November 2016 – Frank Leonhardt's Blog

National Lottery Accounts compromised

This morning Camalot released the news that they’d detected suspicious logins on 26,000 of its on-line punter accounts, of which 50 had been altered. As far as they know. They’re keen to stress that this doesn’t affect their core system (i.e. can’t be used to fiddle the payouts).

It’s entirely possible that they haven’t been breached at all – people could be re-using passwords taken in an earlier heist. What’s odd is that someone has accessed thousands of accounts but done nothing with them. Why? Kiddies, possibly.

If this is as Camalot is currently reporting, well done to them for spotting the suspicious logins and acting fast.

28-November-1624-August-21

Putin the Boogy Man

Vladimir Putin in KGB Uniform I’ve been listening to Today on Radio 4. Francois Fillon has won the conservative presidential candidacy for the French president. Apparently, shock horror, he likes Margret Thatcher and is friendly with VLADIMIR PUTIN. That sounds a bit like Vlad the Impaler!

The presenter also had a jibe about Donald Trump; he also wants to do business with this monster.

He is a monster, right? He’s a Rusky, like Starlin, and therefore wants to take over the world. And he’s done all these terrible things to prove his evil intent. Lets just remind ourselves…

First off, Russian troops put down a “revolution” in Chechnya. Actually, this was an Islamist uprising, but before the West had experienced Islamist uprisings so at the time Mr Putin was portrayed as Mr Nasty. Now we don’t really want to talk about it.

Then he backed the Assad “regime” in Syria against the “rebels”. Assad was and remains the democratically elected president of the country. Sure, he tried to make war against Israel at every opportunity but that’s normal around there. Not a nice person, but democratically elected. The so-called rebels were self-appointed, and unsurprisingly, have long-since disappeared and Islamists have filled the vacuum. The West continues to condemn Russia for backing the democratically elected government against, you guessed it, the Islamist insurgents (Islamic state and the like).

“Ah”, the liberal media wail, “Russia is bombing Aleppo and civilians in the ‘rebel’ held areas are being killed.” Well there’s a war on. The “rebels” are bombing the government-held areas and killing civilians, and this is okay? And non-Russian forces are bombing rebels in Mosul, yet there they’re called Islamic State, and there is little mention of civilians.

Okay, what about annexing Crimea. Russian tanks in a foreign country. What actually happened there?

Well in 2010 Viktor Yanukovych won the presidential election in Ukraine, beating Yulia Tymoshenko. It was considered a fair election. He won. Some people in Ukraine didn’t agree and started fighting about it a couple of years later. Reports vary, but Yulia Tymoshenko’s supporters have neo-Nazi overtones.

Ukraine was split in to the Russian-speaking Crimea and the rest, and the Russian-speaking population in Crimea was in trouble from the violence, so Putin sent in the troops to protect them, and support the democratically elected government. The West sided with the neo-Nazi rebels.

For historic reasons, Russians do no like neo-Nazis. Strangely the Western liberal media reckons they’re okay if they’re fighting against Russia.

Now I’m no more a fan of Putin than I am of most politicians. He’s got his hands dirty, to say the last. Rising up through the KGB is hardly an ideal career path for a benevolent leader, although this is how it’s been done for a long time. But when you look at the situation in Russia, there are plenty of worse candidates for president. You could say he’s the least-worst option. The Russian people like the guy; he looks out for their interests. And with the West pushing hard against Russia, who can blame them? And to cap it all, Putin is actually the defender of democracy in his foreign policy; how does he keep snatching the moral high ground from Obama?

The reason is that Obama and the West still have the “reds under the beds” attitude. Putin, on the other hand, has a different understanding of who the real enemies to freedom (or his cushy way of life) are. As do Trump and Fillon.

Let me be clear – Putin may be a gangster president and a malign influence on the world, but he’s not a lunatic and his actions are not crazy. There are actually worse candidates for the job, which should be remembered before rolling the dice.

And while we’re obsessing about Putin, we’re ignoring the real lunatics in other countries – and regimes like China.

10-November-1610-November-16

Enough with this “Trump Crashes Immigration Site” rubbish!

Ha Ha Ha! On Wednesday, Canada’s web site for prospective immigrants crashed due to the weight of American’s trying to escape from a USA run by Donald Trump. Really? Now other immigration sites such as New Zealand are reporting similar problems and certain some media outlets are lapping it up.

It’s a funny story, but I suspect that it’s too good for some people to check the facts.

There are two possibilities here:

A load of American’s panicked suddenly.
Some jokers decided a DDoS attack at this point to make it appear American’s were panicking would me funny

In the absence of any evidence to the contrary, I think option two is way more likely. People have been joking about the “move to Canada” option for months.

7-November-167-November-16

Are you a Tesco bank customer? Please verify your details. Spam meets salami.

I’m surprised I haven’t seen any phishing emails targeting hapless Tesco Bank customers following the publicity surrounding the weekend’s account raids. Give them a few more minutes.

