 | Cox "Secure" Backup, not Secure.I spent some time setting up Cox's "Secure" Backup service.. While monitoring the traffic the client sends over during the backup process I noticed it was sending everything in plain text over port 80.. This wouldn't really matter to me except they tout the "security" of this backup service, they suggest you install their client on your laptop, phone, etc.. The client sends your username and password in CLEAR TEXT via port 80/http... The client sends your file names and file content in an un-encrypted manner. If one were to use this "Secure" backup service from a laptop on an public wifi access point you would be broadcasting all of your sensitive bits to whomever cared to listen. Sure one should never use an open wifi access point, but most people don't care. POST /2_4/transfer.asmx HTTP/1.1
MIME-Version: 1.0
Content-Type: multipart/related; type="application/xop+xml";start="<http://tempuri.org/0>";boundary="uuid:1a6aedea-a4d1-4743-8555-594c4b8fead4+id=2789";start-info="text/xml"
SOAPAction: "http://developer.digidata.com/schemas/2_4/Write"
Host: services.backup.cox.com
Transfer-Encoding: chunked
Expect: 100-continue
Accept-Encoding: gzip, deflate
--uuid:1a6aedea-a4d1-4743-8555-594c4b8fead4+id=2789
Content-ID: <http://tempuri.org/0>
Content-Transfer-Encoding: 8bit
Content-Type: application/xop+xml;charset=utf-8;type="text/xml"
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Header><h:SHCredentials xmlns:h="http://developer.digidata.com/schemas/2_4" xmlns="http://developer.digidata.com/schemas/2_4" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><Username>MYUSERNAME</Username>
<Password>MYCOX.NET_PASSWORD!!!</Password><SessionId>
Seriously.. W T F. How is this "Secure"? ?!?!? <Request><Data><xop:Include href="cid:http%3A%2F%2Ftempuri.org%2F1%2F635008006741992807" xmlns:xop="http://www.w3.org/2004/08/xop/include"/></Data><Offset>0</Offset><Path>/*My Backup/NICK-PC/C:/Users/nick/Documents/2012 Taxes/Wellsfargo_1-1-12.csv</Path><ClientCreateDate>2012-07-13T10:44:03.9116939-07:00</ClientCreateDate></Request></Write>
16
Thanks cox, you're a real friend. |
|
 | lul. I'd post this to a security bulletin ASAP, lest people start getting their accounts compromised. Some people probably already have their "secure" data compromised/stolen. I never trusted cox secure backup to begin with, so I never used it. |
|
 SoonerAlPremium,MVM join:2002-07-23 Norman, OK kudos:5 | FWIW...
I use small USB external hard drives on both of our Windows computers to backup critical/essential files/photos automatically. I have never wanted to use the "cloud" so to speak to backup critical/essential data...
I do, however, use SkyDrive to sync certain non-critical files and photos between our two Windows computers and an iPod Touch. |
|
|
|
 | Ehh, I wouldn't trust an external drive for backing up.. |
|
 Reviews:
·Sprint Mobile Br..
·Cox HSI
| reply to nickphx Use megaupload. It's pretty damn secure, the cloud provider itself doesn't even have access to your data. The ecmascript code is open source, so you can audit it yourself if you'd like.
Plus 50GB is free, there is no file size limit, and it is easy to share files with others using that service. |
|
 Rob_Premium join:2008-07-16 Mary Esther, FL | Do not forget, this counts against your monthly data CrAP, too.
-Rob |
|
 | The bandwidth cap was the original reason I was going to use the "Cox Secure Backup" service. I assumed the service cox provides wouldn't count against bandwidth usage.. I ended up signing up with crashplan.com. They offer several different clients and allow you to backup networked drives. I guess I will dump my backups to an external drive and drop it at my rack in the datacenter to "seed" the backup to crashplan. |
|
 Rob_Premium join:2008-07-16 Mary Esther, FL | It uses Mozi but, I agree, anything Cox provides, shouldn't count against the monthly data caps. I'd like to see data caps illegal to phone, dsl and cable providers. It's just an extra way of dipping into our wallets and not necessary.
-Rob |
|
 Optimus2357Premium join:2010-11-21 West Warwick, RI kudos:1 | And how would they do this without determining what traffic your sending and where your sending it? I would rather have a smaller "dumb" bandwidth pipe then one that is managed in such a way. Whats next, have HBO GO not count while Netflix does? Slippery slope. |
|
 | You think they don't already know or monitor protocol and destination of traffic? |
|
 Optimus2357Premium join:2010-11-21 West Warwick, RI kudos:1 | Of-course they do, they just don't give priority to any specific traffic other then to manage it's efficiency. Maybe to a degree with their VOIP traffic, but since I don't use VOIP I don't have a problem with that. If they start giving special privileges to the data on their network based on personal interests...well that leads to a ugly future.
My opinion? Build a NAS, do your daily backups to that and then do less frequent backups(when you caps allow) from the NAS to a cloud of your choice. Conserves bandwidth vs your cap, full control of client/server, faster, and not dependent on a ISP. Also you can set up your NAS in RAID so you can get reduncy as well as backup. |
|
 Rob_Premium join:2008-07-16 Mary Esther, FL | I have 400 a month data cap, which I hardly touch, I really want to be able to use this service because we have unlimited data on the backup which is nice. I have some important things but my NAS server in house backs them up. It's almost 2 TB's worth of stuff.
-Rob |
|
 Optimus2357Premium join:2010-11-21 West Warwick, RI kudos:1 | My point is you can control what your backing up and slowly do it over the months from NAS to cloud. Say a few days before the end of the month when the Caps reset you have 200MB left, back up 200MB then wait until next month. You can also backup a little more then 200 maybe and see if you get a notice. I have found the restrictions are tighter or looser based on how population dense your area is. Once everything is on the Cox server bandwidth will be minimal because your just saving changes. |
|