Tech Risk & Security

Recently, a member of PISA (also called Anthony) noticed that when using HK Post office website, FireFox displayed security warning saying the digital certificate used bu HK Post is invalid. A detailed study by other PISA members showed that the reason HK Post (once is the root CA for HK) used their own root certificate. Root certificates are usually shipped with the browser installation and HK Post digital certificate was not included in their default software package. Hong Kong Post setup a page to teach users on how to add the root certificate to most used browsers . However, how many users know this link, willing to follow or could follow the instructions !! It is quite clear that currently most browsers develop and distributed by US company or US-based community. The interest of adding other root certificates is likely lower than adding new functions. Having said that, FireFox developers have a process to add Root Certificates to their software package, for example this li...

http://www.cw.com.hk/content/hk-guangdong-sign-framework-suggestions-e-signature

I read an article about how a group of US newspapers plan to respond to failing revenue. 1st : considered a “presentation on technology/service to track content on the Web and to extract payments from third-parties and ad networks that have appropriated newspaper content.” If other online formats are stealing your copyrighted content, make them pay for it. 2nd Collecting enhanced online newspaper user data across newspaper properties and mining that data to aggressively sell target content to specific audience segments across the network.” The core tech are tracking content (1st model) or user behavior (2nd model). But it is not technology that matters. It is the law that gives the newspaper to charge or sell these data that affect its success. The copyright law enforcement is tooooo expensive compare to maybe HKD 10 for a single reference. Privacy law is too restrictive for newpapers to sell their DB. My personal opinion is that the current legal infrastructure prohibit QUALITY newpap...

SDA Announces Agreement to Make J.P. Morgan's CDS Analytical Engine Available as Open Source; Increases Transparency in CDS Pricing At the centre of our current financial crisis is the CDS (credit default swap). ISDA is the trade association which draft standard contract for CDS. The market was unable to give a reasonable and authority price for CDS in recent months. The open source decision is to make the price of CDS more stable and being open source, each one could validate the price components (market risk, liquidity risk, credit risk, FX risk and others) Open source when taking a transparent perspective could help to stable a market in crisis. http://www.isda.org/press/press012909.html Antony

Recently, I re-organised my research article on legislation on circumvention of TPM and published in PISA Journal . In this issue, there was an article on iSCSI Resilience and Security which is a very precise introduction for security professionals. Thanks for SC Leung's editions.

A study was conducted to study the correlation between website usages and economy!! We now have all sorts of monitoring devices and data points that enable us to track human behavior. It is conveninet to believe some activities (like visiting a particular type of website) will affected by economy. But would this correlation substanitable ? giving the fact that the web content changes constantly and new websites are created daily? http://news.bbc.co.uk/2/hi/technology/7459055.stm

I read two news articles today. One on SCMP which reported that Intel hired anthropologist to study user behavior and shape their strategy. One on BBC Technology, which said ICANN plan to open up top-level domain names. The result would be that everyone could register their website name with ending ranging from .bank to .worm. They seemed unrelated but I wonder how people respond to an explosive growth top-level domain names. Top level domain names, like .com or .hk are limited and users accumulated a sense of trust after years usages. Will user trust citibank.bank more over citibank.bank ? or will user buy items from toyshop.com or toyshop.shop ? What is missing in the current Internet infrastructure, after 10 years of development, is trust? How ICANN's proposal to open up top-level domain is helping to built trust in cyberspace ? The current status of DNS is far from satisfactory and phishing attacks are launched daily exploiting this weakness. Opening up top-level domain name fo...

There is a blog about Effects of ID theft. It is quite a good reference but the whole process of cleaning up ID theft only after you know your identity was comprised.

An article from Bloomberg News discussed how Google adjusted their web services with national cultures. In Thailand, they banned YouTue to show videos which offended King Bhumibol Adulyadej. In China, Google stopped offering Gmail to Chinese Citizen to avoid government demands for messages. To be able to stop user from using a specific web services, Google must rely on the programming codes. Now these codes with geo-sensitive information are used to build walls within Cyberspace, either due to political reason or to respect the natioanl cultures. The multinational enterprise is now taking the duty to fund the building of these walls using their codes. Cultural walls is not an entirely bad concept since a neigbhood enjoy more harmony when there are walls between them. Contrast this to Lawrence Lessig's "Code wants to be free" concept, we could see that multinational enterprises were using codes to control information flow. The force to from multinational enterprises is ...

I wrote about US Senate's approval of Council of Europe Cybercrime Convention . Recently, the Cybercrime Committee of Council of Europe released a guideline on how ISP and law enforcement agencies should cooperate in cybercrime investigations. Guidelines for law enforcement - service provider cooperation (adopted on 2 April 2008) From this document, it could be see that there is a large gap between law enforcement and ISP on obtaining evidences. Both sides need to formalise their procedures (either request or giving evidences). If there is no force from the government or other external factor, I could see no reason for them to incur additional resource in this process.

