Posts by happygeek

You know you are old when a student wants to interview you as part of a piece about 'Internet history' and you realise it's becuase you were there at the time.

The head of the UK MI5 intelligence agency, Jonathan Evans, has this week warned that the London 2012 Olympic Games "present an attractive target for our enemies and they will be at the centre of the world's attention in a month or so". But most of the concern, and indeed the advice being doled out, is aimed squarely at the physical terrorist threat to the games. DaniWeb has been finding out what threats there are surrounding the 2012 Olympics from an IT security perspective.

Although the physical threat does, in fact, cross over into the world of IT (at least hypothetically) with the possibility of a state sponsored hacking or malware attack on critical national infrastructure such as electricity supplies, the reality is likely to be less James Bond and more mundane in approach.

David Emm, a Senior Regional Researcher for Kaspersky Lab, has warned that cybersquatting of domains with similar sounding names to Olympic sponsors or official sites is a real danger. Not just from the driving traffic away from legitimate sites side of things, but also for the setting up of fraudulent phishing scam sites. "Cybercriminals entice people to visit a fraudulent web site that, at first glance, appears to be the legitimate site" Emm explained, adding "this could be used to sell bogus tickets, or simply to trick people into entering personal information".

We've already seen plenty of online ticket scams, many taking the SEO-poisoning route and using ads on …

Erm, but if you forgot your password how did you log in and post this question?

Welcome to the community and the conversation :)

I was hoping you were going to say that :)

Looks very like a zero-day exploiting some unknown/unpatched vulnerability is out in the wild, given the member registration database compromises at LinkedIn, eHarmony and now TechRadar

Are the DaniWeb registration passwords hashed and salted?

Following on from the news earlier this month that LinkedIn had suffered a major security breach involving the compromise of at least six million user passwords, and then dating site eHarmony apparently falling victim to the same password hacking compromise, the latest to be hit would appear to be the UK-based consumer technology news and magazine site TechRadar.

Late last night the site, owned by magazine giants Future Publishing and which gets in excess of seven million visitors from around the world each month, made the announcement on Twitter and the website forums were closed while an investigation into the breach is underway. According to an official statement from Nick Merritt "user details including username, email address, date-of-birth and encrypted passwords have been stolen" due to the compromise of the user registration database for the site.

Emails have been sent out to all registered members of TechRadar, and to those who were registered as members of the various Future Publishing magazine forums which came under the TechRadar banner when they were merged to form the site, warning of the breach and advising that they change their passwords at other sites if they used the same one.

Here is what that email, signed by TechRadar Publisher Nick Merritt, had to say on the matter:

Following on from the news earlier this month that LinkedIn had suffered a major security breach involving the compromise of at least six million user passwords, and …

Welcome to you both :)

Interesting question for the SEO people hereabouts: how do you envisage being able to manipulate such a different search technology for marketing purposes should it become a (albeit fairly niche search sector) reality?

Google might be the biggest search resource on the Internet bar none, but it's far from perfect. In some areas it's actually worse than that, and simply fails to work at all. Now students at the University of Glasgow in Scotland are attempting to fill one of these search gaps with the development of the SMART search engine. Here's the problem: ask Google "How busy is it in New York?" and you will be confronted by a whole bunch of results which don't answer you query at all. In fact, I've just done exactly that and the first result unhelpfully told me what time it was in NYC, and this was followed by equally poor results including a three years old news story concerning Anne Hathaway, tripadvisor.com reviews of Washington Square and a story about the construction of the Freedom Tower (One World Trade Center) but absolutely nothing to help me gauge how bust New York City is.

The search engine for multimedia environment generated content (SMART) project aims to answer this kind of question, and provide those answers in real time. Not only would you be able to find out how busy a city center is, you'd be able to find out how busy it is right now. The computer scientists at Glasgow are attempting to build a search engine that draws the results from net-connected sensors such as cameras and microphone arrays in the physical world. By matching the search queries …

I'm not so sure of that, Liam. I was using it in the sense of "unwilling to admit or accept what is offered as true : not credulous" and that's what I was saying people might think about the statement I referred to. However, I have now changed it to unlikely instead :)

Last year I reviewed the original Kensington KeyFolio Pro case with integrated keyboard, and liked it so much I have been using it on a daily basis ever since. With a DaniWeb rating of 9 out of 10, there really wasn't much room for improvement. So when Kensington released the KeyFolio Pro 2 earlier this year I was dubious that it could actually be worth the upgrade. Having now spent some time hands-on with latest version of this must-have iPad peripheral for the jobbing journalist, writer or coder, I am happy to report that my cynicism was unfounded. Kensington have actually managed to pull off the unlikely task of making the best a whole lot better.

