Guardian inaccurate article: Alleged credit card scam raises new web security fears

Guardian inaccurate article: Alleged credit card scam raises new web security fears

To the Guardian Tech Editor:

Dear Editor,

The article,

Alleged credit card scam raises new web security fears

published Tuesday 18 August 2009 20.43 BST

incorrectly describes the computer vulnerability, or “exploit” allegedly used by one Albert Gonzalez and unnamed others to allegedly steal and sell credit card information from several companies. The article also mis-characterizes the legal procedure used to bring the charges.

The article says,

“The charge sheet says that Gonzalez, along with two others who “resided in or near Russia”, in December 2007 injected “structured query language”, a computer programming language designed to retrieve and manage data, into the computers of companies such as Heartland, one of the world’s biggest credit and debit card payment processing companies.”

Structured Query Language is not a computer language such as C or FORTRAN. It cannot be “injected” anywhere. It is a format or language for querying or posting information to a computer database.

It sounds like your reporters read “SQL injection”, didn’t understand what that meant, and made up a likely sounding (but wrong) explanation.

A more correct description would be that the alleged fraudsters illegally accessed corporate databases, and inserted fraudulent information into them in order to gain access to those or other systems.

SQL injection is a well-known and preventable vulnerability, see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1804

Your writers apparently could not even be troubled to look up the defendant on wikipedia, see http://en.wikipedia.org/wiki/Albert_Gonzalez

The article refers to a “charge sheet”, the correct term in this case is “indictment”, see http://www.usdoj.gov/usao/ma/Press%20Office%20-%20Press%20Release%20Files/IDTheft/Gonzalez,%20Albert%20-%20Indictment%20080508.pdf

A “charge sheet” in US usage refers to the daily written record of events in a police station, it has little or nothing to do with Grand Jury proceedings. In the Commonwealth, it may refer to a final police report. It is not the same as an indictment brought by a Grand Jury. Confusing charges brought by police and charges brought by a Grand Jury is a fundamental error.

The most newsworthy item overlooked in this rather poor excuse for an article is the question of liability. Both the “wardriving” and “SQL Injection” attacks are well-documented and generally preventable. Thus there is the question of the liability of the companies allegedly victimized as they may have failed to take even the most basic computer security precautions with this sensitive data. Further, how was the defendant able to carry out the alleged attacks while at the same time allegedly acting as a consultant or informant to the US Secret Service? To what degree is the Secret Service liable for failing to prevent, or even possibly enabling, these attacks?

The article’s confusion of the acting US attorney for New Jersey, Ralph Marra, with the “acting US Attorney General” further detracts from the accuracy and reliability of your reportage. The Attorney General of the United States is Eric Holder. There is no “acting US Attorney General.” Your reporters should certainly have known this if they were even moderately well-informed. Basic fact-checking by your editors should have caught and prevented this error from being published.

In the future, please don’t have articles written by people who A) have no idea what they are writing about in either the legal or technical sphere and B) don’t do even a basic job of research and fact-checking. Editors must fact-check and verify all references to technical descriptions, legal proceedings, and offices held by public officials.

Best regards,

Henry Edward Hardy
scanlyze.wordpress.com

The subtitle refers to “‘Biggest ever’ case involves 130m cards”

Who says it is the “biggest ever” case? This unattributed quote appears nowhere in the article, which does not state anything of the kind. Was it simply made up by a copy editor?

I would also note that the title of the Guardian article claims that the incident “raises new web security fears.” This is bullocks. Wardriving and SQL injection are neither new issues nor are they web-dependent; how to defend against them is well-understood and documented; and fear-mongering about them isn’t warranted or appropriate.

Copyright © 2009 Henry Edward Hardy

Thoughts on the Pirate Bay Convictions in Sweden

Thoughts on the Pirate Bay Convictions in Sweden

The lawyer for four men found guilty of criminal copyright offenses in Sweden is now calling for a retrial. Attorney Peter Althin, who represents the Pirate Bay, alleges that Judge Tomas Norstrom, “is a member of the Swedish Copyright Association and sits on the board of Swedish Association for the Protection of Industrial Property,” according to the BBC.

Judge Norstrom has told Sveriges Radio, “These activities do not constitute a conflict of interest.”

see and/or hear:
Pirate Bay Judge Conflict of Interest?
Domaren tillbakavisar anklagelser om jäv
The Pirate Bay sentenced to one year in prison
Fredrik Söderling: The Pirate Bay sentence is surprisingly harsh

This controversy has led to an active discussion with one of my Swedish friends. [The following is edited for spelling, accuracy, and clarity]

We were discussing the deficiencies of the various left parties in Sweden (Social Democratic, Left, Green, and various communist and anarchist affiliations).

