In the Highlands of New Guinea, rival clans have often fought wars lasting decades, in which each killing provokes another.

I haven't read it, but given the author and the subject I'm sure it is interesting.

Annals of Anthropology: Vengeance Is Ours: Reporting & Essays: The New Yorker

So the Bum Bot finally made it on the colbert report. Its good stuff. Check it out.

The Bum Bot on Colbert Report

The government's position is as frightening as it is naíve. A computer is not the same thing as a briefcase. Nor, for that matter, is an iPod, a thumb drive, or a cell phone. It is both quantitatively and qualitatively different, and that makes all of the difference in this case. It seems that the government and the lower court are speaking past, and not at, each other. The government says, "We can do anything for any reason," and the court says, "No, you need reasonable suspicion to search a laptop."

A former federal prosecutor weighs in on the border search decision. (Thanks Dc0de!)

On the Border

I think the authors have demonstrated a powerful tool that could be a useful asset to a vulnerability analyst, but their abstract, and the conclusions they draw, assume solutions to difficult problems that remain unsolved in the open, public security research space.

Xpost

Frequency X Blog: More on Automatic Exploit Generation

Italian wall lizards introduced to a tiny island off the coast of Croatia are evolving in ways that would normally take millions of years to play out, new research shows.

In just a few decades the 5-inch-long (13-centimeter-long) lizards have developed a completely new gut structure, larger heads, and a harder bite, researchers say.

This seems to support the theory that environmental pressure can produce evolutionary adaptation in large organisms over short periods of time. However, this new species could be the result of interbreeding between the two original species, producing a third species that outlasted the prior two...

Lizards Rapidly Evolve After Introduction to Island

The Supreme Court of New Jersey became the first court in the nation yesterday to rule that people have an expectation of privacy when they are online, and law enforcement officials need a grand jury warrant to have access to their private information.

The unanimous seven-member court held that police do have the right to seek a user's private information when investigating a crime involving a computer, but must follow legal procedures. The court said authorities do not have to warn a suspect that they have a grand jury subpoena to obtain the information.

Writing for the court, Chief Justice Stuart Rabner said: "We now hold that citizens have a reasonable expectation of privacy protected by Article I ... of the New Jersey Constitution, in the subscriber information they provide to Internet service providers -- just as New Jersey citizens have a privacy interest in their bank records stored by banks and telephone billing records kept by phone companies."

"This decision reflects the reality of how ordinary people normally use the internet," he said. "'It's very nice to have the court recognize that expectation is reasonable."

This is a great result, but I fear that it is unlikely to become a national standard.

N.J. justices call e-privacy surfers' right

Last week, federal, state, and local police in Tennessee, Mississippi, and Arkansas conducted a massive sweep dubbed "Operation Sudden Impact."

The operation included raids of businesses, homes, and boats; traffic roadblocks; and personal searches. They say they were looking for "terrorists." If they found any, they haven't announced it yet. They did arrest 332 people, 142 of whom they describe as "fugitives." They also issued about 1,300 traffic tickets, and according to one media account, seized "hundreds" of dollars.

...

The FBI along with hundreds of officers said they are looking for anything out of the ordinary. Agents take computers and paperwork from businesses.

"What we have found traditionally is that terrorists are involved in a number of lesser known type crimes," said Mark Luttrell, Shelby County sheriff.

There you have it. All law enforcement is anti-terrorism. The police cannot legally establish "anti-terrorism" roadblocks that essentially serve as forums for random search and seizure.

Tennessee Terrorism Sweep nets traffic violators

Acidus wrote:

In the automatic patch-based exploit generation problem, we are given two versions of the same program P and P' where P' fixes an unknown vulnerability in P. The goal is to generate an exploit for P for the vulnerability fixed in P'. More formally, we are given a safety policy F, and the programs P and P'. The purpose of F is to encode what constitutes an exploit. Our goal is to generate an input x such that F(P(x)) = unsafe, but F(P′(x)) = safe.

... ... !!!

There is something humbling about seeing hours work (reading the Microsoft security bulletin, using IDA and BinDiff, discovering the security changes, performing the needed "magic" like unicode evasion, no null's etc) reduced to a math equation.

This article seems to have stirred up a bit of drama. I finally got time to read it this evening. These people have developed a powerful toolset that can be used to achieve some very interesting results, but I also think that what they've demonstrated here falls far short of what their abstract claims.

Basically, you get the impression that they can take a patch diff, pop it in a black box, and pull a program out the other side that can be used to launch remote code execution attacks. They then go on to assume that attackers can use tools like this to instantly produce exploits from a patch, and discuss the implications of that for patch distribution strategies. But thats not what they've produced.

What they've produced takes a patch diff as well as either input sufficient to reach the vulnerable code, or information about the place in the binary where the specific input values that exploit the vulnerability are read in, and produces permutations of that input which would be rejected by the patched version of the code.

In my view the time spent determining what sort of input can reach the vulnerable code (what inputs not what values of those inputs), and more importantly the time spend actually exploiting the vulnerability to gain unauthorized code execution, contribute more to the time required to produce working exploits from patch diffs than the part of the problem that has been solved by this paper, and so their conclusions about the impact of this result on the time from patch distribution to exploit distribution is not correct.

This tool could be helpful in analyzing vulnerabilities where a great deal of permutation occurs to data before the vulnerable code is reached, but it does not result in automatic generation of anything from patches alone, and it does not generate what I would call an exploit.

The underlying toolset, however, is very interesting. Its basically a computer that reads assembly code. You can program it to answer questions about that code. There are many questions that one could ask about binary code that would be helpful in vulnerability research and analysis beyond those envisioned here. Its a shame that these tools seem to not be available to the public.

RE: Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications

Arnold has failed to distinguish how the search of his laptop and its electronic contents is logically any different from the suspicionless border searches of travelers’ luggage that the Supreme Court and we have allowed.

Its clear that there is a difference. The court may decide that the difference is not constitutionally significant, but it is not helpful for the court to pretend that no difference exists. This is a sort of ignorance that allows the court to reach a comfortable decision without addressing the substantive question...

My rant on today's decision.

Re: The Volokh Conspiracy - Ninth Circuit Allows Suspicionless Computer Searches at the Border:

The Ninth Circuit has (finally) handed down United States v. Arnold; the court ruled that there is no Fourth Amendment requirement of "reasonable suspicion" to search a laptop computer at the border.

This is extremely bad.

The Volokh Conspiracy - Ninth Circuit Allows Suspicionless Computer Searches at the Border: