"No Seriously... YOU HAVE BEEN HACKED."

So I find myself yet again trying to do the right thing... as I sit there on the phone with someone's customer support line trying to explain to them that someone has exploited their website (or mailing list provider)... usually with my hand on my forehead.

I have highly restrictive email account settings (on purpose) and do not use a "catch-all" account for non-existent email addresses. So when I sign up for a new account as a rule I go in and create a new email address specifically for the site at hand. This helps me track whether they're sticking to their Terms of Service.

Calvin Klein (Yes they're still around.)

The last time this happened was way back in May 2012 and I was registering for the Calvin Klein website. So I go in and set up ck@[mydomain_for_potential_spam].com and register for the mailing list. (Since I'm requesting this it's not spam.) Two hours later I get a spam (non-solicited) email to this address from a completely different site than Calvin Klein. I think to myself... that's fast!

So I contact customer support and explain to them that Yes, I did just register for the emails today. Yes I did just create this very email account today. Yes, nobody else but your website has this email address and I have only shared it with you. All other connections to make the account were "secure."

Calvin Klein follows up to say "our site is secure and there is no way it was anything on our end." This prompts a swift response stating "Your site is not secure in the truest form of the word on the Internet. You're not using any sort of encryption whatsoever, so if anyone wanted to read any traffic from your site all they would need to do is run a packet sifter and they can read everything that transacts between your site and their machine and look for an exploit." (This is of course not the check-out portion of the site we're talking about.) I get no further feedback from them.

I think to myself... let me check on my end... so I close the CK account and open a new account called CK2. I go in and this time, I register on a Mac (just on the off chance that my firewall didn't catch that I've random traffic communicating directly with my Windows box, or my machine's firewall seems to think that some Trojan [something I installed on purpose that really infected me] is perfectly acceptable.) 30 minutes later more spam for the newest address.

So I go in and take a look at all of the stuff that's being loaded on the CK site using a plug-in for Firefox called Firebug. There are (at the time) no less than 30 scripts running from the CK site... 4 of which keep off-site live open feeds (AJAX and the like). For anyone who doesn't know what this means AJAX is a way for your browser to send information to a web server without you having to really enter anything. People can track your mouse movements, things you click on, all sorts of stuff. So on the CK site I narrowed it down to Omniture,  Shoprunner, and a couple of others before I gave up (it takes a long time to create new email addresses and sign up for stuff when you're just curious)... also I don't want to create too much traffic and make them think I'm the one who took over their mailing form.

So I respond to CK with a second notice that the same thing happened... copied customer support and the default admin@ and abuse@ accounts. I get a reply of "please leave our website alone, we have not been hacked." Oh well. (I still get random spam messages off of the custom CK emails.)

Enter Walthers

So I totally dig toy trains... they're quite a bit more pricey than what I'm willing to pay, but Walthers is one of THE places to get trains if you're considering keeping the hobby alive. I get a print catalog and subscribe to their email newsletters (on the off-chance I win the lottery some day). So today I go into my email account and see a message in the Walthers folder for HVAC air handlers. I contact Walthers and the conversation goes something like this.

Me: "Hello, my name is Chris and I'm calling to let you know that I think your email mailing list has been compromised." (They could have sold my name... A.K.A. shared it with their business partners.)

Support person: "What makes you say that?"

Me: "I've setup a custom email account specifically for Walthers and have been receiving your newsletters for some time, but today I received a message I believe to be Spam at the address that I specifically set up to work with your company."

Support person: "What kind of spam message?"

Me: "Air handlers from Nicor Services."

Support person: "We didn't send that to you. I get Spam all the time... there's no way to stop it."

Me: "No, you don't understand... I only get messages on this email account from Walthers and have only ever shared it with your company, so either you have an infected machine, someone got to your main database of subscribers, or your list handling service was compromised."

Support person: "What's the email address?"

Me: "walthers@[mydomain_for_potential_spam].com"

Support person: "Well I get spam on my Walthers account all the time and I work at Walthers so it's not surprising that you would get spam too."

Me: "I think you're not getting what I'm trying to say."

Support person: "We send out to over 100,000 people every time we send a newsletter... I think we would have heard about it before now."

Luckily my other line started ringing so I had to hang up quick...

Common misconceptions about Online "Safety"

Note: Nothing online is completely "safe."

