Was Sheryl Attkisson's computer hacked? The video is hardly compelling evidence

The Politico has published an exclusive cell-phone video provided by former CBS News reporter Sheryl Attkisson and supporting her claims that her computer was hacked, presumably in relation to her inconvenient reporting on Benghazi and other Administration scandals.  The video shows a Word document on her Macbook Air being modified by some mysterious operator.

Now, this would be easily enough explained if Attkisson had enabled some standard OS X features and a malevolent operator had leveraged them, or if an attacker had somehow installed and enabled remotely-accessible hacking tools.  But, as I'll document, there are problems with either explanation, and with dismissive explanations from some observers that Attkisson was simply experiencing "garden variety technical glitches."  In particular there is one detail in the video that seriously needs explanation from Attkisson or whoever set up her Mac.

First, Macs (and PCs) have remote desktop sharing capability. It's normally disabled but is easily enough enabled by a user with administrative privileges on the machine. I use it all the time to access an old Mac that I use for archival purposes.

But, I know that machine's IP address. I can't just access anyone's Mac that way: it must be enabled, I must know the machine's IP address (and unless it's connected directly to a DSL or cable modem, there's no easy way to get to it from outside the LAN that the machine is on, unless a dynamic DNS utility is running on the machine, which on the evidence I'd doubt Attkisson would know how to arrange on her own).

But there's a problem.  Sitting at the target machine, the phantom operations from a remote desktop-sharing operator look a lot like what Attkisson shows in her video. But, if one is using ordinary Mac screen sharing as built-into OS X, there is an icon in the menu bar that lets you know that control of the machine is being remotely shared. An example is shown below, highlighted in blue: ​

 In what little of that corner of the screen Attkisson shows, there's no such icon: ​

Instead, from left: Dropbox (fully sync'd), AppleScript, Time Machine (OS X's built-in backup utility ...and it seems Sheryl hasn't backed up lately), Bluetooth (on), WiFi (connected), speaker volume, battery (charging), date/time (apparently it's Monday).

There may be other items to the right of the edge of the screen capture, but this moment, at about 0:50, was the broadest view I was able to capture from her video.

...Wait: AppleScript?

AppleScript is a built-in OS X capability that allows easy recording and playback of keyboard, menu and screen operations.  What is its icon doing in the menu bar during this video?

Based on the video, either:

• The attacker is using OS X Screen Sharing but its telltale icon resides just off the edge of the video.  The issue of getting to the computer through whatever WiFi network it's logged into is still tough to explain. 
• Or, the built-in screen sharing capability is not what's being utilized by the remote attacker, meaning Attkisson's computer was really and truly hacked.
• Or, something other than a remote session is actuating the mouse and keyboard off-screen, such as a USB or Bluetooth external keyboard... or an AppleScript macro. 

Bottom line: It's a shame that Attkisson isn't more computer literate (and better videographer!), as this video raises more questions than it answers, and dastardly action by some government agent is not necessarily the likeliest explanation, much as one might want to think so.

How to easily share Keynote presentations and other iWork documents with colleagues

I do a ton of presenting and have found Keynote on my iPad to be a tremendous upgrade over PowerPoint.

• There's no waiting for boot-up, 
• Transitions are beautifully fluid, 
• Animations and videos are 100% reliable and always smooth (and never a black box on the screen where a video is supposed to be!), 
• Projector compatibility is untouchable, and



Courtesy Geekwire's excellent article, "Undeterred
by Office for iPad, Apple updates iWork suite"

• Integrated presentation tools such as virtual "crayons" and "laser pointers" mean you never have to face away from your audience.  

In a competitive environment, Keynote is a valuable arrow to have in your quiver.  Plus, the software runs identically on my iPhone, meaning I can always have your presentations in my pocket.  Being able to whip out a compelling, good-looking presentation at a moment's notice conveys a valuable message of preparedness and professionalism.  That is not of merely academic merit-- it has meant actual, substantial sales for me.

Keynote presentations also transport reliably.  There are none of the missing-font and misplaced-video issues that have afflicted PowerPoint for two decades.  With Keynote, all media and other resources are bundled together in an amalgamated file format.

However, the locked-down nature of iOS presents obstacles to sharing Keynote presentations with colleagues.  You can store a presentation in iCloud and share a link to that, but if the presentation is large, chances are excellent that the download into the recipient's device will break at some point.  Perhaps that will improve over time.

iOS also pioneered a concept of hiding the device's file system, having applications own and manage their own files instead.  There is nothing like a Windows Explorer or Finder in iOS.  You open Keynote; your Keynote files are right there.

