Unscheduled Security Update Fixes Critical IE Flaws:
"The security bulletin accompanying the updates, numbered MS04-025, addresses three vulnerabilities rated 'critical' that could result in an attacker executing code in the context of a logged-on user. If the user is logged on as Administrator, the attack would have free reign over the system."
The first vulnerability, titled "Navigation Method Cross-Domain Vulnerability," could allow an attacker to execute arbitrary code in the Local Machine security zone. Microsoft reports that many factors can make this vulnerability more difficult to execute, including installing certain previous updates. Nevertheless, Symantec reports this as the most critical of the three vulnerabilities and that they have already seen exploits of it in the wild.
The other two vulnerabilities are related to the browser's handling of image files. Both are buffer overflows in Internet Explorer's handling of these files, one for BMP files and one for GIF files. Internet Explorer 6 Service Pack 1 and Windows Server 2003, both 32-bit and 64-bit editions, are not affected by the BMP file vulnerability.
The GIF buffer overrun affects all versions of Windows and Internet Explorer and results when the attacker attempts to free memory that has already been freed. The bulletin indicates that this is most likely a denial-of-service attack, but the potential exists for it to be used to execute arbitrary code.
The update replaces a previous update, MS04-004. If users have applied that patch and subsequently applied non-public hotfixes they may have to reapply them after applying the new cumulative update. Users should consult the bulletin and Microsoft support.
http://www.microsoft.com/technet/security/bulletin/MS04-025.mspx
http://www.eweek.com/article2/0,1759,1629584,00.asp
Saturday, July 31, 2004
Friday, July 30, 2004
Open-Source Exploit Tool: 'Point, Click, Root'
Open-Source Exploit Tool: 'Point, Click, Root':
"It's as easy as 'point, click, root.'
At a heavily attended panel Wednesday at the Black Hat security conference here, HD Moore and 'spoonm' unveiled the latest release of the Metasploit Framework, an exploit tool designed to quickly take over a variety of target platforms."
Although the framework was developed several months ago, the "preview release" of Version 2.2 offers users the opportunity to develop their own custom modules. The tool, written in Perl for Unix environments, also includes a Cygwin shell to enable it to run under Windows. The official Version 2.2 will be available in a week or so.
Both researchers demonstrated the tool "owning," or taking over, Mac OS X, Windows 2000 Server and Windows XP systems, although the duo used a VMWare virtual machine to speed the process. Metasploit even runs on a Sharp Zaurus PDA, which when equipped with a Wi-Fi card can be used to attack while mobile.
The authors described the tool as the open-source, cheap alternative to Immunity's Canvas and Core Security Technology's Impact tools, designed for commercial applications and requiring the latest exploits almost as quickly as possible. Metasploit currently contains 35 exploits and 40 payloads; the tool was designed to point the user to the exploit appropriate for the operating system.
Although available for several months, the tool is apparently still relatively unknown even in security circles, judging from the reaction of attendees. Patrick Chambet, a senior consultant at French IT security firm Edelweb SA, said he found the presentation the most interesting of the day. Another researcher said he worried that Metasploit would be used by "script kiddies" as a means to quickly own other boxes.…
http://www.eweek.com/article2/0,1759,1628707,00.asp?kc=ewnws072904dtx1k0000599
"It's as easy as 'point, click, root.'
At a heavily attended panel Wednesday at the Black Hat security conference here, HD Moore and 'spoonm' unveiled the latest release of the Metasploit Framework, an exploit tool designed to quickly take over a variety of target platforms."
Although the framework was developed several months ago, the "preview release" of Version 2.2 offers users the opportunity to develop their own custom modules. The tool, written in Perl for Unix environments, also includes a Cygwin shell to enable it to run under Windows. The official Version 2.2 will be available in a week or so.
Both researchers demonstrated the tool "owning," or taking over, Mac OS X, Windows 2000 Server and Windows XP systems, although the duo used a VMWare virtual machine to speed the process. Metasploit even runs on a Sharp Zaurus PDA, which when equipped with a Wi-Fi card can be used to attack while mobile.
The authors described the tool as the open-source, cheap alternative to Immunity's Canvas and Core Security Technology's Impact tools, designed for commercial applications and requiring the latest exploits almost as quickly as possible. Metasploit currently contains 35 exploits and 40 payloads; the tool was designed to point the user to the exploit appropriate for the operating system.
Although available for several months, the tool is apparently still relatively unknown even in security circles, judging from the reaction of attendees. Patrick Chambet, a senior consultant at French IT security firm Edelweb SA, said he found the presentation the most interesting of the day. Another researcher said he worried that Metasploit would be used by "script kiddies" as a means to quickly own other boxes.…
http://www.eweek.com/article2/0,1759,1628707,00.asp?kc=ewnws072904dtx1k0000599
Monday, July 26, 2004
Researchers Wonder Why Bagle Virus is a Success
Success of Bagle Virus Puzzles Researchers:
"Several new variants of the venerable Bagle virus visited themselves upon corporate networks last week, frustrating administrators and virus researchers who continue to wonder why these worms can still infect thousands of machines after months of warnings.
None of the most recent variants is particularly innovative or clever in its social engineering efforts or infection methods. Many versions of the Bagle virus actually make it difficult for users to infect machines by requiring them not only to open an attachment but also to enter a password to launch the malware. "
http://www.eweek.com/article2/0,1759,1626686,00.asp?kc=ewnws072604dtx1k0000599
"Several new variants of the venerable Bagle virus visited themselves upon corporate networks last week, frustrating administrators and virus researchers who continue to wonder why these worms can still infect thousands of machines after months of warnings.
None of the most recent variants is particularly innovative or clever in its social engineering efforts or infection methods. Many versions of the Bagle virus actually make it difficult for users to infect machines by requiring them not only to open an attachment but also to enter a password to launch the malware. "
http://www.eweek.com/article2/0,1759,1626686,00.asp?kc=ewnws072604dtx1k0000599
VeriSign: Be Wary Online. Be Very Wary.
VeriSign: Be Wary Online. Be Very Wary.:
"Internet commerce grew 13.2 percent in the past 12 months, according to a new report. Not bad.
But fraud grew faster.
The report, to be released Monday, said phishing attacks, in which fraudsters lure people to sites that mimic those of top retailers in order to steal personal information, have become more acute and global in nature. "
http://www.internetnews.com/ec-news/article.php/3385681
"Internet commerce grew 13.2 percent in the past 12 months, according to a new report. Not bad.
But fraud grew faster.
The report, to be released Monday, said phishing attacks, in which fraudsters lure people to sites that mimic those of top retailers in order to steal personal information, have become more acute and global in nature. "
http://www.internetnews.com/ec-news/article.php/3385681
iPaq handheld can easily switch between cellular and Wi-Fi
HP to Dick Tracy: Bet your phone can't do this - News - ZDNet:
"Hewlett-Packard is introducing its first iPaq handheld that can easily switch between traditional cellular and Wi-Fi networks.
The h6315, which was co-developed with T-Mobile, operates on a traditional cellular network but can automatically hop over onto a faster Wi-Fi connection when one is available. The device also has a built-in camera and a detachable keyboard and can also act as a cell phone using the GSM cellular network. "
http://zdnet.com.com/2100-1103_2-5282083.html
"Hewlett-Packard is introducing its first iPaq handheld that can easily switch between traditional cellular and Wi-Fi networks.
The h6315, which was co-developed with T-Mobile, operates on a traditional cellular network but can automatically hop over onto a faster Wi-Fi connection when one is available. The device also has a built-in camera and a detachable keyboard and can also act as a cell phone using the GSM cellular network. "
http://zdnet.com.com/2100-1103_2-5282083.html
Windows Security Updates for July 2004
Windows Security Updates for July 2004:
"The Microsoft Windows security updates for July 2004 address newly discovered issues in Windows, including Microsoft Internet Explorer and Microsoft Outlook Express, both components of Windows. If you have any of the software listed on this page installed on your computer, you should visit the Windows Update Web site to install related updates."
http://www.microsoft.com/security/bulletins/200407_windows.mspx
"The Microsoft Windows security updates for July 2004 address newly discovered issues in Windows, including Microsoft Internet Explorer and Microsoft Outlook Express, both components of Windows. If you have any of the software listed on this page installed on your computer, you should visit the Windows Update Web site to install related updates."
http://www.microsoft.com/security/bulletins/200407_windows.mspx
Windows XP Home and Professional Service Configurations by Black Viper
Windows XP Home and Professional Service Configurations by Black Viper:
"This section on Windows XP Service Configurations has complete explanations of each service and advice and which ones you can safely disable."
http://www.blackviper.com/WinXP/servicecfg.htm
"This section on Windows XP Service Configurations has complete explanations of each service and advice and which ones you can safely disable."
http://www.blackviper.com/WinXP/servicecfg.htm
Friday, July 23, 2004
Gmail Vulnerability Reported
Gmail Vulnerability Reported:
"A vulnerability in Google's Gmail may give remote users access to Gmail user information. The culprit is the Gmail CheckAvailability script. Remote users can apply the '/accounts/CheckAvailability' script repeatedly until the system returns another user's information.
