Has your PC made you a spammer?

Is your PC spewing spam?:
"Putting a price on a viral network

But wait, it gets worse. Once upon a time, the only way spam operators spread their junk mail was by opening an e-mail account, queuing up a few thousand e-mail messages, then moving on. But Internet service providers got savvy to this practice, and now they look for abnormal spikes in outbound mail traffic, then immediately block or shut down spam-sending accounts.

So the spammers had to get even savvier. With last summer's Sobig virus, it became clear that someone was building viral networks to relay spam messages.

By using open proxies on virus-compromised Windows computers, a spam operator, who may be on some ISP's block list, sends direct marketing e-mail via someone else's compromised PC. Doesn't matter if the infected PC's ISP shuts them down; there are thousands of other PCs relaying the same spam. Viruses are moving targets, so as one system is disinfected or blocked, another system becomes infected."

To illustrate that point, the Sobig virus self-terminated every two weeks or so, allowing the virus writer to sell his or her list of currently infected PCs, then, after the virus expired, author another version, infecting different PCs, and sell that list at a later date. As individual PCs on a given virus network keep changing, the effort to identify and stop spam operators gets much harder.

Yet this open proxy method isn't perfect. To work, the spam operator still contacts each and every infected PC in the virus network. This requires bandwidth, almost as much as if the operator were using a single account to send the spam.

The self-contained spam factory method
Enter the Bobax worm. Security company Lurhq describes Bobax as a self-propagating Trojan horse and a self-contained spam factory. The worm carries with it a template and a list of e-mail addresses, so it's able to create spam on the fly.

This evolution suggests that the virus writers and the spam operators are working closely. No longer is a rogue virus writer selling his or her networks of infected computers created by off-the-shelf viruses and worms to spammers. Now, the spammers are ordering up custom-designed viruses and worms. Perhaps the virus writers are employees, working solely for the spam operators.…

http://reviews-zdnet.com.com/AnchorDesk/4520-7297_16-5136207.html?tag=adss

Paper Trails for Electronic Votes

Demand Grows to Require Paper Trails for Electronic Votes:
"A coalition of computer scientists, voter groups and state officials, led by California's secretary of state, Kevin Shelley, is trying to force the makers of electronic voting machines to equip those machines with voter-verifiable paper trails.

Following the problems of the 2000 election in Florida, a number of states and hundreds of counties rushed to dump their punch card ballot systems and to buy the electronic touch screens. Election Data Services, a consulting firm that specializes in election administration, estimates that this November 50 million Americans - about 29 percent of the electorate - may be voting on touch screens, up from 12 percent in 2000.

But in the last year election analysts have documented so many malfunctions, including the disappearance of names from the ballot, and computer experts have shown that the machines are so vulnerable to hackers, that critics have organized to counter the rush toward touch screens with a move to require paper trails."

Paper trails - ballot receipts - would let voters verify that they had cast their votes as they intended and let election officials conduct recounts in close races.

Not everyone agrees that paper trails are necessary, or even advisable. Numerous local election officials - the ones who actually conduct elections - argue that paper trails could create worse problems than the perceived ones that they are intended to cure. They warn of paper jams, voter confusion and delays in the voting booth while voters read their receipts.

There are no national standards to help resolve the disputes. The federal commission that Congress created after 2000 to guide states is behind schedule, and the research body that was supposed to set standards for November 2004 has not even been appointed. So states, prompted by voter organizations, are taking matters into their own hands.

Nevada, which is using touch screens in all its voting precincts this November, has become the first state to require the manufacturer to attach printers in time for Election Day.…

http://www.nytimes.com/2004/05/23/politics/campaign/23vote.html?pagewanted=all&position=

200 Articles and Columns on PC Troubleshooting

PC Troubleshooting:
"200 Articles & Columns for 'pc troubleshooting' "

Free registration required. Top quality information.
http://techrepublic.com.com/5048-22-0.html?SearchThis=pc troubleshooting&nodeIds=all&tag=e099.0521&queryType=2&tag=search

What's New Now at Ziff Davis

What's New Now

http://blog.ziffdavis.com/louderback/

Skype Creator Promises Official VOIP Program Release:
"The peer-to-peer phone program Skype, which allows computer users to talk to each other globally for free, will soon be expanded to include a paid service that will connect Skype calls to regular phones, the program's co-creator said Wednesday.

Skype Technologies SA founder Niklas Zennstrom, who also co-developed the Internet file-sharing program Kazaa, made the announcement at an Internet-phone conference Wednesday in Markham, north of Toronto.
He said final bugs were being worked out of the Skype software's 'beta' or trial version, which already has at least 5.5 million users worldwide. An official release is scheduled for the summer.…"

http://www.eweek.com/article2/0,1759,1595770,00.asp

Phishing Attacks on the Rise:
"…'The red flag should be any request for personal information, especially from someone who says they need it right now or there will be dire consequences,' said Patricia Poss, an attorney with the Federal Trade Commission's bureau of consumer protection.

Consumers who think they've received a phishing e-mail should not click on any Web links contained in the e-mail and, instead, forward it to the FTC's collection site at uce@ftc.gov.

If they've responded to such e-mails, they should contact their banks or credit card companies immediately to try to prevent account information from being misused, Poss said.

'Then, if you're worried about identity theft, get a copy of your credit report and make sure nothing is going on,' she added.… "

http://www.eweek.com/article2/0,1759,1595710,00.asp?kc=ewnws052004dtx1k0000599

Essential Utilities from PC Magazine

2004 Utility Guide: "You won't find firewall, antispam, antispyware, or traditional antivirus tools in here—they're essential utilities, but we've covered them recently; see our current favorites in the Editors' Choices section. But with new viruses coming at us faster than AV companies can write signatures to stop them, we take a hard look at alternative detection methods that attempt to root out new threats based on their behavior, not just their signatures.

Some utilities are less fun than important—yes, you do have to back up your data regularly, and your Registry probably could use a good cleaning. The following pages present a mix of tools that taste good and are good for you.…"

http://www.pcmag.com/article2/0,1759,1594001,00.asp

Cisco Source Code Reportedly Stolen:
"According to a Russian security Web site, criminal hackers broke into Cisco Systems' corporate network last week and stole 800MB of source code for IOS 12.3 and 12.3t (an early deployment version of the operating system containing features not found in the vanilla 12.3 version). In addition, a 2.5MB sample of what is supposedly IOS code was released on an Internet Relay Chat channel as proof of the alleged theft.

'Cisco is aware that a potential compromise of its proprietary information occurred and was reported on a public website just prior to the weekend,' said Cisco spokesman Robert Barlow. 'Cisco is fully investigating what happened. As a matter of policy, we take security very seriously and we continue to take every measure to protect our intellectual property, employee and customer information.' "

IOS 12.3 is the newest main version of San Jose, Calif.-based Cisco's popular operating system. It's used across the company's networking line, including in home office routers (the 800 Series); those for branch offices (the 3700 Series); and those that comprise the Internet backbone (the 7000 Series). Other routers that use the operating system include the 1700, 2500, 2600 and 3600 Series.

This could represent a major security threat not just for Cisco users, but for the entire Internet. According to the Dell'Oro Group, a market research firm that specializes in the networking and telecommunications industries, Cisco owns 62 percent of the core router market.…

http://www.eweek.com/article2/0,1759,1594322,00.asp

Crypto-Gram: May 15, 2004:
"In this issue:
Warrants as a Security Countermeasure
Counterterrorism in Airports
Crypto-Gram Reprints
News
Counterpane News
Security Notes from All Over: Bypassing the USPS
The Doghouse: Markland Technologies
The Doghouse: IQ Networks
National Security Consumers "

http://www.schneier.com/crypto-gram-0405.html

How to Create A JavaScript Windows Interface - WebReference.com-:
"When windows first appeared on computer screens around the world it revolutionized the way programs interfaced with the user. Multiple programs could be run at the same time without much confusion. Even within a single program, multiple windows could be used to separate unrelated bits of information or data entry forms and much more."

http://www.webreference.com/programming/javascript/gr/column6/index.html

ZDNet: Printer Friendly - Search engines take the stand:
"Fifteen years after his trial, a convicted drug dealer in New York state belatedly got a chance to clear his name--thanks in part to an Internet search.