How so? Well, for starters, the keyboard itself is now fully detachable from the case itself. While this may not seem like any big deal on paper, as soon as you start to actually use it the reality of being able to position the keyboard away from the iPad screen really does make a discernible difference in day to day productivity. The simple fact that I can have the actual iPad screen anywhere on the desk I like, at any angle, is a real boon for getting rid of glare and finding a comfortable typing position. The ability to place the keyboard in a usable position no matter how cramped the available space is also a real boon, although the lightness of the thing is a little disconcerting at …

Reports are coming in thick and fast about 'state-sponsored' zero-day exploits hitting business websites in the UK. The latest, disclosed yesterday by SophosLabs, involves an as yet unnamed European aeronautical parts supplier and follows on from another the day before involving a European medical company site. In both cases the same unpatched vulnerability in Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 that can allow remote code execution, as detailed in Microsoft Security Advisory 2719615 appears to have been successfully exploited.

The vulnerability impacts users of all currently supported versions of Windows including Windows 7, as well as Microsoft Office 2003 and 2007 and is serious enough that a successful exploit as seen in both the attacks discovered this week can launch a drive-by compromise which simply requires a user to visit the infected website to become a victim. Assuming, that is, they do not have anti-malware protection installed that spots the thing or have disabled JaveScript which it uses. Both the sites identified by SophosLabs had four files dropped into them by the attackers: deploy.html containing the vulnerability itself and loading the JavaScript library deployJava.js which interrogates your browser, movie.swf is then run if possible in order to compromise your computer and for good measure an iframe is loaded into faq.htm as well. The end result is that the attacker can potentially gain the same user rights as whoever is using the target computer at the time.

As well …

You read it right. They are doing so now though, after the hash horse has bolted through the unslated stable doors...

Welcome to Daniweb jakedrake...

Welcome aboard...

I have just spent a week in the Gwydyr Forest (North Wales, UK) where there was no Internet and no mobile phone signal and, while I did miss chatting with DaniWeb members, I didn't really miss being disconnected in this way. In fact, I enjoyed it. However, I am very glad to be back online again. Not sure if this means I am an addict or not though...

Hi Doc, welcome to DaniWeb. Looks like you will be spending some quality time in the PHP forum then :)

One of the Internet's biggest online dating sites, eHarmony, has confirmed that security has been breached and member passwords compromised. eHarmony spokesperson Becky Teraoka says that "a small fraction of our user base has been affected" although I am led to understand that the 'small fraction' in question is actually around 1.5 million. The password hashes were published on a Russian hacking forum, with members asking for help in cracking them and converting the hashes into usable passwords.

Sound familiar? Well that's because this has the hand of the LinkedIn password hacker all over it. As DaniWeb reported yesterday, LinkedIn has also confirmed that security was breached and a file containing some 6.5 million password hashes has been published on a Russian hacking forum. That number has now been scaled down slightly to 5.8 million to allow for duplicates that were found, but it's still one heck of big breach with serious consequences for those users whose accounts may be compromised as a result.

Like LinkedIn, eHarmony has acted to mitigate the fallout and Teraoka confirms that "we have reset affected members passwords" and emails are going out to those members with instructions on how to reset them to something different again. Teraoka also insists that "eHarmony uses robust security measures, including password hashing and data encryption, to protect our members’ personal information. We also protect our networks with state-of-the-art firewalls, load balancers, SSL and other sophisticated security approaches." Which all …

Looking forward to reading your contributions and you becoming part of the DaniWeb conversation...

