Kuwait Data Bank

Introduction

 I've been pitching the idea of Kuwait National Datacenter to government officials and parliament members since 2017, in a holistic manner, covering migration of applications, learning center, audit requirements, security, ...etc. -- unfortunately, those efforts fell on deaf ears.

Fast forward to 2021, and I got the chance to work with a fantastic group of volunteers for Kuwait Foundation for  the Advancement of Science (KFAS) to create something more specific: Kuwait Data Bank -- an entity that would hold data from all of Kuwait's government entities and government-owned companies, to do Data Analytics and Data Science.

The group of volunteers comprised of multiple disciplines; experts in law, business management, organizational structure, information technology and security. A friend of mine & I were covering the information technology (IT) and security aspects.

KFAS gave us 1.5 months, that we extended to 2.5 months max to get the initial draft out, and we were done in Oct or Nov 2021. We're now in discussion with KFAS to see how to proceed & hopefully we get to see this project go live at some point!

Project Scope and Goals

We've checked regional and international open data projects, and almost all had very limited sets of samples of data, over inconsistent timespans, and sometimes one time shot kind of data only. Our project's aims are ambitious and exceed anything we've checked.

1. Initially, we'll focus on 1-5 critical reports to the Council of Ministers for decision making support.
2. Gradually, as we sanitize data, and find a source with the most truthful data (or combined sources), then we aim to make data pulling and reporting mainstream and real-time.
3. Data and reports will be available/accessible in this order:
1. Council of Ministers
2. Expand access slowly to government entities in need of help in accurate decision making
3. Universities in Kuwait
4. Public access inside of Kuwait
5. International access to data and/or reports or reporting services
4. Leverage latest technologies of graphics card acceleration and Massive Parallel Processing (MPP) databases in software (non-appliance) to keep things agile and portable.

Data Access & Analysis Methodology

1. Start slow with as few sources of data as possible to deliver the critical reports
2. Deploy data masking & replication connectors to the various databases at the sources
3. Anonymize data at the source, then replicate to our organization's repository/repositories
4. Sanitize data and compare accuracy with help from people at each data source, initally
5. Run Machine Learning models on highly parallelized data access databases
6. Produce reports or dashboards with results of multiple ML models and compare results
7. Initially, those reports will be private and delivered only to the Council of Ministers or KFAS, but gradually, the platform will expand to allow real-time access to reports, and then later, our anonymized data sources
8. Data access & reporting may be monetized to help the platform grow and become self-sustaining, in addition to providing services for companies to run analytics on their data, or using our data sets.
9. Legal aspects of data access, anonymization & privacy, and cooperation from government entities have been addressed in our report/proposal, but I'll not get into that here.

Privacy & Anonymity

1. A primary design aspect is to respect privacy and anonymize data at the source, before it's sent to our repositories/databases
2. Example: if we're to take everyone's full address, we'd remove the house number, but keep the area, and area's block number
3. If our systems get compromised, there will be no personally identifiable information (PII) that would cause personal risks
4. We believe that leaving the data masking (anonymization) in the hands of each government entity giving us access is probably the best approach, so that we will never be able to make changes to what data we receive, without manual intervention from the data sources (government entities)

There's a lot more to the project, but I'll stop here and then maybe revise things once we see how the project will move later.

It's an ambitious project, which is why we need to grow gradually and cater for specific needs that help the country's decision makers in making critical decisions and answering crucial questions, before making a decision.

No More Passwords

Too many websites have been breached in the past 24 months: 21 Sony sites, Gawker, and most recently LinkedIn. A minimum of 20 million passwords were leaked causing chaos on the Internet, from increase in spam originating from legitimate email accounts, to stolen credit cards used for money laundry from stolen emails attached to Amazon, PayPal, eBay and other online payment systems and stores.

This is an article showing what password crackers have done with all those leaked passwords; in summary: Minimal work is now needed to crack 90% of passwords in less than 24 hours!!!

