Quest for Random Data

While doing some database masking work, I came across the need to generate thousands of fake names, addresses, phone numbers, and additional personal information. Originally, I copied the top few thousand names from US census data and saved the results in a spreadsheet. However, I then stumbled upon a website that has been enormously helpful: http://www.fakenamegenerator.com

I thought I'd share this since finding randomly generated data in the exact format you need (with the right attributes) is often difficult.

Google+ Vs Facebook: Separate But Integrated Services

Since Google+ launched several weeks ago, it has been fairly universally praised, yet it has also been doubted and questioned extensively. Can Google+ compete with Facebook and its myriad of over 700 million users (and growing)? Many have wondered if Google, an algorithmic company at its core, has the talent and engineering skills to produce a product that is used in a very different way than traditional search. Although I believe that Google+ will have a slow start, I also feel that the product will ultimately become not only a viable alternative to Facebook, but a better one. There is one major advantage that Google has over Facebook: separate, yet tightly integrated services.

For years, Google has been slowly moving our lives to the cloud. Gmail, although not the top email service, is used and loved by millions of people around the globe. Next, our calendars became available online, easily synced to any computer or device. Google Docs now stores and provides access to almost any file type imaginable without ever leaving the browser. Google Pictures (Picasa), YouTube, Reader, Tasks, Maps, the list goes on. Ultimately, these are separate, yet tightly integrated services. If you need directions, you access Google Maps; events take us to Google Calendar; email to Gmail. Yet within all of these services, although they appear to be distinct and separate, there is an element of connectivity. For example, Google Calendar integrates well with Gmail: we can send and receive invites seamlessley and access our contacts. The same goes for Google Docs.

You may be wondering what this has to do with Google+ or Facebook. My point is that the average user wants separate but integrated services. They want to be able to access their email without seeing their documents; they want to plan a trip without seeing YouTube videos. This is where Facebook falls short. Even with only a few "clones" of Google products, Facebook is starting to become crowded - a fact that many users are now complaining about. Facebook Messages, Events, Groups, Video Chat, regular chat, group chat, fan pages, and many other apps and services are slowly crowding a News Feed that was once a stream of updates from friends. There's only so many features that can fit on a single page and Facebook seems to be running out of white space. Google, although it has probably ten times more services than Facebook, does not feel crowded at all. All of Google's products are separated out into distinct web applications rather than crammed onto the same page. As I mentioned: separate but integrated services.

Now let's take into account social. For Facebook, social means having a base social platform and adding services to it. For Google, social means taking a base set of services and adding social to them. This is a key difference that I believe will ultimately benefit Google. If users can access their notification bar on every Google product (something Google is beginning to do already), social is not only more easily accessible, it is practically jumping out at users. Facebook has limited reach in these terms. Yes, they can have their own notifications as text messages or emails, but you will never see Facebook notifications as you surf the web, plan events on your calendar, or type documents in the cloud. Google already has these products, now it just needs to tightly integrate social into them just like they've integrated their existing products already.

So why do I think Google+ will have a slow start? For many users, moving to a new platform is a big change. The current dilemma facing Google+ seems to be the lack of users (although they are purposefully limiting it). It's a catch-22 of "I won't join until my friends join" and vice versa. However, Google, with its multitude of products can really begin to make not joining Google+ feel like missing out. When the notification bar is always a click away, I think it will become more and more tempting for non-users to give in and sign up. Google can have retention through integration. For Facebook, retention means keeping users on Facebook.com and no where else; for Google retention is becoming synonymous with opening a web browser.

VBA Script to Lookup Values and Return Result

This is a quick VBA script that I wrote after searching for a few hours online. I am posting it in case someone in the same dilemma I was in needs the same script. Basically, the script is for looking up values in another worksheet based on a current value. In this example, I am taking a user account name from the first sheet and then  looking up the last time that he or she logged in using the second sheet (which contains thousands of entries listing all logins). I want to grab the last occurrence of the login (most recent).

