Virgil was there two years ago when Dmitri Sklyarov was arrested and led away in handcuffs at Def Con 9. He's not in handcuffs now, but in speaking to me, he had to stop and think about everything he said, and every third answer was "I really shouldn't talk about that."
The DMCA is largely to thank for that. Section 1201 states that no one "shall circumvent a technological measure that effectively controls access to a work," and that no one "shall... offer to the public... any technology" to do so. Blackboard Inc., whose card system is called the Blackboard Transaction System and known to end users under various names, uses a network of card readers and a central server, and they communicate over RS-485 and Internet Protocol -- using, or so they apparently claim, measures that effectively control access.
For the record, none of what I learned about the Blackboard technology was from him or Acidus after the restraining order was sent. I spoke to other people, who have not been served with a restraining order. Google has a less enlightening mirror of the slide titles from this weekend's PowerPoint presentation and a more enlightening mirror of Acidus's "CampusWide FAQ" from last July. And, most enlightening of all, this mirror has an updated version with details on what they figured out how to do and what their talk was going to be about (click "CampusWide" for the text description, the PowerPoint slides, and Acidus's timeline of the last year).
At many schools, Blackboard's system is the ID: you swipe your card for your meal plan at the cafeteria, to get into your dorm, maybe even to get your final exam.
A swipe at a vending machine will get you a soda -- a money transaction from your campus debit account. When you use a swipe to do laundry and make copies, money has to be involved. Blackboard even notes that they can set up a merchant network on- and off-campus: "a cashless, safe, and secure way to transact on and around campus while offering parents the assurance that their funds will be spent within a university-approved network." (Emphasis added. Maybe readers who go to schools that use such a system can expand on how that system is used.)
The kicker, of course, is that this network is not very secure, or at least Blackboard doesn't think it's as secure as... well, as lawyers. One anonymous Slashdot submitter wrote that: "The authentication system is so weak that [Virgil and Acidus] have been able to create a drop in replacement for the CampusWide network debit card readers used on coke machines on campus."
Virgil couldn't provide me any details about what he had learned about the system. Based on the mirrors, it looks like a man-in-the-middle replay attack -- which is a pretty simple attack, repeating messages sniffed over the RS-485 protocol, or even over IP -- can have effects like convincing a Coke machine to dispense free product. Or, it's claimed, the attacker can create a temporary card, with no name attached, and free money in its account. Hmmmmm.
Or, more ominously, someone else's identification might be sniffed, and then replayed from a security terminal. If a thief gained entrance to a building by sending the message "open the door, my name is John Doe," the real John Doe might be sorely inconvenienced the next morning.
So, if you're a student at a school that uses Blackboard, do you feel more secure now that the DMCA has tried to stop you from learning about its security flaws?
If you're a parent putting money into a Blackboard-based debit account, do you feel more confident of its safety now that this information is ostensibly hidden?
This card system has been installed on many campuses and its roots go back almost twenty years. My guess is that replacing the card-reading hardware would be necessary to improve the security of these devices. Obviously, Blackboard would be hard-pressed to replace thousands of hardware devices at all its locations, even if they'd started in late 2001 when Acidus claims he called to tell them of the flaws he'd found (and "was blown off").
So, assuming that's not possible -- is the DMCA a viable tool to ensure security?
P.S. Virgil tells me that he has a good lawyer. They are scheduled to argue on Thursday that the restraining order not be made permanent. Slashdot will keep you apprised of what happens in our Slashback stories... stay tuned.
P.P.S. Update: 04/15 02:30 GMT by J : Now online are the restraining order, which just lists the six things that Acidus and Virgil are not to do, and the more detailed Complaint. Now that these are available, as Declan McCullagh points out, it turns out the DMCA was only in the lawyers' threatening letter and not considered as part of the Complaint itself. I'm not sure why it would be included in the letter -- some of the language of the Georgia Computer Systems Protection Act is similar, and who knows, Section 1201 might be mentioned later on, as this case progresses. Maybe the lawyers are just keeping their options open. Meanwhile, I love this part of the Complaint:
"Mr. Hoffman openly acknowledges on his website that 'I am a hacker.' His website then defends the process of hacking. See Exhibit B."
