Hijacking a Big U network account

I could not really imagine that there is too much worth reading in the average Big U e-mail account but here is how you can easily hijack one, as well as the user account for the same person - letting you, potentially cavort around the Big U intranet as that user. All you need to know is the person's username, say ALBERTE - which Big U, contrary to all the usual advice, also uses as the e-mail prefix, e.g. ALBERTE@bigu.ac.zw.

1. Send an e-mail to the ICT helpdesk, asking for the password for ALBERTE to be reset. Use any e-mail account whatsoever to send this message! The reason that ICT-help will not find this unusual at all is that they only except password reset requests by e-mail. Since the lame network of Big U requires passwords to be changed on a monthly basis, they get a lot of requests for resets and ALL of these requests originate from some e-mail address different from that which they have to reset, of course. They apparently cannot require that these requests originate from the user's own e-mail address because either (i) they haven't thought of it; or (ii) most users don't have a separate e-mail password or have never used a computer other than their own.
2. Wait a few minutes for the reset password - often "password" - to arrive.
3. Log in the victim's user account. If they have no separate e-mail password, this will probably give you access to their e-mail as well.
   
4. Don't worry. The victim does not receive a copy of the password reset request or of the reset password. They will log on the next time and probably assume that they have forgotten their brand new password from last week and request a new one. This behaviour will confirm ICT-help's conviction that the user ALBERTE is an idiot and that they should keep on doling out reset passwords.
   

Needless to say, criminal minds will probably want to do this after having verified that the target has gone home for the weekend, so as to have a day or two to play around. I have never done this for any other than my own account, but for that it has worked very well. Big U, by the way, has disabled IMAP accounts on the advice of their (Microsoft) consultants who believe IMAP to be an unacceptable security risk. Huh?

[Apologies to Neil Stephenson for hijacking the title of his first published novel, The Big U.]

Useful links:

http://en.wikipedia.org/wiki/Social_engineering_%28security%29
http://en.wikipedia.org/wiki/The_Big_U

1000 weekend minutes on Vodafone Hungary

I am in Budapest at the moment, using a 3G card from Vodafone Hungary, provided with the apartment which I am renting. It occurred to me to check out the call rates and South Africans will be chagrined to find that Vodafone Hungary offers 1000 (sic) free weekend/evening minutes on a package costing R138,40 per month (at today' s exchange rate). On this package, calls to other Vodafone subscribers are about R0,70 per minute and calls to other networks just over R1,00 per minute, at any time of the day. South African subscribers getting 1/10 the number of minutes for the same price are... words escape me... sucked dry. Did I mention just R200,00 per month for an "unlimited" HDSPA service?

Sources: http://www.vodafone.hu/egyeni/tarifak/tarifa_valaszto/vodafone_tripla_en.html http://www.vodafone.hu/microsite/mobilinternet/szolg_hsdpa.html

ICASA's award of pay-TV licences to be challenged

ITweb reports today that Black Earth Communications (BEC) will be challenging the ICASA decision not to grant it a licence for pay-TV services in SA. Apparently represented by Cape Town ICT attorneys Michalsons, BEC was one of ten applicants not to receive a licence. Since the technology for pay-TV does not require the use of any scarce resource, one can presume that the decision to deny licences is based on non-compliance with one of the raft of mom-and-apple-pie (or should that be, umama-and-melktert?) provisions of the relevant legislation, or on ICASA engaging in an anti-competitive carve-up of the market. Which legal grounds it would have for the latter is unclear to me but why should an organ of state be picking winners in the marketplace, especially for a totally non-essential service?

One of the firms awarded a licence, e-Sat, has already announced that it no longer intends to run a pay-TV service but has got into bed with the incumbent monopoly provider, Multichoice. That leaves four firms with licences, one of which is Multichoice (and another... Telkom). In economics, the four-firm concentration ratio is often used to gauge how competitive a market is. In this case, the concentration ratio will be 100% - a situation that many people will regard as a full oligopoly. Furthermore, the barrier to entry is very high and I would not be surprised if the situation turns into a Multichoice/Telkom duopoly rather quickly, with very little benefit for the consumer.

Die volstruisverestoffer in die geskiedenis

Met die uitvinding van die verestoffer, gemaak van kalkoenvere, het die Amerikaanse Susan Hibbard 'n deurbraak gemaak. Haar storie word egter verskeie plekke op die Internet (o.a. die Amerikaanse openbare diens-uitsaaier, PBS, se webbladsye) onjuis aangehaal. Dit word vertel dat haar bose eggenoot die patent by haar wou wegneem en in sy naam registreer en dat sy in die hof sou moes veg om dit te behou. Dit is weliswaar so dat eiendomsreg binne die huwelik 'n netelike probleem was in die patentreg (soos elders in die personereg) maar die geval Susan Hibbard was meer ingewikkeld.

