As I have received several requests from Iranian readers of my blog, I have done some analysis on recent DigiNotar security breach and MITM attack to Iranian users.
This analysis is based on Fox-IT interim report of breach. You can download the complete report in PDF Format from the following link :
What is MITM attack and how to prevent it ?
MITM stands for Man-In-The-Middle. it simply means someone stands between you and destination and intercepts or modifies your communication. it is quite easy when communication is not encrypted.
SSL protocol is originally invented to address this issue. The idea is that a trusted Authority (CA) authenticates the identity of destination and by using some cryptography protocols your connection to authentic destination becomes encrypted and impossible to intercept or modify.
It has been shown that the cryptography methods like AES or RC4 which are employed to encrypt the data are quite effective and very hard to crack. so the easier solution is to attack the base of trust model, the trusted authorities (CA). In this kind of attacks, hackers break into CA systems and forge valid certificates for themselves so they can impersonate themselves as authentic destinations and intercept the data. this kind of attack is used in both recent incidents, Commodo and DigiNotar.
Although the protocol is almost safe itself, unfortunately many of these CAs are vulnerable themselves making the whole process vulnerable.
The FOX-IT report indicates the DigiNotar systems were using Windows (Which is vulnerable in nature) and passwords has been crackable through brute-force attack. (More on this later)
To understand it better, I have created a diagram of recent MITM attack to Iranian users with the goal of intercepting communications between them and Google. the attackers have been able to gain access to Google accounts of users through this attack :
This diagram is self-explanatory. The attacker in middle impersonates itself as Google and establishes a secure connection to the user which is signed by DigiNotar CA. Although the connection is still secure, but users have a secure connection to the attacker, not real Google. so attacker has access to all information sent by user, including username, passwords, cookies and etc.
HTC has doubled its sales in 1 year by selling android phones, it shows how smart the managers of HTC are.
HTC originally had a partnership with Microsoft to implement WP7 on its hardware, when HTC implemented Android, Microsoft sued HTC due breaking the agreement.
Finally HTC insisted on using Android and agreed to pay $5 fine to Microsoft per Android device sold. Microsoft has received millions of dollar from HTC so far due to this fine.
In fact Microsoft has made more revenue from Android compared to its own mobile solutions ! Microsoft should be a big fan of Android now.
Current position of HTC puts Nokia partnership with Microsoft in question , when Nokia chose WP7 for its smartphones , Google made an announcement calling Nokia’s decision a big mistake.
Is Nokia wise enough to pay millions dollars of fine to Microsoft like HTC did and implement Android ? We should wait and see
All of this are very bad news for Apple. no company likes to see its competitors having 100% revenue increase in just one year.
I can see the comments of disappointed Apple Lovers all over the web now , begging Apple to do something , like this one :
Please Apple put some effort in your next phone. Otherwise i have to buy one of these HTC products too.
Its time to say goodbye to iOS and iPhone and switch to Android
Regardless of announcing some new updates including iCloud, iOS 5 and Mac OS X Lion in Apple’s WWDC 2011, The Apple stock price fell dramatically this afternoon losing 4.57% of its value.
Seems the investors already know that apple has fell behind the competition and has nothing new to offer. I expect more price fall and a gap between today’s closing price and tomorrow’s opening price for AAPL.
It is very clear that market is not satisfied and will continue to react to absence of announcement of an iPhone 5.
Many apple lovers were waiting for iPhone 5 and with no clear release date, a large portion will decide to not to wait anymore and buy an available phone.
It makes a brilliant opportunity for android device makers like Samsung, HTC, LG and Motorola to saturate the market with their own products and cut the Apple’s market share even faster.
Some rumors suggest that iPhone 5 will be released with iOS 5 this fall, but even if it’s true, it is a very bad move for Apple. disappointing many customers.
It is time to say goodbye to iPhone and switch to Android devices
After market of smart phones is conquered by an army of Android phones and iOS market share is falling so fast,
I heard the news that iPhone 4 is awarded some Guinness Word Records , it seems a good news for fruit company fans at the first glance, but they should hope no one reads the full story
Lets see what is the Record for : “Fastest-Selling Portable Gaming System“ wtf ! and it is compared to PSP and Nintendo.
