Report: The NSA pays millions for US telecom access

When it comes to tapping into U.S. telecommunications networks for surreptitious surveillance, the U.S. National Security Agency can't be accused of not paying its way.

The government agency pays "hundreds of millions of dollars a year" to U.S. telecommunications companies for the equipment and service required to intercept telephone calls, emails and instant messages of potential interest, according to a story in Thursday's Washington Post.

For the current fiscal year, the NSA will pay US$278 million for such access, and had paid $394 million in fiscal 2011, according to the Post.

Although previous news reports of NSA surveillance noted that the agency paid the costs for tapping into communications networks, the exact amount the agency has paid has not been cited before, according to the Post.

One of the largest of the 16 U.S. intelligence offices, the NSA is in charge of collecting and analyzing data to track foreign activities that could be harmful to the U.S. The agency is overseen by the U.S. Department of Defense's Director of National Intelligence.

The practice dates back at least to the 1970s. These data collection programs -- which have gone under names such as Blarney, Stormbrew, Fairview, and Oakstar -- are separate from the PRISM program first publicly unveiled by former NSA contractor Edward Snowden. PRISM collects data from U.S. service providers such as Microsoft, Facebook and Google, whereas with these programs, the NSA collects potential data of interest as it moves across telecommunication gateways.

The article did not provide the names of any telecommunications companies that participate in the program, though notes they typically are paid for the costs of hardware and the labor to install and run the necessary equipment, as well as a certain percentage for profit.

The privacy advocacy group Electronic Privacy Information Center had noted that it is troublesome that the NSA is paying so much to telecommunication companies given that their customers expect that their communications remain private.

Wales has worst access to superfast broadband

Access to superfast broadband in Wales is significantly lower than the rest of the UK, according to a new report from Ofcom.

The telecoms regulator Ofcom published its communications market report for the country yesterday, which showed that, while on average 73% of UK residents had access to the speedier internet connections, the figure was just 48% in Wales.

Despite the significantly lower number, the report defended the country’s efforts, showing it had the largest increase in access of any of the UK countries, growing by 11% in just one year.

But adoption figures of fixed line and broadband services were still below the UK average for the country. A total of 66% of Welsh households had a broadband connection in the first quarter of 2013, 9% lower than the 75% UK average, and 76% had fixed line services, 8% lower than the 84% UK average.

When it comes to mobile, however, Wales seems to be leading the way. Across the UK just 15% of households rely solely on a mobile phone, but this figure shoots up to 23% in Wales with citizens turning their back on traditional landline phones.

The number of people owning smartphones also grew from 12% to 54% of all Welsh citizens and in rural parts of the country adoption of the devices grew from 33% to 48%.

“Wales remains at the forefront when it comes to mobile-only homes and it is encouraging to see rural Wales leading the way in smartphone ownership, a trend set to continue with the imminent rollout of 4G services across the UK,” said Rhodri Williams, director of Ofcom in Wales.

“4G services will mean faster mobile broadband speeds, greater innovation, new investment and better coverage across Wales with at least 95% of the population of Wales receiving an indoor 4G coverage by the end of 2017 at the latest. This will mean that 4G coverage will extend beyond that of existing 3G services.”

However, Ian Clarke, chairman of Ofcom’s Advisory Committee for Wales (ACW), warned it would be imperative to secure government funding to keep the trend growing and improve access to other technologies.

“This year’s communications market report for Wales suggests an increasing preference for mobile telecommunications, with higher levels of mobile-only homes and smartphone ownership in Wales; and lower levels of fixed line broadband take-up compared with the UK average,” Clarke said.

“It will be crucial to ensure that the UK Government’s Mobile Infrastructure Project (MIP) and forthcoming rollout of 4G services serve to support this trend and ensure that all of Wales’ residents can access the next generation of mobile services, regardless of location.”

Why Small Businesses Need to Spring for Business-Class Internet Access

Google is being accused of violating the FCCs Open Internet Order as a result of its policy toward servers. Essentially, if you run a server from a Google Fiber Internet connection, you’re technically violating the terms of service, and you could find your Internet access shut down. Google stands by that policy, but the reality is that this is only one of many reasons that small businesses should not run a server from a consumer-grade Internet connection.

The issue with Google Fiber stems from a clause in the terms of service that reads, “Unless you have a written agreement with Google Fiber permitting you to do so, you should not host any type of server using your Google Fiber connection.”

