Botnet Movie

There's a cool botnet introductory movie over at GOVCERT.NL (Computer Emergency Response Team for the Dutch Government).

Combating Keyloggers

Ever found your self in an Internet Cafe checking your e-mail or a forum you are registered in? Did you stop for a moment to assess your security? Is someone looking over your shoulder? Is someone watching you in any way? Is the computer you are logged in infected with programs recording every keystroke? (You can't really check that one) No? Well, you should!

Ideally your presence in a public Internet access place should be entirely transparent. This means you should not type in at any time any personal information (no form filling, no logging in).

Anyway, I've come across a very interesting paper (PDF) which describes a simple yet effective technique in entering secure credentials in a compromised computer. It all begins with the basic principle in security: always assume someone is listening. So let's say you are sitting in a public computer. Always assume there's a keylogger installed which records every keystroke therefore is able to record your username and password as you type them.

For every valid username or password character you type, click somewhere outside the form and hit a long string of random characters. Then go back inside the form and continue with the second character, etc. That way while you'll have entered "ABC" as you password, the malicious software will have recorded "AasdsalklkblB9rbvmdsaCdg9tmbafff" (capital letters are used to distinguish the actual token).

This works because the keylogger may know that you are inside an internet Browser and what keys you press but cannot figure out the exact location of the keyboard cursor.

Sounds like a good trick huh? Well, I agree. It is pretty good. But let's be smart about using it.


[ Debugging... ]

Improper use of any security technique is all it takes to render it useless.

In the above method you should not type the same password twice in the same computer because, as you can understand, patterns emerge. So if I type:

AasdsalklkblB9rbvmdsaCdg9tmbafff
AlkfdlgmkmbkdasB324kfdlklCkfkbba
dmfdlkdsAmmkdgfg552BdfdffdCcba

we have three strings of characters all containing, for sure, the actual password.

Now all we have to do is use a known algorithm which uses certain known characteristics to crack the system. For starters if a certain letter or number or symbol is not present in all three tokens, it is excluded since it can't be part of the password (which exists in all three). Next, there's the sequence of characters. If for example we encounter the sequence "mb" (and not the sequence "bm") in only one or two of the tokens then either "m" or "b" have to excluded. The algorithm goes on so that only a few characters are left and then we start with possible combinations. If we take into account that most users use 5-8 character-long passwords, a brute force won't be too hard.

Of course there's always the smart way called Longest Common Subsequence problem.


Let's sum up...

what we have here is a very practical technique in protecting our sensitive information from a keylogger. But we must use it wisely and only once since patterns emerge which can bring the whole thing down.

P.S.: Also please consider the majority of users, when asked to type in a random string, will go for "asdf..." due to their fingers' position on the keyboard. Not so random :P
So here you have another characteristic which can make the cracker's life a lot easier.

"For your convenience"

It is a common joke here in Greece the story about a boyscout who desperately wants to do his good deed for the day and helps an old woman cross the street although she preferred to stay on the other side. The last few years many services online tend to do things for us, before us.

For example, today I received a World of Warcraft 10-day free pass from a friend of mine. According to the instructions all I had to do was install the game and create an account using the key written on the pass to play for free on the WoW servers. Right? Wrong! During the account creation process Blizzard asked me for my credit card number. Why? So that should I wish to continue my "online experience" I won't have to go through a new registration process and possibly don't make it in time to keep my current character in the game. In fact the disclaimer insists that this is for my own "convenience" and that if I make that choice (to renew my subscription), my credit card will be automatically billed every time my pre-paid time expired to ensure "undisrupted gameplay". The above are an essential step in the "free" account registration process. If I want to get a free account, I have to fill in my credit card number. I may stop playing at the end of the 10-day free period and never get a new subscription ever again. It doesn't matter for them. They still need my credit card information. Of course I do not believe this is a scam and that I'll be billed but what a minute.

The problem is that Blizzard will store and manage my sensitive credit card details according to its policy. Well, I do NOT trust that policy. Having that information available in some hard disk somewhere in the world does NOT make feel safe. And what if some cracker manages to compromise the safety of their systems? Certainly no one can claim they have a "hack-proof" system. You never know the next point of penetration until you are penetrated in that way. So why do I have to worry about that?

Giving your credit card for an one-time automated billing process is one thing and keeping it stored for the future is quite another. The people who use the second policy have to say in their defence that the user does not have to go through the information fill-in process again and again. I don't mind. As long as we are talking about SSL sessions I really don't mind typing in a few letters and numbers every time I want to buy something.