Users are stupid. Fact well established thanks to all those leaks, where users have used the same password for their accounts as the email password. But, for the website developers to also be a failure in understanding proper password hashing & encryption? This is the ultimate failure that users cannot see coming until it's too late.

So why are we relying on passwords still? I own accounts at least 15 different websites and I do not like the idea of Single Sign On where one password allows me to login to all of them. That's simply insecure & risky.

The answer is very simple: We don't need passwords in general. Websites should instead offer authorization/access codes in combination to email addresses to access content. Those codes are auto generated by the website, random, long (128+ characters), and most importantly, the user does not have to input any data nor remember anything. It's important to not tie the code to any user data (salting).

The only thing that needs a password is: Email and online payment systems. Everything else should send its auth code by email. When a user wants to login, they go to their email, open the email that has the code and copy/paste it to login.

In case a website is cracked, then users aren't at risk & the website maintainers can simply regenerate all auth codes and email them to the users.

As for now, I adopted the "make a silly temp password" method. I keep forgetting passwords on purpose and every time, I reset the password and enter a new temporary and random password, until website maintainers cut the crap and ditch this password scheme.

Arab Internet Governance Forum: Preparations

Ahmad Al-Ibrahim is organizing a meeting to discuss topics and seek participants for the upcoming Internet Governance Forum event later this year.

The forum will be called "Arab Internet Governance Forum." There will be a brief about the scope here and more details will be discussed in a meeting with the bloggers.

Scope of the forum:

• Focus on discussing public policies related to internet governance especially in the areas of access, stability, security and development.
• Facilitate the exchange of information, best practices, knowledge and lessons learned by involving experts, technical community and academics.
• Gather different opinions and build consensus for harmonized Arab views on priorities and on mechanisms to respond to Arab countries needs related to internet governance issues.
• Discuss emerging issues and develop recommendations on them, as appropriate.
• Build and develop capacity in internet governance as well as improve the participation of all stakeholders to benefit from all possible resources of knowledge and expertise.
• Communicate the Arab positions globally and enhance the Arab role in formulating global internet governance policies.
• Engage in outreach with the internet governance forum and other regional IGFs with the purpose of exchanging knowledge and expertise.

IGF 2012 will be hosted in Kuwait and organized by KITS.

The main themes of the forums are:

• Access
• Openness
• Security and Privacy
• Content
• Managing Critical Internet Resources
• Youth

This preparation meeting will be held on Sunday August 5th, 2012 in KITS @ 9:30 PM.

You can invite as many people as you want, as we want this to reach all the bloggers if possible. It's important for all to know about it.

Viva's Insecure Online Payment System

Viva's website allows you to pay your bills using credit cards like VISA or MasterCard, or the regionally accepted K-Net. In the case of VISA and MasterCard, Viva pushes the data (your phone number, email, credit card number, expiration date, cvv code) in clear text, without encryption!

In any website that takes payments or has a user authentication portal, should offer a secure channel using SSL/TLS and the user sees the link starting with "https." In addition, current browsers show part of the address bar in green when the browser is able to verify that the website is secure and it is who it claims to be.

A friend was worried as she didn't see "https" in the URL, so I checked the pages' source code to see if it was sending the data in a secure channel via javascript or some other mean, without showing it in the URL, alas, it was all in the clear text.

Here's a screenshot of a sniffed packet session from my machine to viva.com.kw (94.128.1.30), while submitting the form data.

This is some of the text from the packet (I removed my personal data):

prepRechargeCreditForm%3Aholder=Mojo+Jojo&prepRechargeCreditForm%3AcardNumber=4550xxxxxxxxxxxx&prepRechargeCreditForm%3AyearList=XY&prepRechargeCreditForm%3AmonthList=XY&prepRechargeCreditForm%3Acvv2=XYZ&autoScroll=&prepRecharg

I have contacted VIVA Telecom and Mr. Salman Al-Badran (CEO) via Twitter  on Saturday Oct 1st (when I found out about the issue). Mr. Salman replied on the same day and said he'll forward it to his team. I also gave him my email address in case his team wanted to get in touch with me.