I declared,

If I was in Sweden now I would vote Pirate Party because the verdict against Neij, Svartholm, Lundström, and Sunde. The myth of Swedish freedom of expression is seen as what it is, a sham and a fraud wholly at the whim of moneyed foreign interests. As soon as those interests are at play, any pretense at freedom of speech or of scholarship is out the window.

Pirate Bay did nothing whatsoever different as a matter of law, than what Google or the Internet Archive do. They published a search engine and links to online material, period. Not the material itself. The decision is not criminalizing copyright infringement, it is criminalizing knowledge, and the dissemination of knowledge, about where certain files are shared, which knowledge is voluntarily taken from the public sphere and released there also.

What they were really convicted of is disrespecting authority and making the “adults” look stupid and feel ignorant. Try searching on “warez” on google. Hope your Swedish police don’t arrest you for that too.

I haven’t read the court decision, if you find it please link and I will at least try with Babelfish and my Norstedts. But it seems a really horrible decision and an attack on any scholar who makes an index or union catalog of information.

I know this must be a controversy at home too. I suppose DN has my view and SD has the other? Or no, both feel threatened by new media?”

She replied, “Do you think artists should have an income out of their work or do you think they shouldn’t? Do you think the shoe polisher should get money for polishing your shoes or do you think he shouldn’t? Do you think society should pay for an artists work or should those buying it?

Enclosed is the court decision. Just ask me if there is something I could translate for you!”

I’ve yet to wade through the court decision, but my initial response is below:

That isn’t the right question to ask I think. If one goes to the library and looks in Chemical Abstracts for how to make a dangerous chemical like an explosive or poison, we don’t arrest the librarians; we don’t arrest the editors of Chemical Abstracts or the makers of the catalog of information from which the abstract is found.

Pirate Bay was not accused of holding or receving any copyrighted information. They provided services like a library or union catalog to where such information could be found. This is no different from Google or from any library or encyclopaedia.

If people engage in copyright violations then the law can hold them accountable. But if anyone who compiles a list or catalog, whether online or not of merely where information can be found, it is profoundly unjust to hold them responsible for the acts of others whom they have never met and have no control over or responsibility for.

I’m sure one could go into the library at KTH or the National Library or some similar place and find chemical manufacturing information to make a poison or a bomb. Should we then arrest library directors or the publishers of abstracts of scientific information?

If this decision stands, then Google, and all public libraries must also be subject to having their responsible officers criminally penalized anytime anyone misuses information they find through such a service. This would be profoundly undemocratic and would not, in fact, do anything to catch the actual perpetrators of the hypothetical crime.

Further, many artists never receive ANY payments from the agencies which allegedly take payments for them. The generally have to engage in protracted court struggles (at least in US) and then receive only a fraction of a penny compared to the dollars received by publishers. For instance, when court action resulted in a 270 million dollar settlement from Napster, artist’s managers complained that the artists they represented received nothing.

INFRINGEMENT! ARTISTS SAY THEY WANT THEIR MUSIC SITE DOUGH

The RIAA which allegedly represents the interests of recording artists in the US, is both suing users and pursuing cases like the case against Pirate Bay while at the same time pushing artists royalties ever lower and lower, keeping the rest of the money for the companies they represent:

RIAA Wants Songwriter Royalty Lowered

Also, in the US we have a concept called “fair use”. This “fair use” doctrine holds that copyrighted material can be used as part of creating another artistic work (as in a collage or montage), for purposes of journalism or review, or for educational purposes. This doctrine is being very much eroded.

Fair Use (wikipedia)
Copyright Fair Use

Another common law doctrine in the US is called the “right of first sale”. This holds that you can’t for instance sell me a chair but make conditions on how I the buyer can use it. If I buy a chair, I can sit in it. I can resell it. I can let someone else sit in it. I can destroy it. I can take it apart to learn about how it is constructed. That is because I bought it.

First-sale doctrine

Further, the purpose of copyright is to grant a limited license to an author or inventor for a *limited time* so that eventually, the invention will come into free use for everyone.

“The Congress shall have the power…To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries;”

US Constitution, Article 1, Section 8

So the correct question is not “does this give authors and inventors enough rights” the question should be “are works and inventions coming into the public domain soon enough to be of use to all”.

