Monthly Archives: June 2014

Google’s guessing games #privacy #humor

Imagine my surprise today when a google search result showed my location below the search results (nil).

Virar West, Virar, Maharashtra – From your Internet address – Use precise location
 – Learn more

I live in Virar East, so the guess was off by a few kilometers. Curious to see how accurate it gets, I allowed it to use “precise location”.

Result?

Friends Colony, Hallow Pul, Kurla West, Mumbai, Maharashtra – Reported by this computer – Update location
 – Learn more

That would be a few dozen kilometers away with an entire Lok Sabha Constituency lying in between mine and the stated target area’s :p

Moral of the story? If you live in an area barely covered by Google Maps, you’d probably do better activating snooping stuff to obfuscate your location :p

Note: this was funny and an obvious backfiring of “precision” if it added an error that put the location in another district altogether. Your mileage may vary. This is not a serious privacy tip :p

Reset the net – Don’t ask for privacy, Take it back

A long overdue backlash against state spying (and NSA in particular) has some of the biggest websites on the internet joining forces with internet rights activists to unleash an unambiguous message. Don’t ask for privacy, take it back.

reset-the-net

Internet website and application owners are encouraged to adopt strong encryption based security measures to prevent spying and spread awareness to more people. Here is are resources for various security measures against spying. It doesn’t get easier than this. Do it. The 5th of June will see splash screens raising awareness on sites participating in the campaign.

While the protest is against NSA and US policies, the internet is a world without boundaries, and I do believe that Indians cannot afford to remain disinterested. As power concentrates in fewer and fewer hands, greater resources are spent protecting it from all threats, real and imagined with scant regard for individual and privacy rights.

So I have decided to support the campaign even if it doesn’t protest Indian government (yet). As some of you may have noticed, all my blogs are now ssl enabled. This will continue. I will be using more security features, and perhaps share how you can get them too (since my ideas are n00b and wallet friendly, I imagine they may help some).

Edward Snowden, whose leaks on government spying became a massive last straw for many, has endorsed the campaign in a must read letter.

“One year ago, we learned that the internet is under surveillance, and our activities are being monitored to create permanent records of our private lives — no matter how innocent or ordinary those lives might be.

Today, we can begin the work of effectively shutting down the collection of our online communications, even if the US Congress fails to do the same. That’s why I’m asking you to join me on June 5th for Reset the Net, when people and companies all over the world will come together to implement the technological solutions that can put an end to the mass surveillance programs of any government. This is the beginning of a moment where we the people begin to protect our universal human rights with the laws of nature rather than the laws of nations.

We have the technology, and adopting encryption is the first effective step that everyone can take to end mass surveillance. That’s why I am excited for Reset the Net — it will mark the moment when we turn political expression into practical action, and protect ourselves on a large scale.

Join us on June 5th, and don’t ask for your privacy. Take it back.”

-Edward Snowden

In other news, Google has released the code for its upcoming “End to End” Chrome plugin offering end to end encryption to prevent email spying. It is also intended to be an easy way to get secure communication for people at risk and thus will carry a burden of having to aim for usability as well as flawless security. The Chrome plugin is currently in the alpha state and Google has released it with an Apache 2.0 licence inviting hackers to find security flaws under its bug bounty programme.

Together with statistics released about the use of encryption in sent and received email via Gmail, Google’s message for today is powerful and straight.

Use encryption to communicate by email.

Other organizations supporting Reset the Net include Reddit, WordPress

WordPress All In One SEO Pack plugin users should upgrade NOW #vulnerability

The Scuri blog has posted that the All in One SEO plugin had two vulnerabilities they had pointed out earlier, and the just released update fixes both. AISEO users are advised to upgrade as soon as possible.

While auditing their code, we found two security flaws that allows an attacker to conduct privilege escalation and cross site scripting (XSS) attacks.

In the first case, a logged-in user, without possessing any kind of administrative privileges (like an author of subscriber), could add or modify certain parameters used by the plugin. It includes the post’s SEO title, description and keyword meta tags. All of which could decrease one’s website’s Search Engine Results Page (SERP) ranking if used maliciously.

While it does not necessarily look that bad at first (yes, SERP rank loss is no good, but no one’s hurt at this point, right?), we also discovered this bug can be used with another vulnerability to execute malicious Javascript code on an administrator’s control panel. Now, this means that an attacker could potentially inject any javascript code and do things like changing the admin’s account password to leaving some backdoor in your website’s files in order to conduct even more “evil” activities later.

Read more: Vulnerability found in the All In One SEO Pack WordPress plugin

Also, commenter Orun Bhuiyan brings up an important security point when he points out that the AISEO plugin echoes a generator tag with the version number, thus exposing both plugin and version number and making it easy for malicious entities to target vulnerabilities when such situations arise. This has been pointed out on several forums including several plugins containing settings to mute generator tags, but it continues to be a problematic default that is a major security risk leaving wide swathes of content vulnerable before updates can be applied.