Saturday, January 15, 2005

Crypto-Gram Newsletter January 2005

Crypto-Gram Newsletter
January 15, 2005

“In this issue:

A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit http://www.schneier.com/crypto-gram.html.”


http://www.schneier.com/crypto-gram-0501.html

The Right Way to Link To Pages On Your Site

The Right Way to Link To Pages On Your Site:
By Dave Taylor

“Here's a topic that should be obvious, but isn't: how should you best code links on your site from page to page? Should you use something like "page two" or "continued..." or "more" with the page filenames as the links? Should you use absolute links that always begin with a leading / (as in "/reviews.html"), should you always use relative links (as in "../reviews.html") or should you use fully qualified links (as in "http://www.informit.com/reviews.html")?

The answer to this question might surprise you! First off, innuendo and rumor aside, Google and other search engines do not care about how your links are coded. I have read on some SEO (search engine optimization) sites that people suggest that Google "spiders" your site faster if you have absolute or even fully-qualified URLs, but as far as I can ascertain, that's just not true.

So this facet of the question boils down to what's the easiest for you to maintain on your site? A link that allows you to move all the pages around as you might need to reorganize things, or a link that forces you to always live with a specific domain name and directory name? My druthers is unquestionably to use relative links as much as possible, and to always use absolute (though not fully-qualified) links on 404 error pages and other content that kind of floats around on your site.

The only area where full, absolute URLs are a necessity are weblog entries, because your Weblog entries should be generating an RSS feed which is then read by subscribers in their own applications, so relative links almost always fail. This means that it's a bit more tricky to add links to certain content – especially if it is built around the Movable Type (or other) weblog content management system -- but the trade-off of having clickable links in the RSS feed makes it worthwhile.



http://www.informit.com/articles/article.asp?p=361413

Understanding Keyword Density

Understanding Keyword Density:

“Search engine optimization, or "SEO" in the biz, isn't only for people trying to turn their Web site into a revenue machine, to make money online, but can really be useful for everyone building Web sites. There are lots of different facets to writing, designing and adjusting your Web pages to maximize the chance of them being a top result for search terms, but one of the best - and easiest - is to work with keyword density.

What is keyword density? It's basically a measurement of how relevant a given keyword "topic" is to a page of material. For example, this page is quite relevant to the word 'keyword' and the phrase 'keyword density' because both occur many times. More importantly, the ratio of their occurances to the total number of words or phrases on the page is reasonably high because, well, they occur a bunch of times.

That's what keyword density is about. The keyword density of the word "keyword" is calculated by counting the total number of words on the page, then figuring out how many of them are "keyword". Typical highly-ranked sites have at least a 2-3% keyword density for the key search word or search phrase.



http://www.free-web-money.com/000437.html

Friday, January 14, 2005

Crypto-Gram Newsletter December 2004

Crypto-Gram Newsletter:
December 15, 2004

“In this issue:


Description of Internet Explorer security zones registry entries

Description of Internet Explorer security zones registry entries:

“This article describes how and where Internet Explorer security zones and privacy settings are stored and managed in the registry. You can use Group Policy or the Microsoft Internet Explorer Administration Kit (IEAK) to set security zones and privacy settings. If you are using Group Policy or IEAK on a Microsoft Windows 2000-based computer, you may have to install several hotfixes to set security zones and privacy settings.


For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 316116 You cannot manage Internet Explorer 6 Group Policies on a Windows 2000-based computer

Microsoft Knowledge Base:182569

http://support.microsoft.com/default.aspx?scid=kb;en-us;182569

Using a Least-Privileged User Account

Using a Least-Privileged User Account:

“Anyone who has been a victim of viruses, worms, and other malicious software (malware) will appreciate the security principle of “least privilege.” If all processes ran with the smallest set of privileges needed to perform the user's tasks, it would be more difficult for malicious and annoying software to infect a machine and propagate to other machines. Today, due to awkward complications that arise when it is employed, least privilege is not in active use on most Microsoft Windows–based systems. However, with the release of the next Windows operating system, codenamed “Longhorn,” almost every user will be able to make regular, daily use of this important security principle.

The Security Principle of Least Privilege

If low-privileged processes are compromised, they will do a lot less damage to a system than high-privileged processes are capable of doing. Consequently, using a non-administrator account instead of an administrator account while completing daily tasks offers the user added protection against infection from a host of malware, external or internal security attacks, accidental or intentional modifications to system setup and configurations, and accidental or intentional access to confidential programs or documents.

