UK Uncut scampers all over website

Anti-cuts group UK Uncut has hijacked a Vodafone website as part of a protest against alleged tax avoidance by the mobile phone giant.
UK Uncut boasted that it had taken over the blogs on the World of Difference website, a site that normally promotes Vodafone's corporate and social responsibility initiatives. The initiative makes small grants to charity programmes.
One of the groups that won a grant supplied UK Uncut with the login details necessary to access the site and carry out the defacement, which argued that Vodafone's contributions to the voluntary sector are small potatoes compared to the £6bn it has allegedly avoided paying in tax. Cuts against the voluntary sector imposed as part of the coalition government's spending clampdown might have been avoided if Vodafone was made to pay its taxes, according to UK Uncut.
Messages posted on Vodafone's website included photos and videos of UK Uncut's direct action protests at Vodafone stores, under the title Vodafone's Tax Dodge £6bn. Cuts to charities £5bn. Vodafone acted promptly to remove the defacement, which was first brought to our attention by tech-savvy political blogger Dizzy Thinks.
Dizzy notes that the hack might easily be considered a violation of the UK's anti-hacking laws. Direct action in cyberspace is certainly not immune from legal consequences, as members of Anonymous arrested for alleged attacks on financial service firms hostile to WikiLeaks would testify.
We asked UK Uncut what, if any, legal advice it took before carrying out its protest against Vodafone. We also asked if it had any concerns about the hack getting traced back to the people who gave it their password/login credentials.
UK Uncut's published mobile phone number goes straight through to voicemail, while an email auto-responder warns that it is receiving a large volume of inquiries, so it may be a while before we hear back from the group.
In a statement, Vodafone said the tax avoidance allegation was untrue. It criticised UK Uncut's protest as spreading "misinformation".
We've seen a couple of posts on World of Difference winners' blogs relating to allegations of tax avoidance. Given these are incorrect, they have been removed. World of Difference winners are doing great things for charities up and down the country. It's very sad to see how low people will go to further spread misinformation and for the charitable programme to be used as a platform for this kind of protest.
We asked Vodafone whether or not it intends to refer the matter to police but have yet to hear back on this point.
We'll update this story as and when we hear more from either UK Uncut or Vodafone. ®

Google's Chrome and Android survive hack attacks, Apple falters

Google emerged strong at the annual Pwn2Own hacking contest with its web browser, Chrome, and its software stack for mobile devices, Android, surviving hack attacks while Safari and Internet Explorer 8 and Apple's iPhone 4 faltered in the browsers category, and Apple's iPhone 4 and RIM's BlackBerry Torch 9800 succumbed in the smartphones class.
Pwn2Own is a computer hacking contest held annually at the annual CanSecWest security conference, during which security experts and hackers attempt to hack into devices.

Ahead of this year's contest both Apple and Google released last minute updates on their web browsers. Despite the update, Safari was the first to falter, followed closely by Microsoft's Internet Explorer, which did not see any update prior to the competition.

Reports suggest that VUPEN was the first to take a shot at Apple's browser. The French security company had gained control of the fully-patched Mac OS X 10.6.6 MacBook just five seconds after the browser visited its specially-crafted web page, reported Ars Technica. The exploit worked on Safari version 5.0.4.

Internet Explorer fell to Stephen Fewer of Harmony Security. The 32-bit version of Internet Explorer 8 running on 64-bit Windows 7 Service Pack 1 was exploited through three separate vulnerabilities, which included two to achieve successful code execution within the browser and one to escape the Protected Mode sandbox. The attempt to exploit Google's Chrome on a Cr-48 Chrome OS notebook failed.

The contest's sponsor, TippingPoint, which provides a report to the applicable vendor, detailing the vulnerability and its exploitation, revealed that in the smartphone category Apple's iPhone 4 and RIM's BlackBerry Torch 9800 both succumbed to hackers while Android and Windows Phone 7 stood the test. Charlie Miller, who is better known as Mr. Four-peat at the contest, took down iPhone with his colleague from Baltimore-based consulting firm Independent Security Evaluators (ISE), Dion Blazakis. Miller, who credited his team mate for the success, is a four-time champion (2008 through 2011).

RIM's Blackberry fell to a multi-national team. Vincenzo Iozzo, an engineer at Zynamics GmbH, Ralf-Philipp Weinmann, a post-doctoral researcher at the Laboratory of Algorithms, Cryptology and Security at the University of Luxembourg, and a third researcher from the Netherlands hacked the Torch. TippingPoint does not release the details of the vulnerabilities to public until the vendor has corrected the vulnerability. Pwn2Own winners are also forbidden from discussing the vulnerabilities. The contest also forbids them from releasing their attack code.

Phone hacking: The dark arts of Jonathan Rees

The collapse of a high-profile murder trial over evidential questions poses uncomfortable questions for the police. But the case is of much wider significance, since it poses equally difficult questions for the prime minister, for his former press secretary, Andy Coulson, and for all those at News International who have stuck to their claim that no one in the company – bar one rotten apple – had any knowledge of illegal behaviour by, or on behalf of, its journalists.
Jonathan Rees, who was yesterday cleared of murdering his former business partner, Daniel Morgan, is a private investigator of a particularly unpleasant and vindicative kind. In the late 1990s he was working for the News of the World, paid as much as £150,000 a year to use his dark arts to illegally trawl for personal information on the paper's targets. The work, which included bribing police officers, came to the attention of Scotland Yard's anti-corruption team, who bugged his office for six months. In December 2000 his newspaper work – which included work for the Mirror Group – came to a sudden and enforced halt when he was jailed for seven years after being caught planting cocaine on a woman. The aim was to discredit her prior to divorce hearings
Rees was one of four private detectives – all of them now convicted criminals – who are known to have been retained by the News of the World, apparently without the knowledge of a single executive. Rees's exploits were certainly no secret. They were written about in two articles published by the Guardian in 2002, while Rees was in prison. One of them named a News of the World executive, Alex Marunchak, who had been caught on tape discussing payments of thousands of pounds. Despite all this – Rees's links to corrupt police, his prison sentence, the publication of his links to, and payment by, the newspaper – he returned to work for the News of the World, now edited by Andy Coulson, in 2005 after he had left prison .
Rees was charged with murder in 2008, which meant that no newspaper could, until today, name him. But both David Cameron and Nick Clegg knew of the background to the story in early 2010, well before they entered Downing Street. The new prime minister chose to ignore it, appointing Coulson head of communications at Downing Street in May 2010. It was an extraordinary piece of bad judgment, and surprising that Clegg apparently did not demur or distance himself in any way. Did no one carry out any official vetting before Coulson was allowed across the doorstep of No 10? Or did Cameron and Clegg want the former Murdoch editor so badly that they pretended not to know, and ignored the ticking time bomb which exploded yesterday?
Meanwhile, what of Acting Deputy Commissioner John Yates, who was so quick to assure the world that there wasn't much to the phone-hacking stories uncovered by journalists on this and other newspapers? He has hired one of the UK's most notorious libel firms to warn off this newspaper for reporting the claim that he misled parliament. In a Commons debate this week, Chris Bryant, MP for Rhondda, made the direct accusation that Yates did, indeed, mislead two parliamentary select committees. Moreover, it was alleged that Scotland Yard has known for five months that its evidence was incorrect. The two committees involved should, as a matter of some urgency, invite the police to explain its position.
Until now most of the attention around phone hacking has centred on the activities of Glenn Mulcaire, who was jailed in 2006 for his work on behalf of the News of the World. Rees was actually paid more than Mulcaire and is alleged to have deployed a wider armoury of illegal methods to acquire information for his Fleet Street clients. Now that his name is no longer protected by court restrictions, another chapter in this disturbing saga of intrusion, power and criminality can be written.

Update 3.60 fixes PS3′s hacking woes?


This week’s software update 3.60 for the PS3 finally brought a Cloud saving service to the system. What Sony didn’t say is that it may have included a fix for its recent hacking problems, although that may only be temporary.
Some hackers are claiming that the update has stopped the PS3 from using the original root key that was hacked. While this prevents anymore hacking taking place, it’s also possible that the new key will simply be hacked too, sending the situation back to square one.
Will Sony be able to find a permanent solution to this problem?

