<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Elliott C. Back &#187; Security</title>
	<atom:link href="http://elliottback.com/wp/category/computers-technology/web-20/security/feed/" rel="self" type="application/rss+xml" />
	<link>http://elliottback.com/wp</link>
	<description>Internet &#38; Technology</description>
	<lastBuildDate>Tue, 03 Nov 2009 23:59:21 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.4</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>New GMail Security Feature</title>
		<link>http://elliottback.com/wp/new-gmail-security-feature/</link>
		<comments>http://elliottback.com/wp/new-gmail-security-feature/#comments</comments>
		<pubDate>Sat, 31 Oct 2009 03:48:33 +0000</pubDate>
		<dc:creator>Elliott Back</dc:creator>
				<category><![CDATA[Google]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://elliottback.com/wp/?p=3256</guid>
		<description><![CDATA[I was using my GMail today and was surprised to see a little link that read &#8220;Last account activity: 1 minute ago at this IP (74.101.6.15).  Details.&#8221;  If you click on Details, it brings up a popup with the latest activity on your account&#8211;who accessed your email last, and from where:

Activity on this [...]]]></description>
			<content:encoded><![CDATA[<p>I was using my GMail today and was surprised to see a little link that read &#8220;Last account activity: 1 minute ago at this IP (74.101.6.15).  Details.&#8221;  If you click on Details, it brings up a popup with the latest activity on your account&#8211;who accessed your email last, and from where:</p>
<p><a href="http://elliottback.com/wp/wp-content/uploads/2009/10/google-new-security.png"><img src="http://elliottback.com/wp/wp-content/uploads/2009/10/google-new-security-449x432.png" alt="google new security" title="google new security" width="449" height="432" class="alignnone size-thumbnail wp-image-3257" /></a></p>
<blockquote><p>Activity on this account: This feature provides information about the last activity on this mail account and any concurrent activity. </p></blockquote>
<p>GMail now tells you with timestamps (a) what kind of thing (browser, IMAP client, etc) accessed your email (b) when it happened, and (c) what the IP address was.  The only thing lacking is a log of what content precisely was downloaded.  So finally Google has solved the &#8220;is my significant other spying on me&#8221; or &#8220;do my parents secretly read my email&#8221; questions.</p>
]]></content:encoded>
			<wfw:commentRss>http://elliottback.com/wp/new-gmail-security-feature/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>MySpace Hacked Phishing Error Message</title>
		<link>http://elliottback.com/wp/myspace-hacked-phishing-error-message/</link>
		<comments>http://elliottback.com/wp/myspace-hacked-phishing-error-message/#comments</comments>
		<pubDate>Fri, 26 Sep 2008 00:10:44 +0000</pubDate>
		<dc:creator>Elliott Back</dc:creator>
				<category><![CDATA[Crime]]></category>
		<category><![CDATA[Errors]]></category>
		<category><![CDATA[Hacking]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Spam]]></category>

		<guid isPermaLink="false">http://elliottback.com/wp/archives/2008/09/25/myspace-hacked-phishing-error-message/</guid>
		<description><![CDATA[I was somewhat scared when I noticed this list of usernames / passwords for MySpace.  Yeah, someone actually managed to hack my MySpace account, which is more incredible given that I don&#8217;t ever log into it:
Myspace hacked accounts 3/20/08
Here a list of myspace accounts and passwords
Example:
Username : Passwords get it  