So this is a classic case where they make me give up my information for them to store in order to make a single purchase. I may never get anything from them in the future. That doesn't matter. For my "convenience" and "service" they'll keep that information. Well, if they care so much about my "convenience" why don't they take the time to ask me what I really want?

How safe do you feel about your online accounts? Right now, this moment, assume your identity is compromised. What would you lose? Do you have your credit card details stored somewhere? Assume they are compromised. How much money do you have in your bank account? Think about it.

These things scare people off the net. It's not me or any other guy talking about security and possible attacks. It's the marketing departments of companies providing "digital ease" and then when someone hacks in one of these databases and it hits the newspapers everyone is terrified and talking about how vulnerable we are against these "criminals".

Let's go back to the Blizzard case. I did not give my credit card. For a moment I considered opening another bank account and having a second credit card, linked to that account, so that I can contain a possible disaster (I would keep a very limited amount of money there etc). Then again why should I do it? Why should I get into paperwork and banks and ultimately employ a very "inconvenient" way in order to register in a system designed for my "convenience"? And what if I do not have a credit card? World of Warcraft subscriptions may be payed with the use of pre-paid cards sold in stores. Many people, especially teenagers, use them. So there's an alternative payment method for full-time subscriptions but not for guests.

To sum up, the "free guest pass", designed to bring people in the game, worked exactly the opposite way for me. And any other "smart" system that works for my "own good" without asking me what I really want will never have me as a customer.


Dear Blizzard,

I am not technophobic or anything. In fact the majority of my purchases are placed online. I am into technology and that's why I want to see things getting more secure and therefore more user-friendly. I JUST DO NOT TRUST YOU GUYS.

Who's messing with my mail?

Everyday I see mailing lists that allow uncontrolled (un)subscription. That means that all you have to do is type in your e-mail address to join/leave that list. Why is that wrong?

Because if you know a guy's address you may subscribe him to spam/porn/etc lists despite his will. You don't get much profit out of this except the fact that you make his life a little bit harder (sorting out the spam). For example I beginning to believe that someone is giving away the list address of an academic class I am attending (the teacher is a pain the neck and many of his students would like to get back at him). Also, if you know that someone is subscribed to a usefull (to him) list, you may unsubscribe him at any time, preventing him from receiving future updates and news.

It's like someone can subscribe you or rivert/cancel your subscription to a magazine or, worse, divert you bills so that you never receive them and therefore never pay them. As you can see, it IS a big deal!

All mailing lists should provide a verification link/code every time you try to add/modify/remove an entry to their system.

dodgeit.com: Beat 'em in their own game

Having an e-mail account is common these days. In fact, most people have more than one. So, there is a tendency among web sites to ask for your e-mail in order to track you down somehow or keep statistics of their own. For example, wanna download sth? give us your e-mail! This doesn't seem so bad at first but wait a minute! Giving away your address lets them know where they can reach you. And unfortunately a great deal of them takes advantage of that. For starters they decide to subscribe you to their mailing list, sending your their daily or weekly newsletter. Others sell your address to marketing firms which in turn use it to promote their customers' products.

In the end you end up with a dozen or so e-mails a day in your Inbox that you don't care and never asked for. What can you do?


Well, there yet another solution to this: dodgeit.com

Next time you are asked for your e-mail, give a random blabla37@dodgeit.com. No registration required! After that, visit dodgeit.com and check your e-mail (still without any registration or password). Pretty cool, huh?

Another interesting aspect of this: can you think of common usernames other people would use? Like nobody@dodgeit.com or person@dodgeit.com, etc? Try entering some of them in the site and you'll get a list of the e-mails these people got. So next time you register to a forum or sth, use a hotmail/gmail/yahoo account instead!

Leaking your info on the net...

It's been 8 years since I purchased Windows 98. At that time I felt really good about my self buying an "advanced Operating System". Of course later I realised I had payed for something that didn't work well most of the time. Anyway, I was living the dream. I was the proud of owner of Windows so I had no second thoughts entering my personal information during the Installation.

Not long after that I found out in horror that web pages could read that information and store/forward them. How did they get that? Well, I started finding cookies in my hard disk titled "firstname.lastname@domain". That's right. It was courtesy of Microsoft :/

Every time someone asked for my details, Windows kindly provided them! At no time did I receive such notification or warning. My name, address, phone number etc where transmitted transparenty to the web.

I remember immediately formatting my hard disk (which does not wipe out sensitive data but at least renders them inaccessible to Windows) and installing the OS under a fake name. I, the legal owner of an overpriced OS, had to forge my identity to ensure some, partial anonymity.