Google has been a proponent of net neutrality, but some were quick to note that Google seems to have changed teams now that it’s also in the Internet provider business. Google’s response to the FCC includes this explanation: “The server policy has been established to account for the congestion management and network security needs of Google Fiber’s network architecture, particularly given that Google Fiber does not impose data caps on its users.”

Bottom line: Google believes it has a right to ban someone from hosting a server on it’s Google Fiber network because of the potential impact it could have on the bandwidth for all of the rest of the customers. That seems reasonable.

You don’t really want to host your business server on a consumer Internet service anyway. Granted, Google Fiber delivers a 1Gbps connection for a very low cost compared to any other consumer or business service. However, Google Fiber is only available in a few select cities, and there are other reasons to choose a business-class Internet provider.

First, Google states explicitly that it doesn’t impose a bandwidth cap, but many consumer Internet services do. Comcast used to have a 250GB per month cap, but switched to a tiered-pricing plan last year for heavy users. The cap is now 300GB, after which Comcast charges $10 extra per month for each additional 50GB.

Another benefit of business-class Internet service is that you generally have a dedicated, static IP address, which makes it much easier to host and manage a server. Consumer Internet services use DHCP to randomly assign IP addresses, so your website or FTP server might be on one address today, and a different one tomorrow.

Most consumer Internet services block various TCP ports—for example port 25. It’s blocked as a measure to guard against or limit spam, based on the assumption that no consumer customer is hosting an email server (because it would violate the TOS). You want to have full access to all of the ports for your Internet access—including TCP port 25, so business-class Internet is the way to go.

Tech support is also different. Calling the consumer tech support line when you’re having an issue is typically an exercise in futility and frustration. If your business depends on the Internet connection, it can be that much more stressful. The technical support for a business-class account is generally more knowledgeable and more expedient, so you can minimize down time and keep your business online.

The operative word in the term “small and medium business” is “business”. In other words, regardless of whether your company has one employee, one hundred, or one thousand, it’s still a business, and it still needs to act like one. That is particularly true when it comes to choosing an Internet provider. 

Remote access a priority for latest Oracle patch update

The vulnerabilities that allow for remote unauthenticated access should be a priority for administrators applying the latest Oracle Critical Patch Update (CPU) say security experts.
This means businesses will need to focus on applying more than 40% of the 89 updates that cover most of Oracle’s product groups.

Java is on a different update cycle of every four months, but it will be migrated to the same schedule from October 2013. 

Oracle’s flagship product, the Oracle database, gets six updates this month, with four being remotely exploitable.
The XML parser vulnerability, which is remotely accessible but requires authentication, has the highest Common Vulnerability Scoring System (CVSS) score of the Critical Patch Update, scoring nine on a scale of 10, indicating high criticality.

“One mitigating factor is that Oracle databases are typically not exposed the internet,” said Wolfgang Kandek, chief technology officer at security firm Qualys.

Oracle’s MySQL database has 18 vulnerabilities addressed, including two that are remotely accessible and have a CVSS score of 6.8.

“MySQL is often found exposed to the internet, even though this is not considered best practice. If you use MySQL in your organisation, it makes sense to run a perimeter scan to collect information on all databases externally exposed,” said Kandek.

The Oracle Sun product line has 16 updates, with eight being remotely accessible. The highest CVSS score is 7.8.

“If you have Sun Solaris servers in your organisation, review these patches and start with the machines on your perimeter and DMZ,” said Kandek.

Oracle’s Fusion Middleware has a total of 21 vulnerabilities and includes many components that are typically found on the internet, such as the Oracle HTTP server.
Of the 21 vulnerabilities, 16 are accessible remotely, with a maximum CVSS score of 7.5. “Again, a perimeter scan is helpful, or even a quick query to Shodan, which shows more than 500,000 machines with Oracle’s HTTP out on the internet,” said Kandek.

The highest CVSS score is 7.5, which should not be ignored, said Ross Barrett, senior manager of security engineering at Rapid7.

Fusion contains the Outside-In product that is used in Microsoft Exchange for document viewing. Outside-In has, in the past year, caused two updates in Microsoft’s email product to address the vulnerabilities in MS12-058 and MS12-080.

According to Kandek, recent research by Will Domann shows that Outside-In has the potential for more vulnerabilities. He recommends turning off the WebReady feature, which means that users have to download the documents to the local disk for viewing.

Other product areas with security updates include Peoplesoft, E-Business, Virtualisation and Solaris, which has been hit with two remote denial of service (DoS) attacks, plus a couple of local elevation of privilege issues, said Barrett.

