Password Codes

LifeHacker has an interesting article regarding the most commonly used pin numbers.

iPhone developer Daniel Amitay anonymously recorded and analyzed passcodes of users of his Big Brother Camera Security iPhone app, resulting in an interesting list of the ten most common passcodes, which, in order of popularity, include 1234, 0000, 2580, 1111, 5555, 5683 (spells LOVE), 0852, 2222, 1212, 1998.
LifeHacker

These 10 numbers were accounted for approximately 15% of all the passwords, 1 in 7 of the total. Of course people are slightly less concerned about their password security for their camera app than they are regarding their finances but the moral of the story is that one must be careful in the way one creates password algorighms.

Cyber War - The Glass Dragon

There is an excellent account at ThreatPost regarding China and the opening phase of Cyber War: Glass Dragon: China's Cyber Offense Obscures Woeful Defense.

It appears that China, while superb on offense is lacking somewhat on defense. The author, Paul Roberts, describes his tests on Chinese systems and finds them quite lacking. It appears that China has much the same weaknesses as the US and others based upon a distrust of open source and an insistence of reinventing systems. The result is system as open to attack and disrupt as ours, if not more so.


Two quotes says it all:

I think China is growing very fast and there aren't enough people to maintain the infrastructure. They have more networks and government sites than their own government can even maintain. They don't have the manpower or even the knowledge to maintain them. And, in many ways, China is still playing catch up with the US. They're an aggressor in cyberspace, but their own networks are very weak and poorly designed. I'm not saying that to shed a negative light on China, but there's so much out there that they just can't maintain it all. Beyond that, there's a lack of trust in Western products - even open source products. A fear that people will put back doors in them, which really misunderstands what open source is about, which is: if we have a lot of eyes looking at the code, people will spot problems and fix them.

Its really not hard. In fact, the amount of data I have found that is not intended for public consumption is amazing. I stopped after three terabytes. These systems are not maintained and are all vulnerable to attacks. HTTP is just one attack vector, but there are many others. For example: there was an LDAP server that was accessible from the Internet and it running a vulnerable version of PHP and, in addition, everything on the server was running as root. I find that a lot - its a bit of laziness by system administrators that makes their job easier. I was able to compromise the the server and then simply enumerate the directory and find other file servers and systems on the network that weren't connected to the Internet. Another example is China's National University of Defense Technology. They had a bunch of Web servers that weren't using SSL or HTTPS, so everyone was logging in using plain HTTP. All you needed to do was compromise one box and you could sniff all the user names and passwords in clear text.

Breaking News and Malware

unmaskparasites.com has a great article on how black-hat websters ensnare Google users and redirect them to malware infected sites which prompts people to download fake anti-virus software.

Apparantly in the moments after a major catastrophe these sites take advantage of the situation:

[in]the first few hours after the event almost any site with relevant information have good chances to rank high on Google. This short window when competition is quite light is all cyber-criminal need to have a steady traffic to their breaking new related doorway pages.

Major Disasters in Poisoned Search Results

Facebook using Social Authentication

Facebook has introduced an "innovative way to verify real users rather than using CAPTCHAS. Using the Social Login feature (or Social Authentication as Facebook calls it), users will be shown a few pictures of their friends and then they will be asked to name the person in those photos."

The logic is that it would be harder for hackers to be able to identify your friends. This would work quite well against a program but I'm not particularly thrilled by this idea in practice. A group trying to hack a celebrity's or political figure's site would be willing to do the research so they to would be able to recognize a large number of the person's friends. Thus compromising the security measure.

It does remind me of a photographic password system that XEROX PARC (I think it was XEROX PARC) came up with several years ago. I wonder why it never took off - that idea seemed to be excellent. The photographic system would take a photo - show it to you and say THIS IS THE PASSWORD. It would then make, as for example, twenty-nine variations on a theme. The human being would easily be able to remember the correct photo but our language is not nuanced enough for it to be accurately described to another.

Obviously there was a flaw to the system otherwise the idea would have spread.

Is your site infected by malware?

A few sites I'm associate with have been infected with malware. It appears as if one of the site owner's FTP application was infected and all affiliated sites were infected with the same malware.