MySpace is pretty [...]]]></description>
			<content:encoded><![CDATA[<p>I was somewhat scared when I noticed <a href="http://gabbytay2000.blogspot.com/2008/03/simple-my-space-hacking.html" rel="nofollow">this list of usernames / passwords for MySpace</a>.  Yeah, someone actually managed to hack my MySpace account, which is more incredible given that I don&#8217;t ever log into it:</p>
<blockquote><p>Myspace hacked accounts 3/20/08<br />
Here a list of myspace accounts and passwords</p>
<p>Example:<br />
Username : Passwords get it <img src='http://elliottback.com/wp/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' /> </p></blockquote>
<p><img id="image2753" src="http://elliottback.com/wp/wp-content/uploads/2008/09/myspace-hacked-password.png" alt="myspace-hacked-password.png" /></p>
<p>MySpace is pretty advanced in this regard; somehow they detected that my account had been compromised and when I logged in now to change the password, I received this neat message warning me:</p>
<p><img id="image2755" src="http://elliottback.com/wp/wp-content/uploads/2008/09/myspace-phishing-warning.png" alt="myspace-phishing-warning.png" /></p>
<blockquote><p>MySpace Announcement:  <strong>Your account has been phished!</strong></p>
<p><strong>What can I do?</strong><br />
Change your password. And don&#8217;t use your current password ever again.  Why do I care?  We&#8217;ve blocked your account until you change your password. This means you can&#8217;t send a message, post a bulletin, send a comment or add a friend until you&#8217;ve changed your password.</p>
<p><strong>What does &#8220;phished&#8221; mean?</strong><br />
&#8220;Phished&#8221; means that someone stole the email address &#038; password that you use to login to MySpace. They might be sending out messages, comments or bulletins as you!</p>
<p><strong>How did this happen?</strong><br />
You went to a fake page that asked for your MySpace login email and password, and you gave them your info. Only login to <a href="http://www.myspace.com" title="http://www.myspace.com" target="_blank">www.myspace.com</a>. Learn more</p></blockquote>
<p>I&#8217;ve changed all my users and passwords now, but still it&#8217;s a tiring experience&#8230;</p>
]]></content:encoded>
			<wfw:commentRss>http://elliottback.com/wp/myspace-hacked-phishing-error-message/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Craigslist Thieves Caught</title>
		<link>http://elliottback.com/wp/craigslist-thieves-caught/</link>
		<comments>http://elliottback.com/wp/craigslist-thieves-caught/#comments</comments>
		<pubDate>Wed, 02 Apr 2008 04:24:19 +0000</pubDate>
		<dc:creator>Elliott Back</dc:creator>
				<category><![CDATA[Crime]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://elliottback.com/wp/archives/2008/04/01/craigslist-thieves-caught/</guid>
		<description><![CDATA[The two who posted a Craiglist ad saying that anyone could take what they wanted from a home in Oregon have been tracked down and arrested by following their IP address.  The stunt was a diversion to steal two horses.

