100大高速連線城市香港排名第二位，攻擊流量排行第46位

Akamai發表2010年Q1互聯網發展概況報告

雲端服務供應商 Akamai Technologies, Inc.發表2010年第一季互聯網發展狀況報告，分析攻擊流量、寬頻採用率和流動連線等重要互聯網統計數據，洞察現今互聯網發展狀況及趨勢，該報告的數據來自其全球網絡伺服器所搜集的資訊。

撮要

• 全球三大高速連線城市：南韓、香港及日本；南韓的最高連線速度上限達 33Mbps
• 歐洲城市佔據了十大城市之中的六個位置，全部的連線速度上限均超過15Mbps
• 美國僅有一城市擠身十大的第八位，連線速度上限為16Mbps。
• 全球攻擊流量排行榜：俄羅斯(12%)、美國(10%)及中國(9.1%)，隨後是台灣、巴西和意大利。香港排第46位。Windows file share(TCP 445埠)是最被針對的服務
• 全球互聯網滲透率迅速上升，季度增長幅度增加75%
• 亞洲於排行榜內獨領風騷，超過半數(61)榜上城市位於日本。
• 只有12個美國城市上榜，其中超過一半位於加州。
• 瑞典的烏美亞是歐洲網速最高的城市，於100個上榜城市中，排第18位。

原圖：http://www.akamai.com/stateoftheinternet/

---

後記
本人(梁兆昌)得指出，Akamai的報告祇比較各國家或經濟體的「高速連線」發展，看的僅是通訊基建，如果要看一個地方的競爭力，我們還要看其他的體系，例如法治、金融、科技、教育、衛生健康，最前列的經濟體系還要在創意和業務的細緻程度有所突破。世界經濟論壇(World Economic Forum )每年出版的環球競爭力報告對此有深入的分析，詳情可見本人的文章香港競爭力的危機 : 環球競爭力報告2009-2010的啟示

雲端運算的新旗艦和私隱的擔憂 —— 談Google公共DNS服務

Google在2009年12月宣布染指DNS服務[1]，引起廣泛關注。

Google公共DNS服務是免費的，現在試驗階段祇提供對個人用戶的服務，相信能吸引用戶和中小型企業。Google公共DNS是雲端運算的其中一個層次 —— 基礎設施即服務 (IaaS, Infrastructure as a Service)。雲端運算的特點，是用戶不需要了解「雲端」中基礎設施的細節，不必具有相應的專業知識，也無需直接進行控制，只關注自己真正需要什麼樣的資源以及如何透過網路來得到相應的服務。

個人用戶的DNS伺服器設定，通常指向ISP的DNS伺服器；要使用 Google 公共DNS服務，就得以手動設定，將主要DNS伺服器指向Google公共DNS伺服器的IP地址8.8.8.8或8.8.4.4。(見圖1)

圖1

相較ISP的DNS服務有甚麼特別？

一個網站的內容，無論是文字、圖片及其他多媒體，都可能來自多個來源；入門網站就包括很多外嵌入的內容如股票走勢、天氣慨況、熱點消息和廣告等。所以，個別網頁的下載是涉及從多個來源下載個別的文字和媒體資源。瀏覽器從主網頁知道這些資源的URL後，先要詢問自己ISP的DNS伺服器，URL上的機器名稱(host name)的IP地址是甚麼，ISP的DNS伺服器會代為向資源所授權的DNS伺服器詢問，將回覆轉告用戶，用戶然後向資源的伺服器(的IP地址)發出下載的請求。ISP的DNS伺服器通常會把回覆的資訊放在快取記憶一段時間，方便再有類似查詢，無需重覆再問。

由Google提供的網頁下載時間分析(見圖 2)，可以見到DNS查詢(深灰色)對用戶的整個等待時間其實有顯著的影響，在ISP的DNS伺服器的快取記憶無請求的資訊時，是要向外查詢，ISP網絡和外間網絡的網絡距離和頻寬，都直接影響回應的時間。

圖2. Google 提供的網頁下載性能分析

Google利用資訊基建的規模和分散性覆蓋的優勢，提高公共DNS服務的效能和可靠性。透過anycast 技術，同一個DNS伺服器IP位址8.8.8.8，在不同地區是會指向不同的實體伺服器去，「梗有一家在附近」，讓用戶能夠獲得更快捷，更可靠的DNS服務。

