“Discover Lost Songs” released / “Discover Lost Songs” veröffentlicht
Posted by cordney* in development, technology on September 26, 2007
The day, the iPhone Europe died
Posted by cordney* in technology on September 18, 2007
That’s today. Steve just announced the iPhone for UK for November, 9th. No 2nd generation iPhone, no UMTS. The same iPhone they sell in the US. Provider will be O2 UK. They will sell it for 269 pound sterling, which is about 390€ or 540$. 18 month contract from 50 to 79€ (or 70 to 110$) including a data flatrate with EDGE.
But wait, a real data flatrate? NO! It’s limited to 1,400 web pages per day (What?) due to fair usage agreement. Wait, where are we – year 2007, isn’t it? Data flatrates everywhere.. In Germany you get a UMTS flatrate for 25€ (35$) per month – real UMTS!
So, they’re using EDGE – the good old GSM way. So what’s the EDGE coverage in UK? 30%? What? Yes, it’s true! So what are they doing? Of course, they will upgrade their network for EDGE. Isn’t that crazy? It’s just a couple of years ago that European providers starting investing billions in upgrading their networks to UMTS – that is way ahead of the plenty 20 year old GSM standard. So – here comes one man with one phone and – and they’re dropping their efforts in the next mobile telephony generation?! *shaking head*
Similar agreements with other European provider are expected for the next days/weeks.
That’s it. Goodbye iPhone Europe.
T-Online and the unusual way to get security
8(!) month ago a vulnerability was discovered in the ADSL-WiFi-Router “Speedport W700V” manufactured by Siemens, allowing remote users to access the web interface of the router remotely. Funnily enough the router shows the default password at the login screen. The router is given away for free with a contract with the German Internet Provider T-Online (German Telekom). A firmware update already exists fixing the hole. Some days ago, users of T-Online discovered that they couldn’t make connections on TCP-port 8085 anymore.
Here is the clue: T-Online admitted that they are blocking port 8085 for outgoing connections by now, but affecting only T-Online users. 
An auction site for vulnerabilities
What’s the security business about? Plenty of people sit in dark rooms and search software for vulnerabilities. When they discover one, they normally inform the software vendor about it and after that make it available to the public. The vendor releases a patch, the exploit gets published to the net. What does the security analyst get for it? Nothing but a bit of fame.
That’s supposed to change. Started on Tuesday, the first official* marketplace for security flaws opened. If you discover a vulnerability, you can register at WabiSabiLabi and sell it there in an auction or for a fixed price. The sellers and buyers must verify themselves, so no script kiddies bad guys may buy an exploit there. Of course one may ask it this is morally ok? I came to the conclusion that it is, because the software vendors then spent the money they saved by dropping quality and security checks of their software, so it should be zero in sum. And the guys sitting in their dark rooms get what they deserve.
* of course there has been a market for vulnerabilities in the underground for a long time
Phishing phishers and tracing their identities
Two fellow students of IT-Security at my university recently came up with an idea [paper] on catching phishers and tracing their identities. The idea is quite simple:
1.) collect some recent phishing sites, e.g. from Google or Microsoft
2.) create user credentials such as name, bank, account number, TANs etc. (e.g. from wordlists, dictionaries)
3.) send these special credentials (called ‘phoneytokens’) to the phishing sites
When the phisher[s] now visit the bank site and enter a phoneytoken, it is detected by the system and the phisher is being redirected to a honeypot system (called ‘phoneypot’) instead of the real banking application. This phoneypot looks like the real banking application and can collect data about the phisher, revealing organizational structures of the phishing system and hopefully the phisher himself.
Talks with German banks are currently in progress, let’s see how this will work in practice. I’ll keep you up to date.
If you have any input, you can write to the authors mentioned in the paper or to me, of course.
see you, cordney*