Getting Hacked (K2 #86)

Question of the Week
Why are so many Bhutanese websites being hacked?
— Chimmi P., Mothithang

Answer
Dear Chimmi,

In the last few years, it seems that almost every website in Bhutan underwent surgery by knives of hackers. From RGoB’s main portal (www.bhutan.gov.bt) to BOB, T-Bank, BICMA, RCSC, DPT, Royal Bhutan Police, DrukNet, tour operators, schools... you name it! Now for the news - good and bad.

The good news: The attacks are often simple ones, and the hackers – perhaps bored teenagers sitting in an internet cafe in Tehran or Istanbul – are not professionals. They usually take advantage of well-known software vulnerabilities in the server. In fact, it’s easy to avoid these simple attacks; one only needs to make sure the server software is up to date (much like the Windows Update feature on personal computers). Many webmasters in Bhutan, however, don’t bother to update the server software, and so suddenly the websites display a cryptic message in Arabic (often bundled with an oriental tune).

The bad news: Given the abysmal state of internet security in the country, combined with the fact that more and more sensitive systems and databases are now online, it is difficult to overestimate the amount of damage that can be caused by malicious, professional hackers. The results can be disastrous. Bhutan must start taking cyber security seriously.

“There are no jobs for IT graduates” has become a common mantra these days, and fewer class XII pass outs are choosing the IT route. The fact is, however, that there are jobs – both in Bhutan’s private sector and abroad – for good computer programmers. The problem is not the jobs – it’s the type and quality of the degrees. I recently met a Bhutanese employer in Bhutan who is looking for skilled programmers, but was not able find a single one although he interviewed hundreds of IT graduates, many of whom are decorated with Bachelor in Computer Application (BCA) degrees. I have had similar experiences. There is a limited market for excellent BCA graduates, but a much larger demand for rigorous B.Tech or Computer Science graduates from reputable universities. The end result: while there are jobs for skilled software engineers and coders (as programmers are often known), the current state is that most of the IT graduates are unemployable.

---

Readers are encouraged to submit technology-related questions to boaz@thimphutech.com

Google not Showing Doodles in Bhutan. Why?

Two months ago, on March 8^th, 2014, the world celebrated International Women's Day (IWD). On that day, as it sometimes does, the official Google home page logo was replaced with a "Google Doodle", a fun and interactive logo designed especially for that occasion. Millions of users around the world enjoyed the logo and the video that came with it (click here to see that doodle; read more Google Doodles, including an archive of more than 2000 past doodles.)

Google Doodle for IWD 2014 (shown worldwide - but not in Bhutan)

Some Google doodles are specific for a country. For example, a few days ago Google showed a special logo to users in the country of Israel, which celebrated its 66^th Independence Day.

Google Doodle for Israel's 66^th Independence Day

Many of the doodles, like the IWD 2014 one, are international and are viewed by users in many countries — almost. For some reason, ever since Google.bt was launched, Google has stopped displaying international Google doodles in Bhutan.

Here is a map showing, in BLUE, the countries where the IWD 2014 doodle was shown. Note that Bhutan — the tiny white speck near NE India — is in WHITE. Bhutanese users got the same treatment as users in less-women-friendly countries such as Iran, Sudan, and Yemen. Why?

The reach of the IWD 2014 Doodle

But that doesn't stop here. Checking information about other international Doodles (Earth Day, Mother's day, birth and death anniversaries of important people, etc) shown in the last few years, it is apparent that users in Bhutan are always excluded. And we dare not even mention the remote possibility that Google can create Doodles specifically for events or people in Bhutan...

Google, bring doodles back to Bhutan!

Update: Yesterday (May 11^th) the 1.2 billion neighbors to our south (along with many others around the world) enjoyed the following Mother's Day doodle. As usual, Google kept Bhutanese in the dark.

Doodle for Mother's Day 2014 shown in many countries, including India (but not Bhutan)

Being there (K2 #85)

Question of the Week
I discovered that Facebook only allows changing a Page’s name if you are in the United States. How can I do that without leaving Bhutan?
— Namgay Zam, Thimphu

Answer
Dear Namgay,

Facebook’s policy is annoyingly discriminating against non-Americans, but luckily – as is often the case – there’s a workaround. First, how do the folks at Facebook know your location? Whenever we access a website, the server on the other end sees our “IP address” – a unique number assigned by the Internet Service Provider to our computer or smartphone. The IP address discloses our location in the same way that someone calling from India will have her phone number displayed as starting with 91. So, when Facebook (or any other website) sees, for example, a DrukNet-assigned IP address, it knows that you are in Bhutan. Open any browser and visit www.WhatIsMyIP.com to watch this in action.

One way to fool Facebook into thinking that you are in the USA is to use a proxy server, which acts as an intermediary on your behalf. You connect your browser to a proxy server (which “happens” to be in the USA), and the proxy server then connects to Facebook; the latter sees the IP address of the proxy server. The sad news is that finding and working with free proxy servers is a major hassle.

Luckily, there’s another option: you can use the free software called Tor (The Onion Router). This software was originally designed to protect the identity of the user, including concealing the user’s location. When using Tor, your information is first encrypted many times, then passed on via many randomly-selected relays around the world. Each relay only “peels” one layer of encryption (hence the Onion metaphor), until the original data reaches the destination. By the time the data reaches Facebook, your original IP address is long gone, and Facebook only sees the IP address of the last relay (also known as the exit node).

To start using Tor, visit goo.gl/AkrVGL, then download and install the Tor Bundle Package. Launch the Tor browser by double-clicking the Start Tor Browser app in the Tor Browser directory. Once the browser is open, visit www.WhatIsMyIP.com and check the displayed country; this is the random country where the exit node is located. Any site you use will now think that you are in that country instead of Bhutan! Since you want Facebook to think that you are in the United States, the last piece in the puzzle is to force Tor to use a USA-based exit node. This is done by using a text editor (Notepad for Windows, TextEdit for Mac) and adding the following line, exactly as written, to the torrc file inside the Tor Browser\Data\Tor directory:

ExitNodes {us}

This tells Tor to use an exit node in the USA. Now, re-launch the Tor browser, go to facebook.com, and voilà – you should now be able to change your Page’s name!

---

Readers are encouraged to submit technology-related questions to boaz@thimphutech.com