I was directed to blog.unmaskparasites.com and it seems to have a tremendous amount of information on just this problem.

From Hidden Iframes to Obfuscated Scripts
10 FTP Clients Malware Steals Credentials From

Amazon Pulls 1984 Off Users' Kindles

Oh how predictable this was.

"In a story just dripping with irony, Amazon Kindle owners awoke this morning to discover that 1984 and Animal Farm had mysteriously disappeared from their e-book readers. These were books that they had bought and paid for, and thought they owned. Apparently the publisher changed its mind about offering an electronic edition, and apparently Amazon, whose business lives and dies by publisher happiness, caved. It electronically deleted all books by George Orwell from people's Kindles and credited their accounts for the price. Amazon customer service may or may not have responded to queries by stating, 'We've always been at war with Eastasia.'"

Amazon Pulls Purchased E-Book Copies of 1984 and Animal Farm

The move was an accident but it shows what may be a future problem. I don't like the fact that data that I put on my machine may be altered or deleted at whim. Data must be protected. Once the data is installed on your device it should be IMPOSSIBLE for the publisher (and ideally anyone else) to remove or alter it.

A Brave New World

One of the beautiful things about increased computer power and bandwidth is the development of new apps and the ease by which one can add new technology for fun, life and business. One of the bad things is that others (hackers, companies and government) can know what you are doing. Your applications can be monitored without your knowledge or permission, with others knowing where you are and what you are doing in real time.

In time will purchased applications be removed or edited without your permission? Will newspapers, books and video be edited without your knowledge? The keeper of this knowledge (the company from which you download the information – and the government which has over site) can alter this data at whim. Without real care we can create a 1984 dystopian society.

I am very positive about the future of technology but we must take care to make certain that we keep our privacy, that the concept of people being “secure in their persons, houses, papers, and effects, against unreasonable searches and seizures” applies to on-line data as implied in the 4th Amendment. Computer companies (Microsoft, Apple) are now having their devices call “home” to detect piracy and malware. While I completely approve of this we must keep in mind potential problems that may come in the not too distant future.

Malicious Javascript and SQL injection attacks

From The H:

According to an analysis by Websense, the malware tries to exploit a total of eight security holes to pass malicious code to the visitors of the pages unnoticed, for example via the VML hole already patched in January 2007. F-Secure has monitored attackers who tried to break into .asp and .aspx web pages by submitting the page parameters in an encrypted SQL query:

DECLARE%20@S%20NVARCHAR(4000);SET%20@S=CAST(0x4400450043004C0041005200450020004[...]

Once decrypted, this is an SQL query designed to find all the text fields in the database behind the web page and inject JavaScript code into them:

DECLARE @T varchar(255)'@C varchar(255) DECLARE Table_Cursor CURSOR FOR select a.name'b.name from sysobjects a'syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b[...]

Both code snippets are only the beginning of the request. Administrators of servers delivering .asp or .aspx pages (like Microsoft's IIS) are advised to check their log files for similar entries and if necessary search their databases for injected links.

Ah, the ingenuity of mankind. It is impressive isn't it?

How to Create a Safe Password

It's easy to come up with hack proof passwords that are easy to remember. The one thing you must keep in mind is that sometimes companies limit the characters that you can use for a password. This is very silly on their part as the longer the password and the more options you have(upper and lower case, numbers, special characters) the more secure your password is.

Too often I've come across sites which limit my password to 8 or less characters, which don't distinguish between upper and lower case and don't allow for special characters. I recommend coming up with a simple alternative password algorithm for these sites.

The following is an example for an 8 characters password. I would recommend having longer passwords - at least 12 characters for those sites you are most concerned about.

1.Select a phrase — "It was the best of times"
3.Take the first letter of each word or number — IWTBOT
3.Change some letters to numbers — 1WTBOT
4.Add special characters — 1WTB@T

And now it is best to make each site's password unique. You can customize it by adding the first two letters of the site in lower case.

5.Customize by adding a prefix or suffix for each site you register with. For example your Blogger account would become 1WTB@Tbl. It makes remembering very simple: "It Was the best of times blogger"