A mysterious option

First, let's agree that using iTunes to convey files from device A to device B is not acceptable in this day and age.  Next, let's stipulate that iCloud's current file-conveyance capabilities aren't yet industrial-class, especially with larger Keynote presentations.

But there's a third mechanism: the mysterious WebDAV option you may have noticed in Keynote and other iOS apps, both on iPad and iPhone.

Web Distributed Authoring and Versioning is a standards-based approach for making the web a readable and writeable medium.  It provides a web-centric, firewall-friendly way of accessing and storing files across the Internet.  Sounds good... but, it's not clear what even the first step should be for leveraging this technology on iOS.

First, fond as I am of Dropbox, it does not support WebDAV, and per their FAQs they have no plans to do so.  So it's not a solution here.  There are third-party services such as DropDAV that you can subscribe-to that provide WebDAV compatibility for Dropbox, but for my occasional usage the annual cost seemed unreasonable, and some users would be justifiably uncomfortable with allowing a third-party service to have access to their Dropbox'd files.

A few competing cloud storage providers provide rudimentary WebDAV compatibility, but flaws abound.  Box.net, for example, lets you upload and download using WebDAV-- but with a catch: At least for the pricing tiers I explored, you have to give your account username and password to anyone you want to be able to access any file.  That's such an obvious non-starter that it's almost mind-blowing.  Even more mind-blowing is how universal it seems to be; I spent hours exploring various services and this sort of idiocy is depressingly common.  Shame on you, Internet.

An exceptional exception

Finally, an exception popped up.  There is a Swiss online storage company, MyDrive.ch, which offers a responsive, secure and well-priced service that supports WebDAV beautifully and has optional guest accounts.  So, you can distribute the guest-account credentials and limit their access to specific folders and permissions.  Perfect!

MyDrive even offers a free tier, with one guest account and 100MB of storage.  That might be enough for many purposes, but I needed more storage than that.  So I upgraded to their "MyDrive Pro" with over 3GB of storage for the princely sum of approximately $10 a year (and they gave me a bonus month on top of that).  Additional guest accounts are $0.50 a month.

They have a free iOS app too, but that doesn't get around the problem that only Keynote can access your presentations on your iDevice.  For that, we'll use WebDAV:

How to use MyDrive.ch's WebDAV feature to share your Keynote presentations

1) Set up your MyDrive.ch account in a browser on your computer or iPad.  You'll receive an authentication email immediately; look for this, and click the activation link it contains.  All set!

2) In the browser, log in and establish any folder structure you want.  I suggest creating a dedicated folder for uploads from your guest(s) if that's something you might want to enable.  MyDrive.ch enforces a rule that only the master account can write to the root folder; by default, guests can access files in the root folder for read-access only.

3) Switch to Keynote.  On iOS, in order to log into your WebDAV-supporting service to upload a presentation, you must first go through the initial steps of downloading something even if there's nothing there yet to download.  So to start: In Keynote's screen that presents your collection of presentations, click the "+" sign at the upper left, and select Copy from WebDAV.  A login screen will appear.

4) For the URL, type https://webdav.mydrive.ch/  ...you can add a folder-name to that if you wish.  (All this is case-sensitive.)  Type in the user name you just established, or the guest name in the form of GuestName@MainUserName. Then, fill in the password for the user you just entered. 

5) Click "Sign In."  Your file-list, if any, will appear.  Clicking on any presentation will download it to your iDevice's Keynote store.  (Keynote files will show up with a .zip extension-- ignore that.)

6) To upload a presentation to share with others, cancel out of the login screen and open the presentation you want to upload.  Click the Share button, then Send a Copy.) Select WebDAV.  From the upload formats you're offered, you'll probably want to choose Keynote.  Your iDevice will click and whirr for a moment, and then the file will be uploaded.  

Done!

Steps 4 & 5 are all your colleagues need to access your presentations: they'd just click the "+" button at the top left of their Keynote presentations listing, Copy from WebDAV, fill in the URL and guest username and password, et voila.

A few caveats

MyDrive supports SSL encryption, as you may have noticed from the https URLs in these examples.  However, if you want your browser-based connection encrypted, you must checkmark the "Use SSL encryption" option at the login screen, even if you logged in via https://mydrive.ch.  I would prefer an "always use SSL" option be instituted in the account settings ...and certainly if you log in via an SSL-encrypted page, your connection should stay SSL-encrypted.  From a usability standpoint, this is a minor but potentially important behavior to be aware-of. UPDATE: The responsive MyDrive folks have responded to this post by changing to an always-on SSL policy. Great!