It&#8217;s nice to see that internet crime doesn&#8217;t pay.  Unfortunately, it&#8217;s also troubling to [...]]]></description>
			<content:encoded><![CDATA[<p>The two who posted a Craiglist ad saying that anyone could take what they wanted from a home in Oregon have been tracked down and arrested by following their IP address.  The stunt was a diversion to steal two horses.</p>
<p><img id="image2599" src="http://elliottback.com/wp/wp-content/uploads/2008/04/craiglist-thieves.jpg" alt="craiglist-thieves.jpg" /></p>
<p>It&#8217;s nice to see that internet crime doesn&#8217;t pay.  Unfortunately, it&#8217;s also troubling to read this article and realize that had this couple simply used an anonymizing service, a proxy chain, an internet cafe, or a TOR node, there would have been no way to catch them from what they posted on Craigslist.</p>
]]></content:encoded>
			<wfw:commentRss>http://elliottback.com/wp/craigslist-thieves-caught/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>This is not a Bomb, Boston</title>
		<link>http://elliottback.com/wp/this-is-not-a-bomb-boston/</link>
		<comments>http://elliottback.com/wp/this-is-not-a-bomb-boston/#comments</comments>
		<pubDate>Sun, 23 Sep 2007 01:10:22 +0000</pubDate>
		<dc:creator>Elliott Back</dc:creator>
				<category><![CDATA[Airplane]]></category>
		<category><![CDATA[Law]]></category>
		<category><![CDATA[Military]]></category>
		<category><![CDATA[Scandal]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://elliottback.com/wp/archives/2007/09/22/this-is-not-a-bomb-boston/</guid>
		<description><![CDATA[Reading about the poor MIT student who was recently arrested at submachine gunpoint on BoingBoing I saw a few comments that interested me enough to write a brief rebuttal.  For example, comment #63 by Jacob Davis:
On another note, to everyone saying, &#8220;It&#8217;s obviously not a bomb, they should have known better!&#8221; : that&#8217;s really [...]]]></description>
			<content:encoded><![CDATA[<p>Reading about the <a href="http://www.boingboing.net/2007/09/21/mit-student-arrested.html">poor MIT student</a> who was recently arrested at submachine gunpoint on BoingBoing I saw a few comments that interested me enough to write a brief rebuttal.  For example, comment #63 by Jacob Davis:</p>
<blockquote><p>On another note, to everyone saying, &#8220;It&#8217;s obviously not a bomb, they should have known better!&#8221; : that&#8217;s really condescending. My mother doesn&#8217;t know what a breadboard is. My neighbors don&#8217;t. Several of my friends don&#8217;t. I&#8217;d wager the great majority of the US doesn&#8217;t know, for better or worse. Don&#8217;t pretend that everyone else knows what you know, especially when you are judging circumstances after being given all the facts at once in hindsight.</p></blockquote>
<p>See the problem is that security personnel, if expected to guard against bombs and bombers, should be able to positively recognize bombs.  Your mother and neighbors are not airport security officers, military police, or Boston police for exactly that reason; they don&#8217;t know what bombs look like.</p>
<p>Then there are comments #7 and #8, which feel like the police brutality (they arrested her outside the airport with force) is justified:</p>
<blockquote><p>Wow, she sure put the &#8220;mor[on]&#8221; in sophomore! Maybe for her next art project she can run around the airport screaming &#8220;I&#8217;m Al Qaida! Look at me! I&#8217;m Al Qaida!&#8221;</p></blockquote>
<p>I&#8217;d have wished the above moron had written &#8220;more[on] in sophomore;&#8221; it would have bee more funny.  That said, there&#8217;s nothing wrong with a geeky girl wearing a hoodie with some blinking LEDs.  As far as I know (and I think the statistics support me here) no one has ever died or been injured, directly or indirectly, by an LED.  And, I fully support her right to voice her political opinions, even in the airport.  Unfortunate the climate these days means wearing <a href="https://marketspace.goodstorm.com/item/http_marketspace_goodstorm_com_stores_nijma/we_will_not_be_silent_arabic_english_0">we will not be silent arabic / english t-shirts</a> will probably get you detained.</p>
<blockquote><p>I thought MIT students were supposed to be a bit more intelligent than the rest of us. Walking into an airport with an electronic device strapped to her chest &#8230;.. a very stupid action. She is lucky to just be in a cell, but I have a feeling a lot of people (including her) will never understand why, this time, the Boston Police are in the right.</p></blockquote>
<p>This one is begging for me point out that 99.99998% of people walk around airports with iPods tucked around their chest or body somewhere&#8230; and I&#8217;m not even going to start counting people with pacemakers, who actually have an <em>electronic device</em> <strong>embedded</strong> in their chests!  An electronic device isn&#8217;t a bomb, and if you <a href="http://www.schneier.com/blog/archives/2007/07/conversation_wi_4.html">think airport security</a> can prevent terrorism, you&#8217;re wrong.</p>
<p>Finally, on a lighter note, Rob Cockerham&#8217;s comment #27 takes the cake, and eats it too:</p>
<blockquote><p>I can&#8217;t believe NBC is promoting Bionic Woman like this. What a terrible idea.</p></blockquote>
]]></content:encoded>
			<wfw:commentRss>http://elliottback.com/wp/this-is-not-a-bomb-boston/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Easy Database Backup with Amazon S3</title>
		<link>http://elliottback.com/wp/easy-database-backup-with-amazon-s3/</link>
		<comments>http://elliottback.com/wp/easy-database-backup-with-amazon-s3/#comments</comments>
		<pubDate>Sun, 05 Aug 2007 19:04:40 +0000</pubDate>
		<dc:creator>Elliott Back</dc:creator>
				<category><![CDATA[Code]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Wordpress]]></category>

