Imagine a Football Game with No Rules

Today the FCC is voting to remove rules for Internet Neutrality that were adopted February 26, 2015.  Removing these rules would allow the few Internet Service Providers (ISP) to manipulate your Internet traffic as they see fit.  Comcast was found to be throttling BitTorrent traffic in 2011 and did not stop until the current rules were adopted.  I applauded these new rules in this blog in 2015.  Now the FCC wants to remove these rules and allow ISPs to treat us however they want with few alternatives for consumers.

Imagine if the government removed all the NFL rules and football games were played with no rules.  How would you know the score?  There would be no penalties and fans could jump on the the field (what’s a field) and run away with the ball (we don’t need a ball).  Crazy, right!  To let ISP make the rules and not tell anyone (both Comcast and CenturyLink did this with data download limits) will make consumers confused, frustrated and angry with no where to turn for help.

The FCC is suppose to help U.S. citizens, not delivery us to corporations for their profit.  Comcast and CenturyLink did not invent the Internet, the U.S. government did with citizen funding, so we invented it, we want rules to protect the Internet’s democratization and our use of it.  If the current administration cannot work for us, we need to find a way to do it ourselves.

It maybe to late to comment on the action, but give it a try at the FCC web site.

Password Shenanigans

There seems to be a trend in web security that requires that you type your password, no pasting allowed!

This combined with other password “requirements” are creating problems for people like me that use very secure long passwords.  That means I use a password safe that generates long random strings of letters and numbers like:

kUTaVYPuw6KdCLsqhfJ35qHdZcgCqR

BTW, this password is random and not used by me, anywhere!

So when I sign up for a site that does not allow pasting my really secure password, but requires that I type it manually, I end up with passwords like:

Secure4Stupid!

Making my password much less secure. Also most sites use the “onpaste=return false;” trick.  This only stops the stupid people, as 5-15 minutes with a Greasemonkey script will defeat that “security” feature.  So let’s not think that every idea about password security is a good idea.

Even the following idea is probably not that secure given that password crackers use dictionaries that contain the words: correct, horse, battery, and staple.

xkcd comicAnother annoyance is sites that do not tell me what the maximum length is for a password on their site.  Almost no one tells you this even though they tell you, you must enter at least 8 characters, using letter and numbers….  Since I have had several sites truncate my password, without error or warning, I now have to look at the HTML source code to see if a hint is there.

So here is some password advice for web-site developers and their customers.

  • Do tell us the minimum and maximum lengths, characters allowed (numbers, letters, symbols, etc.).  Make the maximum something like 255, to allow secure passwords and phrases.
  • Do use a hashing algorithm to store passwords for you password protected applications.  This also allows for very long passwords, but fixes the hash value length that you need to store to authenticate your users.  A really useful function is the Unix crypt() library function that is implemented in numerous languages including C, Perl, PHP, Python, and Ruby.
  • Do use standard HTML for accepting passwords for compatibility with more devices.
  • Do not disable pasting which causes users to create weaker passwords.
  • Do not store passwords in plain text on any system.  For clients, use a password safe program to generate and store passwords. For applications and servers, use a strong hashing algorithm to store and compare passwords.
  • Do not use JavaScript for security as it is easily circumvented.
  • Do not reuse passwords for multiple sites.

For more advice on password security:

39,000 emails and counting….

Today my Junk folder filled up and would not accept anymore messages!  39,019 junk/spam email messages since January 1, 2015 and that is just the blatantly junk messages.  I receive many more messages from organizations that I have contact with that can “legally” send me emails from their push marketing campaigns. Guess what?  I do not read most of these emails and if I do I will be less likely to do business with your organization!  Sending me an email every other day will not cause me to buy your product more often.  In fact, the opposite will happen and I will buy less or none at all!  Selecting the “Do Not Email” preference does not seem to work with most organizations.

Barracuda Central reports that of 440,517,446 emails received 10/15/2015, by networks that use their products, only 62,534,611 (14.2%) are legitimate emails and 371,958,217 (84.44%) are spam!