Some large corporations are standing this moral principle on its head, pretending to be acting in the interests of writers and inventors but actually paying such persons little or nothing in reality.

I do use bittorrent for purposes like updates to computer games I subscribe to, and I never download illegal material. Legal users of a legal service should be protected, and so should the maintainers of that service.

I’ll dig into the opinion and see if [it] address[es] any of these points. Obviously my reasoning and examples so far are from a very US-centric point of view.

As we say, IMHO.

see also: The Pirate Bay
Pirate Party plans election raid

Copyright © 2009 Henry Edward Hardy

Comcast versus the Net

The following is written in response to: Comcast: We’re Delaying, Not Blocking, BitTorrent Traffic on the Bits blog at nytimes.com.

The allegation made against Comcast by the Electronic Frontier Foundation and reported by the Associated Press is that Comcast have allegedly been inserting forged reset (RST) packets into the datastream. This is not analogous to delaying a call. It is more analogous to the company disconnecting a call in mid-sentence because they have been listening in and classifying the type of conversation and don’t like what is being discussed or think it is likely a waste of time.

This is unethical if it is being done and also goes against the Internet technical documents, the RFC’s. Further there are several potential legal issues including potential violations of the:

* Electronic Communications Privacy Act 18 USC § 2510.

* General Prohibition Against Traces and Traps 18 USC § 3121.

* The Computer Fraud and Abuse Act, 18 U.S.C. § 1030.

* The Cable TV Privacy Act of 1984, 47 U.S.C. § 551.

* State statutes such as Michigan statue Fraudulent Access to Computers, Computer Systems, and Computer Networks, MCL 795.791.

Whatever Comcast routing and Quality of Service provisions are in effect should be fully spelled out and transparent to regulators, internet technical experts and the general public so that citizens can make an informed choice about whether they want their internet unsurveilled, uncensored and uninterrupted… or whether they want Internet which is “Comcastic”.

See Comcastic?!? Not So Much…
Comcast and BitTorrent; a Complicated Relationship
Technorati posts tagged comcast bittorrent

See also An Open Letter to Rich Sheridan regarding the proposed insertion of spam by the Wireless Washtenaw Project
Seven Questions on ‘Net Neutrality’ for Ann Arbor City Councilman Ron Suarez

Copyright © 2007 Henry Edward Hardy

Does politics belong in the classroom?

Prof. Stanley Fish has been discussing on his nytimes blog whether or how freely political opinions should be expressed by a teacher in the college or university classroom.

His initial blog entry is, Yet Once More: Political Correctness on Campus and the followup to which I have responded is, George W. Bush and Melville’s Ahab: Discuss!

Fish’s first post was a long response to Evan Coyne Maloney’s Indoctrinate U.

The basic thrust of Fish’s post seems to be that,

Academics often bridle at the picture of their activities presented by Maloney and other conservative critics, and accuse them of grossly caricaturing and exaggerating what goes on in the classroom. Maybe so, but so long as there are those who confuse advocacy with teaching, and so long as faculty colleagues and university administrators look the other way, the academy invites the criticism it receives in this documentary. In 1915, the American Association of University Professors warned that if we didn’t clean up our own shop, external constituencies, with motives more political than educational, would step in and do it for us. Now they’re doing it in the movies and it’s our own fault.

Yet Once More: Political Correctness on Campus

My response follows:

I would not entirely agree with the thesis that politics has no place in the Academy.

As teachers, can we not state that, for instance, “Torture is antithetical to every basic principle of the American democratic system”? Or contrariwise, “Corporal punishment has been a feature of the American system of justice since its inception, and even killing a prisoner who has been condemned to death after due process is held to be judicially and legally acceptable under federal and most state jurisdictions today”?

Can we not say, “The evidence for global warming is regarded as conclusive by an overwhelming international consensus of scientists” as well as, “Solar incident radiation is the principle contributing factor to global warming in accordance with Boltzmann’s Law and the primary factor mediating this is the albedo of the earth, and any radiative forcing from CO2 in the atmosphere is negligible by comparison”?