The only information that seems to be revealed are the user's first and last name and desired Gmail account. Also, in order to access this information, the remote user must have a valid Gmail invite. While this may not be as much of a security caution as, say, revealing credit card information, it still causes a worry for users wishing to remain anonymous.… "
http://www.webpronews.com/news/ebusinessnews/wpn-45-20040720GmailVulnerabilityReported.html
"A vulnerability in Google's Gmail may give remote users access to Gmail user information. The culprit is the Gmail CheckAvailability script. Remote users can apply the '/accounts/CheckAvailability' script repeatedly until the system returns another user's information.
The only information that seems to be revealed are the user's first and last name and desired Gmail account. Also, in order to access this information, the remote user must have a valid Gmail invite. While this may not be as much of a security caution as, say, revealing credit card information, it still causes a worry for users wishing to remain anonymous.… "
http://www.webpronews.com/news/ebusinessnews/wpn-45-20040720GmailVulnerabilityReported.html
Thursday, July 22, 2004
What's Next: For Doctored Photos, a New Flavor of Digital Truth Serum
The New York Times > Technology > Circuits > What's Next: For Doctored Photos, a New Flavor of Digital Truth Serum:
"'It used to be that you had a photograph, and that was the end of it - that was truth,' said Hany Farid, an associate professor of computer science at Dartmouth College who is a leader in the field. 'We're trying to bring some of that back. To put some measure of guarantee back in photography.'
At stake is more than the fate of possible child pornographers. The United States military has become increasingly reliant on digital images from drones and satellites to give soldiers a sense of the battlefield. Law enforcement officers routinely use digital cameras to photograph crime scenes. Newspapers and magazines are now dependent on digital photographs that can be easily doctored.
Over the last three years, Professor Farid and his students have become experts at forgery, making hundreds of images that look authentic but have in fact been digitally tweaked. License plate numbers are changed. A single stool standing on a checkerboard floor is suddenly a pair of stools. Dents on a car are wiped away with a few mouse clicks.
The skillful tampering disturbed the images in ways that the human eye could not detect. But Professor Farid says his algorithms can spot them and sound the alarm."
For example, when two images are spliced together - like the picture of a shark attacking a helicopter that has circulated around the Internet in the past few years - one or both of the original pictures usually has to be shrunk, enlarged or rotated to make the pieces fit together. And those changes, no matter how artful, leave clues behind.
Take a picture that is 10 pixels by 10 pixels, for a total of 100. Stretch it to 10 by 20 pixels, and image-editing software like Adobe Photoshop will assign the picture's original pixels to every other slot in the new picture. That leaves 100 pixels "blank," or without values. Image-editing software fills in the gaps by examining what their neighbors look like, and then applying an average. To oversimplify, if pixel A is blue, and pixel C is red, the blank pixel B will become purple.
This kind of averaging becomes "pretty obvious" after some analysis of the image, Professor Farid said.
In tests on several hundred doctored photos, this technique for detecting changes proved to be virtually foolproof if the picture quality was high enough. Uncompressed TIFF image files, which contain enormous amounts of data, were like an open book to Professor Farid's team.
But Professor Farid said that for now the technique does not work as well with files created in JPEG, the compressed picture format most commonly used online.…
http://www.nytimes.com/2004/07/22/technology/circuits/22next.html
"'It used to be that you had a photograph, and that was the end of it - that was truth,' said Hany Farid, an associate professor of computer science at Dartmouth College who is a leader in the field. 'We're trying to bring some of that back. To put some measure of guarantee back in photography.'
At stake is more than the fate of possible child pornographers. The United States military has become increasingly reliant on digital images from drones and satellites to give soldiers a sense of the battlefield. Law enforcement officers routinely use digital cameras to photograph crime scenes. Newspapers and magazines are now dependent on digital photographs that can be easily doctored.
Over the last three years, Professor Farid and his students have become experts at forgery, making hundreds of images that look authentic but have in fact been digitally tweaked. License plate numbers are changed. A single stool standing on a checkerboard floor is suddenly a pair of stools. Dents on a car are wiped away with a few mouse clicks.
The skillful tampering disturbed the images in ways that the human eye could not detect. But Professor Farid says his algorithms can spot them and sound the alarm."
For example, when two images are spliced together - like the picture of a shark attacking a helicopter that has circulated around the Internet in the past few years - one or both of the original pictures usually has to be shrunk, enlarged or rotated to make the pieces fit together. And those changes, no matter how artful, leave clues behind.
Take a picture that is 10 pixels by 10 pixels, for a total of 100. Stretch it to 10 by 20 pixels, and image-editing software like Adobe Photoshop will assign the picture's original pixels to every other slot in the new picture. That leaves 100 pixels "blank," or without values. Image-editing software fills in the gaps by examining what their neighbors look like, and then applying an average. To oversimplify, if pixel A is blue, and pixel C is red, the blank pixel B will become purple.
This kind of averaging becomes "pretty obvious" after some analysis of the image, Professor Farid said.
In tests on several hundred doctored photos, this technique for detecting changes proved to be virtually foolproof if the picture quality was high enough. Uncompressed TIFF image files, which contain enormous amounts of data, were like an open book to Professor Farid's team.
But Professor Farid said that for now the technique does not work as well with files created in JPEG, the compressed picture format most commonly used online.…
http://www.nytimes.com/2004/07/22/technology/circuits/22next.html
ASP.NET Web Matrix Guided Tour
ASP.NET Web Matrix Guided Tour:
"What Level of Expertise Is Assumed in the Guided Tour?
You should be fluent in HTML and general Web development terminology. You do not need previous ASP.NET experience for most of the walkthroughs, although you should be familiar with the general web concepts behind interactive Web pages, including forms, XML, and data access.
For a walkthrough of ASP.NET itself, please review the ASP.NET QuickStart Tutorial at: http://www.asp.net/Tutorials/quickstart.aspx"
http://www.asp.net/webmatrix/tour/getstarted/intro.aspx
"What Level of Expertise Is Assumed in the Guided Tour?
You should be fluent in HTML and general Web development terminology. You do not need previous ASP.NET experience for most of the walkthroughs, although you should be familiar with the general web concepts behind interactive Web pages, including forms, XML, and data access.
For a walkthrough of ASP.NET itself, please review the ASP.NET QuickStart Tutorial at: http://www.asp.net/Tutorials/quickstart.aspx"
http://www.asp.net/webmatrix/tour/getstarted/intro.aspx
Bagle.ag and Bagle.ai - ZDNet: Reviews
Double trouble as these latest versions of Bagle spread quickly:
"The most recent variations of the Bagle worm family appear to be based on code similar to the Bagle.af variation. Bagle.ag (w32.bagle.ag@mm, also known as Beagle.ac and Bagle.ah) and Bagle.ai (w32.bagle.ai@mm, also known as Bagle.ae, Beagle.ag, and Bagle.ah) are mass-mailing worms that vary in length and are packed with the UPX file compressor. They use various subject lines and attached files to spread via e-mail. They also attempt to spread via shared network files. They both try to terminate security apps that may be running on the infected machine and install a backdoor Trojan horse. Additionally, Bagle.ai will attempt to terminate any Netsky virus that may be running on the infected machine. This worm does not affect Linux, Unix, or Mac OS systems. Because Bagle.ag and Bagle.ai spread via e-mail and open a backdoor Trojan, they rate a 6 on the CNET/ZDNet Virus Meter. "
How it works
Both versions of Bagle use a different set of subject and body texts, contain their own SMTP engine to send copies of themselves. They also harvest e-mail addresses from infected machines, spoof the e-mail sender's address, and password-protect the attached file. These worms contain a remote access Trojan horse, copy themselves to folders that use the string "shar" in the name, and will attempt to terminate security programs and other computer viruses and worms.
Additionally, Bagle.ai will use mutex names already used by the Netsky in order to prevent further Netsky infections. Bagle.ai will also delete the registry entries for security apps and other viruses such as Netsky.
Bagle.ag creates the following in the Win/System32 folder
sys_xp.exe
sys_xp.exeopen
sys_xp.exeopenopen
Bagle.ai creates the following in the Win/System32 folder:
WinXP.exe
WinXP.exeopen
WinXP.exeopenopen
WinXP.exeopenopenopen
WinXP.exeopenopenopenopen
Bagle.ag opens TCP port 1080 while Bagle.ai opens ports 1080 (TCP) and 1040 (UDP).…
http://reviews-zdnet.com.com/4520-6600_16-5144521.html
"The most recent variations of the Bagle worm family appear to be based on code similar to the Bagle.af variation. Bagle.ag (w32.bagle.ag@mm, also known as Beagle.ac and Bagle.ah) and Bagle.ai (w32.bagle.ai@mm, also known as Bagle.ae, Beagle.ag, and Bagle.ah) are mass-mailing worms that vary in length and are packed with the UPX file compressor. They use various subject lines and attached files to spread via e-mail. They also attempt to spread via shared network files. They both try to terminate security apps that may be running on the infected machine and install a backdoor Trojan horse. Additionally, Bagle.ai will attempt to terminate any Netsky virus that may be running on the infected machine. This worm does not affect Linux, Unix, or Mac OS systems. Because Bagle.ag and Bagle.ai spread via e-mail and open a backdoor Trojan, they rate a 6 on the CNET/ZDNet Virus Meter. "
How it works
Both versions of Bagle use a different set of subject and body texts, contain their own SMTP engine to send copies of themselves. They also harvest e-mail addresses from infected machines, spoof the e-mail sender's address, and password-protect the attached file. These worms contain a remote access Trojan horse, copy themselves to folders that use the string "shar" in the name, and will attempt to terminate security programs and other computer viruses and worms.