I have been busy with my LLM study at The Hong Kong University in the past year. All goes well, I will graduate this year. The course I took covers Telecommunication, Cybercrime and IP. Will share about all these topic in the coming posts. First, PISA will has several events in pipeline. Today, we just finished an Oracle Security Seminar On 31 May, there will be Data Protection Public Forum . Speakers from ISACA, ISOC and Privacy Commissioner will share their view on recent incidence on data breaches . Then on 5 June, PISA invited Aloysius Cheang (Head of Security Services for Cable&Wireless Asia-Pacific) to share his experience on malware detections and preventions.

Below are some extracts from NY Times Blog http://freakonomics.blogs.nytimes.com/2008/02/15/is-myspace-good-for-society-a-freakonomics-quorum/ "social capital", a concept that describes the benefits individuals receive from their relationships with others. Bridging social capital reflects the benefits we receive from our "weak ties" — people we don't know very well but who provide us with useful information and ideas. As our social networks are becoming increasingly more geographically fragmented, social network sites are a useful way for us to keep in touch and seek social contact with our friends. When many students begin university, they find themselves with a group of ready-made acquaintances. Given people’s preferences for people who are like them, it could be that friendship networks become increasingly homogeneous. Is this a bad thing? It might be if, by choosing potential friends via their Facebook profiles, it means that folk cut themselves off from ser...

There is a sad but true story that corporate-PR "corrected" wikipedia pages in order to downplay the mistakes done by company and government organizations. Some of the "corrections" may be a true account of history but there are deliberate censorship. Most people think the network address (IP address) are useless and could not reveal the location or identity of individuals. However, most IP address is similar to telephone number and could be traced to specific organizations. This traceability enabled Wikiscanner (mentioned in the article) to find the editor of wiki. There are some anonymous networks like Tor for people to conceal their identity. I believe the PR will continue their censorship on wikipedia with these anonymous networks. It is sad that when truth is the battlefield between individual and large organisations.

The gap between law and science is ever widening. In the past, the court is a place for justice but now justice is bury among scientific experiments and mathematical calculations. Judges trained to filter fake science from USA Today

The Hong Kong district court heard a computer crime case on 18th June 2007. An African visitor had rented a flat and stole credit card numbers from his neighbor using wireless sniffing, then he used the credit card information to do online shopping. The charge was brought under HK Crime Ordinance Chapter 200 s116 . More detailed information will be available when the judgment is posted online. The 23-year old defendant was caught since he had used his home address for online shopping and the police were able to trace the delivery records. His ignorance of fraud detection systems and traceability of online shopping transactions seems to suggest that he is not a professional criminal. There are lots of ways to use stolen credit card numbers, buying cash coupons and delivering to an unoccupied house's mail box are common. According to statistics , credit card fraudis increasing and costs 3 billion USD in 2006, up from 2.7 billion in 2005. Different measures (like adding chips or usi...

On 7 June, there was a reported case of a successful botnet Distributed Denial of Services DDOS attack. This type of attack was difficult to prevent since current technology could only divert the traffic after the attack has been launched. Due to the fact that the sources of attack are highly distributed, we could never monitor nor stop the DDOS attack. Once the attack is launched, the affected system will be unable to response to normal users. DDOS attacks are real and there were even reported cases on DDOS against a national body Estonia . The scary thing about DDOS is the growing number of botnet . With the higher penetration of broadband internet, more computers will be connecting to the Internet 24x7. If the management of these computers is not done securely, they will be a breading ground for botnets and viruses. One area to pay special notice to is the growing trend of networked devices. Vetting machines, CD juke boxes and other everyday electronic devices are likely to be conne...

I saw an article on Yahoo news about "25 Web Sites to Watch " and the web advanced so rapidly that one could never be able to catch up. I grouped some of the web sites according to their features. One thing I noticed is that the web is getting specialised and each website is good doing one particular domain. This fragmented development is the result of a distributed web but in history every development will eventually reverse its course. " speculated that the Internet will become, in essence, a vast operating system" Popfly Yahoo Pipes Goowy Data/Opinion Site BuzzDash Swivel Multimedia Web creation tools SplashCast Squidoo Yodio

China Internet Network Information Centre released a survey result on the current usage of WAP in China. As of March 2007, there were 39M WAP (Wireless Acccess Protocol) users, about 28% of fixed Internet population in China. Not too surprising, Guangdong Province has the large WAP population. The report summary could be find here .

The legal battle on BitTorrent cases reached an end on 18 May 2007 and the full judgement released on Hong Kong Legal Information Institute On 12 Jan 2005, officers from HKSAR Custom Department raided thedefendant's (Mr. Chan) home after tracking his address from an online forum. Mr. Chan he had uploaded 3 .torrent files on 10 Jan 2005 and 11 Jan 2005 to the forum and these enabled BT users to download copies ofmovies. In first instance, Mr. Chan was charged by virtue of section118(1)(f) of the Copyright Ordinance, Cap 528 and of obtaining access to a computer with dishonest intent, contrary to section 161(1) (c) ofthe Crimes Ordinance, Cap 200. But in the final judgement in the Court of Final Appeal, the 5 judges unanimously dismissed Mr Chan appeal andhe was convicted of 118(1)(f) of the Copyright Ordinance only. This was a high profiled case and the HKSAR government launched propaganda on their determination on combating the copyright battle. Since charges was brought to the cou...