Is it not precisely so that such opinions can be voiced without fear of retribution that we have tenured positions in the academic structure? If one prevailing political, scientific, or social view is defined culturally as “objective” and no other views are permitted to be advanced or advocated by a teacher in a classroom setting, then where is the great “marketplace of ideas” of which the classroom is a preeminent exemplar? As the Supreme Court held in Keyishian v. Board of Regents, (385 U.S. 589, 605-606 [1967], supreme.justia.com/us/385/589/case.html ):

‘Our Nation is deeply committed to safeguarding academic freedom, which is of transcendent value to all of us and not merely to the teachers concerned. That freedom is therefore a special concern of the First Amendment, which does not tolerate laws that cast a pall of orthodoxy over the classroom. “The vigilant protection of constitutional freedoms is nowhere more vital than in the community of American schools.” Shelton v. Tucker, supra, at 487. The classroom is peculiarly the “marketplace of ideas.” The Nation’s future depends upon leaders trained through wide exposure to that robust exchange of ideas which discovers truth “out of a multitude of tongues, [rather] than through any kind of authoritative selection.”‘

Thank you for your interesting post and enjoyable and weighty blog, Prof. Fish.

See also: The Universities Under Attack …

I would further note that after 1915 the political “cleaning up” of leftist radicals such as Emma Goldman and Alexander Berkman took the unpleasant form of the Palmer Raids in 1919, indeed an interesting and fraught comparison to draw with our present political situation.

Copyright © 2007 Henry Edward Hardy

Open Letter to an architect about drilling for geothermal heating system in our alley

Open Letter to an architect about drilling for geothermal heating system in our alley

The alleyway behind my downtown Ann Arbor, Michigan office has been turned into a mini-Mordor for the last few weeks with deafening drilling and pumping, effusions of grayish, slimy “slurry” and general disruption and using of the place as trash pit and dumping ground. This is an edited and reformatted version of my original e-mail letter to various parties:

Dear Jan Culbertson and Whom It May Concern:

I am a part-time faculty member at a local college.

In conjunction with that task, I maintain a small office at [address elided].

I am presently dissatisfied with the manner in which the planning, approval, and construction phase of this “Alley Drilling” project has been carried out.

In particular, I am having difficulty understanding why one occupant of an adjacent building, [apparently] with neither property rights nor parking spaces in the alley in question, was allowed to hijack the public right of way for private gain.

Were there any public hearings?

Were any announcements published in any paper of record?

How were my rights and interests as a commercial tenant taken into consideration and respected?

I note the following permits on register with the city which may pertain to this project:

Permits, Enforcements, Certificates

Parcel: 09-09-29-127-017

Permit(s)

10 Permit(s) found.
Number Type Status Category Applied Issued Expired â
PRW072233 Right of Way ISSUED Right of Way 09/17/2007 09/26/2007 09/25/2008
PS070130 Sign ISSUED Sign 09/28/2007 09/28/2007 03/26/2008
PM071698 Mechanical ISSUED Mechanical 09/18/2007 09/18/2007 03/16/2008
PM071699 Mechanical ISSUED Mechanical 09/18/2007 09/18/2007 03/16/2008
PM071700 Mechanical ISSUED Mechanical 09/18/2007 09/18/2007 03/16/2008
PM071701 Mechanical ISSUED Mechanical 09/18/2007 09/18/2007 03/16/2008
PM071702 Mechanical ISSUED Mechanical 09/18/2007 09/18/2007 03/16/2008
PM071703 Mechanical ISSUED Mechanical 09/18/2007 09/18/2007 03/16/2008
PB071537 Building ISSUED Commercial, Add/Alter 06/20/2007 08/14/2007 02/10/2008
PB071324 Building ISSUED Commercial, Add/Alter 06/06/2007 06/15/2007 12/12/2007

source: City of Ann Arbor

09-09-29-127-017
WELLSPRING LAND COMPANY L.L.C. 210 E HURON ST

per Matt Naud of the City of Ann Arbor Systems Planning Unit.

The permit which seems to be associated with the past several weeks of drilling activity is PRW072233

I note that this permit, though applied for on September 17, 2007, was apparently not issued until September 26. Yet it is my best recollection that the work proceeded before this date. If so, on what theory or pretext did this occur?

I am given to understand by several city employees that there may be an agreement regarding the use of the alley right-of-way signed on behalf of the city by Mr. West, and that this document may be available from the City Clerk’s office. I would like to know under what theory the city’s right-of-way for the purpose of vehicular traffic or public utilities extends more than 400 feet deep into the earth for the purposes of the private benefit, public relations, and financial advantage of one private entity in an adjacent structure?

I do not regard this project as creating “a special downtown green space”. I regard it as a deafening, prolonged, violent rape of the earth with 400 foot poles filled with potentially toxic liquid for personal gain, public relations advantage and private profit.

