Potential Facebook Security Issue

Facebook introduced its tagging feature (in wall posts) not too long ago. Since then, almost everyone I know on Facebook has learned to tag their friends in both status updates and comments. But one thing that I haven't seen much of, yet something that could be a security concern, is the ability to tag pages in wall posts using the '@' reference. This works well when the page is on Facebook, such as the company's official Facebook page or a product or service. Here is an example of tagging a company's page on Facebook:

When the user presses 'enter,' the tag is converted into a link that takes anyone clicking it to the official Grooveshark Facebook page.

The word "Grooveshark" becomes a link that directs the user clicking it to the Facebook page for Grooveshark. However, not all pages are contained within Facebook. For example, prior to recent changes (Facebook changed the "liked" links into wall post stories rather than a recent activity), a "page" could be created from any page on the web with Facebook's like button installed. Here is an example from Blogspot blog with a random post.

(Keep in mind that this only works with pages that have been "liked" previously and does not work with new posts).

Clicking "Like" under the post causes a post to be made to your Facebook profile wall saying that "user x likes page y." However, in this case, it simply says "User X likes 'did that five year old I just saw have a cell phone?'" The name of the page is a clickable link redirecting to the original blog page (as it should for viral purposes). Now here is where the potential vulnerability comes into play. Since Facebook treats these older "likes" as pages, the user can "tag" the page as well.

This creates a link, which is posted on the user's wall to the original blog post.

So essentially, this creates a problem because we have links that are masked by text (the same way they are around the web). However, this is especially problematic on Facebook because users will almost always click a link posted by their friends without investigating the underlying URL. It is important to remember that the owner of the original blog post still has complete control over that web page. He or she can redirect it, add malicious code, etc., and there is nothing Facebook can do about it.

Now imagine if the above link said "This video is hilarious!" It looks like a trustworthy post from a friend. But in reality, it's a post made by a rogue application that obtained permissions to post to the user's wall. The text "This video is hilarious!" could redirect to any page on the web.

Fortunately, this problem is not a large one. First, it is hindered by the fact that very few users are aware that they can tag pages. Secondly, Facebook has stopped treating new "likes" as pages and instead treats them as links, displaying their full URLs. However, the problem can still exist on older pages, of which there are millions.

To protect against this threat, always be aware of where the link is going. On Facebook (and any other site), hovering over the link reveals the URL at the bottom of the screen.

This isn't a major security issue with Facebook, nor will it probably be corrected. However, it is important to continually monitor Facebook before clicking any links.

Everything is Moving to the Cloud... Even Hacking?

I promise that this won't be a buzzword-laced post about the benefits of cloud computing, the continuous move to store all our information online, or the pros and cons of relying on off-site storage. However, an interesting trend has been cropping up in terms of cloud computing and network security: the use of "the cloud" as a launching point for cyber attacks. One of the most notable incidents (and the one that inspired this post) was that of the cyber attack on Sony's Playstation Network. One of the big differences between that attack and more "conventional" hacks is that the attackers were able to harness the power of cloud computing to launch their attacks rather than relying on local servers or widespread botnets. I believe that this will quickly become a trend, if not the norm, for cyber attacks in the future. The anonymity of a cloud-based launching point, its ease-of-use, availability, power, and low costs combine to make using the cloud to launch a cyber attack not only feasible, but also tempting.

When Sony released information about the attack, one of the more noteworthy facts was that the attacked had been launched from Amazon's EC2 cloud computing infrastructure. Although hackers have previously used rented servers, this attack marks one of the most significant cases of late where a service such as Amazon's has been abused in such a manner. No longer are the masterminds behind cyber attacks required to purchase server space from shady third parties in unknown countries. Instead, they can use a legitimate service, at a fraction of the cost and with more power (Amazon's cloud is notoriously resilient).

In terms of anonymity, using cloud based services doesn't necessarily decrease your chances of detection, but it does add another layer. Now, law enforcement investigators will need to subpoena Amazon, search their records, find connecting computers, and trace from there. It's another step that only adds time and could possibly aid attackers. Renting a server and service from Amazon is as simple as signing up with a fake account and a fake credit card, something to which cyber criminals undoubtedly have easy access. In addition, using an Amazon server to launch an attack is like hiding behind a proxy without the obnoxious bandwidth reduction. Now, attacks can be launched at full speed, without being channeled through proxies. Only the commands sent to the servers need to be sent through proxies to obfuscate the identity of the attacker.

