to curtail the severity of their attacks.

Fascinating: The US plans to shoot down the dead US 193 spy satellite to keep the parts that might survive unplanned reentry off EBay.

Apparently the Chinese government is big on trolling auctions for secrets. Keep those secrets off a public auction site, kiddies!

And don’t worry, if you there’s damage on the ground from pieces that make it down anyway, the US government will help pick up the tab. Just don’t breath the hydrazine…

Wired Magazine’s recent article “Hackers Take Down the Most Wired Country in Europe” on recent Web War-style attacks on Estonia and its Internet infrastructure begat the interesting “World War 2.0” video piece on the new Wired Science program on PBS. Check out the video below, then read the full article (click here) for more details.

The article contains an interesting sidebar titled “When Bots Attack” by John Robb on how a hypothetical botnet attack against the US might play out (John speculated earlier today that we might even see such an attack play out sooner rather than later). John’s always insightful analysis is also available on his personal blog, in his related Global Guerillas blog, and in his excellent new book, “Brave New War“. All highly recommended.

(Disclaimer: Yes, I am writing for Wired’s Geekdad.com blog from time to time and I know John. Nonetheless, all of the above are excellent whether I was involved with Wired and knew Mr. Robb or not.)

Numerous sites have reported on the now infamous F-22A Raptor systems crash as the first internationally deployed F-22 squadron crossed the International Date Line earlier this month. Read a transcript with CNN military analyst Major General Don Shepperd, USAF-Ret. for more details of what happened (Cntrl+F search for “F-22″ to jump to the pertinent bits).

This is certainly not the first time software has caused an aviation malfunction. It’s but the latest in a long line of aerospace software snafus.

What is interesting about this one, however, is that for a manned system, one might have expected more physical, non-computerized backup systems than appear to have been in place. I’m versed in fly-by-wire and the basics of modern avionics (even have a BS in Aero Eng to prove it), but I have to wonder if there shouldn’t be at least a few critical backup gadgets that aren’t wired-in to the computer systems. Altimeter, compass, etc.

Perhaps there were, and they simply weren’t discussed in any of the coverage. If not, they should have been. F-22 pilots, you know what to add to your kit next time you’re heading up into the wild blue yonder.

BTW, the bug was fixed and the Raptors successfully arrived at Kadena AFB, Okinawa a few days later. Enjoy the arrival with a little video (the narration’s in Japanese, but jet noise sounds the same in any language):

bit-tech.net has published an article looking at widely known sources of text and video open source intelligence (OSINT).

It’s very interesting to see both the good and the bad uses of Internet technology in reporting, reviewing, remixing, and even fighting modern wars. Sobering in many ways.

In the time honored tradition of The MIT Guide to Lockpicking, engadget has published a two part series on bump keys and locks that are vulnerable to them.

Read part 1 here and part 2 here.

As with all security related matters, the best security comes from security-in-depth. It’d be a great idea to replace any affected locks with non-bumpables such as those mentioned in the article, but it’s also a great idea to have other security measures in place (external security cameras, fencing, an alarm system, a big mean attack dog, etc.). The more critical the thing to be protected, the more layers of security one should use.

Now go forth and lose sleep over all of your tumbler locks.

Here’s a brilliant definition and discussion of “What is a Hacker?”.

I bet quite a few of us tinkerers identify with this. Indeed, any good engineer is by definition finding better ways to “bend the rules” to make things cheaper, faster, better. So fear not, fellow geeks, wear the “hacker” moniker with pride.

Now back to breaking things…

An update to my “US passports go wireless” post from last month:

Wired has reported that a hacker has successfully cloned an RFID passport. Read the Wired article here and see what Bruce and his readers think about the whole thing here.

MIT’s Technology Review has an interesting article on Internet storage services entitled “The Internet is Your Next Hard Drive“. The article espouses the notion that, among other things, networked file sharing will improve in lock-step with bandwidth increases to the point that we may not have a hard drive in our computer at all, instead using a network repository for file I/O.

I wonder if the author ever heard about the Fallacies of Distributed Computing? Fallacy numero uno renounces the incorrect belief that “The network is reliable”. This fallacy has a way of rearing its ugly head as soon as you start having computers with no local disk drive. Never mind “Latency is zero” and the other distributed computing false gods on the list. No local hard drive over the open Internet is bad engineering for the foreseeable future.

Nonetheless, some of the networked storage services mentioned in the article are great options for certain users needing more storage than they can afford to buy and maintain themselves or distributed file sharing for geographically dispersed groups.