Music Hack Day: Cracking the Code in New York

Tim Soter

Artists in this Article

Rick Astley
Girl Talk
Thirty-six hours, five hundred cans of Red Bull, 200 bags of pop chips and (maybe) the next great music app -- a New York Music Hack Day diary:

Saturday, Feb. 12, 10:30 a.m.: It's a cold, sunny day in New York. Hackers are sprawled across almost every inch of General Assembly (generalassemb.ly, @gnrlassembly) -- "an urban campus for entrepreneurs seeking to transform industry and culture through technology and design." Representatives from company after company take the mic to pitch tech and explain API (application programming interface) to a mostly male, mostly young, very eager audience. The space smells of coffee, but the energy in the air isn't driven by Stumptown alone‹there's a palpable energy in the airy, new-startup-centric office space; a desire to get cracking and get creating.

There's Italian lyric site MusiXmatch (@musixmatch). Berlin-based online audio distribution platform SoundCloud (@soundcloud). And Boston-area technology and research-focused music intelligence startup the Echo Nest (@echonest). Only one of the major labels is presenting‹Universal(universalmusic.com, @umg). The speaker talks about artist metadata API. And unfortunately, that metadata API doesn't turn out to be terribly in-demand;
only one person ends up using it in his hack. But Tony Huidor, VP of technical product development at Universal Music Group Distribution, says Universal will continue moving forward and working on its API.

"I want us to get smarter about tapping into the developer community, to expose the data, and move the business forward," he says. A few weeks later, Universal label Island Def Jam announced a partnership with the Echo Nest. IDJ's catalog will be made available to developers who employ the Echo Nest's API. The absence of many of the majors at New York Music Hack Day (nyc.musichackday.org) can be attributed in part to timing‹after all, it's Grammy weekend.
And in fairness, there weren't many independent labels at General Assembly. Michigan's Ghostly International (ghostly.com, @ghostly) took part, but few others were banging down the door. Many labels appear to have little idea what a Hack Day is, let alone how it could benefit them. At the very least, they could pick up some new ideas and maybe some new talent to grow their digital departments; but more importantly, they could gain a critical understanding of what makes this new and influential community tick.

After decades -- generations -- of operating on a closed system, being part of the hacking community would involve a massive rethinking for many labels. Hack Days are all about open sharing, swapping and building. And if, at the end of the day, someone makes something cool out of your code, well, more power to them. "This event," says Vickie Nauman, VP of North America for 7digital (@7digital), a U.K. digital media delivery company, "is every label's worst nightmare." But does it have to be that way?

The first public Hack Day (the name is something of a misnomer -- most Hack Days span the course of a weekend) was held in 2006 at Yahoo's headquarters, but kids have been getting together to write code and build new functions practically since the dawn of modern computing. SoundCloud VP of business development Dave Haynes (@haynes_dave) organized the first Music Hack Day in London in 2008.

"I'd started working at SoundCloud and was interested in other music startups like 7digital and Last.fm," he says. "I didn't know what I was in for when I started to organize the event, but . . . it was a success. Since then, there have been 12 Music Hack Days [around the world]."

Feb. 12, 3 p.m.: Before everyone splits into small working groups, hackers take the mic and talk about their dream projects: One guy mentions using genetics/DNA service 23andme (23andme.com, @23andme) to create personalized music recommendations, while another wants to make an Instagram (the photo-sharing program) for songs. Some of the presenting companies hold breakouts for those with additional questions. The representative from MusicXmatch talks more about the company's back story and its dealings with publishers.

"We went to them and asked to buy the rights, and they said sure. Then we asked for the lyrics . . . and we were told to go on the Internet," one of the founders says with a smile. "They own the rights to something they don't even have a copy of. We're at a point where in the future, we could be selling the music back to them."

In a small room at the back of the space, four young men slouch over laptops and toss around ideas. Bowdoin College student Hartley Brody, 20 (@hartleybrody) is down for the weekend -- he's a music blogger/Web developer. Next to him is Eric Vreeland (@vreeland), who lives in Boston and works for HubSpot, a marketing/Web analytics company. They're trying to figure out how to combine text messaging, song delivery and artist development. They slug Snapples, scribble on a whiteboard and every so often burst out with "Oh, yeah, we should offer analytics as well!"

