Frank Leonhardt's Blog

No talk from TalkTalk

Charles Dunston’s budget ISP TalkTalk has been hacked again. Yawn. This time it’s big news on TV; the headline story in fact. Their website has been KOed for a couple of days, but it’s back online with a front page showing a different news agenda. They get their feed from AOL (also part of the Carphone Warehouse family), who probably just missed the kerfuffle; there’s no celebrity connection after all. Not yet, anyway.

If you’re a TalkTalk retail customer (or possibly a business customer – who knows how their systems interrelate and what data’s been pilfered), and you’ve used the same password with TalkTalk as any other sites, change your password on those sites NOW. The popular media is full of speculation as to what’s been compromised but they’re not mentioning passwords, presumably because TalkTalk will have told them that any passwords would have been encrypted. But if the criminals have got hold of the hashes, which is likely, it’s only a matter of time before they crack them.

How worried should customers of other ISPs be? Pretty worried, as on the serious side of the business they’re known as Opal Telecom, a significant LLU operator providing the link between the last time and the data centre for a large number of Broadband providers.

I can, of course, only speculate as to why this keeps happening to them. One reason might be related to several conversations I’ve had with people from ISPs TalkTalk has taken over along the way. Apparently they really don’t like hard stuff like UNIX/Linux, and within months of a takeover they force a switch to Microsoft before making all the UNIX people redundant. Any fool can use Microsoft – low levels of technical understanding are required, meaning cheap engineers and lower costs. But do their Microsofties actually know what they’re doing? I dare say that some of them do, and some of them don’t. But the bar for a point-and-click Microsoft house going to be lower.

23-October-1522-September-16

The spammed malware attack continues, but Microsoft SE has been getting it wrong

Kudos to Microsoft Security Essentials for picking up the nasty attachment being pumped out like crazy by the clean-skin botnet recently, while most of the other scanners failed to detect it. However, it was wrong about the identity of the malware. It’s not Peals.F!plock, as I originally reported with skepticism. It’s now detected as a variation of something known as Troj/DocDl-YU (to use the name give by Sophos). Read about it here:

https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~DocDl-YU/detailed-analysis.aspx

This uses Microsoft’s Office macro language to download further malware from the Internet and install it on the victim’s PC, so if anyone activates it there’ll be more than just this Trojan downloader to worry about. As it’s a Microsoft Word document, people tend to open it. If the government really wants to spend money telling the public how to avoid falling victim to cybercrime, they should start by warning about sending documents by email, instead of the current nonsense. Microsoft might get the hump, though, and as I understand it, they’re acting as advisors.

If people have macros disabled on Word, they’re probably okay as long as they don’t get tricked in to enabling them. I’m not hopeful in this regard.

Meanwhile, those behind it are changing the message tweaking the payload to avoid detection – quite successfully! The latest incarnation reads:

From: UUSCOTLAND@example.com

Subject: Water Services Invoice

Good Morning,

I hope you are well.

Please find attached the water services invoice summary for the billing period of 22 September 2015 to 22 October 2015.

If you would like any more help, or information, please contact me on 0345 #######. Our office is open between 9.00am and 5.00pm Monday to Friday. I will be happy to help you. Alternatively you can email me at UUSCOTLAND@example.com

Kind regards

Melissa

Melissa Lears

Billing Specialist

Business Retail

United Utilities Scotland

T: 0345 ####### (#####)

They appear to be updating it every morning at around 0800Z. Let’s see what we get tomorrow.

22-October-1522-October-15

iZettle now works with Apple iOS 9(.1)

I’ve just had a note to say that Apple has released a new version of its smartphone/tablet system that fixes the bluetooth bug in version 9.0 that prevented iZettle readers to connect using Bluetooth. So fanbois can now upgrade their fondleslabs without cutting of their revenue stream.

For details see here: https://www.izettle.com/gb/help/articles/2122036

On the Android front, teething problems with iZettle 3.0 software – the one that works with contactless – seem to have been fixed with version 3.0.1, although 3.0.2 also turned up a couple of days ago. Given some harsh testing with me, it was impossible to get version 3.0.1 confused by turning things on in the wrong order. However, some people have taken to the play store to say it’s still broken. It could be that its incompatible with their handsets (they don’t say which version of Android they’re using) – it could also be that it’s the cable connected version, which always seemed to be on the cusp of working reliably at the best of times.