If you wish to allow your colleagues to upload presentations without giving away your master account credentials:

• Create a folder to receive their uploads:  Log into your MyDrive.ch account using a browser on your computer or iPad.  Add the folder via the "Create Folder" button.
• Create a guest account for your colleagues to use and set its permissions to allow uploads:  In the Settings menu, select the Guests tab.  Create the guest account there, assigning full access to the guest.  (Currently, MyDrive's upload access setting doesn't actually enable uploading from within iWork applications via WebDAV.  I have brought this bug to MyDrive.ch's attention.UPDATE: Per MyDrive's engineers, this behavior is probably due to Keynote's usage of temporary scratch files.)  Don't worry, a guest account with "full access" can't delete files or folders at the root level.  If you wish to restrict access to specific folders for specific guest accounts, use a browser to go to your main file listing, and click the permissions button to the right of the folder.  

MyDrive.ch offers other goodies too.  For example, you can mount your MyDrive store as a network drive if your operating system supports such things (and all versions of OS X have done so: In Finder's Go menu, select Connect to Server and use the URL https://webdav.mydrive.ch ...authenticating with your username and password.)

Recommended.  My colleagues and I have already found this to be very useful for distributing some of my Greatest Hits presentations... and, likewise, getting their own to me, directly from their iPads.

On repurposing an old Mac, and how to automatically .pdf and print important emails

When I upgraded from an impeccable and solid but nearly-four-year-old Macbook Pro to a spectacular new Retina model in late 2012, I had every intention of selling the old machine.  But as fine a machine as it was, it was worth only a few hundred dollars, so I decided to repurpose it as a server.

OS X Server is an inexpensive app, available from the Mac App Store for about twenty dollars, which puts some GUI lipstick on conventional UNIX server functionality.  This makes the functionality a little bit easier to use and manage (but, warning, only a little bit).  Out of the box, Server provides a very secure L2TP VPN option, which has proven to be useful as a complement to the slightly less secure PPTP VPN running on my Raspberry Pi.  I have CloudPull running continuously on this machine, backing up my gmail account to the machine's hard disk, and this Mac is also linked to my Dropbox account, so it continuously duplicates my critical work-in-progress from the various machines I use.  From there Time Machine backs everything up to two alternating disks attached to my home's Time Capsule router.  It's all part of my multi-layered, duplicative backup strategy.

Best of all, the machine's desktop is remotely and securely accessible via Screen Sharing.  I moved all my email archives to this machine, and now I can search for old emails easily when traveling by starting Screen Sharing, using Spotlight to search my email stash for keywords, and then paging through the results in Finder using Cover Flow and Quick Look-- a delightful reason to use mail.app in the first place.  It's simply wonderful for an email pack-rat like me.

Meanwhile--quite aside from the topic of this nifty little server--my HP OfficeJet multifunction printer has e-print capability that lets print-jobs be sent via a special email address assigned to the printer.  So for two years I've been trying to configure things so that my travel receipts are automatically printed and waiting for me when I return from business trips.  My typical travel partners are Hertz, Marriott, United Airlines, Southwest Airlines, Uber and the occasional Square-powered taxi.  All of these companies send me receipts via email.  I use a Gmail account for receiving these and also because the marvelous TripIt.com service can scour a Gmail account for travel reservations and automatically put schedule details into my Mac/iPhone calendar.  So cool.

One would think that Gmail's filtering capability would allow email receipts from these companies to be automatically forwarded to the HP printer's e-print address.  A Gmail filter like this should do the job:

Matches: ("southwest airlines confirmation" OR "eticket itinerary" OR "Hertz E-Mail Statement of Charges" OR "thanks for staying" OR (squareup AND "receipt from") OR "Uber ride receipt")
Do this: Forward to xxxxxx@hpeprint.com

...where xxxxx@hpeprint.com is my printer's email address.

Well.  Not so easy.  First, the hpeprint.com service rejects automatic forwards from Gmail with a cryptic error message:

Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the server for the recipient domain hpeprint.com byonramp02.hpeprint.com. [15.201.184.202].

The error that the other server returned was:
550 5.7.1 Command rejected

So while manually-forwarded emails usually worked, filter-based automatic forwards wouldn't.  Bad enough, but then HP recently morphed hpeprint.com into "hpconnected.com," necessitating a new email address for the printer.  And, after transitioning my account to the new service, the service quit working altogether!  Some quick googling shows that this service is now unreliable at best and totally inoperative for legions of users.

Nothing to count on, then.  But why not implement something similar on my doughty old Macbook Pro?

