Category Archives: Security

IT upgrades

Ho boy.

The Bushfires Royal Commission has been told staff answering calls at the Bushfire Information Line on Black Saturday were unable to see crucial information about the fires because of an IT upgrade.

More than 12,000 Victorians called the Victorian Bushfire Information Line or on Black Saturday.

Calls that were not answered went to Centrelink.

But the commission was told staff there were unable to see the Department of Sustainability fire database because an IT upgrade had accidentally blocked that access.
…

— ABC News Online

So on the hottest forecast day ever, and which everyone from the Premier down had warned would be the worst fire danger day ever, Centrelink staff, who are the designated backup responders for the bushfire information line, were blocked from getting the information they needed from the DSE web site?

Apart from the timing issues of IT upgrades to systems that are important to the fire-fighting effort, it appears to underscore the severe dangers of restricting network access unnecessarily.

Wifi in your neighbourhood

While I was walking down the street running an errand, I tried scanning for Wifi networks on my N95 phone.

I must have found about 20 or 25 of them during just a few minutes’ walk. Probably every fourth or fifth house seemed to have one.

Many of them appeared to be named after the families living there. Some had obviously default names of common brands… Netgear and the like. A few had gobbledygook names which may or may not have been defaults.

And to my surprise, almost all of them were secured.

Almost.

Two weren’t — one an apparent Apple network, and one Netgear one, both close by to each other.

Hopefully not too many of their neighbours are sponging off them!

e-Security week

Apparently it’s e-Security week in Australia. Who knew?

This post from Graham Cluley of Sophos (who does a very entertaining and informative blog on computer security) includes this short video on how to choose a good password which is easy to remember, but hard for hackers to guess.

Simple tips for better web password security from Sophos Labs on Vimeo.

Not sure I agree with his conclusion, but it’s certainly worth some thought.

Kaspersky blocks doubleclick

It looks like Kaspersky Anti-Virus is blocking at least some web adverts from prominent advertiser Doubleclick, on the basis that they’re phishing.

Here’s the warning from Kaspersky itself:

And here’s what appears on the web page:

This warning is appearing on sites using Doubleclick, including Yahoogroups and Facebook Scrabble (international).

Interesting.

Slowing down WordPress spam

I noticed a lot of my WordPress spam is coming from a handful of IP address ranges. I’ve checked, and in the five-ish years I’ve been using WordPress, no valid comments seem to be coming from there. (Just tap the relevant IP address into the WP comment admin search box.)

Time for a little .htaccess magic, I think.

order allow,deny
deny from 194.8.75.
deny from 194.8.74.
deny from 87.118.112.
deny from 194.8.75.
deny from 194.8.74.
deny from 87.118.112.
deny from 61.18.170.
deny from 196.12.36.
deny from 219.64.175.
deny from 69.59.137.
deny from 80.88.242.
allow from all

By the way, in cPanel File Manager, to see .htaccess you have to switch on the option to view hidden files on the options page when you go in.

Anyway, the result is less spam, though there appears to be a rash of new attacks from a wide variety of IP addresses, with a shirtload of embedded links to upcoming.yahoo.com

Google blurs Colonel Sanders? Maybe.

Oh lordy. I wonder if this is some kind of joke, or if it’s true?

The Telegraph reports that Google has blurred the image of Colonel Sanders on KFC signs in the UK, on the basis that he’s a real person.

The company says it took the decision because he is ‘a real person’ – despite him passing away in December 1980 aged 90.

If it’s true, then can I just say: IDIOTS!

1. It’s a cartoon image, not a photographic likeness.

2. He’s been dead for 29 years.

3. What, you think we won’t know who it is? “Hey, who’s that on the KFC sign?” “Dunno, could be any southern American military guy who knows about chicken.”

4. Are they doing the same for cartoons and photos of real people on billboards and the like?

5. How is the late Colonel’s privacy being spoilt if people could see the cartoon image of his face? Hasn’t the horse already bolted on that, given the image of him is up on thousands of KFC outlets all over the planet?

Of course, it could be that the whole story is a crock.

Or maybe they just haven’t implemented their policy (whatever it is) very well.

The reason I offer these two possibilities is that I found this unobscured KFC sign, and this one too, both in London.

Certainly it appears the Colonel in Australia is freely visible:

If they did institute such a policy in Australia, I wonder what they’d do about other cartoon face logos, especially of people who are still alive. Dick Smith is one who springs to mind, though now I think about it, I think they’re phasing out use of his face on their signs and literature.

Psyb0t worm infecting modems/routers

The new “psyb0t” worm infects modem/routers by getting in via unsecured ssh/telnet ports on common MIPS Linux-based models such as those by Netcomm, Netgear and Linksys. Apparently a lot of these devices are shipped unsecured… and of course, most people don’t know how to check and change that. I know I don’t.

My router has DD-WRT on it. The DD-WRT web site has an article saying they believe they are not vulnerable, unless WAN management has been enabled.

It’s probably worth checking with your router or firmware provider to see if you’re vulnerable, and/or steps to check and secure your equipment.

APCmag: New worm can infect home modem/routers

ZDNet: ‘Psyb0t’ worm infects Linksys, Netgear home routers, modems

DRONEBL: Network Bluepill – stealth router-based botnet has been DDoSing dronebl for the last couple of weeks — which clarifies the conditions under which the infection can spread.

Setting your privacy on Facebook

Facebook don't really explain how to restrict some of your information to particular friends, but it's not hard to do with the new privacy settings.

1. First go to Friends, and if it doesn't already exist, make a Friends List called Limited Profile. This will be used to limit what some people can see. (You can use multiple lists to have different permissions.)

2. Put the appropriate people into it. (When confirming friends it gives you that option, too).

3. Then go into your Settings / Privacy Settings / Profile. You can customise who you want to see what, and exclude the Limited Profile people from seeing particular information — or have particular people see/not see whatever you want.

Easy.

One third party: a tiny bit more complexity; Many: :-(

I didn’t find the most interesting part of the StackOverflow podcast #16 to be my question. I direct you to 17:06 in, where Jeff discusses the pros and cons of using OpenID as the authentication mechanism for StackOverflow:

Atwood: Granted, there’s a third entity here so there’s going to be a tiny bit more complexity.

What Jeff’s overlooked here is the Combinatorial Complexity; he’s not hooking up with an OpenID provider, he’s hooking up with all OpenID providers, which he acknowledged earlier can be a bit of a problem [34:48 in podcast #7]:

Atwood: Well you can, I found that Yahoo doesn’t really do attribute exchange very well.

If you look at the uservoice… forum… bug-reporting… suggestion-y thing for the StackOverflow beta, you see a lot of people complaining “my OpenID provider doesn’t work [at all]/[properly] with your site”.
OpenID has a spec, but given the difficulties being experienced, it mustn’t be terribly tight or there’s no reference implementation to validate against.

Having said all that, guess what I’m going to be using as my authentication process on my next website?

AFL malware?

Apparently the Australian Football League may be distributing malware.

AFL malware warning

(To my mind, they have an annoyingly unresponsive web site, but it’s not actually malware.)