Jason Brome

Not the most interesting blog posting title, is it?

Anyway, the reason for the aforementioned title is that I just upgraded at work to a new laptop, a Lenovo (nee IBM) Thinkpad. One of the issues I hit while setting it up is that the ThinkVantage System Update utility repeatedly failed to work, reporting ‘Unable to connect to package content server.’

After a quick install and run of Ethereal, the culprit turned out to be the System Update utility, which attempts to download package information from a remote server on port 7618. Our firewall here at work is pretty restrictive when it comes to outbound access on non-standard ports, and therefore it was blocking access to the remote package server, resulting in the error. A tweak of the firewall rules by our local friendly firewall administrator, and I was in business. The laptop is now happily downloading updates as I type.

I have yet to really get to grips with the new machine, but is definitely a big step up from my previous laptop, a Compaq Evo 1GHz, and I am looking forward to a speedier work environment!

Caller ID has been compromised. No longer do you have the assurance that the number displayed on your ringing telephone actually represents the person on the other end of the line.

With the advent of so-called Caller ID spoofing services, anyone with a credit card can initiate outbound calls with the Caller ID of their choice. Aside from the fact that these services easily allow anyone to compromise the integrity of the Caller ID service, they also open up a number of critical security concerns across different voice-based systems.

Logging into my cellphone website account today, I noticed a security alert for the voicemail system. My provider’s voicemail system has an option to bypass the requirement to enter your PIN if you’re calling from your own cellphone. Hackers have been able to access the voicemail accounts of others through exploiting this ‘feature’. If you have a cellphone voicemail account, you really should consider enabling PIN-based authentication.

Think about the other types of systems today that use Caller ID for authentication. Caller ID spoofing will have a big impact on all of these if it is the sole authentication token. Here’s another example: Recently I received a replacement debit card, and, when I made the call to enable the card, it confirmed that it had matched my telephone number to the number on file and would not require any further confirmation. This is scary – banking institutions should seriously reconsider the authentication model used for new card enablement.

I’m not completely familiar with the intricacies of the switching network (SS7 et. al.), however I do hope that some steps are taken to restore integrity to the network. Caller ID is a useful feature, but, with the advent of spoofing services, its value has diminished.

Today I had my first experience with Greasemonkey. For those of you who have yet to come across it, Greasemonkey is a Firefox extension that opens up a whole new realm of client-side website personalization opportunities.

Greasemonkey enables the execution of user-written scripts against any webpage. These scripts can interact with the webpage, look-up external content, and literally perform any type of modification.

The first example I tried was Adrian Holovaty’s Chicago Transit Authority map on Google Maps. This script seamlessly adds a third option to Google Maps. Now, in addition to Map and Satellite options in the top right corner, an option for CTA map is added. With the map pointing to Chicago, clicking on CTA map replaces the existing map with the layout of the Chicago Transit tracks. Anyone going to build one for the NYC MTA?

There’s already a long list of canned scripts available from the Greasemonkey script repository. Another interesting script is Jon Udell’s Library Lookup. He modified his existing bookmarklet to rewrite Amazon book pages. Now, while browsing books at Amazon, the Greasemonkey script goes out in the background to your library’s online database and checks for availability. Awesome integration!

Now, it makes me think that I should get around to writing a Greasemonkey quickSub script. This would rewrite any links to RSS/Atom feeds so that they included the appropriate URL to enable subscription against a user’s desktop or web-based aggregator. Any interest?

Congratulations to Daniel and the team at under[de]construction for the v1.0 release of SWIM. SWIM provides a very innovative approach to Content Management, without the complexity of traditional solutions. You can read more about SWIM in the post over on Daniel’s blog.