To begin, I will declare the variables:


Dim userId As String
Dim found As Range
Dim theDate As String


Next, I am going to loop through all of the cells that I want. In my example, I have 1730 user names to lookup (you can see why I wrote a script). First, it assigns the user name from the first sheet to the "userId" variable. Next, it searches through the "Logins" sheet backwards by matching the user ids (since this sheet is ordered by login date and we want the most recent). If it finds a match, it stores the cell's value in the range "found." If found is empty, it writes in the original cell that the last login date was never. If found is populated (a match was found) then it assigns the date stored in the field to the variable "theDate." Finally, it writes the value of theDate into the original sheet in Cells(i,3) meaning the 3rd column of the i^th row.


For i = 1 To 1730
  userId = Cells(i, 1).Value
  Set found = Sheets("Logins").Columns(2).Cells.Find(What:=userId, After:=[B1],
  LookAt:=xlWhole, SearchOrder:=xlByRows, SearchDirection:=xlPrevious)
  If found Is Nothing Then
    Cells(i, 3).Value = "Never"
  Else
    theDate = Sheets("Logins").Cells(found.Row, 1).Value
    Cells(i, 3).Value = theDate
  End If
Next i


Rsyslog Configuration

While working on a system that sends events to an ELA (Event Log Analyser) Server, I had to start filtering the events that were sent. I noticed this after sending all events (*.* in rsyslog) to the server and seeing 218,000 hits in 30 seconds. Apparently rsyslog logs everything from kernel events to authentication issues, and network traffic. This filled up the event log incredibly quickly. Just browsing the web for a few moments resulted in thousands of messages being saved in the event log. In addition, ever broadcast and multicast from every machine was logged. For my system and remote monitoring, this was not feasible.

As you can see, there are multiple entries for broadcast MACs. I do not want to log these. So, I set out on what would become a two-hour adventure on rsyslog and conditional filtering.

First, I discovered that Ubuntu uses rsyslog rather than the older syslog. Essentially, what I wanted to do was send all events to an ELA manager except for the broadcast and multicast messages (note: this computer is not for web browsing. If yours is, you will want to filter out web traffic as well or risk seeing millions of messages).

Before sending all of my information to an ELA Server (I remembered what happened last time I did that), I needed a way to see what messages would be sent and filtered. Enter "xconsole." Xconsole allows you to view messages that are being sent to the console. To run it, open up a command prompt and type:

sudo xconsole


This will open the console window. Leave this open while testing.

Ubunut stores its rsyslog settings in two places. The first is rsyslog.conf which is stored in /etc. However, it references/includes a file "50-default.conf" which is stored in /etc/rsyslog.d. To open that file and begin our edits type this in a command prompt (open a new command prompt tab so we don't close the xconsole)

sudo gedit /etc/rsyslog.d/50-default.conf


This will open a text editor. This file originally looks like this:

#Test logging to temp log
#*.*;kern.none    /dev/console
*.*    /dev/console

#LOG to remote host ELA
#*.* @10.10.92.33

#  Default rules for rsyslog.
#
#            For more information see rsyslog.conf(5) and /etc/rsyslog.conf

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*            /var/log/auth.log
*.*;auth,authpriv.none        -/var/log/syslog
#cron.*                /var/log/cron.log
#daemon.*            -/var/log/daemon.log
kern.*                -/var/log/kern.log
#lpr.*                -/var/log/lpr.log
mail.*                -/var/log/mail.log
#user.*                -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
#mail.info            -/var/log/mail.info
#mail.warn            -/var/log/mail.warn
mail.err            /var/log/mail.err

#
# Logging for INN news system.
#
news.crit            /var/log/news/news.crit
news.err            /var/log/news/news.err
news.notice            -/var/log/news/news.notice

#
# Some "catch-all" log files.
#
#*.=debug;\
#    auth,authpriv.none;\
#    news.none;mail.none    -/var/log/debug
#*.=info;*.=notice;*.=warn;\
#    auth,authpriv.none;\
#    cron,daemon.none;\
#    mail,news.none        -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg                *

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#    news.=crit;news.=err;news.=notice;\
#    *.=debug;*.=info;\
#    *.=notice;*.=warn    /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
    news.err;\
    *.=debug;*.=info;\
    *.=notice;*.=warn    |/dev/xconsole

This is the original file. We are going to be adding all of our rules to the top. Here are the edits I made to the file. These edits drop all messages matching a rule before logging them.