Additionally, Bagle.ai will use mutex names already used by the Netsky in order to prevent further Netsky infections. Bagle.ai will also delete the registry entries for security apps and other viruses such as Netsky.
Bagle.ag creates the following in the Win/System32 folder
sys_xp.exe
sys_xp.exeopen
sys_xp.exeopenopen
Bagle.ai creates the following in the Win/System32 folder:
WinXP.exe
WinXP.exeopen
WinXP.exeopenopen
WinXP.exeopenopenopen
WinXP.exeopenopenopenopen
Bagle.ag opens TCP port 1080 while Bagle.ai opens ports 1080 (TCP) and 1040 (UDP).…
http://reviews-zdnet.com.com/4520-6600_16-5144521.html
Wednesday, July 21, 2004
eMachine Shop, a bridge between the real world and computers.
No Second Acts?:
"At eMachineShop, you can download a powerful yet straightforward CAD program to design objects. You then specify the material and submit your design to the site, and eMachineShop will price it according to the materials and machining or forming difficulty, along with the number of steps involved in manufacturing and finishing. The available materials range from every imaginable kind of plastic to metals such as aluminum, brass, and steel. You can specify bending, drilling, milling, turning, and various other operations. You can also specify finishes, including plating and powder coating.
The eMachineShop software prices your job on the spot, while the 3D rendering is on your screen. You find out what your part or run of parts will cost you in minutes, not days. When you give the okay, eMachineShop makes your parts and ships them to you. It's a full-capability fabrication facility that you pay for on an as-needed basis. Customers have created both simple and complex parts; you can see some photos on the site."
Lewis wasn't content to stop at mechanical fabrication. His goal is to be a one-stop product development facility. "As Amazon is to books I want to be to manufacturing," he says. Since more and more devices contain electronics, it made sense to offer circuit board fabrication too. You can go to sites like www.pcbexpress.com and order up a run of single-layer or multilayer circuit boards, but you have to be sufficiently knowledgeable to generate files that will control their drilling and routing equipment.
So Lewis created the Web site Pad2Pad, where you can design your board with simple downloadable software, place parts, run traces, spot holes, and connect layers. Like eMachineShop, Pad2Pad prices your work in advance and actually assembles the boards from a large inventory of parts instead of delivering solder-ready boards.
Of course, Pad2Pad can't stock all of the millions of electronic components, especially the more esoteric integrated circuits, but it can leave holes or surface-mount pads on the board for you to stuff or solder to. Pad2Pad is still in launch mode, and Lewis is expanding the parts inventory. He plans to connect with a major parts distributor, thus gaining access to just about anything you can put on a circuit board.…
http://www.pcmag.com/article2/0,1759,1619713,00.asp
"At eMachineShop, you can download a powerful yet straightforward CAD program to design objects. You then specify the material and submit your design to the site, and eMachineShop will price it according to the materials and machining or forming difficulty, along with the number of steps involved in manufacturing and finishing. The available materials range from every imaginable kind of plastic to metals such as aluminum, brass, and steel. You can specify bending, drilling, milling, turning, and various other operations. You can also specify finishes, including plating and powder coating.
The eMachineShop software prices your job on the spot, while the 3D rendering is on your screen. You find out what your part or run of parts will cost you in minutes, not days. When you give the okay, eMachineShop makes your parts and ships them to you. It's a full-capability fabrication facility that you pay for on an as-needed basis. Customers have created both simple and complex parts; you can see some photos on the site."
Lewis wasn't content to stop at mechanical fabrication. His goal is to be a one-stop product development facility. "As Amazon is to books I want to be to manufacturing," he says. Since more and more devices contain electronics, it made sense to offer circuit board fabrication too. You can go to sites like www.pcbexpress.com and order up a run of single-layer or multilayer circuit boards, but you have to be sufficiently knowledgeable to generate files that will control their drilling and routing equipment.
So Lewis created the Web site Pad2Pad, where you can design your board with simple downloadable software, place parts, run traces, spot holes, and connect layers. Like eMachineShop, Pad2Pad prices your work in advance and actually assembles the boards from a large inventory of parts instead of delivering solder-ready boards.
Of course, Pad2Pad can't stock all of the millions of electronic components, especially the more esoteric integrated circuits, but it can leave holes or surface-mount pads on the board for you to stuff or solder to. Pad2Pad is still in launch mode, and Lewis is expanding the parts inventory. He plans to connect with a major parts distributor, thus gaining access to just about anything you can put on a circuit board.…
http://www.pcmag.com/article2/0,1759,1619713,00.asp
Keep Your Kids Safe
Keep Your Kids Safe:
"In September 2003, 53-year-old John Zuccarini was arrested at a Florida hotel and, after admitting to his crimes in a plea bargain, became the first person convicted under the national Truth in Domain Names Act. The crime: According to the United States Attorney's office for the Southern District of New York, Zuccarini registered and used more than 3,000 misleading domain names, many of which directed children to hard-core porn sites and graphic depictions of young people engaged in sex acts. The domains included www .teltubbies.com and www.bobthebiulder.com—both misspellings of the addresses for popular children's TV shows.
Porn is just one of many issues parents should be concerned about when their kids go online. Problems could be as dangerous as encountering a predator in a chat room, as common as sharing music and software illegally via peer-to-peer file-sharing services, or as simple as spending far too much time playing games and chatting with friends.
Recent market research suggests that many parents consider online chatting more dangerous than Web surfing. Last year, Microsoft's MSN service shut down its chat rooms in 28 countries partly because of concerns about sexual predators preying on minors. And in a study published by Harris Interactive in November 2003, 24 percent of 550 U.S. teens surveyed said they had been contacted online by a stranger who tried to arrange an off-line meeting.
Meanwhile, the amount of time kids spend online is just as important an issue. A November study performed by the Pew Internet & American Life Project found that almost 70 percent of young users say they would find it "very hard to give up" the Internet, compared with only 48 percent who said the same about television. Computers have become a hub for social activity. And for the most part, it is an unsupervised environment. Many parents go to sleep every night convinced that their kids are sleeping too, while some of the kids are actually chatting online with friends and strangers. And not surprisingly, some kids are also chatting when they should be doing homework.
The Internet has so much good to offer, however, that you can't just take your kids' access away permanently. It's a great educational resource and an essential form of communication today. And the more your kids learn about using the Internet now, the better prepared they'll be for using it in the future.
Parents need to protect their kids online. Just as they want some control over where their kids go and whom they talk to in real life, parents need to establish some rules on where they go and whom they talk to online. Which strategy is best for your needs is your decision. The good news is that the products on the market offer a variety of approaches, so finding the right solution shouldn't be too difficult.…"
http://www.pcmag.com/article2/0,1759,1620643,00.asp
"In September 2003, 53-year-old John Zuccarini was arrested at a Florida hotel and, after admitting to his crimes in a plea bargain, became the first person convicted under the national Truth in Domain Names Act. The crime: According to the United States Attorney's office for the Southern District of New York, Zuccarini registered and used more than 3,000 misleading domain names, many of which directed children to hard-core porn sites and graphic depictions of young people engaged in sex acts. The domains included www .teltubbies.com and www.bobthebiulder.com—both misspellings of the addresses for popular children's TV shows.
Porn is just one of many issues parents should be concerned about when their kids go online. Problems could be as dangerous as encountering a predator in a chat room, as common as sharing music and software illegally via peer-to-peer file-sharing services, or as simple as spending far too much time playing games and chatting with friends.
Recent market research suggests that many parents consider online chatting more dangerous than Web surfing. Last year, Microsoft's MSN service shut down its chat rooms in 28 countries partly because of concerns about sexual predators preying on minors. And in a study published by Harris Interactive in November 2003, 24 percent of 550 U.S. teens surveyed said they had been contacted online by a stranger who tried to arrange an off-line meeting.
Meanwhile, the amount of time kids spend online is just as important an issue. A November study performed by the Pew Internet & American Life Project found that almost 70 percent of young users say they would find it "very hard to give up" the Internet, compared with only 48 percent who said the same about television. Computers have become a hub for social activity. And for the most part, it is an unsupervised environment. Many parents go to sleep every night convinced that their kids are sleeping too, while some of the kids are actually chatting online with friends and strangers. And not surprisingly, some kids are also chatting when they should be doing homework.
The Internet has so much good to offer, however, that you can't just take your kids' access away permanently. It's a great educational resource and an essential form of communication today. And the more your kids learn about using the Internet now, the better prepared they'll be for using it in the future.
Parents need to protect their kids online. Just as they want some control over where their kids go and whom they talk to in real life, parents need to establish some rules on where they go and whom they talk to online. Which strategy is best for your needs is your decision. The good news is that the products on the market offer a variety of approaches, so finding the right solution shouldn't be too difficult.…"
http://www.pcmag.com/article2/0,1759,1620643,00.asp
Tuesday, July 20, 2004
Picasa: Automated Digital Photo Organizer software: Download
Picasa: Automated Digital Photo Organizer software, instant photo albums, sharing & printing: Download:
"Picasa is now part of Google. Download version 1.6 for Free!
