Christopher Boyd: May 2008 Archives

Clock Watching

| | Comments (0)
3clock.jpg

I spend a lot of time looking at the above (there should be a Bangalore clock there too, but it fell off. Whoops). Sitting smack bang in the middle of all the various teams (sort of), I have to juggle a lot of tasks, sites, actions and all sorts of other wonderful things as the timezones shift and day passes to night for each respective area.

As I work remotely, this means a lot of action on Skype and an absolute pile of tabs open on the various machines I have here. I've never particularly liked RSS readers - mainly because I can never seem to get them to work - which means an endless amount of website opening, refreshing, you name it, I've done it (and am probably still doing it).

However.

Cynical as I am about most applications that claim to help shave some time off all your daily activities, I have indeed found something so stupendously useful that it defies description. Interestingly, I only even came to use it because I realised lots of my Feedburner subscribers started to drop like flies. Upon further investigation, I realised there was something out there called Netvibes that was undergoing an upgrade, hence all the lost subscribers. Seeing as I had quite a lot of them from this one particular source, I decided to go check it out and I'm extremely glad I did.

Of course, it's all a bit Web 2.0-ish. You can put in a humorous title (or non-humorous, if you like) at the top, even though you're the only person that can see it. I settled for this:

defender1.jpg

Click To Enlarge

"Paperghost, Defender of the Interwebs". Well, it has a nice ring to it I think. As you can see (and I apologise to anyone in advance that Netvibes is old news to), it's effectively a bunch of custom made tabs on a set of webpages you can keep on changing to your hearts desire.

Right there on the frontpage, I have a whole bunch of things that are useful to my job. English and US calendars that indicate when people have national holidays coming up? You bet. As a lot of my work depends upon being able to interact with the researchers in West Virginia, it's faintly counterproductive when I've spent most of the morning working on something passed to me from the guys in Bangalore (with the intention of passing it off, Baton style, to the team in WV) only to find that they'll actually all be off celebrating some National holiday somewhere.

I have written them out on paper (only to watch the dog eat them, which is kind of similar to what happened to my homework), I have found an endless stream of holiday websites, only to lose them / watch them get hacked / get pulled by a bored webmaster / insert disaster of choice here. This? This is fantastic. It updates automatically and I don't have to do anything.

Moving on, currency converters are useful because of the travel-from-place-to-place (and try not to die) nature of the job. Yes, I can just go here. But the problem was that I was going there, every five minutes. As we spend a lot of time attempting to analyse money trails and seeing exactly what the financial worth of certain online scams is, the only way to go is have a currency converter up somewhere. Now, I have both this tool and a whole bunch of other useful security / network applications all on one page.

This is, as you might have expected, awesome.

The Security page I've created is equally as fantastic:

defender2.jpg

Click to Enlarge

Not only is it about the first RSS reader I've used that doesn't break every ten seconds (or has a horrendously clunky interface), I can see at a glance how frequently everybody else is posting and make some key strategic decisions about what to publish and when, if someone else has beaten you to the finish line with regards a post about a new infection (with the appropriate editing then administered to the blog entry in question) and all sorts of other mysterious and arcane decisions that relate to the Witchcraft that is blog publishing.

Comics? Well, as someone who frequently dips into the comics landscape (how many security writers do you know who get syndicated on Journalista / TCJ?) I can tell you that a lot of interesting security-skimming posts appear on comic websites, especially by the comic writers and creators who often have sites of their own. It's in their best interest to keep up to date with hacks,. SEO and all sorts of other things. Hence, this:

defender3.jpg


...resulted in this blog post. Nothing long or particularly dazzling for my part - I'm simply linking to someone else and saying, "this is interesting". But it's security, and it's comics, and I don't think a lot of security-hungry readers would have seen that first hand example of SEO black hat action so that's great. I hadn't actually been reading the blog in question for a while, so I probably wouldn't have even known about it only for seeing the title pop up on Netvibes.

Finally, my "Two Point Whatever" page is extremely useful:

defender4.jpg

Click to Enlarge

After I publish something I think warrants further attention, I start promoting it on many social networking sites. I have an established presence on Myspace, Twitter, Flickr, Digg and a bunch of other places. Using this single page, I can roll out bloglinks, promote articles, keep in touch with my (many) contacts across the various portals and a lot of other things besides. In many ways, this is the most useful page of all.

So there we have it. When I signed up to Netvibes, I remember seeing a promise saying something like "This site WILL save you time". You know what, it's true. It has. Anyway, you shouldn't be reading a long blog entry like this - you have work to do....



Up Close and Personal

| | Comments (2)
Security in recent years is taking on a much more up close and personal style of gunplay than ever before. In our thirst for wanting to see the story behind the story, we are no longer content with a page of HTML telling us what the file is called, what it does and how many hundred registry keys it adds. The steady influx of blogs into the security landscape has allowed spyware hunters and researchers to try new avenues of exploration with regards shutting down the bad guys, instead of simply throwing in a few definitions into a database somewhere.