一般用戶未必留意到，Google公共DNS服務是支援 IPv6 的，而且設計上對保安的攻擊的抵禦能力較高。記得在12月18日，很多用戶發覺 Twitter.com 網站的模樣完全不同了，還以為是網頁被駭了？原來，被駭的是Twitter的DNS伺服器，駭客透過更改上面的記錄，欺騙用戶到錯誤的IP地址，由此可見DNS保安的重要性。有關Google公共DNS服務的保安分析，可以參考我的博錄(Blog)文章[2]，此處不贅。

回到Google公共DNS服務，試想想，若果所有用戶探訪任何網上資源時，都先問Google DNS，那麼Google將掌握甚麼樣的統計數字？造就些甚麼商機？我相信在將來Google會利用DNS提供增值服務，就像OpenDNS一樣，例如，網站市場調查、過濾垃圾電郵來源網域、過濾不安全內容，這些服務對企業應該會很吸引，會成為Google 繼搜尋器之後的另一旗艦。


私隱及服務承諾的問題

公共DNS服務雖然很棒，用戶無需瞭解它內在的複雜性，就可以應用自如。但是，正如其他的雲端運算服務一樣，因為用戶對它的背後的運作概念模糊，又豈能百分百安心呢？

例如，雖然大家都對Google服務的可用性(availability)有一定信心，但還是會問，如何確保服務水平和管理當機時間呢？原來，Google在服務條款中已講明對服務水平沒有任何承諾，還勸喻用戶要設定次要(secondary)DNS伺服器作為後援，指向自己的ISP或內部的DNS伺服器。

至於私隱問題，大家都知道，DNS日誌內記錄的是用戶採訪的網域(domain)足跡和歷史，雖然日誌不記錄網頁的內容，但是「畫公仔唔使畫出腸」吧。Google的私隱政策[3] 說明，他們保存兩套日誌：臨時日誌存儲用戶的完整的IP地址，但祇保留24至48小時；永久保存的日誌有用戶的地理位置和網絡資料，但沒有個人身份或IP地址資料。表面看來，私隱政策已嘗試照顧問題。然而，Google又如何能提供透明度，以確保隱私政策被貫徹執行。再者，在不同的國家，執法機構或部門都可以要求Google繞過私隱政策，提供涉及私隱的資料以配合調查，Google公共DNS不就是網絡的跟蹤器？

那麼，你的個人資料若在香港受到法律保護，但放到「雲」上，又是否受到相同的保護？答案是不。原來，本港《個人資料（私隱）條例》第33節雖然涉及有關個人資料流出境外的監管，可是現時還未立法，為跨境因為提供的保護。

隨著世界不斷邁向網絡社會，電子商貿日趨發達，個人私隱資料洩漏的風險正以級數上升，一些國家已自行立法，或依據《歐盟數據保護指令》和《歐洲委員會公約》第108條立法，監管跨境的個人私隱資料。2009年11月，全球40多個國家的100個以上的民間組織和關注私隱權的專家，發起《馬德里宣言》[4]，呼籲國際社會正視私隱的問題，更具體提到未符合《歐洲委員會公約》第108條的國家應從速立法。我和IT呼聲的朋友，就《個人資料（私隱）條例》諮詢提交意見書[5]之中，就敦促香港政府早日為33節立法。 世界上的私隱保障條例還未到位的一天， 公用的雲端運算服務，如Google公共DNS服務的私隱問題，始終是個隱憂。

作者：梁兆昌
本文見於 《PC3 Corporate 2010 Mar》

參考：
[1] Google Gets Into The DNS Business. Here’s What That Means"
http://www.techcrunch.com/2009/12/03/google-dns-opendns/

[2] Google Public DNS – Security and Privacy Analysis
http://itvoice-hk.blogspot.com/2009/12/preliminary-security-privacy-analysis.html

[3] Google Public DNS: Privacy Policy
http://code.google.com/speed/public-dns/privacy.html

[4] Madrid Declaration
http://www.privacyinternational.org/article.shtml?cmd[347]=x-347-565563

[5] IT Voice’s Response to Public Consultation on Review of the Personal Data (Privacy) Ordinance
http://www.itvoice.hk/documents/submissions/2009-11_on_pcpo_review.pdf

Google Public DNS -Security & Privacy Analysis

Author: S.C. Leung
Google announced provision of free Google Public DNS service [1]. It is now in experimental stage targeting individual user only. Google Public DNS service is part of Google's cloud computing initiative to make Internet services available anywhere at any time.