Three days later I told Mr. Salman that the problem is still there and that I'll publish my findings on my blog next Sunday (a week from reporting the issue). He replied saying it'll be fixed on Oct 6th.

[this is fixed now] I checked today (Oct 6th) and the form now redirects to a secure website (https). The address bar may not always appear in a green color; In that case, do not use the website, but instead, refresh or try again until the icon looks like this:  not like this . Description of these can be found here. (the two images were produced by Google.)

[this is fixed now] Also, it seems like the changes they made broke the form in the main page, which sends the @ sign of the email address in hex form (%40). Just change the %40 to @ and submit the form again and it'll work.

I'd like to thank Mr. Salman for his prompt response to the matter. I wish other enterprise corporates' CEOs were as attentive and interactive with the consumers as he is. I would also like to point the finger at the technical team and the audit team who let this one slip by! This is a trivial and pivotal requirement of any online payment system!


What kind of complications the insecure site would have?
An attacker in the same network as you are can capture clear text that is being sent from your machine/mobile to the website. That's why the data shows in clear text in the picture above. If the connection was secure, it would have been garbled.

If the address bar showed in red, it is still possible to attack a visitor from the same network, by altering the content that is being transmitted via insecure channels, which could lead to changing the form itself and the user would end up sending the data to a different script/page or a whole different website that the attacker crafted to collect the data.

Botamba Owns Your Twitter Account

Updated

Scroll to the bottom for the updates.

Botamba.com is a blog aggregator and it used to allow creation of users and then each user would link his/her blog(s).

I checked yesterday after a friend mentioned it redirects to twitter now, and it seems like they did changed their methodology to requiring Twitter and it asks to allow their application to access your Twitter account!!! It was based off a typical user/pass authentication previously.

What's worse is that their application gets the following permissions:

• Read tweets from your timeline (even if it's private)
• See who you follow, and follow new people
• Update your profile
• Post tweets for you

It can not do the following:

• Access your direct messages
• See your Twitter password

Why does a blog aggregator needs access to my Twitter account, see my timeline, post for me, update my profile & other privileges?! That's a massive privacy invasion, even if it provides certain ease of use for some users (to use their existing accounts).

If you did not know about this, and you've already allowed Botamba to access your account, you can deauthorize it by going to your profile settings, applications and deauhorize it from there.

So what could Botamba do?
They can get your tweets and follower list and sell that information to advertisers (currently sponsored by Zain). Advertisers can use the info to send you targeted advertisement by reading your tweets and seeing where you have been or what you liked and talked to with your friends.

How can I tell if Botamba posted on my timeline?
Some Twitter clients show the name of the program that posted on the timeline. In this picture you can see under the tweet the line "from TweetDeck." That's the name of the program and in case of Botamba, you'll see the line "from Botamba."

Solution?
Ask Botamba to NOT use Twitter for authentication & not invade your privacy (even if they *promise* they wouldn't), and ask them to put back the old user registration system, or use OpenID instead.

I'm waiting for a comment from Botamba on this issue to see what they have to say about this.

Update:
- Oct 4th: Botamba has deployed a user/pass authentication system. You can link your Twitter account but it gets read-only access to your timeline
- Oct 5th: Botamba's valid reasoning in using Twitter account-linking: If you own a public Twitter account that you'd like to be mentioned in Botamba's tweets/posts, you can link it to your account (read-only mode & only reads your public timeline). If you have a private account, you wouldn't want it to be public & tweet it, so you won't add it.

In the end, I'd like to thank Botamba for being responsive and understanding to the sensitivity of users' privacy!

SSL Certificates Stolen

The issue of DigiNotar's breach keeps getting worse; Computer World writes that over 200 SSL certificates have been generated & stolen, signed for Google, Yahoo, Mozilla, Tor Project among many others.