The Economist reports:

[spam] is also bad for the environment. According to a report from an environmental consultancy, ICF International, commissioned by McAfee, a computer-security company, some 62 trillion unsolicited e-mails were sent in 2008, using 33 terawatt hours of electricity. That is equivalent to the energy consumed by 1.5m American homes or 3.1m cars over a year. If generated by coal-fired power stations it would release 17m tonnes of carbon dioxide, some 0.2% of global emissions of this greenhouse gas.

We need to find ways of securing the Internet email systems to prevent the overwhelming deluge of spam email.  And now I receive junk texts!  We need to act now before these good technologies become worthless for real communication.

Long Live the Internet!

Today the FCC adopted new rules for governing the Internet in the United States.  These rules will protect and insure a open and neutral Internet. The FCC’s Open Internet Order contains the following rules.

  1. No Blocking;
  2. No Throttling;
  3. No Paid Prioritization;
  4. Standard for Future Conduct;
  5. Greater Transparency;
  6. Reasonable Network Management;
  7. Interconnection;
  8. Reclassification of broadband Internet access service as a telecommunications service under Title II;
  9. Major Provisions of Title II that the Order WILL APPLY:
    1. No unjust or unreasonable practices or discrimination,
    2. Allows investigation of consumer complaints,
    3. Protects consumer privacy,
    4. Ensures fair access to poles and conduits by providers,
    5. Protects people with disabilities,
    6. Bolsters universal service fund support for broadband service in the future.

You can read the entire FCC statement at http://www.fcc.gov/document/fcc-adopts-strong-sustainable-rules-protect-open-internet or a PDF version here.

Stop Using Microsoft Internet Explorer

If you are using Microsoft Internet Explorer (IE), there are hackers actively using a software bug to gain control of Microsoft Windows computers.  Stop using IE now! This is twice as dangerous as the Heartbleed Bug because an attacker can take control of your computer and do whatever they want with it.

US-CERT issued an alert about the active exploitation of a use-after-free vulnerability in Microsoft Internet Explorer. This vulnerability affects IE versions 6 through 11 and allows a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

US-CERT recommends that users and administrators review Microsoft Security Advisory 2963983 for mitigation actions and workarounds. If you are still using Windows XP, Microsoft will not provide updates or solutions and you should consider installing and using an alternate browser such as Mozilla Firefox (free) or Google Chrome (free).

For more details, please see VU#222929 and FireEye’s Blog entry.

Heartbleed Bug – End of the World or Non-event?

heartbleed xkcd comicThat about covers the risks.  Now what can you do about it?  First, update your computer (Windows, Mac OS X or Linux/Unix), right now!  Before you read the rest of this post.

Most software vendors/service providers recognized the serious nature of this bug and updated their software (the easy part).  So getting the fix is usually easy. The biggest problem is trying to determine if your information has been compromised.  You can’t!  Attacks leave no trace or very little on the computers that gave up their private secrets.  This bug has been out in the wild for 2 years!  Maybe nobody found it and took advantage OR somebody did and has all our passwords.  N.S.A is that you?  The actual risk is probably somewhere in between those extremes.

Most security experts are recommending that we change all our passwords and replace all of our SSL certificates.  At the very least change your password on you bank account log-in, but you probably don’t need to change your Facebook password (everybody has all that info).  And definitely change your password if you use one password for everything.  Yea, it is hard to remember all of them, but you can let your computer do the remembering.  Start using a password safe like KeePass or KeePassX to create and store long secure password using one password, that you have to remember, to save them on your system in an encrypted file.

More info about Heartbleed Bug:

 

D-Link Router Backdoor Vulnerability

The US-CERT, a part of the Department of Homeland Security,  has issued a warning that certain D-Link routers have firmware that contains a backdoor for remote users to access router administrative functions without entering the administrator password.  Besides D-Link, Planex and Alpha Networks devices may also contain this firmware.

