SWAT team raids wrong home in open WiFi network cock-up [VIDEO]

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Is your home WiFi network left open for anyone to use? Maybe this staggering story from America will make you think twice as to whether that's a good idea.

After spotting threats posted online, a heavily-armed police SWAT team broke down the door of a house in Evansville, Indiana, smashed windows and tossed a flashbang stun grenade into the living room where an eighteen-year-old girl and her grandmother were watching the Food Network.

Can you imagine how terrifying it must have felt to have been in that room when the grenade was thrown in, and the house stormed by police with their guns drawn?

Oh, and just a small detail - the police had the wrong house. The home had an open WiFi connection, which meant that it could be used from an outside location.

The dramatic events were helpfully captured on video, as the police had invited the local news station to record the raid (presumably their intention was to show themselves in a good light, rather than making a massive goof).

I'm not American, and don't live in America, so maybe you think I'm not entitled to ask this question, but I'm going to ask it anyway: What on earth is going on? Has the world gone entirely barking mad?

Okay, that out of the way - let's get on with the story...

The somewhat rattled Stephanie Milan and her family were released without charge once the mix-up became obvious, and police looked further afield for the culprit who had posted messages like the following online:

"Cops beware! I'm proud of my country but I hate police of any kind. I have explosives :) made in America. Evansville will feel my pain."

With a second suspect identified at a different house on the same street, police took a more softly-softly approach. This time not using a SWAT team or grenades, but instead using the tried-and-trusted traditional method of knocking on the door.

You would like to imagine that the authorities understand that many people still have poorly secured WiFi networks in their home, which can easily be exploited by people causing mischief, sending pornographic spam or even terrorist-related emails.

The Milans' door and window are now being repaired at the city's expense. And presumably the family are taking steps to secure their WiFi connection.

Follow @gcluley

Hat-tip: Ars Technica

SWAT team image courtesy of Shutterstock.

View the original article here

Facebook cookie complaints get the wrong end of the stick

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

The news wires are awash with stories about Facebook, cookies and privacy. The source of all this concern seems to be an article written by self-proclaimed "serial entrepreneur, writer and hacker" Nik Cubrilovic of Wollongong, New South Wales, Australia.

(Old-school network hackers will no doubt remember Wollongong from the University of Wollongong's eponymous and once-widespread TCP/IP software stack.

Newer-school hackers will remember Wollongong as the home of Ashley Towns, author of the first in-the-wild iPhone virus.)

Cubrilovic has enjoyed dramatic media success with his concerns about Facebook cookies, but I think he's been barking up the wrong tree.

The criticisms he makes against Facebook could - and perhaps should, though I don't intend to argue that issue here - be levelled against any website operator that sets long-lived cookies aimed at identifying repeat visitors.

Indeed, cookies are text-based key-value data pairs which are included in HTTP traffic precisely so that web servers can keep track of a a user's browsing session.

By design, HTTP is a stateless protocol. So, if you visit my web page twice in a row, those two requests are entirely independent.

By setting a unique cookie in your browser, which your browser will insert into all subsequent request headers, I can tie those two requests together on my server.

I might not know your identity, but I know it's the same person - or at least the same browser on the same PC - coming back for more. So I can target the content I serve based on your previous browsing history. It might not be you, but it very probably is.

Cookies also permit the concept of a website login: the cookie very conveniently acts as a temporary access ticket to your account, so you don't need to resubmit your login information on every page.

Cubrilovic's critique of Facebook cookies seems to boil down to this: when you login, Facebook sets a bunch of cookies which identify your user ID and authenticate you to act as that user for the current session.

But when you logout, Facebook doesn't unset all of the cookies set at login, so - argues Cubrilovic - you continue to identify yourself to Facebook in all subsequent traffic, even after you've logged out.

So what?

Any website which sets a long-lived unique cookie when you first visit the site can do just the same thing.

Try visiting Apple's website, for example. (I don't mean to criticise Apple, just to pick them as an example because I'm an Apple user, and I have an AppleID.)

On your first visit, Apple will set a browser cookie called s_vi, valid for five years, containing a random-looking string of hexadecimal digits. The value of this cookie is - at least as far as I can tell - unique to each brand-new visitor.

So, next time you login with your AppleID, Apple's backend systems can now tie your general-purpose s_vi cookie to your AppleID.

In other words, Apple "knows" who you are every time you subsequently visit using the same browser on the same PC, even if you never log in again. (More precisely, Apple knows who last logged in to its site from your browser, which very likely was you.)

Cubrilovic has therefore rediscovered that long-lived anonymous cookies, once they've been associated with an exact identity, stop being anonymous.

So, if you're worried about this sort of thing, routinely delete all cookies from your browser. This means that you dispose of all your no-longer-anonymous cookies.

Your favourite websites will no longer have cookie-based history about you, so you'll get newly-generated anonymous cookies next time you visit each of those sites.

Most browsers - Firefox, Chrome, Opera and Internet Explorer, for instance - have an "automatically delete cookies on exit" option. I recommend using it: you don't have to keep remembering to delete old cookies by hand.

Follow @duckblog

View the original article here