Given the obvious security benefits, there is a huge desire, both in home and corporate environments, to run Windows using non-administrator accounts. Unfortunately, almost all Windows users today continue to use an administrator account for their daily tasks. A host of nefarious users and applications rely on being able to use the victim's administrator privileges for such dirty work as destroying or stealing data, reconfiguring another application, or installing a key logger that sends each of the unsuspecting user's keystrokes off to some unknown location on the other side of the Internet.…”

http://www.microsoft.com/technet/security/secnews/articles/lpuseacc.mspx


Running with an administrative account is dangerous to the health of your computer and your data

Running with an administrative account is dangerous to the health of your computer and your data:
Michael Howard
Microsoft Security Engineering
“So, whenever someone says they must operate their computers as administrators, I always try to persuade them it's not the correct thing to do from a security perspective. That said, every once in a while I meet someone who has a valid reason. For example, I use one of the computers in my office to install the latest daily build of Windows, and I need to be an administrator to install the OS. However, and this is a big point, I do not read e-mail, browse the Web, or access the Internet in any form when running as an administrator on that machine. And I do not do so because the Web is the source of most of the nasty attacks today.

What if someone does want to browse the Web? Or read e-mail? Or do Instant Messaging and so on, and for some reason must run in an administrative context? If you look at the major threats to computers, they are from user interaction with the Web through tools like browsers and e-mail clients. Sure, there are non-user interaction attacks, such as Blaster (http://www.cert.org/advisories/CA-2003-20.html) and Lion (http://www.sans.org/y2k/lion.htm), but that's in part why we turned on the firewall in Windows XP SP2!”

Note For Best practices on running as a non-admin, I urge you to look over Aaron Margosis' blog to glean tips on running as a non-admin in Windows.


http://msdn.microsoft.com/security/securecode/columns/default.aspx?pull=/library/en-us/dncode/html/secure11152004.asp

OnlineAuction.com Makes Bid for eBay Sellers

OnlineAuction.com Makes Bid for eBay Sellers:

“Tired of high listing fees on eBay? So was Chris Fain. That's why he created OnlineAuction.com, the newest competitor to the online auction giant. The new service was officially launched on Monday.

"We are sure OnlineAuction.com buyers will love the true competitive bidding without the fear of getting sniped. Our sellers will love the billing structure of one low $8monthly fee, with no individual listing or final value fees. Why? Because we know what it is like trying to decipher a listing bill that looks so complex you need a 'New York lawyer' to figure it out," the company claims on its Web site.

Seven years in the making, OnlineAuction.com's selling point is its low all-inclusive monthly fee.

"At OnlineAuction.com, no matter how much you sell or how much you sell it for, the fee is still only $8 a month, period," said Fain, CEO of OnlineAuction.com on Monday during an interview with Car and Driver Radio where he unveiled the new service. "There's no place else you can get worldwide advertising for $96 a year -- not print, not radio and certainly not television."

Fain made a living selling millions of dollars in merchandise on eBay for several years. However, he still paid approximately $20,000 in listing fees, which ate into his profits.

OnlineAuction.com takes aim at what it sees as frustrating and unnecessary flaws in the eBay world. For example, eBay charges sellers a re-listing fee for items that do not sell. OnlineAuction.com does not. In fact, unsold items are automatically re-listed on the site. In addition to listing fees, eBay also takes a percentage of each sale or charges "transaction fees" once an item is bid on, even if the item doesn't sell.

For example, selling a car on eBay would cost $40 for the listing and an additional $40 once a bid is made. On OnlineAuction.com, you still only pay the $8 monthly fee.

OnlineAuction.com also vows never to shut down auctions and restrict verified, legitimate sellers from selling, unlike Ebay, which can shut down a seller's ability to function for more than a week if it thinks the seller is operating in bad faith. eBay has been criticized for being difficult to contact, The company offers no customer service phone numbers and communicates via an automated response system.”


http://www.ecommerce-guide.com/news/news/article.php/3458131

CSS Tooltips - Part One

CSS Tooltips - Part One:
By: John Gallant , Holly Bergevin ,

“This tutorial is meant for those familiar with basic CSS syntax and usage. If this is not you, The following discussion will make more sense after you have studied these articles:

Tooltip Talk

A common part of modern web pages and applications are those handy little text boxes that pop up when some elements are moused over. In web pages these tooltips are usually generated via the title attribute, which can display a small bit of explanatory text for that page element, without otherwise cluttering up the page. This is often quite helpful, but the display of the title attribute is in the hands of the browser, and they all have different ideas about how to handle them, particularly when the text is long enough to need more than one line.

