It looks like iPhones that are jailbroken can be accessed by from the internet using ssh with the root password "alpine".
Instructions for changing the password are here. Please change the password now, you don't want your beautiful iPhone to change into a nice, shiny brick.
Perry
UPDATE 12/1/2009
It's not rickrolling now, the newest one actually steals information, like passwords, and changes your ssh password so you have to wipe the phone to remove it. Luckily it's really easy to tell if there - The battery usage is so high you'll want to wipe the phone anyway. Lucky the battery isn't replaceable, huh? Change those passwords, folks.
Friday, November 13, 2009
Facebook Apps are really Insecure (and their creators know it)
The architecture of Facebook apps has some security problems, and according to this article, companies like Zynga (Farmville, Mafiawars) know about it and exploit it.
That means that you, the user take it in the chin ( and wallet ).
The problem is that when you load Facebook apps, they have access to your whole Facebook account, not just the piece they need. The app makers take advantage of this, or least point to people who do. This means extra charges on your credit cards at best, or identity theft at worst.
Moral of the story - be discreet when you load Facebook apps - do you really want to know which Anne Rice Character you are?
I don't. And I don't want to join MyCalendar, so no birthday requests(sorry), etc etc. I'm not sure about groups. Or Lists.
Facebook is working on it - making your information disclosures selectable - no ETA though, I don't think.
Update 11/14/09 - ValleyWag says that there might be a class action suit in the works. Zynga is going to have fun defending the "every horrible thing in the book"quote from their CEO, especially when it's on tape (nice touch). Let's see how that IPO goes, huh?
Oh, another thing: Do you use Facebook and care about your privacy settings? Are they all set to friends only? I did a google search for myself (AKA vanity search) and found out my whole friends list was available to everyone. I hadn't increased privacy on "search settings" - Click here to make those changes to your profile
Perry
That means that you, the user take it in the chin ( and wallet ).
The problem is that when you load Facebook apps, they have access to your whole Facebook account, not just the piece they need. The app makers take advantage of this, or least point to people who do. This means extra charges on your credit cards at best, or identity theft at worst.
Moral of the story - be discreet when you load Facebook apps - do you really want to know which Anne Rice Character you are?
I don't. And I don't want to join MyCalendar, so no birthday requests(sorry), etc etc. I'm not sure about groups. Or Lists.
Facebook is working on it - making your information disclosures selectable - no ETA though, I don't think.
Update 11/14/09 - ValleyWag says that there might be a class action suit in the works. Zynga is going to have fun defending the "every horrible thing in the book"quote from their CEO, especially when it's on tape (nice touch). Let's see how that IPO goes, huh?
Oh, another thing: Do you use Facebook and care about your privacy settings? Are they all set to friends only? I did a google search for myself (AKA vanity search) and found out my whole friends list was available to everyone. I hadn't increased privacy on "search settings" - Click here to make those changes to your profile
Perry
Flash is really Evil
A post today on Slashdot describes how Adobe flash basically breaks the security of the Internet.
Unfortunately it's really complicated but the author maintains ( and shows ), that when a server sends an Adobe Flash object to a users browser, that object can execute code that's in a file in the originating domain, regardless of whether the file is a flash object. The executing flash object may not even have to be a flash object, it can be something else, like an image.
This opens up the web to a ton of attacks. Basically, any web site that allows file uploads ( like photo sites ), can only be partially resistant to this of they have a different domain for user uploaded content. So pbase.com would need to move all their files to pbase-img.com, or something similar. Some big sites like Yahoo are already doing this.
That means its bad news because it's really hard for anyone to fix other than Adobe, and the worse news is that Adobe says it's not their problem.
What's a poor user to do?
It's easy for a Security Goon to say:
Perry
Unfortunately it's really complicated but the author maintains ( and shows ), that when a server sends an Adobe Flash object to a users browser, that object can execute code that's in a file in the originating domain, regardless of whether the file is a flash object. The executing flash object may not even have to be a flash object, it can be something else, like an image.
This opens up the web to a ton of attacks. Basically, any web site that allows file uploads ( like photo sites ), can only be partially resistant to this of they have a different domain for user uploaded content. So pbase.com would need to move all their files to pbase-img.com, or something similar. Some big sites like Yahoo are already doing this.
That means its bad news because it's really hard for anyone to fix other than Adobe, and the worse news is that Adobe says it's not their problem.
What's a poor user to do?
It's easy for a Security Goon to say:
- Use Firefox. I already do this, as does my wife and kids. Really.
- Use the NoScript add-on. I do this, but haven't got my wife or kids started(yet). This prevents flash from most sites, unless manually turned on. (I gotta pay him something). It's brilliant and improves the net experience if only because I haven't seen punch the monkey in years.
- According to a comment in the above referenced article it's even better if you run the FlashBlock extension. This sounds good but I haven't tried it yet
Perry
Friday, October 16, 2009
Is Paypal a Bank?
An open letter to Paypal:
As I understand it:
1. Paypal banned Moxie Marlinspike, a well known information security researcher, because he wrote some online security tools that could be used against Paypal and accepted donations using Paypal systems.
(More information can be found here)
2. Paypal has a policy banning writing software that can be used against it. I have not verified this.
3. Paypal held $500 of Mr. Marlinspike's money until he removed the Paypal link from his web site
This is just my unsolicited opinion, but I think this should be addressed at the highest levels at the company since it addresses some fundamental questions:
1.Can Paypal confiscate people's money for breaking its terms of service?
