BlogAllAlong

Just like Yahoo started sometime back, Google is in co-operation with AVG scanning their search results for malware sites.

And while this is good in concept, I found the scan to take way too long, that I don’t think people will generally wait to see the result. An option to turn that off was not spotted. This could be troublesome for people with slow connection. Luckily, Google is not mad at my blog, but they better be careful. They don’t wanna make Yahoo’s mistake, or some say trick ;).

Popularity: 30% [?]

(No Ratings Yet)

 Loading ...

Away from politics and all, and due to it’s lack of anti-phishing technology, PayPal has issued a security warning to all Safari users out there from the high possibility of web forgery for Safari users, which accounts for %4.5 of browser market share. Web Forgery, for those you may not know, is having some sites pretending to be something they aren’t. And PayPal being one of the most famous payment solutions on the net, you can guess how often people would like to fake it. I my self got so many emails in my Gmail Junk folder (What a go Gmail Anti-Spam), and when you have a strong anti-phishing browser like Firefox in place, this is what you would get trying to open the link:

Popularity: 27% [?]

(No Ratings Yet)

 Loading ...

Kuwait has been promoting the e-Government at least since I was in college. How every thing is going to be electronic, and how the services will be all available online. In the past few years, several advancements have been made. In the MOI, you can view your speeding tickets and pay them online, see passport status, driving license, see if you have any travel prevention, gun license. In terms of jobs, and through the Civil Service Commission, you can apply for government jobs online, see the vacancies and specify your desires as well. You can request a sick leave, go to Dr. next day and he will print and fill the form. No need to consult your job location first. This is really great, and we definitely want more of it, BUT…

Online services is something that needs planning, stable implementation and rounds and rounds of testing. The way I see it, Government seems to have cut things short and ignored some critical parts. To begin with, we have the privacy and security of the systems. How can a person authenticate him self as the specific individual who is allowed to see the data, and how can we make sure no intruder or outsider gets also access to this data. The way it’s done right now is mostly depending on the person’s Civil ID number. We all know that this kind of information is not confidential. It’s something that identifies you, but it does not authenticate who you are. For example, the guy in the bank has access to thousands of Civil IDs. I was working in Kuwait University and I had access to hundreds of thousands as well. My employer has that kind of information. Many people just have it. It’s not something I can hide from the world. So imagine that by knowing my Civil ID number, you can see if I have speeding tickets, if I have gun license, my passport information, who I am ensuring, and lots of more information. It actually happened to me once as well. My uncle told my father you have a speeding ticket. Why should they know that? Maybe I don’t want them to know it.

Say this is not enough? The MOI it self posted sometime back with a flashy sign an excel sheet with the full list of eligible voters with their civil ID. So pick your name from here and paste it there. It’s that simple! This is in regard of the MOI. For the Civil Service Commission, it gets even worse. Someone could be driving your future without you knowing it. You must sign there to specify your jobs. The only authentication again is your Civil ID. Provide it and you are good to go. Then you can see your information, available vacancies for you, and alter the jobs you want to apply for. Most these windows open inside an IFRAME. Open the IFRAME it self in a new window and you will see this:

My first program example “Hello World”. For non-programmers, Hello World tends always to be the first program you write. Just a dummy program to print this message. It seems the programmers were in a rush and just left the title as it is. Now as for the security, let’s say that soon the authentication model is changed, and a password is applied. Does that mean we are safe? Not without a thorough testing and revamp of the current security model implementation, No. You know why? Because if you open one of the IFRAME windows in a new screen, you will see this is the URL:

http://www.csc.net.kw:8888/csc/SpecialNeed.jsp?kk=13&cv_id=<civil_id>

Where <civil_id> is your civil ID number. Change it to any other person number and you got it. So it’s a matter of passing parameter only. This is one of the oldest tricks in the book. I can’t say now they missed it because Civil ID is already the mechanism of authentication so it’s the same thing anyways. But at least make it not that obvious and a bit future ready.

Again, as I said before, things are moving forward. I just knew you can pay your speeding tickets online. Something many people would like to do. However I don’t see it moving in the right way. Specialists must be following up with the implementation and ensuring the security and integrity of the data. The ultimate solution in hope for is one secured login credential for all government services and sites. Not a walk in the park I know. But unless this security issue is addressed right now, more and more services will come and reside on the existing weak model implementation.

Popularity: 74% [?]

(2 votes, average: 5 out of 5)

 Loading ...

Microsoft co-president Jim Allchin made an irrational statement back in Nov 2006 that Windows Vista is so secured it does not need Antivirus, saying his 7 years old kid is using Vista without Antivirus. Ofcourse this was back in November before public had theirs hands on it to start discovering holes.

Alex Ionescu posted a proof of concept program that utilizes Vista Protected Processes to it’s own advantage, making evil malicious programs as protected processes, be it keylogger or anything else you can think of (Thanks Slashdot for posting it).

This is ofcourse in addition to many other holes that are getting patched everyday, like last animation cursor that got immediate patch. My advise if you want to be mostly secured is to have good antivirus, good firewall (I like ZoneAlarm), and use the most secured browser, Firefox. Since I’ve started using it, very rarely I’ve seen any viruses coming in.

Popularity: 17% [?]

(No Ratings Yet)

 Loading ...

The so-called most secured operating system ever, Windows Vista is seeing increased amount of attacks one day after Microsoft disclosed the security hole withing the the mouse cursor. The newly discovered vulnerability is in the .ani files that change the cursor into animation while loading programs. The hole allows malicious websites to use those files to install their code into visitor’s computer. Worth noting that Windows 2000 SP4, Win XP SP2 and some versions of Windows 2003 Server are also infected with the same flaw. This all comes soon after Microsoft started claiming credits for the world’s most secured system, which they say may not need Anti Virus! Wonder if we can sue them for it. More on the news here.

Popularity: 22% [?]

(No Ratings Yet)

 Loading ...

The FREE to use Google Pack which comes bundled with several useful tools now has added Symantic’s Norton Security Scan to scan and remove viruses and PC Tool’s Spyware Doctor Starter Edition. As a background process tries to show it self more and more, I’ve lost interest in Symantic products recently, they are becoming more and more stupid and bugging. But the fact that both softwares come inside Google Pack with FREE automatic update protection makes it worth considering. I can stop asking my Symantic to remind me about updates 15 days later now. Note that I am assuming you are paying the full license and not a cracked version here in my complement. Otherwise the whole package makes no difference.

Popularity: 18% [?]

(No Ratings Yet)

 Loading ...

Isn’t it funny? Since Microsoft started their monthly security update back in 2003, only few of the known as Patch Tuesdays did not have Microsoft patches coming. Otherwise, it is scheduled that every second Tuesday of the month there is a security update coming from Microsoft. Last time Microsoft did not have Patch Tuesday was in September 2005 imagine! But does that mean things have been going smooth for the past month? Absolutely not. Microsoft are working on security patches for known vulnerabilities in IE7, Office 2007, Publisher 2007, ohh yeah and Windows Vista OS ofcourse. Lucky me I am not using any of those. The patches are not ready yet for release, so hackers will get more time of joy before they have to find new holes in the next patch. Lucky me I am not using any of those. More from PC WORLD.

Popularity: 18% [?]

(No Ratings Yet)

 Loading ...