This free Computer Weekly special report on Oracle gives an independent view of the challenges facing Oracle, its financial performance, the services it offers, its place in the IT market and its future strategy.
“With such a diverse range of products in this quarter’s patch, it's hard to tackle these from top to bottom. I recommend patching any vulnerable Oracle Database Server instances as soon as possible, and don’t neglect the stability or integrity of the Solaris deployment,” he said.

Kandek said dealing with the large sizes of the Oracle CPUs would be easier if a good map of the currently installed software exists.

“In any case, we recommend addressing vulnerabilities on systems that are internet accessible first, such as Fusion Middleware, the Solaris operating system and MySQL,” he said.

According to Craig Young, a security researcher at Tripwire, Oracle has acknowledged and fixed 343 security issues so far this year.

“In case there was any doubt, this should be a big red flag to users that Oracle’s security practices are simply not working,” he said. “The constant drumbeat of critical Oracle patches is more than a little alarming, particularly because the vulnerabilities are frequently reported by third parties.”

This month’s CPU credits 18 different researchers coming from more than a dozen different companies, he added.

Security company to release testing tool for SAP mobile access

As SAP invests heavily in mobile, a security testing company will release a tool next month to ensure mobile-accessible SAP systems are not vulnerable to hackers.

Boston-based Onapsis will release a new module for its X1 security suite, a product that performs automated security assessments, penetration testing and compliance audits for SAP’s ERP (enterprise resource planning) software, said Mariano Nunez, Onapsis’ CEO.

The module will focus in part on the SAP Mobile Platform, formerly known as the Sybase Unwired Platform Developer Center, which helps developers build SAP mobile applications for different devices and platforms. It also looks at the NetWeaver Gateway, an SAP server that links devices to back-end systems, Nunez said.

Exposing those back-end systems is complicated, and companies can face a risk of hacking if the systems are misconfigured or do not have up-to-date patches.

“We see that companies may not be paying enough attention to that and forgetting the devices,” Nunez said. “Our empirical experience shows those systems are usually left insecure because of people not applying the latest patches or not following SAP’s best security practices.”

SAP is focused on mobile access, device management and security as more companies embrace bring-your-own-device policies. SAP supports iPhone, Android, and Blackberry devices.

Sanjay Poonen, head of SAP’s mobile division, said at the Sapphire Now conference in May that the company has more than 1,000 people working on mobile-related projects in areas such as retail, banking and consumer package goods.

Last year, SAP reported more than €222 million ($293 million) in license revenue from its mobile-related business, a revenue stream that didn’t exist two and half years prior, Poonen said.

“We think this market is really poised for an even bigger opportunity if you go even beyond devices,” Poonen said. “This world is going to require us to think of mobile security in a whole new way.”
Nunez said companies faces risks if, for example, a CRM (customer relationship management) system is incorrectly configured for access by mobile devices, opening a door for hackers using attack tools for Web services.

X1’s mobile security module looks at what functions and processes are exposed in the back-end systems and not on the mobile application itself, Nunez said. It alerts users to security vulnerabilities and tells users how to fix the issues. The module is scheduled to be released next month, and will be free to X1 subscribers.

Onapsis is also scheduled to present two SAP security workshops at the Black Hat security conference in Las Vegas, which kicks off on July 27. The workshops, which are not product focused, will look at SAP security from an academic perspective, Nunez said. 

Dropbox update eases worries over offline access to business data

As every hapless teenager stranded in a dank cabin in the psychopath-ridden woods can tell you, your cell phone is useless if you don't have a signal. For business users, the stakes are just as high: Travel to a farflung corner of the world to meet with clients and "zero bars" is a distinct possibility. And God help you if you have to take a plane ride anywhere and aren't lucky enough to get on the handful of jets with onboard Wi-Fi.

While being unable to make calls, send emails, or check the news is certainly an inconvenience, the problem is compounded if you rely on cloud services to actually get work done. Storing data online and running apps that rely on a live Internet connection mean you can abruptly turn into an unproductive layabout when wireless service isn't available.

Hybrid cloud services have started to address the issue, and Dropbox has been leading the charge. Files stored via Dropbox are automatically stored both in the cloud and on your local machine. Changes made to one file are copied in the background when a connection is available, and synced up with all devices running the Dropbox software. Google Drive, SugarSync, and many other cloud storage services work about the same way.

That's a start, but it only addresses the very beginning of the problem. A growing number of services are designed to work exclusively over the Web, and if you're not connected, they simply don't run at all. (Think Facebook.) Well then, why not enable these apps and services to work in offline, hybrid mode, the way Dropbox works? Evernote does it. So does Gmail; it doesn't include all its features from top to bottom, but what it offers is good enough for most users.