A federal judge last November threw out Manuel Rodriguez's conviction and granted him a new trial after discovering evidence of potential jury tampering in a review of court records and queries on Web search engine Google. U.S. Magistrate Judge Frank Maas said that his review of the 1988 court transcript, coupled with looking up jurors' names in Google, had revealed that the assistant district attorney had 'improperly' removed Hispanics.… "

Some judges call Web search a crucial research tool, but critics of the trend are warning that searches on Google and its rivals are no substitute for the painstaking process of evidence and testimony.

"A Google search that I conducted" suggested that a removed juror had "a Hispanic name," Maas wrote in the court decision overturning the conviction.

Rodriguez finished his sentence before his new trial could take place. But his case nevertheless offers a striking illustration of the growing clout of Internet search engines among the judiciary--a controversial trend that's so far garnered little attention outside legal circles.

In the United States and abroad, judges are turning to search engines such as Google to check facts, to look up information about companies embroiled in litigation, and to challenge statistics presented by attorneys in court. Dozens of judges have penned opinions describing Google as a valuable--and sometimes crucial--source of knowledge.

To be sure, Google has no monopoly in the legal system. Yahoo's search engine popped up in the landmark Napster copyright case four years ago, and Oregon police tried to track a criminal defendant accused of firearm violations through Yahoo searches. When AltaVista was in its heyday, it also was mentioned in a handful of cases.

But in the last few years, Google appears to have become the courts' favorite search engine. The Mountain View, Calif.-based company--which announced its plans for an initial public offering last month--accounts for 41 percent of U.S. search referrals, according to statistics compiled by research company WebSideStory.

In one case in Ohio, a judge who ordered a mother not to smoke near her 8-year-old daughter cited medical journals and a Google search that lists 60,000-plus links for "secondhand smoke" and 30,000-plus links for "secondhand smoke children." In addition, the California Supreme Court has Googled for evidence showing that stun belts, which jolt prisoners with 50,000-volt electric shocks, can be harmful and should not have been used in a criminal trial. And an enterprising federal judge in New York did his own Google search to demonstrate that a watch, jeans and handbag retailer named Alfredo Versace was infringing the trademarks of the famous Gianni Versace design house.

Some legal experts warn that Google searches are no substitute for the painstaking process of evidence and testimony. "If a judge is taking as proof facts that are reported in any public medium that pertain to individual actions by persons involved in a case, that is troubling," said George Fisher, a Stanford University law professor. "Those are the sorts of facts that are supposed to be proved in the courtroom under the rules of evidence.…"

http://zdnet.com.com/2102-1104_2-5211658.html?tag=printthis

DVD Rot, or Not?:
"The recent Associated Press story about insidious, disc-devouring 'rot' wasn't the first to hit the mainstream press. Major news outlets Worldwide have for years been publishing sensational reports that up to 20 percent of all mass-produced CDs and DVD-Video discs were slowly destroying themselves. But when an alarmed DVD industry investigated whether the problem was indeed as catastrophic as it appeared, it turned out that most reported incidents had actually been caused by improper disc handling and storage. Despite the latest round of headlines, true 'DVD Rot' today appears to be exceedingly rare. Users themselves are the greatest threat to the longevity of their DVD collections.

Most people think of DVDs as little more than high-capacity CDs, but though the two are very similar, DVDs have vulnerabilities that require particular care in their handling, storage, and cleaning. But with a bit of knowledge and effort, nearly all damage to DVDs can be prevented.…"

http://www.pcmag.com/print_article/0,1761,a=126783,00.asp

Wallon Worm Skirts Around Windows Patch Release:
"Wallon's infection process is complicated. Unlike the ordinary e-mail worm that arrives in an attachment to a message, Wallon appears as a link in a message to a Yahoo page. But with redirection, the Yahoo connection leads to another page that delivers an encrypted link to yet another page that delivers a special downloader application.

Microsoft provided a security patch for this vulnerability in April and suggested its application for all currently supported Windows versions. The company describes the update as 'critical' and recommends it for all Windows variants, starting with Windows 98, even for systems where Outlook Express is not the default e-mail reader.… "

http://www.eweek.com/article2/0,1759,1591569,00.asp

Mac Trojan Set Loose—More to Come?:
"The first malicious Trojan for Mac OS X has been found in the wild, leading some to claim the platform may be on the verge of increased attention from virus writers."

The Trojan—dubbed AS.MW2004.Trojan by anti-virus company Intego—was first discovered by a reader of British Mac magazine MacWorld. It takes the form of a file purporting to be a version of the newly released Office 2004 for Mac and is available on download services such as LimeWire.

However, despite appearing with a legitimate-looking icon, the Trojan is in fact a simple AppleScript application that, when run, erases the contents of the user's Home folder. And, unlike the real release of Office 2004, the application is only 108KB in size.…

http://www.eweek.com/article2/0,1759,1591850,00.asp?kc=ewnws051304dtx1k0000599

New Sasser variant indicates copycat - News - ZDNet:
"A teenager suspected of writing the Sasser code has been arrested by police in Germany. Since his arrest, two variants of the worm have been detected in the wild. The suspected author had confessed to German police that he had released the fifth version of the worm, Sasser.E, four days before he was taken into custody. Antivirus firms didn't detect the variant until the day after the arrest. The most recent, Sasser.F, was first detected Tuesday.

Luis Corrons, head of antivirus company Panda's research labs, said the Sasser.F worm's source code looks like it was written by an inexperienced programmer who has slightly modified the original code but had not added any new functions or behaviors.

'Studying the evolution of Sasser, the fact that variant F does not include any new features confirms that it is the work of a different person,' Corrons said. "

http://zdnet.com.com/2100-1105_2-5211114.html?tag=header.newsfeed

Microsoft Issues Single New Security Alert for May:
"Microsoft's security alerts for May were posted this afternoon. And the list was refreshingly short. The single new vulnerability revealed does allow for remote code execution by an attacker, but with many limitations on the attack, leading Microsoft to classify the problem as 'important.'

The problem is in the Windows Help and Support Center in Windows XP and Windows Server 2003. Windows 2000 and other earlier versions are not affected. The Help and Support Center is based on Internet Explorer components and uses a special protocol called HCP, also used by the Control Panel."

Such pages use an "hcp://" prefix, while normal Web pages use an "http://" prefix. The vulnerability is in the process that the Help and Support Center uses to validate the data from an HCP Web site.

The attacker would have to construct a malicious Web page and entice the user to visit it and click on a specific link. According to Microsoft's advisory on the issue, "After they click the link, they would be prompted to perform several actions. An attack could only occur after they performed these actions."

Certain very old versions of Outlook, lacking certain past security patches, also might allow the attack to be sent through an HTML e-mail. All versions of Outlook and Outlook Express for the past several years run HTML e-mails in the "restricted zone," which would make it much harder to exploit this vulnerability.

Microsoft released a patch for the vulnerability, which can be downloaded from the same page that contains the advisory describing the vulnerability. There are also workarounds available, including unregistering the HCP protocol. These are described in the advisory.

http://www.microsoft.com/technet/security/bulletin/MS04-015.mspx

http://www.eweek.com/article2/0,1759,1590651,00.asp?kc=ewnws051104dtx1k0000599

Microsoft Security Bulletin MS04-015: Vulnerability in Help and Support Center Could Allow Remote Code Execution (840374):
"This update resolves a newly-discovered vulnerability. A remote code execution vulnerability exists in the Help and Support Center because of the way that it handles HCP URL validation. The vulnerability is documented in the Vulnerability Details section of this bulletin.

