] The XBOX Dashboard is what appears when you turn the XBOX
] on without a disc in the DVD drive. It will let you
] adjust system settings, manage your save games, play and
] rip audio CDs and configure your XBOX Live account. It is
] the heart of the XBOX and its most vulnerable point,
] because it lacks several security restrictions which are
] enforced on games. This includes the lack of the
] reboot-on-eject-button "feature", which is obligatory for
] all games.

] The existance of an exploitable vulnerability
] within the dashboard could totally compromises the XBOX
] security system. It will make the box independent from
] Microsoft signed code and therefore this information is
] released to the public now on the 4th of July 2003, the
] day of the XBOX Independence.

From the Full Disclosure mailing list.

XBOX Dashboard local vulnerability

] A group of Xbox security researchers say they have found
] a way to run Linux on the Xbox game console without a
] so-called mod chip and will go public with the technique
] if Microsoft won't talk to them about releasing an
] official Linux boot loader.

] Muir says the release of the claimed series of exploits,
] one of which is in the Xbox Dashboard utility, factory-
] installed on the Xbox hard drive, could be disastrous for
] games companies intent on preventing piracy. If genuine,
] the exploits would let anyone with even a slight technical
] knowledge "reflash" the Xbox BIOS, allowing users to
] pirate games. The only hardware modification necessary is
] a dollop of solder on the write-enable pads on the
] motherboard.

Very interesting..

This is a nightmare situation for Microsoft. If they do nothing, exploits will be released enabling mass-piracy of their games. If they release a Linux bootloader, then they have allowed Linux onto their platform. They sell these consoles at below cost and make their money on games. Razors and blades. From an economic standpoint, either presented option is totally unacceptable.

Also, if Microsoft plays along, there is no guarantee that the exploits will not get released, or more likely, discovered by others.. Infact, I believe they are only being baited, and these exploits will be released anyway. I can't envision Microsoft giving into any demands, of any type, let alone a signed linux bootloader for the XBox..

Expect Microsoft to create a third option. Expect lawsuits. Expect someone to get arrested. The DMCA will play an obvious role. I could see them attacking Huang just for drill.. This will be a developing story..

Group claims Linux advance on Xbox | CNET News.com

The size of the IP6 address space makes scanning for victim computers in a properly managed network as difficult as a brute force attack on an encryption system. Of course, it also makes scanning your own network for backdoors and trojans just as difficult. Furthermore, crackers are using IPv6 to encapsulate traffic, hiding it from intrusion detection systems.

This is a fun paper if you are into network security.

Security Implications of IPv6 - Mike Warfield

This scheme allows Alice to ask Bob if Bob is a warez site, but if it turns out that Bob is the RIAA he cannot prove that Alice asked for warez, and if it turns out that Alice is the RIAA she cannot prove that Bob is a warez site.

Secret Handshakes from Pairing-Based Key Agreements

] Microsoft released a plug-in for Internet Explorer that
] is designed to protect sensitive documents from
] unauthorized editing or copying--an early step in its
] effort to encourage corporations to use its software to
] share sensitive information.
]
] The Rights Management Add-on, available in a beta, or
] test version, allows permitted users to view files, the
] company said. The Web browser plug-in is meant to help
] companies protect sensitive documents, e-mail and other
] Web-based data from being manipulated, forwarded or
] copied by unauthorized individuals.

IE beta plugs document leaks | CNET News.com

] I fully expected ISS to respond with a "we have
] identified the administrator that failed to patch the
] system in question, and have forced him to drink
] buttermilk while watching home movies of Janet Reno in a
] leather teddy. We are confident that this will not happen
] again."
]
] But they didn't.
]
] Instead, ISS revealed that the hacked site, the one from
] which students and universities around the world
] downloaded free versions of BlackICE to protect
] themselves from hackers, was in reality a cleverly
] disguised, purposefully vulnerable honeypot,
] strategically placed in this hostile environment to
] collect and analyze the actions of evil hackers.