John Britton (@johndbritton), who organized Music Hack Day in New York, looks a little like actor/blogger Wiley Wiggins and, should his job as an "evangelist" for Twilio (twilio.com), which "provides a Web-service API for businesses to build scalable, reliable communication apps," not work out, he could easily start his own cult. Britton's enthusiasm is infectious but not overbearing, and he makes writing code seem like the coolest thing since being a rock star.

"I originally wanted to do this for totally selfish reasons," he says, lounging on the sofa at General Assembly a week-and-a-half after the event. "My roommate is a great musician and a hacker, and I always wanted to jam with him and didn't know how. I did some research and found an open hardware device with a grid of buttons you can program. In the process of playing with it and learning about it I came across Music Hack Day. I e-mailed Dave and it all started there."

Britton says the February event surpassed his expectations. "The only thing I'd change is the capacity of the space," he says. "We had a huge demand and there was a waiting list to come to the demos." He also says he wishes more musicians who weren't so tech-savvy had come, and adds that he would've welcomed more labels, too. "We're not closed off to labels," he says. "This is something they really should be coming to."

Feb. 12, 9:30 p.m.: Brief dinner break. Several hundred cheese pizzas. Though, in the spirit of the event, there are a number of toppings so each can be customized. Brooklyn's DJ Rupture (@djrupture) sets up to spin at the party to celebrate the "end" of day one, even though many hackers will continue working through the night. Rupture (born Jace Clayton) grew up in Boston and says he has known Brian Whitman (@bwhitman), a co-founder of the Echo Nest, for a while. Clayton often writes about the intersections between music and technology and is currently raising funds on Kickstarter for a music and film project called "Beyond Digital Morocco." While Clayton himself isn't a programmer, he embodies the spirit and goals of Hack Day‹bringing together seemingly disparate elements to create something new.

The majors aren't totally mired in the dark ages. Many of them are actively engaged, at least in certain areas. "All four of the majors are our customers," Echo Nest director of developer platform Paul Lamere (@plamere) says. "They are very interested in data." The Echo Nest was a major presence throughout the event‹volunteers were clad in matching velour jumpsuits, ensuring the event ran smoothly, and some Echo Nest staff are already at work on a Music Hack Day to be held in the San Francisco Bay Area in the spring or summer.

Sunday, Feb. 13, 3:30 p.m.: Day two. There's still excitement in the air, although it's mixed with a slightly funkier aroma. The hacking has gone on all morning, and the wiki has filled up with demos -- 72 in all. The hackers have two minutes each to wow a jam-packed room with a new creation.

Hacks fly by, and even the slightly bungled presentations, or those handicapped by uncooperative technology, dazzle. There's "tweets on beats," which sets a tweet to a beat, and a call-in karaoke game. A few minutes later, an app that synchs a person's heartbeat with music -- and when the heartbeat gets too slow, the person is "Rickrolled" and leaves this life listening to Rick Astley.

One person presents a program that uses face recognition, connects to Facebook and decision-making website Hunch, then finds songs a user will probably like. Another showcases Beat Parade‹a computer program that does everything mash-up musician Girl Talk does except dance around wearing American Apparel. While these seem like larks, labels could possibly use and perhaps monetize them; publishers could possibly make a fortune from the karaoke game, and the facial recognition app might just be a social media marketer's dream come true.

"Music is something people are passionate about," Union Square Ventures principal Fred Wilson says. "The focus on music made the hacks easy to showcase. If people had been hacking on huge data sets, it would not have been as easy to do all this in a weekend."

But what if something that was done that weekend had caught Wilson's eye, so much so that he was ready to invest? He says that's not really the point. "A lot of these things don't turn into companies," he says. "They're more like senior thesis projects, a proof of concept. Recruiting is a big part of all these events."

Jim Lucchese, who was a music lawyer at Greenberg Traurig specializing in music and digital media deals before becoming CEO of the Echo Nest, says that most companies that provide APIs are happy to strike deals with developers, should their apps start to turn a profit.

"The terms of the API could state that it is free for noncommercial use and there is a cost for commercial use," he says. "If someone uses an API to create an app that then starts to turn a profit, they would do a licensing deal with the company. It could be a revenue-share deal or a licensing fee. And if the developer feels the terms of the deal are too greedy, they can find another source for the data."