According to D-Link, the following D-Link routers are affected:

  • DIR-100
  • DIR-120
  • DI-624S
  • DI-524UP
  • DI-604S
  • DI-604UP
  • DI-604+
  • TM-G5240

For more detailed up-to-date information go to this D-Link page on this issue.

According to the original vulnerability report, the following Planex routers are likely affected:

  • BRL-04R
  • BRL-04UR
  • BRL-04CW

If you have one of these routers, check to make sure that the remote configuration from the Internet is not allowed (default setting).  This may have been changed by ISPs that remotely administer customers Internet connections.

Security researcher Craig Heffner found these routers’ internal web server will accept and process any HTTP requests that contain the User-Agent string “xmlset_roodkcableoj28840ybtide” without checking if the connecting host is authenticated.

DNSChanger malware

If you use default passwords on your home or office gateway/router, then you maybe at risk from the DNSChanger malware.  This can affect how your computers translate domain names such as apple.com, microsoft.com and other domain names to the unique Internet Protocol (IP) address such as 198.51.100.1 that we ultimately depend on to access other computers.  A company in Estonia called Rove Digital has been operating since 2007 and may have affected more that 500,000 computers in the United States alone.  If your computer is affected, it will fail to access the Internet after July 9, 2012.

The Domain Name System (DNS) is a critical Internet service that converts user-friendly domain names, such as www.fbi.gov, into numerical addresses that allow computers to talk to each other. Without DNS and the DNS servers operated by Internet service providers, computer users would not be able to browse websites or send e-mail.

DNSChanger malware causes a computer to use rogue DNS servers in one of two ways.

  1. The malware changes the computer’s DNS server settings to replace the ISP’s good DNS servers with rogue DNS servers operated by the criminal.
  2. The malware attempts to access devices on the victim’s small office/home office (SOHO) network that run a dynamic host configuration protocol (DHCP) server (eg. a router or home gateway). The malware attempts to access these devices using common default usernames and passwords and, if successful, changes the DNS servers these devices use from the ISP’s good DNS servers to rogue DNS servers operated by the criminals. This is a change that may impact all computers on the SOHO network, even if those computers are not infected with the malware.

To assist victims affected by the DNSChanger malicious software, the FBI obtained a court order authorizing the Internet Systems Consortium (ISC) to deploy and maintain temporary clean DNS servers. This solution is temporary, providing additional time for victims to clean affected computers and restore their normal DNS settings. The clean DNS servers will be turned off on July 9, 2012, and computers still impacted by DNSChanger may lose Internet connectivity at that time.

The following table list sites setup to help you determine if your computer is affected.

URL

Language

Maintainer

http://www.dns-ok.us/ English DNS Changer Working Group (DCWG)
http://www.dns-ok.de/ German Bundeskriminalamt (BKA)
Bundesamt für Sicherheit in der Informationstechnik (BSI)
http://www.dns-ok.fi/ Finish CERT-Fi
http://www.dns-ok.ax/ Swedish CERT-Fi
http://www.dns-ok.be/ Dutch/French CERT.be
http://www.dns-ok.fr/ French CERT-LEXSI
http://www.dns-ok.ca/ English/French CIRA and CCIRC
http://www.dns-ok.lu/ English CIRCL
http://dns-ok.nl/ Dutch/English SIDN

For more technically oriented people the following is a list of IP address the criminals used for their activities.

List of Rogue DNS Server Addresses

  • 85.255.112.0 through 85.255.127.255
  • 67.210.0.0 through 67.210.15.255
  • 93.188.160.0 through 93.188.167.255
  • 77.67.83.0 through 77.67.83.255
  • 213.109.64.0 through 213.109.79.255
  • 64.28.176.0 through 64.28.191.255

For more information see the following links:

http://www.fbi.gov/news/stories/2011/november/malware_110911/malware_110911

DNS Changer Working Group (DCWG)

http://www.fbi.gov/newyork/press-releases/2011/manhattan-u.s.-attorney-charges-seven-individuals-for-engineering-sophisticated-internet-fraud-scheme-that-infected-millions-of-computers-worldwide-and-manipulated-internet-advertising-business

Update 2015-01-02: Many sites linked from this page are no longer available.

