Whether it's your Facebook identity or your Google Calendar traffic, there has been plenty of coverage lately about unencrypted information being sent to websites. What annoys the hell out of me, however, is this notion (coming from people who should know better, might I add) that these issues are only a problem if you're connecting to the internet via unsecured wi-fi.

This is complete and utter nonsense; the only thing that secured wi-fi gives you is a higher barrier to entry!

Consider this mental exercise: What happens to your data after it travels past the wi-fi access point? It needs to travel the remaining hundreds or thousands of kilometres to the website's data centre. If that information is unencrypted at the application layer (let's say via HTTP), it's just as visible by somebody intercepting it as it comes across the wire as it was over the unsecured airwaves. Wi-fi encryption is at the link layer, so it's only going to protect your data as it travels from your device to the access point; from then on, it's open season.

I don't dispute the fact that it's easier to snoop on unsecured wi-fi than it is to monitor a wired medium. What I do dispute is this ridiculous claim that securing your wireless connection or using a wired connection solves everything for you.

Avoiding unsecured wi-fi is not the solution. Using secure application layer protocols such as HTTPS is the solution.

Today is Data Privacy Day in Canada, the United States and parts of Europe. Unfortunately most people don't think much about privacy until it's too late. Due to technology, safeguarding one's personal information is always increasing in importance. It is important for Canadians to learn about their privacy rights and for government and businesses to understand their responsibilities with respect to privacy.

Earlier this week I noticed that Google searches on my Windows XP box were coming up with bizarre results. I'd type something in to Google and my search results would come up with headings and descriptions that looked correct but linked to bogus sites. At first I thought that this was some kind of search engine optimization gone awry. Two things changed my mind:

1. I noticed my web browser accessing a bogus URL: http://1.2.3.0
2. I checked my other machines (all running Linux) and they all worked correctly.

I viewed the source of the Google results, and I noticed an HTML script tag that had been injected into the search results page. I installed the NoScript Firefox extension which was successfully able to disable this foreign script and fix my Google results. Now I could work on actually eliminating this malware.

I opened up a Cygwin bash prompt and tried to ping 1.2.3.0, thinking that perhaps this was redirecting elsewhere - nothing turned up. On the other hand, if I launched Firefox and typed in that URL, it would connect to a server and retrieve some JavaScript. At this point I was convinced that this redirection was localized to my Firefox process.

I decided that whatever was causing this could have a varying degree of sophistication. Going for the low-hanging fruit seemed to be the most obvious course of action. I fired up Process Monitor from Sysinternals and logged everything that happened in the system as I entered "http://1.2.3.0" in the Firefox address bar. Here's what I found:



Notice the TCP transmissions to 94.247.2.58 port 80 (HTTP). Something is definitely phoning home. A quick run of the ping command with reverse DNS lookup gave me a successful hit of hs.2-58.zlkon.lv.

Rather than continuing with a fine-grained investigation, it was time to let my fingers do the walking. I had already disabled (though not yet eradicated) this malware, and at this point I had something to search on. Google promptly returned these juicy nuggets:

Beware of sysaudio.sys!

Fake sysaudio.sys causes search engine hijack

It looks like whatever put this on my machine was using some kind of unpatched browser exploit. Anyway, those blog posts point out that c:\windows\system32\sysaudio.sys is the likely culprit. Sure enough, I found it on my machine.

I decided to take a look to see if I could obtain some more information from this binary without doing any disassembly. I ran the strings command and got some interesting results. I won't include them all here, but I will note that they were all reversed in the binary. For example, one line in the strings output was:

:tnegA-resU

Look familiar? Reverse the string and think HTTP. ;)

Among other things, there are HTML script tags embedded in the binary, as well as parts of a URL that look like they are eventually spliced together. There's also a line containing the string "ntnet.drv", so that looks like another file that might be involved.

Here's the MD5 checksum for sysaudio.sys: db8c035980bf8cd18953e3f3f0abfe7e

By quarantining the files and fixing the registry key as mentioned in those blog references, it appears that this piece of malware has been eliminated. Despite the fact that I was happy (and intrigued) to track this issue down, I am kicking myself in the ass for allowing this to happen in the first place. On Windows I tend to run as an Administrator because of so many shitbox apps out there that can't handle a low-privileged user. I usually use Michael Howard's DropMyRights utility to ensure that stuff like this can't happen. I don't know why I wasn't using it on Firefox... perhaps my modified shortcut got overwritten during an upgrade?

