MS Office, without Microsoft

If you see the above and immediately think, Chinese release of MS Word you’d be forgiven for your mistake. It is in fact a Kingsoft product, themed to look like Microsoft office.

I was alerted to its existence in beta state by an article by on OMGubuntu. The debian package can be downloaded from  http://wdl.cache.ijinshan.com/wps/download/Linux/unstable/wps-office_8.1.0.3724~b1p2_i386.deb.

I’ve been using the Android version of the Kingsoft office package for quite some time and it just works. It’s not a paid for product, although, on the Kingsoft website the Windows version seems to be paid for.

The application needs to be broken a little bit for the English to appear, otherwise you’re stuck reading everything in Chinese. After installing the application, launching it brings up in Chinese what appears to be a product registration screen. Just enter whatever you feel like entering. To get rid of most of the Chinese text run the following in a terminal (thanks to the efforts of Mohammed Sayanvala).

cd /opt/kingsoft/wps-office/office6/2052
sudo rm qt.qm wps.qm wpp.qm et.qm

That will remove the fonts making it readable to western civilisation. Opening the suite will generate an error which can be hidden indefinitely with a small check box. It is very interesting that it only appears to open MS office documents, Word, Excel and Presentation. No OpenOffice support seems to be present.

Small secure linux distributions

With the recent news stories about bank accounts being hacked and monies pilfered we decided to investigate ways to protect our business.

Now the problem is two fold.

Online banking login details

The first is quite obvious, protecting the online banking username and password. It is fairly obvious when someone stands over your shoulder concentrating on memorising your account details. It is also very easy to protect yourself from this approach by, say, locking yourself in a tiny room.

More frightening is key logging software. We’ve on occasion identified key logging software running on a clients machine in the logs of one of our products. Malware, trojans, virus (whatever the plural may be) and the like easily infects browsers and workstations. We even had articles this week about government spy software in RSA masquerading as a firefox process collecting end user data. So this is where the problem lies, protecting the details from stealthy criminals thieving all your hard earned cash.

One time passwords

There is a fallacy regarding the cellphones we carry. Banks do not make us aware of this and place the onus on the phone owner to ensure their security. Our cellphone companies do not and have never indicated that sim cards are secure and securely dished out. So when our banks added OTP sms message and claimed we’re all saved it was a huge lie. A fake ID, a couple of bob, and 30 minutes later a crafty criminal is in possession of a new sim card on your account. The OTP sms messages arrive on the new sim card (as the one in your phone was declared stolen) and bobs your uncle, new beneficiaries are created, money transferred and wailing and gnashing of teeth for the now much poorer individual.

Solutions

The solution is not simple, however, one easy start is to use a small OS that stores no data, runs from RAM and loses all data when the workstation is rebooted.

http://en.wikipedia.org/wiki/List_of_Linux_distributions_that_run_from_RAM. Wikipedia lists a number of these small distributions. So now when locked in a small windowless room this ensures no software key loggers are able to steal bank account details. Note software carefully placed in the previous sentence. Physical security is the only way to protect yourself from hardware key loggers readily available for purchase on the internet.

We’re experimenting with Tails, a small distro employing the tor network for anonymity. It’s not ideal, as it forces you to use the Tor network to access the internet securely which makes the experience slow and most banks will raise alarm if your bank activity jumps from country to country.

Another possibility is Lightweight Portable Security (LPS) which is a DoD initiative, if I can get it to work…

Synergy

A blast from the past. I just rediscovered the joys of Synergy. I used to use it over a decade ago while still a lecturer at University. I needed a tool, before I finally abandoned Windows for good, to enable me to effortlessly switch between my Linux workstation, Gentoo at the time, and the Windows workstation. I didn’t want an additional keyboard and mouse to confuse my already cluttered academic brain.

In comes Synergy. It allows multiple workstations to be controlled by a keyboard and mouse connected to one of the devices. The mouse will move from the edge of one monitor to the other. Focus follows mouse and the keyboard then inputs on the client. It’s still the same simple application that can run on Linux, Mac and Windows. There is even a client for Android in alpha dev stage, synergyandroid, so as I’m typing this my mouse can seamlessly move from Laptop, to workstation to Android tablet.

section: screens
Laptop:
Desktop:
AndroidTablet:
end

section: links
Desktop:
left = AndroidTablet
right  = Laptop

Laptop:
left = Desktop

AndroidTablet:
right = Desktop

end

section: aliases
Desktop:
paul-Desktop
end

The config file, /etc/synergy.conf is all too simple to configure for this basic setup. The workstation is the server, and the laptop and tablet the clients. If one or more of the clients are not available that edge of the window disappears seamlessly.