Amazon has an amazing infrastructure and you can be assured that hackers will continue to exploit it mercilessly. A question that needs to be asked, however, is how will Amazon protect against outbound attacks? They have demonstrated (for the most part) that they can secure their infrastructure from attack. But what happens when that infrastructure is doing the attacking itself rather than being attacked? Hopefully Amazon will be able to implement security that can prevent the abuse of its services.

Sony and Anonymous

When discussing online intrusions, hacks, and denial of service incidents, one of the primary questions posed is: "who did this?" Obviously, the company under attack has a direct obligation to its customers to both repair the damage and implement preventative measures. However, an organization today known as "Anonymous" is increasingly challenging the ability to pinpoint a direct source of an attack. Anonymous is neither a collective group nor a dedicated few individuals; it is everywhere, at any time, consisting of whomever so desires to be a part of it. Do I think that Anonymous attacked Sony? No. However, this makes it difficult for Sony because if Anonymous is not a group or a defined set of people, how can it be said that the hacking attempt wasn't Anonymous?

In my opinion, Sony needs to determine who made the attack, and for this reason they have listed Anonymous as the perpetrator. Regardless of its innocence, Anonymous will take the blame because it is not defined, and there is no way to prove it wasn't the group. How can we prove that it wasn't Anonymous if the entire point of the organization is to claim that it is everywhere? If one person "joins" Anonymous, then later, with several other people who have also "joined," commit a service disruption, is that the action of Anonymous or not? How many people does it take to form "Annonymous?" Since there are no statistics on the size of the group, one hundred people could make up 70% of the organization on Monday but only 10% on Tuesday.

As odd as it may sound, I think that most people in the tech community believe Anonymous when they say they aren't seeking credit card numbers. The group as a whole seems to pursue what they feel are moral crusades and stealing customer data doesn't seem to align with the past. However, it is hard to pinpoint a motive for the group, and there certainly be members who elect to pursue more damaging attacks than the rest of the organization. Regardless, Sony will most likely continue to blame the group as a whole. Since Anonymous wants to be anonymous, it can use the shield of anonymity to protect it, but it may also come back to harm them later as well.

RIT48 Challenge

This past weekend (March 25-27) I got a collective six hours of sleep. This comes from the fact that I was participating in a challenge at RIT called the RIT48 Challenge. Essentially, this challenge required participants to design, plan, and launch a web startup company in just 48 hours. Participants are judged on their business models, plans, product designs, etc.

I joined a team at the last minute when their web developer had a family emergency. The team already had their idea in place, we just had to wait until the start of the event to work on it (participants can only work on their ideas during the 48 hours). My team's idea was to create a new content distribution system for small publishers, web artists, videographers, photographers, etc. Essentially, we wanted to create a site that would allow larger companies to get in touch with smaller companies / content producers in regards to licensing their content.

After 48 hours of almost no sleep, our product and business model were in place. Although we didn't win the competition, I really learned a lot during that weekend. I learned a ton about team work, business models, how to launch a startup company, and a lot more. I also met a ton of interesting people in all areas.

RIT48 was an amazing challenge, and I'm already planning on competing next year.

Convert a PHP Array to a JavaScript Array

Many times when working with advanced web applications it may be necessary to convert an array of PHP variables into an array of JavaScript variables. I stumbled upon this issue in some recent web development work and most of the solutions online seemed incredibly complicated for such a simple task.

JavaScript is different than PHP because JavaScript allows manipulation of the page data on the client side (meaning no page refreshes are necessary). PHP works by sending information to a server (server side) to manipulate and return. This means that page refreshes are necessary (typically). So let's say you have an array of strings in PHP; we'll call it "phpArray()". This array may be created in PHP with the following PHP code:

$phpArray = array("Word One", "Word Two", "Word Three", "Word Four");

Now we have a $phpArray variable in PHP that contains the words as strings. To convert this array to a JavaScript array, we are going to first create a string from the PHP array by running through a PHP loop. First, we will declare a string variable in PHP to hold the loop's contents:

$string = ""

Now we're going to loop through the loop and add each element of the array to the string with quotes around it. (Note: this is for an array of strings. An array of ints should be handled as strings in PHP, but passed to JavaScript without the quotes.)


foreach ($phpArray as $a) {
$string .= "\"" . $a . "\", ";
}


This code creates a PHP string that looks like:

$string = "Word One", "Word Two", "Word Three", "Word Four",

Now, we need to do one final thing. This code loops through the array and adds a comma (,) and space( ) to the end of each array element. That means that the resulting code will appear as "Last Word", We don't want this because it will mess up our JavaScript. To cut off this last comma and space, we will do:

$finalstring = substr($string, 0, (strlen($string) - 2));

This code removes the last comma and allows us to place it into our JavaScript. In the JavaScript section of our page, we're now going to add:

<script language="javascript" type="text/javascript">
            var jsString = new Array(<?php echo $finalstring; ?>);
</script>


We now have a JavaScript array called "jsString" which contains all of the elements of the PHP string array. It would be the same as writing:

var jsString = new Array("Word One", "Word Two", "Word Three", "Word Four");

That's all there is to it. If you have any questions, just leave a comment!

