Latest on Technology, Systems, and Security

Archive for the ‘ Uncategorized ’ Category

In a running saga which has lasted since before Windows XP’s release back in 2001, Microsoft have finally shipped an update for their Windows platform which will allow users to choose the web browser they want to run.

Windows 7 in Europe was due to have the update built in when it was released back in October 2009, but last-minute wranglings between the EU and Microsoft saw the deadline off for another short period. Now users will get the choice which was proposed then – a pop-up box asking whether the user wishes to keep on using Internet Explorer 8 or whether they want to switch to Mozilla Firefox, Google Chrome, Opera or Apple Safari.

This is the end of part of Microsoft’s problems with antitrust and competition regulators who wanted to see MS’s practice of making Internet Explorer tightly entwined with their operating systems end. Microsoft’s Windows platform has enjoyed a very dominant market position over the last few years, meaning most web users didn’t even know there was a choice of web browser in the first place.

Whether this will help make the web a safer place is still unknown, however.

 
Friday, February 19th, 2010

Google’s new social network, Buzz, has caused a bit of a stir with privacy campaigners recently, with Google admitting they have messed up with their launch strategy.

The concerns centre around the way Buzz integrates with Gmail and other Google services to provide people with a starting network of friends to share content with. Using the user’s e-mail history, it constructs a list of those users e-mailed most often from that account and automatically adds them to their circle of friends. However, this information is then visible to other users, making it possible to see who a particular user is in contact with.

Google stated that since this product had not gone through its “Trusted Tester” program (whereby friends and family of Google staff are used to test products before launch) the issue had not popped up – especially as internal Googlers hadn’t predicted the problem beforehand.

This does leave a bad taste in the mouth as Google collect ever more data on their users. Slip-ups like this should not be happening with a company holding so much private information, especially when they recently criticised the Chinese government for not respecting the privacy of its users.

 
Tuesday, February 9th, 2010

Microsoft, kings of buggy software, have just patched a bug in their Windows operating systems which was discovered by a Google techie – except this one was almost old enough to drink legally.

The 17 year old bug is in the NTVDM piece of software, responsible for allowing old MS-DOS based programs to function in the Windows NT, XP, Vista and 7 lines of OSes produced by Microsoft.

Why this bug has taken so long to locate, and whether it is a genuine security risk these days is a mystery, only that it has indeed existed since Windows NT 3.1 and is still present in the most modern versions of Windows.

Now I’m no Microsoft basher, but surely it should have been detected by someone inside their organisation long before now, not some Google security analyst in 2010?

 
Thursday, February 4th, 2010

Internet Explorer 6 is a web browser which first appeared in 2001. Since then, we’ve seen browsers like Mozilla Firefox, Apple Safari and Google Chrome establish themselves as serious choices alongside older alternatives like Opera. We’ve even seen IE7 and IE8 arrive on the scene.

All of these browsers leave IE6 in the dust in terms of security, reliability, compatibility and new features. Web developers have been tearing their hair out for years over the problems that IE6 and IE7 present when designing websites, while security firms have warned against using the outdated technology. Recent events have seen Google blame a vulnerability in IE6 for the China e-mail hacking fiasco and both the German and French governments recommend that citizens do not use Internet Explorer until the issues are fixed.

I firmly believe IE6 should be discontinued by Microsoft, along with IE7, leaving IE8 as their only supported browser on the market. What this would do would be to focus all their energies on their latest and greatest, enable developers the world over to cater to more modern browsers and help safeguard users’ private data.

I wouldn’t hold out much hope though. After all, Microsoft say IE6 will be supported until 2014, when it will be 13 years old. Brilliant.

 
Sunday, January 31st, 2010

The latest phishing scam, focussing on the approaching tax return deadline has apparently been sent out to tens of thousands of prospective victims.

Scammers are getting increasingly clever about the methods they use to try and get users to visit a page and enter in their cred card details. Unsuspecting victims enter the site believing it to be a genuine tex return site, where they end up entering their credit card details, address, phone number and a whole host of other information.