Guinness states that the iPhone 4′s first-day sales estimates of 1.5 million make it the fastest selling game system in history. By comparison the PSP only sold 200,000 units its first day and the Nintendo DS sold 600,000 units in its first week.
I guess fruit company should sue Guinness for this record because everyone was thinking iPhone is a smartphone and does not fall into the category of portable gaming systems ! lol
and now we may expect some new records for iPhone in near future :
The fastest selling portable internet TV ( cause you can watch youtube on it )
The fastest selling portable WC notification system ( cause it shows the place of public WC’s on the map )
and many more …
After fruit company shot itself in the leg by suing Samsung for some nonsense claims, now we see this desperate attempt to save iPhone.
I am sorry Steve, let me tell you what you should do to save iPhone market.
You should create an iPhone with Android OS on it , If I remember correctly it is what you have already done for your desktops and laptops after your share of desktop and laptop market dropped to nothing. right ?
you let users buy your products and install windows on it. that was a wise decision
Why don’t you learn a lesson from history ?
After my previous article which explained how to backup MySQL DBs to an email address , I am going to provide a more perfect solution in this article
The previous solution had some drawbacks and some advantages but the biggest problem was about the size of backup. although we compress the data with bzip2 algorithm which provides a high level of compression but in many cases, the attachment size will exceed 25MB or the limit of your email box. so it can not be used with public email services or will need a personal email server.
a better solution is to backup the data to a remote FTP server. in this case we will have almost no limit on file size (depending on your remote FTP server).
A perfect place to backup your files is fileserve.com , it offers 500GB of space for free and FTP access to it ! it is awesome ! I would recommend to upgrade to their premium service.
click on this link to signup for your free account : FileServe.com Free Account
also we will employ encryption to make sure our data is safe in transmit and in remote location.
to use this solution make sure bzip2, mcrypt and ncftp are installed on your server. I am not going into the details of installing each package, Google is your friend
so lets say you want to backup /var/www folder, use the following command :
tar jcf - /var/www | mcrypt -k 'SOME_LONG_COMPLEX_KEY' | ncftpput -c -u FTP_USER -p FTP_PASS FTP_HOST /PREFIX-`date +%Y%m%d`
this only command will compress the whole /var/www folder by tar and bzip2 at the same time encrypt it by your key and at the same time will upload it to remote FTP server !
omg ! thats why I love Linux ! you can put it in your crontab to create automatic backups.
now lets say you want to backup all MySQL DBs , you can use the following command :
mysqldump --user=USERNAME --password=PASSWORD -A | bzip2 | mcrypt -k 'SOME_LONG_COMPLEX_KEY' | ncftpput -c -u FTP_USER -p FTP_PASS FTP_HOST /PREFIX-`date +%Y%m%d`
the combinations and possibilities are limitless !
I just gave you the idea and showed you the power, use your own brain to make your perfect solution
Just something else , if you needed to decrypt the file , you can use the following command :
mcrypt -d FILE_NAME -k 'YOUR_LONG_COMPLEX_KEY' > NEW_FILE_NAME
Make sure mutt & bzip2 are installed on your server.
Change USERNAME & PASSWORD to your MySQL login credentials.
Change firstname.lastname@example.org to your email which can accept large attachments (gmail is recommended, currently it accepts attachments up to 25MBs)
Put the following line in your crontab. you can access crontab by this command : crontab -e
0 0 * * * mysqldump --user=USERNAME --password=PASSWORD -A | bzip2 > ~/AllDBsBackup.bz2 && echo | mutt -a ~/AllDBsBackup.bz2 -s "All DBs Daily Backup" -- email@example.com
It is a few days that I have installed Disqus wordpress plugin and I am quite impressed by it. I am receiving no more spam/bot messages through Disqus commenting system , but still bots are able to send spam to wordpress own commenting system ! so I was looking for a solution to disable wordpress comments and I found the following link :
it provides 2 solutions to get rid of wordpress commenting system , but I prefer the neat one ! delete the whole thing ! lol
simply delete wp-comments-post.php from your wordpress root installation folder. then bots can go to hell