Picasa works with the digital photo files on your PC to create a better, more organized viewing and editing experience. Picasa will not delete or move the location of pictures saved on your PC. "
http://www.picasa.com/google/
"Picasa is now part of Google. Download version 1.6 for Free!
Picasa works with the digital photo files on your PC to create a better, more organized viewing and editing experience. Picasa will not delete or move the location of pictures saved on your PC. "
http://www.picasa.com/google/
Zend Updates PHP Scripting Language
Zend Updates PHP Scripting Language:
"Zend 5 includes a new version of the Zend engine, known as Zend Engine II. It also features object orientation, enhanced XML processing and Web services support.
Gutmans said the previous release, PHP 4, came out four years ago and the installed base of users has grown from 1.5 million then to 16 million now.
'The Zend II engine is a complete rewrite of all the object-oriented capabilities in the language,' Gutmans said. The new version features exception handling."
"The reason why object-oriented development gets such a big focus is that the more critical the application becomes the more structured the development becomes," Gutmans said. And as PHP becomes more a part of the enterprise, interoperability becomes important, he said.
The XML extensions in PHP 5 were rewritten to use the GNOME Project's XML and Extensible Stylesheet Language Transformations libraries. The new version includes a new module, MySQLi, for database support, as well as SQLite, an embedded database.…
http://www.eweek.com/article2/0,1759,1624753,00.asp
"Zend 5 includes a new version of the Zend engine, known as Zend Engine II. It also features object orientation, enhanced XML processing and Web services support.
Gutmans said the previous release, PHP 4, came out four years ago and the installed base of users has grown from 1.5 million then to 16 million now.
'The Zend II engine is a complete rewrite of all the object-oriented capabilities in the language,' Gutmans said. The new version features exception handling."
"The reason why object-oriented development gets such a big focus is that the more critical the application becomes the more structured the development becomes," Gutmans said. And as PHP becomes more a part of the enterprise, interoperability becomes important, he said.
The XML extensions in PHP 5 were rewritten to use the GNOME Project's XML and Extensible Stylesheet Language Transformations libraries. The new version includes a new module, MySQLi, for database support, as well as SQLite, an embedded database.…
http://www.eweek.com/article2/0,1759,1624753,00.asp
Monday, July 19, 2004
ZDNet AnchorDesk: Is another MSBlast attack on its way?
ZDNet AnchorDesk: Is another MSBlast attack on its way?:
"The Eschelbeck Theory, named after Gerhard Eschelbeck, a security researcher at Qualys.
The theory states that only half of the vulnerable systems in the world are patched within the first 30 days of a patch's existence, and that within that same 30-day period, someone invariably releases a virus or a worm to take advantage of the still-vulnerable systems. Given that, the clock is already ticking on these new Microsoft vulnerabilities. Of course, several of the newly announced flaws also involve Internet Explorer in some way.… "
http://reviews-zdnet.com.com/AnchorDesk/4520-7297_16-5144057.html?tag=ns
"The Eschelbeck Theory, named after Gerhard Eschelbeck, a security researcher at Qualys.
The theory states that only half of the vulnerable systems in the world are patched within the first 30 days of a patch's existence, and that within that same 30-day period, someone invariably releases a virus or a worm to take advantage of the still-vulnerable systems. Given that, the clock is already ticking on these new Microsoft vulnerabilities. Of course, several of the newly announced flaws also involve Internet Explorer in some way.… "
http://reviews-zdnet.com.com/AnchorDesk/4520-7297_16-5144057.html?tag=ns
Saturday, July 17, 2004
Crypto-Gram: July 15, 2004
Crypto-Gram: July 15, 2004:
"
http://www.schneier.com/crypto-gram-0407.html
"
- Due Process and Security
- Security Notes from All Over: X-Ray Machines and Building Security
- Cryptographers and U.S. Immigration
- Crypto-Gram Reprints
- Security and Portable Storage Devices
- News
- Counterpane News
- Security Notes from All Over: Coca-Cola and the NSA
- The Doghouse: ICS
- The CLEAR Act Does Not Help Fight Terror
http://www.schneier.com/crypto-gram-0407.html
Latest Bagle succeeds by sheer numbers, contacts one of 141 Web sites - News - ZDNet
Latest Bagle succeeds by sheer numbers - News - ZDNet:
"Bagle.AF arrives in e-mail as an attached file and infects computers running the Windows operating system if the user opens the file. The program attempts to halt more than 250 security applications from running on the computer, mails itself to any e-mail address it can find on the computer, and contacts one of 141 German Web sites, twice the number that a previous version of the virus contacted. The diverse Web sites have likely been compromised by online vandals, leaving behind software to record which computers have been infected by the Bagle worm.
With that information, the vandals can use the compromised computers to spread spam, or sell the information to spammers, Friedrichs said. The virus leaves open a backdoor specifically for that purpose."
http://zdnet.com.com/2100-1105_2-5271930.html
"Bagle.AF arrives in e-mail as an attached file and infects computers running the Windows operating system if the user opens the file. The program attempts to halt more than 250 security applications from running on the computer, mails itself to any e-mail address it can find on the computer, and contacts one of 141 German Web sites, twice the number that a previous version of the virus contacted. The diverse Web sites have likely been compromised by online vandals, leaving behind software to record which computers have been infected by the Bagle worm.
With that information, the vandals can use the compromised computers to spread spam, or sell the information to spammers, Friedrichs said. The virus leaves open a backdoor specifically for that purpose."
http://zdnet.com.com/2100-1105_2-5271930.html
Spam grows as spammers mature - News - ZDNet
Spam grows as spammers mature - News - ZDNet:
"It's been 12 months since spam really burst into the public consciousness. Before then it had certainly been a well-publicized problem, but often only with the more tech-savvy while the wider public had far more questions than answers about strange mail appearing in their inbox.
Then last summer the level of spam passed the important watershed of the 50 percent mark--meaning more e-mail traffic was unsolicited than not. For every 100 e-mails the average user was receiving more than 50 that were offering everything from pornographic content to college diplomas.
Since shattering that 50 percent mark the level of global spam e-mail has continued to skyrocket. By most measures that figure is now somewhere around 75 percent. "
But perhaps the biggest change in the spam world has been in the types of e-mails users are seeing. According to the latest figures from Clearswift, the traditional mainstays of the inbox menace--namely pornography and more frivolous offers--are being replaced by financial services, scams and pharmaceuticals which despite the best advice of the 'don't buy from spammers' lobby still seem to have some traction in the marketplace.…
http://zdnet.com.com/2100-1105_2-5270764.html?tag=adnews
"It's been 12 months since spam really burst into the public consciousness. Before then it had certainly been a well-publicized problem, but often only with the more tech-savvy while the wider public had far more questions than answers about strange mail appearing in their inbox.
Then last summer the level of spam passed the important watershed of the 50 percent mark--meaning more e-mail traffic was unsolicited than not. For every 100 e-mails the average user was receiving more than 50 that were offering everything from pornographic content to college diplomas.
Since shattering that 50 percent mark the level of global spam e-mail has continued to skyrocket. By most measures that figure is now somewhere around 75 percent. "
But perhaps the biggest change in the spam world has been in the types of e-mails users are seeing. According to the latest figures from Clearswift, the traditional mainstays of the inbox menace--namely pornography and more frivolous offers--are being replaced by financial services, scams and pharmaceuticals which despite the best advice of the 'don't buy from spammers' lobby still seem to have some traction in the marketplace.…
http://zdnet.com.com/2100-1105_2-5270764.html?tag=adnews
Friday, July 16, 2004
Google Toolbar Can Browse By Name
Google Toolbar Can Browse By Name:
"The Google Toolbar's new Browse by Name feature, introduced on Wednesday, takes the concept of searching from the browser address bar and kicks it up a notch. Now, to search, you simply type the name or description of the site you're looking for. If there's a strong match, Google will go straight to that page. For example, 'new york times', 'ben and jerry', 'john kerry' and 'strong bad' all zoom directly to the appropriate page. "
When there's no single obvious match, you haven't lost anything—you still get a standard Google search results page. Browse by Name is especially useful when the URL you're searching for is not obvious. For example, Browse by Name on "Muir Woods" brings up the National Park Service's site, www.nps.gov/muwo.…
http://www.eweek.com/article2/0,1759,1623934,00.asp?kc=ewnws071504dtx1k0000599
"The Google Toolbar's new Browse by Name feature, introduced on Wednesday, takes the concept of searching from the browser address bar and kicks it up a notch. Now, to search, you simply type the name or description of the site you're looking for. If there's a strong match, Google will go straight to that page. For example, 'new york times', 'ben and jerry', 'john kerry' and 'strong bad' all zoom directly to the appropriate page. "
When there's no single obvious match, you haven't lost anything—you still get a standard Google search results page. Browse by Name is especially useful when the URL you're searching for is not obvious. For example, Browse by Name on "Muir Woods" brings up the National Park Service's site, www.nps.gov/muwo.…
http://www.eweek.com/article2/0,1759,1623934,00.asp?kc=ewnws071504dtx1k0000599
'Important' Windows flaw could turn critical - News - ZDNet
'Important' Windows flaw could turn critical - News - ZDNet:
"Security experts are bracing themselves for a spate of new worms and viruses designed to exploit of the seven new vulnerabilities announced by Microsoft on Tuesday as part of its monthly patch cycle.
