Dropbox, a cloud based storage service used by millions of users was compromised allowing illegal access by using any user name and password. The service hosts sensitive documents, and other files including media content. The reason to this nightmare according to Dropbox was a code update introducing a bug affecting their site authentication mechanism. Although a fix was delivered in just five minutes after the bug was exposed, but the site remained defenseless for four hours.
Dropbox revealed in their blog entry on June, 20 confessing “this should never have happened”
Clients are obviously outraged and raising privacy concerns over their confidential stuff stored on the cloud. Proper unit testing followed by every update might have avoided this catastrophe to take place.
Despite Billions of dollars have been invested on cloud services and solutions by companies like Microsoft, Amazon, Google, Sales Force to compel individuals and businesses to go online and do expensive conversions; such incidents lately have had a substantial negatively impact on the cloud computing campaign.
These security breaches seriously raise a necessity of having a proper governing body to define standards and rules for all those who offer cloud services. The body should keep auditing to ensure that cloud based service is in compliance to all rules and SOPs and monitor that such companies are fairly investing on best security standards to gain confidence of clients.
Read More on similar cloud security breaches including gmail hacking.
Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts
Friday, June 24, 2011
Monday, June 06, 2011
Completely Secure Erase your iPhone/Android Mobile before Resale
It is very common that we are compelled to upgrade our phones by getting attracted towards the new fascinating look and feel, new exciting features and applications claimed by the upcoming versions of mobile devices; we give away our older phones to the family members or sell em to our peers or bringing up on eBay followed by an upgrade.
Cell phones are now more like wallets and before giving them away, we need to be sure that after taking one last backup on a separate location, all the private information including contacts, text messages, images, emails and other personal information has been securely and permanently removed from the device.
Following Links provide enough guidelines to help securely erase your personal information form your iPhone or Android mobile device.
Clean Sweep iPhone.
Clean Sweep Android.
Cell phones are now more like wallets and before giving them away, we need to be sure that after taking one last backup on a separate location, all the private information including contacts, text messages, images, emails and other personal information has been securely and permanently removed from the device.
Following Links provide enough guidelines to help securely erase your personal information form your iPhone or Android mobile device.
Clean Sweep iPhone.
Clean Sweep Android.
Thursday, June 02, 2011
Gmail Hacking: Google stumbles gmail accounts hacked by chinese
The Recent Cyber attack on Sony PlayStation hacking was a disaster followed by Apple mac defender malware, and now gmail hacking .
Google claims that the accounts were compromised because of stolen passwords, reason could be due to malware installed on client computers, heavy phishing or through responses to malicious e-mails from fake sources by the hackers. It's feared that this might include senior US government and military personnel accounts that were compromised. The origin of this activity according to Google, is china.
Google relayed the details on Wednesday through its official blog:
"Through the strength of our cloud-based security and abuse detection systems*, we recently uncovered a campaign to collect user passwords, likely through phishing. This campaign, which appears to originate from Jinan, China, affected what seem to be the personal Gmail accounts of hundreds of users including, among others, senior U.S. government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists."
Seems like Hackers around the world are getting in alliance for last few weeks to bring world's attention and pose serious security concerns to large enterprise companies.
Just like insurance companies that sell expensive disaster coverage plans (earthquakes for instance) having substantial potential turn over to the insurance company, they equally allocate huge marketing budget by projection of events and news that bring customer attention and awareness to purchase such plans. Human psychology :)
This could be an involuntary marketing campaign for the companies that sell large expensive security and protection software systems. :)
Google claims that the accounts were compromised because of stolen passwords, reason could be due to malware installed on client computers, heavy phishing or through responses to malicious e-mails from fake sources by the hackers. It's feared that this might include senior US government and military personnel accounts that were compromised. The origin of this activity according to Google, is china.
