UK gov clarifies hacker tool ban
294975
Consultants in frame? Definitely Maybe The UK government has published guidelines for the application of a law that makes it illegal to create or distribute so-called "hacking tools".â¦
663154
The U.K. government is bringing in new regulations to resolve those painful occasions when that "funny" workplace e-mail ends up in the wrong in-box. The Department of Trade and Industry (DTI) will, from Oct.
136346
THE US Government has moved for the first time to block unsolicited circulation on the Internet of spyware, a type of software that can inundate web users with pop-up ads, secretly take control of their computers and spy on their online activities.
193519
Pulling the plug Cut-rate internet host UK2.net has become the subject of a hacking attack, leaving customers temporarily unable to access their email.â¦
679509
(InfoWorld) - Lawyers for a British computer hacker started an appeal in London High Court Tuesday to block their client's extradition to the U.S. Gary McKinnon, of London, isÂ accused of deleting dataÂ and illegally accessing information on 97 U.S. military and NASA computers between February 2001 and March 2002. He's been charged in U.S. District Court for the Eastern District of Virginia. McKinnon, who did not show up in court, could face up to 60 years in prison, said his attorney, Edmund Lawson. British authorities declined to prosecute McKinnon and the U.S. sought to extradite him. He challenged the extradition order in Bow Street Magistrates Court in May 2006. His attorney contended that since U.S. authorities allege McKinnon disrupted critical military networks after the Sept. 11 terrorist attacks, he could be held as an enemy combatant and subjected to inhuman treatment. The judge rejected the argument, and the U.K. Home Secretary John Reid subsequentlyÂ approved an extradition order. The appeal hearing will continue Wednesday in London High Court. U.S. authorities allege one of McKinnon's hacking sessions deleted files from computers at the U.S. Naval Weapons Station Earle in New Jersey, causing the shutdown of 300 computers at a critical time. McKinnon freely admits to hacking but contends he never damaged the targeted computers and merely did research on UFOs. He used a program called "RemotelyAnywhere" to control other computers, accessing administrator accounts and gaining passwords, according to British court documents. Most of his hacking occurred before office hours in the U.S.Â McKinnon's undoingÂ came after he mistimed one of his probes, and a user cut McKinnon's connection after noticing the mouse pointer moving around on the screen. Â
204491
(InfoWorld) - Moves by several European countries to tighten laws against computer hacking worry security professionals who often use the same tools as hackers but for legitimate purposes. The U.K. and Germany are among the countries that are considering revisions to their computer crime laws in line with the 2001 Convention on Cybercrime, a European-wide treaty, and with a similar European Union measure passed in early 2005. But security professionals are scrutinizing those revisions out of concern for how prosecutors and judges could apply the laws. Security professionals are especially concerned about cases where the revisions apply to programs that could be used for bad or good. Companies often use hacking programs to test the mettle of their own systems. "One useful utility in the wrong hands is a potentially malicious hacking tool," said Graham Cluley, senior technology consultant at Sophos PLC in Abingdon, England. In the U.K., legislators are debating amendments to the Computer Misuse Act (CMA) of 1990. The proposed revisions would make it illegal to create or supply a tool to someone who intends to use it for unauthorized computer access or modification. Likewise, the proposed changes to German law would also criminalize making and distributing hacking tools. The German government said the changes will bring it into compliance with the 2001 Convention on Cybercrime. Several German security companies are planning to lobby against the law, as they fear it could hamper those who test security systems, said Alexander Kornbrust, founder and chief executive officer of Red-Database-Security GmbH in Neunkirchen, Germany. For example, tools to check the strength of passwords, often freely distributed, could also be used by malicious hackers, he said. "The security community is very unhappy with this approach," Kornbrust said. "The concern is that the usage and possession of so called hacker tools will become illegal." The U.K. and Germany are trying to align their laws with Article 6 of the Convention, which bans the creation of computer programs for the purpose of committing cybercrime. So far, 43 countries have signed the Convention, which indicates their willingness to revise their laws to comply. Fifteen have ratified the Convention. After a country changes its laws, it can ratify the convention and put it into force. The Convention does not mandate a deadline for when countries must comply, and the process of changing laws can be lengthy depending on the country, said Margaret Killerby, head of the European Committee on Crime Problems, which tracks implementation of the Convention. But the goal is for Europe -- and other countries, such as the U.S., which also said it will implement the Convention soon -- to mount a consistent defense against computer criminals given the transnational nature of computer crime, Killerby said. A key point of the Convention requires countries to have a law enforcement contact available at all times to assist foreign authorities in obtaining electronic evidence, which can disappear quickly without quick moves by law enforcement. "What we want to have is an institution to allow states to cooperate with each other as rapidly as possible," she said. Those requirements are devoid of controversy. Individual countries can draft their own customized legislation to comply with the Convention, which can be used as a checklist, Killerby said. The Council has provided assistance to countries in central and eastern Europe in creating computer crime laws where none were on the books, Killerby said. Countries with existing laws will have find a medium that satisfies their own legal requirements and the Convention. In the U.K., the House of Lords is scheduled next month to debate changes in the part of the CMA concerning creation and distribution of hacking tools. The proposed revision to the CMA says a person is guilty of an offense if he makes or supplies something intending it to be used to commit an offense or "believing that it is likely to be so used." But officials are confident that the wording can be smoothed. The controversy could be dampened merely by changing "likely" to "primarily" which could "make sure we don't catch the legitimate penetration testers," said Merlin Erroll, a Lord who sits on the All Party Parliamentary Internet Group (APIG), during a recent presentation in London. REFERENCES: UK bill would increase penalties for cybercriminals, Jan. 27, 2006Analysts eye revamp of UK cybercrime law, Jun. 7, 2006UK teen pleads guilty to DOS e-mail attack, Aug. 24, 2006
300219
Police in the U.K. have arrested a man in connection with the theft of source code from networking equipment maker Cisco Systems Inc. in May, a Scotland Yard spokeswoman confirmed Friday.
