So I’ve unpacked enough to set up my “office” in the apartment and crank up the ol’ PC.  So now I can get around to writing on my blog once more.  Huzzah!

Which brings us to the first topic on my mind then, AT&T U-Verse.  What is it?  Is it all that it’s cracked up to be?

Well, AT&T U-Verse is basically just your every day cable/internet/phone bundle from AT&T.  It’s “fiber optic”.  Which basically means DSL in fancy-speak.  Yep, ye olde phone line is what powers U-Verse.  And your cable channels?  IPTV of course!  At least that’s near as I can figure anyway.  I didn’t opt for the phone option, as my cellphone is sorely underutilized as it is, so I don’t know if U-Verse uses VOIP or honest to goodness regular analog phone like old DSL options did.  Either way doesn’t much matter.  The point is thanks to companies like Tektronix, we’re able to find ways to push crappy old lines to data rates never even remotely dreamed of.  That crappy old DSL technology that couldn’t even remotely compete with cable … now can!

Mostly.

First, the caveat.  The setup in my apartment is not ideal.  Let me just say that my apartment complex, The Landmark at Hatchery Hill, has been somewhat less than ideal so far in that the apartment has a plethora of niggling problems and so far hasn’t even acknowledged that they should maybe get around to fixing any of the problems on the move-in checklist.  The apartment manager happily checked off the whole list as all ok, only for us to find 36 real issues.  From cosmetic “small hole in wall” type things, to water damage, mildew damage, shower door problems, phone jack broken, missing screws in electrical covers, etc.  Some things we’ve fixed ourselves out of necessity.  Everything else is a nuisance, but “livable”.  One such obvious hindrance is that broken phone jack in the living room, where our main TV is, not to mention my “office” where both my wife’s computer and my own reside.  So the primary TV and internet usage is in the room with the broken phone line on what is essentially a DSL-based service.  It brings out both the good and the bad of AT&T-s U-Verse.

That caveat stated, first let’s look at the good:  AT&T was able to provide us with a wireless setup.  I don’t just mean Wi-Fi.  I mean a wireless TV signal as well.  The secondary TV in the bedroom is actually set up as primary TV as far as AT&T is concerned.  It gets the wireless router with built in DSL modem.  And it gets the actual DVR.  And to connect to the living room box, it gets a wireless TV antenna connected via ethernet cable to the router.

In the living room we get a wireless TV box that takes that wireless TV signal (effectively one heck of a good wireless router system I guess, on a different bandwidth I hope) and gives us TV.  As a fortuitous surprise, the wireless TV box in the living room also has a network port which I have successfully glommed all of our living room’s networking off of!  I wasn’t expecting that, but it’s been a life-saver since the wireless router has to be in the bedroom in this broken-jacked apartment.  (At least until maintenance finally gets around to doing something about it.)  And that all works.  (Though I have not tested the networking speeds.  They seem quite good, which again suggests that this isn’t a simple Wi-Fi system delivering the wireless TV signal.)

And, like any modern system, you can access your recorded shows on your DVR from the other boxes as well.  So that’s something.

The TV boxes are pretty good in theory.  They have HDMI jacks and even component and composite wires and stereo analog and optical digital audio.  They have coax.  Great!

Now, the less-than-good and the bad.

Yes, the TV boxes all support High Definition.  Almost.  It’s everything that you could ask for in a box, really.  …Except 1. no pass-through and 2. no 1080p.  You read that right, in this day and age, where HD can practically be taken for granted because the standard is so old by now, and we’re all wondering when the next iteration of HD is coming, AT&T limits you to 1080i at best.  That’s pretty sad.  Not life-endingly sad, but certainly not the best technology can offer … has been offering for many years now.  I suspect this is how AT&T broadcasts their HD signals, so even if the box supported 1080p you’d still be stuck with a 1080i signal.  I have no proof, but that’s my guess.  It does significantly cut down the bandwidth after all, even if it is a less-than-ideal technology.

Speaking of substandard technologies, so is AT&T’s wireless router.  It’s an IEEE 802.11 b/g standard with minimal security.  Yes, you read that right.  My personal ancient router is a b/g/n, and AT&T is still pushing g as their standard?  Not only that, but my ancient router has real firewall feature built in and takes security seriously.  AT&T’s router?  Not so much.  So that’s why I have (and likely will keep it that way) my own router as the main point of connection for all of my PCs, wired and wireless.