If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges. Users whose accounts are configured to have fewer privileges on the system would be at less risk than users who operate with administrative privileges.

Microsoft recommends that customers install the update at the earliest opportunity."

http://www.microsoft.com/technet/security/bulletin/ms04-015.mspx

Motherboards.org - The Elusive Zen of Motherboard Identification:
"It certainly may appear to the inexperienced that there is some 'black magic' involved in the art of motherboard identification but really it only involves patience, determination and a little common sense in most cases. There is no doubt that those of us that have some experience do have an advantage in the ability to recognise some common model numbers or bios strings and in knowing the location of certain resources but all this really does is make the search quicker.

80% of the requests for motherboard identification in this forum can be answered in a few seconds by doing a search using the information supplied by the poster and a good search engine such as www.google.com

This can be done by anyone, 'guru' or not."

http://www.motherboards.org/articlesd/how-to-guides/910_1.html

The Search Engine Report - Number 90 - May 6, 2004:
"Search Engine Watch News

Search Engine Strategies Toronto & London!

Search Engine Articles By Danny Sullivan

SearchDay Articles

Search Engine Articles

Search Engine Resources"

http://searchenginewatch.com/sereport/article.php/3350871

Why your personal firewall could be obsolete - TechUpdate - ZDNet:
"If your business has turned the use of personal firewalls into a required countermeasure, now's a good time to start thinking more strategically before buying any more personal firewall technology from a third party.

Although it still has a serious flaw that Microsoft will have no choice but to fix, the morphing of Windows XP's built-in personal firewall from a toy into a more serious security technology means that now's also a good time for the remaining independent personal firewall vendors like Zone Labs to be thinking about long term survival strategies. For the cottage industry of personal firewalls that includes giants like Symantec and McAfee (a division of Network Associates) and smaller players like Zone Labs, Sygate, Internet Security Systems (makers of BlackICE), and Panda Software, this was an inevitable turn of events.… "

http://64.95.71.98/techupdate/stories/main/Preview4987.html

Patches Could Have Lessened Sasser Worm Spread:
"Sasser's spread began to stabilize Tuesday, but not after infecting hundreds of thousands of computers since Friday by exploiting a known Windows flaw for which Microsoft Corp. issued a software patch three weeks ago. "

Twenty British Airways flights were each delayed about 10 minutes Tuesday due to Sasser troubles at check-in desks, while British coastguard stations used pen and paper for charts normally generated by computer.

On Monday, the worm hit public hospitals in Hong Kong and one-third of Taiwan's post office branches. Major corporations around the world also were infected.

Home users were particularly hit hard, computer security experts say, because they generally lack the know-how to install patches and tend not to have the firewalls needed to keep Sasser from spreading to other computers via the Internet.

Late this summer, Microsoft plans to introduce a Windows XP update that would turn on a built-in firewall and automatically obtain and install security patches regularly. Microsoft is currently testing the update.

For now, computer users must manually turn such settings on—through "System" or "Automatic Updates" in Windows' Control Panel—or they must periodically check the company's Web site for new patches.…

http://www.eweek.com/article2/0,1759,1585008,00.asp?kc=ewnws050504dtx1k0000599

Sasser.D Worm Arrives, Ready to Do Damage:
"A fourth version of Sasser has the potential to cause serious slowdowns and outages; a hoax e-mail claiming to contain a fix for the worm in fact contains a version of the NetSky worm.…"

Sasser.D appeared Monday afternoon and is similar to the previous three versions in most respects. The main difference in the new variant is that it uses ICMP echo requests, also known as pings, to look for other machines to infect. The Nachi worm of last summer had the same capability and, on networks with a number of vulnerable machines, the worm caused severe congestion.

The new Sasser variant could cause the same problems, experts warn. And, Sasser.D can scan multicast addresses, which has led to it causing some destabilization of routers that handle multicast traffic, analysts at The SANS Institute in Bethseda, Md., said.

Sasser.D also uses a different name for the file it leaves on infected PCs: Skynetave.exe. And it creates a remote shell on TCP port 9995, instead of 9996, which is used by the other three variants.

In addition to the new variant, there also is a hoax e-mail circulating that claims to contain a fix for Sasser. The message actually contains a new version of the NetSky worm.…

http://www.eweek.com/article2/0,1759,1584121,00.asp?kc=ewnws050404dtx1k0000599

Symantec Security Response - W32.Sasser.B.Worm:
"W32.Sasser.B.Worm is a variant of W32.Sasser.Worm. It attempts to exploit the LSASS vulnerability described in Microsoft Security Bulletin MS04-011. This worm spreads by scanning randomly selected IP addresses of vulnerable systems.… "

Notes:
The MD5 hash value of this worm is 0x1A2C0E6130850F8FD9B9B5309413CD00.

Symantec Security Response has developed a removal tool to clean the infections of W32.Sasser.B.Worm.

Block TCP ports 5554, 9996, and 445 at the perimeter firewall and install the appropriate Microsoft patch (MS04-011) to prevent the remote exploitation of the vulnerability.

--------------------------------------------------------------------------------

W32.Sasser.B.Worm can run on, but not infect, Windows 95/98/Me computers. Although these operating systems cannot be infected, they can still be used to infect the vulnerable systems to which they are able to connect. In this case, the worm will waste a lot of resources so that programs cannot properly run, including our removal tool. (On Windows 95/98/Me computers, the tool should be run in Safe mode.)

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html

Keyboard Shortcuts with Windows XP Home Edition:
"When speed counts, the keyboard is still king. Almost all the actions and commands you can perform with a mouse you can perform faster using combinations of keys on your keyboard. These simple keyboard shortcuts can get you where you want to go faster than several clicks of a mouse. You'll work faster on spreadsheets and similar documents, too, because you won't lose your place switching back and forth between mouse and keys.

Here are some of the most useful keyboard shortcuts:"

http://www.microsoft.com/windowsxp/home/using/tips/personalize/keyboardsc.asp

ZDNet: Printer Friendly - Alarm growing over bot software:
"Known as bot software, the remote attack tools can seek out and place themselves on vulnerable computers, then run silently in the background, letting an attacker send commands to the system while its owner works away, oblivious. The latest versions of the software created by the security underground let attackers control compromised computers through chat servers and peer-to-peer networks, command the software to attack other computers and steal information from infected systems.

News.context

What's new:
Internet security watchers warn that the most common kind of bot software has been upgraded. A new variant incorporates publicly available code for breaching security through a vulnerability on almost every Windows system sold in the past five years.