Details on what happened are very thin on the ground. This morning on R4 Today they were saying a few thousand, but less than 10K customers had been affected. Estimates are now going up to 20K. But what’s interesting is this appears to be close to a good old fashioned salami raid, a term that the newbies in security may not even have heard of.

A salami raid got its name from thinly cut salami (a kind of foul-smelling sausage). If you cut off a thin slice, no one will notice, and if you do this to a large number of unfortunately sausages, none of their owners are likely to spot it but you’ll end up with a lot of processed meat.

Traditionally this approach was employed by computer programmers diverting pennies from a large number of accounts in to their own, but its unlikely to be the case with Tesco. The spotlight is likely to fall on people making use of the on-line banking facility to enrich themselves using other people’s logins, although I find it curious that accounts weren’t emptied while they had the chance.

3-November-1616-November-16

Baofeng UV-5X vs UV-5R Review

Someone asked me today whether they should get a UV-5X instead of an UV-5R. The 5R is a bit of a legend in the handheld transceiver world – a very cheap and capable VHF/UHF unit covering Business Light and Ham bands on FM. It has a few flaws – for example you can’t disable the keypad and stop users doing stuff they mustn’t (a matter for Business Radio, but not a problem for ham use)

That said, if you can trust your users not to meddle, it’s a good piece of kit. And the UV-5X has an upgraded motherboard and chipset for about 25% more on a very low price – so what’s not to like? (Incidentally, it’s the same as the Baofeng FF-12P, but without the reversed display)

I’m assuming, dear reader, that you will know the Baofeng UV-5R and its variants so I won’t go into any detail on these. If you don’t, they’re extremely good kit for the money.

But if you’re considering a 5X over a 5R, which should you choose? In terms of features, the 5X appears to have similar firmware to the 5R 297 release – presumably not identical due to the new chipset, but you won’t notice a difference. When I get around to it, I intend to pull one apart to see if the chip-set really has changed, but for now I’ll take Beofeng’s word on it. CHIRP treats the 5X as a 5R, although current builds do list it as a separate model. It’s measured power output is around 3.5W on UHF and 4W on VHF, although I’ve no reason to believe this is going to be particularly consistent across examples. (Low power mode was 1.5-2W on both). Accuracy of frequency (objective) and sound quality (subjective) are very good on both units.

For what it’s worth, the 5X is (currently) shipping with a new antenna, not found on the newer 5Rs, and quite different to the longer ones found on slightly older examples. I’d hate to say one performed better than the other – I might run some tests if someone twisted my arm, but in real use I didn’t notice anything.

So what are the differences you will notice? Well, mostly cosmetic! The torch, that Baofeng seem to be so proud of on all their radios, has been upgraded from the simple LED and how has a parabolic reflector. It is thus a better torch. Quite why this is important is beyond me, but if you are a fan of radios with decent torches in, buy one and knock yourself out.

The volume knob is smaller (to make room for the torch beam, I assume). The PTT button is different. And the cover for the microphone is a fold-back job rather than hinged, but has a screw which means you can remove it completely and put it back later. This isn’t a bad thing if you’re using a microphone; the hinged cover on the 5R and similar was a bit vulnerable when open.

One improvement I did notice is that they’ve fixed the carrier squelch nonsense (on the UV-5R the setting made very little difference). However, the current build of CHIRP allows you to tweak this on other models anyway (it’s under Service Settings).

But, there is a killer reason why you may want to stick to the 5R – support. In some crazy move, the 5X uses a different (incompatible) battery and a different charger. If you’re already running 5Rs this is going to be a total pain; if you don’t have a Baofeng radio yet it’s going to limit your choice and availability of accessories. The DM-5R (the digital version) very sensibly kept compatibility with the 5R accessories, so why couldn’t this?

The 5X is, however, reputed to be splash-proof, if not waterproof. This is a good thing. The keypad also has bigger keys – that’s to say thicker with more travel, NOT as you might think, with a larger face. There’d be no room anyway, although The 5X is actually a bit taller. This means it won’t fit the rubber armour sleeves or any tight-fitting holster. Another problem is that I don’t think anyone can supply it with a UK charger as standard, although the US one will work with an adapter.

The UV-5X is not a bad radio, but to mind it’s not good enough to beat the UV-5R, where the ace is the range and availability of spare batteries. For my money, if I wanted to get more than the bog-standard UV-5R I’d go for the UV-5RHX or UV-5RTP – with upgraded (three setting) transmitter power. They’re accessory-compatible with the UV-5R, although internally (and to CHIRP) they appear as BF-F8HP and a BFP3-25 and both have NSR3409 firmware. The only difference is that the TP comes with the new rounded shorter antenna and the HX doesn’t appear to be available with a UK power adapter, although it does ship with the large battery. I don’t think anyone in the UK is selling it.