And while it’s been claimed that we can watch four shows at once, that simply isn’t true.  DVR three HD shows for the same time slot and the thing wigs out and forces us to switch to viewing one of those three shows – at the recording.  It doesn’t even let us watch the channel that it’s recording like my old crappy Frontier cable box would let us do simply at the press of a button.  It forces us to switch to the DVR and watch the recorded show.  Three.  Not four.  Three.

And now for the real kicker, how does AT&T’s wireless TV connection handle every-day life?  Not flawlessly, that’s for sure.  Even with all bars allegedly present, indicating the best possible signal strength, AT&T’s wireless U-Verse TV is … flawed.  It likes to just plain drop its connection on average of once a day.  And I don’t just mean skip for a second.  I don’t mean lag.  I mean flat out FUBAR drop to where the box, after a minute of no signal, finally reboots itself.  (Or if you’re impatient, you get up and yank the power cable out of it to hard-boot it because the box completely stops responding during this time so you can’t soft-boot it.)  Thank goodness this isn’t the DVR!

It did that before I even had my own wireless router plugged in.  Before anything was even using the network at all actually.  Just pure TV, epically failing once a day.  And for the record, those other lags and brief second-long drops happen too, much more regularly.  You’d think you were on an ancient satellite TV system, you get so many flaws.  The only reason that I put up with it instead of cancelling the service is because eventually, when the apartment complex finally fixes my phone jack, I’ll be switching the boxes around so that the wired TV is in the living room and the awful wireless TV signal will be for the rarely used bedroom TV set.

And then there are all of the weird eccentricities.  For example, the channel guide is neither color coded, nor even bothers to show you when a program is “new”.  It must know it somehow, since the DVR can be set to record only first showings, but you’ll never find any kind of indicator that a show is either new or a re-run.  The preview of the channel as you use the channel guide is theoretically a good idea … except that it lags moving on to the next channel until each and every channel has loaded, making it very slow and painful to scroll through channels.  A simple programming change to delay the preview of a channel until you’ve rested on a choice for a second could miraculously solve that dilemma.  There’s no way to set the default recording behavior of the DVR and AT&T’s default settings are not what I would have thought anyone, let alone myself, would want as a default.  And so on and so forth.  It’s just a lot of poor design.

Conclusion?

So, there you have it.  AT&T’s U-Verse is not cable.  It’s throwing a lot of technology at an age-old problem, that phone lines just don’t carry enough bandwidth.  And a lot of that technology is cutting a few too many corners.  AT&T has come up with an “okay” solution.  It’s not awe-inspiring.  It’s barely keeping up with the Joneses.  It’s not 1080P.  The wireless router is cheap crap.  The wireless TV makes you feel like you’ve got unreliable satellite even at its best connection strength.  The box/DVR software has some less-than-ideal design that makes some things awkward to use.  In all, everything about it only just barely does the job adequately.  But, that said, it does the job … just.  I’d give it a 3 unusable phone jacks out of 5.

It’s rare to see a serious security issue when Linux and Unix are involved, but there’s certainly one spreading, at it’s aimed not at your computer, but at your router.

Posing as an ELF (Executable and Linkable Format) file, this malware performs a brute force attack against your *nix-based router to crack your router’s username and password so that it can change your router’s settings, install a backdoor for IRC control from unsavory servers, and, well, you get the idea.  Bad bad bad.

Known affected routers so far seem to just be the D-Link DWL-900AP+ Internet router, but others could still be affected.

In computers we trust.

But the funny thing is, we shouldn’t.  We really really shouldn’t.

So what’s the latest in security news to remind us how insecure computers can be?  Right.  Let’s get crackin’…

Gone in 60 Seconds, WPA Key On A Silver Platter:

To start with, let’s hear it for wireless networking!  Never has hacking been easier.  You don’t even need to connect a wire.  Often, you don’t even need to be in the building.  Just drive by, park nearby, walk along with a laptop, whatever your evil little heart desires, and you can begin the computer equivalent of breaking and entering at your convenience with no real worry of strange looks or calls to security.  That in itself makes wireless networking so very dangerous.  But then there’s the encryption protocols…

The absolute worst, most rubbish ever to use, would be WEP.  Don’t even touch it.  If you think you’re secure using WEP you might as well just not even bother trying.  Now WPA was at least  better.  Key word here however is “was”.  As in past-tense.  Yes, that’s right.  A system of hacking WPA was developed by Toshihiro Ohigashi of Hiroshima University and Masakatu Morii of Kobe University that is based on the established Becks-Tews method and can hack WPA in as little as one single minute.  Yes.  Sixty seconds or less and your WPA key is handed over on a silver platter.  This is of news because one of the formerly best hacks of WPA, the aforementioned Becks-Tews method, takes more than ten minutes.  You can look deeper into these methods if you care to, but the simple point is WPA is dead to us.  As dead as WEP.  Now the minimum to be secure wirelessly is WPA2.  Which, being old itself, you should have been using already anyway.

