Technology – Page 16 – Frank Leonhardt's Blog

Wii’ls come off BBC iPlayer

Those of us with suspicions about BBC’s iPlayer project have been proven correct. The corporation has once again shown its properly out of touch with those who are forced to pay for it by first pushing everyone on to using iPlayer, and then discontinuing the support for it on the most widely installed platform in the country.

When the BBC obtained the funding for BBC3 and BBC4, part of the justification was to allow re-screening of significant programmes that were difficult to watch live in the multi-channel environment. This worked for a while, and then they stopped doing this and filled the airwaves with complete garbage, citing iPlayer as the way to catch up on everything you couldn’t see at the broadcast time. A lot of us were suspicious that this was more to plug iPlayer than anything else. Fortunately in 2009 the corporation released iPlayer for the most popular games console – the one that more households had installed than anyone else – the Nintendo Wii.

Although they had questionable motives, it worked well enough until late last year, then they messed with it. Then it didn’t work. And a few days ago it became apparent that they were dropping the service with the jaw-droppingly arrogant excuse that it was five years old and they wanted to concentrate their efforts on newer platforms.

This is complete nonsense, of course. The Wii platform remains the most widely available, by far. The Wii is tried and trusted, appreciated by families if not hard-core games fanatics, and is hardly an obsolete product. It’s still on sale, and at a reasonable price. As a platform for iPlayer it’s an obvious choice.

So what’s the BBC thinking? Are they stymied by simple technical incompetence, having no one available to working on the Wii code base following an “upgrade” to a new iPlayer version? Quite possibly, and they’re so out-of-touch that they don’t see a problem with this.

A feeble note the BBC web site says they are concentrating efforts on producing a new player for the Wii U – the console no one wants. Hell is going to freeze over before this platform gets anywhere near the installed base of 100,000,000+ of the standard Wii consoles (worldwide, as at late 2014, based on Nintendo’s quarterly consolidated regional sales reports).

So what does this tell is about the BBC? If iPlayer is part of an important future broadcasting strategy, they’re not supporting it very well at all. All the house advertising suggests it’s important to the corporation. It’s a strange outfit – some of its R+D has always been groundbreaking whereas recently a lot of it has been laughable, and the management is notoriously well insulated from the real world. Their failure to support common platforms in the arbitrary manner makes the whole concept unstable.

In the old days you could invest in a TV set in confidence knowing that your license fee was going to keep it supplied with content for as long as was reasonably possible. The BBC acted very honorably when it came to the switch from VHF to UHF; a bit less so with DVB-T – and they’ve used the extra channels to provide constant re-runs of their lowest quality output. Dropping iPlayer now, just as families were trusting that the could invest in the equipment needed to receive the service is a continuation of a worrying trend.

9-February-152-March-15

jpmoryan.com malware spam

Since about 2pm(GMT) today FJL has been intercepting a nice new zero-day spammed malware from the domain jpmoyran.com (domain now deleted). Obviously just one letter different from J P Morgan, the domain was set up in a fairly okay manner – it would pass through the default spamassassin criteria, although no SPF was added as it’s being sent out by a spambot.

The payload was a file called jpmorgan.exe (spelled correctly!) with an icon that was similar to an Adobe PDF file. Is it malware? Well yes, but I’ve yet to analyse just what. It’s something new.

Text of the message is something like:

Please fill out and return the attached ACH form along with a copy of a voided check (sic).

Anna Brown
JPMorgan Chase
GRE Project Accounting
Vendor Management & Bid/Supervisor
Fax-602-221-2251
Anna.Brown@jpmchase.com
GRE Project Accounting

Be careful.

Update: 19:30

As a courtesy, I always let affected companies know they’re being attacked, with variable results. J P Morgan’s cyber security department in New York took about 30 minutes to get to; they couldn’t cope with the idea that (a) I was not in America; and (b) I wasn’t even a customer of theirs. I eventually ended up speaking to someone from the “Global(sic) Security Team” who told me that if I was a customer I didn’t need to worry about it, but I could sent it to abuse@… – and then put the phone down on me. This was an address for customers to send “suspicious” emails to. I doubt they’ll read it, or the malware analysis. If you’re a J P Morgan customer, you might want to have a word about their attitude.

