Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Regular readers of Naked Security will know that I have some strong feelings about timestamps in logfiles.
In particular, the ambiguities created by logfiles based on local time - which is subject to local timezone regulations and changes - can work against your security interests.
Here's one reason why:
"..Don't let year-ends, timezones, daylight saving changes or varying local conventions confuse your logs. If you suffer a breach, you will almost certainly want to put together an irrefutable historical sequence of events, based on your system logs, possibly from many systems and many locations.."
Local time can confuse even local residents, let alone outsiders trying to make sense of unqualified timestamps in logfiles some time after the event.
For example, in New South Wales, Australia, there are three official timezones: one for the far west of the state, 1000km inland; one for the bulk of the mainland; and a third for Lord Howe Island, 700km to the east of Sydney. And there are two different increments for daylight savings: one hour for most of us; but just half an hour for Lord Howe.
Furthermore, the Government of New South Wales has made three legislative tweaks to local time in the past six years: a switch from GMT to UTC in 2005; a temporary change to daylight savings for the Commonwealth Games in 2006; and a long-term change to prolong daylight savings in 2007.
Confused?
Don't be, because all of this is as nothing compared to what is going to happen in Samoa and the nearby New Zealand dependency of Tokelau tomorrow.
Or, to put it another way, the day after tomorrow.
As I write this, it's 1pm on Friday 30 December 2011 in Sydney. It's 2pm in Samoa, and 3pm in New Zealand.
That sounds pretty convenient, considering that the majority of Samoan expatriates live in New Zealand and Australia, and that the three countries have strong business and sporting ties.
Except that it's only Thursday 29 December in Samoa. Back in 1892, Samoa did quite a bit of trade with Hawaii and California, so it made sense to decide to be twelve hours behind Greenwich, rather than 12 hours ahead. (Hawaii is UTC-10; California is UTC-8 or UTC-7.)
But in the 21st century, being the most westerly country in the world has become a huge business pain to Samoans when it comes to dealing with Australia and New Zealand, since our weekends don't line up.
By Friday, Samoans trying to wrap up the week's business can no longer get hold of their counterparts across the South Pacific - we're all at the beach, at the shopping mall, or in the pub. And to contact us early on Monday to catch up, the Samoans have to work on their Sunday.
So the Samoan legislature has taken a surprisingly simple, but astonishingly bold, step. At midnight tonight, the country will make a timezone adjustment, switching from UTC-12 to UTC+12. Figuratively, at least, Samoa will jump from one side of the world to the other.
Clocks won't change at all. Just the calendar will.
Simply put, there will be no Friday 30 December 2011 in Samoa.
How funky is that?
(Samoa is surprisingly good at low-fuss but potentially high-impact bureaucratic change. In 1997, the country changed its name from Western Samoa; in 2009, it switched from driving on the right to driving on the left, as does most of the South Pacific; and in 2011, it will calmly skip an entire day.)
Let this remind you once again why standardised and unambiguous timestamps are vital in logfiles, and take a moment to revisit RFC3339: Date and Time on the Internet: Timestamps.
As I wrote back at the start of 2010:
"..Without reliable logs, you are unlikely to understand [a security] breach, which makes it harder to prevent it happening again. Without reliable logs, you are unlikely to be able to prove your case against the perpetrator, if you are even able to get anyone in your sights. And without reliable and consistent logs, you might not even spot breaches in the first place.."
To everyone in Samoa and Tokelau - Happy New Year! This time, we can celebrate together. And remember this: tomorrow, footy season will be two days closer, not one.
Follow @duckblog
-
Global websites 
Press 
Naked SecuritySkip to contentSearch for:
MalwareSpamSocial networksData lossLaw & OrderApplePodcastVideoMoreAbout Lax security blamed for 100,000+ sensitive files found on Manning's PCNaked Security wishes you great holidays SSCC 78 - IE 9 upgrades, Android malware, Carrier IQ and hospital shut down from malware
I am pleased to have a new guest on the Chet Chat this week, Gary Korhonen. Gary is a Global Escalation Support Engineer working in our Vancouver office.
Carrier IQ clears the air on spying allegations
Carrier IQ snoops on US cell users - Spyware or service monitoring tool?