Bottom line:
Bot software has spread widely--just how quickly is difficult even for security experts to evaluate. Symantec puts the number of computers compromised in the hundreds of thousands. Other security experts have put the number in the millions. Moreover, with source code commonly available, bot software gets quickly updated to take advantage of the latest flaws.…"

http://zdnet.com.com/2100-1105_2-5202236.html?tag=adnews

URLScan Security Tool:
"UrlScan version 2.5 is a security tool that restricts the types of HTTP requests that Internet Information Services (IIS) will process. By blocking specific HTTP requests, the UrlScan security tool helps prevent potentially harmful requests from reaching the server. UrlScan 2.5 will now install as a clean installation on servers running IIS 4.0 and later.…"

http://www.microsoft.com/technet/security/tools/urlscan.mspx

Spam Report Card 2004 - TechUpdate - ZDNet:
"More than 50 percent of e-mail is spam. Billions of spam attacks are launched each month. Spam costs U.S. companies at least $1 billion per year in security and human resources expenditures, as well as lost productivity. Increasingly, virus-infected machines are used to distribute spam and perpetuate additional fraud, such as phishing. Is combating spam a losing battle?"

http://techupdate.zdnet.com/special_report/Spam_Report_Card_2004.html

Crypto-Gram: April 15, 2004:
"In this issue:

National ID Cards
TSA-Approved Locks
Crypto-Gram Reprints
Stealing an Election
Counterpane News
Security Notes from All Over: Man-in-the-Middle Attack

Bluetooth BeepCard
Privacy Hack
News
Virus Wars "

http://www.schneier.com/crypto-gram-0404.html

Signs Point to Worm Attack on SSL Vulnerability:
"Security experts on Tuesday said they are seeing evidence of what appears to be a worm exploiting the recently announced vulnerability in the Windows implementation of the Secure Sockets Layer (SSL) protocol.

During the morning and early afternoon Tuesday, specialists at VeriSign Inc.'s security operations center observed a large-scale exploitation of the vulnerability. While there are a number of software tools available on the Internet to attack the vulnerability, experts said the volume of activity is too great for the attacks to be manual.…"

http://www.eweek.com/article2/0,1759,1573827,00.asp

Microsoft Confirms Bug In SSL Patch:
"The knowledge base article goes by the unusually long name: 'Your computer stops responding, you cannot log on to Windows, or your CPU usage for the System process approaches 100 percent after you install the security update that is described in Microsoft Security Bulletin MS04-011.'

The problem occurs, according to the article, because Windows tries repeatedly to load drivers that fail to load. Microsoft acknowledges that the problem is a bug in the patch and that the company is investigating solutions.…"

http://www.eweek.com/article2/0,1759,1578752,00.asp

Scams, Lies, Deceit, and Offshoring:
"Someone has to take the jobs that, as President Bush and others say, 'Americans don't want.' There appear to be a large number of these jobs. In fact, it seems that our fastest-growing business segment is the creation of more and more jobs that Americans don't want. Often, American companies will lay people off, only to train newcomers to replace them."

Here is how the real scam works. You are a programmer at one of the big IT or computer companies. You're 55 and nearing a retirement plateau; in fact, you're a liability. You're making, say, $80,000 as a program designer. You have various responsibilities. The company eliminates your position in the process of downsizing.

To be fair to you, it creates a new position, Associate Program Designer, that pays $35,000 a year. Its responsibilities coincidentally match those of your old job. You can take this job, doing what you did before but at a huge cut in pay, or look elsewhere. If the latter, it's apparent that this new job is one that "Americans don't want." The company can then hire a "body shop" to drop in a foreign H-1B or L1 visa holder, who will not be quite as good but will work for a lot less.


This is a bait-and-switch scheme that is designed to screw older and more experienced workers out of their retirement benefits, plain and simple. This sort of thing, unfortunately, is nothing new to corporate America:…

http://www.pcmag.com/article2/0,1759,1573102,00.asp

Phishing Scams Increase 1,200% in 6 Months:
"Beware your email.

In the last six months, the number of phishing email scams has increased 1,200 percent, putting end users and major companies at an even greater risk, according to a report from MessageLabs Inc., a managed email security firm based in New York.

MessageLabs reports that last September its analysts had only seen 279 phishing emails. But that number had risen nearly 800-fold to 215,643. Phishing emails peaked in January with 337,050.… "

Phishing is the latest online scam financial scam. It's a con game based on posing.

Spammers send out millions of emails claiming to be from legitimate organizations, such as major U.S. banks or credit card companies. The spammers even fake the senders address so it appears to be from the company they're posing to be. The message in the email often says there is a problem with the recipient's account and it has been shut down. To reinstate the account, or deal with whatever fictional problem the email refers to, the user is instructed to click on a link that then takes them to a phony Web site.

The users are then led to what is often a perfect replica of the Web site that the spammer is pretending to be. At this point, the victim is asked to 'update' his personal security information, passwords, Social Security numbers, addresses and bank account information. The information is then used to siphon money out of the victim's bank account or to make financial transactions with their money.…

http://www.esecurityplanet.com/trends/article.php/3344141

AntiOnline - Windows XP Security Guide (phase one):
"This guide will take you from a FRESH install of XP, to the high level of security … Note that this is more intended for singular computer use (and possibly work office) and not for mission critical server usage. While yes, … use XP for server usages, because it can handle it with the proper settings, a mission critical server requires a primary focus on the 'Server' portion, rather than being evently distrubuted between server, desktop, and game machine. … when it comes down to mission critical servers, it isn't about bending tools to work, it's about how well they work. Windows XP as a *mission* critical server is not recommended because of latency issues, forced RAM on the GUI, and process handling meant for low latency on the GUI responcivness, instead of packet and server process stability handling."

http://www.antionline.com/showthread.php?s=&threadid=255353

Fonts in Cyberspace:
"A guide to finding language fonts on the Internet. Containing more than 400 sources for 123 languages"

http://www.sil.org/computing/fonts/

Getting a Job in CG: Real Advice from Reel People, Chapter 3: What to Learn. By Sybex - WebReference.com-:
"This book excerpt is from 'Getting a Job in CG: Real Advice from Reel People' ISBN 0-7821-4257-5. All rights reserved. Chapter 3: What to Learn., is posted with permission from Sybex.

Knowing the job descriptions in 3D and effects described in the first two chapters can help you find the kind of job that fits your skills and interests. Perusing the descriptions and sample listings, you might have realized that there are skills you lack.

This chapter explains the skills involved in 3D and effects and gives you direction on how to acquire them.…"

http://www.webreference.com/3d/cg/

Security issues move Linksys routers off the short list:
"As more companies adopt a telecommuting-friendly culture, more employees are taking the plunge for cable or DSL-based Internet access. In many cases, their households have more than one Internet user and are installing turnkey connection-sharing appliances. The two companies that most often come to mind for me as providers of these appliances are the recently Cisco-acquired Linksys and the as-of-yet-to-be acquired NetGear. Linksys is apparently having some engineering difficulties that are leaving its customers exposed to potential security problems.… "

http://techupdate.zdnet.com/techupdate/stories/main/Linksys_routers_and_DDoS.html

ZDNet AnchorDesk: What's wrong with Internet phones:
"The best thing about the traditional phone system is what people take for granted: Any phone on the planet can connect to any other. Some Internet telephone systems, such as Vonage, can also connect to any other phone. But except in extremely rare cases, two people on different VoIP systems can't connect to each other directly over the Internet--they have to use the public phone system as a go-between.… "

http://reviews-zdnet.com.com/AnchorDesk/4520-7297_16-5130570.html?tag=adss

Training:
"This set of labs will help you learn how to design and deploy Extensible Markup Language (XML)-based forms in Microsoft® Office InfoPath® 2003 SP-1."

