Slashdot Mirror
Security Flaws In Aussie Net Filter Exposed
Faldo writes "There's a three-part interview with a computer security expert on BanThisURL that goes into the flaws in the Aussie net filtering scheme. In addition to SSH tunnels and proxies, more worrying problems like trojaning the boxes to set up man in the middle attacks (which the interviewee has done in his lab), cross site scripting and the Australian blacklist leaking are all discussed. Worrying and relevant, especially since Thailand's blacklist has just been leaked."
The concept itself is flawed. Centralized filters will never work, and any filtering system is imperfect. The best we can do is have individuals ascribe a reputation to a particular resource and based on trusting others' ratings we can tailor the firehose to our liking.
Anything else is just a way for some fearmongers to stay in office and/or make a quick buck.
Disagree, they could just use a Windows box for this, as long as they keep it up-to-date with patches they'll be fine, right?
Once I was a four stone apology. Now I am two separate gorillas.
...it will only serve to piss off those that can't circumvent the firewall (or unskippable anti-piracy adverts in the case of legit DVDs)
To do something right, you often have to roll up your sleeves and get busy.
that things are unhackable.
"If you code it, it will be hacked!"
The Titanic was an example of what should be called Cockyisms. (The beliefe that one is better or their product is better than it truly is.) in this case, Unsinkable...and we all know how THAT turned out!
DVD encryption, DRM and now Net Censorship...the tighter the grip, the faster they will lose control.
So Jesus, Mohammed and Abraham walk into a Bar....
An amazing story would be "NO SECURITY FLAWS IN AUSSIE NET FILTER WHATSOEVER". I'm just sayin'. There are flaws in everything.
We figured out a long time ago that it's easier to elect seven judges than to elect 132 legislators.
The Australian government seems to have gone pretty crazy over this thing, and is taking one of the classic paths when meeting resistance; that is to make the plan even bolder and more sweeping. There seems no recognition of the fact that this won't do a damned thing to prevent the production and distribution of child pornography, but will cause no end of problems for legitimate users. But this government clearly feels it's back is against the wall, and rather than simply taking the more sensible path and admitting that filtering is flawed, and in its own way dangerous, and that any attempt to screw with various P2P and secure protocols is going to real harm to legitimate users, is basically saying "We know better than the ISPs and technical experts."
Politics tends to attract the insanely vain, but these guys are way out to lunch. I have no idea who their technical advisers are, but either these guys are morons or simply being paid to tell the government what it wants to here.
But as anyone who has dealt with any kind of Internet security can tell you, it's always a game of catch-up. Whether it's viruses, root kits, DRM, firewalls, and so on, there's always someone willing, for good or ill, to crack systems, and believe me, if they actually go through with this nonsense, the desire to crack the filters, and more dangerous and delerious attempts to bust encryption and P2P is simply going to be met with better innovations to overcome them.
But it does go to show you that the intellectual tyrannies are not simply the product of political tyrannies, but any government so sure in its own righteousness can play the part of the tyrant, simply by repeating the mantra "it's for their own good".
The Enlightenment has died in Australia, and it's sad that the people aren't marching on Adelaide demanding the government's resignation and Rudd's forced expulsion. Western Civilization has lost its balls. We've fought world wars, sacrificed our young on countless battlefields, beat back the Communists by even the most questionable means, for what? So some religious nut can make decrees as to what law-abiding citizens of a so-called free country can view on the Internet?
What a sad, fearful, pathetic lot the West has become.
The world's burning. Moped Jesus spotted on I50. Details at 11.
The people need to DO something about this. It IS a slippery slope.
If stopping 100% of the users is the goal, then it fails. However, if stopping or impeding 50% perhaps it could be labeled a success. In general the argument against most of these proposals seems to follow the line of, 'it wont stop me so why bother.' However, for every one you can't stop there are scores of those you do. Does that make the effort less worthy? For every one that gets by, there are dozens of 14 year old girls who will now be denied the latest Fergie album on their ipod. This is really what they care about. Girls like guys with skills. Maybe your skill can be that you can still score the free music for the girls.
I'm not arguing whether its the right thing to do or not. Just saying that just because it can be circumvented by some (and lets face it, its a very small number compared to the whole) doesn't mean its not worth doing.
The people need to DO something about this. It IS a slippery slope.
Too late, the Aussies already let their government take away their (most effective) guns.
A government that fears guns in the hands of its people... should.
doesn't the govenment publish the blacklist? this isn't like other countries where they just pretend like there is no filtering going on at all.
--
Stay tuned for some shock and awe coming right up after this messages!
I bet the filter isn't ipv6 capable... I just can't see the lawmakers being that tech savvy.
That could be just the boost the protocol needs, in Australia at least.
Comment removed based on user account deletion
The Aussie net filter is a security flaw.
Please refer to it correctly in the future.
Let's not forget that, if a big important router was compromised (such as the one in charge of the carrier pigeon link between Downunderland and the rest of the world), the same things could be done.
These aren't new problems introduced purely by a porno filter. These are problems introduced by lack of encryption and made easier by insecure porno filters.
If they try to MITM a TLS connection, certificate warnings will pop up. As is supposed to be guaranteed. All the bullshit lately should go a long way to convince people that YES, we need widespread encryption NOW.