Other than depending on browsers' displays, there is no author accessible mechanism to style these attribute-based "tooltips." There are oodles of JavaScripts that will dynamically create "faux tooltips," but if one wishes to avoid JavaScript, then it's been the boring title attribute "tooltips" or nothing at all. If only there was some way of forcing CSS to style those "tooltips"!

Well, CSS can't actually style browser-based "tooltips," but CSS can create "faux tooltips" much the same as the JavaScript ones, but without all the (possibly) undesirable scripting. There are a few in's and out's involved, but surprisingly, the methods are rather easy to accomplish.”


http://www.communitymx.com/content/article.cfm?cid=4E2C0

Thursday, January 13, 2005

Will Microsoft's monoculture take the 'pod' out of podcasting?

Will Microsoft's monoculture take the 'pod' out of podcasting?:

“Connecting the dots between the current state of podcasting and Microsoft's joint announcements with TiVo coming out of CES last week results in a picture worth viewing by any technologist (enterprise, consumer, vendor, and podcaster).

Podcasting is a marriage of the TiVo concept (though TiVo itself is not involved) to Internet-delivered audio. In broadcaster-speak, TiVo facilitates "time-shifted consumption." As with the VCR, broadcasts get recorded and digital video recorders (DVRs) like the TiVo facilitate the consumption of these broadcasts at your convenience. Originally, consumption of time-shifted broadcasts required the DVR. But, in the case of TiVo, technologies like TiVoToGo that promise to burn those broadcasts onto DVDs will mobilize those time-shifted broadcasts. In the context of podcasting, the DVR experience is vastly superior to that of the VCR for two reasons. First, it greatly simplifies the notion of broadcast subscription because you get to pick the specific programs you want to record as opposed to picking a channel and setting the recording start and end times. From the TV Guide in our DVR, my wife simply finds the listing for Desperate Housewives and presses the record button. Second, the way the DVR digitally records the broadcasts onto a hard drive makes the messy business of VCR tapes a thing of the past.

What's in a name? Why is it called "Podcasting?" The first time that Internet-accessible MP3-based broadcasts turned up on the hard drive of a portable MP3 player -- without a middleman like Audible.com -- was with Apple's iPod. As a recent press release from the WNYC affiliate of cost-conscious National Public Radio put it, "Distinct from fee-based services like audible.com, podcasts are free and can be saved to iPods (hence, the name) or any other MP3 player." WNYC announced that NPR's On the Media is being made available as a podcast.

It is primarily two technologies that made podcasting possible. First, an AppleScript written by ex-MTV video jockey-cum podcasting poster child Adam Curry whisked an audio file off the Internet and into an iPod. The second was the RSS protocol, which, under the stewardship of Dave Winer, is not only what facilitates the ability to subscribe to a specific podcaster's program (much the same way you can subscribe to blogs or ZDNet's news feeds), but also supports the notion of enclosures. As can be seen from one of Winer's very recent postings, the work of incorporating enclosures into RSS feeds is far from over.

With a blog authoring platform like Userland's Radio that gives users a way to attach an audio file's URI to a blog entry as though it were an enclosure, the resulting RSS feed goes out with an enclosure field that can be parsed by an enclosure-aware RSS client like iPodder (an open-source successor to Curry's AppleScript that's the result of a collaboration between Winer and Curry). The audio file itself is not part of the feed. Only its URI is. What this means for the producers of podcasts is that they still must find a Web accessible host like the storage locker that AOL is testing to store their audio files -- which can be sizeable. Our first podcast was 22.6 MB and Curry's files routinely run in the 15- to 20MB range. As an enclosure-aware client, iPodder knows exactly what to do when it encounters the URI to an audio file in a blog entry's enclosure field. As an aside, enclosure-aware blog hosts (like Userland's Radio) will also know what to do with the enclosure. As can be seen from ZDNet's podcast test center, any blog entry that has an audio file enclosure with it also gets an icon (resembling a bullhorn) that is linked directly to the audio file.

Now that TiVo-like time-shifted consumption of the "audio Web" is built, will content authors and consumers come? They're already here. Hundreds if not thousands of podcasters are producing content and, as exemplified by WNYC's announcement, more are coming on-line every day. According to Release 1.0 (a CNET Networks sister outfit to ZDNet), Googling the term "podcast" yielded 300 search results in October 2004. Already, in early January 2005, that number is up to 1 million (having climbed by 150,000 results in just one week). By all accounts, the podosphere appears destined for a presence in digirati culture comparable to the blogosphere.