Offline support is uncommon because coding this kind of software isn't easy. There are myriad issues to consider: What happens if you change a file in two places before re-syncing? How do you manage the unavoidable data file differences between, say, an iPhone and a Windows 8 PC? And good luck when you bring multiple users into the mix. Imagine five offline users working on a single document simultaneously, then trying to sync en masse. Nightmare. Who wants to try to code all of this stuff themselves?

Well, with the new API releases the company put out this week as part of its DBX developers conference, Dropbox has told the developers of the world that they don't have to. Without getting too far into the weeds, the new APIs mean that third-party developers can now use Dropbox to store program data instead of having to stash it on the user's hard drive or build their own cloud service to store it. That means you'll be able to work on a spreadsheet, draw a picture, or play a game on one device… then pick right back up where you left off on another, whether you're online or off.

With 100,000 apps already supporting Dropbox in some fashion, this isn't a pipe dream. Universal access to data from any device and robust offline support have the potential not just to revolutionize the way we work but to become expected, almost required components of any piece of software we use. As Dropbox CEO Drew Houston told TechCrunch, "Every app is going to be designed this way in the future and we wanted to get started on that now.” I can't wait.

Hacker Holes in Server Management System Allow 'Almost-Physical' Access

Major vulnerabilities in a protocol for remotely monitoring and managing servers would allow attackers to hijack the computers to gain control of them, access or erase data, or lock others out. The vulnerabilities exist in more than 100,000 servers connected to the internet, according to two researchers.

The vulnerabilities reside in the Intelligent Platform Management Interface, a protocol used by Baseboard Management Controllers that are used to remotely monitor servers for heat and electricity issues as well as manage access to them and other functions.

The security holes would allow hackers to obtain password hashes from the servers or bypass authentication entirely to copy content, install a backdoor or even wipe the servers clean, according to Dan Farmer, an independent computer security consultant who conducted the research for the Defense Department’s DARPA.

A scan of the internet conducted by HD Moore, chief research officer at Rapid7 and creator of the Metasploit Framework penetration testing tool, found more than 100,000 systems online that were vulnerable to one or more of the security issues.

The IPMI protocol standardizes communication so that management controllers from various manufacturers can interact seamlessly with servers from various manufacturers. BCMs provide a virtual keyboard, mouse and removable media to remotely manage servers and are installed on nearly all servers manufactured today.

By using the vulnerabilities in IPMI to compromise a server’s remote management controller, an attacker can then gain access to the server itself.

“In short – any weakness of the BMC can be used to get an almost-physical level of access to the server,” Moore says, noting that users of IPMI are “heavily cautioned by the vendors to never place a server’s BMC on the internet because of the dangers it poses,” but many ignore the warning.

“Essentially every modern company and government on the planet relies on IPMI for system management, and internal attacks would be substantially more deadly,” he says.

Two versions of the protocol currently in use, versions 1.5 and 2.0, both have issues. Version 1.5 doesn’t require that passwords for the BMC be encrypted. And version 2.0 has half a dozen additional vulnerabilities.

Farmer identified six distinct vulnerabilities in version 2.0 of the protocol. One intrinsic vulnerability lies in the fact that the protocol specifications call for passwords for the IPMI to be stored unencrypted on the BMC. He says this is particularly foolish because organizations often configure a single IPMI to manage large groups of servers — sometimes as many as 100,000 in the case of hosting providers — all of which would be vulnerable if someone gained access to the clear text password.

“The exposure of clear text credentials makes it possible for an attacker to compromise all BMCs using the same password,” he says. “Information [about] how and where these passwords are stored has been documented online, and has been confirmed on both Dell and Supermicro BMC implementations.”

Another vulnerability allows anyone to obtain a cryptographic password hash of a user’s account, allowing an attacker to perform an offline brute-force attack to decipher the password. A Metasploit module already exists to conduct such an attack.

“A Python script and a Metasploit Framework module exist to test for this issue and have broken over 10 percent of the passwords with an initial test,” Moore says.

A third vulnerability allows an attacker to bypass the authentication process entirely if someone has Cipher 0 enabled in the BMC configuration. Cipher 0 is often enabled by default in BMC systems to handle the authentication handshake, but it allows anyone to bypass authentication and send the system commands.

A fourth vulnerability would allow someone to use anonymous logins with the username and password set to a null value to gain administrative privileges on the control system.

Some BMCs also enable Universal Plug and Play by default. Moore published a paper earlier this year identifying three sets of serious security flaws in UPnP.

