I found an interesting article today studying the frequency of PIN usage on the iPhone. If you have an easily guessable PIN number then you really are doing yourself a disservice. I’d bet that people who use these common PIN numbers on their iPhones use them everywhere else as well. If you find yourself in this boat then you should consider changing it up!
Naturally, 1234 is the most common passcode: mimicking the most common internet passwords. To put this into perspective, these 10 codes represent 15% of all passcodes in use. Most of the top passcodes follow typical formulas, such as four identical digits, moving in a line up/down the pad, repetition. 5683 is the passcode with the least obvious pattern, but it turns out that it is the number representation of LOVE (5683), once again mimicking a very common internet password: “iloveyou.”
Interestingly, 1990-2000 are all in the top 50, and 1980-1989 are all in the top 100. I would interpret this occurrence as a subset of users that set their passcodes to the year of their birth or graduation.
Occasionally at work I am called upon to pick passwords for my end users. They would prefer that I use passwords like “password” or “1234567890.” We all know how secure that is. I prefer to randomly generate a password for them. I have a website bookmarked that I use to generate a few passwords at a time to get me past any immediate needs.
Today I needed to generate 1350 passwords. My favorite tool generates them 50 at a time. What is an IT guy to do? The first thing is to start Googling around. After a brief search I came across a linux utility called makepasswd. After a few command line entries and some brief cleanup in a text editor I was ready to go!
To Install makepasswd (in Ubuntu):
sudo apt-get install makepasswd
To generate the passwords:
makepasswd --chars 8 --count 1350 | cat >> /path/to/file/passwords.txt
The end result is a quick and dirty file of passwords ready to be handed out. These may not be the most secure but they are certainly several orders of magnitude more secure than if I let my folks pick their own. I think I’ll dump the website generator from now on. I have an easy to use and powerful Linux utility right at my fingertips!
Our friends at the Mozilla Foundation provide some good tips on how to choose a strong password.
Our clergy e-mail server at work is running a Thawte SSL123 certificate for securing all webmail, POP/SSL and SMTP/SSL traffic. They have been an excellent certificate authority and we have used them for several years now. Unfortunately, the certificate in question expired over the weekend. I was supposed to renew it late Saturday night or Sunday morning, the time when we have the least traffic on our server (go figure, it’s a bunch of preachers). The problem was that I got home, sat on the couch, played with the kids and this slipped my mind.
There’s nothing better than a dose of high octane stress to kick off a week just right. I came in this morning to find out that no one could connect to the server anymore. Our office was flooded with calls wondering what was wrong with the e-mail server. In the past people could have clicked past the expiration error and kept on trucking. I quickly renewed the certificate, downloaded and installed it. Then the real problem started. All of our clients could now access the server but they were getting trust errors. Turns out the new Thawte certificates need to have an intermediate CA certificate installed.
Thawte uses Intermediate CAs to enhance the security of SSL and Code Signing certificates. Installing the correct Intermediate CAs or CA bundle for the certificate being used is absolutely essential to ensure that users don’t see certificate errors when visiting a website or running software secured with a Thawte certificate.
I didn’t know about this since it had changed in the last year. After running it by their technical support (they give great chat by the way) I was pointed to an article discussing the issue. Turns out this new requirement was implemented on June 27th, 2010. I downloaded the required certificate and added the following line to ssl.conf:
One quick Apache restart and all is well. Now it’s noon on Monday. Time to get the week started!
Leave it to Google to come up with interesting new things. I downloaded the latest version of Chrome and noticed that several things have changed. You can now synchronize extensions and preferences across browsers. The best part though is the new graphic for SSL certificates:
Beware the security devils!
This is the graphic that you now see when you are visiting a website with a valid certificate that is loading page elements that are not encrypted. It’s not a terrible thing security wise but nevertheless, beware the red skull of security! Even though I know it is going to generate support calls I still love it. Well done Google!
I have noticed over the last few days that we have had Roadrunner messages in our main e-mail gateway stuck in our queue with the following error:
56FE71501A1C 1695 Fri Jul 30 08:32:19 email@example.com
(host hrndva-smtpin02.mail.rr.com[184.108.40.206] refused to talk to me: 421 4.7.1 - Connection refused - - Too many concurrent connections from source IP)
Due to Roadrunner’s rather draconian inbound rate limit policy, we receive this bounce error almost constantly. A fairly large number of the e-mail that is sent out over our servers is headed for Roadrunner’s system. Given that much of the traffic is generated from local church mailing lists, a delay of a few hours usually isn’t that big of a deal. At least, it hasn’t been up until this week. Once I got in this morning however, I saw that we had almost 5,000 messages in the queue with the same error. Alarm bells went off and the IT Office shifted into DEFCON 1.