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/odc_2003_ta/html/odc_landinfo03_tr.asp

The New York Times > National > 9/11 Panel Calls Policies on Immigration Ineffective:
"The commission investigating the 9/11 attacks has concluded that immigration policies promoted as essential to keeping the country safe from future attacks have been largely ineffective, producing little, if any, information leading to the identification or apprehension of terrorists."

http://www.nytimes.com/2004/04/17/national/17IMMI.html?pagewanted=all&position=

EMediaLive.com Review: Editor's Choice-Ulead DVD Workshop 2.0:
"Compared to its peers, we found DVD Workshop much more accessible than Adobe Encore, while offering a greater range of design options. Workshop stands up well even if you throw Photoshop and After Effects into the creative mix, especially if you consider development efficiency."

http://www.emedialive.com/Newsletters/EMediaXtra.aspx?NewsletterID=152#9

Understanding and Choosing File Formats in Photoshop CS and Illustrator CS:
"Peter Bauer discusses file formats and their various capabilities, including information on which format to select for which purpose. "

regitration required

http://www.informit.com/articles/printerfriendly.asp?p=169496

Data Recovery Software. NTFS Reader for DOS NTFS DOS. Freeware & Shareware.:
"NTFS Reader DOS Boot Disk provides read access to NTFS drives from the MS DOS environment. It supports long filenames as well as compressed and fragmented files. NTFS Reader for DOS allows you to preview the files on NTFS and copy them from NTFS to FAT volumes or network drives. In order to use the software you need to copy the readntfs.exe file to a bootable floppy disk and boot from it."

http://www.ntfs.com/products.htm

12 Short Steps Go a Long Way Toward Safeguarding Your Business:
"SMALL BUSINESS SECURITY CHECKLIST

Before you begin, make sure these recommendations concur with your security policy. If you don't have a security policy, learn why you should consider adopting one. "

http://www.microsoft.com/smallbusiness/gtm/securityguidance/hub.mspx

Manipulate the User Agent for Accurate Site Stats:
"If you implement any sort of hit monitoring or tracking on your Website, you probably don't want to include any of your own hits."

Ordinarily, you could set a "self-specific" cookie. Then, when the tracking script was called, you could simply check to see if that cookie existed, and, if it did, exit the tracking script.

However, if, like me, you're frankly scared of cookies on the grounds that they:

are difficult to test with,

are called something silly and

aren't 100% reliable

Furthermore, many Webmasters exclude from tracking certain browsers that are known not to work on their Websites. For example, many sites block any non-Internet Explorer or Netscape browsers, such as Mozilla's excellent new Firebird and a whole heap of others. Being able to manipulate the user agent to fool the Website into thinking we're using Internet Explorer 6.0 when we're really running Firebird 0.7 could be quite handy! …

http://www.sitepoint.com/print/site-stats-user-agent

ZDNet: Printer Friendly - Attackers infiltrating supercomputer networks:
"Unknown attackers have compromised a large number of Linux and Solaris machines in high-speed computing networks at Stanford University and other academic research facilities, according to an advisory.

The attacks, which apparently compromised servers as recently as April 3, are currently being investigated, according to an advisory posted April 6 by the Information Technology Systems and Services (ITSS) group at Stanford. "

The attacks start with the compromise of an unprivileged local user account. Usually this is because the attacker's captured the password from somewhere else: it's been sniffed off the network (through the use of insecure protocols like telnet), it's been collected when the user signs on to or from another compromised machine, it's been harvested from the password file on a compromised system.

If the target machine is behind on its patches, the attacker then uses one of a number of public exploits to elevate the unprivileged account to root status. Exploits target the Linux mremap() vulnerabilities, the Solaris kernel module loading vulnerability (for which an attack was made public on 8 Apr), and a Solaris priocntl() issue.

http://zdnet.com.com/2102-1105_2-5191024.html?tag=printthis

New Bugbear Virus finds New IE Hole:
"This has been a busy week for virus writers and antivirus vendors. We've seen some more Netsky and Bagle variants, as well as a number of new Trojans. However, the most prevalent has been last week's top threat Netsky.P, followed by Netsky.C and Netsky.D. While we haven't seen a wide distribution yet, a new Bugbear variety is starting to make the rounds?4Bugbear.C or Bugbear.E (depending on antivirus company reporting it). Bugbear.C attacks through an HTML attachment, and an unpatched Internet Explorer vulnerability. See our top threat for more information. "

Compared with PC users, Apple users have been fairly immune to viruses. However, a new "concept" Trojan is making waves in the Mac community. Intego, a security company announced the appearance of a new Trojan, MP3Concept. While Indego's press release describes potentially malicious payload the Trojan can have such as file deletion, sending e-mail, or infecting other MP3, Jpeg, GIF or QuickTime files, the MP3 Concept only shows a text message, and plays an MP3 of a man laughing. According to Symantec, the Trojan is not in the wild yet. Codemonkey takes a bit more of a swipe at Intego saying they are spreading FUD. The famous Nigerian 419 scam (also known as the advance payment scam) was in the news this week, with the conviction of one of the scammers. According to UK newspaper AllAfrica.com , Peter Okoeguale, a Nigerian living in Wales, was arrested for committing fraud. He was sentenced to 20 months, and faces deportation to Nigeria once freed. Unfortunately, this perpetrator is only one of probably hundreds or thousands of scammers preying on victims looking to make a fast buck. The Nigerian 419 scam, named after the Nigerian penal code covering fraud, comes in a number of varieties. Some offer a victim an investment in a Nigerian company, or a share of a large sum of money being spirited out of the country by an exiled high official. They often send the victim a forged or stolen check that the victim is to hold while they put up their own money. There are many web sites that explain and fight the scam. A quick search on Google for Nigerian Scam will bring up hundreds results. Peter Ferrie and Frederic Perriot, researchers at Symantec have just published an analysis of the Welchia.B (Nachi.B) worm in Virus Bulletin called "The Wormpire Strikes Back". Welchia.B attempts to be a good worm by removing other worm infections. The analysis is a terrific look under the hood of the virus, with a little Star Wars humor tossed in. If you're interested in a deeper understanding of worms in general, and Welchia in particular, take a look at Peter's whitepaper.

http://www.pcmag.com/print_article/0,1761,a=124102,00.asp

Cheaper Shared Hosting Imperils Security:
"How secure is that $16.95-a-month hosted Web account? Hosted servers, especially shared accounts, can pose real security problems. Some hosts are better than others, but with shared hosting, you basically have to keep your fingers crossed. "

http://www.eweek.com/article2/0,1759,1565792,00.asp

833786 - Steps that you can take to help identify and to help protect yourself from deceptive (spoofed) Web sites and malicious hyperlinks:
"When you point to a hyperlink in Microsoft Internet Explorer, Microsoft Outlook Express, or Microsoft Outlook, the address of the Web site typically appears in the Status bar at the bottom of the window. After you click a link that opens in Internet Explorer, the address of the Web site typically appears in the Internet Explorer Address bar, and the title of the Web page typically appears in the Title bar of the window.

However, a malicious user could create a link to a deceptive (spoofed) Web site that displays the address, or URL, to a legitimate Web site in the Status bar, Address bar, and Title bar. This article describes steps that you can take to help mitigate this issue and to help you to identify a deceptive (spoofed) Web site or URL."

http://support.microsoft.com/default.aspx?scid=kb;[ln];833786

Magical Jelly Bean Software - Magical Jelly Bean Keyfinder v1.41:
"The Magical Jelly Bean Keyfinder is a freeware utility that retrieves your Product Key (cd key) used to install windows from your registry. It has the options to copy the key to clipboard, save it to a text file, or print it for safekeeping. It works on Windows 95, 98, ME, NT4, 2000, XP, Server 2003, Office 97, and Office XP. This version is a quick update to make it work with Windows Server 2003."

http://www.magicaljellybean.com/keyfinder.shtml

Internet Explorer 6 Security and Privacy Essentials:
"Protect your privacy and the security of your computer on the Web. The following topics are packed with information and easy-to-follow, practical instructions that explain how features in Internet Explorer 6 help make your Web browsing experience better. "

http://www.microsoft.com/windows/ie/using/howto/privacy/secprivessntl.asp

RealPlayer 10 Release Supports More Formats:
"RealNetworks Inc. on Wednesday released the latest version of its digital media player with support for all of the major Internet media formats, including those from competitors Microsoft Corp. and Apple Computer Inc.