After performing an internet-wide scan to determine how many BMC systems are connected to the internet, he found more than 300,000. Of these, 195,000 were using version 1.5 of the protocol, which does not provide any encryption. Another 113,000 of the BMCs support version 2.0, and of these, 99,000 exposed password hashes, and 53,0000 were vulnerable to the password bypass issue due to Cipher 0 being enabled. About 35,000 BMCs from Supermico have a Universal Plug and Play vulnerability.

“The 53,000 BMCs that allow authentication via Cipher 0 are at immediate risk of compromise,” Moore says. “No exploit code is needed to manipulate these systems as the standard IPMI command-line tools provide the required functionality. An attacker could use the Cipher 0 weakness to configure a backdoor account with administrative privileges. This backdoor could be used to compromise the BMC and the connected server.”

Because BMCs have their own IP address, separate from the server’s IP address, hackers could hijack the BMC and never be noticed by network administrators who are only monitoring server IP addresses for nefarious activity, Moore says.

Farmer began researching the IPMI protocol in mid-2012 as part of a DARPA Cyber Fast Track grant. Earlier this year Farmer published a list of security best practices for IPMI (.pdf).

Moore says companies should make sure that IPMI-enabled BMCs are not connected to the public internet, and that companies should also disable Cipher 0, set complex passwords, and in the case of Supermicro systems, demand a patch for the UPnP vulnerability from their vendor.

“Many folks are unaware that their systems have IPMI enabled in the first place, the only way to tell for sure is to use some form of scanner on the local network,” says Moore, who added an IPMI module to the open source Metasploit Framework to help with this.

Kevin Smith on Why 'Clerks 3' Kickstarter Didn't Happen: 'I Have Access to Money'

Even with the success of the Zach Braff and Veronica Mars movie projects, Kickstarter just isn't for Kevin Smith right now.

"I love the idea and I want to do it so desperately, but I think I've missed the window based on the fact that I do have access to materials, I do have access to money," he said to The Hollywood Reporter's Kim Masters on KCRW radio. "I don't know, I feel like I should leave that for the cats that really need it at this point."

Smith was elaborating on why he decided against using the crowdfunding website to help finance Clerks III. The Weinstein Co., he was informed by his lawyer, has the first look rights for the possible sequel.

GUEST COLUMN: Director Kevin Smith: My Prayer for 'Star Wars'  

"It feels like me trying to have a second bite at the apple by going, 'All right man, now I'm going indie again with this Kickstarter thing.' Like, the truth of it is, after all this time, 20 years later, I have access to money," Smith said in the interview. "If I don't use my own money, I can always hit up some of my famous friends."

The director, Masters noted, made a point to explain that he wasn't criticizing other celebrities' Kickstarter projects.

In April, Braff launched a $2 million Kickstarter to fund his Garden State follow-up, Wish I Was Here, that ended up receiving $3.1 million in pledged funds. The revival of Veronica Mars, meanwhile, closed with $5.7 million in pledged donations from fans.

But even though Smith decided against going the crowdfunded route for Clerks III, he said it probably would make for a successful Kickstarter project.

"If our Kickstarter video had been me just walking out in front of a blackboard and writing Clerks and then III after it, without much more than that, we probably would have easily cleared $5 million to $7 million bucks," Smith said. "And not because people like me, but they love Clerks, man."

Smith's breakout film, Clerks, was released in 1994. A sequel, Clerks II, arrived in theaters in 2006 and grossed $24 million in the U.S.

Follow me on Twitter @sajilpl

Drake Denied Access to Miami Heat Locker Room (Video)

"I am media," Drake said, after being turned away from the Miami Heat locker room Thursday, June 20.

After the Heat won their second consecutive NBA championship, this year over the San Antonio Spurs, Drake headed to the team's locker room to congratulate them and team player and friend LeBron James.

PHOTOS: Slam Dunk! Hollywood's Best Basketball Movies

When denied access by security and told only media was allowed through, the bewildered rapper responded with "I am media."

Before footage surfaced, NBA reporter, Alex Kennedy, tweeted of the incident.

Drake was just stopped by security. He tried getting in the locker room without media pass. "I am media," he said with a laugh.

— Alex Kennedy (@AlexKennedyNBA) June 21, 2013

Before heading to Miami for the championship game, Drake made a special apperance at J. Cole's "Dollar and A Dream" NYC show. Both rappers headed over to Best Buy in NYC's Union Square afterwards and bought all available copies of Cole's sophomore album, Born Sinner.