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.
Remember, Citizens (Score:5, Funny)
Re:No, it doesn't. (Score:5, Insightful)
Parent
Re:No, it doesn't. (Score:5, Insightful)
Parent
Re:No, it doesn't. (Score:5, Insightful)
Interesting, isn't it, in these days of terrorism paranoia, that laws like this ARE going to result in worse security ? Well worse security for the USA, relative to every other country in the world that doesn't (yet) have these sort of laws.
Parent
Duh... (Score:5, Insightful)
Re:*cough* Clueless *cough* (Score:5, Insightful)
Parent
Re:*cough* Clueless *cough* (Score:5, Insightful)
That's when they Cease and Desisted him, and told him that the burning theater was their little secret.
Personally, I'd wanna know, but hey, I'm obviously not normal. Stay asleep if you want, everybody. It's still a free country - but you better check back with me tomorrow just in case.
----
www.whatreallyhappened.com is interesting.
Parent
Re:Duh... (Score:5, Insightful)
Parent
well (Score:5, Insightful)
If a default remote control, garage door opener, et al provided the features the consumers
I don't know if anyone else saw the >article [securityfocus.com] [securityfocus.com] about the student doing steganography work for his PhD - he's moving all his work offshore because he resides in Michigan and the super-dmca may make 'his whole academic career illegal' - depressing.
Re:well (Score:5, Interesting)
Yes, the possibility with getting slapped with a huge lawsuit and/or criminal charges is pretty scary. Somewhat scarier, on the other hand, is a society where people comply with the demands of other people even though those other people aren't really authorities at all.
Police states are pretty bad. Worse, IMHO, is a people governed by the Will of f*cking Landru...
Parent
Another BS Govt Move (Score:5, Funny)
The sky is Blue!!
DMCA Official " You must cease to call the sky blue, as it is in violation of what we have said before that the sky is infact not there"
Ostrich tactics (Score:5, Funny)
Of course not...the DMCA is a tool that allows companies to safely keep their heads in the sand. Here on Planet Earth, wrapping a towel around your head doesn't *really* make the Ravenous Bug-blatter Beast of Traal go away.
I know a little about this... (Score:5, Interesting)
Re:I know a little about this... (Score:5, Informative)
Parent
obviously not (Score:5, Informative)
Here's [bbc.co.uk] an article from the BBC [bbc.co.uk].
and here's a good presentation [treachery.net] from toorcon.
and lastly, this [itworld.com] is a good article from ITWorld.
Companies hurting themselves (Score:5, Insightful)
A much better plan would of been to let these guys give their talk, to hire them, fix the problems, and them make a bundle in upgrades to existing customers. Come on, if some of these installations are 20 years old we're not talking much more then maintenance revenue. On the other hand system upgrades, especially when demanded by parents, can net a pretty penny. The colleges could have fund drives, hit up alumni societies, all the normal ways to get money when something unexpected walks through the door.
Instead the company gets to look like a fool that knows there are security flaws, aren't fixing them and instead are wasting money on laywers, get getting bad press.
Oh well, I guess there is no such thing as bad press. And that companies would rather think about prestige short term then a better product long term, even if the better product will get them more money.
=Blue(23)
it's over (Score:5, Interesting)
I can see the writing on the wall just as easily as anyone else. The joy that I got out of these marvelous toys just isn't worth it anymore. It used to be liberating, now it's just torturous. I can think of dozens of ways to get thrown in prison just by playing around with my system at night after work. Tinkering and exploring are forbidden. I'd rather be an insurance guy or something similarly boring then spending part of my life in a 4x6 cell, or even living in fear of same.
Just proof once again that anytime government gets involved with anything, it sucks all the fun out of it. All in the name of equity and greater corporate profits.
Is this the most correct channel? (Score:5, Interesting)
As my good old Uncle Scrooge always said: Work Smarrrrrterrrr not harrrrrderrrrr
Stupid. Typical. (Score:5, Insightful)
If hacking is outlawed (and talking about it), only outlaws will know how to hack.
So who do you get to sue if someone makes a dupe of your ID card and raids your campus debit account, or breaks into your dorm room? The school? The hacker? The company that sold the school the lame ID system they claim is secure but is not?
