February 2009 - KICTANet

Re: [kictanet] Hacked password list offers security insights
by James Kagwe 11 Feb '09

11 Feb '09

When you consider the way these passwords are usually stored (sometimes on simple MSAcces databases or other databases without encrypting the password field) by the website designers on some of these websites. I agree it is very wise not to put serious passwords on such websites as they do not serve their purpose anyway. I personally use very weak passwords on such websites too. Let them hack an e-banking website then rewrite the story. The statistics will make more sense then. ________________________________ From: kictanet-bounces+jkagwe=kippra.or.ke(a)lists.kictanet.or.ke [mailto:kictanet-bounces+jkagwe=kippra.or.ke@lists.kictanet.or.ke] On Behalf Of Odhiambo Washington Sent: Tuesday, February 10, 2009 8:19 AM To: James Kagwe Cc: KICTAnet ICT Policy Discussions Subject: Re: [kictanet] Hacked password list offers security insights On Tue, Feb 10, 2009 at 1:27 AM, Evans Kahuthu <ekahuthu(a)comtechltd.co.ke> wrote: Recently a niche programming-oriented website called phpbb.com had its user database hacked into and the passwords for 20,000 members stolen. The hacker who broke in then posted the account info and passwords online for the world to see. And while this is really bad news for those 20,000 unlucky souls, it offers an instructive lesson on password security <http://www.darkreading.com/blog/archives/2009/02/phpbb_password.html> for the rest of us. InformationWeek analyzed the hacked password list and found a number of interesting trends in the data, primarily revolving around the fact that most people do exactly what they've been told not to do since passwords were first invented. Author/analyst Robert Graham has tons of analysis on offer. I'm ordering my favorite/most enlightening data points from the piece here, starting with the most interesting. On thing to remember: These passwords are from a group of people interested in computer programming, so if anyone should know better, it's these guys. > The most popular password (3.03% of the 20,000) was "123456." It's also generally considered the most common password used today <http://www.whatsmypass.com/?p=415> . > 4 percent used some variant of the word "password." Seriously, people, there's no excuse for this one. "password" was the 2nd most popular password used, also in keeping with historical trends. > 16 percent of passwords were a person's first name. No word on if it was their first name, but someone's. Joshua is the most commonly used first-name password, a likely reference to the movie WarGames. > Patterns abound. In addition to "123456," other pattens like "12345, "qwerty," and "abc123" were common, comprising 14 percent of the passwords used. > 35 percent of passwords were six characters long. 0.34 percent were only one character long. > For reasons no one can explain, "dragon," "master," and "killer" all crack the top 20 passwords. (On the top 500 password list linked above, "dragon" is #7.) > One thing Graham doesn't discuss is that phpbb.com is really just a message board, and many users may simply have not cared about the security of their passwords here (unlike, say, with a bank account). In other words, they may very well have intentionally chosen something simplistic here to avoid re-using a password they save for an important login, just in case this site got hacked. Which, it turns out, it did. I could go on, but Graham's post has way more detail than I can digest here and it's easy-reading too. Worth a close look for any citizen of the web. Personally, I believe noone really cares about the strength (or lack of) the passwords they use on community sites. To start with, there is a stage in the registration process into such sites (or Bulletin Boards if you may call them) which warns you NOT TO USE any of your sensitive passwords that you use elsewhere. Given that noone really stores any sensitive material on such sites it's not uncommon to simply use 123456 (because the registration system insists on your password having at least six characters) or something like "letmein". I don't believe it was "really bad news for the 20,000 unlucky souls" at all. Rather, the lesson to be learn here, IMHO, is by those souls deploying systems that are accessible to the hostile Internet to take seriously security considerations for those systems. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ "The only time a woman really succeeds in changing a man is when he is a baby." - Natalie Wood

1 0

Church service Late Dr Juma
by Andrew Limo 11 Feb '09

11 Feb '09

Dear all, There will be a funeral service 10am tommorow Thurs 12th at St Paul Chapel, Nairobi, for our late brother Dr Juma Okech (ICT Secretary, Directorate of e-Government). Thank you all for your prayers and support. Andrew

1 0

BungeSMS com added you as a connection on Plaxo
by BungeSMS com 10 Feb '09

10 Feb '09

Hi Policy, BungeSMS com wants to add you as a connection on Plaxo. To accept this connection request, go to: http://www.plaxo.com/invite?i=59901184&k=1839213572&l=en&src=email&et=1&est… Thanks! The Plaxo team More than 20 million people use Plaxo to keep in touch with the people they care about. Don't want to receive emails from Plaxo any more? Go to: http://www.plaxo.com/stop?src=email&et=1&est=nolevels&etv=nnic1b2&el=en&ema…