Since then, I developed a fear against entering my name anywhere. Privacy statements go right out the window for me. Whether it is a well-known web site (companies, service providers) or a no-name one, it's one and the same. I simply do NOT trust them. I am not ashamed to state so. I am not fealing paranoid. I just feal you are NOT good enough to protect my privacy. Goodbye now.

Detecting Tor

Talking about Tor with RSnake has produced some interesting points:

First of all, the use of Tor can be detected. In detail, Privoxy - a proxy working with Tor to provide web surfing anonymity - tends to block certain website elements that may blow a user's "cover". Such behavior can be monitored by a website to determine whether a visitor is under a cloak of invisibility or not.

Also, as pointed out, Tor network uses the domain extension .onion (like .com). Of course that is inaccessible outside the network so there you have it, another detection way. If such page gets a hit, the user is using Tor. Of course the user's anonymity is not compromised in any way since one can never be sure about the given IP. Yet this method is a potential tool for content providers who aim in restricting access to identifiable users.

Tor still remains one of the best ways of operating in insecure networks.

Public Web Surfing

The New York Times has an article on safely using public networks (e.g. Wi-Fi hotspots) or public computers (e.g. at an internet cafe or airport). The author points out that most users leave too many traces behind them after using their computer in a public network or using a public computer. These traces may be from browser cookies to passwords and work documents.

It is true that most people are just computer users meaning they don't know and don't care about technical issues, including security. So someone is on the move, wants to check his/her e-mail or contact a friend, connects to a hot spot or visits an Internet cafe. In any case, malicious people could "snif" what he/she does and steal almost anything this user sends or receives.

Of course there are many things one can do to protect him/her self. Everything has to do with attitude: First of all more and more people have laptops so using a public computer is rare. Yet, if you ever need one, keep in mind that it's like talking on a public phone in the middle of a square. Would you yell your ATM PIN over the phone or your e-mail password? No! Hell, No! The same rule applies here. When typing in passwords *always* make sure you are using SSL. If not, just quit. The problem is someone could plant a keylogger in that public PC and collect tons of information. For that reason these PCs are restarted between different users and any specific user-specific programs or data are wipped out. But you can never be too safe so consider public PCs the last possible solution. When using your own laptop you are at least safe from malicious programs. Eavesdroppers do exist though. Check here too for SSL and don't even think about logging in otherwise.

Go ahead, check the article. The author tries to ring the bell to those who are totally unsuspected of the potential dangers but may end up scaring them into ineffective techniques which only offer the illusion of safety. Another point I disagree with is the listing of "security tips" like encryption software and VPN. As I've just said users who don't know how to deal with this stuff are likely to a) lock themselves out of important files b) use a VPN in such way that no protection is provided c) get tricked too easily.

To sum up, public web surfing is certainly a great service allowing you to talk, work, have fun while on the move but, as any public means of communication, should not carry sensitive information. If that is absolutely necessary, there are ways to ensure privacy. The thing is that Security Policies and Techniques for "Private Public Web Surfing" should be applied by trained professionals and not layed upon the hands of ignorant users.

P.S.: To read the article you'll be prompted for a username and a password. Since registration is free I don't see any point in this. I mean they restrict access to registered users but then again, anyone can register! So why not leave the access totally public? Anyway, use goaway147:goaway as username:password (thanks to bugmenot.com).

Next Gen Search: Photo ID Lookup

Every time you add a picture to your gmail contact's profile, you are asked to crop it to seperate the face from the body. So Google has, somewhere, a huge database with people's headshots tied with nicknames and other information. I wonder why...

Now hear this: Google was very close in acquiring Riya, a face recognition service which expanded into a visual search engine. The deal broke since Google decided to develop an in-house solution. This prooves their intentions in developing algorithms for processing and recognizing faces.

How about that? You enter google.com, search a name/nickname and download the guy's/gal's photo. Another scenario describes you taking a photo with your digital camera/cell phone, uploading it to the search engine and identify the displayed person. OMG. This is just huge. What's next? License plate identification?

Of course there are serious legal implications mainly from possible privacy violations.

To sum up, from a technological point of view this is very big (of course intelligence services have been using this thing for a decade now) but we should give it a good thought before launching it as it is. Besides, Google is already under suspicion because of its search engine (keeping user search entries) and its mailing service (filterning e-mail content to extract information). Finally, all this huge amount of data is becoming an invaluable source which is yet to be mined.