Is I Robot coming?

Google has been in the news a lot lately for buying a number of robotics companies. If you're not familiar, just search "google robotics" and read an article similar to, "Google plans to take over the world with advanced robotic war machines" (or something that sounds catchier with the same meaning).

Why you should pause before signing up for the Circle

If you have a Facebook account you've probably been overwhelmed by invitations to join the new "Local Network" the circle. If you're thinking about signing up for it, I'd encourage you to

Cyber Security Exhaustion

Do you feel overwhelmed by cyber security?

Me too. Let me give you my brief personal background.

How do I patch the things good?

My team was recently asked to do an assessment of our companies patching strategy and to suggest improvements. Senior management's questions came down to, "How do we patch the things good?"

That AIN'T REST

I don't have screen shots for this because it happened a while back and I've switched jobs, so I'll tell this tale in text.

Working on migrating articles out of a company wiki I wrote a script to download these articles automatically using the wiki's rest API. Here's the general algorithm:

1. Start with article 0 and request a batch of 100 articles (maximum allowed)
2. Request the text for the first article returned
3. Request list of attachments for each article
4. Download each attachment
5. Repeat for the next article in the batch
6. Grab the next batch
7. Stop when the batch returned is less than 100

Since the API is labeled "RESTful" this should be fine, right? Each batch of 100 will always return the same 100 articles, so asking for them sequentially is fine, right?

Wrong. So very wrong. Putting the word "REST" next to the word "API" does not necessarily mean they gave you a REST API.

One article was failing, making my whole script bomb. Thinking I could pop in and try to exclude that specific article, I found the index number and excluded it. But the next day it failed again. I tried to figure out why and realized that the bad index was moving down the index once every 6 - 10 hours. Which means that the indexes were stateful. Which means it's not REST.

I get it. I honestly do. Not cleaning up indices makes for a painful system that can get bloated fast. But don't use the buzzword if you can't actually make it work.

OWASP Top 10 For the Average Internet User: Broken Authentication/Session Management

Where can it happen?

This can happen anywhere you need a username and password to login or anywhere that you are uniquely identified from other internet users.

What is it?

When you log on to a website that website needs a way to identify your internet traffic and keep you straight from all of the other people that are out there. Let's say when you log on to Facebook, Facebook tells you to identify yourself as user 150 everytime you go to a new page. As long as you send that number, Facebook knows to show you your friends, allow you to post new status updates, comment on pictures as yourself, etc.

But what if I (as an evil internet hacker) decided to browse Facebook and send them 150 as my identifier? Suddenly I become you! I can ask for my (your) chat history and see what girls you've talked to, I can post witty comments on your mothers pictures, I can unfriend your girlfriend! Mwwahaha!

Why should I care?

We really just covered this, but in case you don't care that I can unfriend your girlfriend on Facebook, what if I get your session token for your bank? Or your fandango or paypal account? Now your finances as well as your social life is at my mercy, which is very bad.

How can I protect myself?

Make sure that your websites log you in over a secure connection. This means that you should log in over ssl (you should see HTTPS at the beginning of the URL). Not many companies provide it, but it doesn't hurt to ask your bank or credit union how they handle your internet security before agreeing to do business with them online. That being said, the larger the company the more likely they are to put time and resources into ensuring your online security.

OWASP Top 10 For the Average Internet User: Injection

Where can it happen?

This can happen anywhere that a website allows users to enter text (Literally anywhere. Comment boxes, twitter updates, payment fields, username and password fields, etc, etc, etc) or anywhere that a website accepts text from the internet.

What is it?

A computer program is really just a series of letters and symbols put together by a person that a computer understands as instructions and then executes. When a computer program (like a website and your browser) handles text that you type, the distinction between the text and program is completely created by the computer. Think of it like a chocolate bar in a wrapper. The wrapper contains the chocolate bar and you can tell the difference, so you know to eat one and not the other.

But what if someone made a wrapper that looked and smelled like chocolate? You'd probably wind up with a mouthful of paper.

Injection is someone making the text they type into your website look and smell like program code so that the computer will run that code.

Why should I care?

Usually the program that is injected is SQL or javascript. Both of these are very bad. Javascript can make your browser do almost anything. The possibilities are only limited by the attackers imagination and the time they have to search for javascript tricks on the internet. If the attacker can find enough information about the website, they can make find a lot of information with SQL.

How do I protect myself?

Unfortunately this one is mostly on the people running the websites. The best thing you can do is to be careful what websites you visit. If someone sends you a link that doesn't look familiar, or you don't know why they're sending it to you find out more from them first.

You can also search for the name of the website on google. If you add "virus" or "malware" to the website's name, google should return some helpful results telling you if the website is known for suspicious activity.