Google relayed the details on Wednesday through its official blog:
"Through the strength of our cloud-based security and abuse detection systems*, we recently uncovered a campaign to collect user passwords, likely through phishing. This campaign, which appears to originate from Jinan, China, affected what seem to be the personal Gmail accounts of hundreds of users including, among others, senior U.S. government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists."
Seems like Hackers around the world are getting in alliance for last few weeks to bring world's attention and pose serious security concerns to large enterprise companies.
Just like insurance companies that sell expensive disaster coverage plans (earthquakes for instance) having substantial potential turn over to the insurance company, they equally allocate huge marketing budget by projection of events and news that bring customer attention and awareness to purchase such plans. Human psychology :)
This could be an involuntary marketing campaign for the companies that sell large expensive security and protection software systems. :)
Monday, April 21, 2008
How to login to SQL Server as SA while running Windows Authentiaction only mode
A colleague of mine ran into following situation:
My Company polocies enforce that domain-admins group be removed from sysadmin role in production SQL Server and windows authentication mode should only be used.
He removed the domain-admin group from sysadmin roles , then set windows authentication only and restarted the server at night.
When he tried to log in back with his domain user account (which was part of domain admin group too) he could only log on to master db with public role only!!!!!!!!!!!!!!!!!!!!!
He forgot to add his own account explicitly in SQL Server before removing domain-admins group.
Interesting situation:
Besides my colleague was planning to run rebuildm.exe utility to rebuild the master db , and then setting up logins and all user databases using scripts.
I tried something on my local test machine and found that there's a way!
I opened Enterprise Manager and tried to connect using SA with SQL authentication; Error: Login Failed for user 'sa'. Reason: Not associated with a trusted SQL Server connection.
hmmmm! OK
Solution:
This isn't a security breach; since you already logged in to the machine locally, that means your are an authenticated user to the system. NamedPipes library only supports connections that are valid windows logins. You can not connect using NamedPipes over the WAN or out of a trusted domain. Your Windows login must be authenticated on the machine running SQL Server before in order to use NamedPipes!
Cheers!
My Company polocies enforce that domain-admins group be removed from sysadmin role in production SQL Server and windows authentication mode should only be used.
He removed the domain-admin group from sysadmin roles , then set windows authentication only and restarted the server at night.
When he tried to log in back with his domain user account (which was part of domain admin group too) he could only log on to master db with public role only!!!!!!!!!!!!!!!!!!!!!
He forgot to add his own account explicitly in SQL Server before removing domain-admins group.
Interesting situation:
- Domain-admins removed from SQL sysadmin role
- SQL running Windows Authentication only Mode.
- No windows user exist in SQL with sysadmin role.
Besides my colleague was planning to run rebuildm.exe utility to rebuild the master db , and then setting up logins and all user databases using scripts.
I tried something on my local test machine and found that there's a way!
I opened Enterprise Manager and tried to connect using SA with SQL authentication; Error: Login Failed for user 'sa'. Reason: Not associated with a trusted SQL Server connection.
hmmmm! OK
Solution:
- I logged into the operating system running production SQL machine using local admin account.
- Checked that NAMED-PIPES are enabled under the Server network utility.
- Start --> Program Files --> Microsoft SQL Server --> SQL Server Client Network Utility
- Goto Alias, Select Add.
- Under network libaries , selected NAMED PIPES
- Gave server alias prod1
- Under Server Name typed the actual SQL instance name (in our case PRODUK1)
- Clicked OK.
- Open the Enterprise manager again
- New SQL Server Registration.
- Under the server, typed the alias: prod1
- Selected, Use SQL Server authentication
- user name : SA
- password : typed the password
- clicked OK.
This isn't a security breach; since you already logged in to the machine locally, that means your are an authenticated user to the system. NamedPipes library only supports connections that are valid windows logins. You can not connect using NamedPipes over the WAN or out of a trusted domain. Your Windows login must be authenticated on the machine running SQL Server before in order to use NamedPipes!
Cheers!
Subscribe to:
Posts (Atom)