#Test logging to console with /dev/console.
#Then open CLI and do sudo xconsole to watch output

#Drop all packets containing information matching below. Then write.
:msg, contains, "DST=10.10.92.255"
& ~
:msg, contains, "DST=255.255.255.255"
& ~
:msg, contains, "DST=224.0.0.251"
& ~
*.*    /dev/console

#LOG to remote host ELA
*.* @10.10.92.3


The line for logging to the ELA can be commented out while you test this. The line with /dev/console will write to the xconsole window. Now we need to save it and restart the service. Save the file in the text editor, exit, and then issue:

sudo service rsyslog restart


That will begin throwing messages to your xconsole. If it works, you can comment out that line and then send the messages just to the ELA.

Here are some links that were used as sources. However, I wrote this post because none of the sources I found addressed multiple rules directly.
http://www.rsyslog.com/doc/rsyslog_conf_filter.html
http://www.rsyslog.com/doc/rsyslog_conf_examples.html
http://www.rsyslog.com/discarding-unwanted-messages/
http://people.redhat.com/pvrabec/rpms/rsyslog/rsyslog-example.conf

Potential Facebook Security Issue

Facebook introduced its tagging feature (in wall posts) not too long ago. Since then, almost everyone I know on Facebook has learned to tag their friends in both status updates and comments. But one thing that I haven't seen much of, yet something that could be a security concern, is the ability to tag pages in wall posts using the '@' reference. This works well when the page is on Facebook, such as the company's official Facebook page or a product or service. Here is an example of tagging a company's page on Facebook:

When the user presses 'enter,' the tag is converted into a link that takes anyone clicking it to the official Grooveshark Facebook page.

The word "Grooveshark" becomes a link that directs the user clicking it to the Facebook page for Grooveshark. However, not all pages are contained within Facebook. For example, prior to recent changes (Facebook changed the "liked" links into wall post stories rather than a recent activity), a "page" could be created from any page on the web with Facebook's like button installed. Here is an example from Blogspot blog with a random post.

(Keep in mind that this only works with pages that have been "liked" previously and does not work with new posts).

Clicking "Like" under the post causes a post to be made to your Facebook profile wall saying that "user x likes page y." However, in this case, it simply says "User X likes 'did that five year old I just saw have a cell phone?'" The name of the page is a clickable link redirecting to the original blog page (as it should for viral purposes). Now here is where the potential vulnerability comes into play. Since Facebook treats these older "likes" as pages, the user can "tag" the page as well.

This creates a link, which is posted on the user's wall to the original blog post.

So essentially, this creates a problem because we have links that are masked by text (the same way they are around the web). However, this is especially problematic on Facebook because users will almost always click a link posted by their friends without investigating the underlying URL. It is important to remember that the owner of the original blog post still has complete control over that web page. He or she can redirect it, add malicious code, etc., and there is nothing Facebook can do about it.

Now imagine if the above link said "This video is hilarious!" It looks like a trustworthy post from a friend. But in reality, it's a post made by a rogue application that obtained permissions to post to the user's wall. The text "This video is hilarious!" could redirect to any page on the web.

Fortunately, this problem is not a large one. First, it is hindered by the fact that very few users are aware that they can tag pages. Secondly, Facebook has stopped treating new "likes" as pages and instead treats them as links, displaying their full URLs. However, the problem can still exist on older pages, of which there are millions.

To protect against this threat, always be aware of where the link is going. On Facebook (and any other site), hovering over the link reveals the URL at the bottom of the screen.

This isn't a major security issue with Facebook, nor will it probably be corrected. However, it is important to continually monitor Facebook before clicking any links.

Everything is Moving to the Cloud... Even Hacking?