It has a far reaching impact to the Internet after Google goes into the search engine business. Here is my preliminary analysis from information security & privacy perspective.

Performance and Availability
With the vast and distributed points of presence, clients are able to obtain more speedy and more resilient DNS services via geo-location awareness load balancing (technically using anycast), cache and prefetch name resolution. [2]

Comments: Just as the GMail service, Google has a wonderful resilience in infrastructure that corporations cannot generally afford. However, Google has no commitment on service level and you are always advised to have a secondary DNS pointing to your own ISP or internal DNS server.

Security
Google Public DNS has designs against spoof attacks leading to DNS cache poisoning. [3]

• filter out malformed queries and responses.
• use more randomness of source ports and responding DNS servers
• randomly vary the case of letters in domain names queried by "0x20 technique" [4] to reduce chance of spoofed response.
• remove duplicate name queries are removed to mitigate birthday attacks (spoofed flooding response to increase chance of hit)

Google Public DNS has designs against Denial-of-service (DoS) and amplification attacks [3]

• rate limiting of outgoing queries to name servers
• rate limiting of outgoing responses to clients

Comments: These security measures are very carefully designed to combat the most current DNS attacks. Note that, however, there is a limitation in Public DNS. It can only accept and forward DNSSEC requests but CANNOT validate DNSSEC responses. When DNSSEC is popularizing we need to keep an eye on this.






Privacy
Everyone knows that a log of you DNS queries is merely the same as a log of your web access habit without the content involved. Another Google service Safe Browsing was challenged by a researcher RSnake of potentially infringe clients' privacy by collecting client machines' browsing history[5]. Will that happen to Public DNS? What does Google log?

The Privacy Policy [6] specifies that they stores two sets of logs: temporary and permanent. Temporary logs (kept within 24-48 hours) store the user's full IP address so that Google can spot potentially bad things like attacks and fix problems like particular domains not showing up for specific users. The permanent log has no personally identifiable information or IP information but user's geolocation and ISP (AS number). Google will not correlate user's use of other services, like Search and advertisement.

Comments: The Google privacy policy has looked into the privacy concerns properly. However, as in cloud computing, how can they provide the transparency to assure the privacy policy is followed closely. Secondly, we also need to take into account the overriding conditions that may apply if Google is asked to cooperate with law enforcement agencies or authorities. Google not only keep track of everything you search, but every address you are visiting. Depending on which country you live in, government agencies have various powers to compel online service providers, such as Google and your ISP, to give them whatever information they might have about your identity and activities. For US, the post-9/11 Patriot Act made it easier for law enforcement agencies to get this information. Other governments will learn to get have access to such widespread surveillance powers for reasons they see fit. [7]


Other Comments

1. We need to be aware that DNS server is a key infrastructure for the directory of information on the Internet. Controlling DNS can directly control information access. Moreover, if a client cannot access an information repository, he has no knowledge if that information repository is unavailable or the name resolution is denied by the DNS server. So a key for freedom of information access is to guarantee that Google does not implement any kind of filtering without user authorization. Google has acknowledged this [1] but should have more transparency on this.

2. As with Google's Safe Browsing service, Public DNS can be used to filter against malware and phishing. It could be a future revenue stream, like Google's competitor OpenDNS. Besides, similar technology can be applied to pornography and gambling filtering for parental care. Once filtering is added, we have to look at how these services could impact freedom of information access and privacy.

3. Fast flux DNS technology is widely used by botnets to provide dynamic DNS resolution of malicious web sites to evade investigation. With Public DNS, Google can play an active role in malware and botnet detection through analysis of the DNS server responses. The information would be very useful for the security community.

4. Last by not least, I like to point out the importance of diversity as commented by the CEO of OpenDNS[8]. From Chrome OS at the bottom, to Chrome browser, and to Google Search at the top, Google is running the end-to-end infrastructure. Google is the largest advertising company in the world. Do we want Google to keep control over so much of our Internet experience? How can we preserve a heterogeneous Internet with lots of parties collaborating to make this thing work.