It's now official, account passwords for the popular business social network LinkedIn have been compromised.
Vicente Silveira, a director at LinkedIn, has confirmed that some of the passwords that were published online by a Russian hacking group "correspond to LinkedIn accounts". How many of the 161 million LinkedIn members have been impacted by this breach is as yet unknown, however it is likely to be a relatively small percentage as the published list of passwords is 'only' 6.5 million in number, even if LinkedIn passwords prove to be the vast majority if not all of them.

The list of compromised passwords was published in a file that contained the passwords in unsalted SHA-1 hashed form, and appeared online in a Russian based public forum. I am led to believe that at least a quarter of a million of these hashes have been cracked, and that number will inevitably increase as the cracking work continues. Although no associated account data such as usernames were published within the file, at this point in time it is unknown if the hackers have access to this information or not.

Silveira admits that the password hashes were unsalted when he says "it is worth noting that the affected members who update their passwords and members whose passwords have not been compromised benefit from the enhanced security we just recently put in place, which includes hashing and salting of our current password databases".

It would appear that this exposed file …

Today is World IPv6 Launch Day.Today is the day that the global Internet gets redefined. Today is the day that people everywhere are saying "so what?" I imagine. However, not everyone is having a 'meh!' moment at the thought of IPv6 being officially launched. Take Jay Parikh, Vice President of Infrastructure at Facebook, who insists that "supporting IPv6 has become crucial to the future scalability of the Internet" and goes on to say that it's "awesome to see so many people and companies working together across the world to make progress on this transition".

But is IPv6, as the Internet Society insists, now the "new normal" for the Internet? Certainly as websites, ISPs and router manufacturers start supporting IPv6 by default, a process which one assumes is meant to happen from this day forth, that statement could make sense. For many people though, IPv6 adoption is as far off as ever. If you want to see whether your ISP is supporting IPv6, determine if you can access IPv6 only websites, simply navigate to the Test Your IPv6 Connectivity site.

The chances are pretty high that, for now, your test results will not be 'awesome' in regards to IPv6 connectivity but then neither is it 'critical' that they should be right now. It may be World IPv6 Launch Day but that doesn't mean that the Internet will somehow stop working from now on if you remain an IPv4 user for the foreseeable …

Microsoft Security Advisory notices do not, as a rule, make the media sit up and take much notice. Not least as they have become relatively commonplace over the years, but every now and then one comes along which may grab some press attention. Take MSA 2718704 for example.

At first the advisory with the expanded title of "Unauthorized Digital Certificates Could Allow Spoofing" issued on June 3rd doesn't hold out much hope in the immediately interesting stakes. However, when you realise that components of the Flame worm (as reported here on DaniWeb) were signed with a certificate that ultimately 'chained up' to the Microsoft Root Authority via the Microsoft Enforced Licensing Intermediate PCA Certificate Authority, and exposed a potentially serious problem with such code-signing certificates that could enable malware code to be validated as a Microsoft product, the interest starts to become clear.

Following the exposure of the Flame worm, Microsoft started investigating and discovered that a particular old crypto algorithm could be exploited in such a away as to enable certificates issued by the Microsoft Terminal Services licensing certification authority (for Remote Desktop services authorization in the enterprise) to be used to sign code as Microsoft itself without accessing the Microsoft internal PKI infrastructure which exists to prevent such abuse, rather than the intended use which is limited license server verification.

Of course, it's not just Flame that's the problem here; such unauthorised certificates could spoof content used for phishing …

My point is that the '88% are victims of cybercrime' claim seems way too high, as far as my real world experience as both a journalist and small business consultant working in the field of IT security is concerned. It's how you define the word 'victim' that is the key I suspect. Does being a recipient of a phishing scam email make you a victim? No, not unless you follow it up and eventually lose money. Does being sent a link to a Trojan dropper site make you a victim? No, not unless you click it and install it and the payload is dropped.

These things are all a huge problem, I'm not trying to downplay that. I just wonder if the constant scare stories do less in terms of educating people and making them aware of the dangers and rather more by way of simply numbing them to the problem by overexposure and exaggeration?

In your original post you didn't mention that you had met the landlord face to face (just 'spoken with') nor seen the property with him, nor seen a draft contract. All those things change the perspective somewhat. You really should confirm what happens to the deposit if you don't go ahead though, at the very least being happy that it is non-refundable if that is the case.