I would think the schools would like to know why sodas, meals, etc. are disappearing from their supplies. Hmmm.... This Coke machine is empty, but only 5 Cokes were recorded to be bought from it. Hmmm...
This is the worst kind of security through obscurity.
- Jasen.
my experience with it... (Score:5, Interesting)
It does offer some advantages, for instance, all people could be allowed into the dorms at some parts of the day, but other times of the day only people who live in that dorm could gain entry.
Though there are some interesting caveats
*the first one, which I didn't really know well at the time, is the fact that making a copy of the card is far easier than making a copy of the key. Remagnetizing magnetic stripes is not the hardest thing in the world.
*the campuswide system runs off of ethernet to the AT&T9000 computer which administers everything. If a particular door gets disconnected with the central computer, it's default setting is to pretend like everything is normal, and let everyone in, and it has a cache of swipes which it would then transmit back to the central computer when the connection was restored. That seems like a sensible kludge given the circumstances, given a network failure it would be more sensible to allow all in as opposed to all out, especially at a dorm. (Higher security places would have their door failure mode set to allow no one.) On the other hand, as a security concept, it just bugged me. (this is explained in the powerpoint presentations.)
*my big concern at the time was the tracking and auditing abilities, and it still is. the key system had no tracking and auditing. The swipe system allowed the university to keep a record of when students come into the building (and implicitly, when they go.) I pointed out that Ohio law prohibited a government institution from collecting information which were not authorized by law, nor required to achieve a particular purpose...and that the system need not perform the tracking, it only needed to perform the authorization.
The response I got was that the system was not designed with a zero tracking/auditing setting, it needed to perform tracking and auditing as part of its authentication mechanism. I pointed out that I can't help that the university bought a dumbass product, and I threatened to sue them, but I was young, and I threatened to sue everyone.
I got a letter from the university lawyers saying "While we ourselves certainly hope never to need the archived data -- and, fortunately, rarely do -- it can be of unquestionable value in
investigating incidents in the residence halls. It is for this very reason that similar systems are in use at numerous colleges and universities
around the country."
I've however pointed out that any idiot who was gonna do something in the dorms would do what everyone else does, and that is follow someone who swiped before you, and not swipe themselves.
I still hope to work on this issue at some point.
I have a OneCard (Score:5, Informative)
There are various machines around that let you deposit money onto your OneCard, but there is no "university-approved network" of stores that accept the OneCard as payment.
The OneCard is primarily used for borrowing books from the library, and for operating the photocopiers/printers on campus, and there is exactly one vending machine on campus that allows you to pay with your OneCard.
As for people living in residence who have meal plans (like me), there's a separate card for that, provided by Aramark [aramark.com]. To get into our dorms, we have keys. Laundry is coin-operated. The OneCard has absolutely nothing to do with the on-campus residences.
For most finals and midterms, we're required to show our onecards and/or driver's licenses as photo ID, but the OneCards aren't swiped through a card reader or anything, it's just photo ID, nothing more.
There are restricted areas on campus that you can access by swiping your OneCard and punching in a secret code, but as a first year undergrad, I don't have access to any of those places so I can't say what it's like (though for most of the places that aren't top-secret nuclear research facilities, it's almost trivially easy to get in by walking in when somebody else walks out -- we're friendly here in Canada, generally we hold the door open for people we don't know).
So, if you're a student at a school that uses Blackboard, do you feel more secure now that the DMCA has tried to stop you from learning about its security flaws?
Gee, I dunno. This is Canada, there is no DMCA here (as far as I know, anyway). Hopefully some Canadian security researcher will hear about this, and continue the research here...
DMCA=Gun Control=Thought Control (Score:5, Insightful)
Instead of fixing the exploit in their keycard system, the company in question finds it easier to have their lawyers drop a house on the students.
Doesn't "Security through Obscurity" create an environment where persons with malicious intent are free to exercise it?
The students discovering the security hole = The Good Guys. The knowledge they posses equal a Munition (or, a firearm.) They were not planning to use their knowledge maliciously.