Volgens 'n artikel in The American Journal of Legal History het Susan se man, George Hibbard, in 1874 'n patent in sy naam registreer vir die verestoffer. Kort daarnee het ene GM Richmond aansoek gedoen vir 'n patent vir dieselfde item. By 'n verhoor om die twee aansprake te beoordeel het dit aan die lig gekom dat die uitvindsel eintlik Susan s'n was. Die VS-patentekantoor het die dispuut toe verander na een tussen Susan Hibbard en Richmond en die patent aan Susan toegestaan. Hoewel die storie van Hibbard se verestoffer wel wys dat mans soms in die 19e eeu gerieflikheidshalwe hul eggenote se uitvindsels patenteer het (miskien soos sommige amper-insolvente individue vandag hul huise in hul eggenoot se naam registreer), illustreer dit eerder 'n verligte houding aan die owerhede se kant!

Volgens die Wikipedia is die volstruisverestoffer in 1903 in Johannesburg uitgevind deur ene Harry S. Beckner. Die Beckner Feather Duster Company se webbladsye maak egter 'n minder omvattende aanspraak:

original South African Ostrich Feather Dusters were invented in Johannesburg, South Africa by missionary, broom factory manager, Harry S. Beckner in 1903...

Let op die hoofletters en die kwalifikasie "South African"! In iedere geval, Beckner is na die VSA saam met sy broer George en het dié maatskappy in 1913 op die been gebring. Vandag word die maatskappy besit deur George se kleindogter Margaret Fish en haar man en word dié verestoffers vervaardig in McDonald, Tennessee, van vere wat uit SA ingevoer word.

Hoewel dié webjoernaalskrywers een van die laaste persone sou wees om die ekonomie deur 'n nasionalistiese bril te sien, kom die vraag tog by 'n mens op: watter hoop het, byvoorbeeld, die SA-regering se planne om verydeling (die vervaardiging van juwele e.d.m.) in die mineraal- en edelmetaalsektore aan te wakker indien ons, na meer as 100 jaar, nog die vere van ons volstruise Amerika toe stuur om daar aan 'n stok vasgemaak te word vir 'n stoffer? Dié tipe denke oor die verestoffer ignoreer natuurlik die subtiele ekonomiese kragte (die "onsigbare hand", indien u wil) wat dinge gemaak het soos dit is. Ministers ignoreer dié kragte ook besonder graag.

Bronne: http://www.pbs.org/wgbh/amex/telephone/sfeature/index.html http://en.wikipedia.org/wiki/Ostrich_feather_dusters http://findarticles.com/p/articles/mi_gx5205/is_1999/ai_n19125056 http://www.becknerfeather.com/

Deborah J. Merritt . Hypatia in the Patent Office: Women Inventors and the Law, 1865-1900. The American Journal of Legal History, Vol. 35, No. 3. (Jul., 1991), pp. 235-306.

Jou wagwoord en Oliver Cromwell

Een van die burgerregte wat gevestig is tydens die 17e-eeuse bewind van die Oliver Cromwell in Engeland, is (aldus Wikipedia) die reg om mensself te weerhou van self-inkriminasie tydens 'n kriminele verhoor. Dié reg is baie belangrik omdat dit die vergryp van gedwonge bekentenisse, dikwels deur marteling, bekamp het. Vandag is dié reg veral bekend uit Amerikaanse TV-reekse en films, waar die uitoefening daarvan in die spesifieke instansie waar 'n mens weier om 'n vraag te beantwoord, bekend staan as "taking the Fifth". Hierdie is die verwysing na die vyfde amendement van die grondwet van die VSA, waar die reg verwoord word m.b.t. kriminele vervolgings.

Pas hierdie week het 'n Amerikaanse federale regter in die deelstaat Vermont beslis dat 'n man wat daarvan aangekla word dat hy kinder-animasiepornografie (uiters smaakloos, maar is dít 'n misdaad?) oor die Kanadese grens op sy draagbare rekenaar die VSA sou ingebring het, op gronde van die "Fifth" kan weier om die kriptografiese sleutel (sê maar: wagwoord) wat nodig is om sy harde skyf te ontsyfer, te verskaf. Doeanebeamptes het blykbaar wel inkriminerende materiaal op dié rekenaar gesien maar het nou die sleutel nodig om weer toegang tot die geënkripteerde skyf te kry. Die brandende (indien daar so iets is) regskwessie is of 'n wagwoord (of sleutel) 'n vorm van spraak of verbale getuienis is, en of dit eerder ooreenstem met 'n kas-sleutel of die kode vir 'n kluis. Blykbaar kan 'n mens gedwing word om 'n sleutel of 'n kluiskode te oorhanding indien dít nodig is om getuienis van ernstige belang te bekom en my gevoel is dat daar min verskil tussen 'n kluis- en 'n kriptografiese sleutel is. 'n Mens sien hier eintlik dat die reg wat 'n teenstrydigheid konfronteer wat spruit uit 'n wiskundige innovering - sterk enkripsie.

Lesers wil dalk in gedagte hou dat onder SA se nuwe Wet op Seksuele Misdrywe dit 'n kriminele oortreding maak vir mense jonger as 16 om te soen (om nie te praat van wat nóg in die agterste ry by Sterland mag aangegaan het nie). Hou dus maar stil wat agter die fietsloods gebeur het, hoop dat die staatsaanklaer nie op jóú dagboek toeslaan nie, en vertrou op nulla poena.