1.  Our website is secure
   Your website is only "secure" if you're using SSL. Your email is more than likely NOT secure unless you work for a bank and you're sending your email to another person inside the bank behind the company firewall... even then it's iffy at best because some of the firewalls will decrypt SSL so they can speed up the transfer. When you have a form on your website people and someone hits submit, the site transmits that information over the Internet from their browser to your server. If your server stores the information through and encrypted channel, then it's "safe" only because the channel was encrypted. Anyone who was able to get the handshake keys at the start of the transactions could decrypt everything you've sent. If your site sends you an email containing the information, what happens is that the web server has its own email sending server... this server more than likely uses the standard email protocols and sends the message in what's called "clear text" or "plain text" if it's not configured to log into your server directly with SSL. Most mail servers allow the people sending the messages to send in clear text because it's faster and not everyone submits messages in SSL (or any of the other encryption protocols).
2. We are a big company, we're invincible
   This is funny. I work with a lot of big companies. The reason the big companies are super successful is because the investors come in, take a look at operations and cut out everything that seems to be non-important. If you're not in a financial market then chances are your IT staff has been cut, just like everyone else's. Most IT guys that I've had the experience of working with are sort of "old-skool" in the sense that they learned what they do mostly on the job. Sometimes these guys have been at a company for eons and they started in some other department, learning the ropes as they go. If they've not been hacked, or if they're not resourceful enough to look stuff up, chances are they're not as up-to-date on the latest threats as most companies would like to believe... despite what they're being paid. It's a lot of work to read 25 blogs a day, check all of the latest security threat sites for zero-day attacks (attacks without warning) AND help Pat in HR figure out how to copy and paste (for the 25th time this week).
3. We have a custom website, nobody knows about it except for the developers
   There are a couple of things that happen here... sometimes you do have a real custom site where it's been written from the ground up. If that's the case then there were definitely corners cut somewhere. Not everyone has the time to make sure that all of the form fields in every form being submitted conform to what you're expecting (it's almost impossible). The other thing I typically run into with "custom websites" are sites that were created with something like WordPress and then they have a custom skin on the front-end. At some point in time the site goes down and then people start asking "How did this happen?" or "How can my site be infected by trackbacks when we don't even know what those are?" There are hundreds of thousands of lines of code in the "industry-leading" CMS systems out there. All of this code is available on the Internet and there are people overseas who have nothing better to do than look for an exploit and take advantage of some website.
4. We don't have a very big company, someone's surely not going to target us.
   People who hack servers don't care about who they're hacking unless it's a site in the security industry or some large company where they can get "street cred." If you're not in those two categories most "hackers" won't make a distinction between your site or anyone else's... and here-in lies the problem. You have a web server and you have server space somewhere in a server farm on the internet. This server is publicly accessible from all over the world. In the industry we refer to it as real estate. If someone takes over your server, now they can use your real estate to do things like launch attacks, or steal information from your customers while they pretend to be you, or they can use your system to host something called a "bot net" for example. Botnets are hundreds upon hundreds of machines that have also been infected by some exploit that now answer to the main control server... in this case your web server. So there are a lot of reasons why someone who has a need might want to take over your server real estate. Unlike regular real estate because you're on the internet location doesn't really matter, unless you're hosting a web server on dial-up, then your "safe."
5. "How come we've never heard about this before?" or the best of all... "We've never been hacked before."
   This may be true, but it all starts somewhere. The first step to fixing the issue is realizing that you have an issue.

               

That's all I have for now. Hopefully this wasn't too wordy. Until next time, if someone says "we think you might have been hacked," there may be an off-chance that they're trying to help you out.

-Chris

Search Engine Optimization is The Devil's fruit.

I do a lot of work on different websites and people are always impressed by how high we are in the search rankings. I tell people that I don't do anything special in order to achieve the proper ranking for my sites' content, but I understand how the search engines work and design accordingly. Because of this I'm rewarded for presenting all of my information in a way that the search engine can read, understand, and process; and for writing my content to gain the interest of the intended target market. When the visitors respond and stay on the site, it affirms to the search engine that they have provided a good result.

According to Dictionary.com, Search Engine Optimization or SEO is

"the methods used to boost the ranking or frequency of a Web site in results returned by a search engine, in an effort to maximize user traffic to the site: The first step in search-engine optimization is to generate keywords that are relevant to your site's content. Abbreviation: SEO" (http://dictionary.reference.com/browse/search-engine+optimization)

In short we're tricking the search engine to rank a page if we're not doing things the right way. There are companies that provide "SEO" services for websites that result in having a lot of clients downranked or unlisted.

What the search engine wants

This industry standard practice isn't always in the Search Engine's best interest. As described by Larry Page, the co-founder and CEO of Google, the “perfect search engine” is something that “understands exactly what you mean and gives you back exactly what you want.” This would have to happen almost intuitively.

