Order of the Bath

If someone you passed in the street stopped you to point out that your trousers were undone, you might get a bit embarrassed as you quickly did them up and you might stutter a bit as you thanked them. What you would certainly not do is flag down a police car and report your informant as a pervert for looking in the first place.

So why, when someone with a bit of knowledge discovers and reports a weakness in a web site, do some major organisations immediately call in the lawyers and take them to court on “hacking” charges. This has got so bad that security researchers, even professionals, are now wary of reporting such flaws direct to the owners. Instead they must publish publicly and anonymously to protect themselves. That means that the criminals have access to the information at the same time as the administrators making them much more vulnerable to attack. To be convicted of theft it has to be shown that you not only took something but also intended to permanently deprive the owner of it. Something similar needs to be added to the various computer misuse laws around the world.

However, in a far sighted move, Microsoft have said publicly that they will not take action in cases like this. Indeed they positively welcome being told.

They were quite efective even though we all hated them—the fuzzy, misshapen, blurred letters that we had to read and type into the box to verify that we were human not some robot spam generator. But recently, two big systems, Google’s gmail and Microsoft’s live mail have been cracked. There are other types about such as simple arithmetic and counting monkeys but they wouldn’t last long if used on high volume, high profile systems like these. They all suffered from being more or less inaccessible to the disabled anyway. So now that CAPTCHA can’t keep the crackers out, where can we go next? And whatever, for the accessibility reasons they must be dropped altogether now.

There are a lot of possibilities out there; one-time pass codes texted to your mobile or RSA key-fob dongles for instance, but they are all far to expensive for the many places that you (the end user) would like to use and you (the site owner) would like to attract customers.

…when the ISP’s are selling your browsing data direct to the advertisers anyway. If you are a BT, VirginMedia or Carphone Warehouse customer who values your privacy I suggest you start looking for proxy anonymizers. Anonymizer.com and proxify.com are well known ones but I can’t vouch for any of them.

This is a problem a colleague at work came across with a home machine. His wife said that suddenly strange words started appearing on the screen. Suspecting some virus she disconnected the network immediately and called her husband. When he tried to use a bootable Linux CD to investigate the problem he had trouble closing down because windows were being selected randomly. Resorting to the kill button (hold down the power button for a while) he rebooted but strange words started to appear during the boot sequence as well.

What is your diagnosis?

He first suspected a BIOS virus but those haven’t been seen since the late ’90s. Then he spotted that one of the words showing up was the name of a neighbour’s child. Light dawns! A chat with the neighbour revealed that they had just replaced the battery in their wireless keyboard and the extra power must have been sufficient to be picked up by the identical receiver on his wife’s PC.

The implications are left as an exercise for the reader.

Thanks to Frank and his (internal) blog for the details.

When we build web sites we don’t necessarily create all the content ourselves. For various reasons we might subcontract out parts of it to third parties. Some examples are banner advertising and external widgets such as page counters and other statistics. In each case the code we insert on behalf of the third party pulls in content from their web servers and we have little control over it.

Now you might imagine that the big advertising company that you are signed up with have their reputation to consider and would only serve you good banners but it is not as simple as that. They sell on advertising space (syndicate) to other companies. The person visiting your site may be in another country; the code can tell that and will adjust the response accordingly; that is called geo-targeting. Now the agency doesn’t necessarily have material for that country so they contract out to yet another company to do it for them. This can happen many times before the advert is delivered, sometimes on a geographical basis, sometimes on a share arrangement—all without you knowing anything about it. You trusted the original supplier, and they trusted their subcontractor but it is getting a bit thin by the time the eventual supplier is reached and it is not uncommon for that one to be sending a virus or spy-ware to your customer. Yes, they are still your customer and will hold you responsible for what happens.

The other example I suggested was page counters, they are useless but small site owners still seem to like them. There used to be hundreds of different ones around but I haven’t looked recently. Some of these go out of business or get bought out without you knowing. The web address may have lapsed and been snapped up by someone else. This new owner could be using it for anything—including sending mal-ware to your visitors. When was the last time you looked at that page counter? Is it still doing what you though it was?

There are two good, but rather technical, reports linked to from this Google Blog that you should read if you think you may be affected by this.

This is more of a problem in an area with a lot of holiday homes but The St. Ivean points out that you only have to look for the houses with a Yellow Pages standing by the front door to find one where you won’t be disturbed breaking in.

There is a big debate going on at the moment prompted by an article by Bruce Schneier in which he explains why he leaves his home Wi-Fi network unsecured i.e. no password, no encryption. He discusses the risks and benefits and comes to the conclusion that, for him, the latter outweigh the former. Note that he is not saying it is for everyone.

The key points in the debate centre around

• How much you trust your neighbours not to flood your bandwidth.
• The terms of service from your ISP, if you are bothered about that.
• The responsibility you have for what travels over your link—e.g. illegal/unsavoury material.
• Reducing your protection from hackers—this is why it is not for everyone.

I still don’t know which way to turn—which means I secure it for the time being.