Essentially the DMCA has turned knowledge into a weapon to be regulated through the legal system. Just be careful what you know, because speaking of it publicly is becoming the 21st century equivalent of pulling a gun out of your pocket at the mall to discuss it's function with another gun enthusiast.
Of course, we all know the gun paradox. Seriously. Increasingly orwellian gun laws !=less crime. Criminals will always find weapons. On the electronic mean streats, crackers & hackers will always find exploits, but unlike the Good Guys, the Bad Guys won't go to a symposium to divulge the PROBLEM, embarassing the company into FIXING IT. Instead, the Bad Guys will EXPLOIT the FUCK OUT OF IT.
I'm not a philosopher, psychologist, ethicist or sociologist by profession, but perhaps the DMCA needs to be re-evaluated by a panel consisting of a few. Right now it seems to favor only the government and very, very large corporations. Oh, and it makes learning a criminal act.
Do you have a permit for your mind?
Trade secrets and the Economic Espionage Act (Score:5, Informative)
Trade secrets used to be frowned upon by the law. Patents were legally preferable, so that when the patent expired, the knowledge went into the public domain. A trade secret could be lost easily; any publication by anybody erased trade secret status. All trade secret law really did was to put some teeth into confidentiality requirements for employees. It didn't affect outsiders.
All that has changed in the last decade. Between the Economic Espionage Act, the DMCA, and several court rulings, trade secrets now look more like property rights.
DMCA how? (Score:5, Interesting)
If it's something within the school, then the makers of the system wouldn't really have a DMCA complaint against researchers; the school (user of the blackboard product) would. (Just as MPAA, not DVDCCA, are the ones who had DMCA complaints when knowledge of bypassing CSS got out. It's the copyright holder of content who gets to use DMCA, not the inventor of a protection mechanism.)
Assuming the blackboard lawyers actually see a way to use DMCA and aren't just trying to intimidate (hell of an assumption), then the copyrighed content must be some artistic expression within the Blackboard system itself, rather than something the system is intended to protect.
If the copyrighted expression turns out to just be the serial number on a card, or something like that, then that would be very (*cough*) interesting.
Patent your exploits (Score:5, Funny)
Then you have precedence for publishing them, or you just point to the online patent info.
As a bonus, you can sue the companies that fix the holes you're supporting because they've broken that "shall circumvent a technological measure that effectively controls access to a work" line. After all, your exploit controls access, right? Opening a door is controlling access as much as locking it is.
free printing (Score:5, Interesting)
People also spent time sniffing the one card network, but as far as I know no one had found anything interesting yet. this was 4 years ago, so I'd assume the entire thing is solved by now.
embarassment & consequences (Score:5, Insightful)
As a security professional, the fact that any cheeseball company can successfully hide their shoddy product behind a federal law is an embarassment. It induces even more cognitive dissonance when I work with federal and state goverment security staff who are well aware of good security principles, and then think about laws such as the DMCA which are diametrically opposed to known-good principles of improving security technology and processes.
It's a lose-lose proposition: News of an exploit always gets out, and is propogated fastest within the community which has little fear of the DMCA. But invocation of the DMCA causes relatively-innocent people -- those that were willing to stand up and state their names -- to tremble and retreat. As I said: it's wrong, immoral, and ultimately ineffectual. I spend my days educating people about the dangers of security by obscurity, and exposing the risks associated with snake-oil solutions such as Blackboard's "secure" transactions. I'm doing my part to educate as many people as I can, but with Grand Moff Ashcroft at the legal helm of the country (and with US federal/foreign policy changed to match the prosecutorial principles of "pre-crime"), I'm afraid it's like spitting into the Mojave.
The first time that some predator clones the card of a victim (or a patsy) in order to gain access to a building and rape/murder someone, I wonder... Will the appropriate law enforcement be able to effectively investigate/prosecute such a crime if the computing research community is prohibited from supporting them? Would Blackboard be content to sit on known security flaws and let a patsy get convicted? Again: wrong, immoral, and ultimately ineffectual. It ought to be illegal to *withhold* security flaws, at least from those who depend on/are subject to them. Feh.
J
Re:I say publish all the details overseas (Score:5, Insightful)
Parent
Re:I say publish all the details overseas (Score:5, Funny)
Ah, I've often shouted "POST IT ON USENET!" at the television screen whenever there's a movie or x-files/whatever episode where the hero is running away with the evidence/HotInfo trying to keep it from the Evil Conspirators.