Of the new vulnerabilities, Windows Shell (MS04-024)--has been picked out by security experts as a potential target for future worms and viruses.
Ben Nagy, senior security engineer at security researcher firm eEye, said he expects the Windows Shell bug to be the most serious threat--despite Microsoft rating the problem as 'important' rather than 'critical'."
According to Microsoft, if a user is vulnerable to MS04-024 and has administrator privileges, an attacker could "take complete control of the affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges."
However, the flaw is not rated as critical because it would require "significant user interaction" to work. This means that a user would need to open an e-mail attachment, or download a file from a malicious Web site.
Richard Starnes, president of security industry group ISSA UK, said that malware writers usually reverse-engineer Microsoft's patches in order to produce exploits. Based on his on experience of previous threats, he expects the first batch of new exploit codes to be available as early as next week. These would probably be used to create a worm delivered as an email attachment.…
http://www.microsoft.com/technet/security/bulletin/MS04-024.mspx
http://zdnet.com.com/2100-1105-5268989.html
"Security experts are bracing themselves for a spate of new worms and viruses designed to exploit of the seven new vulnerabilities announced by Microsoft on Tuesday as part of its monthly patch cycle.
Of the new vulnerabilities, Windows Shell (MS04-024)--has been picked out by security experts as a potential target for future worms and viruses.
Ben Nagy, senior security engineer at security researcher firm eEye, said he expects the Windows Shell bug to be the most serious threat--despite Microsoft rating the problem as 'important' rather than 'critical'."
According to Microsoft, if a user is vulnerable to MS04-024 and has administrator privileges, an attacker could "take complete control of the affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges."
However, the flaw is not rated as critical because it would require "significant user interaction" to work. This means that a user would need to open an e-mail attachment, or download a file from a malicious Web site.
Richard Starnes, president of security industry group ISSA UK, said that malware writers usually reverse-engineer Microsoft's patches in order to produce exploits. Based on his on experience of previous threats, he expects the first batch of new exploit codes to be available as early as next week. These would probably be used to create a worm delivered as an email attachment.…
http://www.microsoft.com/technet/security/bulletin/MS04-024.mspx
http://zdnet.com.com/2100-1105-5268989.html
Wednesday, July 14, 2004
MS Security Bulletin MS04-022: Vulnerability in Task Scheduler Could Allow Code Execution
Microsoft Security Bulletin MS04-022: Vulnerability in Task Scheduler Could Allow Code Execution (841873):
"This update resolves a newly-discovered, privately reported vulnerability. A remote code execution vulnerability exists in the Task Scheduler because of an unchecked buffer. The vulnerability is documented in the Vulnerability Details section of this bulletin.
If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges. However, user interaction is required to exploit this vulnerability. Users whose accounts are configured to have fewer privileges on the system would be at less risk than users who operate with administrative privileges.…"
http://www.microsoft.com/technet/security/bulletin/MS04-022.mspx
"This update resolves a newly-discovered, privately reported vulnerability. A remote code execution vulnerability exists in the Task Scheduler because of an unchecked buffer. The vulnerability is documented in the Vulnerability Details section of this bulletin.
If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges. However, user interaction is required to exploit this vulnerability. Users whose accounts are configured to have fewer privileges on the system would be at less risk than users who operate with administrative privileges.…"
http://www.microsoft.com/technet/security/bulletin/MS04-022.mspx
MS Security Bulletin MS04-023: Vulnerability in HTML Help Could Allow Code Execution
Microsoft Security Bulletin MS04-023: Vulnerability in HTML Help Could Allow Code Execution (840315):
"This update resolves two newly-discovered vulnerabilities. The HTML Help vulnerability was privately reported and the showHelp vulnerability is public. Each vulnerability is documented in this bulletin in its own Vulnerability Details section.
If a user is logged on with administrative privileges, an attacker who successfully exploited the most severe of these vulnerabilities could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges. Users whose accounts are configured to have fewer privileges on the system would be at less risk than users who operate with administrative privileges.…"
http://www.microsoft.com/technet/security/bulletin/MS04-023.mspx
"This update resolves two newly-discovered vulnerabilities. The HTML Help vulnerability was privately reported and the showHelp vulnerability is public. Each vulnerability is documented in this bulletin in its own Vulnerability Details section.
If a user is logged on with administrative privileges, an attacker who successfully exploited the most severe of these vulnerabilities could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges. Users whose accounts are configured to have fewer privileges on the system would be at less risk than users who operate with administrative privileges.…"
http://www.microsoft.com/technet/security/bulletin/MS04-023.mspx
Defensive Perimeter, The Top 10 Best Security Tools:
Defensive Perimeter:
"You may not don battle gear, but switch on an Internet-connected PC, and you've stepped into a war zone where countless insurgents relentlessly pound your system, looking for ways in. 'Keep Your PC Safe', part of the comprehensive new Security Special on our Security Watch page, provides the Special Forces training you need to prevail. As backup, in this roundup we've stockpiled reviews of the products recommended in that PC combat manual."
http://www.pcmag.com/article2/0,1759,1618645,00.asp
http://www.pcmag.com/category2/0,1738,12,00.asp
http://www.pcmag.com/article2/0,1759,1621759,00.asp
"You may not don battle gear, but switch on an Internet-connected PC, and you've stepped into a war zone where countless insurgents relentlessly pound your system, looking for ways in. 'Keep Your PC Safe', part of the comprehensive new Security Special on our Security Watch page, provides the Special Forces training you need to prevail. As backup, in this roundup we've stockpiled reviews of the products recommended in that PC combat manual."
http://www.pcmag.com/article2/0,1759,1618645,00.asp
http://www.pcmag.com/category2/0,1738,12,00.asp
http://www.pcmag.com/article2/0,1759,1621759,00.asp
Tuesday, July 13, 2004
Troubleshooting Windows XP, Tweaks and Fixes for Windows XP
Troubleshooting Windows XP, Tweaks and Fixes for Windows XP:
"To use the Regedits: Save the REG File to your hard disk. Double click it and answer yes to the import prompt. REG files can be viewed in Notepad by right clicking on the file and selecting Edit.…"
http://www.kellys-korner-xp.com/xp_tweaks.htm
"To use the Regedits: Save the REG File to your hard disk. Double click it and answer yes to the import prompt. REG files can be viewed in Notepad by right clicking on the file and selecting Edit.…"
http://www.kellys-korner-xp.com/xp_tweaks.htm
Anti-Phishing Working Group
Anti-Phishing Working Group:
"What is Phishing?
Phishing attacks use 'spoofed' e-mails and fraudulent websites designed to fool recipients into divulging personal financial data such as credit card numbers, account usernames and passwords, social security numbers, etc. By hijacking the trusted brands of well-known banks, online retailers and credit card companies, phishers are able to convince up to 5% of recipients to respond to them."
http://www.antiphishing.org/
"What is Phishing?
Phishing attacks use 'spoofed' e-mails and fraudulent websites designed to fool recipients into divulging personal financial data such as credit card numbers, account usernames and passwords, social security numbers, etc. By hijacking the trusted brands of well-known banks, online retailers and credit card companies, phishers are able to convince up to 5% of recipients to respond to them."
http://www.antiphishing.org/
Atak, The latest mass-mailing Worm sleeps to avoid detection - News - ZDNet
Worm sleeps to avoid detection - News - ZDNet:
"The latest mass-mailing worm, Atak, hides by going to sleep when it suspects that antivirus software is trying to detect it.
Atak was first discovered Monday. Although antivirus companies do not expect it to cause much damage, they say it will be a nuisance because it can generate a large amount of spam.…"
"Atak tries to tell when someone is stepping through the code to analyze whether it is a virus or not. Often, a virus will contain lots of code that is designed to make it more complicated for (antivirus) companies to write the detections,"Graham Cluley, senior technology consultant for antivirus company Sophos said.…
http://zdnet.com.com/2100-1105-5267258.html
"The latest mass-mailing worm, Atak, hides by going to sleep when it suspects that antivirus software is trying to detect it.
