Back in late-January of this year, I received a curious email from Apple, indicating that my credit card information and billing address listed in my iTunes Store account had ben recently changed. Now, I never keep credit cards on file with retailers, nor do I have the iTMS linked to PayPal. I strictly adhere to a policy of making music, app and video purchases using only gift card balance, mainly out of concern that credit card account information stored anywhere outside my wallet or my noggin is inherently vulnerable, so I avoid it, when possible.

I logged into my iTunes account and found that, while my street address remained the same, my house had been magically transported to Townson, MD 21286-7840. Furthermore, my account balance, which had been about $34 the evening before, now hovered around 12¢. Apparently, after teleporting to Townson, I went on a spending spree, buying Fruit Ninja, Fruit Ninja HD, Angry Birds Seasons, Angry Birds Seasons HD, Plants vs Zombies, Plants vs Zombies HD, and so on, including a mystery lifestyle app titled “27000+ 天下美食.”

Immediately, I dashed off a support request to Apple stating that: I did not change my address or billing information, I did not buy the apps listed in the most recent invoice and that I expected a refund of my balance.

Apple’s initial response stated that it must have been my fault:

• either one of my family members made the changes and purchases, or
• I exposed myself to fraud by following a phishing link,
• by using an easily penetrated email service, or
• by using an insecure password.

There’s only some tiny flaws in those arguments:

• my wife has her own account and did not move to Townson in the middle of the night (and the two-year-old doesn’t have a credit card);
• I never, ever follow links in emails, ever… and generally manually type URLs (I’m old-school);
• I run a self-hosted mailserver (I’m glancing over at it, as I type this), on which I have multiple accounts (and loads of aliases), but I’m the only real user and
• my iTunes password was a randomly-generated alphanumeric string (and really fun to type on an iPhone; now it’s an even-longer random string, and the email address is unique to iTunes, as well).

Worse, a quick search turned up a consistent pattern, starting in November 2010, of iTunes accounts being subject to unauthorized access in which the perpetrators change the billing City, State and ZIP to read “Towson, Maryland 21286-7840.” They then use any existing balances on the iTunes accounts to buy apps and music, until the balance is less than 99¢ — they do not spend more than the balance, to ensure that a credit card is not needed/charged. The name on the account, the email address and the street address remain unchanged. The majority of the victims who have posted details of this unauthorized access claim to have never received any phishing attempts for access to the iTunes store. (Examples of fraudulent access to iTunes accounts, on Apple’s discussion boards and MacRumors’ forums.)

Apple’s “iTunes Store Advisor” happily ignored any mention of those facts, replying with a link to Apple’s guide to suggested security practices. To their credit, they restored my account balance within less than 24 hours, though immediately afterward, they disabled my account, on suspicion of “fraudulent access.” (Go figure.) That, in and of itself caused three days of pain, as the AppleID associated with the account dated back to the heady days of iTools, and, so, lacked the @mac or @me that the system expected after the rollout of the free edition of ‘Find my iPhone.’ (My connections with Apple are many and go waaay back to 1987.) My old password would have required around 6,300 machine hours to crack; my new password would need 14 billion machine hours.

I was hoping that, despite the outward appearance of having ignored my account security concerns, Cupertino was hard at work on fixing the issue and tracking down the twerps in Townson, MD. Apparently, not.

Microsoft Principal Program Manager Scott Hanselman’s iTunes account was recently compromised and used to make $40 in fraudulent app purchases. Tech writer, MG Siegler believes that Hanselman’s login and password were compromised, Gruber agrees. I don’t. For the better part of a year, the evidence indicates that there is a systematic vulnerability in the iTunes store. Apple is undoubtedly aware of it, despite blatantly ignoring the hundreds, if not thousands, of users who have experienced the same violation.

Thanks to Panic’s wonderful Transmit client and a little phpMyAdmin querying, the transition was relatively smooth, save for an unresolved issue when utilizing phpFlickr’s caching function.

The car recently had its air-flow meter, fuel pressure regulator and throttle position sensor replaced. Oil change was most recently within the last 600 miles. Clean/straight Ronal/ACT LS wheels in 16×8.5 shod with Toyo Proxes 4, with rears having less than 6,500 miles on them and fronts in good shape. Current NC safety inspection as of 6/1/2011.

$7,195 obo.

Well, I’ve learned my lesson about being lazy and allowing WordPress to upgrade itself. (I should have known better, given my professional background and am pretty embarrassed to admit my issue.)

Using Chris Pearson’s blog, specifically, his post, “How to Diagnose and Remove the WordPress Pharma Hack,” Ottopress’ “How to Cope with a Hacked Site,” (and “How to find a backdoor in a hacked WordPress“), Donncha‘s “Did your WordPress site get hacked?” and WordPress’ own “FAQ My site was hacked,” I was able to find the files affected and mitigate the damage (to the sites, not my ego).