589272
England-based Netcraft - an Internet services company, has released an anti-phishing toolbar that provides detailed information about the websites you are visiting at all times to help users validate fraudulent URLs.
458563
Security-minded users can find out faster if their applications need to be patched with a free tool.
238981
MI5, GCHQ bemoan 'biggest change since telephones' The head of the UK government's secret electronic spying and codebreaking agency, GCHQ, has said that his organisation's ability to intercept conversations and messages is seriously undermined by internet-protocol (IP) communications. The digital spook's comments may come as a blow to British and European politicians who have sworn to eradicate terrorism from the internet.â¦
298509
Germany's High Court has handed down a landmark decision banning police from installing spyware on computers of suspected criminals without their knowledge.
643306
(InfoWorld) - New legislation proposed by the German government aims to makeÂ computer hackingÂ a punishable crime. The draft law, announced Wednesday, defines hacking as penetrating a computer security system and gaining access to secure data, without necessarily stealing data. As part of the draft, groups that intentionally create, spread or purchase hacker tools designed for illegal purposes could be punished by law, the Federal Ministry of Justice said in a statement. OtherÂ punishable cybercrimesÂ include denial-of-service attacks and computer sabotage attack on individuals, which would extend the existing law that limited sabotage to businesses and public authorities. Offenders could face up to 10 years in prison for major offenses. Although Germany already has a comprehensive penal law against attacks on IT systems, the proposed revision aims to close any remaining loopholes, the ministry said. Some security experts warn, however, that "good" hackers, also known as "white hats" who work for security companies, could be restricted in their ability to help software makers and businesses as a result of the proposed law. If hackers can't share their tools with the public, "white hats will not be able to get them and use them internally for testing or external security consultants won't be able to do security testing," a hacker, known by the pseudonym van Hauser, wrote in an e-mail. "It's a win-lose law in favor for the bad guys." Van Hauser is president of The Hacker's Choice, a noncommercial group of security experts.
157952
New UK tax rules intended to eradicate a multi-billion pound fraud come into effect today.
568824
Red Hat Enterprise Linux 3 Update 3 limits how much damage a hacker could do. The company said the release is ahead of schedule and not a reaction to any specific threat.
139875
Company says breach last week by hackers likely had no impact on customers, but it continues to investigate the incident.
245945
Moves by several European countries to tighten laws against computer hacking are concerning security professionals, who often use the same tools as hackers.
602412
(InfoWorld) - A security expert has cracked one of the U.K.'s new biometric passports, which the British government hopes will cut down on cross-border crime and illegal immigration. The attack, which uses a common RFID (radio frequency identification) reader and customized code,Â siphoned data off an RFID chipÂ from a passport in a sealed envelope, said Adam Laurie, a security consultant who has worked with RFID and Bluetooth technology. The attack would be invisible to victims, he said. "That's the really scary thing," said Laurie, whose work was detailed in the Sunday edition of the Daily Mail newspaper. "There's no evidence of tampering. They're not going to report something has happened because they don't know." The British government, which began issuing RFID passports about a year ago, eventually wants to incorporate fingerprints and other biometric data on the chips, although privacy activists are concerned over how data will be stored and handled. Currently, the chip contains the printed details on the passports, the person's photograph, and security technology to detect if those files have been altered. The attack was executed while the passport was still in its original envelope used to send it from the passport service, since RFID chips can be read from a few inches away, Laurie said. He used a passport ordered by a woman affiliated with No2ID, a group that opposes the U.K.'s biometric passport and ID card programs. The data on the passport's chip is locked until an RFID reader provides the encryption key, Laurie said. The encryption key is calculated using a combination of the person's personal data, such as date of birth, and is contained in the "machine-readable zone" (MZR) -- the string of characters and digits on the bottom of the passport's first page. At an immigration desk, the optical character reader scans the MZR and gets the key. The RFID chip is unlocked, and the information on the chip is matched with that on the passport. However, Laurie was able to do this process himself. He analyzed ICAO 9303, the standard from the International Civil Aviation Organization that been adopted worldwide for machine-readable passports, to see how the MZR is organized. Laurie also knew some of the woman's personal details -- used to calculate her passport's key -- and found out more through Internet research. He then wrote what's known as a "brute force" program, which repeatedly tries different combinations of data to discover the key. After about 40,000 attempts by the program, he cracked the key. To scan the chip, he used a common RFID reader from ACG ID, now part of Assa Abloy Identification Technology of Germany. The attack could then let Laurie begin the process of making an exact copy of the woman's passport. "[The biometric passport] has been sold to us as something that increases the security of the passport, but so far I don't see anything about it that increases my security," Laurie said. The greatest weakness with the passports is using relatively easy-to-find data to compose the encrypted key, Laurie said. It would be better to include more random elements that would render brute-force style programs nearly useless, he said. Laurie's work spawned from concern over how users can know what's on their passport's chip. "At the moment, if you want to see what's in your own passport, you have to go to passport office," Laurie said. "With my code, you can do it at home." Laurie has published a library of open-source tools written in the Python programming language that will run on RFID readers made by ACG and by Frosch Electronics, based in Austria. Â