£63 million for the police to fight Cybercrime

So, the police are going be allocated £63 million from the £650 million made available to 'beef up' Britains cyber defences.

My question is: Is this an appropriate organisation to be tasked with this role? I suspect it is not. Now the money has fallen into the police budget, it will offset other spending cuts applied by the government austerity measures. In short, those police personnel that would have been made redundant may now find themselves assigned to cyber defence work, whether they are suitable or not.
I believe the full £650 million should have been assigned to a new organisation tasked with cyber security, with the sole purpose of blocking cyber attacks and, wherever possible, identification and prosecution of offenders. With the police having the funding assigned to them, there is an imperative to retain and retrain staff for the role rather than employing suitably trained and experienced personnel who are ready to commence the tasks required.

A full UK Cyber Defence Organisation could be provided with the authority and access to identify those organisations that are actively being exploited with a view to contacting them directly and perhaps even offering a commercial service to allow said organisations to employ them to secure their systems against such further attacks.
Naturally, such an organisation would require an unprecedented level of access to Internet traffic and there would be immediate privacy concerns over what is viewed by them but surely, it would be better for this to be in the hands of an independent service rather than the police who will have other issues to deal with and might want to leverage the access afforded to facilitate additional investigations, drawing further resources away from the primary objective.

It's not an easy task and the levels of funding being suggested are appropriate to tackle the task at hand but in no way adequate to completely irradicate the threat - no level of funding could be.

I will watch closely how the remaining 90% of the £650 million will be distributed. I'm sure the MoD will be allocated a portion of the funding and the same issues will apply with regards to redeployment of staff, retraining and scope creep. I'm sure that CESG will receive a good dollop and, while I respect the ability of CESG and the issues of conflicting priorities will be lessened, there is the ever-present issue that CESG has an incredibly hard time retaining suitably cleared and experienced staff who, once they have attained the clearance and received the training that CESG provides, are tempted away to high-paying consultancy and contract positions, often returning to their previous job but costing CESG up to ten times as much. Many of the issues at CESG are down to their stringent vetting requirements but that is a post for another day!

Wikileaks, Assange, Insurance, US Cables, Anonymous, LOIC and all that jazz.

There are so many aspects to this story, it's very difficult to know where to start.

First, it was clear that once Julian Assange got his hands on the leaked cables, it was only a matter of time before some or all of them were released. The nature of many of the released cables is pretty tedious to be honest and I suspect that a number of them have been 'over-marked' that is to say, have been afforded a protective marking above the marking that they actually warrant but it's not my call. There are some leaked cables that are significant and whoever Assange has employed to vet/ redact them may be working to a different agenda.

Second, the issue of the 'insurance' file and Assange. It is clear that the huge insurance file could be the complete collection of cables, perhaps we'll never know as, if Assange releases the password for it, there will be absolutely nothing left for him to bargain with therefore he is only likely to release the password if he has nothing left to lose.
Regarding the accusations levelled against him in Sweden, we should always take the attitude of 'innocent until proven guilty', even if sexual crimes are seen as the most distasteful. It is possible he is guilty, it is possible that the accusations have been made in an attempt to discredit him. The timing would seem to suggest the latter or it could be a coincidence. Certainly the initial prosecutor in Sweden felt as though there was no case to answer.

Regarding Anonymous and their attempts to avenge Assange. From what I've seen of Anonymous, it is rare for them to be so united behind one cause. They also seem to be garnering support from other sections of society. Historically, Anonymous has a pretty short attention span and I would not expect their assault to run and run but if the momentum thay have gathered can continue it is possible that a sustained campaign could be achieved.

The LOIC. I'll admit, I've not submitted the code to any analysis, I do have some concerns though. A malware developer is a malware developer. It is entirely possible that anyone putting together the LOIC code could have included an update function that could change the nature of the tool entirely. While the LOIC will only be attacking anti-Wikileaks targets at the moment, it could trivially be modified for the operators to target sites for blackmail purposes or to install additional trojan software onto the host computer to assist in the collection of personal details, banking details, passwords, etc. The bottom line is, the LOIC has not come from a 'trusted' source and therefore there is no recourse to the developers if it starts acting in a manner that was not advertised. If you're tempted to download and run the software, please bear this in mind. You might also find that your actions would be considered illegal. IANAL.

Finally, a quick word about the 'need to know' There has been some discussion concerning the need to know and if it would be considered illegal to view the wikileaks cables. I would suggest that if you are working in Government, it would be beneficial to discover what has been released. I'm sure the Intelligence community is reviewing the cables but I am less confident that they will pass on the relevant information to other Government departments.

New Windows 0day vulnerability

All Windows XP/Vista/7 32bit and 64bit are vulnerable to a new 0day attack.

http://www.prevx.com/blog/160/New-Windows-day-exploit-speaks-chinese.html

The vulnerability does not have any known exploits but it will only be a matter of time before they are seen in the wild.

The vulnerability centres on the win32k.sys NtGdiEnableEUDC API which is not validating some inputs correctly, allowing it to be exploited via a stack overflow. The result is that an attacker can cause their malicious code to be executed  with kernel mode privileges, meaning, even if the malicious code is executed by an account with restricted privileges, the resultant code would  be executed with the highest privileges, bypassing the need for confirmation via UAC in Vista and Windows 7.

The vulnerability is not remotely explotable but it would be susceptible to standard delivery methods such as email, drive by and,more recently, USB infection.