There was only one suspicious database modification (I checked against the last 45 days of backups), three new php function files that were added into non-core directories, an odd change or two to my info.php, wp-config, expired WP-SuperCaches and Google site verification files and a ham-fisted, half-hearted attempt at building an RBC bank phishing site, similar to this example. It appears that they attempted to create a user, but weren’t able to do so, thanks to a couple of tweaks I had made. All in all, it only really appears to have affected my google rankings and meta descriptions (via an off-site redirect), which is why I didn’t even notice the modifications for two weeks.

It was, however, sophisticated enough to hide the injected keywords from Googlebot user-agents that didn’t actually originate from the Mountain View mothership, which is why it took me a little time to figure out, once I’d noticed yesterday evening. The other sneaky part was that they stuck some includes into the first lines of a couple of files, with enough tabs/spaces to push them past the first 180 or so columns, so they weren’t visible in a normal terminal window or BBedit. Too bad, for them, that MacOS X’s quicklook auto-wraps long lines.

The code resembled this backdoor; reinstalling the core WordPress, the theme files, plus all active plugins (and removing the inactive), crawling through my uploads directories and non-core WordPress directories, changing every shell password, wiping out my salt keys, plus a couple of complex BBedit queries. (Here are some additional WordPress hardening techniques.)

My number one suspect, at the moment, is WP-phpMyadmin, which should be removed immediately.

2003 BMW 540i in TitaniumSilber

So, in the name of practicality and responsibility, I’ve replaced the M30B34-powered 210hp/230lb-ft 635CSi with an M62TUB44-powered 280hp/320lb-ft E39 540i/6 sport. Right, practicality.

The 6er’s fate is as yet unresolved. I currently have a love/hate relationship with the car. It’s too gorgeous to stay mad at, but too long in the tooth to serve as a daily driver over Durham’s terrible, terrible roads.

As reported by the Independent Weekly, Representative Ty Harrell (D-Wake) and State Senator David W. Hoyle (D-Gaston) have penned SB1004 (and it’s House counterpart, HB1252), known as the “Level Playing Field/Cities/Service Providers” bill. Contrary to its name, the bill seeks to prevent municipal governments from installing high-speed broadband or wireless internet service and acting as an ISP, even if commercial ISPs have no plans to offer service to their communities.

Close on the heels of Time Warner Cable’s announcement that it would begin testing “tiered bandwith” caps in Greensboro, and the annoucement of Salisbury’s plan to follow in Wilson’s footsteps and provide fiber to the home for its residents (promising symmetrical speeds of up to 100Mbps), these bills not only threaten the possibility that North Carolina will finally claw its way above the national average in residential broadband access, and do so in an affordable manner, it also threatens North Carolina’s access to the $4.7 billion the National Telecommunications and Information Administration (NTIA) has set aside from the $787 billion stimulus package to bring broadband to underserved and un-served communities.

Read on for legislative contact information and learn why North Carolina isn’t likely to receive fiber internet any time soon…

Current Status and Legistlative Contacts

HB1252 is expected to be considered by the Committee on Science and Technology tomorrow (apparently, despite numerous complaints, Harrell was pushing to have it voted on on April 15, but ran out of time). If the Committee on Science and Technology, which Harrell chairs, approves the bill, it will then be sent to the Comission on Public Utilities, chaired by Lorene Coates (D-Rowan), and then, Finance, chaired by Paul Luebke (D-Durham).

SB1004 is waiting to be considered by the Senate Committee On Commerce, chaired by Sen. Floyd McKissick (D-Durham).

If you oppose this bill, and there’s plenty of reasons to oppose, just as there were plenty of reasons that the previous attempt, the “The Local Government Fair Competition Act” failed in 2007, contact the bills’ sponsors:

The sponsors of House Bill 1252

Ty Harrell (D-Wake) | (919) 733-5602 | ty.harrell@ncleg.net

Earl Jones (D-Guilford) | (919) 733-5825 | Earl.Jones@ncleg.net

Marilyn Avila (R-Wake) | (919) 733-5530 | Marilyn.Avila@ncleg.net

Thom Tillis (R-Mecklenberg) | (919) 733-5828 | Thom.Tillis@ncleg.net

The sponsors of Senate Bill 1004

David Hoyle (D-Gaston) | (919) 733-5734 | David.Hoyle@ncleg.net

Debbie Clary (R-Cleveland/Rutherford) | (919) 715-3038 | Debbie.Clary@ncleg.net

ILECs and LATAs and RBOCs, Oh My!: Why NC is Screwed When it Comes to Telecom Coverage

Most people would look at North Carolina and think it was a prime candidate for a rollout of one of the leading high-speed internet packages, such as FIOS or U-Verse, considering that it is the 10th largest state population in the U.S., home to a number of major banking and telecommunications companies, the site of three major research universities, the hosts what is widely considered to be the east coast’s Silicon Valley.