1 0

Obama and Cybersecurity
by alice 10 Feb '09

10 Feb '09

FYI http://www.washingtonpost.com/wp-dyn/content/article/2009/02/09/AR200902090… best alice

1 0

Capital Mobile Radio Drive Winners
by Patrick Mburu 10 Feb '09

10 Feb '09

Congratulations to the Capital Mobile Morning Drive winners so Far! There's a lot of prizes to be won! Listen in on Capital FM Radio: 98.4 or listen on the web: www.capitalfm.co.ke in between 7am and 9am and participate in a chance to win: - 2 nights for 2 Flying package Holiday in the Mara Intrepid (Courtesy: Heritage Hotel's and Safari Link) - 2 nights for 2 at the Leopard Beach Resort (Courtesy: Leopard Beach Resort & Uzuri Spa and Fitness Forest!) - Free breakfasts and lunches at exclusive restaurants in Nairobi And Much Much More....! www.capitalmobile.co.ke/mobile Want a chance to win.. listen in the morning for a get your prize 98.4 Capital FM

1 0

[Fwd: [IGP Announce] Internet Governance Project Headlines]
by lillian＠cipesa.org 10 Feb '09

10 Feb '09

Apologies for cross posting! -------------------------------------------------------------------------- February 09, 2009 A Field Guide to the ICANN Reforms EU posts online consultation results on "Internet of Things" Cyber-security for people? Or nations? Shareholder groups push ISPs for transparency on DPI use Search Internet Governance Project Headlines ________________________________________________________ * A Field Guide to the ICANN Reforms - http://feedblitz.com/r.asp?l=38133930&f=175425&u=11399282 Important changes are taking place in ICANNâs representational structures. They are the most sweeping changes in ICANN since the so-called âevolution and reformâ process of 2001-2. The new changes will directly affect opportunities for people to participate in ICANN â hopefully in a more positive way. Indeed, there are some (potentially) good things about the planned reforms, such as a more balanced representation of commercial and noncommercial users and more flexible working group structures. But there are also serious problems and dangers in this effort. That is why the Internet Governance Project is initiating a series of blogs explaining and analyzing the structural changes underway in ICANN. If you think reading about this topic is about as appealing as getting a tetanus shot, we sympathize, and promise to make it as lively and interesting as possible. At the very least, we guarantee that reading this unfolding report will be more pleasurable than reading the 23 different ICANN staff reports, 5-6 Board resolutions, months of Council minutes and multiple email lists you would have to monitor to piece it all together for yourself. Email to a friend Article Search - http://www.feedblitz.com/f/f.fbz?Search=175425;9995717;Main Page;A Field Guide to the ICANN Reforms;1047081 * EU posts online consultation results on "Internet of Things" - http://feedblitz.com/r.asp?l=38108085&f=175425&u=11399282 Europe is very interested in the Internet of the future, having ceded to the United States so much of the standards and governance of the Internet of the past. A September 29, 2008 European Union staff working paper, âEarly Challenges to the Internet of Things,â shot some policy concerns across the bow. How should the IoT be regulated? EU seemed especially concerned about the apparent linkage between the Object Naming System (ONS) used by EPC Global (contracting with VeriSign) and the U.S.-controlled DNS root. Comment upon and responses to this staff paper are now posted online. If you are interested in the evolution of thinking about IoT a look through these comments might be rewarding. Email to a friend Article Search - http://www.feedblitz.com/f/f.fbz?Search=175425;9995717;Main Page;EU posts online consultation results on "Internet of Things";1047081 * Cyber-security for people? Or nations? - http://feedblitz.com/r.asp?l=38066197&f=175425&u=11399282 The Internet is organized around âautonomous systemsâ -- independently managed networks most of which are privately owned or, if public, managed at the agency or department level. The current institutional structure for public governance, on the other hand, is organized around nation-states. That disjunction encourages some actors to construct Internet security as a national security issue. Political claims that invoke ânational securityâ can inflate budgets and provide for more effective political mobilization within bureaucracies and the political class. A recent report from a "Commission on Cyberspace Security for the 44th Presidency" assembled by the Center for Strategic and International Studies (CSIS), a Washington DC-based think tank with longstanding roots in Cold War dialogue, exemplifies this problem. Written late in 2008, it urged the incoming President to proclaim that âcyberspace is a vital asset for the nation andâ¦the United States will protect it using all instruments of national power.â This is a fundamentally misguided approach; this post explains why. Email to a friend Article Search - http://www.feedblitz.com/f/f.fbz?Search=175425;9995717;Main Page;Cyber-security for people? Or nations?;1047081 * Shareholder groups push ISPs for transparency on DPI use - http://feedblitz.com/r.asp?l=38031216&f=175425&u=11399282 A coalition of investors have filed shareholder resolutions with 10 major U.S. Internet service providers, urging their corporate boards to report on the impact of the companiesâ use of deep packet inspection for Internet network management on the freedom of expression and privacy of their customers. The effort was organized by the Open Media and Information Companies initiative (OpenMIC). A spokesperson for one of the investor groups, Farnum Brown of Trillium Asset Management, said: "These companies have responded to the challenges of managing the Internet in a patchwork, ad hoc fashion. In so doing they've failed to notice the profound social policy issues they've unwittingly engaged. Americans are concerned about how their use of the Internet is monitored. They're concerned about whether their privacy and freedom of expression are respected by the companies that manage the Internet. We as shareholders believe it is in these companies' best business interests to respond to those concerns." Email to a friend Article Search - http://www.feedblitz.com/f/f.fbz?Search=175425;9995717;Main Page;Shareholder groups push ISPs for transparency on DPI use;1047081 ________________________________________________________ Unsubscribe from all current and future newsletters powered by FeedBlitz - http://www.feedblitz.com/f/f.fbz?EmailRemove=_MTEzOTkyODJ8fGxpbGxpYW5AY2lwZ…

