Friday, May 16, 2008

A major security hole was discovered in the pseudo-random number generator (PRNG) of the Debian version of OpenSSL. OpenSSL is one of the most used cryptographic software, that allows the creation of secure network connections with the protocols called SSL and TLS. It is included in many popular computer programs, like the Mozilla Firefox web browser and the Apache web server. Debian is one of the most used GNU/Linux distributions, on which are based other distributions, like Ubuntu and Knoppix. The problem affects all the Debian-based distributions that were used to create cryptographic keys since the September 17, 2006. The bug was discovered by Luciano Bello, an argentine Debian package maintainer, and was announced on May 13, 2008.

This vulnerability was caused by the removal of two lines of code from the original version of the OpenSSL library. These lines were used to gather some entropy data by the library, needed to seed the PRNG used to create private keys, on which the secure connections are based. Without this entropy, the only dynamic data used was the PID of the software. Under Linux the PID can be a number between 1 and 32,768, that is a too small range of values if used to seed the PRNG and will cause the generation of predictable numbers. Therefore any key generated can be predictable, with only 32,767 possible keys for a given architecture and key length, and the secrecy of the network connections created with those keys is fully compromised.

These lines were removed as “suggested” by two audit tools (Valgrind and Purify) used to find vulnerabilities in the software distributed by Debian. These tools warned the Debian maintainers that some data was used before its initialization, that normally can lead to a security bug, but this time it was not the case, as the OpenSSL developers wrote on March 13, 2003. Anyway this change was erroneously applied on September 17, 2006, when the OpenSSL Debian version 0.9.8c-1 was released to the public.

Even though the Debian maintainer responsible for this software released a patch to fix this bug on May 8, 2008, the impact may be severe. In fact OpenSSL is commonly used in software to protect the passwords, to offer privacy and security. Any private key created with this version of OpenSSL is weak and must be replaced, included the session keys that are created and used only temporary. This means that any data encrypted with these keys can be decrypted without a big deal, even if these keys are used (but not created) with a version of the library not affected, like the ones included in other operating systems.

For example any web server running under any operating system may use a weak key created on a vulnerable Debian-based system. Any encrypted connection (HTTPS) to this web server established by any browser can be decrypted. This may be a serious problem for sites that requires a secure connection, like banks or private web sites. Also, if some encrypted connection was recorded in the past, it can be decrypted in the same way.

Another serious problem is for the network security software, like OpenSSH and OpenVPN, that are used to encrypt the traffic to protect passwords and grant the access to an administrative console or a private network protected by firewalls. This may allows hackers to gain unwanted access to private computers, networks or data traveled over the network, even if a not affected version of OpenSSL was used.

The same behavior can be applied to any software or protocol that use SSL, like POP3S, SSMTP, FTPS, if used with a weak key. This is the case of Tor, software used to offer strong anonymity on the TCP/IP, where about 300 of 1,500-2,000 nodes used a weak key. With 15-20% of weak Tor nodes, there is a probability of 0.34-0.8% circa to build a circuit that has all tree nodes weak, resulting in a full loss of anonymity. Also the case of only one weak node begin used may facilitate some types of attack to the anonymity. The Tor hidden services, a sort of anonymous public servers, are affected too. However the issue was speedly addressed on May 14, 2008.

The same problem also interested anonymous remailers like Mixmaster and Mixminion, that use OpenSSL to create the remailer keys for the servers and the nym keys for the clients. Although currently there is no official announcement, at least two remailer changed their keys because were weak.

Tuesday, December 22, 2009

The US Senate has voted by 60 to 40 votes to close debate on landmark health care reform legislation backed by President Barack Obama but unanimously opposed by Republican lawmakers. Now, the divided chamber appears to be heading towards a vote to pass the bill on Thursday.

All 100 senators were gathered in the Capitol building for a key procedural vote on health care reform legislation. All 58 Democrats in the Senate, plus the two independents who normally vote with them, voted for cloture, which limits the length of debate. All forty Republicans unanimously opposed the cloture.

The bill would extend health insurance coverage to 30 million US residents who currently lack it, and forbid insurance companies from practices such as denying coverage due to pre-existing conditions. Most residents would be required to purchase health insurance for the first time, with subsidies provided to those who cannot afford it.

“We’ll get this [bill] passed before Christmas and it will be one of the best Christmas presents this Congress has ever given the American people,” said Democratic senator Tom Harkin.

“This country, the greatest and richest the world has ever seen, is the only advanced nation on earth where dying for a lack of health insurance is even possible,” said Senate Majority leader Harry Reid.

Most Republicans, however, said they believed the bill is too expensive and would not correct the current problems with the US’s health care.

If the bill passes in the Senate, that version will have to be merged with a more liberal version passed by the House of Representatives which includes a government-run alternative, not included in the Senate version.

Monday, October 30, 2006

On November 13, Torontoians will be heading to the polls to vote for their ward’s councillor and for mayor. Among Toronto’s ridings is Parkdale—High Park (Ward 13). Two candidates responded to Wikinews’ requests for an interview. This ward’s candidates include Linda Coltman, David Garrick, Greg Hamara, Aleksander Oniszczak, Bill Saundercook (incumbent), and Frances Wdowczyk.

