Wednesday, December 11, 2013
Tuesday, December 10, 2013
Hawaii's 'Big Island' passes bill forbidding biotechnology companies, GMOs
The Honolulu Civil Beat reports that the Hawaii County Council voted 6-3 to pass the momentous bill, which contains only one exemption for GM papayas that have been grown in Hawaii since the late 1990s. All other GMOs, including the latest incarnations of Roundup Ready soybeans and Bt corn, for instance, will have to make their homes elsewhere, as residents of the Big Island have made their voices overwhelmingly heard on the issue.
"Forcing genes of one species into another and changing the DNA of plants is not natural," stated one local resident by the name of Helene Love. "[GMOs] could turn out to be a huge danger, similar to nuclear disasters of our planet that we can't put out."
Some might say this suggestion is a bit dramatic, but the truth of the matter is that the long-term adverse effects of GMOs on the environment and human health are largely unknown. It is also undeniable that, once released, GMOs can never again be contained, as their pollen and other components will continue to indiscriminately spread and contaminate other plants and food crops.
"Even the worst chemical pollution diminishes over time as the pollutant is degraded by physical and biological mechanisms.," explains the comprehensive Earth Open Source research study GMO Myths and Truths. "But GMOs are living organisms. Once released into the ecosystem, they do not degrade and cannot be recalled, but multiply in the environment and pass on their GM genes to future generations."
Big Island mayor fully endorses Bill 113; says it will help protect his community's agricultural heritage
Big Island Mayor Billy Kenoi was also supportive of the bill, telling reporters that it fully embodies the sentiments of his local community. Rather than continue to allow large biotech corporations to rob the people of their agricultural heritage, Bill 113 encourages community-based farming and ranching rather than chemical-based factory agriculture."Our community has a deep connection and respect for our land, and we all understand we must protect our island and preserve our precious natural resources," wrote Kenoi to the councilmen. "We are determined to do what is right for the land because this place is unlike any other in the world."
The Hawaiian island of Kauai is also considering similar legislation in the form of Bill 2491, which rather than implement a full-on GMO ban would merely increase the standards for GMO approval. According to Civil Beat, Bill 2491, which is expected to be very soon submitted by councilwoman Elle Cochran to the Maui City Council, would require biotech corporations to disclose details about pesticide use and report all experimental and commercial GMOs to authorities.
"The bill requires commercial agricultural companies that use more than 5 pounds or 15 gallons of restricted use pesticides to disclose what chemicals they spray, where and in what quantities," explains a recent new report on the upcoming bill. "The bill would apply to all of Maui County -- including the island of Molokai where both Monsanto and Dow AgroSciences operate."
Source: Natural News
Monday, December 9, 2013
Mad Science: “We’re now able to eavesdrop on the brain in real life”
When do scientific advances cross the line between exciting progress over to a frightening chapter in a futuristic fantasy novel? How about when those advances intrude uncomfortably into the human brain, harvesting thoughts and recording them?
A group of researchers at Stanford University have taken this leap into mad science with experimental “intracranial recording”. Or, put simply, they’ve taken the first step towards mind reading using electronic monitoring of brain activity.
Using a novel method, the researchers collected the first solid evidence that the pattern of brain activity seen in someone performing a mathematical exercise under experimentally controlled conditions is very similar to that observed when the person engages in quantitative thought in the course of daily life.
“We’re now able to eavesdrop on the brain in real life,” said Josef Parvizi, MD, PhD, associate professor of neurology and neurological sciences and director of Stanford’s Human Intracranial Cognitive Electrophysiology Program…
His team’s method, called intracranial recording, provided exquisite anatomical and temporal precision and allowed the scientists to monitor brain activity when people were immersed in real-life situations…
The procedure involves temporarily removing a portion of a patient’s skull and positioning packets of electrodes against the exposed brain surface. For up to a week, patients remain hooked up to the monitoring apparatus while the electrodes pick up electrical activity within the brain…
During this whole time, patients remain tethered to the monitoring apparatus and mostly confined to their beds. But otherwise, except for the typical intrusions of a hospital setting, they are comfortable, free of pain and free to eat, drink, think, talk to friends and family in person or on the phone, or watch videos.
The electrodes implanted in patients’ heads are like wiretaps, each eavesdropping on a population of several hundred thousand nerve cells and reporting back to a computer.