But, as also indicated by WNYC's press release, despite the art still being referred to as podcasting, Apple's iPod is no longer the only last stop for the circuitous route that a podcast travels before it gets consumed. The software has evolved to the point that podcasts are easily consumed by other MP3 players as well, and through other synchronization conduits such as Windows Media Player.

Such evolution was only natural. (Microsoft did nothing to make that happen.) However, Apple failed to seize the natural advantage that was gifted to it by Adam Curry when his first AppleScript changed the course of the audio Web. Had I been Steve Jobs, I would have marshaled every engineer needed to produce the GarageBand equivalent of a podcast authoring tool for the Mac and to turn the iPod into the ultimate podcast endpoint. Not only would I make them capable of reading the Outline Processor Markup Language-based (OPML) outlines that podcasters are using to describe the content (known as "shownotes") within their podcasts (for example, this outline for one of Adam Curry's podcasts) , but I'd also make them capable of managing podcast subscriptions without the need for a middleman like iPodder. At the very least, I'd fund the open source iPodder project, try to take on Dave Winer and Adam Curry as consultants (not that they'd accept), and build all of the functionality of iPodder into iTunes (turning iTunes into an enclosure-aware RSS client).

Recipes for creating podcasts with the Mac and Windows get the job done, but they basically involve a handful of technologies that must be alligator-clipped together.

Not only doesn't Apple seem interested in greasing the wheels of the podosphere, it doesn't appear interested in what big content publishers like ZDNet would like to see happen. So far, I've received no response from Apple to an e-mail inquiry regarding ideas for how podcast authoring and consumption (on the Mac platforms) could be vastly improved.… ”



http://news.zdnet.com/2100-9588_22-5519810.html?tag=nl.e539

Gmail Bug Exposes E-mails to Hackers

Gmail Bug Exposes E-mails to Hackers :
“UNIX developers HBX Networks have stumbled upon a bug within Google's Gmail that allows access to other users' personal e-mails.

By altering the "From" address field of an e-mail sent to the service, hackers could potentially find out a user's personal information, including passwords.

At first glance, to the average user the e-mail would appear normal. But by clicking "show options" within the Gmail interface, the "Reply-To" field will show HTML code that is actually a formatted version of another user's e-mail, HBX wrote on its Web site.

HBX said that they think a missing character is tripping up Gmail and causing it to print whatever is in its cache, or memory, into the Reply-To field.

The group did say much of what they saw was spam. However, what troubled them was in at least one case they were able to see a user's password.

Quick to respond, Google acknowledged the problem late Wednesday and has since corrected the problem for all users, a company source said.

At first glance, to the average user the e-mail would appear normal. But by clicking "show options" within the Gmail interface, the "Reply-To" field will show HTML code that is actually a formatted version of another user's e-mail, HBX wrote on its Web site.

HBX said that they think a missing character is tripping up Gmail and causing it to print whatever is in its cache, or memory, into the Reply-To field. The group did say much of what they saw was spam. However, what troubled them was in at least one case they were able to see a user's password.

“Regardless of the specific failure, the result is a compromise of the privacy of communications over Gmail,” the organization said. “Usually, this only permits an attacker to examine recently-arrived spam in random user's inboxes - but message content does occasionally become more interesting.””


http://www.betanews.com/article/Gmail_Bug_Exposes_Emails_to_Hackers/1105561408

http://www.eweek.com/article2/0,1759,1750785,00.asp?kc=ewnws011305dtx1k0000599

Red Hat, SuSE release Linux patches

Red Hat, SuSE release Linux patches:
“Linux vendors Red Hat, Novell and Mandrakesoft on Wednesday released patches for several vulnerabilities, ranging from flaws that could allow denial-of-service attacks to buffer overflows.

Five of the updates released were rated "highly critical" on Thursday by security information company Secunia. Red Hat released three of the updates, Novell's SuSE one and Mandrakesoft one.

SuSE issued updates to resolve flaws including a vulnerability that could allow malicious code to cause a local denial-of-service attack using a specially created Acrobat document. The vulnerabilities would affect most SuSE Linux-based products.

Another vulnerability in the Linux system components used to route network traffic could allow a malicious person to execute a local denial-of-service attack by inserting erroneous information into the netfilter data stream, according to SuSE.

Red Hat, meanwhile, issued a package of updates for its desktop, enterprise and advanced-workstation software.

An updated libtiff package was released to address vulnerabilities involving various integer overflows. The vulnerabilities would enable an attacker who has tricked a user into opening a malicious image file in the TIFF format to make a libtiff-related application crash or have the potential to compromise the computer with arbitrary code.