Watson and the Future of Humanity

You've probably seen it by now - the videos of the IBM-created supercomputer named "Watson" correctly answering question after question on Jeopardy as its human opponents stood by helplessly. After reading many of the comments on the news articles around the Internet, I have realized that most people truly don't understand the implications of the technology behind Watson. "Computer Overlord," "HAL," and "Rise of the Machines" jokes aside, Watson represents a unique turning point in the history of computing and information searching.

Watson is unique because it can truly learn from reading - just like humans. However, Watson stores its vast amount of information based on patterns. Everything that Watson does boils down to a series of patterns, word associations, and language recognition skills. Watson will never be able to "think" on its own in terms of the human definition of "thinking." However, with every passing day, its ability to compare billions and billions of words, create highly specialized series of rules based on associations, and deliver content that is unique grows.

So what can Watson be used for, besides putting Ken Jennings to shame? Imagine five or six years from now, you're experiencing pain in your stomach. You visit the hospital and you list your symptoms aloud for the doctor. But as you do, a machine is also processing your symptoms, sorting through millions of medical articles, patient databases, your family health history, and more to determine what it thinks you should be diagnosed with. Your doctor could never possibly process that much information. Together, the computer and the doctor correctly diagnose your problem. The point here is that neither the doctor nor the computer are working independently. Humans are amazing at understanding the complexities of speech. A computer could never understand "Well it hurts sometimes, but only when I am thinking about it." However, computers are excellent at processing information. Your doctor could never sort through five million medical articles for the one that relates to you; the doctor could never think of every possible side effect of every combination of medicine. But machines can. So working in tandem, the computer and doctor could achieve much more than either could alone.

Watson represents a giant step forward in the history of computing. It is amazing how machines are slowly being trained to comprehend our search queries in terms of the spoken language rather than a string of text we type into a search engine. Hopefully Watson's technology will help us achieve even more. But always remember: humans created Watson.

What an iPhone on Verizon Means

As most of you have probably heard by now, rumors are flying about the iPhone coming to Verizon this Tuesday (January 11th). Although I feel that Verizon could use this moment to pull one of the largest pranks the entire mobile industry has ever seen and introduce another Android device, I think that most experts agree this is the day the iPhone will finally be announced. To be honest, I am not as excited about this as most. Allow me to explain.

Since the beginning, I have supported Android. I have owned iOS devices, but have felt that, as someone who loves to modify and customize my device, Android is the better platform. I do admire Apple for their products that "just work" and feel that they have become the leaders in the mobile industry because of this. They are catering to a market of people who don't care about the technology behind their devices, they just want to turn it on and use it (Obviously technology enthusiasts use iOS devices as well, they're just not the bulk of users). But in the end, Android has become a place where I can install whatever application I like, change my home screen, and make changes to how the entire operating system functions; it's just how open source works.

This is why I don't look forward to the 12 Million expected iPhone users, each consuming on average 200 MB of data per month, consuming valuable Verizon resources. Android users have enjoyed Verizon's fast, always-present network for about two years. Unless Verizon has invested millions of dollars in infrastructure to support the impending onslaught of iPhone users, you can bet that the network will stagger under the load. While I doubt that it will suffer as much as AT&T's has, I am certain that the slow-down and congestion will be noticeable.

In addition to speed issues, I fear for the future of Android. Android is an amazing product and has made huge leaps in terms of development and market share. A huge portion of Android's success (sadly) has been because it is typically referred to as the "Verizon iPhone." I have no doubt that Android's market share will take a huge dip when the iPhone is introduced. It will need to fight to stay alive, and without Verizon's ridiculous marketing, I honestly don't know about Android's future.

The iPhone coming to Verizon is something millions of customers have wanted for years. Now that it is finally here, I fear it will bring congestion to Verizon's networks and a decline in Android's market share and development. Google will need to invest millions in marketing, which I hope they do. Competition is good for the consumer and I hope that both products will benefit from this. I just hope that Google can do enough to convince new users that Android is just as good (and better, in some cases) than the iPhone.