Southwest database fail

Linda: So it turns out that the reason that I've been locked out of my account is that when I booked your ticket their database subbed your birthday for mine, therefore no validation with my birthday would work. Database flaw, they have one. Also, it seems likely that all of my password reset emails are in your spambox somewhere.
(1:29:32 PM) ce: oh, that's ugly :(
(1:29:54 PM) ce: at least it's fixed now?
(1:30:59 PM) Linda: No, it's not. The database also subbed in middle name and gender and I can't fix them from this end for some reason. Unless I get this fixed, there's no way I can get through security again if booking travel through my SW account.
(1:31:03 PM) Linda: Sigh.
(1:31:27 PM) ce: that's fucking terrible.

When I booked a trip for him using my account (and the rewards and vouchers in my account) the database must have inserted his information instead of mine in the fields of: middle name, birthday, gender, and email address. And there's no way to fix it from the consumer side of the webpage.

However, the good news is that, thanks to someone on the help line, I have a password to my account now. The bad news is that I can't book travel yet, unless I want travel booked for a male with my first and last names, but Lance's middle name. ...useless, no? So, back to the phone help line.

Edit: Called customer service 214-932-0333. After some initial confusion on the part of the agent, and then a request that I fax her my drivers license (my reply: "I don't have a fax machine... can I email you a picture?"), she simply changed my data to correct data which I supplied verbally. A quick refresh of my account page shows that she changed my middle name and my gender, and although for some reason my account won't show me what she changed my birthday to, I have no reason to doubt that she did that accurately too.

So, where are the security flaws here?

• Initial database flaw- replacing good information with bad. How far does this extend?
• In password reset attempts, sometimes two attempts with the same data had different results, i.e. either "bad data, please retry" or "email sent, please click link"
• Lack of ability to change your own birthday/gender on the website might be an attempt at security? Or just a bug. Inability to see my own birthday in my account info is definitely a bug, because if I can't see it, it might be wrong and I would have no way of knowing.
• Ability for customer service rep to change account info without evidence other than my voice (and confirmation data that I provided, such as address, name, birthday... all things that someone could find out about me).

By the way... the way to add a Southwest LUV voucher to your account is here: https://www.southwest.com/flight/travel-funds-results.html (for the next time that I forget and get frustrated)

Google: security

http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html

In other words, Google will pay you (and make you famous and possibly hire you) to find their security bugs for them.

Rocking.

Sadly I don't know where I would start on a project like that. Maybe some googling will give me some ideas. (ahaha irony)

EDIT: after reading parts of the Hall of Fame for people who've won the money, I'm less convinced that I can make an immediate contribution, but more convinced that I want to.

Fireshepherd: a response to firesheep

So this guy wrote this thing that crashes Firesheep through a bug. -shrug- Which is cool. I'm going to test it out... maybe tomorrow. Today isn't a good time for it. (I found this because I set up a google alert that sends me blog posts that mention firesheep.)

http://notendur.hi.is/~gas15/FireShepherd/

FireShepherd, a small console program that floods the nearby wireless network with packets designed to turn off FireSheep, effectively shutting down nearby FireSheep programs every 0.5 sec or so, making you and the people around you secure from most people using FireSheep.
The program kills current version of FireSheep running nearby, but the user is still in danger of all other session hijacking mechanisms. Do not do anything over a untrusted network that you cannot share with everyone.

Optional command line switches:
-i *IP* Ip Destination for packets, local router is recommended. (A trivial facebook server is default)
The local router can be found with the tracert command. (For example the first hit from "tracert www.google.com")
-t *timeout* Timeout in ms for packet sending. About 200 is ok for a local router. (400 is default)
-h Shows this message

Note that a dot represents a packet being sent.

Download FireShepherd.exe (Win32)
Download Source code
Download Licence.txt

Note that by downloading/using you accept the terms found in licence.txt

Gunnar Atli Sigurdsson, University of Iceland, 2010
e: gas15 at_hi.is

Cool security blogs about Firesheep

http://erratasec.blogspot.com/2010/10/re-firesheep.html
http://blog.mozilla.com/security/2010/10/27/cooling-down-the-firesheep/

Firesheep

Firesheep, Force-TLS, KB SSl Enforcer. I am playing* with them. Which is to say, installed TLS and KB, still trying to get Firesheep to run on ubuntu. Might boot into windows soon so I can play with them there.