RealNetworks of Seattle first announced RealPlayer 10 for Windows in January and said it would include support for playing music purchased through Apple's iTunes, working around Apple's digital rights management technology. "

http://www.eweek.com/article2/0,1759,1563416,00.asp

Researcher Claims Online Anti-virus Scanners Buggy:
"Online scanners from Symantec, McAfee and Panda all contain buffer overflows. One researcher claims an attacker could execute arbitrary code, another just that they could crash the browser. Panda reports their software has been fixed and Symantec denies there is a problem at all. "

http://www.eweek.com/article2/0,1759,1563092,00.asp

Authorama - Public Domain Books:
"Authorama.com, featuring completely free books from a variety of different authors, collected here for you to read online or offline. The books may have been published before, but not in this form, which I hope you find enjoyable to read and print."

http://www.authorama.com/

Tax Center:
"American Express has created a Web site to help small-business owners learn about new tax developments and interact with other entrepreneurs on tax issues."

http://home3.americanexpress.com/smallbusiness/Landing/tax_center_main.asp?openvan=taxcenter

Attrition Security Rant: Anti-Virus Companies: Tenacious Spammers:
"For roughly three years, the Internet has seen worms that spread via e-mail, often taking addresses out of the infected machine's web cache, user addressbook or other sources. Some of these worms will also forge/spoof the 'From:' line so the mail appears to be from someone else, in an attempt to make the mail more 'trusted'. To be clear, here is a sample timeline of how these work:

EvilGuy01 writes and releases a new worm.

Fred is a moron and clicks on an attachment from a stranger, infecting his machine.

The worm mails a copy of itself to everyone in Fred's addressbook.

The mail sent out spoofs the headers of the mail so it may be 'From: George' or 'From: Sally'.

Tom gets a copy of the mail 'From: Sally' and clicks on the attachment, infecting himself.

Tom sends mail to Sally complaining about her evil shenanigans.

Sally replies to Tom with 'd00d WTF?! lol' since she never sent the mail. "

How enterprise AV systems add to the Internet traffic

But wait, it gets worse. Even if friends and family understand that I likely did not send them a virus, some enterprise antivirus program with built-in return messages will state emphatically that I have a virus. Here's how that works: As the forged e-mail enters their enterprise system, that system bounces it back to the apparent sender with a message that authoritatively states, "You are infected with XXX virus." I have hundreds of these bounced e-mail messages claiming that I am infected with MyDoom.f, Netsky.d, or Bagle.c. I'm not.

In the middle of an e-mail virus outbreak, messages such as these--originally intended to provide a useful service--only add to the Internet traffic jam. Brian Martin, a.k.a. Jericho at Attrition.org, wrote a thorough critique of the current methods being used, complete with examples. His conclusion? System administrators need to turn off this "helpful" feature if they haven't already.

Unfortunately, the spoofing problem itself lies deep under the hood of the Internet, within SMTP, Simple Mail Transfer Protocol, the Internet protocol used for sending e-mail. SMTP was created many years ago and lacks a modern method for verifying the authenticity of the sender. With a little finesse, almost anyone can manipulate the header information on an e-mail message to disguise its true origin and make it appear as though someone else sent you a message.

http://reviews-zdnet.com.com/AnchorDesk/4520-7297_16-5128975.html?tag=adss

http://www.attrition.org/security/rant/av-spammers.html

Microsoft Releases Source Code on SourceForge:
"On Monday, Microsoft released some of its code under an open-source license, and posted it on SourceForge, the open-source code repository.

To date, Microsoft has made its source code available under a variety of licensing mechanisms, all under its 'shared source' umbrella. But until today, the company had not released code under what is commonly considered a true open-source license."

Microsoft made available an internally-developed product called the "Windows Installer XML" (WiX) to SourceForge. The code is downloadable here.

WiX is a toolset for building Windows installation packages from XML source code. It runs on Windows NT and Windows 2000.…

http://sourceforge.net/projects/wix/

http://www.microsoft-watch.com/article2/0,1995,1561953,00.asp

Microsoft Security Newsletter For Home Users- Current Edition

http://www.microsoft.com/security/home/secnews/current.asp

Executive E-Mail: Current Edition:
"Microsoft Progress Report: Security

Malicious software code has been around for decades. But only in the last few years have the Internet, high-speed connections and millions of new computing devices converged to create a truly global computing network in which a virus or worm can circle the world in a matter of minutes.

Meanwhile, criminal hackers have become more sophisticated, creating and distributing digital epidemics like Slammer, Blaster, Sobig and Mydoom that spread almost instantaneously, threatening the potential of technology to advance business productivity, commerce and communication.

The kinds of threats are evolving too. Blaster, for example, hijacked individual computers, turning innocent users into unknowing and innocent worm propagators. These kinds of attacks – "swarming" attacks that are coordinated to cause multiplied, cascading effects – change the landscape of security threats. They put new demands on IT professionals and consumers to take preventative measures, and on the technology industry to continue to innovate and develop new solutions.…

Given human nature, evolving threat models and the increasing interconnectedness of computers, the number of security exploits will never reach zero. But we can dramatically blunt the impact of cybercriminals, and are dedicating a major portion of our R&D investments to security advances.…"

http://www.microsoft.com/mscorp/execmail/

HOAXBUSTERS Home Page:
"Interspersed among the junk mail and spam that fills our Internet e-mail boxes are dire warnings about devastating new viruses, Trojans that eat the heart out of your system, and malicious software that can steal the computer right off your desk. Added to that are messages about free money, children in trouble, and other items designed to grab you and get you to forward the message to everyone you know. Most all of these messages are hoaxes or chain letters. While hoaxes do not automatically infect systems like a virus or Trojan, they are still time consuming and costly to remove from all the systems where they exist. At CIAC, we find that we spend much more time de-bunking hoaxes than handling real virus and Trojan incidents. These pages describe some of the warnings, offers, and pleas for help that are filling our mailboxes, clogging our mailservers, and that generally do not have any basis in fact.…"

http://hoaxbusters.ciac.org/

MSBlast epidemic far larger than believed - News - ZDNet:
"New data from Microsoft suggests that at least 8 million Windows computers have been infected by the MSBlast, or Blaster, worm since last August--many times more than previously thought.… "

http://zdnet.com.com/2100-1105_2-5184439.html

A Heretical View of File Sharing:
"But what if the industry is wrong, and file sharing is not hurting record sales?

It might seem counterintuitive, but that is the conclusion reached by two economists who released a draft last week of the first study that makes a rigorous economic comparison of directly observed activity on file-sharing networks and music buying.

'Downloads have an effect on sales which is statistically indistinguishable from zero, despite rather precise estimates,' write its authors, Felix Oberholzer-Gee of the Harvard Business School and Koleman S. Strumpf of the University of North Carolina at Chapel Hill.… "

http://www.nytimes.com/2004/04/05/technology/05music.html

The Search Engine Report - Number 89 - April 2, 2004:
" Search Engine Watch News
Search Engine Strategies Goes International
Search Engine Articles By Danny Sullivan
SearchDay Articles
Search Engine Articles
Search Engine Resources"

http://searchenginewatch.com/sereport/article.php/3335091

Kinja, the weblog guide:
"Kinja is a weblog portal, collecting news and commentary from some of the best sites on the web. Visitors can browse items on topics, everything from food to sex. Or they can create a convenient personal digest, to track their favorite writers.

Weblogs are much talked about, but still challenging to navigate for the average web user. Kinja is designed to bring weblog writers to a broader audience, by making it easier to explore topics, posts and writers.

Kinja is not aimed at early adopters. Users wanting to analyze patterns of meme propagation, and other sophisticated data, should try the excellent Technorati."

http://www.kinja.com/

Google to offer gigabyte of free e-mail - News - ZDNet:
"Google, the company that made off with the search market, is setting its sights on free e-mail.