12-January-158-September-15

Interesting security issue with Google Apps for Education

I’ve come across a feature of Google Apps for Education that people should really be aware of. It goes like this…

When a school or college signs up for Google Apps for Education, a single email account is used to register a local administrator. This administrator then has control over the sub-accounts, including creation, passwords and monitoring. This would be someone at the school you can trust, right? Because they have access to all your children’s data. And it’s only for school use, so where’s the problem?

Well here’s the problem: that data will probably include a GMail account, and they may not be using it for education-related matters. Creepy. Assuming you trust the monitor, do you snoop on the pupils for their own protection or leave it completely unmoderated, with all the implications for child safety. You’re between a rock and a hard place. By forcing pupils to use an insecure channel you’re responsible for the consequences: if you look you could be accused of voyeurism; if you don’t you can be accused of allowing abuse which you could have prevented.

And it gets worse, because you’re basically logging in using a Google Account. How many people log out when they’re finished? And if a child logs in on a home computer and someone else uses it afterwards without realising, the administrator at the school gets to snoop on data inadvertently added to the account by other members of the household.

Are you a parent, and were you aware of this? You are now!

If you’re a school, my advice is to (a) monitor the monitor; and (b) make sure children know to log out after use; and (c) make very sure that you have parents’ specific permission to allow their children to use the system, being aware of the above. If not and you end up monitoring someone you don’t have permission to (i.e. not your pupil), you’re probably looking at an offence under the Misuse of Computer Act 1990 in the UK, and a class action law suit in the USA. Remember that school in Philadelphia that took snapshots using students’ Macbook webcams without telling anyone? (Robbins v. Lower Merion School District). There was no suggestion of foul play, just naivety on the part of the school district. And it cost them $600K to settle, plus a great deal of embarrassment.

31-December-142-March-15

Do I have SoapSoap in my WordPress?

Apparently, 100,000 WordPress sites have been compromised by this nasty. It injects redirect code in to WordPress themes.

According to an analysis posted by Tony Perez on his blog, it’s going to be easy to spot if you’re a server administrator as in injects the code:

php function FuncQueueObject() { wp_enqueue_script("swfobject"); } add_action("wp_enqueue_scripts", 'FuncQueueObject');
In to wp-includes/template-loader.php

So,

find / -name template-loader.php -exec grep {} swfobject \;

should do the trick. I’m not a PHP nut, but I don’t think swfobject is common in that file.

Update: 06-Jan-2015

The web site linked to above has an on-line scanner that’s supposed to check for this problem, so I’ve just run it against this blog. It found something here. False positive, methinks! I’ve written to them pointing out that the search may be a little naive given the subject matter of that post! Fair play for providing such a tool free of charge though. It’s a little hard to see how such a scanner could work at all, but not pick up text lifted from a compromised site.

27-December-14

Sony and Microsoft games network hack

Both the Sony an Microsoft games network servers have been badly disrupted from Christmas day. The cyber vandals Lizard Squad have admitted responsibility.

This outage has nothing to do with millions of new games consoles being unwrapped and connected at the same time. Oh dear me no. Their network servers would have taken the huge spike in workload in their stride. This is definitely something to blame on those awful hactivists, and any suggestion that it was teetering on the brink and all it needed was a little push is a foul slur on the competence of Microsoft and Sony.

The extent to which Lizard Squad was involved may be in question, but major respect for the expert way they’ve played the media. Again.

10-December-1423-December-14

Sony Hack – whodunnit?

Details are starting to emerge about how Sony was compromised. Sagie Dulce from Imperva reckons he’s seen the Destover back-door software used before, in 2012 in Saudi and then again in the 2013 Dark Seoul.

A few days ago Jaime Blascoof AlienVault Labs sent me a note about malware samples he’s got hold of, with the following comment:

“From the samples we obtained, we can say the attackers knew the internal network from Sony since the malware samples contain hardcoded names of servers inside Sony’s network and even credentials – usernames and passwords – that the malware uses to connect to systems inside the network. The malware was used to communicate with IP addresses in Europe and Asia, which is common for hackers trying to obscure their location. The hackers who compiled the malware used the Korean language on their systems.”