Searching through the 5,000 messages quickly showed me that there was one sender who was doing most of the work. Grepping through /var/log/maillog quickly showed me which server the traffic was coming from. Once I had this information handy I shut down the main gateway server to stop the bleeding until I could figure out what was going on. I headed over to the server in question and started searching through those logs as well.
Turns out that there was an old Squirrelmail plugin that the spammer was using to generate plain text spam messages internally. Specifically these were nigerian phishing scheme messages. Since they are plain text, coming to and from legitimate addresses and were constantly changing, they were very difficult for our spam filters to stop. Once I updated the plugins, cleaned out all of the mail queues in question and restarted the affected services we were back in action.
The only problem remaining was to convince my fellow e-mail administrators that we were no longer sending spam. All of the major ISP’s use different filtering systems, real time blacklists (RBL’s) and their own internal policies. This meant visiting each ISP listed in the queue as a bounced message and reporting to them individually that the issue was resolved.
Along the way I noticed that there were two agencies that many of the ISP’s use as a clearing house for online e-mail system reputation. You can sign up your organization and they will independently verify that you are not a spammer. Once you are on their list, the ISP’s that subscribe to their services can verify that you are a legitmate sender. It amounts to a shake down more or less. You have to pay to play. Given the importance of our e-mail systems I decided to go ahead and sign us up. If you need to do the same with your mail servers then visit these companies:
- E-mailReg.org – This service charges $20 for one year of service. After verifying domain ownership they say it will take several days.
- ReturnPath.net – This is the big service that a lot of the major ISP’s use. They charge for their service based on how big your organization is. We received the non-profit discount and paid $200 for the application fee with no monthly fee. This system will take several weeks to verify. You really should sign up for this service when times are good.
All is well now. The spam flow has been stopped and all of our queues are cleaned out. All we can do now is wait on Roadrunner’s rate limits to time out and allow us to resume sending messages.
There is a bill now being written behind closed doors that would give the President the power to exert emergency control of the internet in times of emergency. If you are fortunate enough to be a company that is designated as a critical interest you could be subjected to forced removal from the internet when an emergency strikes. Why is the government trying to get into the business of controlling these companies? Shouldn’t they be cleaning up their own house first? These companies hire entire departments of people who are in charge of protecting their digital assets. It’s their job. Why is the government concerned with the operation of private property? It frankly is none of their business how large companies operate their networks. Who thinks this is a good idea?
Internet companies and civil liberties groups were alarmed this spring when a U.S. Senate bill proposed handing the White House the power to disconnect private-sector computers from the Internet.
They’re not much happier about a revised version that aides to Sen. Jay Rockefeller, a West Virginia Democrat, have spent months drafting behind closed doors. CNET News has obtained a copy of the 55-page draft of S.773 (excerpt), which still appears to permit the president to seize temporary control of private-sector networks during a so-called cybersecurity emergency.
The new version would allow the president to “declare a cybersecurity emergency” relating to “non-governmental” computer networks and do what’s necessary to respond to the threat. Other sections of the proposal include a federal certification program for “cybersecurity professionals,” and a requirement that certain computer systems and networks in the private sector be managed by people who have been awarded that license.
Here’s the real kicker:
Probably the most controversial language begins in Section 201, which permits the president to “direct the national response to the cyber threat” if necessary for “the national defense and security.” The White House is supposed to engage in “periodic mapping” of private networks deemed to be critical, and those companies “shall share” requested information with the federal government. (“Cyber” is defined as anything having to do with the Internet, telecommunications, computers, or computer networks.)
Now we see the true purpose of this bill. The government wants to know what is on our computer networks. Imagine the possibilities for a moment. Let’s say there is another (God forbid) terrorist attack. The government already has the power to ground all air travel. Now they can pull the plug on the internet as well. What better way to suppress dissent could their be? The government already effectively controls the majority of the mass media. Oh wait, this is for our safety. There I go being paranoid again…
The NC State Office of Information Technology has produced a video outlining the importance of installing antivirus software on your computer. You may not qualify for their software but you should run something!