Security Blog 


4.30.2004

Alarm growing over bot software
CNET reports. I think bot is just a different term for rootkit - nothing new here.



Google denies FBI link to Gmail
Google denies it, which is probably accurate. I would bet that in the near future though, that won't be the case. I don't see how the FBI couldn't be concerned about Gmail as an anonymous, albeit crude, file transfer system (when used with strong encryption and open wireless access points). I wonder what the size limitatons are for Gmail attachments?


4.29.2004

Google and privacy
Interesting email on John Battelle's site. If you use the Google Toolbar or plan on using Gmail - check it out.

One day he had a firewall issue when trying to retrieve a file,
and the person who was hosting it offered to put it on a "private" (i.e., unlinked) page for him to grab over HTTP. He accepted, downloaded the document, and promptly forgot about it - until this document, which had extremely personal information on it (personal to the person *hosting* it, not the person retrieving it) showed up on Google a short time later. You see, the toolbar had seen him go to a web page that Google did not have, and so they indexed it right away.



4.28.2004

Florida town to use blanket of surveillance cameras
1984 + 20 = 2004.

One of the nation's wealthiest towns will soon have cameras and computers running background checks on every car and driver that passes through.




Encrypted Gmail
An interesting idea in my inbox this morning from David Farber's Interesting People list. What if people start encrypting their Gmail messages? Google's AdWords technology would be worthless, since they couldn't scan the message content for keywords. Suddenly, you get a gig worth of storage for free. And a group could easily open a bunch of accounts, abusing several hundred gigs of space.

Take this a step further. Using open wifi hotspots, a malicious group suddenly has virtually unlimited, anonymous storage space and transfer capabilities. That's not a good thing for Google in the current political climate. It will force them to collect a unique identifier for confirmation purposes. I wouldn't be surprised if the government pressures them into this. Keep an eye on this.


4.27.2004

Hackers Strike Advanced Computing Networks
The Washington Post reports on a recent breach of several university supercomputers. At least they went after something interesting instead of the standard DoS attacks that make the news.