1 0

Re: [kictanet] SPAM-LOW: Re: Hacked password list offers security insights
by Evans Kahuthu 10 Feb '09

10 Feb '09

Washington, I completely agree with you on users not caring about their passwords on community websites. Unfortunately, when it comes to social networking web sites, people tell all -- who they are, what they like to do and what's happening at that exact moment. Consequently, with this weak passwords, hackers "hijack" their profiles and go after internet contacts. This is one of the newest scams to hit the internet. Hackers somehow take over users pages and pose as them online. Case in point, "Facebook user Bryan Rutberg of Seattle, Wash., had his profile hacked into by someone who changed his status to: "Bryan Rutberg NEEDS HELP URGENTLY!" Many friends immediately responded to the status change wanting to know what had happened to him. One friend, Beny Rubenstein, got a direct message from Rutberg saying he had been robbed at gunpoint while in England and was in desperate need of cash in order to get home. Being a good (but dumb) person, he wired his thought-to-be troubled friend $1,143 in two installments, only to find out Rutberg was sitting home safely in Seattle. Rubenstein told CNN that he misses the money he lost, but feels worse about being tricked by someone impersonating his friend on the Web site." Evans Kahuthu ---------------------------------------- From: Odhiambo Washington <odhiambo(a)gmail.com> Sent: Tuesday, February 10, 2009 8:26 AM To: ekahuthu(a)comtechltd.co.ke Subject: SPAM-LOW: Re: [kictanet] Hacked password list offers security insights On Tue, Feb 10, 2009 at 1:27 AM, Evans Kahuthu <ekahuthu(a)comtechltd.co.ke> wrote: Recently a niche programming-oriented website called phpbb.com had its user database hacked into and the passwords for 20,000 members stolen. The hacker who broke in then posted the account info and passwords online for the world to see. And while this is really bad news for those 20,000 unlucky souls, it offers an instructive lesson on password security for the rest of us. InformationWeek analyzed the hacked password list and found a number of interesting trends in the data, primarily revolving around the fact that most people do exactly what they've been told not to do since passwords were first invented. Author/analyst Robert Graham has tons of analysis on offer. I'm ordering my favorite/most enlightening data points from the piece here, starting with the most interesting. On thing to remember: These passwords are from a group of people interested in computer programming, so if anyone should know better, it's these guys. > The most popular password (3.03% of the 20,000) was "123456." It's also generally considered the most common password used today . > 4 percent used some variant of the word "password." Seriously, people, there's no excuse for this one. "password" was the 2nd most popular password used, also in keeping with historical trends. > 16 percent of passwords were a person's first name. No word on if it was their first name, but someone's. Joshua is the most commonly used first-name password, a likely reference to the movie WarGames. > Patterns abound. In addition to "123456," other pattens like "12345, "qwerty," and "abc123" were common, comprising 14 percent of the passwords used. > 35 percent of passwords were six characters long. 0.34 percent were only one character long. > For reasons no one can explain, "dragon," "master," and "killer" all crack the top 20 passwords. (On the top 500 password list linked above, "dragon" is #7.) > One thing Graham doesn't discuss is that phpbb.com is really just a message board, and many users may simply have not cared about the security of their passwords here (unlike, say, with a bank account). In other words, they may very well have intentionally chosen something simplistic here to avoid re-using a password they save for an important login, just in case this site got hacked. Which, it turns out, it did. I could go on, but Graham's post has way more detail than I can digest here and it's easy-reading too. Worth a close look for any citizen of the web. Personally, I believe noone really cares about the strength (or lack of) the passwords they use on community sites. To start with, there is a stage in the registration process into such sites (or Bulletin Boards if you may call them) which warns you NOT TO USE any of your sensitive passwords that you use elsewhere. Given that noone really stores any sensitive material on such sites it's not uncommon to simply use 123456 (because the registration system insists on your password having at least six characters) or something like "letmein". I don't believe it was "really bad news for the 20,000 unlucky souls" at all. Rather, the lesson to be learn here, IMHO, is by those souls deploying systems that are accessible to the hostile Internet to take seriously security considerations for those systems. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ "The only time a woman really succeeds in changing a man is when he is a baby." - Natalie Wood