While they were at it, they’ve fixed a few oddities in the user interface, so you can now just put through a payment without having to add it to the cart first (one of the points I made in the original review).

I’d be interested to hear details if anyone is still having trouble, and I may be able to help.

19-October-1520-October-15

New botnet spammed malware – Peals.F!plock

This is a big one, coming from hitherto unlisted botnet addresses – and it’s coming right now. I’m cross referencing the blacklisted addresses now to see if I can see who’s had an expansion lately. Spamassassin isn’t that great at picking it up, with about 10% getting straight through and about 90% failing to reach five points.

It’s a Microsoft Word document, apparently containing controversial malware Peals.F!plock. Little is known about this, other than Security Essentials flagging it but others say it’s a false positive. Well someone’s gone to a lot of trouble to sent it a “false positive”.

The messages all claim to come from “Stephanie Greaves”, sgreaves at btros.co.uk, with a fixed subject of COS007202, which is unusual. You’d have thought that if you’re using a clean botnet you’d randomise things a bit. This is a genuine domain name (with no SPF – come on guys!) and for all I know, Stephanie Greaves is the name of a genuine victim. Their MX is a virtual server and they’re probably wondering why it’s been heavily loaded since 9am.

Whoever’s doing this has a pretty comprehensive spamming list, containing nearly all of my honeypots.

Update:

This same malware is now being sent out claiming to be from customerservices@ocado.com with the subject “Your receipt for today’s Ocado delivery”, and an HTML message looking like an Ocado receipt (as far as I can tell – I shop for my own groceries!) Again, Ocado doesn’t seem to have SPF set up.

The message text is:

HERE’S YOUR RECEIPT

Hello

Your receipt for today’s delivery is attached to this email. I’ll be delivering your 12:00-14:00 order and, so you’ll know it’s me, I’ll be driving the Lemon van.

Your order doesn’t have any substitutions, everything’s there.

See you later,

Paul

The fake bombardier one reads:

Good morning,
Please see attached purchase order.
Kind regards,
Stephanie Greaves
cid:image002.jpg@01D01077.BAC48BA0
Administration Apprentice
Bombardier Transportation (Rolling Stock) UK Ltd
Electronics, Cabling, & Interior Division
Litchurch Lane, Derby, DE24 8AD

Update: 20-Oct-15 11:22

The malware spam now looks like this:

From: Shaun Buzzard <shaunb@hubbardproducts.com>
To: <to_addr}}>  <-- Note error
Subject: Order

Hi ,

Please find attached order.

Kind regards.

Shaun Buzzard

13-October-1523-October-15

Is Northolt Aerodrome Dangerous?

Biggin Hill, a rival airfield to Northolt chasing executive jet traffic for London, has got hold of a 2012 report that says Northolt doesn’t meet current CAA standards for obstacle clearance, especially at the east end of the runway. Northolt has been there for a hundred years, so shame on the local council for allowing this alleged dangerous development to have taken place.

It wouldn’t be the only airfield to lose its CAA license since new rules came in (e.g. Sandown and Bembridge on the IoW) but then again it’s a military/government field and is regulated by the MAA instead. The civil operators of Biggin Hill and Oxford reckon the CAA should take over regulation, and (presumably) shut their rival down. They would say that, wouldn’t they?

Of course, a cynic like me may wonder whether the value of a huge plot of land next to the A40 had a bearing on what interested parties have to say on the subject.

12-October-1512-October-15

Installing Apache 2.4 with PHP on FreeBSD for Drupal 8. It’s a Nightmare

I’ve been playing about the Drupal 8 (still in Beta) and one of its features is that it needs the latest version of PHP (5.5.9 or later). I have a server I keep for testing the latest whatever, and this includes Apache 2.4. So how hard can it be to compile in PHP?

Actually, it’s not straightforward. Apache 2.4 is fine, but PHP is another matter. First off, installing lang/php55 does not include mod_php for Apache. It’s not that the option to compile it hasn’t been set – the option has gone. With a bit of digging around you can find it elsewhere – in www/mod_php55. Don’t be fooled in to thinking you need to just build and install that though…

You’ll probably end up with stuff like this in your httpd error log:

Call to undefined function session_name() Call to undefined function hash()

Digging further you’ll find www/php55-session and security/php55-hash in there, and go off to build those too. Then wonder why it still isn’t working.