For rentable storage on a large scale, I’m intrigued by things I’ve been reading recently about Amazon S3. Basically, S3 lets you use Amazon’s big ole bit bucket for your own applications. They maintain the storage, you go forth and harness massive data using their REST or SOAP interfaces. All apparently for low rates compared to DIY. As Tim O’Reilly notes, these Internet scale services are changing the very definition of what is, and isn’t, part of The Platform.

On a much smaller scale, network file sharing services can be a boon to distributed workgroups. Example: I’ve recently started using FolderShare for remote work. It’s a bit awkward to set up, but once it’s configured it operates automatically. FolderShare replicates files in a user specified directory to other properly invited and authenticated users’ systems. This happens “invisibly”, in the background, providing the illusion that everyone with access to your network shared folder (hence the name, hah hah) is using the same hard drive on their own machine, or at least their LAN.

Security is an obvious concern anytime your key bits are flying through the ether. FolderShare seems to be doing the right things to address it. First, FolderShare is a peer-to-peer system, so (hopefully) your bits only live on the systems of the people you trust and invite into your group. Second, all comms are authenticated and encrypted using AES over SSL in an attempt to secure the pipe. Seems well thought out and executed.

FolderShare is very handy for small workgroups that need to share files over the Internet. Heck, you can even use it to share files between your own systems (work desktop, a laptop, and a home PC, for instance). As much as I hate to admit it, it quickly becomes a necessity. See, I can say something nice about Microsoft after all. Well, at least about something MS acquired.

Is Internet storage in your present or future? Talk amongst yourselves.

[Tip of the hat to GigaOm, O'Reilly Radar, and digg]

Filed under “know thy enemy”:

Prabhaker Mateti has published “Hacking Techniques in Wireless Networks“. This is an excellent overview of wireless network attacks including a wireless LAN overview, sniffing, spoofing, probing, and more.

The section on access point weaknesses is particularly interesting because the subject doesn’t seem to get as much coverage as many of the other topics. Also worth noting, and heeding, are the best practices, and within that section, the links to software tools (if you want to know what somebody else can see and do with your WiFi network, check these out).

You might also want to check out this additional article on hotspot hacks.

[Via digg]

David Pogue recently blogged about a vision of flash drives “of the future”:

you’d carry around your whole world–not just documents, but programs, settings, e-mail, the works–on your keychain. You’d just plug in to public terminals whenever you wanted to do work.

The only problem with David’s vision is that his “flash future” is here today, in the form of U3 enabled USB flash drives.

U3 drives work just like any other USB drive for data storage and retrieval. In addition they implement the U3 Hardware Specification and a U3 Device API which enables properly packaged Windows applications to execute from within the U3 container. Everything about the apps, including their configuration settings and any personal data generated during execution, resides on the U3 drive. Docs, check. Programs, check. Settings, email, any other bits that you’d need to run your apps, check check check. This enables you to unplug from your PC at work and reconnect to a terminal in the airport, a partner’s laptop at a conference, or anywhere else you can find a system with a USB port. Your apps, configured the way your like them, everywhere.

It all sounds very mobile Java-esque, only I’ve yet to see a cell phone or PDA the size of my thumbnail.

Security is an obvious concern anytime you start carrying around “your digital life” in a tiny little key fob. You could lose the drive (the “I spend half of my life looking for my keys” phenomenon). There are also data security concerns, not the least of which is whether or not a savvy attack on a host computer’s memory might be able to ferret out critical data at runtime. I’d want to dig into the specs before I put anything too terribly sensitive on one myself. And one of the biggest potential problems I see is not being able to find anyone willing to loan you a system and trust (yes, the ‘t’ word surfaces again) that your little USB thingy really does have antivirus software and will keep things clean.

Nonetheless, for many people this could be a handy solution to the problem of having bookmarks and address books and files scattered between at work, home, and laptop computers. If you’re not quite willing to put everything online a la del.icio.us and Yahoo Mail, this just might be workable. Especially since U3 goes much farther than just bookmarks and email. Click here to see a catalog of U3 apps ranging from Mozilla and Skype to OpenOffice and EditPad, and even some games and photo apps and podcast software to boot.

How did we get all of these apps? A developer forum and kit, silly! Click here to get the full details or here to read the dev blog.

David goes on to discuss a reader’s comments that such devices could be a boon for school children since they could allow each student to cheaply carry their books, school work, MySpace bookmarks (oops, not that) wherever they were. In theory this could also cut down on the number of computers required by said USB-toting students. As other readers’ comments point out, though, kids would probably be bad about losing their drives.