Revenue and Customs has warned people not to respond to the emails being sent around as it only informs users of a refung by post.

 
Monday, January 18th, 2010

No big surprise here but the recent increase in the smart phone market has triggered hackers and cybercriminals to dust off some old tricks to try and install diallers and other exploits on smart phones.

People that fall into the traps of installing applications on smartphones end up with software that dials out to premium rate phone lines. Leaving the victim of such attacks with enormous phone bills and little or no way of retrieving a refund.

The diallers are mainly found on mobile porn sites, so if you are into that kind of thing, be careful and don’t download anything unless you are absolutely sure it’s safe to do so.

 
Friday, January 15th, 2010

Google might well be pulling out of China this week after news that they were subjected to a sophisticated synchronised attack.

Google and other security experts have indicated that the attacks are from China itself (ie the PRC) and are much more advanced than the normal attacks received by normal isolated hackers.

The attacks targeted Chinese human rights activists worldwide and it’s fairly obvious from people in the know that the hackers were backed by a nation state.

It’s unfortunate that the Chinese government continues it’s efforts to isolate itself from the rest of the world. One thing is for sure: the PRC isn’t making itself any friends globally.

 
Tuesday, January 12th, 2010

In what looks like another DNS hack, China’s biggest search engine “Baidu” has been hacked.. Users who visit the site were redirected to another political message.

In a way it’s a bit of a relief that the hackers didn’t use the opportunity to launch a massive phishing scam.. literally millions of people’s data would have been compromised if this was the case, making it one of the biggest hacks ever.

It’s not immediately clear how the “Cyber Army” (probably a fat guy in his mums basement) got access to the dns records, but I’m quite sure there are a few hundreds of people looking into it.

 
Thursday, January 7th, 2010

A new world record has been set where Pi (3.1415..) has been calculated to 2.7 Trillion digits. Whats perhaps more interesting is that it was completed by a simple desktop computer. This kind of thing is usually taken up by a supercomputer specially designed for crunching vast amounts of data.

If a simple desktop computer can work this out imagine how complex encryption need to be nowadays in order to keep one step ahead of would be attackers. With so much processing power at your disposal it’s becoming increasingly plausible for someone to crack higher levels of encryption.

Admittedly it was a pretty decent one with an i7 running at 2.93Ghz and 6GB of RAM. It also used up 1.5 Terabytes of data just on the number itself.

As you’ve probably seen in the news over the last week or so, tens of thousands of e-mail accounts have been compromised and had their log-in details posted online. Furthermore, the problem was not down to security weaknesses in Google Mail, Hotmail/Live Mail or Yahoo Mail. The problem was users giving out their information to anyone who asked.

You’re a web user. You do your shopping and banking online, always involving your confidential financial information. Perhaps you even pay the utility bills and taxes through online services. Chances are there is an awful lot of your information circulating on the internet.

So, if someone e-mailed you, claiming to be your bank, and asked for your bank account or credit card details, would you hand them over? Picture it this way – if the same person came up to you on the street and said that they were a representative of your bank, would you give the information to them, then and there? Probably not, if you had any sense!

While people may be more savvy about this threat, they seem not to be so sharp when it comes to ‘less important’ matters such as e-mail or social networking accounts. It seems tens of thousands of people have been more than happy to provide their usernames and passwords to anyone who asks, or to put those details into questionable forms on the web. When their data gets accessed, stolen or tampered with, they all of a sudden blame the services rather than themselves. This wouldn’t be so bad if every service didn’t say something like “Never give your information to anyone, ever – we will never ask for it” when you signed up!

What you have here is a deadly combination – stupid users and high tech con artists. Users are stupid in the way that they are wary in certain areas of the internet, but not in others – while they wouldn’t give a stranger their credit card details, they will give them their e-mail account details (which more often than not contains enough confidential information to sign up for a new credit card in your name!). Meanwhile, con artists are using ever more high tech methods to get people’s information – and succeeding.

Remember this golden rule: trust no-one. If someone is asking you about your information, chances are they aren’t supposed to have access to it. So, lesson to be learned? Don’t be a stupid user – get smart.