Malware shuts down hospital near Atlanta, Georgia
Android malware clean-up exposes reliance on mobile carriers to push out updatesOne Response to SSCC 78 - IE 9 upgrades, Android malware, Carrier IQ and hospital shut down from malware
Sigh Man says:December 22, 2011 at 8:02 pm
About the authorChester Wisniewski is a Senior Security Advisor at Sophos Canada. He provides advice and insight into the latest threats for security and IT professionals with the goal of providing clear guidance on complex topics.You can follow Chester on Twitter as @chetwisniewski or send him an email at chesterw@sophos.com.
Free coffee from Starbucks and Tim Hortons? No, it's a Facebook scam
Facebook's ticker privacy scare, and what you should do about it
Want to see who has viewed your Facebook profile? Take care..
Most Wi-Fi routers susceptible to hacking through security feature
Free Costco Gift Card for all Facebook users? Scam spreads quickly
Data leaks at Stratfor and Care2 mark the end of a year riddled with data theft
Samoa moves to the other side of the world - and misses a day!
HMRC phishing scam promises end of year refund
Large percentage of websites vulnerable to HashDoS denial of service attack
Carrier IQ clears the air on spying allegations
Carrier IQ snoops on US cell users - Spyware or service monitoring tool?
Malware shuts down hospital near Atlanta, Georgia
Android malware clean-up exposes reliance on mobile carriers to push out updatesVideo posts
VIDEO: How to solve the #dragontattoo #sophospuzzle![Typosquatting - study reveals the real risks when you mistype a website's name [VIDEO]](http://sophosnews.files.wordpress.com/2011/12/typing-keyboard-thumb1.jpg?w=75&h=75&crop=1 "Typosquatting - study reveals the real risks when you mistype a website's name [VIDEO]")
Typosquatting - study reveals the real risks when you mistype a website's name [VIDEO]
Identify your missing security patches this Christmas
VIDEO: Awkward! Facebook VP stumped by BBC question
IHC, Mac malware, Nerd New Year, Conficker and Privacy à la Google - 60 Sec SecurityTwitter Feedgcluley: Facebook distributing White Hat Debit Card to Bug Bounty Winners http://t.co/MToOc2gmabout 1 hour agogcluley: Which passwords should you share with your girlfriend? http://t.co/AR8zNYoX Some interesting responses..about 4 hours agogcluley: Anonymous imposters: hiding behind the AntiSec identity http://t.co/VxaK2lOUabout 4 hours agogcluley: Hackers may have accessed Gordon Brown's emails http://t.co/czvtbH2Yabout 6 hours ago
We are slowly winding down for the Christmas break, and we wanted to thank you, our lovely readers and commentators, for all your help throughout the year. 
Researchers presented information on a long standing vulnerability in most web application frameworks at today's 28c3 (28th Chaos Communication Congress) security conference in Berlin, Germany, Earth, Milky Way.
Emails are currently circulating that purport to be sent by the UK tax organization HM Revenue & Customs (HMRC). These e-mails claim that the recipient is eligible to receive a tax refund and that he or she must download an attached file and open it in a browser. 
Stefan Viehböck, an independent security researcher, published a paper on Boxing Day titled "Brute forcing Wi-Fi Protected Setup" to his WordPress blog disclosing a weakness in the configuration of most consumer/SoHo Wi-Fi routers.
The PIN used for authentication is only eight digits which would give the appearance of 108 (100,000,000) possibilities. It turns out the last digit is just a checksum, which takes us down to 107 (10,000,000) combinations.
Was 2011 the year of the data leak? Could be, but it is hard to tell. 
You can listen to my thoughts on 2011 alongside John Moe, Jonathan Zittrain, Susan Crawford and Danah Boyd in this four minute podcast.
The number of records stolen was enormous. Sony alone was hacked more than 20 times and lost over 100 million records.
Citibank credit cards users had card information compromised affecting more than 200,000 people as well as customers of handmade cosmetics company Lush.
Rather than storing passwords as a salted cryptographic hash that would not reveal their customers passwords if stolen (or make it much more difficult) they are storing them either in plaintext or in a reversible format.
Ten tips for protecting sensitive data in your organisation
What can you learn from the deluge of data leakage news?
BP in troubled waters over Gulf oil spill data spill
Three men charged in 130 million credit card identity theft2 Responses to Data leaks at Stratfor and Care2 mark the end of a year riddled with data theft
Jon W says:December 30, 2011 at 11:17 pm
jessi slaughter says:December 31, 2011 at 4:18 am
Ten tips for protecting sensitive data in your organisation
What can you learn from the deluge of data leakage news?
BP in troubled waters over Gulf oil spill data spill
Three men charged in 130 million credit card identity theftVideo posts