On the last point, I was told several times by city officials and representatives of this project that the tubes would be filled with propylene glycol (propane-1,2-diol). I was told that this substance is “completely non-toxic”, “harmless” and “approved by the FDA to use in food… you could eat it.”

First I would point out that throughout the world there have been a number of poisoning incidents due to imported diethylene glycol being mislabeled as propylene glycol. For instance, the New York Times reported on May 19, 2007 that 136 people were killed in a 2006 diethylene glycol poisoning incident involving toothpaste in Costa Rica.

I strongly suggest that the city or another government agency independently test and assure us that the “completely safe” substance in the tubes is actually what it is represented as being (food-grade propylene glycol) and is in fact, safe and non-toxic. Methods of testing are documented in a US FDA publication from the Center for Drug Evaluation and Research, Guidance for Industry: Testing of Glycerin for Diethylene Glycol.

21 CFR § 589.1001 says that “Use of propylene glycol in or on cat food causes the feed to be adulterated and in violation of the Federal Food, Drug, and Cosmetic Act”. Propylene glycol is toxic to cats.

The World Health Organization sets the Acceptable Daily Intake (ADI) of 1,2-propylene glycol acetate for a human being to 0-25 milligrams per kg of body weight. (1)

21 CFR § 184.1666 indicates,

Sec. 184.1666 Propylene glycol.

(a) Propylene glycol (C3H8O2, CAS
Reg. No. 57-55-6) is known as 1,2-propanediol. It does not occur in
nature. Propylene glycol is manufactured by treating propylene with
chlorinated water to form the chlorohydrin which is converted to the
glycol by treatment with sodium carbonate solution. It is also prepared
by heating glyercol with sodium hydroxide.
(b) The ingredient meets the specifications of the Food Chemicals
Codex, 3d Ed. (1981), p. 255, which is incorporated by reference. Copies
may be obtained from the National Academy Press, 2101 Constitution Ave.
NW., Washington, DC 20418. It is also available for inspection at the
Office of the Federal Register, 800 North Capitol Street, NW., suite
700, Washington, DC 20408.
(c) The ingredient is used as an anticaking agent as defined in
Sec. 170.3(o)(1) of this chapter; antioxidant as defined in
Sec. 170.3(o)(3) of this chapter; dough strengthener as defined in
Sec. 170.3(o)(6) of this chapter; emulsifier as defined in
Sec. 170.3(o)(8) of this chapter; flavor agent as defined in
Sec. 170.3(o)(12) of this chapter; formulation aid as defined in
Sec. 170.3(o)(14) of this chapter; humectant as defined in
Sec. 170.3(o)(16) of this chapter; processing aid as defined in
Sec. 170.3(o)(24) of this chapter; solvent and vehicle as defined in
Sec. 170.3(o)(27) of this chapter; stabilizer and thickener as defined
in Sec. 170.3(o)(28) of this chapter; surface-active agent as defined in
Sec. 170.3(o)(29) of this chapter; and texturizer as defined in
Sec. 170.3(o)(32) of this chapter.
(d) The ingredient is used in foods at levels not to exceed current
good manufacturing practice in accordance with Sec. 184.1(b)(1). Current
good manufacturing practice results in maximum levels, as served, of 5
percent for alcoholic beverages, as defined in Sec. 170.3(n)(2) of this
chapter; 24 percent for confections and frostings as defined in
Sec. 170.3(n)(9) of this chapter; 2.5 percent for frozen dairy products
as defined in Sec. 170.3(n)(20) of this chapter; 97 percent for
seasonings and flavorings as defined in Sec. 170.3(n)(26) of this
chapter; 5 percent for nuts and nut products as defined in
Sec. 170.3(n)(32) of this chapter; and 2.0 percent for all other food
categories.
(e) Prior sanctions for this ingredient different from the uses
established in this section do not exist or have been waived.

[47 FR 27812, June 25, 1982]
http://www.cfsan.fda.gov/~lrd/FCF184.html

Where in the federal code is the specific use contemplated by A3C and the City permitted?

sincerely,

Henry Edward Hardy
[email address elided]

http://scanlyze.wordpress.com/

(1) INTERNATIONAL PROGRAMME ON CHEMICAL SAFETY
WORLD HEALTH ORGANIZATION
TOXICOLOGICAL EVALUATION OF CERTAIN
FOOD ADDITIVES
WHO FOOD ADDITIVES SERIES 16

Copyright © 2007 Henry Edward Hardy