Jalaj P. Jha Technical & Miscellaneous Ramblings

14Feb/090




Locked Systems are meant to be locked, not rebooted…

If you are working in a office where security is taken seriously, this screenshot should not be new to you. If you are leaving your system, just press ‘ctrl+alt+delete’ and ‘enter’ and your system will get locked to open again only if you put in your password.

The computer is in use and has been locked.

Once I was busy with my project nearly finished with the testing phase. Just when I was expecting a call mentioning testing is over, I got to hear something totally different. I was told that testing team is receiving error.

Everything had gone smoothly so far, how could it be possible that it is erring at the last stage. Puzzled I moved to the area where systems that were part of testing environment were located, and found that a guy unable to find hostname of one of the three machines in testing environment, due to machine being locked and showing above message, had forced the machine to shut down. Doing so enabled him to start the system again and get the hostname using his own login password.

I told him not to do such things without informing others in the team, as some time critical tasks may get delayed. Then I got him to log off and sat down to restart all the services that were required for testing to start again, only to find that something had broken down. Next 30-40 minutes I sat there trying to get system up again with anxiety building up as time passed. At last things settled down to normal.

Hope you are not someone bearing resemblance to that guy, who despite knowing the name of the person who locked the system (gets mentioned in the message “only <name> or an administrator can…”) and asking him to unlock, chose other way… Remember “Locked Systems are meant to be Locked” don’t force it to open unless you have the key.

10Feb/093




How to Create Private Yahoo Pipes?

Officially there are no Private Yahoo Pipes! All Pipes that you create can be seen and cloned by any other Yahoo Pipes user, if they know about it, that is they know its address or the pipe id associated with each pipe. So if you want to keep a Pipes created at Yahoo Pipes private you can do that by :

  • Not Publishing the Pipe
    You can always use your pipe even if it is not published. Publishing a pipe just means that your pipe becomes the part of the pipes directory which all users can access. If a pipe is published there is every chance that it is discovered by others by search string, modules used in it etc. Using your pipe without publishing keeps you safe on this front.
  • Embedding RSS feeds online taking care that the Pipes ID is not revealed
    If you are embedding RSS feeds created by you Yahoo Pipes, make sure that the pipe id is not revealed as a link or in the source code of the page. For example if you embed RSS feed in RSS module available in Blogger your pipe id doesn’t show up anywhere but on a wordpress.com blog an RSS link reveals the pipe url (and thus id) by which anybody can clone the pipe. Take care when you do that and check source code of generated page too.
  • Not embedding or linking or using the pipe on other unsecured pipes.
    Pipes can be embedded in other pipes or RSS feeds from pipes retrieved in other pipes. Don’t do with the pipe that you want to keep secure. If the pipes that linked to it or embedded it goes into others’ hands your private pipe is exposed. So if  a pipe uses your private pipe, it to needs to be kept with same security as with this one.
  • Not sharing it with anybody else.
    Your pipes is just for you. If you want to keep the source code of pipe private but want to share its functionality with others, you have no chance. As soon as you share your pipe with someone you have exposed the source.

Thanks for patiently reading to this point. Now we start with the unofficial way to create a Private Yahoo Pipe. Yes there is a way!

All we need to do is to create one extra pipe for each pipe that you need to publish or share or embed. We would henceforth call this extra pipe as PipeShield. The PipeShield itself can be published or shared or embedded.

Let’s say I want to secure my Google Trends Scraper pipe, which takes one user input and generates output based on it.

image

We will create a new yahoo pipe, but before that run the above yahoo pipe and get the RSS output url as given in the link ‘Get as RSS’

image

Create a new Yahoo Pipe and insert a ‘URL Builder’ module. Paste the url that you got from the previous step into the textbox provided alongside label ‘Base:’. As soon as you press ‘Tab’ button all query parameters present in the url will switch their position.

image

Insert a ‘Fetch Feed’ module and make it to take url from the url builder module and link to output module.

image

Now since the pipe that we are shielding here took a user input ‘Date’ so we will need to do same here to. So, add a ‘Text Input’ field and wire it to date field in ‘URL Builder’

image

Now we have a functional pipe that forms a wrapper around original pipe, but the original pipe is still not secure as its pipe id is visible, in the parameter ‘_id’ of the URL Builder. Here is the final step.

Add a ‘Private Text Input’ module, fill its default value from the value in _id field, check the ‘Private’ checkbox, clear the _id field and make it to take value from Private Text Input module.

image 

Save the pipe and distribute it to all you know and those you don’t without fear of exposing the original pipe and the functions/secrets it carried. This pipeshield will show the value in the ‘Private Text Input’ only to you. Everyone else will see the field blank. Others will not be able to run the pipeshield in Edit mode and thus cannot debug the pipe id, they cannot clone the pipeshield otherwise its link with the underlying pipe will break and the pipeshield will become non-functional. Others can just run the pipe and get the results! Once you have distributed your pipeshield you can rest assured that your original pipe is always.

You can check this pipe in edit mode here. Watch my page on Yahoo Pipes for more pipes. All posts on Yahoo Pipes on this blog will share this archive url

20Feb/088




Email Forward related to Osama Bin Laden Virus

When will people learn to be careful?

Not long ago I had posted "Email forwarding - All Fun and No Responsibility ?" which carried several examples where people received forwarded mails, which they in their turn forwarded again, not caring to probe if the information contained is true or not.

Today I received yet another mail which began with an extra large heading (all in CAPS) "Please read below and pass on as soon as possible." Don't ever do that... take time... verify the information... and then if you feel like forwarding, pass it on.

Below it was a letter with a logo and address of Australian Federal Police advising not to open attachment contained in certain email moving around the net bearing picture of Osama Bin Laden being hanged. It later says that if the attachment is opened the system will crash and cannot be fixed. All this was followed by a request to forward this mail to everyone you know "as soon as possible". The shocking thing here was that all the content mentioned here was not in text form but in the form of a single image (this prevents the mail from being filtered by mail servers as spam are identified by checking the text content and cannot read text from images).

Now what you could have done to identify if the mail is real or spam. Check for "Australian Federal Police" on Google and you would know that www.afp.gov.au is their official site. Now fire query "site:www.afp.gov.au osama virus", idea behind this is that if "Australian Federal Police" actually sent the mail with "forward asap" priority then the same should also be available on their site. Doing so you will get to know that no such thing was published. A page (https://www.afp.gov.au/about/publications/platypus_magazine/december_1999/terror.html), however published in 1999 contained words 'Osama' and 'Virus', but that was not the content we are searching for.

Now you can fire a generic query for "Osama Virus" and you will get to know from various pages that the mail in circulation is just a Hoax and even the authority varied in some mail (Israeli Police instead of Australian Federal Police)...

Now if yuou knew all these things will you forward the mail?

4Dec/070




Tweaking Registry for Windows Media Center

Windows Media Center is an application aimed at the Home segment and catering various entertainment facilities as Television, Radio, Streaming Video and so on. It made its first appearance with Windows XP Media Center Edition. Business houses are unlikely to purchase this edition as it's name only suggests that it is unsuitable for business purposes. But what about "Windows Vista Ultimate", it too includes Windows Media Center though this is not apparent from its name.