In the study, participants’ actions were also monitored by video cameras throughout their stay. This allowed the researchers later to correlate patients’ voluntary activities in a real-life setting with nerve-cell behavior in the monitored brain region…
Afterward, Parvizi and his colleagues analyzed each volunteer’s daily electrode record, identified many spikes in intraparietal-sulcus activity that occurred outside experimental settings, and turned to the recorded video footage to see exactly what the volunteer had been doing when such spikes occurred…
“These nerve cells are not firing chaotically,” he said. “They’re very specialized, active only when the subject starts thinking about numbers. When the subject is reminiscing, laughing or talking, they’re not activated.” Thus, it was possible to know, simply by consulting the electronic record of participants’ brain activity, whether they were engaged in quantitative thought during nonexperimental conditions. (source)
Researchers are able to suggest all sorts of do-gooder applications for this technology: allowing stroke victims who can’t talk to communicate, for example.
But it isn’t a stretch at all to believe that this will one day be used in a more sinister fashion. It could be applied as a control mechanism, the basis of Big Brother technology like implantable chips for the human brain, or an interrogation tool. Would you really want someone to be able to take the very thoughts from your mind and interpret them?
Henry Greely, JD, the Deane F. and Kate Edelman Johnson Professor of Law and steering committee chair of the Stanford Center for Biomedical Ethics, who is familiar with the study, waved off concerns about mind control. “Practically speaking, it’s not the simplest thing in the world to go around implanting electrodes in people’s brains. It will not be done tomorrow, or easily, or surreptitiously.”
Sunday, December 8, 2013
Meet “badBIOS,” the mysterious Mac and PC malware that jumps airgaps
Three years ago, security consultant Dragos Ruiu was in his lab when he noticed something highly unusual: his MacBook Air, on which he had just installed a fresh copy of OS X, spontaneously updated the firmware that helps it boot. Stranger still, when Ruiu then tried to boot the machine off a CD ROM, it refused. He also found that the machine could delete data and undo configuration changes with no prompting. He didn't know it then, but that odd firmware update would become a high-stakes malware mystery that would consume most of his waking hours.
In the following months, Ruiu observed more odd phenomena that seemed straight out of a science-fiction thriller. A computer running the Open BSD operating system also began to modify its settings and delete its data without explanation or prompting. His network transmitted data specific to the Internet's next-generation IPv6 networking protocol, even from computers that were supposed to have IPv6 completely disabled. Strangest of all was the ability of infected machines to transmit small amounts of network data with other infected machines even when their power cords and Ethernet cables were unplugged and their Wi-Fi and Bluetooth cards were removed. Further investigation soon showed that the list of affected operating systems also included multiple variants of Windows and Linux.
"We were like, 'Okay, we're totally owned,'" Ruiu told Ars. "'We have to erase all our systems and start from scratch,' which we did. It was a very painful exercise. I've been suspicious of stuff around here ever since."
In the intervening three years, Ruiu said, the infections have persisted, almost like a strain of bacteria that's able to survive extreme antibiotic therapies. Within hours or weeks of wiping an infected computer clean, the odd behavior would return. The most visible sign of contamination is a machine's inability to boot off a CD, but other, more subtle behaviors can be observed when using tools such as Process Monitor, which is designed for troubleshooting and forensic investigations.
Another intriguing characteristic: in addition to jumping "airgaps" designed to isolate infected or sensitive machines from all other networked computers, the malware seems to have self-healing capabilities.
"We had an air-gapped computer that just had its [firmware] BIOS reflashed, a fresh disk drive installed, and zero data on it, installed from a Windows system CD," Ruiu said. "At one point, we were editing some of the components and our registry editor got disabled. It was like: wait a minute, how can that happen? How can the machine react and attack the software that we're using to attack it? This is an air-gapped machine and all of a sudden the search function in the registry editor stopped working when we were using it to search for their keys."
Over the past two weeks, Ruiu has taken to Twitter, Facebook, and Google Plus to document his investigative odyssey and share a theory that has captured the attention of some of the world's foremost security experts. The malware, Ruiu believes, is transmitted though USB drives to infect the lowest levels of computer hardware. With the ability to target a computer's Basic Input/Output System (BIOS), Unified Extensible Firmware Interface (UEFI), and possibly other firmware standards, the malware can attack a wide variety of platforms, escape common forms of detection, and survive most attempts to eradicate it.
But the story gets stranger still. In posts here, here, and here, Ruiu posited another theory that sounds like something from the screenplay of a post-apocalyptic movie: "badBIOS," as Ruiu dubbed the malware, has the ability to use high-frequency transmissions passed between computer speakers and microphones to bridge airgaps.
