republican-creole
site Search:


 
    All Forums Hot Topics Gallery






how-to block ads


 
Search Topic:
Uniqs:
212
Share Topic
view:
normal
Posting?
Post a:
Post a:
Links: ·Cox HSI Forum FAQ ·Cox HSI forum Links ·WEB Mail ·Cable and Sat TV forum
AuthorAll Replies

nickphx

join:2009-10-29
Phoenix, AZ

Cox "Secure" Backup, not Secure.

I spent some time setting up Cox's "Secure" Backup service.. While monitoring the traffic the client sends over during the backup process I noticed it was sending everything in plain text over port 80.. This wouldn't really matter to me except they tout the "security" of this backup service, they suggest you install their client on your laptop, phone, etc..

The client sends your username and password in CLEAR TEXT via port 80/http... The client sends your file names and file content in an un-encrypted manner. If one were to use this "Secure" backup service from a laptop on an public wifi access point you would be broadcasting all of your sensitive bits to whomever cared to listen. Sure one should never use an open wifi access point, but most people don't care.

POST /2_4/transfer.asmx HTTP/1.1
MIME-Version: 1.0
Content-Type: multipart/related; type="application/xop+xml";start="<http://tempuri.org/0>";boundary="uuid:1a6aedea-a4d1-4743-8555-594c4b8fead4+id=2789";start-info="text/xml"
SOAPAction: "http://developer.digidata.com/schemas/2_4/Write"
Host: services.backup.cox.com
Transfer-Encoding: chunked
Expect: 100-continue
Accept-Encoding: gzip, deflate
--uuid:1a6aedea-a4d1-4743-8555-594c4b8fead4+id=2789
Content-ID: <http://tempuri.org/0>
Content-Transfer-Encoding: 8bit
Content-Type: application/xop+xml;charset=utf-8;type="text/xml"
 
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Header><h:SHCredentials xmlns:h="http://developer.digidata.com/schemas/2_4" xmlns="http://developer.digidata.com/schemas/2_4" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><Username>MYUSERNAME</Username>
<Password>MYCOX.NET_PASSWORD!!!</Password><SessionId>
 
 

Seriously.. W T F. How is this "Secure"? ?!?!?

<Request><Data><xop:Include href="cid:http%3A%2F%2Ftempuri.org%2F1%2F635008006741992807" xmlns:xop="http://www.w3.org/2004/08/xop/include"/></Data><Offset>0</Offset><Path>/*My Backup/NICK-PC/C:/Users/nick/Documents/2012 Taxes/Wellsfargo_1-1-12.csv</Path><ClientCreateDate>2012-07-13T10:44:03.9116939-07:00</ClientCreateDate></Request></Write>
 
16
 

Thanks cox, you're a real friend.

Rakeesh

join:2011-10-30
Mesa, AZ

lul. I'd post this to a security bulletin ASAP, lest people start getting their accounts compromised. Some people probably already have their "secure" data compromised/stolen. I never trusted cox secure backup to begin with, so I never used it.



SoonerAl
Premium,MVM
join:2002-07-23
Norman, OK
kudos:5

FWIW...

I use small USB external hard drives on both of our Windows computers to backup critical/essential files/photos automatically. I have never wanted to use the "cloud" so to speak to backup critical/essential data...

I do, however, use SkyDrive to sync certain non-critical files and photos between our two Windows computers and an iPod Touch.


nickphx

join:2009-10-29
Phoenix, AZ

Ehh, I wouldn't trust an external drive for backing up..


Rakeesh

join:2011-10-30
Mesa, AZ
Reviews:
·Sprint Mobile Br..
·Cox HSI

reply to nickphx
Use megaupload. It's pretty damn secure, the cloud provider itself doesn't even have access to your data. The ecmascript code is open source, so you can audit it yourself if you'd like.

Plus 50GB is free, there is no file size limit, and it is easy to share files with others using that service.


Rob_
Premium
join:2008-07-16
Mary Esther, FL

Do not forget, this counts against your monthly data CrAP, too.

-Rob


nickphx

join:2009-10-29
Phoenix, AZ

The bandwidth cap was the original reason I was going to use the "Cox Secure Backup" service. I assumed the service cox provides wouldn't count against bandwidth usage.. I ended up signing up with crashplan.com. They offer several different clients and allow you to backup networked drives. I guess I will dump my backups to an external drive and drop it at my rack in the datacenter to "seed" the backup to crashplan.


Rob_
Premium
join:2008-07-16
Mary Esther, FL

It uses Mozi but, I agree, anything Cox provides, shouldn't count against the monthly data caps. I'd like to see data caps illegal to phone, dsl and cable providers. It's just an extra way of dipping into our wallets and not necessary.

-Rob



Optimus2357
Premium
join:2010-11-21
West Warwick, RI
kudos:1

And how would they do this without determining what traffic your sending and where your sending it? I would rather have a smaller "dumb" bandwidth pipe then one that is managed in such a way. Whats next, have HBO GO not count while Netflix does? Slippery slope.


Sunday, 07-Apr 19:46:43 Terms of Use & Privacy | feedback | contact | Hosting by nac.net - DSL,Hosting & Co-lo
over 13.5 years online © 1999-2013 dslreports.com.
Most commented news this week
Hot Topics