Hot List – Snow Leopard Insecurities:

So you just upgraded your Mac to Snow Leopard, Apple’s latest Mac OS X.  Congratulations!  But did you know that Show Leopard comes with an older version of Adobe Flash?  Yes, that’s right.  Even if you had upgraded to the latest and safest version from Adobe before (which would be 10.0.32.18 at the time of writing), you’re downgraded now.  Back to version 10.0.23.1.  And that means exposure to old exploits and attacks on your shiny new and “secure” Mac.  All without a hint of warning from Apple.  Isn’t that nice of them?  So if you upgraded to Snow Leopard, be sure that one of the first things that you do is update your Adobe Flash … again.

But that’s not all.  Oh no.  Apple’s far too unconcerned with security for that.  Apple has kindly included malware protection built in to Snow Leopard.  (Why is it when Microsoft does this, it’s anticompetitive, but when anyone else does it, it’s heralded as genius?)  Which you’d think is good.  Bundled protection means more people are safe.  If you download and install some Big Nasty Snow Leopard pops up a warning and recommends that you toss it in the Trash before it harms your computer.  How nice.  It sounds good, except that so far Apple’s protection is very … limited.  It hardly identifies any baddies at all.  And this is the problem, because it lulls you into a false feeling of security.  You’re protected, right?  Wrong!  So until Apple does a much better job of identifying malware it is highly suggested that you also install your own protection software.

Microsoft IE – Something Rotten in Denmark England:

And speaking of Microsoft and bundling, Microsoft’s SmartScreen Filter, built/bundled into Internet Explorer 7 and 8, has decided to protect a lot of folks from those dangerous blokes across the pond by blacklisting every uk.com top level domain!  Um, come again?  Yes, that’s right.  To protect you from phishing attacks, IE blocks Blighty.  As one would imagine, this has caused a great deal of problems and phone calls from concerned web surfers over there.  Of course Microsoft fixed things fairly quickly.  After all, blacklisting entire countries on a whim is kind of bad press.  But it just goes to show, sometimes “security” works as much against you as it does for you.

O2- Something Else Rotten in Denmark England:

Customers of O2, a British internet service provider, may want to disconnect.  O2 has been handing their customers faulty routers.  The O2 Wireless Box II (a rebranded Thomson TG585) and the O2 Wireless Box III (a rebranded Thomson TG585n) are vulnerable to cross-site request forgery (CSRF) attacks, allowing pretty much anyone to easily log into your router itself, at will, no questions asked.  This in turn lets them steal your encryption key, even if you use WPA2, and do all sorts of other not-so-nice things to your computer.  Needless to say, this is bad.  But after badgering O2 about it, security champion Paul Mutton has finally convinced O2 that it actually is a problem.  And O2 has promised to look into it and remedy as necessary.  If you’re an O2 customer, make sure you keep on top of this, as at-will hijacking of your router is A Bad Thing.

World of Warcraft – Gone Phishing Again?:

Yes, same as always then.  The official Blizzard WoW forums are being used to distribute malware to steal your passwords, blah blah blah.  If you play World of Warcraft and have somehow not heard of all of the phishing and malware trying to steal your account information so that hackers can sell your loot for real money, then you must be oblivious.  To everyone else, same s___, different day.  This latest phish is pretending to offer you exclusive access to a new service.  Just click on their invitation, bend over, and take it from  behind.  I guess these things must work, because hackers keep doing them.  But honestly, if there isn’t a group of people that should be extremely aware of security by now…  Welcome to the World of Phishcraft.

What’s This?  Good News?  Google Polishes Chrome:

If you use the newest web browser darling, Google Chrome, then congratulations, you’ve got a patch to fix a couple of severe vulnerabilities.  The update to 2.0.172.43 protects you from a known attack on Google’s V8 JavaScript engine, and from a known attack on webpages using XML-encoded information.  If you  haven’t patched your Chrome yet, it is highly recommended.

Well, that’s it for now.  Be wary.  Be safe.