Red Hat also released updates for Xpdf packages to address a vulnerability to a potential buffer overflow. Xpdf is a stand-alone application for reading Portable Document Format documents and is also used by many Linux programs to process PDF files. This vulnerability could enable an attacker to create a PDF file that would crash Xpdf and possibility execute arbitrary code when opened, according to Red Hat's update.

Red Hat also released multiple patches to resolve flaws in its Xpm library. The XPixMap (XPM) format enables color images to be stored in an easily portable file.

Several stack overflow flaws and an integer overflow vulnerability were found in the libXpm library, which, in turn, is used to decode XPM images. If an attacker creates an XPM file that causes an application to crash, a computer system could be compromised.

Mandrakesoft also released an update for Imlib, a standard set of code used by older versions of the GNOME desktop to process graphics.”

http://news.zdnet.com/2100-1009_22-5535228.html?tag=nl.e589

Hackers Tune In to Windows Media Player

Hackers Tune In to Windows Media Player :

“Hackers are using the newest DRM technology in Microsoft's Windows Media Player to install spyware, adware, dialers and computer viruses on unsuspecting PC users.

Security researchers have detected the appearance of two new Trojans, Trj/WmvDownloader.A and Trj/WmvDownloader.B, in video files circulating on P2P (peer-to-peer) networks.

According to Panda Software, both Trojans take advantage of the new Windows anti-piracy technology to trick users into downloading spyware and adware applications.

"When a user tries to play a protected Windows media file, this technology demands a valid license. If the license is not stored on the computer, the application will look for it on the Internet, so that the user can acquire it directly or buy it," Panda Software explained.

An unsuspecting user attempting to download the DRM (digital rights management) license will instead be redirected to a Web site that loads a large quantity of adware, spyware, modem dialers and other viruses, the company said in an advisory.

"It's pretty ingenious," said Patrick Hinojasa, chief technical officer at Panda Software. "To take an anti-piracy feature and use it to feed spyware is extremely ironic."

"In this case, they're using technology meant to secure content. It just shows that the more bells and whistles you add to the technology, the more you open doors for the bad guys," he said.

Even though these Trojans have been detected in video files on P2P networks such as Kazaa or eMule, Hinojasa warned that these files can be distributed via e-mail, FTP or other Internet download avenues.”


http://www.eweek.com/article2/0,1759,1749948,00.asp


Monday, January 10, 2005

High-Risk Flaws Flagged in IE, Mozilla

High-Risk Flaws Flagged in IE, Mozilla :
“Security researchers have raised the alarm for a series of unrelated, high-risk vulnerabilities in Microsoft Corp.'s Internet Explorer and the open-source Mozilla browsers.

According to a Secunia advisory, the most serious IE flaw could be exploited by a malicious hacker to hijack a vulnerable machine, conduct cross-site/zone scripting and bypass a security feature in Microsoft Windows XP SP2.

For its part, Microsoft has confirmed it is investigating a "Click and Scroll" issue in IE and has posted a temporary workaround to protect users from the flaw.

In a Knowledge Base article, the software company said the bug could make it possible for an attacker to put a malicious file on a PC if a user visits a Web site.

Microsoft recommends that users install the most recent cumulative fix for IE and disable the "drag-and-drop" or "copy-and-paste files" option across a domain.

Another unpatched IE flaw could allow an embedded HTML Help control on a malicious Web site to execute local HTML documents or inject arbitrary script code.

A third vulnerability exists in the handling of the "Related Topics" command in an embedded HTML Help control. Secunia said this bug can be exploited to launch harmful script code in the context of arbitrary sites or zones.

Secunia has posted a vulnerability test online to demonstrate the flaws.

The updated IE warning comes on the heels of a Bugtraq advisory for multiple flaws in Mozilla, Firefox and Thunderbird products.

The Mozilla Foundation has rolled out new versions to patch the holes, which range from a potential buffer overflow and temporary files disclosure to anti-spoofing issues.

According to the advisory, a potentially exploitable buffer overflow was discovered in the way Mozilla and Firefox handle NNTP URLs.

Also fixed is a way of spoofing filenames in the "What should Firefox do with this file" dialog-box option.

"A remote attacker could craft a malicious NNTP link and entice a user to click it, potentially resulting in the execution of arbitrary code with the rights of the user running the browser," the advisory read.”


http://www.eweek.com/article2/0,1759,1749293,00.asp?kc=ewnws011005dtx1k0000599