Uncle Sam Needs You!

We need your help prevent United States Senate Bill 968 (PIPA) and HR 3261 (SOPA) from becoming U.S. law. These bills are essentially a technical solution (a flawed one) for a business problem.  These laws would short-circuit due process of existing laws and provide a sledge hammer for businesses to take down their competitors.  These laws are the wrong solution for the described problem.  A group of Internet inventors and engineers have voiced their opinion in an open letter to Congress stating their opposition to the SOPA and PIPA bills.  Ironically some provisions in these bills would attack Free Speech in ways we condemn in China and Iran.

Uncle Sam needs youWe need you to help over come the well funded lobbying effort to create these laws!  Some opponents of PIPA and SOPA: Google, Yahoo, Wikipedia, craigslist, Facebook, Twitter, LinkedIn, eBay, AOL, Mozilla, Reddit, Tumblr, Etsy, Zynga, EFF, ACLU, Human Rights Watch, Darrell Issa (R-CA), Ron Wyden (D-OR), Nancy Pelosi (D-CA), Ron Paul (R-TX), Tim O’Reilly.

To find out how you representative is voting go to SOPA Opera to find out.  Then contact them and tell them how you feel about keeping the Internet a fair and open place to socialize and work.

Here are some of the people and companies that are working against your interests and for their own profit: RIAA, MPAA, News Corp, Time Warner, Walmart, Nike, Tiffany, Chanel, Rolex, Sony, Juicy Couture, Ralph Lauren, VISA, Mastercard, Comcast, ABC, Dow Chemical, Monster Cable, Teamsters, Rupert Murdoch, Lamar Smith (R-TX), John Conyers (D-MI), Michael F. Bennet (D-CO).

Amazon Simple Storage Service (S3)

I have been using Amazon Simple Storage Service (S3) for several years to provide off-site backup and synchronizing files on my numerous systems.  It is a cloud-based service that provides storage for a very reasonable cost ($0.14 per GB/Month as of 7/19/2011).  Access to files on S3 are through web service interfaces (REST, SOAP, and BitTorrent) that are not for general use.  So most access is through some end-user program or service.  Many services have been built that use S3 including Netflix, Tumblr, reddit, and SmugMug with the list growing rapidly.

To use this service, I use a variety of tools including command-line utility called s3cmd, on my Linux systems to synchronize directories and upload/download files.  Synchronizing a directory is as simple as:

s3cmd sync /home/dirk/data s3://bta-bucket/dirk/

This will create a “directory” data in the S3 “directory” bta-bucket/dirk; upload the files that have changed or do not exist on S3 and store file metadata date/time information to make all this possible.  The only problem I have run into is s3cmd’s get and put commands do not use this file metadata to set the file modification time.  This prevents using get and put where you have used the sync command, because the file modification time will not be saved (in S3 headers) or set (on local PC) with get and put.  So to restore one file to a directory AND set the file modification time set during the sync upload use the following command:

s3cmd sync s3://bta-bucket/dirk/data/somefile.ods /home/dirk/data/somefile.ods

The local file date should match the original file’s modification date/time.  Note: the date/time shown by the s3cmd ls command is the upload date/time, NOT the file modification date/time.  The file metadata is stored in the S3 metadata headers with the Key  = “x-amz-meta-s3cmd-attrs” with a Value similar to: “uid:1000/gname:dirk/uname:dirk/gid:1000/mode:33188/mtime:1302623148/atime:1311007748/ctime:1302627027” to hold the file information.

Other S3 utilities save file metadata in different and incompatible ways, so be careful in choosing your S3 backup software and remember that changing to another utility may cause problems with synchronization based on the file modification date/time.

For Windows users, there is a free client called DragonDisk that uses S3 for file storage.  I have not used it, so this is not a recommendation.