Bigfoot in the age of the advanced persistent threat
At times as I've reported this story, its outline has struck me as the stuff of urban legend, the advanced persistent threat equivalent of a Bigfoot sighting. Indeed, Ruiu has conceded that while several fellow security experts have assisted his investigation, none has peer reviewed his process or the tentative findings that he's beginning to draw. (A compilation of Ruiu's observations is here.)
Also unexplained is why Ruiu would be on the receiving end of such an advanced and exotic attack. As a security professional, the organizer of the internationally renowned CanSecWest and PacSec conferences, and the founder of the Pwn2Own hacking competition, he is no doubt an attractive target to state-sponsored spies and financially motivated hackers. But he's no more attractive a target than hundreds or thousands of his peers, who have so far not reported the kind of odd phenomena that has afflicted Ruiu's computers and networks.
In contrast to the skepticism that's common in the security and hacking cultures, Ruiu's peers have mostly responded with deep-seated concern and even fascination to his dispatches about badBIOS.
"Everybody in security needs to follow @dragosr and watch his analysis of #badBIOS," Alex Stamos, one of the more trusted and sober security researchers, wrote in a tweet last week. Jeff Moss—the founder of the Defcon and Blackhat security conferences who in 2009 began advising Department of Homeland Security Secretary Janet Napolitano on matters of computer security—retweeted the statement and added: "No joke it's really serious." Plenty of others agree.
"Dragos is definitely one of the good reliable guys, and I have never ever even remotely thought him dishonest," security researcher Arrigo Triulzi told Ars. "Nothing of what he describes is science fiction taken individually, but we have not seen it in the wild ever."
Been there, done that
Triulzi said he's seen plenty of firmware-targeting malware in the laboratory. A client of his once infected the UEFI-based BIOS of his Mac laptop as part of an experiment. Five years ago, Triulzi himself developed proof-of-concept malware that stealthily infected the network interface controllers that sit on a computer motherboard and provide the Ethernet jack that connects the machine to a network. His research built off of work by John Heasman that demonstrated how to plant hard-to-detect malware known as a rootkit in a computer's peripheral component interconnect, the Intel-developed connection that attaches hardware devices to a CPU.
It's also possible to use high-frequency sounds broadcast over speakers to send network packets. Early networking standards used the technique, said security expert Rob Graham. Ultrasonic-based networking is also the subject of a great deal of research, including this project by scientists at MIT.
Of course, it's one thing for researchers in the lab to demonstrate viable firmware-infecting rootkits and ultra high-frequency networking techniques. But as Triulzi suggested, it's another thing entirely to seamlessly fuse the two together and use the weapon in the real world against a seasoned security consultant. What's more, use of a USB stick to infect an array of computer platforms at the BIOS level rivals the payload delivery system found in the state-sponsored Stuxnet worm unleashed to disrupt Iran's nuclear program. And the reported ability of badBIOS to bridge airgaps also has parallels to Flame, another state-sponsored piece of malware that used Bluetooth radio signals to communicate with devices not connected to the Internet.
"Really, everything Dragos reports is something that's easily within the capabilities of a lot of people," said Graham, who is CEO of penetration testing firm Errata Security. "I could, if I spent a year, write a BIOS that does everything Dragos said badBIOS is doing. To communicate over ultrahigh frequency sound waves between computers is really, really easy."
Coincidentally, Italian newspapers this week reported that Russian spies attempted to monitor attendees of last month's G20 economic summit by giving them memory sticks and recharging cables programmed to intercept their communications.
Eureka
For most of the three years that Ruiu has been wrestling with badBIOS, its infection mechanism remained a mystery. A month or two ago, after buying a new computer, he noticed that it was almost immediately infected as soon as he plugged one of his USB drives into it. He soon theorized that infected computers have the ability to contaminate USB devices and vice versa.
"The suspicion right now is there's some kind of buffer overflow in the way the BIOS is reading the drive itself, and they're reprogramming the flash controller to overflow the BIOS and then adding a section to the BIOS table," he explained.
He still doesn't know if a USB stick was the initial infection trigger for his MacBook Air three years ago, or if the USB devices were infected only after they came into contact with his compromised machines, which he said now number between one and two dozen. He said he has been able to identify a variety of USB sticks that infect any computer they are plugged into. At next month's PacSec conference, Ruiu said he plans to get access to expensive USB analysis hardware that he hopes will provide new clues behind the infection mechanism.
