Blog On Stuff

Dear Canadian Government - Learn Computers.

2011-02-18T05:36:00.001-08:00

The recent cyber-attacks by foreign hackers on the Canadian Government network infrastructures shouldn't have happened and were easily preventable. I believe it was exactly what our government needed to start thinking about implementing modern system security strategies to secure data.

It appears that the hackers used "spear-phishing" tactics targeting specific government officials, fooling them into giving away sensitive information, and having them open documents infected with viruses.

In a few sentences, spear-phishing works a bit like this:

Hacker Zhang sends an email to Industry Canada clerk Bob.
The email appears to come from Bob's colleague Rita working at the "Gov of Canada's Central File Repository" administration. It warns Bob that his password has been compromised and needs to be reset. It provides him with a link.
Bob clicks on the link and resets his password.
The link is actually pointing to a website hosted in Indonesia that "appears" to be an official government website, but actually isn't.
Hacker Zhang now has the password, and does what he wants with it.

Of course it's probably a lot more complicated than this, you need to obtain a lot more information in order to even know things like.. how does the government store sensitive data? Is it on a separate network? How to I access this network.. etc. etc. Of course with a bit of social-engineering in a bureaucracy that is clueless to software security, all this easily done.

How could this have been prevented?

Well let's first start by identifying the security holes that allowed this to happened:

Government officials exchange emails with no encryption, allowing hackers to send emails "appearing" to come from legitimate contacts.
Government email system has bad virus cleansing strategies.
Government officials with access to sensitive system credentials have little IT training.

Unencrypted email problem, and email address spoofing:

Every government agency should encrypt emails with with digital signatures to ensure that the sender is actually who he / she claims to be, and so that no middle-man can read sensitive data. See this for more information: http://www.openpgp.org/

This is not something new.. this could have been implemented years ago.

Better Virus Cleansing Strategies:

Allow only the exchange of safe file formats by email. No .doc, .pdf, .exe, .zip etc... The email servers should filter all files that are potentially dangerous, and government agencies should use "safe" file formats such as restructured text.. txt... etc. It won't be as pretty as docs / pdfs, but it will prevent getting infected because of a bad file attached to a spoofed email.

Also, perhaps e-mail should simply not be used as a file-exchange medium. Emailing's initial purpose was to exchange messages, not mp3s, videos, pdfs... Other technologies are much better at dealing with file exchange.

IT Training:

This is perhaps the most important point of all! Regardless of how high-ranking a government official may be, he / she can the the victim of phishing attempts / impersonation attempts. Classes on Information Security in IT should be mandatory for ALL government officials that have access, or CAN have access (through a colleague) to sensitive credentials allowing them to access sensitive data.

There are simple things that most people should know regarding network security.

Few examples:
-How to store passwords (or should you store passwords?)
-What's phishing?
-What's social engineering?
-Is email a safe medium for communication?
-How to send files?
-What can I install on my computer?
-.. and so on.

Why wasn't the government ready to prevent such simple cyber-attacks? How can the Harper government have billions of dollars to spend on brand new planes, while its network security infrastructure is failing in every way and needs major restructuring?

Why do I know this, yet millions of dollars in consultation fees spent every year couldn't prepare them for such an attack?

How are we now supposed to trust our own government for keeping our data safe when its network security standards (that are actually in place) are practically non-existent?

Just my two cents.

-
Benoit

Google Transliteration - Quite impressed.

2010-12-09T15:47:00.000-08:00

I just checked out Google Transliteration currently in Google Labs.

It's basically a *any language* phonetics writer, which when using Chinese, can be used a an excellent Input method.

Request's IP address using django, Apache proxying through Nginx.

2010-12-06T09:45:00.000-08:00

So I spent about 2 hours trying to figure out how to get the real IP address from the request objects when proxying through Nginx using Apache. I didn't find much documentation online about this topic so I figured that I should share.

Problem:
So you do something like this:

Class MyModel(models.Model):
 ...
 def populate_meta(self, meta_data):
     try:
         if 'REMOTE_ADDR' in meta_data:
             self.ip = meta_data['REMOTE_ADDR']
     except KeyError:
             pass

And you ./manage.py runserver and all works well, your IP addresses are recorded fine.