2.Is Paypal a bank?
3.Should the United States government step in and regulate Paypal as an interstate bank?
Regardless of whether my understanding of Mr Marlinspike's situation is correct, it appears that Paypal thinks the answer to question #1 is “yes”.
I don't know the answers to these questions, but I think Paypal would want the answer to question #3 to be “no”. If this is so, and I were them, I'd be concerned that this has the attention of the US Government
Perry Engle
Stratham NH
As I understand it:
1. Paypal banned Moxie Marlinspike, a well known information security researcher, because he wrote some online security tools that could be used against Paypal and accepted donations using Paypal systems.
(More information can be found here)
2. Paypal has a policy banning writing software that can be used against it. I have not verified this.
3. Paypal held $500 of Mr. Marlinspike's money until he removed the Paypal link from his web site
This is just my unsolicited opinion, but I think this should be addressed at the highest levels at the company since it addresses some fundamental questions:
1.Can Paypal confiscate people's money for breaking its terms of service?
2.Is Paypal a bank?
3.Should the United States government step in and regulate Paypal as an interstate bank?
Regardless of whether my understanding of Mr Marlinspike's situation is correct, it appears that Paypal thinks the answer to question #1 is “yes”.
I don't know the answers to these questions, but I think Paypal would want the answer to question #3 to be “no”. If this is so, and I were them, I'd be concerned that this has the attention of the US Government
Perry Engle
Stratham NH
Thursday, September 17, 2009
Don't get fooled by Free Antivirus!
There are some scams out there trying to peddle free antivirus software, just say no!
You'll go to a web site, and it does all kinds of things to say you're infected, and to load their software. There's a technical description here.
Right now, suffice to say Norton and Mcafee are the best but co$t, and there's a free one I like called Avast.
Trend, ClamAV are OK too, I guess, but I haven't tried them.
Don't use any others
Perry
You'll go to a web site, and it does all kinds of things to say you're infected, and to load their software. There's a technical description here.
Right now, suffice to say Norton and Mcafee are the best but co$t, and there's a free one I like called Avast.
Trend, ClamAV are OK too, I guess, but I haven't tried them.
Don't use any others
Perry
Monday, August 3, 2009
*Important* Update Adobe Products Now!
I'm back from Blackhat, and Adobe is now sharing the spotlight as a company *we like to make fun of*.
Don't worry, Microsoft, you still have the top of the heap, but with at least 3 zero-days in 2 months, Adobe is getting their share of abuse.
There is evilness out there, and all 3 of the usual suspect Adobe products need updating, Flash, Shockwave, and Reader. Mine didn't update automatically, so I had to go to the following 3 places:
http://get.adobe.com/flashplayer/
http://get.adobe.com/shockwave/
http://get.adobe.com/reader/
It's kind of a pain, but pretty quick on broadband, do reader last, and a reboot at the end, and if you're using firefox (update that too from "about") , and you should be pretty safe .
Happy end-of-summer
Perry
Don't worry, Microsoft, you still have the top of the heap, but with at least 3 zero-days in 2 months, Adobe is getting their share of abuse.
There is evilness out there, and all 3 of the usual suspect Adobe products need updating, Flash, Shockwave, and Reader. Mine didn't update automatically, so I had to go to the following 3 places:
http://get.adobe.com/flashplayer/
http://get.adobe.com/shockwave/
http://get.adobe.com/reader/
It's kind of a pain, but pretty quick on broadband, do reader last, and a reboot at the end, and if you're using firefox (update that too from "about") , and you should be pretty safe .
Happy end-of-summer
Perry
Tuesday, March 31, 2009
Is Conficker an April Fools Joke?
Update 4/9/2009: Obviously, the Internet didn't melt down, but some of of the information security people around were waiting for the other shoe to drop. According to this article, Conficker has woken up, and started moving files. We're still looking.
Original Post:
If you've been paying attention to media, you've probably heard about the Conficker worm. It really is a big thing, and has been a problem to corporate IT staffs since last October.
If you're a home user, there's not much you can do about it, except make sure your virus signatures are up to date, and run a virus scan.
If you would like a quick sanity check to see if you have conficker - click on one of these two links:
Symantec , or F-Secure.
You should see Symantec and F-Secure, two network security companies. If you had the Conficker worm, you'd get something else, and should immediately run a full security scan.
The reason it's come up now to the mass media is that researchers have found a reference to April 1 in the Conficker code, and they're not sure what it does. Conficker might wake up and do something, and it also might be part of a bigger event, so we're keeping alert.
You can find lots more about it at the Honeynet project and SANS (Extreme technical content on these sites )
Perry
Original Post:
If you've been paying attention to media, you've probably heard about the Conficker worm. It really is a big thing, and has been a problem to corporate IT staffs since last October.
If you're a home user, there's not much you can do about it, except make sure your virus signatures are up to date, and run a virus scan.
If you would like a quick sanity check to see if you have conficker - click on one of these two links:
Symantec , or F-Secure.
You should see Symantec and F-Secure, two network security companies. If you had the Conficker worm, you'd get something else, and should immediately run a full security scan.
The reason it's come up now to the mass media is that researchers have found a reference to April 1 in the Conficker code, and they're not sure what it does. Conficker might wake up and do something, and it also might be part of a bigger event, so we're keeping alert.
You can find lots more about it at the Honeynet project and SANS (Extreme technical content on these sites )
Perry
Subscribe to:
Posts (Atom)
