EU might raise fines for data breaches

This makes a lot of sense.

Viviane Reding dismissed recent fines for Google as "pocket money" and said the firm would have had to pay $1bn under her plans for privacy failings. Ms Reding said such punishments were necessary to ensure firms took the use of personal data seriously.
And she questioned how Google was able to take so long to getting round to changing its policy.
"Is it surprising to anyone that two whole years after the case emerged, it is still unclear whether Google will amend its privacy policy or not?" she said in a speech.
Ms Reding, who is also vice-president of the European Commission, wants far tougher laws that would introduce fines of up to 5% of the global annual turnover of a company for data breaches.

If fines are intended to change corporate behavior, they need to be large enough so that avoiding them is a smarter business strategy than simply paying them.

SPARROW II: NSA exploit of the day

Today's item from the NSA's Tailored Access Operations (TAO) group implant catalog:

SPARROW II (TS//SI//REL) An embedded computer system running BLINDDATE tools. Sparrow II is a fully functional WLAN collection system with integrated Mini PCI slots for added functionality such as GPS and multiple Wireless Network Interface Cards.
(U//FOUO) System Specs
Processor: IBM Power PC 405GPR
Memory: 64MB (SDRAM), 16MB (FLASH)
Expansion: Mini PCI (Up to 4 devices) supports USB, Compact Flash, and 802.11 B/G
OS: Linux (2.4 Kernel)
Application SW: BLINDDATE
Battery Time: At least two hours
(TS//SI//REL) The Sparrow II is a capable option for deployment where small size, minimal weight and reduced power consumption are required. PCI devices can be connected to the Sparrow II to provide additional functionality, such as wireless command and control or a second or third 802.11 card. The Sparrow is shipped with Linux and runs the BLINDDATE software suite.
Unit Cost: $6K
Status: (S//SI//REL) Operational Restrictions exist for equipment deployment.

Page, with graphics, is here. General information about TAO and the catalog is here.
In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

New Security Risks for Windows XP Systems

Microsoft is trying to stop supporting Windows XP. The problem is that a majority of ATMs still use that OS. And once Microsoft stops issuing security updates to XP, those machines will become increasingly vulnerable.
Although I have to ask the question: how many of those ATMs have been keeping up with their patches so far?
We have far to go with our security of embedded systems.

PHOTOANGLO: NSA Exploit of the Day

Today's item from the NSA's Tailored Access Operations (TAO) group implant catalog:

PHOTOANGLO (TS//SI//REL TO USA,FVEY) PHOTOANGLO is a joint NSA/GCHQ project to develop a new radar system to take the place of the CTX4000.
(U) Capabilities
(TS//SI//REL TO USA,FVEY) The planned capabilities for this system are:

• Frequency range: 1 - 2 GHz, which will be later extended to 1 - 4 GHz
  
• Maximum bandwidth: 450 MHz.
  
• Size: Small enough to fit into a slim briefcase.
  
• Weight: Less than 10 lbs.
  
• Maximum Output Power: 2W
  
• Output:
  
• Video
  
• Transmit antenna
  
• Inputs:
  
• External oscillator
  
• Receive antenna

(U) Concept of Operation
(TS//SI//REL TO USA,FVEY) TS//SI//REL TO USA,FVEY) The radar unit generates an un-modulated, continuous wave (CW) signal. The oscillator is either generated internally, or externally through a signal generator or cavity oscillator. The unit amplifies the signal and sends it out to an RF connector, where it is directed to some form of transmission antenna (horn, parabolic dish, LPA, spiral). The signal illuminates the target system and is re-radiated. The receive antenna picks up the re-radiated signal and directs the signal to the receive input. The signal is amplified, filtered, and mixed with the transmit antenna. The result is a homodyne receiver in which the RF signal is mixed directly to baseband. The baseband video signal is ported to an external BNC connector. This connects to a processing system, such as NIGHTWATCH, an LFS-2, or VIEWPLATE, to process the signal and provide the intelligence.
Unit Cost: $40k (planned)
Status: Development. Planned IOC is 1st QTR FY09.

Page, with graphics, is here. General information about TAO and the catalog is here.
In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

Friday Squid Blogging: Giant Squid Caught by Japanese Fisherman

It's big: 13 feet long.

The fisherman was stunned to discover the giant squid trapped in his net, having been caught at a depth of around 70m, about two-thirds of a mile from the coast.

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

Income Inequality as a Security Issue

This is an interesting way to characterizing income inequality as a security issue:

…growing inequality menaces vigorous societies. It is a proxy for how effectively an elite has constructed institutions that extract value from the rest of society. Professor Sam Bowles, also part of the INET network, goes further. He argues that inequality pulls production away from value creation to protecting and securing the wealthy's assets: one in five of the British workforce, for example, works as "guard labour" -- in security, policing, law, surveillance and forms of IT that control and monitor. The higher inequality, the greater the proportion of a workforce deployed as guard workers, who generate little value and lower overall productivity."