Here's how to implement e-print functionality on OS X

This should work with any printer.  My objective is to have my travel receipt emails and their attachments automatically printed and filed as .pdfs, but this same technique can be used to automatically print-and-file emails of any sort.  (You don't have to be running your Mac as a server.)

My approach borrows from a host of web posts from folks doing similar things, but many previous examples are now complicated by the new application sandboxing security features introduced in OS X 10.8 Mountain Lion.  The following works with the new ways of doing things and includes a cute twist or two.

The two tools used are AppleScript and Automator, both of which are built-into every Mac.  AppleScript integrates easily into mail.app's rules framework, so incoming emails that meet certain criteria can be processed automatically.  AppleScript scripts can be programmed from raw commands, or the AppleScript engine can mimic user interactions with application GUIs.  Meanwhile, Automator makes automatic printing and filing super-easy.  The combination is very powerful and convenient, and it's all good geeky fun.  (And you can still use any e-print service your printer might support too-- there's nothing mutually-exclusive about this.)

• First, out of fondness for the TripIt.com service, I receive my emailed receipts to my gmail account.
• I set up a new free account on the superb GMX.com webmail service for exclusive use for receipt-printing purposes.  There are other ways of doing this, but this works brilliantly.  I've had my eye on GMX.com for a while now and have had a test account there for some months.  It works well in a browser and integrates beautifully with the Mac's mail.app email client.  GMX.com seems a more private and standards-compliant alternative to other webmail vendors, and its spam filtering is effective (perhaps a bit aggressive-- I had to white-list my Gmail and other addresses in it).  GMX.com provides you with a free IMAP account with unlimited email storage; setting up a new account takes perhaps five minutes and requires minimal personal information and no credit-card.  Besides being great for general email purposes, GMX.com is terrific for setting up a specific "print to me" email account.  Good stuff.
• Once the print-to-me email account was set up on GMX.com and active in mail.app, I set up the Gmail filter to forward incoming receipts to the new print-to-me email.  This just meant replacing the xxxxx@hpeprint.com address in the filter rule above with the new GMX.com address.
• In mail.app, go to the app's Preferences, then the Rules pane.  Add a rule.  In the Description field, name it something like "Receipt Print".  In the conditions block, one way of doing thing is to select "If [any] of the following conditions are met: [Account] is [gmx account]".  Then, in the Perform the Following Actions field, select Run Applescript, and select Open in Finder.  This will open an AppleScript editor.
• Paste the following into the AppleScript editor:

• Note I created a folder called "autoprint" inside my Downloads folder.  The application sandboxing introduced with Mountain Lion limits where apps can write to your disk; Downloads is one of the few places mail.app is now allowed to write without user intervention.  So, create that folder in your Downloads folder.  Inside of that, make another folder called "printed".
• Edit the hard-coded folder names in my example script (especially the one in quotes towards the end) to match your user name and so forth, minding case.  Then click the compile button at the top of the AppleScript editor, and check for any errors.  When satisfied, save it.  Check that your mail.app rule points to the AppleScript you just made.  (Note that initiating the script's construction from within mail.app ensures that the script is stored within mail.app's own script folder, ~/Library/Application Scripts/com.apple.mail ...another recent security improvement.)
• If you're running OS X 10.8 Mountain Lion: In System Preferences, click the Accessibility icon and ensure that "Enable access for assistive devices" is checkmarked at the bottom.  This allows the GUI scripting in the script to operate.  See this helpful post for how to do the same thing in OS X 10.9 Mavericks, which grants assistive permissions with per-app granularity for security reasons.
• Now, load Automator.  Choose "Folder Action".  In the Choose Folder pull-down, select Other, then navigate to select your autoprint folder.  Drag the Print Finder Items action from the column at the left into the workflow.  Then drag the Move Finder Items action under that, and specify that printed items should be moved to the "printed" subfolder you previously placed in your autoprint folder.  Save this new Folder Action you've made.

You're done.  Incoming emails will be split from their attachments.  Any attachments will be given unique names based on the numeric mail ID and original subject, then they will be placed in the autoprint folder.  Meanwhile the body of the email will be converted to .pdf (complete with clickable embedded links!) and also placed in the autoprint folder.  Printing will occur automatically, after which the files will be moved to the printed folder.  A print-success email notification is then sent back to you.  The original emails will remain untouched in mail.app.

So handy for compiling expense reports after a long trip!  You can even snap a photo of paper receipts with your phone as you travel and email them to your print-to-me address.  It's a great way to ensure receipts aren't lost or forgotten.  

The script is easy to modify if you have different needs, too.  Enjoy.

