Science Addiction

A dormant blog by Devanshu Mehta

Tag: research

“Grey Hat” Guide: To Disclose or Not to Disclose

Jennifer Granick, Civil Liberties Directory at the Electronic Frontier Foundation is putting together a “Grey Hat” guide for security researchers. The problem, says Granick, is that the law has been a real obstacle to solving vulnerabilities.

The muddy nature of the laws that regulate computers and code, coupled with a series of abusive lawsuits, gives researchers real reason to worry that they might be sued if they publish their research or go straight to the affected vendor. By reporting the security flaw, the researcher reveals that she may have committed unlawful activity, which might invite a lawsuit or criminal investigation. On the other hand, withholding information means a potentially serious security flaw may go unremedied.

The guide seems to be a work-in-progress and Granick has solicited constructive feedback.

Track Your Stolen Laptop for Free

Researchers at the University of Washington and University of California, San Diego have released a free and open source software called Adeona. It tracks your stolen or lost laptop without relying on proprietary or centralized software or databases. And unlike commercial services, it preserves the privacy of the user- it uses cryptography mechanisms so that only the user has access to the laptop location information.

Adeona is designed to use the Open Source OpenDHT distributed storage service to store location updates sent by a small software client installed on an owner’s laptop. The client continually monitors the current location of the laptop, gathering information (such as IP addresses and local network topology) that can be used to identify its current location. The client then uses strong cryptographic mechanisms to not only encrypt the location data, but also ensure that the ciphertexts stored within OpenDHT are anonymous and unlinkable. At the same time, it is easy for an owner to retrieve location information.

It is licensed under GPLv2, and is available for Linux, Mac OS X and Windows. Like Lojack for cars, simply the prevalence of such software can serve as a deterrent for casual theft. A determined thief can replace the operating system before using (or selling) it, but a lot of consumer electronics theft is casual and opportunistic.