They almost never do.
Parent
Re:I say publish all the details overseas (Score:5, Insightful)
Parent
Re:I say publish all the details overseas (Score:5, Insightful)
Parent
Re:I say publish all the details overseas (Score:5, Interesting)
Parent
Re:I say publish all the details overseas (Score:5, Interesting)
A guy figured out how to manipulate the chip on the smart cards used for credit cards. He contacted whatever company makes the cards to try to get them to hire him. They didn't believe him, so to prove his point he bought about $7.00 worth of metro tickets from an automatic distributor.
And then what?
They busted his ass big time. I think it totally destroyed the guy's career, life, etc. Then the company upgraded their encryption...
Parent
Re:I say publish all the details overseas (Score:5, Funny)
Yeah, I wish we had some sort of global communication network where you could instantly and anonymously post a piece of information, and people anywhere in the world could see it. Wouldn't that totally rock?
Parent
Hey! (Score:5, Funny)
Come *on*, someone toss a practical exploit in here!
--grendel drago
Parent
Re:Hey! (Score:5, Funny)
To: mkldev
Subject: Cease and desist
Sir/Madam,
Due to your recent post on the 'news' site 'Slashdot', we issue this cease and desist hereby ordering you to refrain from describing any manner of breaking security methods for refreshment beverage machines. Your suggestion of "...first you take a crowbar..." is in violation of the Digital Millenium Copyright Act.
or something like that
Parent
Re:I say publish all the details overseas (Score:5, Insightful)
It is sad to see that the DMCA can be used by a company if it wishes to ignore flaws. It is a sad day knowing that profit is more important than a good product.
Parent
Can you say 'Ford Pinto'? I knew you could! (Score:5, Insightful)
Does it bother anyone else that copyright violations are given more attention than violent crime? Why can't the same reasoning the vilifies P2P networks since they "could" be used for illegal copies be applied to manufactures of Dum-Dum bullets, Assault rifles, etc.?
Before rants go off-topic both ways, I'm trying to point out the absurdity of the anti-copyright measures when compared with how other crimes against individuals and not corporations are treated. Laws are being crafted that protect corporations, at the expense of individual rights. My right to not get shot should be a lot more important than a corporations right to make money
(For the record, I'm not against guns in principle - I'll eat hunted meat, etc. I just don't think you can get a good set of steaks if you hunt with an assault rifle, nor is it really sporting, so I don't see why normal people need them. And in today's world the 'standing militia' argument no longer holds - if our armed forces can't hold off an invasion, we're pretty much boned. You'd have to have lots of forces to be able to get a supply chain for more ammo, and if I remember correctly WWI proved you can't really hold the ground without air superiority, so you'd better build an air strip as well.)
Parent
Re:Can you say 'Ford Pinto'? I knew you could! (Score:5, Insightful)
Sure, that might not happen, a lot of things might not happen; but it's silly to simply throw away one of the most important checks that individual citizens have on the federal government's power, just because there are some idiots out there who are mentally incapable of possessing a weapon without doing harm to innocent third parties.
By eliminating the right of individual citizens to bear the same firearms that soldiers do, you save a few lives in the short run, and you set us up for a bloody revolution in the long run, when the government decides it's had enough of that "freedom" thing.
Parent
I say DON'T publish the details AT ALL! (Score:5, Insightful)
Just announce that the product has a MAJOR and EASILY EXPLOITABLE security flaw. Then absolutely _refuse_ to give any details on it to the company. Cite fear of the DMCA [and numerous examples] of its enforcement as your reasoning. (+5th amendment)
Watch their stock take a pounding, and see if they don't fix it themselves. Then they will have to hope you come out and say they fixed it.
Parent
Re:I say DON'T publish the details AT ALL! (Score:5, Interesting)
My solution is pick one university, find a specific solution, and have about 1000 people get free cokes, free lunches, free access, all on one particular day only. Create a financial incentive, but more importantly a social incentive to open up the conversation.