How to work around the latest Man-In-The-Middle attacks

The ImperialViolet blog has an informative analysis of the just-patched encryption issue that can potentially expose unpatched iOS devices to a man-in-the-middle eavesdropping situation in some circumstances.  Seems Mac users running OS X 10.9 Mavericks should anticipate an update in the next days too…

Do this now: Update your iOS device straightaway, and your Mac when an update comes.  It couldn't be easier: in iOS, go to Settings, click General, and then Software Update.  You'll need to be on WiFi.  The whole process takes 5-7 minutes and temporarily requires a shade over 1GB of free space on your device for scratch storage.

The vulnerability was in an open-source component of iOS (and OS X, and potentially other platforms).  My point is not to make snide assertions about open source— I agree that many eyes make for a more secure product, and the solidity of Linux attests to that.  But it's no panacea, as mistakes can still be made and persist, as this demonstrates ...as does the 14-month-old WebView Android vulnerability that made the news in the past few days.  In this newest case the flaw is very easy to see even if, like me, you’re no expert in C-like languages or encryption.  But somehow it got overlooked, including by the compilers that one would have hoped would have caught such a visible issue.

From what I’ve read, seems the code involved is a fork of the OpenSSL encryption module.  I’ve not yet seen an analysis of whether it may have propagated beyond iOS/OS X.  You can bet that many eyes are looking into that right now.

As I understand it: in this vulnerability, a man-in-the-middle attacker possessing an encryption certificate signed by a trusted Certificate Authority could potentially intercept an encryption handshake between a user and a secure service or website, and under some circumstances the mechanisms that would detect such an attack would be short-circuited, allowing the MITM to eavesdrop or maybe impersonate the remote party.

A Workaround

Patch or no patch, one way around vulnerabilities of this sort is to tunnel past the attacker using a virtual private network that authenticates by some unrelated mechanism.  Typically, once a VPN client is set up on your computer, tablet or phone, you can connect to it most any time, and it establishes an encrypted tunnel and routes some or all your traffic into that tunnel so nearby eavesdroppers can’t make sense of it.

Using a VPN routinely is not a bad idea for those, like me, who frequently rely on public hotspots in hotels, planes and other venues… including in untrustworthy countries.  A bonus is that a VPN also evades firewall blocks for things like Voice-over-Internet and (in some countries) social media.  Of course, one must have their eyes open about the local rules for utilizing such services… It’s one thing if your hotel blocks VoIP to maximize its in-room-phone revenues, but VoIP is flat illegal in many Middle East countries (for example).  Fortunately, if you’re on a VPN, no one between you and your VPN service can detect what you’re doing, at least not easily.

Also, when you’re connected via a VPN, it appears to the services you connect-to that you are connecting from the geographic location of your VPN’s endpoint.  That’s great for accessing your subscriptions to things like Netflix and Hulu when you’re traveling beyond copyright enforcement borders.

Commercial VPN services are plentiful, cheap and easy to use.  It’s also easy to set up your own: Here at Jordan Manor we have three: two (PPTP and ssh-forwarding) running on Linux on a little Raspberry Pi per the instructions at http://unvexed.blogspot.com/2012/08/how-to-set-up-real-encrypted-vpn.html and http://unvexed.blogspot.com/2012/08/how-to-use-raspberry-pi-as-secure-web.html and then a third kind (L2TP) running on an elderly Mac enjoying a second life running OS X Server.

Although some firewall situations block VPNs as well, having a choice of VPNs maximizes the chance one will get through.  And running your own VPN means blocking strategies based on the IP addresses of known commercial VPN services won’t work.  Corollary: if you successfully run your own VPN in a situation where commercial VPNs are routinely blocked, don’t blab about it, and resist the temptation to run “check my IP address” utilities on the web when using your VPN, as these can serve as honeypots that database the IP addresses of likely VPN services, which can result in their being blacklisted.

(Meanwhile, blocking strategies based on the port numbers commonly used by VPN services can sometimes be evaded by routing your VPN through non-standard ports ordinarily utilized for other services less likely to be blocked, though that’s often not possible since port assignments are often baked in the pudding of most operating systems and clients.  Of the three VPN implementations I run here, only the ssh-forwarding approach is amenable to that dodge.)

The takeaway

Just be careful out there, use duplicative layers of security when you can, pay attention to updates and patches for your OS and applications and especially for things that execute code on your machine, like Java and Flash.

Something to watch

One thing worth listening-for in the coming days is the potential impact of this bug on other platforms that might utilize the same open-source code …including the Tor network, as it is OpenSSL based.