The bigger picture

In various languages there are different meanings for the same word. Out of context, the search engine has to determine what your intended search result was based on these various meanings, your dialect based on your region, and deliver the websites for the same keywords that show the appropriate level of stickiness (duration on page).

This is a huge undertaking on the part of the search engine, because not only are they trying to get the correct results for the search on the whole for their entire audience, but now they have to get the results right for individuals... people like me who look up a lot of stuff. So their approach is to follow habits through tools like Google Analytics, Google Search, Android Phones, various web browsers, Gmail accounts, online social network accounts, and blogs to get a better idea of who a person is... a profile if you will. When someone searches they can use previous search history to get the results they were looking for (You can opt out), based on search phrases from before. It's almost dynamic.

Because they're trying too hard (or maybe they're cutting corners), I've experienced searches where I'm looking for something, an exact phrase even, that I know exists and I never get the results I'm looking for. They're close, but hours daily have been wasted trying to find the correct results. If you're researching anything technical online you know what I mean.

The mistaken case for SEO

There is no perfect solution from a design standpoint for "Search Engine Optimization" because people are involved, everyone uses different phrasing, people change their minds, the definitions of words change, things lose popularity, and people alter their speech patterns over time. When a regular website isn’t designed properly (to present the information appropriately), as a last resort we have to perform SEO by definition to trick the search engine into displaying our site in the search results (or pay). When the search engine finds out we’ve tricked them or that we’re not in the best interest for the search engine for the keywords their users are searching on, we are down-ranked in the results for the term. They have a blog about this.

So when someone pays for SEO-only services, they're really paying for a temporary fix to a major problem. Many companies have shorted themselves in terms of a web design and development budget, hired people who don't know the correct answers to the problem (or that the problem even exists), and don't want to pay people to write the information they need on the website to make sure they're providing valuable information to the search engines for their results and the end users. In essence they've crippled their growth.

The Solution

In the long run, because Google has a lot more money to throw at this problem than most companies, the companies will lose out by trying to trick the search engines over and over, whereas it's simply much more cost effective to do it right the first time and hire the proper talent. This will make the Internet a much better place.

1. Write interesting content for the visitors that will keep them on the site and informed.
2. Provide clues in the interface to the search engines that will help them to target your audience.
3. Provide methods for your audience to share information about your site.
4. Analyze your statistical traffic data and adjust accordingly.

A nibble of a little bit of knowledge from the old tree might lead one to be kicked out of the garden.

Danger in the proliferation of QR Codes

You might have noticed more and more of these graphics popping up everywhere from your packages you receive in the mail, to the backs of toys, games, electronics, consumables, and even on billboards and ads throughout our societies around the world. They're everywhere and without the proper software you can't tell what they say until they've been decoded. QR codes are a relatively new way to encode information usually for mobile devices, so the lazy masses can open a URL without having to type anything (it's one of the little things we're doing for the kids so their lives aren't as complicated as ours).

This one specifically (above) is a QR code that I created with the website at qrcode.kaywa.com that says "This could have been a virus." And that would be correct. It could have been a virus, a link to a Trojan, or a link to who knows what, and in the wrong place at the wrong time, it could cause a lot of trouble. Let's say it's to an illegal website and you're on your network at work, and you open a webpage with one of your devices that you have been authorized to use on the company network. It could cost you your job. You could open a backdoor to your corporate network. If it's placed for you specifically to open, you could give someone your physical location(stalker) or information unknowingly. (Think forms that auto-complete and use AJAX - an acronym for Asynchronous JavaScript and XML for processing)... by the time it opens whoops, it's too late.

The problem is, because your phone, ipad, etc, can open a URL or a bit of code under the assumption it's something else, the codes can't always be trusted. See the graphic itself is harmless. It's just a high contrast collection of squares in a pattern that tell the decoding software which characters are meant to be represented when the code is translated. The problem comes back to people. A malicious individual could place a link to a website with a specially crafted payload or better yet a script that qualifies a device, then delivers a specially crafted payload to the device to take over the device, to steal information, or to simply implant something for the sake of tracking on the device (such as a cookie). This can all happen super fast and then the site can redirect you back to another site. It says flowers.com, I ended up on flowers.com, but what really happened in-between? In actuality the in-between part is commonly referred to as an XSS attack (Cross-Site Scripting) where one website is used to exploit the visitors of another.

So take it from someone with a devious curiosity when it comes to technology. The next time you see one of these things on a package or somewhere in the wild, before you scan it, think about what it is you think you're getting and whether the risk is worth it. If it's on a toy, you're probably okay, they're just going to track you or sell you more stuff, but if it's stuck to a pole next to Wrigley Field, you might be getting more than you bargained for.