The clue can be found with this log file error:

PHP Warning: PHP Startup: Unable to load dynamic library '/usr/local/lib/php/20121212-zts/session.so' - Cannot open &quote;/usr/local/lib/php/20121212-zts/session.so&quote; in Unknown on line 0

(NB. The &quote appears in the log file itself!)

Basically, mod_php expects you to compile the ZTS (Zend Thread Safe) version of everything. And why wouldn’t you? Well it turns out that this important option is actually turned off by default so you need to configure the build to include it. Any extensions you’ve compiled up until now will not have been placed in a directory tagged with -zts, which is why it’s looking in the wrong place as shown by the error log.

If you’re reading this following a Google search, you’ve probably already fallen down the Pooh trap. You need to go back to lang/php55 and start again with the correct options. The best way to do this (in case you didn’t know) is:

make clean make config make make install

When you run make config it’ll give you a chance to select ZTS, so do it.

Repeat this for compiling www/mod_php55 and then go back and compile www/php55-session, security/php55-hash and anything else you got wrong the first time, You don’t have the option to configured them, but they must be compiled again once the core of PHP has been compiled using ZTS.

Incidentally, if you haven’t had this pain before, you will probably need to switch to using the new pkg system if you haven’t already. Trying to build without it, it’ll put up a curt little note about it and go in to sulk mode until you do. Unfortunately, on an older FreeBSD, any attempt to compile this will result in an O_CLOEXEC symbol undefined error in pkg.c. This is actually a flag to the open() kernel function that was added to POSIX in 2008. What it means is that if your process subsequently makes exec call, the file handle will be automatically closed. It saves leaking fds if your execution path goes awry. But what’s the solution?

Well, if you’re using an older version of the kernel then it won’t support O_CLOEXEC anyway, so my fix is to delete it from the source and try again. It only appears once, and if the code is so sloppy that it doesn’t close the handle, it’s not the end of the world. The official answer is, of course, to upgrade your kernel.

If you are running Drupal 8, here’s a complete list of the ports you’ll need to compile:

lang/php55 (select ZTS option in the configuration dialogue)
www/mod_php55 (select ZTS option in the configuration dialogue)
www/php55-session
security/php55-hash
security/php55-filter
devel/php55-json
devel/php55-tokenizer (for Drupal 8)
databases/php55-pdo
databases/php55-pdo_mysql
textproc/php55-ctype
textproc/php55-dom
textproc/php55-simplexml
graphics/php55-gd
converters/php55-mbstring (not tested during setup)

All good fun! This relates to Drupal 8.0.0 RC1 – it may be different with the final release, of course.

6-October-156-October-15

Safe Harbour Agreement on Data Sharing with Uncle Sam ruled unlawful

Photo Source: Court of Justice of the European Union — Causing trouble – Court of Justice of the European Union

The long awaited ruling about whether the Safe Harbour agreement allowing free transfer of data concerning European citizens to the USA is valid under European Law has just been published. And it’s a doozie.

Basically a Safe Harbour agreement (note the use of the indefinite article here) means that you won’t be sent down the river for doing something that might otherwise be illegal. The specific Safe Harbour agreement in this case (2000/520/EC) says it’s okay for European data controllers to send whatever they like to the American’s because Uncle Sam is a good friend. This would otherwise be a no-no because you’d be giving up control over information that would otherwise be protected by European privacy laws.

This situation is currently being misrepresented in the popular press as being about Facebook (social media being their favourite subject after themselves); it’s not. It’s about all data. The case was brought by Austrian civil rights campaigner, Max Schrems in the Irish courts to test the legality of Facebook doing just this, as a high-profile example. A lot of American companies like to base their data centres in Dublin because, up until now, the Irish courts have been quite relaxed about what goes in compared with certain other European governments. (And lets not forget the tax breaks, and that Dublin is a nice place to be).

Hanging over this is the shadow of Edward Snowden (yet again), raising public awareness and anxiety over government access to PII. The fact that this PII is already in the hands of the likes of Facebook, Amazon, Microsoft, Google and Twitter with the full knowledge of the subjects doesn’t seem to matter – it’s the principle of the thing!