This attitude stands in stark contrast to the traditional music industry, where using someone's copyrighted material, for free or not, will trigger a lawsuit faster then you can say "sampling." Nonetheless, collaborative, open-sourced, sharing‹these are ideologies embraced not only by the tech-savvy kids at Music Hack Day, but a whole generation for whom remixing, remaking and customizing is second nature. A report released last year by consulting firm Accenture found that globally, about one-half of millennials have accessed online collaborative tools, online applications and open-source technologies when they found their workplace technology lacking. One can only imagine that the percentage who do so for personal use is even greater.

It's too soon to say whether Hack Days have changed the music business on a grand scale. But just because a hacker has yet to invent an iTunes killer, or an app that tracks down illegal downloaders and makes their computers explode, doesn't mean hacking isn't influential, and a huge part of the future of the music business. If labels embrace the hacker community, they might be more privy to cutting-edge thinking and innovation. The first label that rolls out an artist app with Foursquare integration would surely be ahead of the game.

Feb. 13, 6 p.m.: All 72 hacks have been presented, and the prizes are being announced. Third place goes to Stringer, which allows users to play instruments through Xbox 360's Kinect. Second goes to DJtxt, which allows users to collaboratively build a playlist. First prize goes to an invisible violin.

As the gathering breaks up, hackers stream out from General Assembly, some toward bars on Union Square, others toward a hot shower and bed. But most are going to continue hacking, continue creating. They'll keep on trying to change the music industry -- one keystroke at a time.

iPhone, BlackBerry Hacked At Pwn2Own Contest


On the second day of the Pwn2Own hacking competition at CanSecWest in Vancouver on Thursday, Apple's iPhone and RIM's BlackBerry fells to determined attacks by security researchers.
Charlie Miller, a security expert with Independent Security Evaluators who has previously hacked Macs at Pwn2Own, compromised an iPhone 4 running iOS 4.2.1.

AlertSite's Deja Click is a free plug in for Firefox that records end-user web experiences. You can also use it as a professional monitoring service (that part isn't free). The company has added script sharing, which allows for collaboration.
According to ZDNet, Miller developed the exploit with the help of colleague Dion Blazakis.
Just prior to the contest, Apple released iOS 4.3, which reportedly protects against the exploit, thanks to the addition of a security technology known as ASLR (address space layout randomization). ASLR, also used in current versions of Windows, makes the location of data and code in memory unpredictable, which makes exploitation more difficult.
Learn key findings and recommendations from Gartner Research
Using Social Media to Drive Sales, Marketing and Customer Service
The vulnerability itself, however, remains unpatched, despite the fact that Apple fixed 59 vulnerabilities in its iOS 4.3 release.
Three other researchers, Vincenzo Iozzo, Willem Pinckaers and Ralf Philipp Weinmann, compromised a BlackBerry using a flaw in the open source WebKit browser engine. RIM just recently integrated WebKit. Looking for vulnerabilities in WebKit makes a lot of sense for security researchers because the code is also used by Apple and Google in their browsers.
Iozzo told ZDNet that the major challenge with the BlackBerry was security through obscurity -- the researchers had trouble finding information about the device. Iozzo reportly characterized BlackBerry's security as "way behind the iPhone" due to the lack of ASLR or DEP (data execution prevention).
A researcher who was planning to try to hack a Dell Venue Pro running Windows 7 Phone withdrew at the last minute, though he may try again, according to The Register. No one has said they intend to attempt to break into a Samsung Nexus S running Android.
On Wednesday, security researchers managed to compromise Apple's Safari browser and Microsoft's Internet Explorer browser. No one tried to hack Firefox or Chrome.
Pwn2Own is sponsored by TippingPoint, a division of HP.

Cutting-edge attacks like Stuxnet and Zeus will be the everyday exploits of the future. Here's what you need to know. That and more--including five best practices to improve the budgeting process for security spending--in the debut all-digital issue of Dark Reading. Download the issue now (free registration required).

