Posted on

BT Internet Mail Fail (again)

BT Internet’s email system is broken AGAIN. It rejects everything it gets as “spam” (554 Message rejected, policy (3.2.1.1) – Your message looks like SPAM or has been reported as SPAM please read…)

Having checked against blacklists, and sent perfectly innocuous test text messages to friends account, it’s definitely busted.

My advice to anyone using BT Internet for important email is to get a proper account with a proper provider (or handle your email in-house if your name is not Fred and you don’t work from a shed).

Posted on

M A G Airports web site exploitable for mailbombing attacks

Last July I was surprised to receive an email of “special offers” from Manchester Airport. I’ve only ever been to Manchester once, and I drove. It was actually sent to a random email address; was the company just sending out random spam?

I checked, and visiting their web site produced a JavaScript pop-up asking you to enter your email address to receive special offers. I wondered if I’d accidentally confirmed acceptance to be added to the wrong mailing list, so I checked. No. Apparently this sign-up doesn’t bother to confirm that you actually own the email addressed entered; it just starts spamming whoever you ask it to.

It got worse. A look at the code showed it was easy for someone to make a load of calls to their site and add as many bogus addresses as they liked at the rate of several every second.

And it gets even worse – a quick look at the sites for other airports operated by MAG had identical pop-up sign-ups (Stansted, Bournemouth and East Midlands).

Naturally I called them to let them know what a bunch of silly arses they were. After being passed around from one numpty to another, I was promised a call back. “Okay, but I’ll go public if you don’t bother”.

Please generate and paste your ad code here. If left empty, the ad location will be highlighted on your blog pages with a reminder to enter your code. Mid-Post

Guess what? That was last July and they haven’t bothered. They did, however, remove the pop-up box eventually. They didn’t disable it, however. The code is still there on a domain owned by MAG Airports, and you can still use it to do multiple sign-ups with no verification.

So what are they doing wrong? Two things:

  1. Who in their right mind would allow unlimited sign-ups to a newsletter without verifying that the owner of the email address actually wanted it? Were they really born yesterday? Even one of the MD’s kids writing their web site wouldn’t have made such an elementary mistake.
  2. Their cyber-security incident reporting mechanisms need a lot of work. Companies that don’t have a quick way of hearing about security problems are obviously not doing themselves or the public any favours.

One assumes that MAG Airports doesn’t have any meaningful cybersecurity department; nor any half-way competent web developers. I’d be delighted to hear from them otherwise.

In the meantime, if you want to add all your enemies to their spamming list, here’s the URL format to do it:

Okay, perhaps not but if it’s not fixed by the next time I’m speaking at a conference, it’s going on the demo list.

 

Posted on

New DVLA on-line system is broken

Why can’t companies implementing government on-line systems actually get anything right? And if they must mess things up, why can’t they do it in private? The new DVLA system is broken. They ought to have tested it in-house, without launching a beta version on the public. Seriously, do they not know what a beta version is for?

My experience – I went through and entered all the details, paid, and got this:


It’s now impossible to tell whether it’s taken payment from the card or not. Okay, this appears to be an external system that’s screwed up BUT it’s not be handled properly. Basic rule of data communications – Assume the link will be corrupted and cope with it.

Posted on

Baofeng DMR handheld – the DM-5R

DM-5R PlusIn 2016 Baofeng released the DM-5R – what sounded like a fantastic DMR radio at a very attractive price. One of the best features was that it maintained the same form factor as the UV-5R, meaning accessories were cheap and plentiful. In fact it was completely compatible as an analogue transceiver, but with DMR too.

Only one huge problem – it only implemented Tier-1, which basically meant it could only talk to other DM-5Rs – not to the Motorola or Motorola-compatible Tier-2 units.

Suppliers insisted that Baofeng was going to release a software update for it. I’m on record elsewhere as being sceptical of this, as I’ve never seen a way to update the software on any Baofeng radios, even when they’ve introduced killer bugs in to the wild.