Then you set-up a production server with Nginx and Apache with a configuration that looks like this:

server {
  listen   80;
  server_name example.com;
  location / {
           proxy_pass      http://127.0.0.1:81;
           proxy_redirect  off;
           proxy_set_header   Host             $host;
           proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
           proxy_set_header    X-Magic-Header "secret";
           client_max_body_size       10m;
               proxy_set_header   X-Real-IP $remote_addr;
  }
  location /static {
       alias /srv/web/landing/landing/static/;
  }
  location /media {
      alias /srv/web/landing/env/lib/python2.6/site-packages/django/contrib/admin/media/;
  }
}

And then suddenly all the IP addresses are recorded as 127.0.0.1!

How to fix it:
Change your python code to the following:

Class MyModel(models.Model):
 ...
 def populate_meta(self, meta_data):
     try:
         if 'HTTP_X_REAL_IP' in meta_data:
             self.ip = meta_data['HTTP_X_REAL_IP']
     except KeyError:
             pass

That's it! Hope it helps.

Petit aide-mémoire mercurial

2010-12-02T07:16:00.000-08:00

Voici un petit aide mémoire pour mercurial, pour ceux et celles qui en ont besoin. Note, cet aide-mémoire décrit un cas ou un repository est sur un serveur, et l'autre en local. Les exemples s'appliquent quand même dans le cas de deux repository locaux.

hg clone ORIGINE [DESTINATION]
*Pour créer une copie locale (un "repository" local) du projet ORIGINE

hg commit [NOMS DE FICHIERS] [-m "Description du commit"]
*Inscrire les changements (le "changeset") dans le repository local

hg add [NOMS DE FICHIERS]
*Ajouter un nouveau fichier dans le changeset actuel

hg rm [NOMS DE FICHIERS]
*Enlever un fichier dans le changeset actuel

hg log
*Voir la liste des commits

hg status
*Voir l'etat du repository local
**A = Fichier ajouté dans le changeset
**M = Fichier modifié dans le changeset
**R = Fichier enlevé dans le changeset.
**? = Fichier pas dans le changeset
**! = Fichier manquant dans le changeset actuel.

hg pull
*Mettre à jour le repository local, avec les changements
du repository sur le serveur.

hg push
*Mettre à jour le repository du serveur, avec les changements
du repository local.

hg update
*Après avoir fait un hg pull, il faut faire un update pour
mettre à jour les fichiers avec les changements récupérés
sur le serveur.

hg merge
*Pour mettre à jour l'historique des commits avec une
historique différente.
Exemple:
*Anna:
-Fait des changements à ses fichiers
-hg commit -m "Mes changements!!"
*Ben:
-Fait des changements à ses fichiers
-hg commit -m "Changements de mehdi"
-hg push **OK!!
*Anna:
-hg push **ERREUR!!
-hg pull
-hg merge
-hg commit -m "merged avec changements de mehdi"
-hg push **OK!!

What if Omar Khadr was a white, middle-class American?

2010-08-11T09:37:00.000-07:00

Here's a scenario:

James Jones, a 15 y/o, middle-class white American, leaves home by himself to fight coalition forces in Afghanistan, convinced by some radical ideas he's picked in during his teenage years.

Next thing you know, James Jones is taken by Canadian forces, brought to a military prison, and accused of murdering a Canadian soldier on foreign soil.

Imagine his pinkish face, on TV in a court room, answering to the crimes he's been charged with.
Imagine him holding on to a Mickey Mouse book, trying to sleep at night.
Imagine his fear as the child remains imprisoned for 7 years with murderers.

Would you deny his right to defend himself in a fair, internationally recognized justice system?

Would refuse that the child should be protected by international agreements such as the Paris Agreement, adopted by the United Nations in order to safeguard the rights and welfare of children during wartime?