I do miss the spellcheck, especially as I have trouble seeing what I've typed half the time these days. A nice squiggly underline works wonders, but my browser add-on spoil chicken sadly doesn't work with the reply textbook. See! That should have been textbox but I didn't spot it until now. Oops :)

On my 10" dell not so much

Oddly, on my iPad the reply text box is enormous! Takes up about 70% of the screen width.

I'd still be asking the questions I set out. The landlord shouldn't worry if he is genuine, and it shows you are serious about wanting to rent. The property might be great, but if the rental agreement sucks it could be a financial albatross around your neck... Check the contract before handing over any money would be my advice...

The results of a new security survey, which asked some 6,000 people across Europe questions about cybercrime, would appear to suggest that nearly everyone (88% of respondents in fact) is some kind of online victim. Have things really got this bad, or is it just another case of the security industry painting a very dark picture in order to drive demand for IT security solutions and services?

Well let's take a look at the results of that survey which was carried out by security vendor Sitecom. I can understand fully that the 73% of people 'concerned about their security online' might think that, after all every sane person has to be concerned about malware, phishing, cybercrime. I'm slightly surprised that this would seem to imply that 27% are not concerned, as that suggests to me these people don't care if they fall victim or not. Surprisingly, 88% believed it was 'important to be protected against cybercrime' which is another statistic that falls into the 'realms of normality' category. Or at least it would were it not that this then highlights the disparity between those who are concerned about cybercrime (73%) and those who think it important to protect against it (88%). Somewhere there is a peculiar 15% who, I have to assume, think it is important to protect against something that they are not actually concerned about.

But wait, things get even odder as you dig into the results further: 88% of the respondents said …

I'm looking at DaniWeb on a 22" screen at a res of 1920x1080 with IE9 not quite maximised, but with text size increased courtesy of my low vision. The reply textbox stretches across approx half of the screen and appears, fairly logically it seems to me, at the bottom of the thread I'm reading. Which is why I'm bemused by the 'too small' remarks. It makes me wonder it it appears very differently indeed for other users - how much screen estate does it occupy for you Nick, Rash?

How big do you need the reply textbox to be? I've got really crappy eyesight these days (long story) but find the textbox to be perfectly adequate here to be honest. I'm not sure how it could be described as unusable, unless you are seeing something entirely different to me. Plus, it expands dynamically as you use it so gets bigger the more you type.

The articles vs posts vs threads vs news stories vs tutorials thing is just a matter of semantics. You may think you are starting a new thread but actually you are contributing an article whether you like it or not, because that's what DaniWeb calls them now :)

I suspect that number 1 is most likely, given that Facebook has quite a decent acquisitions purse as the moment.

You need to ask yourself, and the landlord, a number of questions before releasing any money in his direction:

What happens to the deposit if you do not proceed with the rental?
What happens to the deposit if the landlord decides you are not a suitable tenant?
Is the deposit refundable against your first rental payment?
Is the deposit to be used as the bond against damage to the property?
What are the terms of the rental contract for the property?
Will the deposit be held in escrow, and if so with which company?
Will the landlord accept payment by credit card instead of direct debit? (this provides you with much greated protection in case of fraud in the UK)

Some questions I would ask of you include, how did you find the property and landlord? If it was just a classified ad online then I would be very tempted to walk away. Have you seen the property itself, met the landlord in person, spoken to him over the phone? If you are too far away to see the property before signing a rental agreement, then I would strongly suggest you use a rental agent to find a suitable property.

...and point them in the direction of this thread

How about a link back to this thread, as to avoid having to keep up with multiple threads about the same thing?

Same thing, surely? :)

If you have never stopped to think about language in terms of Search Engine Optimisation (SEO) then the results of a survey by digital marketing agency Greenlight might make you do just that. According to the global Search and Social Survey, some 76% of people do their online searching in at least two different languages. This should come as no real surprise when you consider how many countries have more than one official language, and explains why Belgium with three official languages was towards the top of the survey for countries topping the multilingual searching stats. However, this explanation does not hold true when you also consider that Italy and Spain topped the list with 100% of respondents searching in multiple languages.