Anyway, the ruling basically says that the initial ruling is incompatible with European Law, and we can’t trust the Yankees to look after it without further safeguards. Where this leaves American companies with European data centres remains to be seen.

5-October-1522-October-15

Edward Snowden says smartphones can be taken over by text message

The most incredible revelation has just appeared on the BBC News web site. Apparently Edward Snowdon has revealed in a Panorama interview that smartphones can be taken over by sending them an SMS.

“The former intelligence contractor told the BBC’s Panorama that UK intelligence agency GCHQ had the power to hack into phones without their owners’ knowledge.” it begins. It continues with “Mr Snowden said GCHQ could gain access to a handset by sending it an encrypted text message and use it for such things as taking pictures and listening in.”

That’s pretty specific, and as I said, incredible. For anyone with a shaky knowledge for the English language, “incredible” means difficult or impossible to believe. If it were true, then one of the following must also be true:

All the handset makers in the world would have to pre-install a wedge to intercept SMS traffic before the OS got to the hardware.
Apple would have to be in on it; and there would have to be something hidden in the publicly available Android source code that no one had noticed.
All the hardware used in smartphones would have the ability to intercept SMS and implement a hypervisor to manipulate the OS in way I can’t even comprehend (and with the chip maker’s collusion.

None of the above strikes me as very likely, so if there is any truth in it, what could it be?

The obvious answer is that GCHQ and the NSA have some dodgy Apps which, if you install them and give them permission, could do things on receipt of a SMS. Not such a big deal – criminals are doing this and I’d be surprised if governments weren’t in on that game too. He could also be referring to known exploits in some phone OSs that could be used to compromise its security. But the BBC quote is clear that this is something “new”, and applies to all, or at least the majority of smartphones. It does not say “some handsets”; the implication is clearly that all handsets can be pwned by the spooks whenever they want. I’ve kept the text of the original article, as I suspect they’ll be needing to change it!

It could also be that Mr Snowden is being grossly mis-represented in a case of sloppy journalism, or in a deliberate attempt to hype the forthcoming Panorama program. The term “encrypted text message” rings an alarm bell here; no one who knew anything about the subject would have used the word “encrypted” to refer to a specially crafted or encoded message.

Or it could be that the publicity-seeking Mr Snowdon has sold some credulous hacks a fairy story and they’ve lapped it up.

5-October-155-October-15

Malware sent in .ace format

This one made me look twice. I’m intercepting a lot of malware spreading attempts with text that starts out thus:

Dear Sir or madam
 Hi
 I'm milad and our company called UTIACHEM CO. located in Tehran-Iran.
 Following a telephone conversation with my colleague.
 I was going to send me your request.
 We have an inquiry from your products as attached file,please check.
 Please answer each request.
 Please certificate and an analysis and data sheet product send it to us.

They’re notable because they contain a pair of files of similar length (454K) which have names ending in .jpg.ace. It took me a while to figure this out; they’re compressed using a program called WinAce, a proprietary (paid for) German program from the late 1990’s. The only people likely to have a copy of this will likely be running Windows 98 – or so I thought. The company is still going, much to my surprise, and there are Linux and Mac versions too – although not UNIX, BSD, Android, Apple OS or anything else you’d need if you wanted to compete as a cross-platform archive format. There is, however, a DLL for unpacking that may be used in other people’s products, so perhaps decoders are more prevalent than might first appear.

I wonder how many they’ll have to spam out before they find someone (a) with an ACE decoder; and (b) dumb enough to use it?

Incidentally, most of these spams trace back to Mandril (aka Mailchimp), and are probably uploaded there by someone abusing an IOMart account (from Nottingham). In other words, zero abuse enforcement, based on previous attempts to contact them.

5-October-157-October-15

iZettle is now contactless on Android

Update 6th October 2015:

What a difference a day makes! Yesterday I was trying to get iZettle 3.0.0 working on my Android 5.0 handset and failing miserably. Today, it’s all working just fine. The difference? Three things:

Don’t have the handset and the reader too close together. Bluetooth was interfering with the WiFi. They’re on the same frequency, and Bluetooth doesn’t really play nice with 802.11n. While the Internet connection was being blocked by the reader, the App became unstable on loading.
Either turn on the reader before you start the App, or afterwards. I’m not completely sure of the timing, but there seems to be a bad spot if they’re both starting up together where they fail to sync and both go funky deux. The photographs following the review show what I mean!
When you turn on the reader, wait for the “Please wait….” to disappear before you considering it to be “on”. i.e. don’t start the App while it’s in that state, and don’t do anything to try to use it if the App is already running.