Atak was first discovered Monday. Although antivirus companies do not expect it to cause much damage, they say it will be a nuisance because it can generate a large amount of spam.…"
"Atak tries to tell when someone is stepping through the code to analyze whether it is a virus or not. Often, a virus will contain lots of code that is designed to make it more complicated for (antivirus) companies to write the detections,"Graham Cluley, senior technology consultant for antivirus company Sophos said.…
http://zdnet.com.com/2100-1105-5267258.html
Lovgate.ad prevention and cure - ZDNet: Reviews
Lovgate.ad prevention and cure - ZDNet: Reviews:
"Lovgate.ad is the latest variation of a known mass-mailing worm family that includes a backdoor Trojan horse and, this time, overwrites several key Windows files, including executables files ending with .exe. While Lovgate.ad (w32.Lovgate.ad@mm, also known by some antivirus software vendors as Lovgate.ab, Lovgate.ae, Lovgate.ah, Lovgate.ao) doesn't destroy personal data, it will destroy access to the applications that run the data. Restoration from a backup utility after removal of the worm is required. Mac, Linux, and Unix users are not affected. At this time, Lovgate.ad is spreading slowly via e-mail, network-shared files, and network connections still vulnerable to the flaw that allowed the MSBlast worm to spread last summer. Because Lovgate.ad contains a variety of ways in which to spread and could damage system files, this worm rates a 6 on the CNET/ZDNet Virus Meter.…"
http://reviews-zdnet.com.com/4520-6600_16-5143031.html
"Lovgate.ad is the latest variation of a known mass-mailing worm family that includes a backdoor Trojan horse and, this time, overwrites several key Windows files, including executables files ending with .exe. While Lovgate.ad (w32.Lovgate.ad@mm, also known by some antivirus software vendors as Lovgate.ab, Lovgate.ae, Lovgate.ah, Lovgate.ao) doesn't destroy personal data, it will destroy access to the applications that run the data. Restoration from a backup utility after removal of the worm is required. Mac, Linux, and Unix users are not affected. At this time, Lovgate.ad is spreading slowly via e-mail, network-shared files, and network connections still vulnerable to the flaw that allowed the MSBlast worm to spread last summer. Because Lovgate.ad contains a variety of ways in which to spread and could damage system files, this worm rates a 6 on the CNET/ZDNet Virus Meter.…"
http://reviews-zdnet.com.com/4520-6600_16-5143031.html
FCC chief blogs to tech industry - News - ZDNet
FCC chief blogs to tech industry - News - ZDNet:
"WASHINGTON--U.S. Federal Communications Commission Chairman Michael Powell has started his own Web log, or blog, to reach out to the high-tech community and bypass the scores of Washington lobbyists who typically skulk around his office.
Powell, who wants to avoid regulating new technologies like Web-based telephone service for fear of stifling innovation, said he started the blog to encourage the high-tech industry to get involved because its past practice of flying under the radar to avoid regulations would no longer work.
'Regulated interests have about an 80-year head start on the entrepreneurial tech community when it comes to informing regulators what they want and need, but if anyone can make up for that, Silicon Valley can,' he said in his first blog comments posted Thursday morning.…"
http://www.alwayson-network.com/comments.php?id=4860_0_3_0_C
http://zdnet.com.com/2100-1103_2-5264405.html
"WASHINGTON--U.S. Federal Communications Commission Chairman Michael Powell has started his own Web log, or blog, to reach out to the high-tech community and bypass the scores of Washington lobbyists who typically skulk around his office.
Powell, who wants to avoid regulating new technologies like Web-based telephone service for fear of stifling innovation, said he started the blog to encourage the high-tech industry to get involved because its past practice of flying under the radar to avoid regulations would no longer work.
'Regulated interests have about an 80-year head start on the entrepreneurial tech community when it comes to informing regulators what they want and need, but if anyone can make up for that, Silicon Valley can,' he said in his first blog comments posted Thursday morning.…"
http://www.alwayson-network.com/comments.php?id=4860_0_3_0_C
http://zdnet.com.com/2100-1103_2-5264405.html
Saturday, July 10, 2004
Mozilla Flaw Lets Links Run Arbitrary Programs
Mozilla Flaw Lets Links Run Arbitrary Programs:
"The Mozilla Foundation has confirmed findings that its Mozilla and Firefox browsers are vulnerable to attacks using the 'shell:' scheme, which execute arbitrary code under Windows without the user having to click a link."
Security researchers are reporting another security issue in Web browsing under Windows, but this time Internet Explorer is not the culprit. The Mozilla Foundation's Mozilla and Firefox are reported as vulnerable.
The Mozilla Foundation has confirmed the problem and issued a fix, which is available here.
http://update.mozilla.org/extensions/moreinfo.php?id=154
http://www.eweek.com/article2/0,1759,1621451,00.asp?kc=ewnws070904dtx1k0300599
"The Mozilla Foundation has confirmed findings that its Mozilla and Firefox browsers are vulnerable to attacks using the 'shell:' scheme, which execute arbitrary code under Windows without the user having to click a link."
Security researchers are reporting another security issue in Web browsing under Windows, but this time Internet Explorer is not the culprit. The Mozilla Foundation's Mozilla and Firefox are reported as vulnerable.
The Mozilla Foundation has confirmed the problem and issued a fix, which is available here.
http://update.mozilla.org/extensions/moreinfo.php?id=154
http://www.eweek.com/article2/0,1759,1621451,00.asp?kc=ewnws070904dtx1k0300599
Article compilation: You've been hacked - TechRepublic
Article compilation: You've been hacked - TechRepublic:
"You'll want to download this collection of articles and keep them handy. They detail what to do in the first five minutes and first few hours of an attack on your network and provide help for preventing future attacks."
requires free registration
http://techrepublic.com.com/5138-6288-729430.html?tag=e601
"You'll want to download this collection of articles and keep them handy. They detail what to do in the first five minutes and first few hours of an attack on your network and provide help for preventing future attacks."
requires free registration
http://techrepublic.com.com/5138-6288-729430.html?tag=e601
IE Exploit Attacks Another Piece of ActiveX
IE Exploit Attacks Another Piece of ActiveX:
"Using Internet Explorer hasn't gotten any safer in the past few days as a Dutch security hacker, Jelmer Kuperus, pointed out yet another unblocked security problem in the popular Web browser.
The latest exploit, an attack on a Windows ActiveX component called Shell.Application, is similar to the Download.Ject attack, also called JS.Scob.Trojan. In that exploit, crackers broke into IIS servers on several popular but still unnamed sites and used them to spread keyboard loggers, proxy servers and other malware through IE's ActiveX scripting technology."
Indeed, attackers used the spyware technique of installing a pop-up ad program, except this one silently installed a Trojan and a BHO (Browser Help Object) designed to swipe login information from several dozen financial sites.
The sites that spread the malware have since been fixed, but there has been no master shipping solution for the underlying IE vulnerabilities. Disabling Active scripting and ActiveX controls in the Internet Zone and Local Machine Zone will prevent exploitation of these holes, but at the cost of seriously affecting IE's functionality.
Microsoft shipped a "patch" Friday that addressed part of this security problem by disabling the Windows component called ADODB.Stream.…
http://www.eweek.com/article2/0,1759,1620855,00.asp?kc=ewnws070804dtx1k0000599
"Using Internet Explorer hasn't gotten any safer in the past few days as a Dutch security hacker, Jelmer Kuperus, pointed out yet another unblocked security problem in the popular Web browser.
The latest exploit, an attack on a Windows ActiveX component called Shell.Application, is similar to the Download.Ject attack, also called JS.Scob.Trojan. In that exploit, crackers broke into IIS servers on several popular but still unnamed sites and used them to spread keyboard loggers, proxy servers and other malware through IE's ActiveX scripting technology."
Indeed, attackers used the spyware technique of installing a pop-up ad program, except this one silently installed a Trojan and a BHO (Browser Help Object) designed to swipe login information from several dozen financial sites.
The sites that spread the malware have since been fixed, but there has been no master shipping solution for the underlying IE vulnerabilities. Disabling Active scripting and ActiveX controls in the Internet Zone and Local Machine Zone will prevent exploitation of these holes, but at the cost of seriously affecting IE's functionality.
Microsoft shipped a "patch" Friday that addressed part of this security problem by disabling the Windows component called ADODB.Stream.…
http://www.eweek.com/article2/0,1759,1620855,00.asp?kc=ewnws070804dtx1k0000599
Wednesday, July 07, 2004
The Builder.com guide to SpamAssassin
The Builder.com guide to SpamAssassin:
"Spam is one of the most serious problems plaguing Internet users today. There's nothing quite as frustrating as arriving at work each morning to a mailbox full of unwanted ads. Sorry, there is one thing more frustrating...wasting the next hour deleting those ads for drugs and refinancing and other junk you don't want or need.
Fortunately there is a cure for the spam blues. It's called SpamAssassin, and it's possibly the best tool out there to combat spam. In this guide we'll show you how it works, and then how to install and configure it for your server.…"
http://builder.com.com/5100-6372_14-5247932.html?tag=e601
"Spam is one of the most serious problems plaguing Internet users today. There's nothing quite as frustrating as arriving at work each morning to a mailbox full of unwanted ads. Sorry, there is one thing more frustrating...wasting the next hour deleting those ads for drugs and refinancing and other junk you don't want or need.
Fortunately there is a cure for the spam blues. It's called SpamAssassin, and it's possibly the best tool out there to combat spam. In this guide we'll show you how it works, and then how to install and configure it for your server.…"
http://builder.com.com/5100-6372_14-5247932.html?tag=e601
The New York Times > Technology > You've Got Mail (and Court Says Others Can Read It)
The New York Times > Technology > You've Got Mail (and Court Says Others Can Read It):
"When everything is working right, an e-mail message appears to zip instantaneously from the sender to the recipient's inbox. But in reality, most messages make several momentary stops as they are processed by various computers en route to their destination.
Those short stops may make no difference to the users, but they make an enormous difference to the privacy that e-mail is accorded under federal law.…"
http://www.nytimes.com/2004/07/06/technology/06net.html?pagewanted=all&position=
"When everything is working right, an e-mail message appears to zip instantaneously from the sender to the recipient's inbox. But in reality, most messages make several momentary stops as they are processed by various computers en route to their destination.
