Google suggest Online Payment with Single Sign On

Google has suggested a micropayment System to the Newspaper Association of America. How is this asecurity issue? They suggest to combine it with a Single Sign On System also operated by Google.
I welcome paid-for Internet content because I believe that advertising As the only Business model for online content endangers the journalistic quality of the articles. The dependency on the advertisers leads to articles written for the advertisers, not for the readers. Also, I hope that flash and popups will become less intrusive if publishers get an additional revenue stream.
The bad news is that Google would know even more about their users, in particular if they operate the micropayment system.
I really would prefer having a small micropayment token connected to my computer that performs Single Sign On and micropayment operations under my control.

Linux Botnet

The Register reports a new linux server botnet originally reported here. It is not yet clear how the servers are infectected. The purpuse of these servers is to serve malware from an additional webserver installed on listening on port 8080. It seems to me that people look at their web forum security again very closely: Not only can be used to exploit a server, but also if it is possible to post links at public discussion sites it is also possible to post links to such malware.

Quantum Computer Chip

One popular use for the quantum computer is the factorization of big numbers. If one could factor a big number as quickly as it can be multiplied from its prime components the RSA algorithm would be broken. Theory says that this should be possible, but no practical implementation has been seen so far. The most important obstacle is the quantum noise that leads to random changes in quantum states.

Researchers at the university of Bristol have found a way to cram a complete quantum computer on one silicon chip. However, the largest number they can factor right now is 15. Also, the peripheral devices still fill up a complete desktop.

In order to factor larger numbers the quantum computer needs more degrees of freedom, which are called 'qbits'. Miniaturizing the computer might help with increasing the number of qbits.

Real Time Keylogging

According to New York Times the trojan Clampi is able to send key presses in real time. This means that it can be used to attack one time password (OTP) systems.

From here on, it seems necessary to consider a more complex mode of OTP known as EMV CAP respectively Visa DPA. Here a challenge is sent from the server which is signed by a smart card. Therefore the attacker cannot submit the stolen OTP signature for any other purpose than it was originally intended for.

MacOS X is not Invulnerable

Apple has fixed a nasty longstanding bug. This bug seems to enable user space programs to overwrite arbitrary locations in the kernel memory. The impact of this depends on how easy it is to guess the location of the target. A technique called Address Space Layout Randomization is expected to help here. Attackers need to guess the location of target variables or code for many computers in order to create a worm or rootkit that spreads using this vulnerability. However, it seems that the kernel memory is not randomized so all macs prior to the latest version of Leopard are vulnerable.

Voting Computer Tempest Attack

Youtube has a video where the german hacker club CCC shows how to read out the votes cast on an online voting machine. The electromagnetic radiation generated by the machine, in particular it's pressure sensitive input device, is measured by a sensitive radio scanner. It seems that almost any man-machine interface is threatend by this kind of attack.

Whole Genome Amplification allows DNA Spoofing

Israele researchers found that using a variant of polymerase chain reaction called 'whole genome amplification' it is possible to produce macroscopic amounts of DNA from very small samples. This can be used to create fake evidences at crime scenes. The fabricated samples have been tested with commercially available test kits.

This underlines two insights we all should know since long:

• Don't trust on DNA alone to convict people
• Be careful with large databases - their contents might be stolen

Update (209-08-20): Another Israeli company, Nucleix, claims that they have a DNA analysis kit that can distinguish between real and amplificated DNA. This looks ver much like another armamaent race to me.