If you follow the rules above, everything else works like a charm. And like all rules, there are exceptions when it might work anyway.

Review

iZettle is a Swedish company, founded in 2010, offering a complete mobile card payment system for small businesses with Terms of Business and charges that should make the bankers blush. The deal is that they charge a straight ~1.5%-3% dependent on volume, with no minimum transaction fee. You can buy a reader from them, or if your volumes are high enough, they’ll give you a free Chip and Pin reader that connects to some smartphone/tablet hardware (iPhones and a few Android devices) using the microphone/speaker. My advice on the free reader is “don’t be cheap – pay for the bluetooth one”.

Today iZettle released its all-new Android App, version 3.0.0, which allows it to work with the Card Reader Pro Contactless . When I say “released”, it appeared in the Google Play store without fanfare; not even a press release. Apple fanbois have been able to use contactless cards (and Apple Pray) for some time now, but the Android App has always lagged behind; odd, as 90% of smartphones run Android. Perhaps iZettle really likes Objective ‘C’?

The good news, apart from contactless support, is that the new Android App is much cleaner and nicer to use than the old one. On startup, it goes straight in to the screen where all you need do is enter the amount and optional description and add it to a cart (you can’t charge it immediately, for some reason). If you have pre-set items you can access them in grid or list from by swiping left; tapping an item adds it to the cart.

70D_04547c

To take a payment just tap on the cart icon. You get a chance to add a percentage or set value discount and when you’re done it just connects to the card reader and does the business. One very welcome feature is that the display on the reader now shows the amount being charged.

There are other good features lying about in the software. For example, a battery status indication is available in settings. But the main feature of 3.0 is its ease of use.

Teething problems connecting notwithstanding, there are a few possible improvements that spring to mind. It would be handy to be able to enter a number and select “Charge” immediately without going through the cart first. This may be a bug – before you enter an amount the there is a large button marked “Charge” that changes to “Add Item” (to the cart) as soon as you enter something. Also, there are pre-set discount rates of 5%, 10% and 15% and the ability to enter any percentage manually, but you can’t edit the pre-sets. More seriously, you can’t edit the VAT rate table or enter a manual rate. It has 0%, 5% and 20%, which are the current rates in the UK, but they’re going to change. It also makes no differentiation between Zero-rate an Exempt, which does matter for proper accounting.

But these are minor quibbles. iZettle 3.0 is a big improvement on the rather clunky 2.5 and I’ve no doubt the teething troubles with the connection will be fixed. In the mean time, just leave the reader enough time to warm up.

In view of the problems I did have, a means of rolling back updates is needed. iZettle says that they can’t do this at the moment, but given the difficulty of testing Apps – especially Android ones – on the wide range of hardware and OS versions out there, relying on a compatibility list is a bad idea tactically. There’s a danger that people will seek to download older versions of the App if they encounter problems, and a bit of research this morning turned up a few .apk files on the Internet that had definitely been tampered with. I’m trying to persuade iZettle to implement a rollback option but no luck yet.

Rogues gallery: iZettle 3.0.0 going mad yesterday. See update above.

If you get the timing wrong or something interferes with the Internet connection (e.g. it’s masked by bluetooth) you could be in for a world of pain.

70d_04521

Whenever I try to make a charge it either says that an “Unexpected error occurred – try again”, or it crashes out.

70D_04543

This is before it even gets to the “insert card” part. And it’s really flaky when it comes to keeping bluetooth contact with the reader.
70D_04533 70D_04542

It randomly freezes, in the case of the above while it was moving between screens – it appears to be when its thinking about bluetooth connections.

It even manages to crash the reader itself!

70D_04540

For what it’s worth, I’m using Android 5.0, and it worked just fine (albeit Chip and Pin) on the old version of the App.

Fortunately I don’t process a lot of payments, so can live without it but others may be having a really bad day as a result.