Thursday, February 7, 2008

United Nations Secretary-General Ban Ki-moon has expressed concern about crises in Chad, Kenya, and the Sudan. The U.N. chief is recently back from Africa where he attended the African Union summit in Ethiopia and met with leaders in Kenya.

On rebel efforts to overthrow the government in Chad in recent days, the secretary-general welcomed an African Union initiative to have the leaders of Libya and the Democratic Republic of Congo mediate the crisis. He says the United Nations will do its utmost to help resolve the crisis, urging the Security Council to act swiftly to help bring an end to the violence.

“It has devastating consequences not only for the people of Chad and Darfurian refugees seeking shelter there, but also for Darfur itself,” said Ban.

Mr. Ban told reporters the situation in the neighboring Darfur region of Sudan is no less troubling. He says the deployment of the AU-U.N. peacekeeping force, known as UNAMID, must be sped up and urged member states to properly equip the troops.

“UNAMID still lacks required aviation and ground transportation – chiefly helicopters. Additional troops will not make up for this shortfall,” said Ban. “Those countries that called for intervention in Darfur are under special obligation to deliver on their promises.”

While at the AU summit, Mr. Ban says he discussed some of the outstanding issues affecting the deployment with Sudanese President Omar al-Bashir, and he expects the Status of Forces Agreement (SOFA) to be signed this week. But Mr. Ban remained vague on whether some of the agreement’s sticking points – such as night flights, land agreements, and advance notice of U.N. movements – had been settled.

On Kenya, Mr. Ban says he has been deeply engaged in the post-election crisis and told political leaders during his visit there that they bear particular responsibility for the future of Kenya.

“I stressed to all the Kenyan leaders the need to stop the unacceptable violence and killings, and to resolve their differences through dialogue and democratic process. I also appealed to all the political leaders to think beyond their individual interests or party lines and to look to the future of Kenya as one country,” he said.

Mr. Ban also met in Nairobi with his U.N. predecessor, Kofi Annan, who is leading the panel of eminent Africans trying to mediate the crisis, and said they discussed his roadmap for the talks.

Security of U.N. personnel in Africa and elsewhere has been high on the secretary-general’s agenda, especially in the wake of the December bombing in Algeria that killed 17 staff members. Mr. Ban announced that he is naming diplomat Lakhdar Brahimi to chair an independent panel on safety and security of U.N. personnel and premises. Brahimi is an Algerian, but Mr. Ban says he has no concerns about his fairness or objectivity in heading up the panel.

Thursday, May 8, 2008

An Iraqi Defense Ministry spokesman said that the leader of al-Qaeda in Iraq, Abu Ayyub al-Masri, was arrested Thursday. Al-Masri, also known as Abu Hamza al-Muhajir, was reportedly arrested in the northern city of Mosul, 225 miles northwest of Baghdad. File:Al-masri.jpg

There has been no official confirmation or comment from United States forces yet, but news of the arrest was reported on Iraq state television.

The Iraqi Defense Ministry spokesman, Mohammed al-Askari, told the Associated Press via telephone that, “The commander of Ninevah military operations informed me that Iraqi troops captured Abu Hamza al-Muhajir the leader of al Qaeda in Iraq.”

Al-Masri, an Egyptian-born militant, took control of Al Qaeda operations in Iraq after former leader Abu Musab al-Zarqawi was killed on June 7, 2006 in an airstrike northeast of Baghdad.

Major Gen. Abdul-Karim Khalaf, an Interior Ministry spokesman, said that police in Mosul “arrested one of al Qaeda’s leaders at midnight and during the primary investigations he admitted that he is Abu Hamza Al-Muhajir. Now a broader investigation of him is being conducted.”

[edit]

Monday, March 15, 2010

Wikinews reporter Mike Morales interviews fellow Wikinews contributor Peter Coti, who is on the scene at a north eastern storm in the United States in New Jersey. Coti tells Wikinews what happened in the area of Ridgewood, New Jersey and provided pictures of the damage and area.

Friday, May 16, 2008

A major security hole was discovered in the pseudo-random number generator (PRNG) of the Debian version of OpenSSL. OpenSSL is one of the most used cryptographic software, that allows the creation of secure network connections with the protocols called SSL and TLS. It is included in many popular computer programs, like the Mozilla Firefox web browser and the Apache web server. Debian is one of the most used GNU/Linux distributions, on which are based other distributions, like Ubuntu and Knoppix. The problem affects all the Debian-based distributions that were used to create cryptographic keys since the September 17, 2006. The bug was discovered by Luciano Bello, an argentine Debian package maintainer, and was announced on May 13, 2008.