Adam Bunn, the director of SEO at Greenlight, says that "despite reasonably homogenised language use" the high level of multilingual searching in Italy and Spain is "possibly a testament to the position of English as the quasi-official language of Europe and the relative prevalence of English language web pages." Certainly with the UK producing the most web pages per head across Europe, some 17 pages per person on average according to Greenlight research, which compares to 6 in Italy and 10 in Spain, this could point to more English content to be searched for within the European markets at least.

But why should anyone engaged with SEO care? Bunn reckons that as search engines use the domain extension to determine geographical relevance (a …

Trying to escape from UK 'Diamond Jubilee' madness by listening to God Save the Queen by the Sex Pistols in order to regain some sanity.

Soz Dani, didn't realise that the top level forums don't get sticky. The questions across threads point was dealt with by

If you have any questions, please ask them in the Geeks' Lounge Code Snippet Contest thread here.

I posted them in the developer forums (now deleted) as that is where most people who are most likely to want to enter are going to see the announcement, surely? I'm not sure how many will see this thread here in the lounge.

Maybe the mods who deal with specific coding forums could post something, in their own words so as to avoid the SEO penalty, in those specific langage forums which inform members that a coding competition is underway and point them in the direction of this thread?

There will be an announcement in the DaniWeb Digest newsletter as well, of course, and I'm about to post something on my Facebook page.

The only way of making newbies, and everyone else, feel welcome is to maintain a genuine community spirit within every forum and every post.

Members have to engage with the community, and for that to happen we have to engage them; in conversation, with interesting threads, with friendly responses, with the help they seek. As soon as any member feels like they are being patronised, their questions an inconvenience to us or their lack of familiarity with forum posting convention a criminal offence - that's when they feel like an outsider, and that's when they drift away.

I guess what I am saying here is that we as a community, as an holistic entity, have to genuinely want new members in order to be able to genuinely welcome them. If any forum becomes something of an old boys club where the 'regulars' rule the roost and dictate who can speak and when, that community requirement to 'openly embrace all' simply vanishes into the ether.

In the words of Bill and Ted: "be excellent to each other, and party on dudes"

Welcome to DaniWeb, Richard. Be sure to check out the Internet Marketing forums as these will be of interest to you.

Darn it, that's me out then :)

The official annoucnement, including the rules and the submission deadlines:

...
Can you code? Of course you can, this is DaniWeb after all. The question is how good can you code? Are you the best coder in the DaniWeb community? Now is your chance to find out by entering the first DaniWeb Code Snippet Contest!

It's really easy to take part, all we ask is that all code is fully-working and bug-free: code which does not work, or which is buggy, will be disqualified. All entries must be properly submitted as a code snippet using the article editor, code posted as a normal discussion thread will be disqualified.

The competition is open to anyone who is a registered member of DaniWeb, that includes newbies and old hands, regular forum contributors and lurkers, even moderators and admins. Anyone who can code is encouraged to show us what you are capable of. What's more, there are some great prizes to be won, including:

$250 amazon.com gift card for the most efficiently written code

$150 amazon.com gift card for the most creative functionality

$100 amazon.com gift card for the most elegant code

In addition, the winners and runners-up in all categories will be awarded some much deserved positive rep points!

The contest starts now, so get coding! You can submit code snippets in any language as long as they are fully working and bug free. Submissions will be accepted until midnight (EST) on Tuesday July …

As an aside, I used to be involved with an early online community in the UK some twenty years ago which generated usernames based upon the actual name of the member registering an account. Somehow I managed to screw up the original registration, not surprising given these were the days of 300 baud modems and acoustic couplers, and when I tried again the original 'dwinder' (my name is Davey Winder) was flagged as unavailable as it had gone into the member database despite that account not being activated successfully. Long story short (too late, I hear you cry) it soimply appended an a to the name and I became 'dwindera' which I kind of liked as it rolled off the tongue somewhat. That username stuck for many years, followed, me around wherever I went, and even ended up on the front page of a national Sunday newspaper when I was interviewed under the headline of 'Meet dwindera and the virtual celebrities of cyberspace'. I migrated from dwindera to Wavey Davey (although I kept the dwindera account until jist a few years back) and eventually ended up as Happygeek.

