Twitch Accounts Were (quite likely ) compromised

It seems Twitch account have been compromised (again ) as I got e-mail from:

"We are writing to let you know that there may have been unauthorized access to some of your Twitch user account information, including possibly your Twitch username and associated email address, your password (which was cryptographically protected), the last IP address you logged in from, and any of the following if you provided it to us: first and last name, phone number, address, and date of birth.

For your protection, we have expired your password and stream keys. In addition, if you had connected your account to Twitter or YouTube, we have terminated this connection.

You will be prompted to create a new password the next time you attempt to log into your Twitch account. If applicable, you will also need to re-connect your account to Twitter and YouTube, and re-authenticate through Facebook, once you change your password. We also recommend that you change your password at any other website where you use the same or a similar password.

We apologize for this inconvenience.

The Twitch Team"

and there is official blog entry on their page:
 http://blog.twitch.tv/2015/03/important-notice-about-your-twitch-account/

WHAT TO DO:

• As always, if you used twitch's password anywhere else  ... then you better change this password in all places where you used this password.
• If you struggle with remembering passwords , use tools like keypass to store your passwords (which can generate random and secure password too).
• How long should be password ? Well, these days it should be at least 13-15 characters.
• If you use complicated password and store them in keepass,then :
• For services that you use often create password easy to rembember but hard to guess password, what i mean ? Check this page to find clues how to make good and secure password http://preshing.com/20110811/xkcd-password-generator/
• For important services like bank and etc. You need created long complicated password (use keypass generator ) and NEVER EVER USE ONLINE PASSWORD GENERATOR!

Why 8 characters password is not strong enough ?
 Well, because it can be guessed in 2 days in worst case scenario by almost anybody who knows how to brutal force password.

HipChat and good result of suspicious activity ...

Around one week ago, it was a blog entry about Hip Chat on Atlassian Blog.

" Atlassian’s security team has discovered and blocked suspicious activity on the HipChat service that resulted in unauthorized access to names, usernames, email addresses, and encrypted passwords for a very small percentage (<2%) of our users. We have no evidence that any payment information was accessed. While HipChat passwords are one-way encrypted (hashed and salted), as an added precaution we have triggered a password reset for all affected HipChat user accounts and all Atlassian services that share the same email address"

It's good to see that password implementation have been done correctly. However,it is shocking for me that many companies has still a big problem with that.
You may think,that It is not an exciting reason to write post about it.
Yes, You are correct .
It something interesting  happen as result of this event. Atlassian folks changed priority for  'Support two-factor authentication' from  minor to Critical!

Check it, if you don't believe it. https://bitbucket.org/site/master/issue/5811/support-two-factor-authentication-bb-7016

I hope, Altassian will implement security features with high priority as part of their normal release to avoid potential problems rather than implement feature as result of suspicious activity.

It is very scary, that many companies still do not treat Security features as critical business value.  Security should be part of their normal development and operation process, not a reaction of 'shit happen'.

Source: https://blog.hipchat.com/2015/02/01/hipchat-security-notice-and-password-reset/

Alert! A serious Atlassian Confluence vulnerability discovered.

Atlassian made announcement but it wasn't that excited as Microsoft's HoloLens :(.

Their announcement was a bit scary as you can read from Atlassian's blog "Attackers can use this vulnerability to execute Java code of their choice on systems that use this framework". 
Good news is that attacker need to have an account in order to do it.
SOLUTION?
Install patch ASAP!

Affected products:
Bamboo  - all version up to 5.7
Confluence - all version up to   5.6.5,
FishEye - all version up to 3.6.1
Crucible - all version up to 3.6.1.

Note : Atlassian Cloud customers are not affected by any of these issues.

It has a critical priority and according to Atlassian website, it means:

"Vulnerabilities that score in the critical range usually have most of the following characteristics:

• Exploitation of the vulnerability results in root-level compromise of servers or infrastructure devices.
• The information required in order to exploit the vulnerability, such as example code, is widely available to attackers.
• Exploitation is usually straightforward, in the sense that the attacker does not need any special authentication credentials or knowledge about individual victims, and does not need to persuade a target user, for example via social engineering, into performing any special functions.