I promise that this won't be a buzzword-laced post about the benefits of cloud computing, the continuous move to store all our information online, or the pros and cons of relying on off-site storage. However, an interesting trend has been cropping up in terms of cloud computing and network security: the use of "the cloud" as a launching point for cyber attacks. One of the most notable incidents (and the one that inspired this post) was that of the cyber attack on Sony's Playstation Network. One of the big differences between that attack and more "conventional" hacks is that the attackers were able to harness the power of cloud computing to launch their attacks rather than relying on local servers or widespread botnets. I believe that this will quickly become a trend, if not the norm, for cyber attacks in the future. The anonymity of a cloud-based launching point, its ease-of-use, availability, power, and low costs combine to make using the cloud to launch a cyber attack not only feasible, but also tempting.

When Sony released information about the attack, one of the more noteworthy facts was that the attacked had been launched from Amazon's EC2 cloud computing infrastructure. Although hackers have previously used rented servers, this attack marks one of the most significant cases of late where a service such as Amazon's has been abused in such a manner. No longer are the masterminds behind cyber attacks required to purchase server space from shady third parties in unknown countries. Instead, they can use a legitimate service, at a fraction of the cost and with more power (Amazon's cloud is notoriously resilient).

In terms of anonymity, using cloud based services doesn't necessarily decrease your chances of detection, but it does add another layer. Now, law enforcement investigators will need to subpoena Amazon, search their records, find connecting computers, and trace from there. It's another step that only adds time and could possibly aid attackers. Renting a server and service from Amazon is as simple as signing up with a fake account and a fake credit card, something to which cyber criminals undoubtedly have easy access. In addition, using an Amazon server to launch an attack is like hiding behind a proxy without the obnoxious bandwidth reduction. Now, attacks can be launched at full speed, without being channeled through proxies. Only the commands sent to the servers need to be sent through proxies to obfuscate the identity of the attacker.

Amazon has an amazing infrastructure and you can be assured that hackers will continue to exploit it mercilessly. A question that needs to be asked, however, is how will Amazon protect against outbound attacks? They have demonstrated (for the most part) that they can secure their infrastructure from attack. But what happens when that infrastructure is doing the attacking itself rather than being attacked? Hopefully Amazon will be able to implement security that can prevent the abuse of its services.

Sony and Anonymous

When discussing online intrusions, hacks, and denial of service incidents, one of the primary questions posed is: "who did this?" Obviously, the company under attack has a direct obligation to its customers to both repair the damage and implement preventative measures. However, an organization today known as "Anonymous" is increasingly challenging the ability to pinpoint a direct source of an attack. Anonymous is neither a collective group nor a dedicated few individuals; it is everywhere, at any time, consisting of whomever so desires to be a part of it. Do I think that Anonymous attacked Sony? No. However, this makes it difficult for Sony because if Anonymous is not a group or a defined set of people, how can it be said that the hacking attempt wasn't Anonymous?

In my opinion, Sony needs to determine who made the attack, and for this reason they have listed Anonymous as the perpetrator. Regardless of its innocence, Anonymous will take the blame because it is not defined, and there is no way to prove it wasn't the group. How can we prove that it wasn't Anonymous if the entire point of the organization is to claim that it is everywhere? If one person "joins" Anonymous, then later, with several other people who have also "joined," commit a service disruption, is that the action of Anonymous or not? How many people does it take to form "Annonymous?" Since there are no statistics on the size of the group, one hundred people could make up 70% of the organization on Monday but only 10% on Tuesday.

As odd as it may sound, I think that most people in the tech community believe Anonymous when they say they aren't seeking credit card numbers. The group as a whole seems to pursue what they feel are moral crusades and stealing customer data doesn't seem to align with the past. However, it is hard to pinpoint a motive for the group, and there certainly be members who elect to pursue more damaging attacks than the rest of the organization. Regardless, Sony will most likely continue to blame the group as a whole. Since Anonymous wants to be anonymous, it can use the shield of anonymity to protect it, but it may also come back to harm them later as well.