He said he suspects badBIOS is only the initial module of a multi-staged payload that has the ability to infect the Windows, Mac OS X, BSD, and Linux operating systems.
"It's going out over the network to get something or it's going out to the USB key that it was infected from," he theorized. "That's also the conjecture of why it's not booting CDs. It's trying to keep its claws, as it were, on the machine. It doesn't want you to boot another OS it might not have code for."
To put it another way, he said, badBIOS "is the tip of the warhead, as it were."
“Things kept getting fixed”
Ruiu said he arrived at the theory about badBIOS's high-frequency networking capability after observing encrypted data packets being sent to and from an infected laptop that had no obvious network connection with—but was in close proximity to—another badBIOS-infected computer. The packets were transmitted even when the laptop had its Wi-Fi and Bluetooth cards removed. Ruiu also disconnected the machine's power cord so it ran only on battery to rule out the possibility that it was receiving signals over the electrical connection. Even then, forensic tools showed the packets continued to flow over the airgapped machine. Then, when Ruiu removed the internal speaker and microphone connected to the airgapped machine, the packets suddenly stopped.
With the speakers and mic intact, Ruiu said, the isolated computer seemed to be using the high-frequency connection to maintain the integrity of the badBIOS infection as he worked to dismantle software components the malware relied on.
"The airgapped machine is acting like it's connected to the Internet," he said. "Most of the problems we were having is we were slightly disabling bits of the components of the system. It would not let us disable some things. Things kept getting fixed automatically as soon as we tried to break them. It was weird."
It's too early to say with confidence that what Ruiu has been observing is a USB-transmitted rootkit that can burrow into a computer's lowest levels and use it as a jumping off point to infect a variety of operating systems with malware that can't be detected. It's even harder to know for sure that infected systems are using high-frequency sounds to communicate with isolated machines. But after almost two weeks of online discussion, no one has been able to rule out these troubling scenarios, either.
"It looks like the state of the art in intrusion stuff is a lot more advanced than we assumed it was," Ruiu concluded in an interview. "The take-away from this is a lot of our forensic procedures are weak when faced with challenges like this. A lot of companies have to take a lot more care when they use forensic data if they're faced with sophisticated attackers."
FBI able to secretly turn on laptop cameras without triggering indicator light ‘for several years’
In a recent report by The Washington Post, it was revealed that the FBI has been able to secretly activate a target’s laptop camera “without triggering the light that lets users know it is recording” for several years.
While this may be surprising to some, it really shouldn’t be. Previous reports revealed that the FBI employs hackers to create software to remotely activate the microphones on laptops and cell phones as well as cameras. The U.S. government has also become the world’s largest buyer of malware. The NSA also recommended physically removing the webcam from Apple laptops for security reasons.
In August, the Wall Street Journal reported that the FBI has developed hacking tools like this for over a decade, though they rarely are discussed publicly.
The Washington Post cites Marcus Thomas, former assistant director of the FBI’s Operational Technology Division in Quantico, who said that the remote activation of cameras is used mostly in serious cases.
Thomas, who now sits on the advisory board of Subsentio, a company that helps telecommunications firms comply with federal wiretap laws, told the Post that the bureau uses the technique “mainly in terrorism cases or the most serious criminal investigations.”
As technology advances, the FBI’s surveillance techniques do as well.
“Because of encryption and because targets are increasingly using mobile devices, law enforcement is realizing that more and more they’re going to have to be on the device — or in the cloud,” Thomas said.
Indeed, in January of this year a report indicated that all data stored on cloud services could be accessed by the U.S. government without a warrant.
In the past, a federal magistrate rejected the FBI’s attempt to get authorization to activate the laptop camera of a suspect. The magistrate ruled that it was “extremely intrusive” and could be a violation of the Fourth Amendment.
Federal magistrate Judge Stephen W. Smith also said the Texas-based court did not have the jurisdiction to approve the search of a computer in an unknown location.
Yet, another federal magistrate approved sending surveillance software to a target, though it did not involve remotely activating a computer camera.
The surveillance software gave the FBI a detailed account of the computer of the target – a federal fugitive – including his hard drive space, the chips used on his computer and a list of installed programs.
In the case the Post was reporting on, an individual calling himself “Mo,” probably located in Tehran, made a series of bomb threats.
The FBI obtained a warrant to send surveillance software to Mo’s computer when he sign in to his Yahoo email account but the program “never actually executed as designed,” according to a handwritten note by a federal agent given to a court.