For critical vulnerabilities, is advised that you patch or upgrade as soon as possible, unless you have other mitigating measures in place. For example, if your installation is not accessible from the Internet, this may be a mitigating factor."(source: https://www.atlassian.com/security/security-severity-levels

More details:
 All useful information about bug itself, workaround and patches are available here:
https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+-+2015-01-21

Stay safe folks!

Ignore this e-mail as it is phishing !

Usually , I don't publish news or warning about new phishing attack as they are many of them but this one come to my Inbox and haven't been catch by anti-spam filter which is unusual for Gmail.

If you see message :

"Dear Gmail User,
Your two incoming messages were placed on standby due to the recent update of our database. In order to receive messages click to login and wait for the response from our server.

We apologize for any inconvenience this change may cause you and thank you for your understanding.

Sincerely,
Gmail."

Ignore it and remember:
- NEVER CLICK ON LINK in e-mails that you are not expect regards security ! 
- NEVER USE LOGIN DETAILS
- If you went to this page or even worse ... you use your login/password,then  change them now  !(if you use this password anywhere else ... change them too!


How to spot it phishing ? They are few rules and as I don't remember all of them ,so search on Google for them (or go here: http://www.techrepublic.com/blog/10-things/10-tips-for-spotting-a-phishing-email/ or here http://www.zonealarm.com/blog/2014/07/7-ways-to-spot-a-phishing-scam/,but ...

• Phishing e-mails almost use  starts from  "Dear valued/company name/" (they may use your first and last name if your e-mail is firstname.lastname@gmail.com )"
• Link/Domain/Page/Sender address is different from what is shown  (so if is from Gmail link,sender and etc. should be from/to gmail.com not anywhere else ). be CAREFUL. it is usually small one character difference for example Grnail instead of Gmail
• Poor grammar and weird vocabulary used gives you 99% that it is a phishing
• E-mail require action that you are not requested (for example ... password change). if you see that ,it may indicate that somebody trying access to your account..but check it using company website directly ... not link in e-mail
• Big companies ,banks do not ask you to verify your account (If they are screwed ,you will hear about it in the news,so follow instructions from them ,not from e-mail)
• Big Companies NEVER asks for update personal data!

 If anything looks suspicious ... just ignore email ... always or check online,but simply copy and paste message.If is phishing then should be plenty copy of this e-mail .


Stay safe folks

Heartbleed bug (What is it? What happen ? Where find useful resources? )

WARNING! I am not expert in field.

Table of content:

1. What is OpenSSL?
2. What happen?
3. Consequences 
4. Interesting links and resources about heartbleed bug(If you want know more:  )
5. My opinion

Everyday,we hear about new 'critical' bugs was found in project x,website y or OS Z.

Some of them are more or less scary.

Recently, folks from Google Security(Neel Mehta) found a  serious bug in OpenSSL, which exists for .. .2 years. Other folks Bodo Moeller and  Adam Langley created a fix for OpenSSL.

What is OpenSSL?

OpenSSL is a cryptographic software library. It is  an open-source implementation of the SSL and TLS protocols. these protocols are response for  communication security over the Internet. (from Wikipedia).

It is widely used library in software.

For example:

• Apache and Nginx servers (Nearly 70% website uses this software!)

• Heroku (Cloud Application Platform) 

• WordPress (a free and open source blogging tool and a content management system) 

• Multiple Cisco Products

• Android 4.1.1 (Jelly Bean)

What happen?
Let's starts from official information.

OpenSSL Security Advisory  states :"A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.". OpenSSL  1.0.1 until -1 .0.1f versions are affected by this vulnerability . (from  https://www.openssl.org/news/secadv_20140407.txt)

If you have no clue what does means (like me) ,then I may explain consequences of problem:

"This bug allows anyone on the Internet to obtain  private keys ,secrets (to  identify the service providers and to encrypt the traffic), the names and passwords of the users and the actual content. " from http://heartbleed.com

Oh dear.

