Hiding in the Firmware?

The most interesting feature of the newly-described "Equation Group" attacks has been the ability to hide malware in disk drive firmware. The threat is ghastly: you can wipe the disk and reinstall the operating system, but the modified firmware in the disk controller can reinstall nasties. A common response has been to suggest that firmware shouldn't be modifiable, unless a physical switch is activated. more

New Report About Internet Routing With MANRS

I find myself reading, frequently, about "interesting" exploits of IP routing. Recent history includes the redirection of Telegram traffic to Iran, Google traffic to China, and Cloudflare traffic to Nigeria -- and, per bgpstream.com, 64 events this month, 18 of them on one day. Is this expensive? You bet, both in money and in mindshare. Imagine the impact of discovering your company's name in the press. more

Red Tape Set to Snuff Out Online Identity of Wales

Wales, a small Celtic country that has proudly withstood the depredations of Anglo-Saxons, Normans, and tourists, which has given the world everything from an enduring mythology to the world's longest single-world domain name, has been informed that they will not be allowed to proceed with .CYM (short for the Welsh name for Wales, Cymru) because that three-letter code is already claimed by the Cayman Islands. more

How to Donate Safely to Charity

Please share this post. After a tragedy, many of us want to donate to funds and charities to show our support for a community. However, scam charities immediately pop up, looking to steal your well intentioned donations. There are at least 30 newly-registered domains over the past 48 hours related to the tragic shootings at the Sandy Hook elementary school in Connecticut: Most, if not all are scams and rip-offs. How then, to donate so that your funds make it to the deserving victims? more

In Which We Explore the Federal Laws that Apply to Cyberstalking

Tragedies frequently result in flurries of legal activity. Last years witnessed the Myspace tragedy in which a 13 year old girl committing suicide. Unfortunately stalking laws have been clumsy tools that are difficult if not impossible for law enforcement officials to wield. Where existing laws respond poorly to tragedies, the option behind Door Number One is to enact a new law, and the option behind Door Number Two is to argue for a reinterpretation of current law that would somehow miraculously shoehorn the tragedy into the law. Unlike game shows, legal contestants can pick both doors -- which is what happened in this case. more

The Great Inevitable: From Broadband Internet to Cloud Application Access

Some inevitable changes are hard to see in prospect, yet are 'obvious' in retrospect. The next communications revolution is 'made for cloud' access. A colleague pointed me to a Forbes article "For Today's Telecoms Companies, Customer Experience Is Just As Important As Download Speeds". It was written by Huawei's global president of assurance and managed services. Well, I told you so! more

Digital Geneva Convention: Multilateral Treaty, Multistakeholder Implementation

Microsoft's call for a Digital Geneva Convention, outlined in Smith's blog post, has attracted the attention of the digital policy community. Only two years ago, it would have been unthinkable for an Internet company to invite governments to adopt a digital convention. Microsoft has crossed this Rubicon in global digital politics by proposing a Digital Geneva Convention which should 'commit governments to avoiding cyber-attacks that target the private sector or critical infrastructure or the use of hacking to steal intellectual property'. more

Australia’s Gigabit: Cheapest Upgrade in History

Australian Minister Stephen Conroy announced the National Broadband Network would offer speeds of 1 gigabit without spending a penny more of capex. Sounds like the usual politician's promise. The NBN is a huge issue in the election in 8 days. The opposition wants to kill the $43B project as too expensive; the government warns that a vote against them will condemn Australians to a second rate Internet for a decade or more. Both are right. more

Accidentally Importing Censorship

With advancements in hardware and software, sophisticated filtering technologies are increasingly being applied to restrict access to the Internet. This happens at the level of both governments and corporations. .. given the open nature of the trust-based Internet, one country's restrictions, if not handled very carefully, can easily foul the global Internet nest we all live in. This blog is about one such story of Internet restrictions in China becoming visible (seemingly at random) from other parts of the world and going undetected for 3 weeks. more

X-Force Report: Corporations Becoming No. 1 Security Threat to Their Own Customers

With the alarming increase in cyberattacks, criminals are literally turning businesses against their own customers in order to steal consumer's personal data, warns the latest annual X-Force Trend and Risk report from IBM. "The security industry puts a lot of effort into the technical evaluation of security threats, examining, sometimes at great length, the potential threat that each issue might present to corporations and consumers. Criminal attackers out for profit, however, have considerations that the security industry does not always take into account, such as monetization cost and overall profitability." more

The Supreme Court Decides that Compatible Software is Still Legal

Back in the 1980s, everyone used the Lotus 1-2-3 spreadsheet on their PCs. In 1989, Borland released a competitor, Quattro Pro. It used the same menu commands as 1-2-3 so that users could import their 1-2-3 spreadsheets with keyboard macros. Lotus sued Borland, and after a loss in the district court, Borland won on appeal, arguing that the keyboard commands are a "method of operation" and not subject to copyright. Lotus appealed to the Supreme Court... more

Internet Society’s New Policy Brief Series Provides Concise Information On Critical Internet Issues

Have you ever wanted to quickly find out information on key Internet policy issues from an Internet Society perspective? Have you wished you could more easily understand topics such as net neutrality or Internet privacy? This year, the Internet Society has taken on a number of initiatives to help fill a need identified by our community to make Internet Governance easier to understand and to have more information available that can be used to inform policymakers and other stakeholders about key Internet issues. more

Email Vendors: Time to Build in DMARC

DMARC is extremely useful, yet I've heard some vendors are putting their implementations on hold because of the IETF DMARC working group. You really shouldn't wait though -- it's been in wide use for nearly three years, enterprises are looking at DMARC for B2B traffic, and the working group charter is limited in it's scope for changes. Let's compare this to a similar situation in the past. more

Domain Name Registry and Registrar Separation Now Probably Going to Be a Policy Debate

Again on the subject of new Top-Level Domains (TLDs) ... One of the "issues" that concerned a number of people is the concept of "vertical separation". The basic idea is that domain name registries and registrars should be kept separate. While that is a wonderful Utopian ideal, the reality is that in the real world companies own other companies, people trade in stocks and shares etc., etc. So it's far from being a simple "cut and dried" situation. more

Obstacles in OneWeb’s Negotiations with Russia

This case illustrates the fact that political, security, and financial negotiations may be as difficult as designing satellites and rockets for a would-be global Internet service provider. OneWeb is investing billions of dollars in a constellation of low-Earth orbit (LEO) Internet-service satellites. In 2015 they placed launch orders for 21 Russian-made Soyuz rockets. more