Internet Banking, IDS/IPS and Application Security

I received highly-reliable reports that two large Philippine banks' online banking system were compromised. A third bank's website got vandalized. I can't divulge the names of the banks but I'm just worried about it. One of them I have a pending application for a card that I'm thinking of just not pushing through with.

one of the banks I know have expensive and sophisticated Intrusion Prevention Systems (IPS) in place since I personally know their Information Security Officer and IS Auditors. But their "pride" took a beating at this latest problem of theirs.

I would like to point out that no amount of obscurity, Firewalls and IPS/IDS can ever compensate for a poorly designed online banking application.

Web application security is still not a hot topic here for a simple SQL injection attack can access confidential information there.

Chinabank High Interest Deposit Certificate Offering

Two weeks ago, I received a text message from a Chinabank insider informing me of a special product offering with much higher interest rates than their regular time deposits.

The message said "Good day, chinabank will be launching a new product called the Long-term Negotiable Certificates of Deposit (LTNCD). Minimum amount is P50t. PDIC insured. Term is 5 years. NO withholding tax. Indicative rate projected at 8% to 8.5%..an account opening fee (1 time charge) at P75 per cert will be charged and account maintenance fee of 0.025% per annum based on face value whichever is higher deducted from the gross interest due on the LTNCD on interest dates. Quarterly interest payment...offering period starts on July 28 to August 8, 2008. Please reply ASAP if interested cause it is 1st come 1st served..."

I replied immediately upon receipt of the message to express my intention to invest part of my savings. But as fate would have it, I forgot my passbook the following Monday and decided to bring it the following day. The morrow, I was able to bring my passbook but totally forgot about going to the bank when my friend from Chinabank dropped by the office and asked me if I was able to open an account to which I replied no. She just told me that it's already closed the day before due to the high turnout and already reached P5B.

Oh well, the planned early morning trip to the bank didn't materialize and thus missed an excellent investment opportunity.

Better luck and be ready next time, Paetechie!

Executive Privilege, Supreme Court and MILF MOA on Ancestral Domain

Here we go again, after that "error" of the Supreme Court effectively letting Neri walk away with potentially damaging disclosure regarding his conversations with PGMA about the NBN-ZTE scandal, the iron lady again is using the same executive privilege tack, not against the Senate, her traditional enemy, but against the Supreme Court, regarding the constitutionality of the proposed Memorandum of Agreement (MOA) between the Government of the Replublic of the Philippines (GRP) and the Moro Islamic Liberation Front, a Muslim rebel group in Mindanao whose end is independence.

According to news reports, GRP is considering creation of the so called Bangsamoro Juridical Entity (BJE) larger than the present ARMM with the inclusion of villages that also infringes on the ancentral domain of lumads of Mindanao particularly the Subanons of Zamboanga peninsula.

The Philippine daily Inquirer report stated "the government said while negotiations with the MILF did not involve any foreign power, there were military and national concerns raised." and that "the Philippine government and the BJE are to exercise “shared authority and responsibility” over the Bangsamoro homeland."

Let's wait and see how this will transpire. I just wish the justices who voted in favor of executive privilege realize the mistake they made and make corrections as early as possible.

Executive privilege should not be upheld when the interests of the people are at stake. It cannot be invoked just to cover up crimes committed by the president.

I am for peace, for a lasting one, but compromising other things to attain the objectives is not negotiable. The MILF has an ultimate end of secession and eventual independence. Should the MOA be implemented, only time will tell if the fears of many are true.

How-to: View, Edit EXIF Data EXIF Editor

I've been asked many times how to view EXIF data in Windows XP as well edit the data for no obvious reason except when you're just going to brag if you have the latest camera or possibly to hide camera you're using and delete incriminating details of the date the photo was taken.

How-To view EXIF data, right click a file on Windows Explorer, select Properties on the menu, click the Summary tab, then Advanced to display EXIF data with photographic details.

I use IrfanView with the plugin to view EXIF data.

Editing EXIF data is tricky, it requires third party software like Opanda PowerExif to edit data but it doesn't come free (price: $49.99).

There's also ExifPilot and ExifEditor ExifEditor

For occasional use, the cheap trick is to use a hex editor, many free hex editors available, where you can edit the fields you want before saving to another file (don't overwrite the original file to be sure).

For my demo, i used HexEdit for its simplicity requiring no installation, just a small executable file.

To completely remove EXIF data in a picture, you may use EXIF Stripper (available here to hide settings and save on file storage space though minimal as claimed.

Tip: For anonymous bloggers, I recommend stripping pictures of EXIF data before posting in your blog. You can be traced by the camera model you have and date/time stamp on it if you're living in a small town.