Nick Davies email to Andy Coulson on phone hacking


Nick Davies, the Guardian journalist who revealed the News of the World had made a series of legal payments to hide the full extent of the phone-hacking scandal, wrote to the paper's former editor Andy Coulson on 23 February last year.
He put a series of allegations to Coulson, who was then head of the communications for the Conservative party. At the time of Davies' letter, the Guardian could not reveal the full extent of the phone-hacking affair because one of the private investigators who had worked for the paper was facing a murder charge.
The email containing the charges was sent two months before the general election. Both David Cameron and Nick Clegg – later to be prime minister and deputy prime minister – knew about the allegations. Despite that, Cameron appointed Coulson as his director of communications in Downing Street in May 2010. Coulson resigned in January this year.
Coulson replied from Conservative Central Office on 24 February with a single sentence saying: "I have nothing to add to the evidence I gave to the [Culture Media & Sport] select committee in July [2009]."
Andy,

I'm working on a piece for Thursday's paper, looking at your role at the News of the World during the time when various private investigators were obtaining information for the paper by illegal means.
In relation to two of these investigators, Steve Whittamore and Glenn Mulcaire, both of whom have been convicted of illegal information-gathering, I have the transcript of your evidence to the select committee in which you dealt in some detail with questions about them, and I will refer to that in what I write.
Can I ask two further questions in relation to Whittamore?
First, in April 2005, he and three other men pleaded guilty at Blackfriars crown court to taking information from the police national computer and selling it to three newspapers, one of which was named in court as the News of the World, of which you were then editor. This conviction was reported in national news media. Can you tell me whether you became aware of this at the time and, if so, what steps you took to investigate the involvement of your journalists in this illegal activity?
Second, the professional standards department of the Metropolitan police conducted a lengthy inquiry into one of the men who was convicted alongside Steve Whittamore, an investigator called John Boyall, who had been assisting in the illegal procurement of information from the police national computer and who had worked regularly for the News of the World. Are you aware that, during that inquiry, Met police offices arrested your then assistant editor (news), Greg Miskiw, and questioned him about his commissioning of Boyall to supply this illegal information and also about his alleged payment of cash bribes to staff working for mobile phone companies? If you were aware of this, can you tell me what steps you took to investigate and prevent a recurrence?
There is a third investigator whose activities I plan to describe who was mentioned only in passing at the select committee, and I wanted to give you the chance to respond to the points which I am thinking of making about him. This is Jonathan Rees, whose agency Southern Investigations worked for the paper from the mid-1990s up until December 2000 and then again from 2005 up until your departure. Can you tell me:

• Whether you were aware that in December 2000, in a nationally publicised trial, Rees was jailed for six years, extended to seven years on appeal, for conspiring with a corrupt police officer to plant cocaine in the car of a woman so that she would lose custody of her children to her husband, who paid Rees to achieve this end?

• Whether you were aware that in September 2002, the Guardian published two lengthy stories, running to a total of more than 3,000 words, exposing Rees's involvement with corrupt police officers, naming the News of the World as a regular recipient of information obtained by Rees from these corrupt officers, explaining that Scotland Yard had been so concerned about his involvement with corrupt officers that they planted a listening device in his office and that they concluded in an internal report that Rees and his agency "have for a number of years been involved in the long-term penetration of police intelligence sources. They have ensured that they have live sources within the Metropolitan Police Service and have sought to recruit sources within other police forces. Their thirst for knowledge is driven by profit to be accrued from the media?"

• Whether you were aware that, in spite of all of the above, Rees was hired again by the News of the World, after his release from prison, when you were editor, and paid from your editorial budget to carry out more work for the paper and that this work continued to involve the use of illegal methods?

I should add that Rees is currently in custody, awaiting trial for conspiracy to murder, and, for that reason, I will not name him nor publish any detail which might identify him. But, based on legal advice, I intend to raise the points which I have mentioned and look forward to your response to them.
Finally, the thrust of the piece as a whole is that your statement to the select committee, that you had never had any involvement at all in any form of illegal activity at any stage in your career as a journalist, is one which remains in doubt, largely as a result of the sheer scale of the illegal activity which was being conducted by private investigators in the pay of the News of the World during your time as deputy editor and editor. The core of this is whether it is conceivable that you were unaware of the explicit invoices which were being submitted, the considerable amount of money which was being spent, the considerable amount of information which was being supplied for stories which you were supervising, the number of your journalists who were directly involved in handling this information.

Many thanks
Nick