 | Cox "Secure" Backup, not Secure.I spent some time setting up Cox's "Secure" Backup service.. While monitoring the traffic the client sends over during the backup process I noticed it was sending everything in plain text over port 80.. This wouldn't really matter to me except they tout the "security" of this backup service, they suggest you install their client on your laptop, phone, etc.. The client sends your username and password in CLEAR TEXT via port 80/http... The client sends your file names and file content in an un-encrypted manner. If one were to use this "Secure" backup service from a laptop on an public wifi access point you would be broadcasting all of your sensitive bits to whomever cared to listen. Sure one should never use an open wifi access point, but most people don't care. POST /2_4/transfer.asmx HTTP/1.1
MIME-Version: 1.0
Content-Type: multipart/related; type="application/xop+xml";start="<http://tempuri.org/0>";boundary="uuid:1a6aedea-a4d1-4743-8555-594c4b8fead4+id=2789";start-info="text/xml"
SOAPAction: "http://developer.digidata.com/schemas/2_4/Write"
Host: services.backup.cox.com
Transfer-Encoding: chunked
Expect: 100-continue
Accept-Encoding: gzip, deflate
--uuid:1a6aedea-a4d1-4743-8555-594c4b8fead4+id=2789
Content-ID: <http://tempuri.org/0>
Content-Transfer-Encoding: 8bit
Content-Type: application/xop+xml;charset=utf-8;type="text/xml"
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Header><h:SHCredentials xmlns:h="http://developer.digidata.com/schemas/2_4" xmlns="http://developer.digidata.com/schemas/2_4" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><Username>MYUSERNAME</Username>
<Password>MYCOX.NET_PASSWORD!!!</Password><SessionId>
Seriously.. W T F. How is this "Secure"? ?!?!? <Request><Data><xop:Include href="cid:http%3A%2F%2Ftempuri.org%2F1%2F635008006741992807" xmlns:xop="http://www.w3.org/2004/08/xop/include"/></Data><Offset>0</Offset><Path>/*My Backup/NICK-PC/C:/Users/nick/Documents/2012 Taxes/Wellsfargo_1-1-12.csv</Path><ClientCreateDate>2012-07-13T10:44:03.9116939-07:00</ClientCreateDate></Request></Write>
16
Thanks cox, you're a real friend. |
|
|
|
 | lul. I'd post this to a security bulletin ASAP, lest people start getting their accounts compromised. Some people probably already have their "secure" data compromised/stolen. I never trusted cox secure backup to begin with, so I never used it. |
|
 SoonerAlPremium,MVM join:2002-07-23 Norman, OK kudos:5 | FWIW...
I use small USB external hard drives on both of our Windows computers to backup critical/essential files/photos automatically. I have never wanted to use the "cloud" so to speak to backup critical/essential data...
I do, however, use SkyDrive to sync certain non-critical files and photos between our two Windows computers and an iPod Touch. |
|
 | Ehh, I wouldn't trust an external drive for backing up.. |
|
 Reviews:
·Sprint Mobile Br..
·Cox HSI
| reply to nickphx Use megaupload. It's pretty damn secure, the cloud provider itself doesn't even have access to your data. The ecmascript code is open source, so you can audit it yourself if you'd like.
Plus 50GB is free, there is no file size limit, and it is easy to share files with others using that service. |
|
 Rob_Premium join:2008-07-16 Mary Esther, FL | Do not forget, this counts against your monthly data CrAP, too.
-Rob |
|
 | The bandwidth cap was the original reason I was going to use the "Cox Secure Backup" service. I assumed the service cox provides wouldn't count against bandwidth usage.. I ended up signing up with crashplan.com. They offer several different clients and allow you to backup networked drives. I guess I will dump my backups to an external drive and drop it at my rack in the datacenter to "seed" the backup to crashplan. |
|
 Rob_Premium join:2008-07-16 Mary Esther, FL | It uses Mozi but, I agree, anything Cox provides, shouldn't count against the monthly data caps. I'd like to see data caps illegal to phone, dsl and cable providers. It's just an extra way of dipping into our wallets and not necessary.
-Rob |
|
 Optimus2357Premium join:2010-11-21 West Warwick, RI kudos:1 | And how would they do this without determining what traffic your sending and where your sending it? I would rather have a smaller "dumb" bandwidth pipe then one that is managed in such a way. Whats next, have HBO GO not count while Netflix does? Slippery slope. |
|