UPDATE January 9, 2009: I submitted this malware sample to a number of anti-virus vendors, and some of them needed to add it to their databases. It appears that a slightly different version has been floating around as of late, this time under the guise of c:\windows\system32\wdmaud.sys and accessing http://7.7.7.0 instead of http://1.2.3.0.

Today the Federal, Alberta, and BC privacy commissioners jointly issued guidelines concerning driver's licenses. While certainly not as detailed as PIPEDA or PIPA legislation (or related investigations), it does provide a concise, easy to comprehend guide for retailers who might not be aware of their rights and responsibilities. I think that it's also useful to the consumer and worth reading if you care about identity theft.

It's time for me to search for a new place to rent, and once again the quality of the landlords is a mixed bag. One problem I've had with some landlords over the years is their tendency to demand rather intimate personal information for the purposes of vetting their prospective tenants.

The first piece of personal information that I take issue with is the social insurance number. SINs are not necessary to facilitate a credit check; name and date of birth are sufficient. There are very few organizations that are legally required to use the SIN. If it doesn't involve your employer, your banker, or the CRA, generally speaking you don't need to give it out.

The second identification number that I won't divulge is my driver's license number. First of all, my driver's license is supposed to identify me as an operator of a motor vehicle. As far as I'm concerned, any other use of the number is not reasonable (note that I am talking about the actual ID number on the license, not the license itself). Second, even with that number, what can a landlord legitimately do with it? Privacy laws do not permit the government to just go around and divulge information to whomever walks in the door brandishing somebody's driver's license number. The landlord could provide it to the police in the event of an incident, but he could also provide it to all kinds of unknown third parties at any time. I would argue that there are many more illegitimate activities that can be performed with somebody's driver's license number than legitimate activities.

I would suggest that it's far more risky to the tenant to disclose such information to a landlord than it is for the landlord to rent to that tenant. The other day, when I refused to provide my SIN and driver's license number, the property manager looked at me incredulously and exclaimed, "But this is a $400,000 house! The owners need to protect themselves!"

That might be true, but I need to protect myself. As far as I'm concerned, my identity is worth more to me than $400,000.

I love how the landlord expects the tenants to provide all of this information, yet the landlord is a complete stranger. I find it amusing that owning a rental property supposedly makes this person a trustworthy citizen of good standing. The landlord doesn't trust me, so he wants my SIN and driver's license numbers. However, I'm just supposed to accept at face value that the landlord will properly use and safeguard that information. I think that the next time somebody demands this information, I'll agree to provide it on the condition that the landlord provides me with his SIN and driver's license numbers. It seems only fair, right? I'd be interested to see how many actually would go for it. My guess: not many.

I often get the impression from landlords that, if I refuse to provide my driver's license number and SIN, they'll just find another tenant who will. While that might be the reality of the current rental market in Calgary, there's one problem with this practice:

It's illegal under both provincial and federal legislation.

Both the Alberta PIPA and the federal PIPEDA state that an organization cannot require consent to collect personal information as a condition of the supply of a product or service (beyond what is required to supply that product or service). In other words, because the SIN is not necessary for a credit check, a landlord legally cannot refuse to rent to a prospective tenant who refuses to disclose it. Because operating a motor vehicle has nothing to do with renting a house, and the driver's license number serves very little legitimate purpose outside of that domain, this also applies to the driver's license number.

The biggest problem that I see here is that these behaviours, while obvious to a tenant, are also hard to prove. I'd love to file a complaint against a landlord who is engaging in this behaviour, but I'd also need enough information to be able to know whom I was complaining about. It has been my experience that I never really find out much information about a prospective landlord beyond a first name until we're both ready and willing to sign on the dotted line. Second, how does one produce evidence that the non-disclosure of unnecessary personal information is the reason for being refused as a tenant? In reality, it's the tenant's word against the landlord's. Unless the landlord is either clueless or stubborn, it would probably be challenging to get him to admit to a privacy commissioner that he was engaging in such behaviour.

Until the time comes that I can snare a complaint, I'll just keep on searching. Oh, and by the way, if you have a property to rent in Calgary and you'll give me your SIN, let me know!