The company, based in Mountain View, Calif., on Thursday launched a test with about 1,000 invited guests set to try out a new e-mail service called 'Gmail.'

Google, which made its name in search but has added numerous services, such as a news aggregation page and a newsgroup interface, says that Gmail is search-based e-mail."

Like Yahoo Mail and MSN Hotmail, Gmail will let users search through their e-mail. Unlike those competitors, though, Google will offer enough storage so that the average e-mail account holder will never have to delete messages.

Hotmail currently offers 2MB of free e-mail storage. Yahoo offers 4MB. Gmail will dwarf those offerings with a 1GB storage limit.…

http://zdnet.com.com/2100-1104_2-5182805.html

PC Magazine: Top 100 Web Sites:
"Top 100 Web Sites - April 2004

You'll wonder how you ever got along without these little-known gems. We've also updated our Top 100 Classics."

http://www.pcmag.com/category2/0,1738,7488,00.asp

Top 100 Favorites Download:
"2004 100 Top Websites You Didn't Know You Couldn't Live Without "

http://www.pcmag.com/article2/0,1759,1558426,00.asp

DOS on Its Death Bed?:
"DeviceLogics, keeper of the DR-DOS code base, released this week what might be the final upgrade to the 17-year-old DOS operating-system variant.

At the Embedded Systems Conference in San Francisco, DeviceLogics took the wraps off DR-DOS 8.0, the first update to DR-DOS since 1999."

The primary new feature of the 8.0 release is FAT32/large-partition support, which DeviceLogics is targeting at customers with DOS-based embedded applications that are built atop FAT32 platforms.…

While Microsoft's now-defunct MS-DOS is the probably the best known of the DOS flavors (Microsoft buried MS-DOS inside Windows, as of Windows 95), DR-DOS has had its share of backers through the years.

http://www.eweek.com/article2/0,1759,1558362,00.asp

DDoS Attacks for the Common Man:
"Ask not why the DDoS bell tolls for thee.

You might ask why you, who monopolized your industry or sued customers for using someone else's product, should be the target of a DDoS attack? You might as well ask why there's random street crime. The answer is that the Internet is a rough neighborhood, and even little guys have disgruntled former employees and customers who feel cheated, not to mention ex-spouses and competitors. Trust me, it really could happen."

Most Web sites don't have or need the resources that Microsoft or even The SCO Group put in theirs for normal business, and it doesn't take an army of zombied clients to bring them down. Just a few clients, focused on the job, can cause problems for a Web site. Froutan says that at his company they've seen such attacks go on for days at a time. Experience with the MyDoom worms certainly bears that out.…

http://www.eweek.com/print_article/0,1761,a=122636,00.asp

This summary is not available. Please click here to view the post.

Online Merchants Find Problems With Google:
"Google may be popular, but it gets its share of complaints. Merchants quibble when their sites rank poorly, while some users say the popularity-based ranking system shuts out useful, but little-known sites. "

Because a site scores higher the more other sites link to it—an indication of popularity—independent films are less likely than Hollywood blockbusters to appear in results, said Dragomir Radev, an information studies professor at the University of Michigan.

Newer and foreign sites may also be difficult to find because they are not as well known by the U.S.-centric Internet population.…

as Google's popularity grew, so did attempts to fool it. A cottage industry developed around search engine optimization to share tricks for ranking higher.

One early trick involved buying hundreds of domain names and having them link to one another to mimic popularity. As Google closed one loophole, webmasters found others.

Pranksters have figured out that they, too, could game the system, so that typing "miserable failure" gets you President Bush's biography, even though neither word appears on the page.…

http://www.eweek.com/article2/0,1759,1556008,00.asp?kc=EWNWS032904DTX1K0000599

Crafty Syntax Live support Help - Free download and open source:
"A multi-user, multi-operator, multi-department live Help support chat system that allows the operators of the websites to monitor their visitors as they are browsing the site and proactively open a chat session with the visitor. Is in PHP and uses either Mysql or Text based database . Other features include AUTO INVITE!, referer tracking, page tracking, chat notification, user is typing message, multiple chat sessions, sound alert, leave a message if offline, push urls, quick responses, and multiple operators. runs on your server and is open source GPL."

http://www.craftysyntax.com/CSLH/

Online Swindlers, Called 'Phishers,' Lure Unwary:
"EarthLink, the big Internet access provider, went hunting for phishers.

It started a campaign to track down people who were sending e-mail messages that pretended to be from EarthLink but were actually fraudulent attempts to steal customers' passwords, credit card numbers and other information. What it found was that of the dozen or so people it could clearly identify as engaged in the practice known as phishing, more than half were under 18."

http://www.nytimes.com/2004/03/24/technology/24PHIS.html?pagewanted=all&position=

Hotmail, Yahoo Users at Risk of PC Takeover:
"A potentially serious security flaw found in Web-based e-mail services offered by Microsoft and Yahoo could put millions of PCs at risk of takeover, an Internet security research firm warned Tuesday.…"

The vulnerability only affects Hotmail and Yahoo running on Microsoft's Internet Explorer (IE) browser.

"When the victim attempts to read this email, the code executes and may result in severe consequences," the company said. Successful exploit could lead to theft of a user's login and password, disclosure of the content of any e-mail in the mailbox and disclosure of all contacts within the address book.

Additionally, GreyMagic said the attacker could manipulate the system to automatically send e-mails from the mailbox and to exploit vulnerabilities in IE to access the user's file system and eventually take over his or her machine.

The company said Microsoft reacted to its warning with a fix for the flaw. However, GreyMagic said all attempts to contact Yahoo's security department failed, meaning that Yahoo's users are still vulnerable. Efforts by internetnews.com to contact Yahoo at press time were unsuccessful.

…the vulnerability makes use of an IE technology called HTML+TIME (based on SMIL), which is meant to add timing and media synchronization support to HTML pages.

One of the features of HTML+TIME is the ability to manipulate any attribute on an element via special control elements.…

http://www.internetnews.com/dev-news/print.php/3329821

MSDN Flash:
"Volume 8, Number 6 March 23, 2004"

http://msdn.microsoft.com/flash/currentissue.htm

Netsky.P Spreads Through Ancient Security Hole:
"McAfee's Avert labs is reporting that a new variant of the Netsky worm, Netsky.P, is spreading quickly. Both McAfee and Trend Micro Inc. rate Netsky.P as a 'medium' threat and Symantec Corp. has rated it a '2' (for 'Low,' on a scale of 1 to 5). This is the first new variant of Netsky seen in about a week, a long hiatus for recent times. "

This new variant is very much like other Netsky versions with two differences, according to Vincent Gullotto, vice president of the McAfee Avert Virus and Vulnerability Emergency Response Team. The initial seeding of the worm, referring to the initial group of users to whom the virus author distributed it, appears to have been in Australia. It's not clear whether or how this would facilitate spreading of the worm, but it is unusual.

The other interesting and unusual characteristic of this worm is that is utilizes a very old vulnerability in Internet Explorer, the Incorrect MIME Header (MS01-020) bug. This bug, patched almost three years ago, allowed a hostile HTML e-mail to execute arbitrary code if viewed in the preview pane of a mail client.

Once very much in vogue among virus writers, it has fallen into disuse in recent times.…

http://www.eweek.com/article2/0,1759,1552315,00.asp?kc=EWNWS032204DTX1K0000599

Fast-Moving Worm Crashes Computers:
"Witty, a new worm that hit the Internet Saturday, looked late Monday to be running down. It corrupts the hard drives of machines running vulnerable versions of ISS' BlackIce products."

The Witty worm, which took hold of the Internet for a short time during the weekend, appears to have peaked thanks to its habit of destroying the machines it infects.