Apparently I was wrong(-ish), and a firmware update has appeared for the promised $10. Furthermore, a DM-5R Plus has also turned up on the market, with Tier-2 software already. I don’t have confirmed specifications (i.e. the unit in my hand) but there’s some question about the battery. Sometimes its listed as 1.5Ah, other time 2Ah. BL-5 battery packs (the UV-5R standard) are 1.8mAh. I really hope they haven’t been crazy enough to come up with a new battery format.

Battery aside, what’s not to like? If if’s Tier-2/Motorola compatible, then I’m sure I’ll love it. But how compatible is it? Questions remain. Take this announcement from DMR-UK (target likely to expire) quoting a Phoenix Repeater Keeper:

“I have now heard a station using the DM-5R on the Phoenix network. I can confirm that although the radio appeared to work (apart from having very low audio) it was actually occupying both time slots on the originating repeater. This confirms that even though the so-called Tier 2 update had been done it was still working as a Tier 1 radio.”

This is unattributed, and it’s not clear whether the transceiver was a DM-5R Plus or an upgraded DM-5R. I don’t even know if an upgraded DM-5R becomes identical to a 5R Plus. This will become clear over time.

That Baofeng didn’t get the complex firmware right first time would come as no surprise. But do I want to risk it? Only if they promised to offer a free fix; but they really don’t have a good track record there.

Posted on

No More Mr Nice Guy

Ever since I was Tech Ed on PCW (1991?), strange people have beaten a path to my door with a their domestic computer problems. Solving them was, for ten years, a good source of material for my column but that was in the 1990’s. Yet still them come. And still I help them. Why? Well I know if they took their precious data anywhere else it’d either cost more than they could afford, or they’d be ripped off and lose their data too. And I’d rather recover it before the mobile phone unlockers on the High Street made it harder.

So why is it that when you’re doing some people a favour they feel they have the right to telephone you for progress reports? Talk about looking a gift horse in the mouth,

One recent example is an elderly lady who’s PC World special laptop threw a shoe. I don’t know her, but a we had a mutual friend who asked if I’d help her out. This is not uncommon.

So along I go and take a look at it. Standard stuff – Windows is a mess and it won’t boot. After about an hour of trying, it almost boots but I opt for a System Restore as I really can’t stay any longer. “Call me in the morning and let me know what it says.”

I make it a rule NEVER to have a freebie fix in my workshop. People used to turn up and leave broken kit on my doorstep for “when I have time”. I also have to figure out what’s wrong with it the hard way. I don’t mind making the odd house-call for a worthy cause, but the kit stays with its owner. Period.

So what does she do? Call me in the morning? No! It turns out she’d get around my rule of not taking freebies back to base by leaving the laptop with our mutual friend. Then some time later she called me to see how I was getting on. Eh? First I’d heard she left it.

At the next opportunity I picked it up, against my better judgement, an spent an overnight session trying to sort it. I then had my proper work to do. And she called again. And after I’d spent all that time and effort on it came out with the immortal words “Well I don’t want to take your time up so why don’t I just take it to the [mobile phone unlockers] in the High Street. In other words, I know this is a freebee but so I’m going to use emotional blackmail to get you to hurry up.

I’m fed up of this game. I’ve seen it often enough. So I called her bluff. Let our mutual friend sort it out – I’m not touching it again with a barge pole. I’ve wasted about ten hours on it, I shall waste not a second more. Except I couldn’t help myself; someone told me she’d been unwell in hospital and I went soft.

And today she called me again. I could feel myself losing my cool, so I ended up asking her to sort out out with our friend and hung up before I blew. Ironically, her disk had been on the analyser, in place of paid work, for the last couple of days (as you may or may not know, data recovery systems can take long time to run if the disk is trashed).

And as I write this, she calls again (perfect timing) with more emotional blackmail. I apologize she caught me at a bad time earlier, but that she needed to understand… Then she gets down-right rude. I point out I’ve spent ten hours working on her machine and she might consider she’s out of order; she says “I beg your pardon…” so I just have to hang up. Her attitude is not pardonable.

I really don’t need all this. So if anyone is thinking of dumping some kit on my doorstep for a freebee, think again!