Holiday Shopping Help - How to get the good deals.

Here's a cheat sheet for doing the math. In our household we do a lot of shopping (looking for the best deals). I have the ability to memorize prices items, quantities, and container packaging. Because of this I've noticed a bit of trickery. Around holiday time people are desperate for deals and sales and will unknowingly purchase things at a much, much higher price.  Some companies increase the prices a month or two in advance (in regard to Christmas, this can be as early as late September) to offer the item for the original price they are claiming is a new sale price. Here are a few of the phrases that companies uses that aren't always intuitive, but seem like a good deal.

Buy 1 Get 1 Free = 50% off of two.
You'll want to watch this, usually they've increased the price by double which makes it so you only get 25% off in the end. Not bad? Well, considering the items they do this to have a huge mark-up it's rare you'll get your money's worth.

Buy 1 Get 1 for $1 = 50% off of both plus $1.
Same as above, they've already increased the price astronomically and people are typically preoccupied with the plus $1 to think about what the original price was.

Buy 3 Get 2 free = 40% off of each. You're still paying 60% of the price for each. If it seems reasonable, then go for it.

Buy 1 Get 1 for 50% off = 25% off both.
Not a real deal if the place you're shopping is 25% higher than the competitor.

Be sure if you're going for a sale not to get lured into purchasing other items you might normally buy if they are going for a higher price. High sales also mean they have to make-up the cost, so that savings is spread around to other items in the store. Statistically, if you buy soda, and then Tuna Fish, Pizza or Toilet Paper, one of the items might be on sale, whereas the others will carry an inflated price.

It's a good idea to always look around for the best price before going out to shop.

Another trick I've noticed is varying quantity amounts. Some products (eg. Bullion Cubes) might be sold in 5 or 6 different quantity sizes at various stores. When you visit one store for price comparison, the price may seem lower, but you're getting a considerably less amount. Each package might seem like a scaled down version of the other and since the side-by-side counterpart offerings aren't available you might not be aware of the change in quantity. Sometimes this is a visual trick because although the front of the item is the same size and shape, the depth may have changed.

Another one of the tricks that companies do is when they change the package they've usually changed the quantity is some way or another. In regard to toilet paper, if there is a raised pattern on the paper this will cause less paper per roll. Toilet paper companies increase the diameter of the tube inside of the roll (to give you less paper), they change the sheet count so you get fewer sheets per roll in different arrangements, meaning if you buy 24 rolls you may be getting fewer sheets per roll than you do if you buy three 8 packs. Also look out for another change a shorter tube where they take up to an inch and a quarter off of one end of the roll.

Soda is bad for you and this year, they've introduced a new 20 pack instead of a 24 pack. They're still charging the inflated prices for the soda to begin with but it's harder for people to make the comparison. They also don't use the same measurements for comparison from one product line to the other (2 liters is 67 US Ounces) If you're comparing a 12-pack of soda (144 ounces) vs two 2-liters (134 ounces), then you'll get one fewer can. If the price for the two liter is 11/12ths (Price x .92) the price of the 12 pack then it's a deal. I always try to break down the price per ounce for a comparison in my head, but most phones have calculators as well.

If you're looking at the two prices for the comparison, consider the amount of gas and time it takes to shop at both places. If there is very little difference in price, then it might not be worth it to do a lot of comparison shopping.

The work around, buy items all year round. If you know you have special occasions to buy for, pick up the items on clearance after the holidays and put them in a safe place. If you are running a little behind, start shopping around August for December, you'll be well ahead of the price hikes. Also don't buy the latest technology Zero-day. Companies will usually drop the prices back down around May or June, so if you can live without it, you can save up to 25% of the cost in some cases.

Rising Prices Everywhere

November 1, 2011
The road to recovery was hit today with another toll booth. With "the economy" not doing so hot companies are finding new ways to take advantage of the average consumer.

"Prices for a ton of runner peanuts, commonly used to make peanut butter, hit nearly $1,200 this month, according to the U.S. Department of Agriculture. That's up from just $450 per ton a year ago. Overall, the USDA projects that American peanut production will hit 3.6 billion pounds this year, down 13% from last year." -CNN Money

So production is only down 13% from last year, but prices have increased 20% to 40% across the board. Companies are not making up for loses, but rather fleecing the average American who has turned to peanut butter in their time of crisis.


References:
Peanut butter prices skyrocketing By James O'Toole
http://money.cnn.com/2011/10/31/markets/peanut_butter_prices/index.htm