Those short stops may make no difference to the users, but they make an enormous difference to the privacy that e-mail is accorded under federal law.…"
http://www.nytimes.com/2004/07/06/technology/06net.html?pagewanted=all&position=
Another summer of misery for Windows users? | CNET News.com
Reheated Bagle comes with side of source code | CNET News.com:
"The author of mass-mailing worm Bagle began distributing its source code and two new variants on Sunday, which could trigger another summer of misery for Windows users. "
http://news.com.com/Reheated Bagle comes with side of source code/2100-7349_3-5258179.html?tag=adnews
"The author of mass-mailing worm Bagle began distributing its source code and two new variants on Sunday, which could trigger another summer of misery for Windows users. "
http://news.com.com/Reheated Bagle comes with side of source code/2100-7349_3-5258179.html?tag=adnews
Saturday, July 03, 2004
Microsoft posts work-around for IE flaw - News - ZDNet
Microsoft posts work-around for IE flaw - News - ZDNet:
"Microsoft released on Friday a work-around for an Internet Explorer vulnerability that has left Windows users open to attacks for almost nine months.
The flaw, in an ActiveX scripting component, gained notoriety last month when it became the mechanism used by a network of compromised Web sites to install a malicious program on victims' computers. Microsoft has decided to plug the hole by turning off the ability for the ActiveX component to write to the operating system. The software giant published the work-around on its Web site and directed customers to use its Windows update service to download the patch. "
Though Microsoft intends the change to become a standard configuration for Windows, the software giant is working on a more comprehensive solution, said Stephen Toulouse, security program manager for Microsoft's security response center.
The change fixes a problem that allowed several compromised Web sites to infect visitors' PCs with a Trojan horse program, known as Download.Ject or JS.Scob.Trojan. The program would record the keystrokes and send them to an overseas e-mail address. That Internet Explorer security issue and several others lead some security experts to suggest that users should consider alternative browsers.
Microsoft's configuration change blocks the ability of the ADODB.screen ActiveX component to write to the PC's hard drive. ActiveX, which adds interactivity to Web sites viewed with Internet Explorer, has long been thought to have security issues.
This particular vulnerability has been known about for more than 9 months…
http://www.microsoft.com/security/incident/download_ject.mspx
http://zdnet.com.com/2100-1105_2-5256297.html
"Microsoft released on Friday a work-around for an Internet Explorer vulnerability that has left Windows users open to attacks for almost nine months.
The flaw, in an ActiveX scripting component, gained notoriety last month when it became the mechanism used by a network of compromised Web sites to install a malicious program on victims' computers. Microsoft has decided to plug the hole by turning off the ability for the ActiveX component to write to the operating system. The software giant published the work-around on its Web site and directed customers to use its Windows update service to download the patch. "
Though Microsoft intends the change to become a standard configuration for Windows, the software giant is working on a more comprehensive solution, said Stephen Toulouse, security program manager for Microsoft's security response center.
The change fixes a problem that allowed several compromised Web sites to infect visitors' PCs with a Trojan horse program, known as Download.Ject or JS.Scob.Trojan. The program would record the keystrokes and send them to an overseas e-mail address. That Internet Explorer security issue and several others lead some security experts to suggest that users should consider alternative browsers.
Microsoft's configuration change blocks the ability of the ADODB.screen ActiveX component to write to the PC's hard drive. ActiveX, which adds interactivity to Web sites viewed with Internet Explorer, has long been thought to have security issues.
This particular vulnerability has been known about for more than 9 months…
http://www.microsoft.com/security/incident/download_ject.mspx
http://zdnet.com.com/2100-1105_2-5256297.html
Thursday, July 01, 2004
Web Searching Tips
Web Searching Tips:
"This section of Search Engine Watch provides tips on using search engines better, along with some fun facts such as what people search for on search engines. "
http://www.searchenginewatch.com/facts/index.php
"This section of Search Engine Watch provides tips on using search engines better, along with some fun facts such as what people search for on search engines. "
http://www.searchenginewatch.com/facts/index.php
Pop-up program reads keystrokes, steals passwords - News - ZDNet
Pop-up program reads keystrokes, steals passwords - News - ZDNet:
"A malicious program that installs itself through a pop-up can read keystrokes and steal passwords when victims visit any of nearly 50 targeted banking sites, security researchers warned on Tuesday.
The targeted sites include major financial institutions, such as Citibank, Barclays Bank and Deutsche Bank, researcher Marcus Sachs said Tuesday.
'If (the program) recognizes that you are on one of those sites, it does keystroke logging,' said Sachs, director of the Internet Storm Center, a site that monitors network threats. Even though all financial sites use encryption built into the browser to protect log-in data, the Trojan horse program can capture the information before it gets encrypted by the browser software. 'The browser does not encrypt data between your keyboard and computer. It's encrypting it (when it goes) out onto the Web.' "
Sachs said the Trojan horse was first discovered on the computer of "an employee at a major dot-com." The victim apparently picked up the program from a malicious pop-up ad that used a flaw in Internet Explorer's helper server to install itself on the user's PC. In this case, because of the computer's security settings, the installation failed. Microsoft said IE users should raise the security settings to high until the company issues a patch.
Two other IE flaws, which Microsoft has yet to fix, were used recently in two other hacking schemes, one last week that turned some Web sites into points of digital infection, and another, earlier in the month, that installed a toolbar on victims' computers that triggered pop-ups. This most recent Trojan horse differs from the attack software used in last week's Web site compromises but could be paired with that technique to spread spyware.
Researchers at the Internet Storm Center studied the Trojan horse file, called "img1big.gif," which was provided by the dot-com. Working through the weekend, the security experts reverse-engineered the program and discovered that it targeted a long list of banks and attempted to steal the account information of those institutions' customers.
The program points to a recent trend in computer viruses and remote-access Trojan horse, or RAT, programs: Attackers are increasingly after money.…
http://zdnet.com.com/2100-1105_2-5251981.html
"A malicious program that installs itself through a pop-up can read keystrokes and steal passwords when victims visit any of nearly 50 targeted banking sites, security researchers warned on Tuesday.
The targeted sites include major financial institutions, such as Citibank, Barclays Bank and Deutsche Bank, researcher Marcus Sachs said Tuesday.
'If (the program) recognizes that you are on one of those sites, it does keystroke logging,' said Sachs, director of the Internet Storm Center, a site that monitors network threats. Even though all financial sites use encryption built into the browser to protect log-in data, the Trojan horse program can capture the information before it gets encrypted by the browser software. 'The browser does not encrypt data between your keyboard and computer. It's encrypting it (when it goes) out onto the Web.' "
Sachs said the Trojan horse was first discovered on the computer of "an employee at a major dot-com." The victim apparently picked up the program from a malicious pop-up ad that used a flaw in Internet Explorer's helper server to install itself on the user's PC. In this case, because of the computer's security settings, the installation failed. Microsoft said IE users should raise the security settings to high until the company issues a patch.
Two other IE flaws, which Microsoft has yet to fix, were used recently in two other hacking schemes, one last week that turned some Web sites into points of digital infection, and another, earlier in the month, that installed a toolbar on victims' computers that triggered pop-ups. This most recent Trojan horse differs from the attack software used in last week's Web site compromises but could be paired with that technique to spread spyware.
Researchers at the Internet Storm Center studied the Trojan horse file, called "img1big.gif," which was provided by the dot-com. Working through the weekend, the security experts reverse-engineered the program and discovered that it targeted a long list of banks and attempted to steal the account information of those institutions' customers.
The program points to a recent trend in computer viruses and remote-access Trojan horse, or RAT, programs: Attackers are increasingly after money.…
http://zdnet.com.com/2100-1105_2-5251981.html
Java Technology Fundamentals Newsletter
Java Technology Fundamentals Newsletter:
"Java Developer Connection Java Technology Fundamentals Newsletter.
This monthly newsletter provides a way for you to learn the basics of the Java programming language, discover new resources, and keep up-to-date on the latest additions to Sun Developer Network's New to Java Programming Center.…"
http://java.sun.com/developer/onlineTraining/new2java/supplements/2004/june04.html
"Java Developer Connection Java Technology Fundamentals Newsletter.
