Tor, BitCoin, Bank Fraud, Outlook.com, DynamoDB, S3, GAE, Cloud Storage, Mobile POS, LFTP

Post date: Dec 11, 2012 5:19:26 PM

• Botnet called Skynet uses Tor network for Command & Control networking. This is hardly any news. I have been thinking for a long time for encrypted distributed chat program, which would use relays and DHT storage for delivering messages, in pseudo random style. Making it impossible to know who is communicating with who and how much and when they're communicating. As well as we well know that Tor is low latency network, which makes statistical attacks easy if attacker can monitor the network. It's just like following the bulge on pipe in cartoons. Better network delay messages and send out fake messages & traffic on purpose, making following the bulge much harder. Because A came in, and B went out to another node. A is forwarded to C after quite a while, when D was received. So who can now tell that the message went from A to C instead of going to C? Sending fake traffic out when receiving data also might make you to seem to be an relay and not final destiation of the traffic. Because when you receive A you send B out. But now this B was bogus packet, sent out just to confuse attackers. It's the very old movie trick to swap briefcases. ;) Three men go in to one room and come out all with similar briefcases. Even harder, if this happens repeatedly and stuff can be stored in the swapping point which we can't monitor. Also see: Traffic Analysis
• Checked out multiple BitCoin payment integration service provider APIs and services and this guide how to accept bitcoins without fees. One friend said that the problem with bitcoins is that we're going to run out of them. Well, I immediately thought about derivates. There can be absolutely huge market on something that is very scarce, if just derivates are being used. Although this could make market dangerously easy to manipulate. Like Finnish Markka and Swedish Krona have been seriously manipulated in history (as well as many other small currencies in history). Considering things in this scale, bitcoins are absoutely invisibly small nano currency. Check out: ICBIT Bitcoin Derivatives Market and Exchange It's also interesting to see that Virtual cash exchange is now officially a bank. A guide how to accept bitcoins without any fees.
• Checked Eurograbber white paper (PDF) in detail. Well, this is nothing new. Everyone knew this is going to happen, sooner or later. Two-Factor (Two or Multi Step) authentication simply isn't enough, because mobile phones are also hackable. "two-factor authentication mechanism used by the banks to ensure the security of online banking transactions was circumvented".
• Added: NodeBeginner (Node.JS beginner guide to Kindle)
• "Outlook.com makes it easy for you to recover your deleted messages even if you have permanently emptied your Trash bin." - Really great! So even "permanently deleted" data/messages aren't being actually deleleted. I really don't know if this is good thing at all.
• Domain Name System (DNS) servers hacked, allowing hijacking of national TLDs. Yet another reason why you never should trust that the site you think you're connecting is what you really want to connect. Really great for drive by downloads and stuff like that. Not to even talk about more sophisticated attacks which this enables. Never trust counter party, never send passwords even over SSL/TLS connections, always confrim that the remote end is what it is supposed to be. And so on. This is why protocols shouldn't ever use any passwords or shared keys in plaintext, even when using encrypting layer. Domains affected this far are .ro, .rs, .ir, .pk.
• Even more great Coursera courses: Grow to Greatness, Financial Planning, Computational Investing, etc.
• Used Kroll Ontrack Easyrecovery Professional to restore some data which got lost due NTFS corruption (might be hardware induced). I also noticed that for some strange reason it wont show full file system tree with ext4 disks, only root entries. Maybe it isn't working too well with ext4?
• Google App Engines Datastore (database) now got version information for all entity groups. This is nice update. Before this I actually had to read record, do my stuff, and then then in transaction to reread compare and write the record. With this version field, it gets simpler. I can just check if the version number is same, I don't need to verify every field separately. For Java:check out public static final java.lang.String VERSION_RESERVED_PROPERTY and for Python check out: get_entity_group_version() which gets a version number for an entity group; this is useful for finding out if any entity in the group has changed since the last time you got the version number.
• Studied Amazon AWS DynamoDB and Simple Storage Service (S3) documentation.
• Listened SecurityNow #380 show covering: Datagram Transport Layer Security (DTLS). Btw. Wikipedia article about DTLS is is quite tiny, someone could fix that.
• Updated (public) PyClockPro project documentation, I'm pretty sure I'll release source soon. There are still a few minor things I want to fine tune before releasing. I'll do it when I got just the right mood.
• Quickly studied basics of Mobile Device Management.
• Laught a bit: Duh, it seems that they don't know how to write proper HTML at Google? ;) So much fail: "<dt><span class="argname">acl</span>=<span class="argdefault">none</span> span style="text-transform: uppercase; font-size: 8pt">(Optional)</span></dt>". Maybe nobody at Google is reading their documentation? - I assume they fix the page at some point, so it's hard to get this, but currently it seems that they got classical <tag> fail issue. ;)
• Studied Google Cloud Storage API, because I haven't used it this far. It seems pretty much to be like file system instead of blob store, even with file like interface. I just assume that blob store is faster to use, but I really don't know because I haven't tested it. Basically it's quite same if I get blob #8129192128 or file from Cloud Storage with id #8129192128, doesn't make a big difference to programmer. One thing I did wonder thought, was that 'a' is "write", it's not "append". So I assume it overwrites the file, it wasn't instantly clear from documentation if it overwrites the file instead of appending. I still got an impression that it will overwrite the file in storage.
• Studied Python 3.4 weakref feature. (I know, this is not a new feature) Currently I really don't know what I would use it for, but in some cases when caching data it might be useful. I have huge backlog of garbage collector and memory management related stuff to post. I hope I'll find time to write about that too.
• Read excellent article, New things coming to JavaScript. Especially interesting part is ECMAScript 6 (ES6).
• Quickly glanced at these interesting services: TXT4Coffee, Synqera, Mobuyle Payments, NoQ, Paylevel, PayAnywehere
• Finally: I really don't know why Duplicati/LFTP is so slow when using FTPS connections. It simply seems to max out at 140KB/s level, without any reasonable reason. I have even confirmed that my config files allow 100MBytes/s of traffic to both directions simultaneously. But alas, LFTP is still maxing out at 140KB/s even if there is over 1MBytes/s of free bandwidth on both ends of this connection. After checking netstat and monitoring network traffic, it simply does look like that Duplicati/LFTP is NOT sending data with proper data rate, because there is no Send-Q on socket level. Duh. Any hints? Mail me.
• I would have so much more to post, but this is it this week. (Except if I tomorrow have enough time to finish one post which I have been preparing for quite a while.)