Frustrated by lack of progress from Governments, law enforcement and civil liberty groups, the gloves are off and people demand justice. From the security researcher to the spare-time blogger, most have discovered that ruthless public exposure and a name-and-shame attitude are two of the most effective tools available when looking to take a bad guy down. The laws, resources and penalties available to hit them with in most cases are severely lacking, and a sizeable portion of miscreants simply don't care about getting into trouble with law enforcement, because they know it's highly likely never going to happen.

However.

This approach can create numerous risks - to the researcher, their websites, the companies....anything and everyone can become a target. At that point, it comes down to a battle of wills - how confident is the researcher that they can expose and shut down the bad actor? If they wobble, even just a little, is retaliation on the cards?

Traditional wisdom dictates that you should never be visible when shutting down a Phish, Botnet, hacking forum or other shady operation. You don't want to become the victim of a DDoS attack needlessly, right? The problem with this approach, is that the bad guy never realises he is being hunted. They just put it down to their host wising up to their activities, chalk it down to experience and move on, setting up shop again in hours, not days.

This solves nothing. Nor does the idea that "If I lay low while doing this, they won't attack me". Plenty of security sites and companies get hit with DDoS attacks and infection files that target their programs and websites quite randomly and arbitrarily. If someone is going to whack you, they'll do it anyway. So why not get there first? To me, the proactive and aggressive approach is the only one that works. Everything else is a poorly applied bandage just waiting to be torn off.

With this in mind - and as blogs spill into more and more corporate environments (how many security companies now have a blog? It's probably easier to list the ones that don't) - it's interesting to observe how previously "neutral" companies (in terms of not making a big, direct public stink about someone or something) now have to adapt to tackling the bad guys on a personal level, through the medium of their blogs. I'm lucky - I've always done things in this manner so there is no need to update my approach and change my writing style. Recently though, I saw one security blog (which shall remain nameless) write about a problem with a website and they seemingly refused to actually name the site in question, even though the issue was something as basic as spam pages.

This troubles me. Every blog post carries a risk. The more upfront, the more forthright, the more critical of whatever it happens to be talking about, the greater the chance that someone, somewhere, is going to be annoyed. But do we really need to be so twitchy about what we post that we won't even do something as basic as name the site in question where this spam is taking place? Isn't that actually putting the very users of that site at risk through not telling them that there's an issue there?

Clearly, this was a blog where the corporate line is weighing down on the specifics of what can and can't be posted - and that's fine. Not everyone is going to take risks and put themselves in the firing line for the sake of some random blog post somewhere. Perhaps they have other means and methods of communication better served than their blog to get the word out. Ultimately though, it does make me wonder what use the blog is if hampered by red tape, overly zealous self-censorship and (in some cases) not even the ability for readers to leave comments and interact with the writer.

You find yourself asking, well, what's the point of writing about an issue but not actually addressing it?

As the number of security blogs continues to grow - and more and more people realise the stakes keep being raised with regards naming and shaming of the bad guys, I'm looking forward to seeing how the blogs at the more corporate end of the scale adapt and survive. Do companies actually want bad guys turning up on their sites and threatening them? Emails containing death threats (I think I'm up to three now)? Denial of service attacks hovering over their heads? How far do they want to push their blog to both expand readership and develop new ways of taking down hackers, with the trade-off being that they then open themselves up to an endless series of inventive (and probably not very pleasant) attacks? Is it worth it? Should they just forget the whole blog thing right now and walk away, not wanting the trouble?

There is the risk that the looser, more Indie blogs will just keep cranking up the level of expectation with regards the content posted, while the blogs necessarily straitjacketed from being too wild or zany revert to a list of a hundred or so registry keys or (worse) fold altogether because nobody reads them anymore. I personally think there's room for both, but I also think that if you have a security blog - corporate or otherwise - you have a duty to tackle any and all issues head on, whether it be spilling the beans on something that needs fixing, hackers that need whacking and end-users that need protecting.

Dancing around the fire solves nothing. Plunging in head first, however, tends to get results - as long as you don't mind a few scorch marks...

FaceForward Authors

Kailash Ambwani
President and CEO
Brian Babin
Director of Product Management
Christopher Boyd
Sr. Director of Malware Research
Frank Cabri
Vice President of Marketing and Product Management
Eric Young
Director of Field Engineering Services

June 2008

Sun Mon Tue Wed Thu Fri Sat
1 2 3 4 5 6 7
8 9 10 11 12 13 14
15 16 17 18 19 20 21
22 23 24 25 26 27 28
29 30          

About this Archive

This page is a archive of recent entries written by Christopher Boyd in May 2008.

Christopher Boyd: June 2008 is the next archive.

Find recent content on the main index or look in the archives to find all content.

Comment/Trackback Policy

This site supports an open comment policy. Rude, wasteful, off-topic, privacy-intruding or libelous comments will be deleted. Comments will remain open unless abused.