The Register | 'Relax, It Was a Honeypot'

] North Korea is training around 100 computer hackers each
] year to boost its cyber-warfare capabilities, pushing the
] South to fortify its own computer security, a South
] Korean military official said on Friday.

The main reason this seems offbase to me is the "100 hackers each year" thing. I have a feeling tracking down 100 computers in North Korea is a hell of a challenge, let alone 100 hax0rs with clue. Not to mention a decent net connection for them to search out tools over, keep up to date on discovered sploits, etc.. The thing that is going to make a cracker a danger isn't a set selection of skills that the other 99 also have, but rather the ability to think on their feet and learn on the fly.. That takes time and experience. I see this situation being very hard to cultivate, as it would require their cracker-corps to be constantally working on their skills, finding new sploits, etc.. It would require access to many of the devices/software they are interested in hacking, which is going to be nearly impossible for them.. I immagine the resources for this all are very slim..

That number also leads to believe that their intent is not to have their hacker-corps working out of North Korea, but rather send them out of the country and have them work elsewhere. North Korea proper would likely be very easy to cut off from the rest of the world in the event of a conflict, rendering their hacker teams useless.. They would have to be stationed in many places outside North Korea to be useful.

Now, if North Korea had crackers spread out all over the globe, working toegether to form some l33t North Korea cracker-corps, this might be logical.. Otherwise, its very unlikely to exist, or be a real danger. Of course, that also implies that North Korea has their shit together, something I don't think is likely. Its more likely that they have 100 people in North Korea who are being called "hackers" and being "trained on hacking", even though most of them have never actually used a real computer for more then 5 min.

This is probably another case of North Korea trying to give the impression to South Korea (and everyone else) it is more dangerous then it actually is.. They have 4 skilled and loyal hax0r kiddies, and somehow it became "100 every year".. Don't they have 300 nukes aimed at the US right now? Heh. Two or three maybe. (And more on the way, but that's another story..)

There is also another option.. North Korea has zero to do with this, and South Korea is just trying too pump up some fear in order to get its people to take computer security more seriously.. Slammer did really take them for a spin. They have reason to be concerned.

CNN.com - N. Korean training hackers, Seoul says - May. 16, 2003

] Chilling details of al Qaeda's secret communications
] system - and the possibility of widespread knowledge that
] the devastating attacks on New York and Washington were
] in the works - were unveiled in a courtroom in Milan,
] where a group of Islamic militants are on trial for
] supporting al Qaeda's terrorist activities.
]
] According to reports in the Corriere della Sera newspaper
] and on ABC News' Web site, the secret communications were
] discovered during a November 2001 raid on the Via
] Quaranta mosque in Milan, where police confiscated 11
] computers.

] Investigators believe cell members were using a process
] called stenography, in which special software allows a
] text message to be hidden inside a small part of a
] computer photograph.

NYPOST.COM World News: 9/11 PLOT HIDDEN IN E-PORN By NILES LATHEM

] A vulnerability identified in a library included in
] Windows XP and Internet Explorer version 4.0 and newer
] can be exploited to cause a DoS (Denial of Service) on
] certain applications.
]
] The vulnerability is caused due to a NULL pointer
] dereference bug in Microsoft Shell Light-Weight Utility
] Library ("shlwapi.dll"). A malicious person can exploit
] the vulnerability by constructing a special HTML
] document, which will crash applications using the
] vulnerable library.
]
] An example was provided in the original advisory:
]
] <html>
] <form>
] <input type crash>
] </form>
] </html>

Bahaha! Trustworthy Computing... Bahahaha!!

Secunia - Advisories - Microsoft Browser Fall Down Go Boom 5 Line HTML Funfun

Now here is the challenge to you, how about writing an article which
addresses the facts.

Snagged from the SE2600 mailing list.

Harvard Crimson | Swipe Card Hack Prompts Complaint