For more information on the election, read Toronto municipal election, 2006.

Monday, January 1, 2007

A crowd of approximately 1 million has welcomed the new year in Sydney overnight. Many of the crowd had camped out since 6 AM AEDT (7PM UTC) to ensure they had the best vantage point for the fireworks displays at 9 PM and 12 AM. Earlier predictions of rain failed to dampen enthusiastic revellers and fortunately did not eventuate.

According to police, vantage points were Circular Quay and Sydney Opera House closed around 7 PM.

This year’s theme was “A diamond night in Emerald City” and celebrated the Sydney Harbour Bridge’s diamond anniversary of 75 years which will fall in March.

As usual, the bridge became the centre piece of Sydney’s celebrations with a question mark turning into a coat hanger during the 9 PM fireworks show before a diamond appeared at 11 PM.

Entertainment was held in the city throughout the day, culminating in a spectacular fireworks display at midnight. Revellers counted down the final seconds of 2006 with numbers on the side of the Sydney Harbour Bridge.

The festivities are estimated to have cost AUD $4 million and organisers claim their fireworks display is “the largest in the world”. Sydney’s celebrations were broadcast on television live around the world as other countries prepared their New Year’s Eve celebrations.

Despite the large crowd, police made only 58 arrests for offences including offensive conduct, stealing, assaulting police, goods in custody, assault, drink driving and affray.

Ambulance officers were called to 1,139 incidents in Sydney with another 900 in country areas.

Wednesday, December 24, 2014 With the English-language Wikinews continuing to increase the amount of original content published, we take a look back at some of the eighty-plus original reports from our contributors during 2014.

Saturday, December 26, 2009

A metal guard rail slicing into a bus killed ten people today in an overnight crash in Ipoh, Malaysia. Three more were injured with one hospitalised when the double-decker Sani Express struck the rail at 1 a.m. this morning with 48 passengers on board.

The vehicle was en route to the northern destination of Perlis from the central state of Selangor when it crashed in Perak on the North-South Expressway, which runs the length of the country. The victims were on the lower deck when the vehicle skidded, struck and was ripped open on the left-hand side by the rail before swerving across the road to rest against the central divider. Of the ten killed, the youngest was fourteen and the oldest 64. The victim hospitalised has four broken ribs.

The bus driver had prior traffic offense convictions, although the bus had not been in any incidents with the police. Police arrested him, noting he was not drunk or on drugs, and he has been remanded in custody until Wednesday. He admits that he fell asleep just before the crash.

Press photographs showed the left side of the bus had been torn open along the bottom of the lower deck for most of its length, and bodies covered with newspaper lying in front of the vehicle.

Perak saw another major bus crash two years ago on the same highway. 22 people were killed in that crash, which remains the nation’s worst bus accident.

Monday, December 12, 2005

Cronulla Beach in Sydney, New South Wales was the scene of racist mob-violence yesterday. In what has been described as disgusting, un-Australian and shameful behaviour, participants in a 5000-strong mob assaulted people suspected of being of Lebanese origin. The angry, alcohol-fuelled crowd also turned on anyone who tried to help the victims, including police, security guards and ambulance officers.

Following an attack on two lifeguards earlier in the week, allegedly by men of Lebanese descent, a protest had been organised via text messages and a small number of usenet postings.

Sutherland Shire Mayor Kevin Schreiber says inflammatory text messages calling for revenge attacks fueled the violence. Mr Schreiber said the heavily-circulated messages ensured troublemakers went to the southern Sydney beach looking for a fight. Police had patrolled the area all weekend after text messages began circulating among the community calling for vigilante responses to unwelcome visitors on the beach.

“The sending out of that text message was foolish and irresponsible and ensured that people from all over Sydney came to Cronulla looking to cause trouble and this was further fueled by alcohol,” said Mr Schreiber.

Sydney’s popular talk-back radio station 2GB also promoted Sunday’s event. Breakfast announcer Alan Jones has been accused of “fanning the flames.” Callers who recommended vigilante action were not discouraged to take the law into their own hands. Mr Jones, notorious for inflammatory comments, repeated the text message for Cronulla residents to defend their territory several times.

As the crowd marched along the beach and foreshore area, waving Australian flags, the crowd chanted racist slogans, with many wearing clothes bearing racist sentiment.

Middle Eastern men were openly targeted and assaulted. A young Muslim woman wearing a veil was chased into a kiosk on Cronulla beach. Police tried to move her away from the chanting crowd but were unable to reach the security of the command post. While the woman and police officers hid in the kiosk, a crowd surrounded the kiosk and shouted “Kill the Lebs”, while others climbed on top of the kiosk.

As police horses and special operations officers formed a line and pushed the crowd away, they were bombarded with beer bottles. After half an hour, an ambulance arrived at the kiosk and people were loaded into it. The ambulance, transporting six injured youths, escorted by police and police horses, was also bombarded with beer bottles. One struck an ambulance officer on the head. His colleague suffered lacerations to the arm.