I’m convinced the better scenario is for someone like my mother: A PC at work and one at home. Checks email and browses the Web. Edits a document once in a while. Values having the same environment and tools on each computer, and would prefer one archive of docs that’s always available. Not really a Web 2.0 kind of person. U3, we have a winner!

Right now many major USB drive manufacturers are making U3 drives. You can actually get one for pretty cheap if you shop around. In fact, I just bought a SanDisk 1GB Cruzer Micro with U3 last weekend for $20 after rebate. Not bad.

Heck, for that price, maybe I should outfit my Mom with one too. Sure would save me a lot of “Bill, can you help me with my computer” problems…

CNN has reminded us all that starting next month, US passports will be RFID-enabled.

Engadget has a nice discussion and good linkage on the subject. The State Department’s spin is here. Both are worth reading for the security conscious among us.

While I’m a fan of RFID in many retail and transit scenarios, I’m very glad my passport isn’t due for renewal anytime soon. It reminds me of an anti-skimming patent application I helped file way back when I was at Sun. Only in that case, the primary threat we were addressing was stealing credit card information old fashioned ways, whereas this time around a thief could literally swipe all of the key quantifiable components of your citizenship and identity from a good distance away, never even touching your or your e-passport. Bruce Schneier and many others are justifiably concerned.

If you have a US passport due for renewal anytime soon, you might consider submitting an expedited application early to try to get an old fashioned un-wireless. Hopefully the inevitable issues will be hammered out, and any redesigns complete, before my turn comes up.

Whatever you do, make a mental note that now would be a good time to stop flipping through your passport to show off visas in tourist hangouts…

Only 3 spams have made it through while Akismet killed 3755 in the last twenty-four hours.

I am very impressed!

I’ve upgraded my WordPress install using DreamHost’s fab-o upgrader. Nothing broke during the upgrade, which was a two step process: Run DreamHost’s upgrader, then run the WordPress database upgrader et voila, done!

As a part of my upgrade, I activated the Akismet comment and trackback spam killer plugin bundled with WP. So far, I love it! Akismet’s throttled back an ongoing spam attack from several messages per second to one spam in the last three hours. Talk about an improvement!

The newest WP+Akismet are highly recommended for anyone considering the upgrade.

Someone’s finally written the first known J2ME malware.

Read up on the details (including how to avoid infection or remove Redbrowser.A from an already infected mobile) from Symantec and McAfee.

I guess it was inevitable, but given the huge number of deployed devices as potential targets it’s amazing that it’s taken close to seven years for something as weak as Redbrowser to finally appear.

Following up on my post “Symbian Signed for open source apps” yesterday:

Forum Nokia has posted “Freeware Opportunities for Series 60 and Series 80 Developers” detailing how to request free Symbian Signed testing.

Which software qualifies? The document notes:

The only requirement is that the application submitted conform to the program’s definition of freeware as “software that is distributed at no charge to the user, and from which the developer derives no form of direct revenue for the software being used.” The program allows honorware (“if you like this, feel free to contribute”) as long as there is no restriction on users should they choose not to contribute. The program explicitly excludes applications that provide a limited feature set of a commercial product (crippleware) and applications that provide revenue to the developer through the delivery of messages to users (adware).

Seems reasonable to me. The document also clarifies that the program will be administered by Symbian and paid for by Symbian and its licensees, including Nokia (the report from yesterday only mentioned Nokia picking up the tab).

Learn more by downloading and reading the PDF here.

All About Symbian reports that Nokia is going to pay for all Series 60 and 80 freeware developers to have their apps Symbian Signed. If true this will finally allow open source to play nicely with newer Symbian-based phones.

Lack of a free path to get open source Symbian Signed has been a major stumbling block for potential Symbian developers, IMO. There are enough obstacles for future Symbian success without developers tripping up over this one. Good on ya Nokia for trouncing this problem before it got out of hand.

Watch BillDay.com for an update with details once they’re posted to Forum Nokia.

A not-so-secret secret about theoretical SMS and network security has surfaced lately and demands a response.

As Bruce Schneier reports, several researchers have published a paper showing that one can theorectically deny cellular voice service over a network using a relatively small scale SMS-based DoS attack. The researchers estimate 165 SMS messages per second could disrupt voice service on a targeted network throughout Manhattan. In theory, this throughput level is something one broadband connected computer might accomplish.

The problem with the theory, however, is that it doesn’t take into account the realities of the GSM network side of the equation.

In practice, carrier infrastructure and policies actually render this theoretical attack just that, theoretical.

Nice try, guys, but no dice.