Category Archives: Security

Security

Security Eval of J2ME CLDC Embedded Java Platform

Leave a comment

The Journal of Object Technology has posted a document with some in-depth information on the security of Java 2 Micro-Edition Connected Limited Device Configuration (J2ME CLDC). With so many mobile devices, including phones, running this platform expect to see more and more analysis and attacks in this area.

Problems already found show that the usual suspects (buffer overflow, input validation, confidentiality, session control, etc.) linger and should not be overlooked:

We showed that the J2ME CLDC security model needs some refinements (e.g. permissions and protection domains). Moreover, we demonstrated the presence of some vulnerabilities exist in the RI of MIDP 2.0 (e.g. SSL implementation). Some phones were also shown to be vulnerable to security attacks like the Siemens SMS attack, while other phones followed a restrictive approach in implementing the J2ME CLDC platform.

Security

Chicago gangs use web for ‘hits’

Leave a comment

New meaning for “web hits”? Report by the Chicago police dept on how violent gangs are using the web to plan violent attacks:

Work by Special Gang Task Force Foils Murder Plot by Members of New Breed Street Gang: A special gang task force formed by Chicago Police helped disrupt escalating violence between two rival Chicago street gangs as well as foil a murder plot by one of the gangs earlier this week, police reported Thursday.

The full text of the report has several interesting points, including the use of wiretap by the police, the use of anti-forensics measures by the gangs, and how information on the web fit into the gang’s plans:

[Supt. Philip] Cline said the gang members used sophisticated means as they plotted the hit, including accessing the Illinois Department of Correction Web site for photos of rival gang members so they would have an exact description of their target.

Poetry, Security

Fugitive found due to poetry, community work

Leave a comment

It seems to me that this story tells how a wanted man was actually found because he had become a well-known member of a community/church and was actively publishing poetry:

At some point last month, FBI investigators running Porter’s fingerprints through a database came up with a match to the 1993 theft arrest, according to the law enforcement official. FBI investigators notified the Massachusetts Department of Correction, which notified State Police, and the hunt for Porter began anew.

After running Porter’s alias, Jameson, through Internet searches, investigators discovered their fugitive was an established poet who also had ties to a progressive Unitarian church on Chicago’s West Side.

Horton, the State Police Investigator, was at a loss yesterday to explain why, after trying to run Porter’s prints for all these years, authorities finally got a match.

”We don’t know,” he said. Illinois officials could not immediately say yesterday when the state began putting fingerprints of all known criminals into a nationwide database.

Three Massachusetts State Police investigators and three Department of Correction officials arrived in Chicago Sunday and turned up nothing. Yesterday, they decided to go to the Third Unitarian Church.

”Honest to God, he just walked in,” Horton said.

Interesting choice of words.

History, Security

Toddler and Infant face arrest/charges

1 Comment

Bruce wrote another spot-on post on the idiocy of secret US data mining programs and the fallability of travel info databases. The worst part about these programs is that they are apparently promoted, through any means necessary, by people who do not understand how very little integrity their information will have.

So in that vein, which is worse, an individual making robbery charges against the infant of a man s/he has a grudge against, or a country putting a toddler on their no-fly list and issuing an arrest warrant?

Compare, contrast:

3-month old baby charged with robbery

The baby had been charged with robbery, extortion and banditry, said local superintendent of police Rattan Sajai.

Though the robbery in the remote village of Muzzafarpur occurred Sept. 19, the fact that a prime suspect was an infant only came to light recently when police launched their investigation, Sanjai said.

Toddler gets travel ban, arrest warrant: paper

“While going through the passport checking procedures to get on board, one of the officers on duty said they wanted to take Suhail,” Emirates Today quoted the boy’s father, Abdullah Mohamed Saleh, as saying.

“I thought he was kidding me and said ‘Take him if you want’,” he said. “He showed me a print-out of a document that said Suhail was wanted and there was an arrest warrant for him.”

Now let’s say you are in charge of writing the queries for the mining tools. How would you prevent these errors from happening?

Is such a question even relevant if no one will face accountability for data integrity?

Welcome to The Trial, children…