News: http://techcrunch.com/2010/10/24/firesheep-in-wolves-clothing-app-lets-you-hack-into-twitter-facebook-accounts-easily/

Force-TLS (for Firefox): https://addons.mozilla.org/en-US/firefox/addon/12714/

KB SSL Enforcer (for Chrome): https://chrome.google.com/extensions/detail/flcpelgcagfhfoegekianiofphddckof

Code for KB: http://kbsslenforcer.googlecode.com/svn/trunk/

Firesheep: http://codebutler.com/firesheep

Further on the topic of packet capture... my main interest is security (whitehat), and I like playing with the toys. I hope to make my own toys someday- maybe even someday soon.

Thought- how does firesheep deal with login via openid?

linux

http://www.tcpdump.org/

sudo tcpdump -A -i en1 tcp port 80
http://www.blogher.com/frame.php?url=http://www.engadget.com/2006/03/21/how-to-ssh-tunnels-for-secure-network-access/
http://www.engadget.com/2006/03/21/how-to-ssh-tunnels-for-secure-network-access/

Wireshark (I installed it on my Windows partition just now)

http://portforward.com/networking/wireshark.htm

http://wiki.wireshark.org/

Also, a link from the illustrious https://twitter.com/#!/LaMenta3

http://www.metageek.net/products/inssider

For firefox 4 protection: https://addons.mozilla.org/en-US/firefox/addon/246797/

My fav blogpost on it so far http://hossgifford.com/firesheep/

*And by playing I mean playing. I won't damage anyone's anything with this; I won't use someone's data for nefarious purposes. Yadda yadda.

PHD4: networks/machine translation (notes)

Heuristic word alignment with parallel phrases
Maria Holmqvist
Sweden. PhD student

Word alignment applications: bilingual dictionaries, computer aided translation, statistical machine translation (most likely answer)

Corpus (training sample?) - hopefully millions of sentences w/ translations.
Extract phrase translations from word-aligned texts
Estimate translation probabilities (of different interpretations)
This is unsupervised- does not require human intervention for training.

Gold standard evaluation: % correct links in sample.

Alignment with parallel phrases (Maria's method)
- uses manual alignments to improve alignment quality.
-- find common alignment patterns, match them to patterns in new text.
- generalize phrases with parts of speech
-- replace nouns with noun tag, verb with verb tag- i.e. creating grammar translators!

Limit number of part of speechtags.

Questions to answer with the research:

How does phrase-based compare with statistical alignment?

How can they be combined for good results?

Ongoing work:

comparison of the two methods

comparison of wars to combine different alignments

machine translation experiments

Q: What kind of work has Bing done on getting diverse data? Your data has been academic. How do you verify your data?

A: Verify by comparing to Gold Standard of "manually aligned"

A: On the web, can get comparable text but not parallel text. So it's hard to get and work with "real" data. But work is being done to collect more diverse data.

Q: Have you looked at what the statistical method gets wrong?

A: Infrequent words. I'm doing a deeper analysis. Problem: in Swedish, it's a compound language, so there will be lots of previously unseen words in a given chunk of text.

Ewa Musial

University at Albany, SUNY

Modeling and testing of services-oriented applications

Existing testing methods: single-tier testing (presentation tier, application tier, service tier, data tier)

New approach: choreography/orchestration testing- "web flow in application layer"

- about "Business process execution applications"

- they don't question the incompleteness of current techniques.

Problem: lack of techniques to test ~~

Test model:

~

test study 1~

test study 2:

fault detection by users. 36 test cases, 31 faults.

results:

results show that approach is effective for improving reliability of industrial projects

develop complete tools for automated testing

Q: Just java?

A: yes, but not always

Q: (from guy!) Can you characterize the general faults that you were finding?

A: Yes. People tend to test easy things. If people move, the database won't keep up.

Q: How did you make the complicated dependency graph? Can't all that change?

A: It can change. Sometimes it needs to be adjusted. During testing, the reliances change...

Fariba Khan

U of Illinois- Urbana, Champaign

Assuring network service with bandwidth and integrity-based fairness

Also, DDOS attacks.

Fair-queue- head of line blocking

IP spoofing- can't use IPs as a solution

Graph- testing packet success rate under different attack circumstances. Attack, no defense and Attack, FQ, spoofing were both ~4/100 packets getting through.

Ingress filtering is neither complete not verifiable. IP of a filtered domain can be spoofed either in the same domain or in an unfiltered domain.

Design: integrity levels, integrity token, queue.

Spoofing index table (?)

MAC integrity token

(My worry: would this make communications more tracable? Where does this interact with trueanon and cyberprivacy?)

Q: How did you develop a relationship with an ISP so they will use your algorithm?

A: Haven't yet.

Now: turn in your presentation evaluations!