Consequences 

Is shortcut ... 
Huston,we have a problem. a BIG ONE. 
It means somebody can stole your digital valuables .It means DISASTER.

Sounds scary? Well,because it is!
Good news:

• It is not end of the world.

Bad news:

•  It will cause lots of troubles soon,but it will be fine.
• First many pages will display certificates issues.
• Some software will have emergency releases.

If you want know more:

If you want learn more  about heartbleed  bug then :

• If you need all essential information about bug and what to do look here: 

• http://heartbleed.com

• Some technical information about bug(where is,how fix looks like and etc,) is :

• http://blog.existentialize.com/diagnosis-of-the-openssl-heartbleed-bug.html
• http://blog.cryptographyengineering.com/2014/04/attack-of-week-openssl-heartbleed.html

• To test are you affected  (for website owners or to check service where you store critical data),go here: 

• http://filippo.io/Heartbleed/
• Other
• https://xkcd.com/1353/  [comics strip from xkcd  ]
• https://xkcd.com/1354/  [comics strip from xkcd  ]

My opinion:
Bugs happen and they will happen.
I feel sorry for guy(Dr. Stephen Henson)  who introduce bug in this git commit (git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4817504 . (Git is cruel !)
Many people go wild with criticising OpenSSL team for that bug.

BUT ...

OpenSSL is open-source.
It means:

• It is everybody responsibility to take care about it.
• if you believe that something is needed (for example: security audit ),DO IT and share result with OpenSSL community (too expensive? Use  croudfunding solution instead).

• It must be better donated  (if you want donate openSSL folks https://www.openssl.org/support/donations.html )

So people,stop blaming and bitching about it.It is useless and you waste your time.Use these time to improve OpenSSL instead. 

Another question is about  secure programming in C. Many people said that these days ,  secure programming in C is almost mission impossible and it should be rewritten  BUT ... atm. YOU must live with fact that OpenSSL is written in C.

Sources:

• http://heartbleed.com
• http://news.ycombinator.com
• http://niebezpiecznik.pl
• https://www.openssl.org
• https://www.openssl.org/news/secadv_20140407.txt
• http://blog.existentialize.com/diagnosis-of-the-openssl-heartbleed-bug.html
• http://blog.cryptographyengineering.com/2014/04/attack-of-week-openssl-heartbleed.html

Prism in Android

Recently PRISM was  very famous in media.

This is ,what i saw in Android log recently :

"ERROR/Prism.WidgetManager(896): The same lists. No need to update. skip it."

:)

Personal Security: How to detect Scam emails.

I start from
If you have any suspicion about content in  e-mail,then DO NOT TRUST.
 NEVER EVER click on any link in email  and do NOT type any card details.

WARNING!

In case if you look on this blog,because you accidentally click on link and gave any details.

DO NOT READ MORE.

CALL YOUR BANK STOLEN CARD HELPLINE ....and block your card.NOW!

THEN. .. continue read.

TO DO LIST ,WHEN EMAIL LOOKS SUSPICIOUS IN ANY WAY:

1. Check who sent you email  (however ,it is quite easy to cheat ).
2. To figure out ,where link will go you can move cursor over link and see (usually in web browser on bottom .If you can easily spot difference between normal bank url and dodgy one.
3. NEVER EVER click on any link in email  and do NOT type any card details.
4. Is e-mail looks different (even tiny detail like weird grammar ,few typo different skin for email) ,then thread this as potential scam.
5. Is it any news in media about issue with your  Bank ?  In case,if you see news about  security problem with your bank,then wait until  they said that's sorted and follow advices.Always use known url.Do not use links from emails!
6. No news? Check on website anti-scam website that provide Scam alert service like: http://www.ingraftedsoftware.com/aggregator/sources/3 and etc. 
7. Copy message and paste to search engine  like  Bing/Google to figure out is message was reported as scam? 
8. Still has doubt... call to bank's infoline or .. go to bank directly.