1 0

Hacked password list offers security insights
by Evans Kahuthu 10 Feb '09

10 Feb '09

Recently a niche programming-oriented website called phpbb.com had its user database hacked into and the passwords for 20,000 members stolen. The hacker who broke in then posted the account info and passwords online for the world to see. And while this is really bad news for those 20,000 unlucky souls, it offers an instructive lesson on password security for the rest of us. InformationWeek analyzed the hacked password list and found a number of interesting trends in the data, primarily revolving around the fact that most people do exactly what they've been told not to do since passwords were first invented. Author/analyst Robert Graham has tons of analysis on offer. I'm ordering my favorite/most enlightening data points from the piece here, starting with the most interesting. On thing to remember: These passwords are from a group of people interested in computer programming, so if anyone should know better, it's these guys. > The most popular password (3.03% of the 20,000) was "123456." It's also generally considered the most common password used today . > 4 percent used some variant of the word "password." Seriously, people, there's no excuse for this one. "password" was the 2nd most popular password used, also in keeping with historical trends. > 16 percent of passwords were a person's first name. No word on if it was their first name, but someone's. Joshua is the most commonly used first-name password, a likely reference to the movie WarGames. > Patterns abound. In addition to "123456," other pattens like "12345, "qwerty," and "abc123" were common, comprising 14 percent of the passwords used. > 35 percent of passwords were six characters long. 0.34 percent were only one character long. > For reasons no one can explain, "dragon," "master," and "killer" all crack the top 20 passwords. (On the top 500 password list linked above, "dragon" is #7.) > One thing Graham doesn't discuss is that phpbb.com is really just a message board, and many users may simply have not cared about the security of their passwords here (unlike, say, with a bank account). In other words, they may very well have intentionally chosen something simplistic here to avoid re-using a password they save for an important login, just in case this site got hacked. Which, it turns out, it did. I could go on, but Graham's post has way more detail than I can digest here and it's easy-reading too. Worth a close look for any citizen of the web. Evans Kahuthu

2 1

[Fwd: [APC Forum] APC job vacancy: Assistant to the executive director and grant administrator]
by alice 09 Feb '09