I’ve had other reports that the malware was compiled using a Korean language development environment. This means nothing to me – a lot of these generic malware kits are.

To me, this is looking more and more like the work of the usual suspects. An inside job – not a sudden and spontaneous lashing out by the North Koreans. This kind of attack requires time to put together.

5-December-1423-December-14

North Korea Refuses to Deny Sony Cyber Attack

The popular media is in a frenzy – those dastardly North Koreans have launched a cyber-attack on Sony, pinched a lot of films and posted them on-line in revenge against the company for a disrespectful comedy making fun of their glorious leader. According to the BBC, they have refused to deny the attack, with a spokesman saying “Wait and see.”

The north Koreans must be loving this – they were, apparently, pretty hacked off about the depiction of Kim Jong-un. They have no sense of humour as far as he’s concerned. However, this bears all the hallmarks of a bunch of script kiddies ripping off a load of films to add to the pirate haul. The North Korean’s response, when doorstepped about the incident, suggests to me that they think their “enemy’s” predicament is hilarious, but stops well short of taking credit for it. Why would they be so coy? Because when the real culprits break cover they’d look stupid.

Yes, it could have been the North Koreans, but they’re not exactly high-tech. As far as I can tell there are only about a thousand IP addresses for the whole country. If it were China in the frame, I could believe it. Would the Chinese pull a stunt in support of their southern “friends” – I somehow doubt that; not over a film.

Given the extensive nature of the compromise, I wouldn’t be surprised if it was an inside job. Did the people involved set out to purpetrate the hack of the decade? There’ll be trouble now.

27-November-1427-November-14

Daily Telegraph and The Independent web sites compromised by “Syrian Electronic Army”

I’m getting reports from people reading the Daily Telegraph web site saying that a dialog box saying “You have been hacked by the Syrian Electronic Army (SEA)”. The implication is that their PCs have been compromised, but I have no evidence that this is actually true. The web sites of the newspapers do appear to have been breached, however, in order to cause the pop-ups to appear.

Reports already exist of the problems with the Independent and the Evening Standard, with a time of 12:20 GMT, but the Telegraph problem appears to be new.

The problems don’t appear on all pages of the Telegraph – in fact the problem seems to be on the Alex cartoon only. The Independent has been off-line, but at time of writing is back – but slow.

Given the preponderance of adverts on this page, one possible method of attack could be via the advert feed. It certainly doesn’t happen of every access. However, reports suggest of a redirect to a page showing the Syrian logo. This could be JavaScript, a server change or a DNS hijack. People at the papers probably know which, but they’re a bit busy right now…

12-November-14

“Right to be forgotten” and police body cam footage posted forever on YouTube

In Europe, the court has decided that people who don’t like search engines like Google turning up embarrassing details about them now have the right to get the offending pages removed from the index. A Spanish lawyer by the name of Mario Costeja Gonzálezping hated people typing his in his name and finding an article in his local rag alluding to his past financial difficulties, and when they refused to pull the historical record he took all and sundry to court until Google (in particular) was forced to stop indexing the page. If you want to read the page from La Vanguardi, click here. Whilst I have some sympathy for the guy, taking Google to the European Court over the matter is not the best way to keep out of the public eye.

This isn’t without controversy – it’s censorship by the back door, handed down by a bunch of un-elected judges and everyone in Europe now has to comply. However, our colonial cousins, with their First Amendment, have e completely different problem – too much free speech.

Someone is exploiting the system, and the fact that publicly generated records in the USA are public, by requesting all police body camera images in order to provide content for a new YouTube channel, as reported by Komo News. Basically they’re slurping all the footage shot by Poulsbo Police in Washington and posting the “best bits”. The privacy issues are mind-boggling! Forget getting drunk and posting an unfortunately selfie on your Facebook page – if you get a visit from the cops in Poulsbo, it could end up on YouTube forever.

What is Google (owner of Facebook) doing about THIS? Absolutely nothing (thus far); it’s free speech, isn’t it?