This vulnerability was caused by the removal of two lines of code from the original version of the OpenSSL library. These lines were used to gather some entropy data by the library, needed to seed the PRNG used to create private keys, on which the secure connections are based. Without this entropy, the only dynamic data used was the PID of the software. Under Linux the PID can be a number between 1 and 32,768, that is a too small range of values if used to seed the PRNG and will cause the generation of predictable numbers. Therefore any key generated can be predictable, with only 32,767 possible keys for a given architecture and key length, and the secrecy of the network connections created with those keys is fully compromised.

These lines were removed as “suggested” by two audit tools (Valgrind and Purify) used to find vulnerabilities in the software distributed by Debian. These tools warned the Debian maintainers that some data was used before its initialization, that normally can lead to a security bug, but this time it was not the case, as the OpenSSL developers wrote on March 13, 2003. Anyway this change was erroneously applied on September 17, 2006, when the OpenSSL Debian version 0.9.8c-1 was released to the public.

Even though the Debian maintainer responsible for this software released a patch to fix this bug on May 8, 2008, the impact may be severe. In fact OpenSSL is commonly used in software to protect the passwords, to offer privacy and security. Any private key created with this version of OpenSSL is weak and must be replaced, included the session keys that are created and used only temporary. This means that any data encrypted with these keys can be decrypted without a big deal, even if these keys are used (but not created) with a version of the library not affected, like the ones included in other operating systems.

For example any web server running under any operating system may use a weak key created on a vulnerable Debian-based system. Any encrypted connection (HTTPS) to this web server established by any browser can be decrypted. This may be a serious problem for sites that requires a secure connection, like banks or private web sites. Also, if some encrypted connection was recorded in the past, it can be decrypted in the same way.

Another serious problem is for the network security software, like OpenSSH and OpenVPN, that are used to encrypt the traffic to protect passwords and grant the access to an administrative console or a private network protected by firewalls. This may allows hackers to gain unwanted access to private computers, networks or data traveled over the network, even if a not affected version of OpenSSL was used.

The same behavior can be applied to any software or protocol that use SSL, like POP3S, SSMTP, FTPS, if used with a weak key. This is the case of Tor, software used to offer strong anonymity on the TCP/IP, where about 300 of 1,500-2,000 nodes used a weak key. With 15-20% of weak Tor nodes, there is a probability of 0.34-0.8% circa to build a circuit that has all tree nodes weak, resulting in a full loss of anonymity. Also the case of only one weak node begin used may facilitate some types of attack to the anonymity. The Tor hidden services, a sort of anonymous public servers, are affected too. However the issue was speedly addressed on May 14, 2008.

The same problem also interested anonymous remailers like Mixmaster and Mixminion, that use OpenSSL to create the remailer keys for the servers and the nym keys for the clients. Although currently there is no official announcement, at least two remailer changed their keys because were weak.

Saturday, September 3, 2005

Blizzard Entertainment has won a federal ruling in the U.S. Court of Appeals against the programmers of bnetd, a software package that emulates Blizzard’s Battle.net service. The court reaffirmed the original judgement, given in October, that the Digital Millennium Copyright Act and click-through EULA‘s prohibited the reverse engineering of Blizzard’s software in order to improve their playability. This was the first real test of the DMCA’s applicability.

Bnetd, released under the GNU General Public License, was created to enable users to play multiplayer games, bypassing Blizzard’s freely accessible Battle.net servers, which have sometimes been unreliable or slow for gamers. The software also disabled the CD-Key check which is present in Battle.net to prevent users of pirated copies from being able to connect to Blizzard’s servers. Offers by bnetd developers to incorporate Blizzard’s CD-Check system were declined.

The CD-Check system itself has faced controversy, with some users complaining it borders on breaching privacy in the same way as adware and other malevolent software. This is not confined to Blizzard: controversy occurred when Sony Online Entertainment‘s EverQuest had a similar system which was later disabled due to complaints. Other games designed for network play are also known to have similar systems in place, the most prominent perhaps being Valve Software‘s Steam system developed for Half-Life 2.

Blizzard has produced many popular titles such as Starcraft, World of Warcraft and the Diablo series.