 

Posted on

It’s official – the Ruskies got Trump elected

This weekend the news has been full of the story that the CIA has accused Russia of swinging the US presidential election in favour of Donald Trump. Their evidence? Not much to speak of. Normally I’d be commenting on the technical merits of this kind of thing, but there are no technical details to back any of this up.

Apparently someone with “links to the Russian government” handed a bunch of pilfered emails to WikiLeaks that shed Hillary Clinton in a bad light. Let’s look at theses features in order.

  1. A lot of prominent people, companies and organisations have links to the Russian Government. They’re trying to imply Putin was behind it, but that’s hardly proof. In fact they’re rather coy about identifying the source of the leak anyway.
  2. WikiLeaks has a very good system in place to make it impossible to identify the source of any uploads. That’s the whole point. The identity of the uploader can only be conjecture.
  3. Hillary Clinton can come across as crooked without the help of the Russians. As can Trump, of course. Anyone could have obtained those emails and uploaded them. The most likely source is an insider; and it’s likely every foreign intelligence agency was reading them before long. And anyway, you could argue that someone has done the American people a great favour by exposing dodginess.

It’s worth remembering that largest number of cyber attacks originate from the USA, not Russia or China. Yet some people persist in blaming them any time something goes wrong. Doubtless they are behind some of it, but let’s get this in perspective.

It’s no secret that Putin and the Russian government are likely to prefer Trump to Clinton. Trump is telling it like it is on foreign policy, especially in the Middle East, whereas the American establishment is defending the indefensible corner they’ve painted themselves in to. Trump realises the Cold War is over, the CIA doesn’t. Whatever else you think about them, I’m sure both leaders recognise each other as being able to do business.

Trump dismissed the latest fluff pointing out that the information came from the same people as “Saddam Hussein’s Weapons of Mass Destruction”. He has a point.

 

Posted on

National Lottery Accounts compromised

This morning Camalot released the news that they’d detected suspicious logins on 26,000 of its on-line punter accounts, of which 50 had been altered. As far as they know. They’re keen to stress that this doesn’t affect their core system (i.e. can’t be used to fiddle the payouts).

It’s entirely possible that they haven’t been breached at all – people could be re-using passwords taken in an earlier heist. What’s odd is that someone has accessed thousands of accounts but done nothing with them. Why? Kiddies, possibly.

If this is as Camalot is currently reporting, well done to them for spotting the suspicious logins and acting fast.

Posted on

Are you a Tesco bank customer? Please verify your details. Spam meets salami.

I’m surprised I haven’t seen any phishing emails targeting hapless Tesco Bank customers following the publicity surrounding the weekend’s account raids. Give them a few more minutes.

Details on what happened are very thin on the ground. This morning on R4 Today they were saying a few thousand, but less than 10K customers had been affected. Estimates are now going up to 20K. But what’s interesting is this appears to be close to a good old fashioned salami raid, a term that the newbies in security may not even have heard of.

A salami raid got its name from thinly cut salami (a kind of foul-smelling sausage). If you cut off a thin slice, no one will notice, and if you do this to a large number of unfortunately sausages, none of their owners are likely to spot it but you’ll end up with a lot of processed meat.

Traditionally this approach was employed by computer programmers diverting pennies from a large number of accounts in to their own, but its unlikely to be the case with Tesco. The spotlight is likely to fall on people making use of the on-line banking facility to enrich themselves using other people’s logins, although I find it curious that accounts weren’t emptied while they had the chance.

Posted on

Baofeng UV-5X vs UV-5R Review

Someone asked me today whether they should get a UV-5X instead of an UV-5R. The 5R is a bit of a legend in the handheld transceiver world – a very cheap and capable VHF/UHF unit covering Business Light and Ham bands on FM. It has a few flaws – for example you can’t disable the keypad and stop users doing stuff they mustn’t (a matter for Business Radio, but not a problem for ham use)

That said, if you can trust your users not to meddle, it’s a good piece of kit. And the UV-5X has an upgraded motherboard and chipset for about 25% more on a very low price – so what’s not to like? (Incidentally, it’s the same as the Baofeng FF-12P, but without the reversed display)

I’m assuming, dear reader, that you will know the Baofeng UV-5R and its variants so I won’t go into any detail on these. If you don’t, they’re extremely good kit for the money.

