Bits: Wall Street Journal Leak Site Works on Fixes

May 7, 12:29 a.m. | Updated Updating Qualys’s rating of SafeHouse’s encryption.

The Wall Street Journal on Thursday introduced SafeHouse, a Web site that takes a page from WikiLeaks by inviting whistleblowers to submit tips and documents. But within hours, security researchers were challenging the notion that the site was safe for leakers. And on Friday, The Journal said it was rushing through technical changes to address the problems.

According to the researchers, the way SafeHouse uses Web encryption technology known as HTTPS opens the site up for attacks, and is not rigorous enough for a site that handles highly sensitive communications. They also said they were troubled that SafeHouse used Adobe Flash for uploading documents, a technology that can help strip leakers of anonymity.

The problems were the subject of a barrage of messages on Twitter on Thursday afternoon by Jacob Appelbaum, a developer for the Tor Project, which provides tools for anonymous online communication used by dissidents, whistleblowers, journalists and others. Mr. Appelbaum was formerly associated with Wikileaks. “Pro-tip: if you’re going to create a document leaking website – have a clue!” he wrote.

The Journal said in an e-mailed statement that it was taking the issues raised “very seriously” and that it would end its use of Flash within 48 hours. “In addition, our system has been updated to limit the types of less secure connections it will accept,” it said.

SafeHouse’s terms of service encourage whistleblowers to improve their security by using tools like Tor that provide anonymity. However, both Mr. Appelbaum and Peter Eckersley, a senior staff technologist at the Electronic Frontier Foundation, a digital rights group, said Adobe Flash defeated? those tools.

Mr. Eckersley said the problem was with a Flash feature called Flash Socket Class, which would allow SafeHouse to discover a user’s real IP address, regardless of any anonymizing technologies that might be in use. As such, The Journal could identify people who upload documents, or be forced by the government to do so. News organizations like The Journal are accustomed to protecting sources, including from the government, but having the information could open it up to legal difficulties.

The E.F.F. said that it raised its concerns about Flash Socket Class in March 2010 with Adobe’s chief privacy officer, MeMe Rasmussen, and that the company said the issue would be hard to fix but that it would work on it. An Adobe spokeswoman was not immediately able to provide comment.

The way HTTPS is used by SafeHouse would not be problematic for an average Web site, said Ivan Ristic, director of engineering at Qualys and founder of a research effort called SSL Labs. However, it did not cover all the bases necessary to ensure that a user couldn’t be fooled into engaging in unencrypted communication.

Dan Kaminsky, chief scientist at the security firm DKH, said even major banks did not use the advanced technologies in question. Those technologies are “nice to have,” but can cause other problems, he said, and their absence does not make a site unsafe.

Mr. Ristic said it was also troubling that SafeHouse was using algorithms known as cipher suites that are not strong enough to ensure that recorded communications cannot be deciphered later if the key to them is somehow obtained.

On Friday afternoon, Qualys was giving SafeHouse a grade of B on its use of encryption, in large measure due to poor cipher strength. But by Friday evening, its use of cipher technology was getting higher marks, and Qualys raised its grade to an A.

“Hopefully we’ll see this WSJ site moving toward a truly secure deployment,” Mr. Eckersley of the E.F.F. said. “That kind of i-dotting and t-crossing is necessary to be safe against some of the attacks we’ve seen used against HTTPS Web sites in recent years.”

View the original article here

Wall Street Indexes End the Week on the Upside

The market’s three main indexes have been climbing steadily in recent weeks as quarterly results trickled out and proved better than expected in many cases.

While the one-day gains on Friday were minimal, they were enough to build on past advances and to push the broader market and the Dow to their best monthly performances this year.

The dollar, on the other hand, declined against its index of six currencies to a three-year low, said Brian Dolan, the chief currency strategist at Forex.com.

The euro was at $1.4839 on Friday, up from? $1.4821 on Thursday.

“It is weak across the board,” said Mr. Dolan of the dollar. “U.S. interest rates are low and going to stay low, and other central banks are tightening. There is very little on the fundamental horizon to alter that downtrend.”

But corporate results have surpassed many forecasts.

About 300 of the companies in the Standard & Poor’s 500-stock index have reported quarterly results so far, and nearly 80 percent have said sales and operating earnings were higher in the first quarter than they were in the quarter a year ago, according to a survey compiled by Howard Silverblatt, the senior index analyst at Standard & Poor’s.

Russell T. Price, the senior economist for Ameriprise Financial, said the first quarter had suffered some economic and financial shocks from the disaster in Japan and the higher oil prices fueled by turmoil in the Middle East and North Africa.

But he said quarterly results were “coming out so much better than expected.” He added, “It is a pretty good indication that corporate America is able to deal with the headwinds.”

Some companies benefited from the higher oil prices. Energy shares in S.& P. were up more than 1 percent on Friday.

Exxon Mobil released results on Thursday that reflected an increase in higher oil prices in the first quarter, reporting a 69 percent rise in net income to $10.7 billion, or $2.14 a share. Its shares rose less than 1 percent to $87.98.

Occidental Petroleum rose 8.71 percent to $114.29 after it reported on Thursday that profit rose to $1.55 billion, beating forecasts.

Industrial shares were also up.

Caterpillar, the heavy equipment maker, climbed more than 2.4 percent to $115.41 after its first-quarter income of $1.23 billion a share topped Wall Street’s expectations.

The Goodyear Tire and Rubber Company was 12.04 percent higher at $18.15 after reporting a profit that was four times greater than forecast.

The markets were also partly lifted this week by the Federal Reserve statement on Wednesday that it would continue to stimulate growth with low interest rates.

The Dow Jones industrial average closed up 47.23 points, or 0.37 percent, at 12,810.54, a nearly 4 percent rise in the month and its best close since May 2008. Eighteen of the 30 components rose.

The S.& P. was 0.23 percent, or 3.13 points higher, at 1,363.61, in its highest close since June 5, 2008. It rose 2.85 percent in April, its best monthly advance this year.

The Nasdaq was 1.01 points higher at 2,873.54, weighed down by Microsoft, which reported that its third-quarter profit was up 31 percent, but that revenue from the division that includes the Windows operating system fell 4 percent.

Microsoft was down by 2.96 percent at $25.92. Research in Motion, the maker of the BlackBerry, was down by about 14 percent at $48.65 after it lowered its forecast for the current quarter.

The market has also been assessing the latest indicators of growth and spending this week. The government reported on Thursday that the economy grew at a rate of 1.8 percent in the first quarter. Consumer spending increased 0.6 percent in March.

Interest rates were lower. The Treasury’s benchmark 10-year note rose 7/32, to 102 26/32, and the yield fell to 3.29 percent from 3.31 percent late Thursday.