Google & Mozilla have updated their browsers to remove the affected certificates/invalid signatures, but in the latest build of Chrome on Linux (13.0.782.218) I still see DigiNotar as a CA.

I suggest you delete DigiNotar from all your browsers as it's not worthy of trust at the moment. Remember, if you update your browser, double check its existence as it may be added again by the update.

Websites and Account Management: Threat to Privacy

It's astonishing how many websites are still using archaic methods in storing their users' personal information.

I did stumble across a few in the past but have no recollection of them now, pretty much because I never bothered using them ever again.

The latest encounter was a few minutes ago when I went  to ChangeThis.com to vote for a manifesto. It required registration and I did register, only to find an email from them containing my password in clear text!
I followed my suspicion and changed the password, then logged out, then clicked on "Forgot password" to have them email me the password, and there it was: They sent me the password in clear text rather than a randomly generated one!!!

Why is this an issue? Simply because should one day their website gets hijacked, all registered users' passwords are visible to the attackers and since it also holds their email addresses, the attackers can try each email & password to see if it logs in or not, then collect those that were successfully logged in and sell them to SPAM networks.

Another issue is having a rogue/snoopy employee at the website trying to login to emails using the clear password.

This method of storing password is absolutely unacceptable! Websites should store hashes of the passwords and not the passwords in clear text, and when the user requests a password reset, a randomly generated one should be created, saved & served to the user.

Google's Response to Chinese Attacks

Google has finally spoken officially on the attacks on its infrastructure and the theft of intellectual property in China.

It's not clear in their response what was stolen from Google itself, but it did state that some email accounts of Human Rights activists were accessed.

For now, as a response, Google has started providing uncensored search results, which the Chinese government had mandated at the time of business negotiations in 2006.

It's yet not clear whether Google will withdraw from China, but it's a possibility.

The link above contains links to detailed reports on the attacks and responses.

Facebook Desperate For Love

After so many Facebook privacy breaches by Facebook itself, and the recent statement of its founder on how privacy is not important and everything should be publicly available, seems like Facebook is trying hard to get some back respect and love...

If privacy isn't that important, then why is its founder's profile private? The same person calling for public exposure of info... hmmm???

Note: Mark Zuckerberg (founder of Facebook) has 2 profiles: A public one (for stunts) and a private one (which got breached when they broke their own privacy rules!).

Try harder you snob.

Facebook Privacy: Friend Lists Are Public

After Facebook's new fiasco about its new "enhanced" and "simple" privacy settings, which resulted in setting most, if not all, pictures and information to be public!

What I found today is that even if you set your friend list to be private, it's still available to the public eyes, through a swift link.

To demonstrate, I'll show an example on Mark Zuckerberg, Facebook's founder.

Here's Mark's profile. As you can see, there's no friend list available to the public. but that's OK, going to this link will show the friend list! Tada!

In case they fix this problem before you can look at it, here're pictures:




The trick applies even to numeric IDs of users.

Facebook Privacy: Where Is It?

I'm new to Facebook. I didn't like it before and I still don't like it. One of the reasons that I dislike it is its weird, absurd and abusive privacy laws.

I have no apps or games lurking in my profile. I'm part of 2 groups so far. The other day I wanted to join a fan-page, and I was shocked at the message that showed up:


I simply clicked a poll asking which Operating System I use. It asked me the following:
"Allowing Poll access will let it pull your profile information, photos, your friends' info, and other content that it requires to work.
Allow or cancel"

I find it very hard to understand why a poll application needs to pull my profile along my friends'! It's a stinky poll! All it could require is my name and whatever public information I've opted to share.

The fact that Facebook defaults to leaving every privacy option set to Public isn't enough deter people apparently.

I should note that even when you leave the fan-page, game or application, your information is still retained by the maintainers of that application. It is not deleted!

I haven't joined any games, and will not, because of such absurd privacy violations. Maybe if people paid enough attention, Facebook would actually do something about it. Hopefully. One day. Eventually?