I stand by previous statements that Firefox's multi-click certificate override is the Right Thing. But more and more, I'm beginning to think we need an 'httpe' as some people suggested which operates on SSH's "ohhh shits teh key changed!!" model. Push it out in the new Firefox and WebKit. Have a nice, plain-language warning on first visit and a big scary multi-click override when the key changes. And here's something new...
Define a means by which a link, such as from a secure Google search results page, can include the expected key. No need for a warning - you now have a key for that domain if expected agrees with what you get. The reason is simple - big brother can't see your conversation with Google or some other secure/pseudo-trusted authority, but they CAN try to MITM you with a key other than the expected one. Google can lie about the expected key, but you'd get a different one (either the real one or one from aussieland's gov). If either party could do BOTH you'd be screwed anyway, because Google's certs would at that point mean jack shit.
"Strangers have the best candy" -Me
TFA: "The Chinese filter only works as well as it does because the people think that the filter is a good thing. Say for instance you've got a group of Chinese children. They won't know anything about Tiananmen Square. They won't even want to know anything about Tiananmen Square, because they think that that's unpatriotic to know. It's self-censorship in that regard. The Chinese firewall works because the citizens don't attempt to bypass it -- even though there's so many ways to."
At the same time chinese have become experts in ssh tunnels and proxies. There are many experts out there who know how to bypass the Chinese firewall.
"We have buttiduously canvbutted the industry, buttessed what is available and buttembled the finest selection of contractors for this buttignment. The filters will buttociatively clbuttify all communications and filter then, I can butture you, rebuttemble them with surpbutting exacbreastude in any quanbreasty. Consbreastuents can be rebuttured that a mulbreastude of industry compebreastors will butture quality and keep our clbuttrooms safe. EDS Capita Goatse will not embarbutt us."
The plans have attracted wide criticism. "It will only give supersbreastious rebutturance to medireview thinkers," said EFA. "Automated systems won't solve human problems like loveual harbuttment. Mbuttacring the written word into a Picbutto painting is not the anbreastank missile of Internet safety."
Unions also butterted that such close buttessment of staff in the workplace would hamper efficiency and could verge on workplace harbuttment. "Watermeloning cranberries."
The government was unfazed. "Butterting free speech is one thing, but a triparbreaste committee considers that that does not justify mere pbuttive breastillation at the expense of others."
The first filtering offices will be set up in Arsenal, Penistone and Scunthorpe.
http://rocknerd.co.uk
As a lifetime USA resident and citizen [save for a semester abroad], I have been among the ranks who, in 2000 and 2004, talked about moving out of the country if Bush was elected [and re-elected].
I'll admit it--that talk was mostly in jest. However, I will say this now:
If the USA gets national web filtering, I WILL move out of the country. Period. I have relatives who live in Europe and could help me find work over there. I feel that strongly about it.
http://rights.theseekerr.com/
Band together and fight for your freedom - it was going to remain a prototype a little longer, but I think it's time to move!
Funding technical problems with it is not going to help. It's not a technical solution, it's a political solution.
Are these politicians actually popular with the people? Are they actually happy about this blatant censorship? I find it hard to believe that anyone would be so willing to accept giving away so much control to the government.
Yeah great, introduce a filter threat does nothing but introduce very very serious security risks. The government will end up with nothing but lawsuits and a broken internets :(
The Aust. Gov. has already planned how to stop these security vulnerabilities, effectively immediately this article and videos will be filtered.
Copyright infringement is "piracy" in the same way DRM is "consumer rape"
http://www.cgisecurity.org/xss-faq.html
Believe me, if I started murdering people, there would be none of you left.
Internet filters won't work: ISP
Don't bother clicking unless you want to hear audio.
Two of the country's major internet providers say the Government appears unlikely to meet its own deadline for trials of mandatory internet filtering.
The Government planned to begin the trials before Christmas, but iiNet and Optus say they have not heard back from the Government about their applications to take part.
iiNet's chief operating officer Mark White has told Radio National he is sceptical about plans to filter the net.
"We absolutely endorse their intention, but don't agree with their proposed solution. We believe it's not going to work. It's as simple as that," he said.
"There are a whole range of techniques, rather than just looking at URLs, that people can use. Rotating IP addresses, a whole range of things, so it's really not going to solve the problem."
Don't be apathetic. Procrastinate!
UM wheres your parents ????
that's how you really filter.
forget it all else is facist nazi corporate sell me my soul control
HTF can I download Gay Niggers in Space when my government blocks bittorrent?
This person does nothing more than paste "funny" articles from his monetized blog on to Slashdot. Please do not reward spammers, or people who write things like these.
As the spokesperson for the Australian Child Pornography Union, I must say that us pedophiles are going to make a stand for our legitimate lifestyle in the face of government tyranny. If the filtering scheme is not abolished at once, then we will probably do something bad!
The Researcher just mentions the possibility not any does not mention any specific threats. This headline is 100% bogus.
Interesting topic. First, there is no loss of security in publicising blacklists. It is a bit silly (or nasty) to claim this is some security breach when it simply isnt.
The problem with web filtering is that there is a market for it. People want to buy it. People are making money on it. It is not going away.
Now, what aussie govt is doing is plain wrong. But, at least, they are not doing it in secret like in the UK... On balance, UK's filter is not mandated by the government, rather it is chosen by ISPs.
Either way, the technology simply isn't there yet.