But if you’re considering a 5X over a 5R, which should you choose? In terms of features, the 5X appears to have similar firmware to the 5R 297 release – presumably not identical due to the new chipset, but you won’t notice a difference. When I get around to it, I intend to pull one apart to see if the chip-set really has changed, but for now I’ll take Beofeng’s word on it. CHIRP treats the 5X as a 5R, although current builds do list it as a separate model. It’s measured power output is around 3.5W on UHF and 4W on VHF, although I’ve no reason to believe this is going to be particularly consistent across examples. (Low power mode was 1.5-2W on both). Accuracy of frequency (objective) and sound quality (subjective) are very good on both units.

For what it’s worth, the 5X is (currently) shipping with a new antenna, not found on the newer 5Rs, and quite different to the longer ones found on slightly older examples. I’d hate to say one performed better than the other – I might run some tests if someone twisted my arm, but in real use I didn’t notice anything.

So what are the differences you will notice? Well, mostly cosmetic! The torch, that Baofeng seem to be so proud of on all their radios, has been upgraded from the simple LED and how has a parabolic reflector. It is thus a better torch. Quite why this is important is beyond me, but if you are a fan of radios with decent torches in, buy one and knock yourself out.

The volume knob is smaller (to make room for the torch beam, I assume). The PTT button is different. And the cover for the microphone is a fold-back job rather than hinged, but has a screw which means you can remove it completely and put it back later. This isn’t a bad thing if you’re using a microphone; the hinged cover on the 5R and similar was a bit vulnerable when open.

One improvement I did notice is that they’ve fixed the carrier squelch nonsense (on the UV-5R the setting made very little difference). However, the current build of CHIRP allows you to tweak this on other models anyway (it’s under Service Settings).

But, there is a killer reason why you may want to stick to the 5R – support. In some crazy move, the 5X uses a different (incompatible) battery and a different charger. If you’re already running 5Rs this is going to be a total pain; if you don’t have a Baofeng radio yet it’s going to limit your choice and availability of accessories. The DM-5R (the digital version) very sensibly kept compatibility with the 5R accessories, so why couldn’t this?

The 5X is, however, reputed to be splash-proof, if not waterproof. This is a good thing. The keypad also has bigger keys – that’s to say thicker with more travel, NOT as you might think, with a larger face. There’d be no room anyway, although The 5X is actually a bit taller. This means it won’t fit the rubber armour sleeves or any tight-fitting holster. Another problem is that I don’t think anyone can supply it with a UK charger as standard, although the US one will work with an adapter.

The UV-5X is not a bad radio, but to mind it’s not good enough to beat the UV-5R, where the ace is the range and availability of spare batteries. For my money, if I wanted to get more than the bog-standard UV-5R I’d go for the UV-5RHX or UV-5RTP – with upgraded (three setting) transmitter power. They’re accessory-compatible with the UV-5R, although internally (and to CHIRP) they appear as BF-F8HP and a BFP3-25 and both have NSR3409 firmware. The only difference is that the TP comes with the new rounded shorter antenna and the HX doesn’t appear to be available with a UK power adapter, although it does ship with the large battery. I don’t think anyone in the UK is selling it.

Posted on

Has LinkedIn had its data blagged again?

This could very well be related to the breach that occurred in May, but it might be a new one.

This morning a trap email account, known only to me and LinkedIn, started to receive a lot of spam of a similar nature. This hasn’t happened before. For anyone else to be aware of this addresses existence it had to be stolen from me or from LinkedIn, or possibly by monitoring an ISP if not encrypted en-route. I’m pretty confident that it wasn’t stolen from me; the system it exists on is pretty secure and under my nose. As an added measure, all addresses are stored with additional traps that aren’t known to a third party, and if none of these is used its reasonable to assume that the data wasn’t pinched from me.

Monitoring an ISP is possible, but I don’t think it’s likely.

This means the address was probably stolen from LinkedIn. It’s hard to know for sure whether this was in May or later, but there was no indication it had gone missing until this morning so it’s worth of more investigation.

Has anyone else suddenly started receiving spam on a linkedin-specific address?