09 Feb '09

Please help us circulate. Thank you! ---------------------------------------------------------------------- APC job vacancy: Assistant to the executive director and grant administrator The Association for Progressive Communications (APC) is a global network of civil society organisations whose mission is to empower and support organisations, social movements and individuals in and through the use of information and communication technologies to build strategic communities and initiatives for the purpose of making meaningful contributions to equitable human development, social justice, participatory political processes and environmental sustainability. www.apc.org The APC is looking for an Assistant to the Executive Director/Grants Administrator. Application deadline: 20 February 2009 Start date: Immediately DUTIES AND RESPONSIBILITIES Grant administration * Research and track funding opportunities * Coordination submission of proposals and following up subsequent to submission * Prepare and maintain appropriate materials that need to accompany proposals * Coordinate receipt, signing and filing of donor/client agreements * Manage the APC donor reporting calendar and notify relevant staff members of upcoming deadlines and ensure that completed reports are filed in the appropriate online spaces * Liaise with donors in submitting reports, providing updates, etc. * Ensure that donor contact information is kept up to date and is reflected on APC’s online project management space and on APC.org * Provide overall support to the management team in ensuring effective relationships with APC’s donor partners. Assistance to the Executive Director * Assistance with correspondence, scheduling, and travel arrangements, and expense reimbursements * Compile and draft reports, procedures, and other internal documents * Take minutes of board and staff meetings as needed * Provide administrative support to the board of directors’ activities * Assist in the maintenance of internal calendars in collaboration with the Network Development team * Assist with event follow-up (minutes, reports, and other documentation) Coordination of consultants’ contracts * Liaise with staff members and consultants in order to acquire all relevant contract information and finalise consultants’ contracts and distribute to relevant staff and consultants for approval * Distribute approved contracts to consultants and relevant staff members * Receive signed consultant and staff contracts by email, fax, and mail, and file them online and in paper files in the APC office * Notify relevant staff members when consultants have signed their contracts * Ensure that all relevant documents and information are present in the subcontracts database of APC’s online project management space Management of the Executive Director’s office in Johannesburg (if based there) * Answer the telephone, check voice mail, and send and receive faxes, mail, packages and email. * Maintain complete and accurate paper and online filing systems * Order office supplies and arrange payments via the online finance system * Work with APC’s Events and Logistics Coordinator in the planning and coordination of events held in South Africa * Provide other executive and administrative assistance as needed REQUIREMENTS * Higher degree in the social sciences, development studies or a related field (or at least three years professional experience) * Excellent interpersonal and communication skills * Excellent written English * Ability to organise, prioritise and complete tasks in a timely manner without supervision * Experience in information management * Able to work independently and as part of a team * Excellent wordprocessing and internet skills (e.g. online research) * Able to communicate comfortably in written French and/or Spanish ADVANTAGES * Ability to work from executive director’s office in Johannesburg, South Africa * Familiarity with working in networks * Experience working remotely * Experience in working in an international context with ICT-based civil society networks like APC * · Ability to communicate in more than two languages ORGANISATIONAL RELATIONSHIPS The successful applicant will report to the Executive Director and work closely with the Events and Logistics Coordinator, the Network Development Manager, the Finance Manager, the Finance Assistant, and other members of the management team. LOCATION AND WORK CONDITIONS The successful applicant will work in the APC office in Johannesburg, South Africa. However very strong candidates who wish to be considered for the post and work remotely from another country may still apply. Some international travel might be required. APC provides an equipment allowance but requires staff to provide their own laptops. REMUNERATION This is a full time, fixed-term (renewable) contract. Remuneration is based on the APC’s salary scale for the position. Short-listed candidates will receive specific information on the salary range. HOW TO APPLY Send a covering letter and detailed CV (in English), which include the following information: * A description of your interest in working with APC in this position * Your experience related to the job requirements listed above * Experience of working in networks and managing partnerships * People and project management skills * A rating of the languages you speak and write * A description of your computer skills * Work experience in an international context * Online work experience * Other information you think might be of importance to our assessment of your application * Three (3) references: names, relationship and their contact details. Send your application via email, as an attachment, to jobs at apc.org with “Executive Assistant and Grant Administrator” in the subject line. Please note that only short-listed candidates will be contacted. Any applications which are incomplete, do not follow the instructions here, received with viruses, or in any language other than English will be automatically disqualified. (END/2009) ======================================= APC Forum is a meeting place for the APC community - people and institutions who are or have been involved in collaboration with APC, and share the APC vision - a world in which all people have easy, equal and affordable access to the creative potential of information and communication technologies (ICTs) to improve their lives and create more democratic and egalitarian societies. _______________________________________________ apc.forum mailing list apc.forum(a)lists.apc.org http://lists.apc.org/cgi-bin/mailman/listinfo/apc.forum

1 0

Blogging; Special Report on Business Daily, Opinion?
by Gakuru Alex 09 Feb '09

09 Feb '09

Dear all, I would be very interested in your views of Business Daily's Special Report on blogging: - 1. Blog post revolution hits corporate Kenya <http://www.bdafrica.com/index.php?option=com_content&task=view&id=12756&Ite…> 2. Blogs command attention of corporate world <http://www.bdafrica.com/index.php?option=com_content&task=view&id=12755&Ite…> 3. Blogs emerge as avenues for making money< http://www.bdafrica.com/index.php?option=com_content&task=view&id=12754&Ite…> 4. Companies use online platform to monitor views from the public <http://www.bdafrica.com/index.php?option=com_content&task=view&id=12753&Ite…> 5. Fibre optic cable to pave way for corporate blogging <http://www.bdafrica.com/index.php?option=com_content&task=view&id=12752&Ite…> 6. What is likely to compete with the mainstream media? <http://www.bdafrica.com/index.php?option=com_content&task=view&id=12751&Ite…> Please,,, be generous with your opinion.... regards, Alex

1 0