You are currently browsing the archives for the Uncategorized category


Russian Black List Grows

If a country want’s to start exercising more control over the internet, there is an easy way to start.  You get your legislation together, work out what infrastructure is needed and then announce you will implement measures to protect children online.  This is exactly what Russia did last year with a special bill which requires ISPs to maintain an ‘internet blacklist’ containing sites that should be blocked.  It’s also what a host of other countries are currently investigating including the UK and some European countries.   In Russia the bill was intended to protect children from harmful information contained online, in itself a rather vague and subjective definition.

The list does include some pretty horrible sites including child pornography but is also slowly expanding to include drug related sites, suicide information web pages and many others.  However it illustrates exactly what happens when a Government believes that no-one cares about censorship and it has a remit to control as it sees fit.    The list will grow and grow, in the last few weeks an entire blogging platform called L.J.Rossia has been blocked.   Apparently there was some paedophile content  uploaded to the site, but instead of blocking the specific pages or actually taking action against the individual involved the whole platform was banned.

Remember this is a blogging platform just like LiveJournal or WordPress, so when you block the platform you are also blocking all the bloggers and individuals who use that platform.  People like Andrei Malgin, a journalist who is very critical of the Russian Government or perhaps Vladimir Pribylovsk,  the author of  Anticomprat.ru and another journalist who is vocal in their criticism of Putin’s regime.   Potentially thousands of bloggers are now blocked in Russia because of a couple of pages uploaded onto the site.

Censorship simply doesn’t work in protecting the right people, any  paedophile who operates online will use VPNs, maybe an Australian proxy or security programs like Identity Cloaker to bypass filters and URL blacklists.   This is becoming mainstream technology and completely eliminates  the effectiveness of simple URL black lists held at an ISP.    Simple technology exists which individuals can use to protect children that can be installed very easily on a PC in fact most modern security/AV programs already have the feature.

In reality, it is simply a way for a Government to impose their own control over the internet.

Online Crime in a Virtual World

I was recently clearing out my bookmarks and came across a link to an article in an Asian newspaper.    It was an example of an area that is growing incredibly quickly,  crime in online games.  The story tells the tale of a smitten young man, a girl and an online computer game – World of Warcraft.

What happened is the girl wanted to make her character more powerful but instead of playing the game and leveling it up she came up with another ‘fast track’ method.  She knew an American boy online in the game who was very keen on  her, so she gave him a challenge -

If you love me, give me your password to prove it”

All sounds quite romantic up to there, doesn’t it – however when  the American boy did give the password to the girl, she  then ruthlessly cleaned out his account.   Now this all might sound a little trivial, after all it was just ‘digital stuff’, weapons, armour, gold and jewels in an online game.  However for anyone who has ever played any of these games – it can take quite a lot of time and effort into acquiring all this stuff.

What’s more the digital gold and equipment actually has a ‘real world’ value.  There are thousands of sites where you can buy and sell game gold and equipment for real cash.  You can equip your character with a fast track to success and put it all on your credit card.  The industry is thought to be worth millions of dollars across hundreds of online games.

The young man was heartbroken and when he discovered the theft, he begged her to return his stuff – but she wouldn’t.  She didn’t consider it a real crime merely part of the game, after all none of it was real.  Most legal systems around the world would struggle to prove a crime in these circumstances.   In this situation the girl had simply asked for access to the account, then transferred all the items to her own character – she didn’t make any attempt to sell the stuff for personal gain.   It wasn’t nice, but was it a real crime.

This example however is dwarfed by the real criminals targeting online games.  There are hundred of virus and trojans which have been written specifically to steal users passwords in these games – Trojan-PSW.win32, Trojan-SPY.Win32.Delf, Trojan-PSW.Win32 are some of the more well known ones.  Once the user’s gaming password is known then all their valuables can be stolen and resold on one of the many websites that operate in this area.

The criminals know how to exploit these players too, they hang around gaming forums and come up with devious methods to install this malware on indiduals machines.  For example a common exploit is to circulate some sort of program or addon designed to give players an advantage in the game, of course it doesn’t but just emails the user account details instead.

It’s a huge business, the rewards can be very lucrative and the risks often negligible.