There’s a new worm spreading fear and panic across the world wide web.  Well … okay, maybe that was a little over-dramatic.  It has security experts concerned anyway.  The reason?  The psyb0t worm doesn’t attack PCs.  It attacks the routers and modems that comprise your networks instead.

Using vulnerabilities in Mipsel Linux, a variety used in many routers and modems, psyb0t can turn your always-on internet-attached device into an evil nasty zombie that can do anything any hacked PC can do.  It can snoop packets for passwords.  It can do distributed denial of service (DDoS) attacks.  It’s a mess.  And it’s so handy because we tend to just leave our routers and modems running 24/7, where as we typically turn off our PCs when they’re not in use.

It’s supposedly the first time that a router has been the target of a worm, and it bodes ill for the industry.  In theory it’s just the start of a whole new trend in internet insecurity.

The world is a scary place. The internet is no different. Everyone is out to get you. Everyone wants to hurt you. And they’re always thinking up horrible new methods to do it.

Okay, so yeah, that’s just a tad over the top. No, life isn’t really that bad. But yes, there really are hackers out there in the world trying to be mean and nasty.

Just ask Adobe. What is more internet than Adobe’s Flash providing all sorts of goofy little Flash applets all over the intarweb? Well Symantec has found a weakness in it. An exploited weakness. With at least 20,000 web pages found to carry links to a site that hosts malicious Flash applets that exploit the weakness. Not good. Fortunately, it’s only Adobe’s own Flash Player stand-alone application that is vulnerable. Internet browsers like Internet Explorer, Firefox, et cetera that support Flash plug-ins aren’t vulnerable. They’re safe. Still, not such a great moment for Adobe.

Speaking of the internet, what about one of the biggest ISPs out there, Comcast? Well just a couple days ago, for a mere few hours, Comcast.net was hacked by a couple of losers who redirected the webpage to one with text that read, “KRYOGENIKS Defiant and EBK RoXed COMCAST. sHouTz To VIRUS Warlock elul21 coll1er seven.” Wondrous stuff that. Just the hack of the ages there. Fortunately Comcast fixed everything by Thursday and is working with the police, even if they are stymied.

Still, a hack is a hack, and of all businesses out there to be well protected, you’d have thought one of the great cable ISPs like Comcast.net would have held up better than that. Oh well.

And speaking of ISPs and hacks, let’s jump across the pond to everyone’s favorite BT Home Hub wi-fi internet router, which has yet another security hole. When left on the default settings. You see, to combat stupidity from being a factor in hacking the device, recently the default administrator password from “admin” to the device’s serial number. Each being unique and relatively harder to guess than “admin”, it seemed a fairly intelligent way to go. And since it’s stamped on the device you never have to go far to find where you wrote it down. Except that, according to GNUCitizen, it’s not actually all that difficult to request the serial number from the device over a network connection. Hmm. Not so brilliant then. Just yet another reason to change from the default settings to actually secure ones. Good advice for everyone out there, not just for BT Home Hub owners.

In fact, when was the last time you Windows users patched your bugs and holes? You naughty naughty lot. Automatic Updating should be fixing it for you. If you haven’t turned it off that is. Why do I ask? Well, according to a new study by Akamai, China and the US lead the way for denial of service and exploit traffic in 2008. Yes, that’s right. Exploits. As in your computer has a security hole the size of Texas that was fixed years ago, but because you don’t think updating is worth it, you got hacked and now hackers are sending out traffic from your computer. Goodness knows that the past years have seen a great number of really effective worms, viruses, and Trojans for Windows PCs. All of them with fixes. Have you updated your computer with those fixes? Because in the world of always-on-line high-speed internet, if you’re not part of the solution, you really are part of the problem. Update your PC today. With Windows it’s just as simple as turning on your Automatic Updates. Or clicking on that little Windows Update button. It’s never been easier. Protect yourself. Protect us all. Update your PC. Please!

So yes, hubs, computers, even cell phones can be hacked.

Cell phones?

Yes, that’s right, cell phones.

Such as a bug found in Motorola’s RAZR firmware allows intentionally malformed JPG images to execute whatever code a hacker’s little black heart desires. Fortunately, after a year of working on it, Motorola finally has a fix. Yipee! Way to keep on top of things Motorola!

But all is not lost. It’s a scary scary world, but there are plenty of folks out there finding the security holes. And plenty of people fixing them. Or telling you how to protect yourself from them. It’s a scary place, but we’re here to help. If you let us.