		<guid isPermaLink="false">http://elliottback.com/wp/archives/2007/08/05/easy-database-backup-with-amazon-s3/</guid>
		<description><![CDATA[Taking Paul&#8217;s great article How To: Bulletproof Server Backups with Amazon S3 a step farther here&#8217;s an easy way to automate your Wordpress database backups.  First, follow all the steps to get ruby and the s3sync client installed.  Once that is setup, create a text file somewhere with the databases you&#8217;re interested in. [...]]]></description>
			<content:encoded><![CDATA[<p>Taking Paul&#8217;s great article <a href="http://paulstamatiou.com/2007/07/29/how-to-bulletproof-server-backups-with-amazon-s3/">How To: Bulletproof Server Backups with Amazon S3</a> a step farther here&#8217;s an easy way to automate your Wordpress database backups.  First, follow all the steps to get ruby and the s3sync client installed.  Once that is setup, create a text file somewhere with the databases you&#8217;re interested in.  I called mine <strong>s3backup-db.txt</strong>:</p>
<pre class="brush:bash">
[root s3sync]# cat s3backup-db.txt
db-one
db-one-user
db-one-pass
db-two
db-two-user
db-two-pass
</pre>
<p>Then you&#8217;ll need to make a folder for your backups, which I put in <strong>/home/s3backup/</strong>.  The shell script that does the backups is as follows:</p>
<pre class="brush:bash">
#!/bin/bash

BUCKET=your-bucket-here
BACKUP=/home/s3backup/
ROOT=/root/s3sync/
NOW=$(date +%m%d%y)

if [ $(($# % 3)) -ne 0 ]
then
	echo "Wrong number of arguments!!"
	exit
fi

i=0
while [ $# -gt 0 ]
do
	DBNAME=$1; shift
	DBUSER=$1; shift
	DBPWD=$1; shift

	echo "Backing up MySQL db '$DBNAME' with '$DBUSER:$DBPWD'"
	nice mysqldump -u $DBUSER -p$DBPWD -C -q $DBNAME | gzip -9 > $BACKUP$DBNAME.$NOW.sql.gz

	cd $BACKUP
	tar -r -f backup.$NOW.tar $DBNAME.$NOW.sql.gz
	rm -f $DBNAME.$NOW.sql.gz
	cd $ROOT

	i=$(( $i + 3 ))
done

nice ruby ${ROOT}s3sync.rb -r --ssl --progress ${BACKUP} $BUCKET:
rm -f ${BACKUP}backup.$NOW.tar
</pre>
<p>This will dump a file called <strong>backup.040506.tar</strong> in the Amazon bucket you picked earlier containing the full database backups of the arguments you specified.  You can run the script like this, and it will produce a little bit nicer output than Paul&#8217;s bare-bones backup:</p>
<pre class="brush:bash">
[root s3sync]# cat s3backup-db.txt | xargs /root/s3sync/s3backup-db.sh
Backing up MySQL db '*****' with '****:****'
Backing up MySQL db '*****' with '****:****'
Update node backup.080507.tar
</pre>
<p>The next step is just to set it up with cron to run every night at midnight:</p>
<pre class="brush:bash">
[root s3sync]# crontab -e
crontab: installing new crontab
[root s3sync]# crontab -l
0       0       *       *       *       cat /root/s3sync/s3backup-db.txt | xargs /root/s3sync/s3backup-db.sh
</pre>
<p>If you want an easier way to backup all your databases than specifying some of them, just use your MySQL administrative password and username with mysqldump&#8217;s &#8211;all-databases parameter.  However, on my host there are things like Plesk databases I&#8217;m not particularily interested in backing up, so this works better for me.  Just make sure you make <strong>s3backup-db.txt</strong> u=rw so that no one but root can see those passwords:</p>
<pre class="brush:bash">
-rw------- 1 root root   148 Aug  5 13:40 s3backup-db.txt
</pre>
]]></content:encoded>
			<wfw:commentRss>http://elliottback.com/wp/easy-database-backup-with-amazon-s3/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
	</channel>
</rss>