Back to Top

Reference:

[1] Google Gets Into The DNS Business. Here’s What That Means"
http://www.techcrunch.com/2009/12/03/google-dns-opendns/

[2] Google Public DNS: Performance Benefits
http://code.google.com/speed/public-dns/docs/performance.html

[3] Google Public DNS: Security Benefits
http://code.google.com/speed/public-dns/docs/security.html

[4] Use of Bit 0x20 in DNS Labels to Improve Transaction Identity
http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00

[5] Google Safe Browsing Feature Could Compromise Privacy
http://www.darkreading.com/security/privacy/showArticle.jhtml?articleID=218800199

[6] Google Public DNS: Privacy Policy
http://code.google.com/speed/public-dns/privacy.html

[7] You Have Zero Privacy Anyway -- Get Over It
http://www.osnews.com/story/22603/You_Have_Zero_Privacy_Anyway_--_Get_Over_It/

[8] Some thoughts on Google DNS, by David Ulevitch, Founder of OpenDNS
http://blog.opendns.com/2009/12/03/opendns-google-dns/

IT Voice response to consultation on CERC Review

IT Voice response to consultation on CERC Review

Date: 14--Nov-2008

Background

1. We, IT Voice and Charles Mok had expressed our concern in the past few years abut the information security development of Hong Kong.

• When the ITC's 3 year funding for HKCERT ended in 2004, the future of HKCERT had been a mystery. There is no answer to the direction of HKCERT and no clear funding sources. The obscurity had impacted the sustainable and continuous development of information security incident response service in Hong Kong.
• This was worsen by a sharp increase in information security threats like botnet and cyber crimes in the past few years.
• Under the mega trend of globalization, Hong Kong is facing keen competitions with neighbouring and farther economies. The fact that our CERC development was brought to a standstill for several years had impacted our competitiveness.
• In a recent global information security survey 2008 conducted by McAfee, “.hk” is posed as the most risky domain space in the world. The reputation of Hong Kong was at stake! We recalled that when HKCERT was funded by ITC several annual security surveys were made available to track the progress of the industrial information security development. However, in recent years, Hong Kong has no relevant survey to verify such third party claims.
• Furthermore, Hong Kong lacks proactive monitoring of security threats to preempt attacks targeting Hong Kong. It was reported in the APCERT Conference 2008 that many CERT teams in Asia Pacific economies have very mature security threat monitoring system and malware analysis capabilities. Hong Kong has been left behind.

Comment

1. We welcome Government admitting the essence of a CERC in Hong Kong (para. 12) and has expressed explicitly to commit to the financial support for CERC. (para. 14).

2. We agree that the current CERC in Hong Kong, namely HKCERT, to continue to operate under HKPC which is a non-profit making entity. (para. 13)

3. We agree to the service scope of HKCERT (para. 15) but also like to point our insufficiencies.

• We propose that HKCERT should keep up with the advancement of CERTs in the world. There should be more investment in security threat monitoring in Hong Kong to collect information of attacks targeting Hong Kong and also use the information to preempt any attacks. We emphasize the implementation of security monitoring or study should not jeopardize privacy.
• Due to the increasing complexity of security attacks, Government should conduct much more information security awareness activities to the public and SMEs. HKCERT should be one of the Government's major partners in the promotion campaign.

4. We agree that there should be transparency on the operation of HKCERT to the industry sector and the public (para. 17(a)) by publishing business reports periodically to the HKCERT web site.

5. Contrary to the proposal in para 17(b), we think that the Government should be giving strategic direction the HKCERT and set our performance metrics. HKPC senior management should only be the operation management of the activities as directed by the Government. CERC service should be regarded as crucial part of the municipal security defense strategies. It is not appropriate to leave the CERC service in the hand of the operating organization.

• We propose that the Bureau heading the strategies of HKCERT, with input from the D21 Strategic Committee which is advised by the Information Security Working Group. The D21 Strategic Committee comprises of different stakeholders and the Information Security Working Group comprises of experts in the area.
• The Information Security Working Group should hold regular meetings and advise the Government strategies and directions of information security development in Hong Kong.
• There should be transparency on the information security development strategies (which includes the part for CERC) to the public.