Treatment of children accused of crimes under international law

3.6 Children who are accused of crimes under international law allegedly committed while they were associated with armed forces or armed groups should be considered primarily as victims of offences against international law; not only as perpetrators. They must be treated in accordance with international law in a framework of restorative justice and social rehabilitation, consistent with international law which offers children special protection through numerous agreements and principles.

3.7 Wherever possible, alternatives to judicial proceedings must be sought, in line with the Convention on the Rights of the Child and other international standards for juvenile justice.

3.8 Where truth-seeking and reconciliation mechanisms are established, children’s involvement should be promoted and supported and their rights protected throughout the process. Their participation must be voluntary and by informed consent by both the child and her or his parent or guardian where appropriate and possible. Special procedures should be permitted to minimize greater susceptibility to distress.

Why are we treating prisoner Omar Khadr as a war criminal? Why has he been imprisoned for 7 years when instead he should have been in school, studying, playing, loving?

Is it because he is brown? Because he's a muslim? Are we really living in a world where society accepts to jail children and deny them the rights we have promised to give them?

Bpython + Django

2010-07-21T09:23:00.000-07:00

Hi,

If you'd like to use the bpython interpreter with django, and auto-load your models, here's how you can do it.

install bpython using pip or whatever, make sure it's in your path
example:
pip install bpython

create a file in (django location)/core/management/

commands/ (I use virtualenv so for me it's in (env)/lib/python2.6/site-packages/django/core/management/ )

Name the file bpshell.py containing the code below.

and now you can run ./manage.py bpshell !!!


# Copy this file to (django location)/core/management/commands/bpshell.py
# make sure that bpython is somewhere in your path (virtual env?)
# run using ./manage.py bpshell

import os
from django.core.management.base import NoArgsCommand
from django.db.models.loading import get_models, get_apps
from optparse import make_option

class Command(NoArgsCommand):
    option_list = NoArgsCommand.option_list + (
        make_option('--plain', action='store_true', dest='plain',
            help='Tells Django to use plain Python, not bpython.'),
    )
    help = "Runs a Python interactive interpreter. Tries to use bpython, if it's available."

    requires_model_validation = False


    def handle_noargs(self, **options):
        # XXX: (Temporary) workaround for ticket #1796: force early loading of all
        # models from installed apps.
        from django.db.models.loading import get_models
        loaded_models = get_models()

        use_plain = options.get('plain', False)

        imported_objects = {}

        for app_mod in get_apps():
            app_models = get_models(app_mod)
            if not app_models:
                continue
            model_labels = ", ".join([model.__name__ for model in app_models])
            print self.style.SQL_COLTYPE("From '%s' autoload: %s" % (app_mod.__name__.split('.')[-2], model_labels))
            for model in app_models:
                try:
                    imported_objects[model.__name__] = getattr(__import__(app_mod.__name__, {}, {}, model.__name__), model.__name__)
                except AttributeError, e:
                    print self.style.ERROR_OUTPUT("Failed to import '%s' from '%s' reason: %s" % (model.__name__, app_mod.__name__.split('.')[-2], str(e)))
                    continue

        try:
            if use_plain:
                raise ImportError
            from bpython.cli import main
            locals_=imported_objects
            args=['-i', '-q']
            banner=None
            main(args, locals_, banner)            

        except ImportError:
            import code
            imported_objects = {}
            try: # Try activating rlcompleter, because it's handy.
                import readline
            except ImportError:
                pass
            else:
                # We don't have to wrap the following import in a 'try', because
                # we already know 'readline' was imported successfully.
                import rlcompleter
                readline.set_completer(rlcompleter.Completer(imported_objects).complete)
                readline.parse_and_bind("tab:complete")

            # We want to honor both $PYTHONSTARTUP and .pythonrc.py, so follow system
            # conventions and get $PYTHONSTARTUP first then import user.
            if not use_plain: 
                pythonrc = os.environ.get("PYTHONSTARTUP") 
                if pythonrc and os.path.isfile(pythonrc): 
                    try: 
                        execfile(pythonrc) 
                    except NameError: 
                        pass
                # This will import .pythonrc.py as a side-effect
                import user
            code.interact(local=imported_objects)