Unfortunately, if you think that way, you’re looking at the Old North State from the standpoint of a rational human being. The Telcos see it far differently.

RBOCs

The Regional Bell Operating Companies were the result of the U.S. DoJ’s anti-trust suit against AT&T. Commonly called “Baby Bells,” the RBOCs were split regionally in an effort to prevent monopolies and increase investment in telecommunications technologies. North Carolina was served by BellSouth and independent regional carrier GTE, which was roughly the size of an RBOC, but was not limited by geographic boundaries like the units spun-off from AT&T.

Following the Telecommunications Act of 1996, which substantially erased the lines between the RBOCs and the long-distance carriers, the larger RBOCs began gobbling up the smaller RBOCs and independent regional carriers, creating circumstances wherein what were formerly local, competitive markets became fragmented segments of national markets.

ILECs

Incumbent Local Exchange Carriers are essentially what’s left of the RBOC — they’re the telecom companies that, prior to the 1996 Telecommunications Act, held local monopolies. Competitive Local Exchange Carriers, on the other hand, are the smaller, more agile telecom carriers, that, for the most part have been bought-up as soon as they pose a financial threat to the ILECs. North Carolina has three major ILECs: Verizon, AT&T and Embarq and none of them are interested in providing substantial service outside of their main ILEC boundaries.

LATAs

Local access and transport areas are the geographic regions in which former RBOCs and ILECs own the physical exchanges and network infrastructure. LATAs are the reason that calling a physically local number within the same area code (such as Durham to Raleigh) might incur long-distance charges, but further distant numbers within separate area codes (Durham to Roxboro) does not. As a result, wireline providers are able to license their high-speed backbones to their competitors at prohibitively expensive rates, discouraging competition.

Further confusing the issue is that LATAs are not defined by state, county or even city boundaries and a single city may have multiple LATAs owned by multiple providers. DSL providers are not permitted to provide broadband service that crosses LATA boundaries, even if the adjacent LATA is also owned by the same company, so while your residence might be only 1,000 yards from the geographically-closest CO, the closest CO in your LATA may be more than 6,000 yards, making it effectively too far away for DSL.

And the LATAs, themselves, are often divided by the ILECs. LATA 426, technically the “Raleigh” LATA, encompasses the Research Triangle Region, and has five different ILECs/CLECs providing service to various locations. None of these companies, particularly BellSouth (AT&T) and Verizon, have any incentive to improve the quality of their data services in these municipalities, because the customer base is so balkanized that the costs of infrastructure improvements outweigh any potential profits.

LATA 426 is North Carolina in a microcosm. Divided between Verizon, AT&T and Embarq, as well as a host of small, regional and local players, the rules as they exist, discourage the telecom industry from serving the residents and businesses of North Carolina with the latest in high-speed broadband, if they provide any service at all. (Click here to see just how segmented North Carolina’s telecommunications infrastructure is.)

If the telecom industry manages to ram HB1252 and SB1004 through the state legislature, it will only get worse.

Save NC Broadband

As best summed up by Brian Bowman, the Public Affairs Manager for the City of Wilson, NC, on the Save North Carolina Broadband blog:

If the cable/phone companies really want a level playing field, they’d open their books just like we do in the spirit of open meetings and open records law. They don’t want a level playing field. They want to be the only team on the field.

Bottom line, these companies are using your state lawmakers to protect monopolies. It was wrong in 2007 when a similar bill died in the house and it’s wrong today.

One last note, Wilson tax money does not fund Greenlight. It is self-supporting through subscription fees.

====

Cross-posted at DailyKos (link)

Digg it (link)

The requirements are:

• Less than $10 per month for hosting all three domains
• Shell access
• MySQL
• PHP
• WordPress
• and terms that allow artistic nudity (for my photo site)

The candidates are:

• Laughing Squid
• A Small Orange
• Bluehost
• DreamHost
• iWeb
• PRGMR

Any thoughts/suggestions?

• Iceberg salad with anjou pear, stilton cheese, shaved red onion with red wine vinegarette
• Wild mushroom bread pudding
• Spinach madeline (from Bay Leaves)
• Garlic mashed potatoes
• Pan-seared, oven roasted, center cut tenderloin head roast (I even butcher my own PSMOs)
• Tangerine bavarian with caramel sauce and candied tangerine peel
• Sugar jumbles (great-great grandmother’s recipe)