IT議員選委提施政報告建議

IT 呼聲今天聯同IT界立法會議員單仲偕及選委莫乃光，向即將於下月發表首份施政報告的第三屆特區政府提出46項施政報告建議，促請政府促以締造香港成為資訊無間斷的數碼都會為目標，增加政府未來對科技的投資和承擔，維持香港的競爭力。
多達46項政策建議可分為數部份，包括(1)發展以使用者為本而互動的新一代電子政府、(2)推動電子醫療、(3)強化IT產業發展、(4)提升基建科研、(5)加強資訊保安、(6)培育科技人才、(7)推廣科技應用、(8)打破數碼隔膜，以及(9)廣播政策。

如欲觀看報告全文，請按此鏈結。


以下是簡要：

「資訊科技是香港成功轉型為知識型社會的重要動力，這是不爭的事實。預計新一份施政報告將會勾劃曾蔭權政府未來五年的施政藍圖，因此我們期望他在施政報告中肯定和承諾對科技的支持。而我們的建議，旨在積極推動社會各層面和各階層更廣泛應用IT，並促進IT業的長足發展，使香港成為真正資訊無間斷的數碼都會。」單仲偕說。

身為IT界選委的莫乃光認為，電子政府和電子醫療是「首要項目」。「Web2.0是最新最流行的互聯網技術，看看最多人流的網站、Blog、網絡社群工具，全部都強調互動和具備個人化功能的服務。為了配合知識型社會的市民的需要，提升電子公共服務的質素，我們的電子政府服務不能再限於單向的資訊傳遞，而是為市民提供更開放的平台和渠道直接參與公共事務。只有這樣，才能有助達到政府所想的有效管治。」
至於電子醫療方面，身兼醫管局成員的莫乃光認為香港人口日趨老化，推動全天候的電子醫療服務有助保持本地的醫療服務質素和效率，紓緩醫護人員的壓力。他建議盡快提升診療管理統，並成立適用於公私營醫院及診所的全港電子病歷系統。
因應政府即將推出的WiFi計劃，單仲偕建議當局推出如圖書館／公園無線電子導賞等位置定位(location-based)服務，並開放現時由政府不同部門持有的位置定位數據資訊(location information)，刺激私人市場開發具創意及切合消費者需要的位置定位技術和服務。
另一位IT界選委宋德嘉(IT呼聲成員)較關注政府的資訊保安政策。他指出特區政府從來欠缺一份全面而長遠的資訊保安政策。「現時，政府可說是只把資訊保安當公眾教育工作來做，無論在本地或區域層面，特區政府在保障資訊安全所擔當的角色和功能都十分模糊。事實上，當社會越依賴互聯網，資訊保安就越重要，甚至應把涉及重要基建(critical infrastructure)的資訊保安視為公共安全。」宋德嘉建議，政府應盡快訂立資訊保安政策，並增撥資源推行網絡威脅監察系統，更主動地監察互聯網的潛在保安風險，保障社會的網絡安全。
此外，數碼隔膜也是單仲偕和多名選委的關注重點。「儘管IT在香港社會看似十分普及，但截至去年中，低收入家庭擁有個人電腦和接駁上互聯網的比例，仍遠較中產及高收入家庭擁有個人電腦的比率為低，反映政府在這方面仍需努力。把互聯網接駁費納入綜援的基本生活開支項目之一，協助志願團體把二手電腦轉贈予有需要的低收入家庭，絕對有助改善問題，幫助低收入家庭兒童的學習。」選委之一的梁兆昌(IT呼聲成員)建議說。
有關強化IT產業發展，他們的政策建議主要有三大方向，包括(i)推動IT服務出口、(ii)發展開放源碼軟件，以及(iii)培育數碼內容業。另外，他們促請特區政府向中央政府爭取國民待遇，使為本地業界可享有與內地同業同等的政策待遇，又支持政府為科技企業提供稅務優惠，如科研活動雙倍扣稅。

至於廣播政策，他們除了建議政府制訂引進數碼聲頻廣播的具體時間表，同時支持把香港電台轉型為獨立於政府架構的公營廣播機構。「政府曾承諾就港台前途做研究和公眾諮詢。我們認為政府不應再拖，應盡快做好研究和諮詢，再交由社會大眾決定港台的去向。」單仲偕補充。