Introduction to Vagrant on Linux

Modern operating systems, including Linux, have developed over recent years to bring operating system virtualization to the humble PC. Although virtualization itself isn’t new technology and Linux isn’t the only OS that can run virtual machines, the combination of open source technologies along with mature hypervisors means that Linux is able to offer advanced virtualization solutions. Among these solutions is Vagrant – a tool which works with virtualization software like Virtual Box and VMware to provide an easy way to create, configure and reproduce virtual machines with a known state. The ability to easily create multiple virtual machines in a known configuration can help with testing, software development and deployment. It is also useful in small offices or at home (for hobbyists) as test machines can be easily created and allowing experimentation with new software or configurations.
What Vagrant does is take a base guest operating system, say Ubuntu Linux, and create virtual machines that can be started, stopped and destroyed with simple commands. When  a virtual machine is initially created, it can be put into a predefined state – software can be installed, files can be created or copied onto it and other administration tasks can be performed.
To install Vagrant on Linux, visit the downloads page and pick the correct download for your distribution. The project offers packages for Debian and Ubuntu as well as Red Hat, CentOS and Fedora. There are 32-bit and 64-bit versions available. If you aren’t sure whether you have installed a 32-bit or 64-bit version of Linux then use “uname -a” to find out.
For Ubuntu you can install the .deb file using:

sudo dpkg -i vagrant_1.4.3_x86_64.deb

Replace “vagrant_1.4.3_x86_64.deb” with the version that you downloaded.
For Vagrant to work, you need to install VirtualBox (or VMware). Download the correct version for your distribution from the VirtualBox Downloads page. Oracle provides packages for Ubuntu, Debian, SUSE, Fedora and others.
For Ubuntu you can install the VirtualBox .deb file using:

sudo dpkg -i virtualbox-4.3_4.3.6-91406~Ubuntu~precise_amd64.deb

Replace “virtualbox-4.3_4.3.6-91406~Ubuntu~precise_amd64.deb” with the version that you downloaded.

Starting your first Vagrant machine

The quickest way to get Vagrant up and running is to create a directory for the virtual machine (VM) and then run two Vagrant commands, one to initialize the system and one to start the VM. First create a directory and cd into it:

mkdir vagrant-test1 cd vagrant-test1

Now initialize Vagrant:

vagrant init precise32 http://files.vagrantup.com/precise32.box

This tells Vagrant to initialize and use “precise32″ as the base operating system (called a box). The third parameter tells Vagrant where it can find the files for that box. In case you aren’t familiar with Ubuntu’s code names, precise32 means Ubuntu 12.04 LTS 32-bit. Vagrant also offers official boxes for Ubuntu 12.04 LTS 64-bit (precise64) and Ubuntu 10.04 LTS 32-bit and 64-bit (lucid32 and lucid64). There is also a list of community provided boxes at  http://vagrantbox.es.
As part of the initialization phase, Vagrant will create a file called “Vagrantfile” in the current working directory (i.e. vagrant-test1). You can create as many directories and initialize Vagrant as many times as you like. Each directory and Vagrantfile represent one virtual machine. These different VMs can be based on the same box (i.e. precise32) or on different boxes.
To start the VM run:

vagrant up

If this is the first time that a virtual machine has been run with the selected box, then Vagrant will download the .box file from the URL provided and boot it. This may take a few minutes, depending on the speed of your Internet connection, but subsequent boots will be much quicker as the .box file is only downloaded once. If you get a warning about the “guest additions” versions not matching, you can safely ignore it. Any files in the VMs working directory on the host machine will be available in the “/vagrant” directory on the VM. By default, that means just the Vagrantfile.
Once booted, the virtual machine is running in a headless mode (without a monitor or virtual screen) and so you need to connect to it via SSH. You can do this via a normal SSH client from any other machine on your network, or you can use the built-in ssh command. If you want to use another SSH client, note that the correct IP address is the IP address of the host machine (the PC running Vagrant and VirtualBox) but on a different port. During the boot up Vagrant will show how port 22 (for SSH) has been forwarded, it will likely be to port 2222.
To use the built-in ssh command, type:

vagrant ssh

You are now connected to the VM. To leave the SSH connection, type “exit” or press “CTRL + D”.

Final thoughts

To stop a running VM, use

vagrant halt

and to delete the VM, use

vagrant destroy

When a VM is destroyed, the base operating system (from the .box file) remains stored internally in Vagrant and further VMs can be started whenever necessary without Vagrant downloading the .box file again.
In just two commands (“vagrant init precise32...” and “vagrant up“), Vagrant allowed you to boot up a fully functional, SSH accessible virtual Linux machine. Advanced configuration happens via the Vagrantfile and you can find more details in the Vagrant documentation.