Latest on Technology, Systems, and Security

Archive for the ‘ Uncategorized ’ Category

 
Tuesday, August 31st, 2010

Cook to Perfection, a Kings Lynn cookship, has had its website brought down by hackers only two months after setting it up. The business was voted ‘best cookshop’ in British retailer awards and its website was specifically mentioned as part of this recognition.

However, the company director, Alastair Done, has found that the website is currently offline.

“I was going to use our website to do some work and it came up with a big error. Somebody’s gone in and deliberately deleted every single file. We have the database – which is good for us – but what we don’t have is the framework that that database goes onto, so it’s as good as useless.”

Goatse Security has been able to grab around 114,000 personal email addresses of iPad buyers from a major telecoms providers website. Some of the email address that have been leaked include White House Chief of Staff Rahm Emanuel, New York City Mayer Michael Bloomberg, Diane Sawyer of ABC News, and many CEOs, CFO, and CTO’s.

Some of the email addresses exposed even belonged to DARPA reesarchers and high-ranking military officials. Each iPad comes with an ICC-ID or an “integrated circuit card identifier.” The subscriber’s SIM card and ICC-ID are linked to uniquely identify them. Normally this data would not be publicly accessible.

 
Sunday, June 27th, 2010

Apple has just released a new version of the iPhone software, commonly known as iOS. Formerly known as iPhone OS, and the name change is not the only thing that comes packaged with this update.

Apple’s website, there is a list of 64 security holes which have now been fixed in new iOS. The component within the operating system which was the most vulnerable to attacks is WebKit. WebKit is the browser engine which powers safari on iDevices, and was the cause for 50 of the security patches. That’s three quarters of the errors fixed.

In a running saga which has lasted since before Windows XP’s release back in 2001, Microsoft have finally shipped an update for their Windows platform which will allow users to choose the web browser they want to run.

Windows 7 in Europe was due to have the update built in when it was released back in October 2009, but last-minute wranglings between the EU and Microsoft saw the deadline off for another short period. Now users will get the choice which was proposed then – a pop-up box asking whether the user wishes to keep on using Internet Explorer 8 or whether they want to switch to Mozilla Firefox, Google Chrome, Opera or Apple Safari.

This is the end of part of Microsoft’s problems with antitrust and competition regulators who wanted to see MS’s practice of making Internet Explorer tightly entwined with their operating systems end. Microsoft’s Windows platform has enjoyed a very dominant market position over the last few years, meaning most web users didn’t even know there was a choice of web browser in the first place.

Whether this will help make the web a safer place is still unknown, however.

 
Friday, February 19th, 2010

Google’s new social network, Buzz, has caused a bit of a stir with privacy campaigners recently, with Google admitting they have messed up with their launch strategy.

The concerns centre around the way Buzz integrates with Gmail and other Google services to provide people with a starting network of friends to share content with. Using the user’s e-mail history, it constructs a list of those users e-mailed most often from that account and automatically adds them to their circle of friends. However, this information is then visible to other users, making it possible to see who a particular user is in contact with.

Google stated that since this product had not gone through its “Trusted Tester” program (whereby friends and family of Google staff are used to test products before launch) the issue had not popped up – especially as internal Googlers hadn’t predicted the problem beforehand.

This does leave a bad taste in the mouth as Google collect ever more data on their users. Slip-ups like this should not be happening with a company holding so much private information, especially when they recently criticised the Chinese government for not respecting the privacy of its users.

 
Tuesday, February 9th, 2010

Microsoft, kings of buggy software, have just patched a bug in their Windows operating systems which was discovered by a Google techie – except this one was almost old enough to drink legally.

The 17 year old bug is in the NTVDM piece of software, responsible for allowing old MS-DOS based programs to function in the Windows NT, XP, Vista and 7 lines of OSes produced by Microsoft.

Why this bug has taken so long to locate, and whether it is a genuine security risk these days is a mystery, only that it has indeed existed since Windows NT 3.1 and is still present in the most modern versions of Windows.

Now I’m no Microsoft basher, but surely it should have been detected by someone inside their organisation long before now, not some Google security analyst in 2010?

 
Thursday, February 4th, 2010

Internet Explorer 6 is a web browser which first appeared in 2001. Since then, we’ve seen browsers like Mozilla Firefox, Apple Safari and Google Chrome establish themselves as serious choices alongside older alternatives like Opera. We’ve even seen IE7 and IE8 arrive on the scene.

All of these browsers leave IE6 in the dust in terms of security, reliability, compatibility and new features. Web developers have been tearing their hair out for years over the problems that IE6 and IE7 present when designing websites, while security firms have warned against using the outdated technology. Recent events have seen Google blame a vulnerability in IE6 for the China e-mail hacking fiasco and both the German and French governments recommend that citizens do not use Internet Explorer until the issues are fixed.

I firmly believe IE6 should be discontinued by Microsoft, along with IE7, leaving IE8 as their only supported browser on the market. What this would do would be to focus all their energies on their latest and greatest, enable developers the world over to cater to more modern browsers and help safeguard users’ private data.

I wouldn’t hold out much hope though. After all, Microsoft say IE6 will be supported until 2014, when it will be 13 years old. Brilliant.

 
Sunday, January 31st, 2010

The latest phishing scam, focussing on the approaching tax return deadline has apparently been sent out to tens of thousands of prospective victims.

Scammers are getting increasingly clever about the methods they use to try and get users to visit a page and enter in their cred card details. Unsuspecting victims enter the site believing it to be a genuine tex return site, where they end up entering their credit card details, address, phone number and a whole host of other information.

Revenue and Customs has warned people not to respond to the emails being sent around as it only informs users of a refung by post.

 
Monday, January 18th, 2010

No big surprise here but the recent increase in the smart phone market has triggered hackers and cybercriminals to dust off some old tricks to try and install diallers and other exploits on smart phones.

People that fall into the traps of installing applications on smartphones end up with software that dials out to premium rate phone lines. Leaving the victim of such attacks with enormous phone bills and little or no way of retrieving a refund.

The diallers are mainly found on mobile porn sites, so if you are into that kind of thing, be careful and don’t download anything unless you are absolutely sure it’s safe to do so.

 
Friday, January 15th, 2010

Google might well be pulling out of China this week after news that they were subjected to a sophisticated synchronised attack.

Google and other security experts have indicated that the attacks are from China itself (ie the PRC) and are much more advanced than the normal attacks received by normal isolated hackers.

The attacks targeted Chinese human rights activists worldwide and it’s fairly obvious from people in the know that the hackers were backed by a nation state.

It’s unfortunate that the Chinese government continues it’s efforts to isolate itself from the rest of the world. One thing is for sure: the PRC isn’t making itself any friends globally.