I am NOT a big fan of breaking the law purely for protest means. (see my many other posts on this subject) However, considering the DMCA itself is a violation of free speech, it may be warranted. Not to rip off large amounts of money, or do serious damage, just nickel and dimed for ONE day where it is OBVIOUS that it is a security breach that can not be overlooked. Then do what you suggested, say you can't tell them how it was done due to DMCA. ('you' being someone who didn't participate but knows how it was done)
Parent
What a strange filename (Score:5, Interesting)
Parent
Re:What a strange filename (Score:5, Interesting)
Parent
Re:God this world blows... (Score:5, Funny)
Hey, don't blame me. I set you up in a nice garden, and you had to listen to that stupid snake.
-----
g0d
Parent
Re:God this world blows... (Score:5, Insightful)
Every year more money is spent on political campaigns in the USA. Money, in other words, is an essential requirement for securing election in the USA. The result? Well, look at the percentage of millionaires in Congress versus the general population (http://www.opensecrets.org/pubs/law_wp/wealth06.
So, what can we expect the actions of power driven and facilitated by wealth to do? We can expect it to act on behalf of the wealthy and the systems that support them. So why should we experience any surprise when this is exactly what happens?
The DMCA, for example, represents a simple transaction in this political economy. Intellectual property creates value. Value can be converted into money. The more control people are able to exert over intellectual property, the less it's potential value can be harnessed by its owners to create wealth. It may be true that further restriction of access to intellectual property may impair the absolute value that can be derived from a given pool intellectual property. To those who value intellectual property solely or primarily for the wealth it can generate, this is immaterial. So, the groups that represent the greatest centralized pools of wealth generated by intellectual property transact some of that wealth into political power (by supporting representatives directly and by buying the louder voice on capital hill through lobbyists, by controlling large parts of the media and keeping the issue a non-story in most conventional news outlets, etc.). So, the legislation is passed, and these are the consequences.
In a rational economic system, the bottom line for a product like Blackboard's swipe cards would be how well they work and security would be part of that. But Blackboard isn't going to think that way - they are thinking about covering their asses and squeezing as much money out of their property as they can and security be damned.
Without appropriate protections and controls in place to level the playing field where money is concerned, in a context where wealth and power are more and more easily interchanged, it's easy to see that the worse it gets the worse it will get, becuase the very systems we expect to protect us from the undue influence of wealth are themselves increasingly corrupted by wealth, and like a compromised immune system, the more those sytems are corrupted the more curruptible they become.
As long as people accept the side a/side b black and white polarized view they are provided by the respective representatives of sides a and b - that is to say, as long as the primary beneficiaries of the current system are allowed to define the dialogue within their own terms - it will never get better. If you're still voting democrat cause you're scared of them war mongering, civil rights destroying, business loving loonies or republican because you're scared of those tax and spend, victim culture gun banning freaks, then you are manifestly part of the problem.
Parent
Re:You Americans should have another civil war.. (Score:5, Insightful)
Just recently there have been proposals to amend the DMCA to add some public rights to the equation. They might go somewhere, they might not, but a stable democracy is dependant on changes NOT happening a breakneck speeds.
Parent
Oh no! Not again! (And again, and again, ...) (Score:5, Interesting)
Probably a couple per week until the damned thing is repealed or struck down.
When will the DMCA start getting some media attention outside of
When there are media outside of
The DMCA strikes down a lot of rights that many people hold near and dear. I don't know about the rest of
Your opinion is widely shared.
Parent
Re:silly response (Score:5, Insightful)
Given solution 2, how about this scenario. While C&D is in force and no one is implementing a fix, all users of the systems still remain vulnerable. Someone else figures out how to fake the ID's, uses said fake to gain access to student's dormroom, and commits serious crime against student. Student's parents sue college, college FREAKS and looks to point a finger, original objects of C&D step forward with evidence that security company was informed of the problem and offered help with a solution. College and student's parents sue security company into non-existence.
Parent
Re:Another way to go about this? (Score:5, Informative)
This is a snippet from Acidus' old website. It relates the timeline of events. I hope you enjoy.
Sorry for posting AC but since this does come from Acidus' website ....
Parent
Re:What about this analogy (Score:5, Informative)
Hope that helps with your question.
Parent