Can you imagine going to the local police station to report that your ‘sword of destiny’ and 500 ducats of gold has been stolen from your dwarf cleric

Most of the criminal gangs operating in this way are based in China and South Korea so bringing them to justice is going to be nigh impossible. There are laws like the Computer Misuse Act 1990 which could be used to prosecute – but in reality prosecutions are almost unknown.

From our story at least the young man probably learnt a valuable life lesson, he’s also learnt to be more careful with his usernames and passwords.
Here’s the link to the original story -

http://www.asiaone.com/Digital/Features/Story/A1Story20071202-39249.html

Higgs Boson Update Video

Well I posted about the Higgs Boson on Wednesday and it happened.

Fantastic news – if you have kids tell them about it!!  It’s inspiring stuff, wonderful, incredible science….

 

An Introduction to SSL

Now I’m sure we’ve all bought something online or done a bit of internet banking.  If you have you’ve probably noticed that little lock picture in the corner of your browser somewhere.But I wonder how many people know what it means and what that little lock signifies.  Well if you’ve ever wondered, then let me explain some of the basics behind SSL and exactly how it works.

To begin with – SSL actually stands for Secure Socket Layer.  It was developed in the Mid-90s by a company called Netscape.  They owned a popular browser of the time called Navigator which was actually the first browser to allow secure and safe ecommerce functionality.  Up to then it was rather a large drawback that your communications should be spied on with the minimum of fuss.  Often it wouldn’t matter but if you were transmitting a credit or debit card number or some other confidential information – then you were risking a lot.

Netscape were well aware of this and what they designed was a new protocol.   That is a way for two different computers to talk to each other, however this protocol was different – the communication was encrypted in transit so they couldn’t be read by anyone.  Making the communication secure and ensuring that whatever information that was transmitted was safe. This was especially important due to the distributed design of the internet – your data could pass through hundreds of hops before it reached it’s destination. Without encryption anyone could just sit on a European, US or UK proxy server and analyse your data.

This works by the owner of the web server, obtaining something called a digital certificate from a company known as a Certification Authority or CA for short. Every certificate is unique and is linked to the company who issued it, this link eventually leads to the Root CA.

So each browser has access to a list of these CAs which are considered safe and secure.   So when you make a secure connection to a web site that owns a digital certificate, your own browser will look up the chain of command and check the validity of each certificate.  If the browser goes all the way back to the Root CA and still doesn’t find the certificate listed then you’ll get a warning that the certificate is not a trusted one.

Public Key Exchange

When a certificate is not trusted then you won’t know for sure if the information listed e.g. company name, address etc is valid.   Trusted Certificate Authorities (CAs) verify all the business and contact information for you. However even if the certificate is not trusted and the contact information unverified, at least the traffic from your browser to the web server is secured.

The next stage after the browser has established the certificate’s trust or you confirm you’re willing to trust it anyway is for the two computers involved to exchange keys.
A ‘Key’ is just a very large number which is related mathematically to another number in a defined way.  The form in which these two numbers are chosen is quite complicated, in fact an explanation of the process involved is likely to start something like this -

Agree on a finite cyclic group G with a generating element g in G.”

Unless you’re very interested in the cryptography behind these calculations, it’s probably just to consider it ‘magic’!

Each of the computers will create it’s own set of two keys.  Because of the special relationship of these two keys, any data encrypted with one key can only be decrypted by the other key.  One key is kept as a secret whilst the second is sent to the other machine.   After these keys are exchanged, each of the machines uses it’s own secret key and the key sent by the other machine to encrypt all data communicated between them.The same process is repeated at the second machine, which will decrypt using the two keys it has.

Remember the keys will only work to decrypt data which has been encrypted with the matching keys.  Each machine knows that the message came from the known source and was only intended for this machine.This effectively secures the data and ensures it cannot be intercepted.

Hope that clarifies a little – if it didn’t well I tried !

 

 

The New Identity Cloaker has Been Released

Well it’s finally happened – they are over a year late, but the new version of Identity Cloaker has been released. I was going to post a review but I’m afraid I got sidetracked listening to Rock tunes on YouTube.

Ok and I had a couple of beers too – the review is coming, it’s an incredible program. But in the mean time – it’s ACDC …..

But check in here soon – I’ll have a serious breakdown of the new version of Identity Cloaker.

No Politics – But Ninja Videos Ok

Is this right?

Fuck…I hope not….
The Dead Kennedy’s shocked in my youth – some thirty years ago..,,,,still pretty hard core…..

Awesome video :)