The 'chief security expert' at Kaspersky Lab, Alexander Gostev, has expanded upon the functionality of Flame at a technical level now, and rather importantly, provided the information required in order to perform a detailed check to see if you are infected (unlikely unless you are a Middle Eastern government agency, but you never know). More here

And more: "Conflicting conjecture and confusion over the ‘ownership’ of the detection is muddying the waters. According to the Iran National CERT they had detection (but not removal) for the malware ESET calls Win32/Flamer.A in early May, but Kaspersky claims it’s been in the wild since March 2010: however, it seems to be the same malware threat the Laboratory of Cryptography and System Security (CrySyS) in Budapest calls sKyWIper (which they believe may have been active for 5-8 years or even longer). " - David Harley, senior researcher at ESET

Initial SkyWiper analysis document (warning - opens PDF) here.

Also interesting to consider that Flame is around 20Mb in size, and includes livraires for compression, database management and a LUA virtual machine amongst other things. It's a very complex, and very large, package of assorted modules - much larger than most (if not all) worms to have surfaced so far. Reserachers at Kaspersky think the attack toolkit is so large, and not written using compact programming languages, as a deliberate tactic rather than through simplistic development processes. While you might expect malware to be made small so as to be easily hidden, it appears that the Flame developers have gone for the polar opposite: concealment of the naughty stuff through the use of large amounts of code.

An interesting development:

"Hungarian researcher Boldizsar Bencsath, whose Laboratory of Cryptography and Systems Security first discovered the Duqu cyber weapon, said his analysis showed Flame may have been active for at least five years and perhaps eight years or more" according to a report from PC Pro magazine.

That would pre-date Stuxnet and, if true, makes the whole Flame story even more interesting. Of course, the simple fact of the matter is that even if Flame does prove to have been active for five years or more it doesn't necessarily make it the most complex nor most succesful state-sponsored worm in history. That accolade will probably go to something we will never hear about, that will never be discovered. And that's what is. perhaps, most worrying of all...

A cyber weapon grade piece of malware, some twenty times the size of Stuxnet, has apparently been fired at a number of countries in the Middle East. This highly complex piece of code which takes screenshots of any open 'programs of interest' such as email or IM, records audio and sends large volumes of compressed sensitive data back to base, was uncovered thanks to research from Kaspersky Lab and the International Telecommunication Union (ITU). Described as being far more functional and far more complex than previous nation-state sponsored attacks such as Stuxnet, Flame has been found to be actively deployed within Egypt, Iran, Israel, Lebanon, Saudi Arabia, Sudan and Syria so far.

Perhaps the most surprising piece of information that has emerged about this cyber weapon is that it appears to have been first fired some two years ago in 2010. At present, however, there are no clues as to which nation-state is behind the worm. That is if it is, indeed, a state-sponsored attack at all. The chances do appear high that it is, given the complexity of the code and the fact that this isn't some bank login scraping affair or something that delivers a denial of service or site defacement payload. So if we rule out the organised cyber-criminal gangs and the political hacktivists, that only really leaves the nation states. It has been suggested that there are 'similarities' with Stuxnet in the code design itself, but at this moment in time …

The FBI took claims by new hacking group The WikiBoat that it was going to bring down the likes of Apple and Tesco last Friday at 4pm so seriously that it sent email warnings to those targeted. It's now Sunday morning, and the threatened DDoS attacks do not appear to have happened. So has The WikiBoat been sunk and is #OpNewSon a failure?

The answers would appear to be that it was never actually launched, but that doesn't mean that #OpNewSon is a failure or that this is the last we will hear from The WikiBoat in my opinion.

Let's look at the declaration from The WikiBoat which started the whole thing off:

"We, #TheWikiBoat would like to introduce this press release on our very first operation: Operation NewSon (OpNewSon). As previously stated, we have no motives other then doing it all for the lulz. However this operation will be slightly different and will somewhat change our already stated objective on doing it for the lulz. On the day of the operation, we plan to hit and attack several high corporate entities. Shortly after the start of the operation, we plan to release precious classified data on the already set out list of targets we do have. Those targets are none other then the ones who ultimately rule: the high revenue making companies of the world. While attacking the major companies of this planet may seem lulzy, we also wish that this operation make …