Witty made a dramatic entrance Saturday morning, quickly infecting more than 6,000 computers, which then began scanning the Internet for other machines to attack. But within 24 hours, the number of Witty-infected PCs scanning the Internet had dropped to around 2,000. That number dropped even further, to around 1,000 machines by Monday morning, according to data compiled by The SANS Institute, based in Bethesda, Md.

Unlike most worms, which exist for the lone purpose of spreading themselves, Witty is capable of corrupting the hard drives of infected machines, preventing normal operation of the PC and eventually causing it to crash. The worm attacks via random UDP ports; however, it always comes from UDP source port 4000, according to various analyses of the code by security experts. Infected machines will begin sending out large amounts of UDP traffic as the worm attempts to infect other machines.

Rebooting an infected machine appears to remove the worm, experts said on the weekend.

The main reason for the drop-off seems to be that Witty gradually corrupts the hard drives of infected machines, eventually causing them to crash and preventing them from scanning any longer. At the peak of the outbreak Saturday, SANS was seeing as many as 300,000 Witty-related packets per hour. Witty exploits a flaw in a component of Internet Security Systems Inc.'s BlackIce protection software. The vulnerable component also is found in several other ISS products, but the Atlanta-based company said they are not susceptible to the worm.

Once it infects a given machine, the worm generates a random IP address and sends its payload to that PC. It repeats this process 20,000 times, then turns its attention back to the local machine it's on. Witty opens a random drive on the PC and writes 65 kb of data to a random location.…

http://www.eweek.com/article2/0,1759,1552000,00.asp?kc=EWNWS032204DTX1K0000599

Use JavaScript to Create a Scrolling Grid - WebReference.com-:
"A problem often encountered in web design is condensing large tables of data into a standard 800x600 web page. If the table is too big, the user will need to scroll the browser window to see all of the data, which means that the surrounding text and any row or header columns cannot be seen."

http://www.webreference.com/programming/javascript/gr/column4/index.html

Experts Debate Danger of Phatbot Worm:
"Security discussion lists and reports were abuzz Wednesday with talk of a new worm, named 'Phatbot,' that had spread to as many as hundreds of thousands of systems. But not all security experts agreed that the worm was widespread.

As of late Wednesday afternoon, no major antivirus company had listed the worm as more than a 'low' risk. "

http://www.eweek.com/article2/0,1759,1550393,00.asp?kc=EWNWS031804DTX1K0000599

New Bagle Worm Variant Can Run Without Launching Attachment:
"A series of new variants of the prolific Bagle worm has raised alarms in the security community through an innovative infection mechanism: The e-mail message in which the variants arrive may have no file attachment, and it's possible for a user to become infected without having to launch one. "

The message includes a Windows ActiveX control and uses a vulnerability announced and patched by Microsoft Corp. in August and another problem from last October. The most recent Cumulative Security Update for Internet Explorer also includes a fix for the more recently discovered flaw.

The ActiveX control does not contain the actual worm, according to McAfee Security. Instead, it creates and runs a VBScript on the system, which downloads and executes the worm from one of a list of IP addresses. According to McAfee, as of 06:45 PST on March 18, "The majority of the 590 IP addresses seen have been closed down. At the time of writing, 39 were still responding."

http://www.eweek.com/article2/0,1759,1550835,00.asp?kc=EWNWS031804DTX1K0000599

New Homeland Security Guidelines Called Vendor-Driven:
"A task force formed by the Department of Homeland Security is set to unveil a set of security recommendations this week for both enterprises and home users, but many industry observers say the guidelines are too little, too late. "

The guidelines are the work of the Awareness for Home Users and Small Businesses task force, formed late last year by DHS and private industry at the National Cybersecurity Summit. The group and several others formed at the same event are designed to help foster better cooperation between government and industry and to tackle topics such as creating early warning systems, writing secure software and bolstering security in corporate governance.

The groups mainly comprise executives from security and software vendors such as Oracle Corp., Microsoft Corp., RSA Security Inc. and Internet Security Systems Inc., as well as government officials and security experts in academia.

The recommendations, scheduled to be released Thursday, are intended as a follow-up to the National Strategy to Secure Cyberspace, released in early 2003 and widely panned in the industry for being long on platitudes and short on definitive action. The new offering reportedly centers on increasing users' awareness about security issues through education and communication.

"Because this is driven mainly by the vendors, it will be about blaming the users," said Alan Paller, research director at The SANS Institute in Bethesda, Md. "Private industry isn't doing its part to fix the problems we have with software and processes. It's like telling drivers to drive safely and not fixing the bumpers and the seat belts."

http://www.eweek.com/article2/0,1759,1549954,00.asp?kc=EWNWS031704DTX1K0000599

Microsoft Renews Its Commitment to Security Education:
"If you lead customers to the security trough, will they drink?

Microsoft seems convinced they will. And the company is pulling out all the stops to continue to educate its users, reasoning that a more educated customer base will be a more secure customer base.…"

Microsoft will release for download on Wednesday, March 17, a new scripting capability for its Microsoft Baseline Security Analyzer 1.2, a product which performs scans of Windows systems for security misconfigurations. The new scripting tool will allow users to scan an unlimited number of computers or IP addresses from a single input file.

http://www.microsoft-watch.com/article2/0,1995,1549876,00.a

Help Yourself:
"Although it's easy to pick up the phone and call that friend who always has an answer, or post a message to your favorite tech forum, you might want to take a few steps to try to solve the problem on your own—or at least be prepared with the information your geek in shining armor will need to troubleshoot the problem for you. Here are ten steps that can help you solve your problems faster.…"

http://www.pcmag.com/article2/0,1759,1544176,00.asp

Java(TM) Boutique - Using FOP with Java:
"In data-centric applications, you are often required to produce reports and documents in various formats. One of the challenges facing the developer world is to find a generic and consistent way of manipulating a structurally diverse data set to produce formatted reports. For example, if you write a program to accept a certain data set and produce a PDF formatted report, than in order to produce an HTML report on the same data set you might have to write a different program. In this article, we will see a relatively new technology involving W3C standard named XSL-FO. FOP gives us the flexibility to operate on XML structured data, apply an XSL Stylesheet, do the XSLT transformation and publish the data in various formats such as PDF, PCL, SVG, TXT and many other…"

http://javaboutique.internet.com/tutorials/FOP/

The Hidden Power of Photoshop CS: Chapter 2: Color Separations. Pt. 2. By Sybex - WebReference.com-:
"A second way to achieve manual duotoning is to create the effect using spot color channels. This creates an image with the spot color built in, and essentially it will be press ready as a separation. In the following techniques you will use both the manual layer method just described in the previous section and Photoshop’s duotone interface to create duotone results."

http://www.webreference.com/graphics/ps2/

Office update clogs spam filters - News - ZDNet:
"A recent update for Microsoft's Office software is blocking several popular spam filters, and software makers are scrambling to find a fix to the fixes.

The problems have occurred since the release earlier this week of Service Pack 3 for Office XP and 2000, which are recent versions of Microsoft's widespread productivity package. The patches and big fixes in SP3 included a number of security fixes for Office's widely used e-mail client, Outlook.

Shortly after SP3 was released, users started reporting problems to the makers of several popular products for filtering out junk e-mail. They said every time their spam filter tried to intercept a message, Outlook would pop up a warning message that another application was trying to access Outlook's address book. …"

"If they were to click, 'yes,' 'yes,' 'yes' (in Outlook), it would work for them," Fahey said. "It's just a pain.…"

http://zdnet.com.com/2100-1105_2-5172968.html

Building ASP.NET Applications with C#Builder for Microsoft .NET:
"Among the many features of C#Builder is an ASP.NET application development environment. With full support for WYSIWYG design and access to HTML and C# code, C#Builder is an excellent tool for building entire Web sites."

http://www.informit.com/articles/article.asp?p=169672