TIPS:

1. Use email that for critical purposes only, (Email with banks, backup email for recovery from main email, BUT NOT FOR ANYTHING ELSE). (do not use any names that are relalted to you in any way.
2. Keep copy of emails from your bank,so you can easly spot difference in case ,if you have any doubt.

Example of  recent scam e-mails from "banks".

" Dear Valued Customer,

Your Nationwide account needs an important verification

for security purpose, please kindly click here now to verify

your account for a faster easier and more efficient banking experience

Thanks

 Nationwide Building Society " 

or

" Starting from September 25 2013, 

Lloyds bank introduces new authentication

procedures in order to better protect private information of our account holders.

Please note that accounts that are not reviewed within 48 hrs are subject to termination.

To avoid service interruption click here to avoid services interruption

Thank You.

Lloyds Banking Group."

or

"Our record shows that you have a refund slated on your card account

due to charges made against your card account by us.

We do apologies for this mistake which was caused by errors from our system.

This transaction cannot be completed due to the errors present in your account information.

You are required to click on the LOGON below to fix this problem immediately.

Please note, it will take 3 working days to credit your account with the refund.

LOG ON HERE (<dogdy link)

Thanks

NatWest Card Services" 

or

"Dear Valued Customer,

We have encountered a generic error on our database server which compromised

some of our customers account due to the circumstance of the error.

We implore you to make sure your account was not compromised due to this error.

Kindly verify your information for safety purpose

Click Here to verify now

We are sorry for any inconvenience this may have caused. 

Yours Sincerely,

 Barclays Bank Plc. "

Stay safe! 

Useful link:How to add a security log level in log4j

I always think about how to log a ... security events.
During reading various stuff about security i found  a perfect solution for my needs.

 Solution is to add a new level to log4j.

On OWASP page you can  finds a interesting article about adding security log level to log4j.

I have only one concern about where put security in level set.
I believe it should be between ERROR and WARN ,where in OWASP's example is between WARN and INFO.

Probably there are right,but i will stick to my decision.I don't have any wise sound-like reason why it should be there .(for me security level shoud be a more important than just warning,but security is not a error).


Article was written by Arshan Dabirsiaghi on owasp website
Link can be found below:
https://www.owasp.org/index.php/How_to_add_a_security_log_level_in_log4j
based on example from:
http://jaikiran.wordpress.com/2006/07/12/create-your-own-logging-level-in-log4j/

I will add this level to level set in my micro project where I will practice skills (scala, play framework 2.x) .

Security tips: Delete Tomcat examples folder

According to this blog entry : Tomcat Servlet Examples threats on ONsec , where they recommend:

"We strongly recommend to disable public access to /examples directory again."

Reasons:

• Bypassing HttpOnly Cookies protection
• CSRF cookies manipulation
• Session manipulation

How to check is my Java exploitable?

Are you fancy to know,  is your version of Java is exploitable,go to this link:
http://www.isjavaexploitable.com/

(Don't panic link is safe to use)


It should help you to understand why saying : "I have a virus on my computer ,but i haven't done anything."
Really?
Believe me. 0days holes are danger.(in OS, Java, web browser etc.)


Source: http://niebezpiecznik.pl

Definition: XSS

Note: It is for private use only really.If you interesting in good explanation, use link provided on end of this note.

XSS is an abbreviation of cross-site scripting and it  a security exploit that allows crackers to interfere with your program’s logic by inserting their own logic and cause  causing a user's Web browser to execute a malicious script. Common exploitations can be used  for example in  form or search engine boxes.

Definition used  words from following sources:
http://oreilly.com/ruby/excerpts/ruby-learning-rails/ruby-glossary.html
http://www.pcmag.com/encyclopedia_term/0,1233,t=XSS&i=57401,00.asp
http://en.wikipedia.org/wiki/Cross-site_scripting
http://www.testingsecurity.com/how-to-test/injection-vulnerabilities/XSS-Injection <read this article!