This monthly newsletter provides a way for you to learn the basics of the Java programming language, discover new resources, and keep up-to-date on the latest additions to Sun Developer Network's New to Java Programming Center.…"
http://java.sun.com/developer/onlineTraining/new2java/supplements/2004/june04.html
The Java 2 Platform, Standard Edition version 1.5: new language features
J2SE 1.5 (Tiger):
"The Java 2 Platform, Standard Edition version 1.5 (J2SE 1.5) has introduced several enhancements as well as new language features that ease the development of Java applications. This major release is focused along certain key themes, such as quality, monitoring and manageability, performance and scalability, and ease of development. The codename for the J2SE 1.5 release is 'Tiger', and all the new features have been developed under the Java Community Process (JCP)."
http://java.sun.com/developer/technicalArticles/releases/j2se15langfeat/
"The Java 2 Platform, Standard Edition version 1.5 (J2SE 1.5) has introduced several enhancements as well as new language features that ease the development of Java applications. This major release is focused along certain key themes, such as quality, monitoring and manageability, performance and scalability, and ease of development. The codename for the J2SE 1.5 release is 'Tiger', and all the new features have been developed under the Java Community Process (JCP)."
http://java.sun.com/developer/technicalArticles/releases/j2se15langfeat/
Wednesday, June 30, 2004
Download details: Windows Application Compatibility Toolkit 3.0
Download details: Windows Application Compatibility Toolkit 3.0:
"The Windows Application Compatibility Toolkit (ACT) version 3.0 for Windows 2000 Service Pack 3 or later, Windows XP and Windows Server 2003 contains the tools and documentation you need to design, deploy, and support applications on these platforms. Tools include the latest versions of the Microsoft Windows Application Compatibility Analyzer that simplifies application inventory and compatibility testing, the Windows Application Verifier that assists developers and testers in locating common compatibility issues during the development cycle, and the Compatibility Administrator that provides access to the necessary compatibility fixes to support legacy applications in Windows."
http://www.microsoft.com/downloads/details.aspx?FamilyID=7fc46855-b8a4-46cd-a236-3159970fde94&displaylang=en
"The Windows Application Compatibility Toolkit (ACT) version 3.0 for Windows 2000 Service Pack 3 or later, Windows XP and Windows Server 2003 contains the tools and documentation you need to design, deploy, and support applications on these platforms. Tools include the latest versions of the Microsoft Windows Application Compatibility Analyzer that simplifies application inventory and compatibility testing, the Windows Application Verifier that assists developers and testers in locating common compatibility issues during the development cycle, and the Compatibility Administrator that provides access to the necessary compatibility fixes to support legacy applications in Windows."
http://www.microsoft.com/downloads/details.aspx?FamilyID=7fc46855-b8a4-46cd-a236-3159970fde94&displaylang=en
Microsoft Christens Cut-Rate Windows as 'XP Starter Edition'
Microsoft Christens Cut-Rate Windows as 'XP Starter Edition':
"Last summer, in response to the success that Linux was having in the Thai marketplace, Microsoft began offering Thai citizens a Thai-localized bundle of Microsoft Windows XP Home and Office XP Standard. As part of the deal, Microsoft also stripped out some unspecified features from both products and slashed the price for the pair to 1,500 Thai Baht, or about $38 U.S. Microsoft Windows XP Home sells at retail for $225; Office XP Standard retails for $499.
This past spring, Microsoft officials said they would decide whether to continue offering the combination based on customer feedback.
It's not clear if Microsoft also will use the "Windows XP Starter Edition" name in other countries. In March, Microsoft began offering a similar cut-rate Windows XP and Microsoft Works bundle customized for the Malaysian market as part of the Malaysian government's PC Gemilang Project.…"
http://www.microsoft-watch.com/article2/0,1995,1616618,00.asp
"Last summer, in response to the success that Linux was having in the Thai marketplace, Microsoft began offering Thai citizens a Thai-localized bundle of Microsoft Windows XP Home and Office XP Standard. As part of the deal, Microsoft also stripped out some unspecified features from both products and slashed the price for the pair to 1,500 Thai Baht, or about $38 U.S. Microsoft Windows XP Home sells at retail for $225; Office XP Standard retails for $499.
This past spring, Microsoft officials said they would decide whether to continue offering the combination based on customer feedback.
It's not clear if Microsoft also will use the "Windows XP Starter Edition" name in other countries. In March, Microsoft began offering a similar cut-rate Windows XP and Microsoft Works bundle customized for the Malaysian market as part of the Malaysian government's PC Gemilang Project.…"
http://www.microsoft-watch.com/article2/0,1995,1616618,00.asp
Monday, June 28, 2004
Wi-Fi security standard sealed and delivered - News - ZDNet
Wi-Fi security standard sealed and delivered - News - ZDNet:
"The 802.11i standard should give wireless networking a boost in the eyes of businesses. Previous security measures, such as Wired Equivalent Privacy, were easily broken by hackers, leaving many security-conscious IT managers wary about wireless networking. The 802.11i standard encrypts data sent along wireless networks to protect it from anyone who may intercept it.
The most significant feature of the 802.11i standard is Advanced Encryption Standard (AES), a strong encryption standard supporting 128-bit, 192-bit and 256-bit keys, said Robin Ritch, Intel's director of security industry marketing.
Ritch added that Intel's Centrino bundle of chips will begin to incorporate the 802.11i standard following interoperability certification by the Wi-Fi Alliance, expected in September. All Centrino products will be 802.11i-compliant by the end of the year, and the upgrades will be in software. "
http://zdnet.com.com/2100-1103_2-5248275.html
"The 802.11i standard should give wireless networking a boost in the eyes of businesses. Previous security measures, such as Wired Equivalent Privacy, were easily broken by hackers, leaving many security-conscious IT managers wary about wireless networking. The 802.11i standard encrypts data sent along wireless networks to protect it from anyone who may intercept it.
The most significant feature of the 802.11i standard is Advanced Encryption Standard (AES), a strong encryption standard supporting 128-bit, 192-bit and 256-bit keys, said Robin Ritch, Intel's director of security industry marketing.
Ritch added that Intel's Centrino bundle of chips will begin to incorporate the 802.11i standard following interoperability certification by the Wi-Fi Alliance, expected in September. All Centrino products will be 802.11i-compliant by the end of the year, and the upgrades will be in software. "
http://zdnet.com.com/2100-1103_2-5248275.html
ZDNet AnchorDesk: Why AOL users are saying, "I've got spam!"
ZDNet AnchorDesk: Why AOL users are saying, "I've got spam!":
"The good news is that AOL apparently segregates its data across different servers. The data that Smathers allegedly stole did not include individual passwords or credit card numbers, for instance. According to the Wall Street Journal (registration required), Smathers may have obtained the lists by searching letter by letter across nearly 30 different servers.
However, as of this writing, AOL has not offered a site where AOL members can see if their e-mail address, telephone number, and zip code was sold, nor has the ISP offered any further assistance to those affected beyond a simple apology. That's unfortunate, since the stolen lists contain enough information for direct marketers to add customers to e-mail and telemarketing lists. Affected AOL members can expect to hear their phones ringing more and see their in-boxes a little fuller in the near future. "
In addition to rogue employees, companies are also under attack from virus-infected laptops connecting inside their networks and Trojan horses installed on individual workstations that give outsiders inside access. Using that yardstick, last summer's MSBlast worm also qualifies as an inside attack. By installing personal firewalls and antivirus software on each workstation and laptop (even home computers that connect to the corporate network via VPN), companies can eliminate these dangers. Still, even these measures won't stop a determined cracker who gains employment in a company as a janitor or a temp to snoop around for vulnerable points of access.…
http://reviews-zdnet.com.com/AnchorDesk/4520-7297_16-5141384.html?tag=adss
"The good news is that AOL apparently segregates its data across different servers. The data that Smathers allegedly stole did not include individual passwords or credit card numbers, for instance. According to the Wall Street Journal (registration required), Smathers may have obtained the lists by searching letter by letter across nearly 30 different servers.
However, as of this writing, AOL has not offered a site where AOL members can see if their e-mail address, telephone number, and zip code was sold, nor has the ISP offered any further assistance to those affected beyond a simple apology. That's unfortunate, since the stolen lists contain enough information for direct marketers to add customers to e-mail and telemarketing lists. Affected AOL members can expect to hear their phones ringing more and see their in-boxes a little fuller in the near future. "
In addition to rogue employees, companies are also under attack from virus-infected laptops connecting inside their networks and Trojan horses installed on individual workstations that give outsiders inside access. Using that yardstick, last summer's MSBlast worm also qualifies as an inside attack. By installing personal firewalls and antivirus software on each workstation and laptop (even home computers that connect to the corporate network via VPN), companies can eliminate these dangers. Still, even these measures won't stop a determined cracker who gains employment in a company as a janitor or a temp to snoop around for vulnerable points of access.…
http://reviews-zdnet.com.com/AnchorDesk/4520-7297_16-5141384.html?tag=adss
Saturday, June 26, 2004
Web site virus attack blunted - News - ZDNet
Web site virus attack blunted - News - ZDNet:
"Web surfers are no longer playing Russian roulette each time they visit a Web site, security researchers say, now that a far-reaching Internet attack has been disarmed.
The attack, which had turned some Web sites into points of digital infection, was nipped in the bud Friday, when Internet engineers managed to shut down a Russian server that had been the source of malicious code. Compromised Web sites are still attempting to infect Web surfers' PCs by referring them to the server in Russia, but that computer can no longer be reached."
Still, Web surfers should take precautions, as the Internet underground is increasingly using this type of attack as a way to get by network defenses and infect officer workers' and home users' computers.
http://zdnet.com.com/2100-1105_2-5248279.html
"Web surfers are no longer playing Russian roulette each time they visit a Web site, security researchers say, now that a far-reaching Internet attack has been disarmed.
The attack, which had turned some Web sites into points of digital infection, was nipped in the bud Friday, when Internet engineers managed to shut down a Russian server that had been the source of malicious code. Compromised Web sites are still attempting to infect Web surfers' PCs by referring them to the server in Russia, but that computer can no longer be reached."
Still, Web surfers should take precautions, as the Internet underground is increasingly using this type of attack as a way to get by network defenses and infect officer workers' and home users' computers.
http://zdnet.com.com/2100-1105_2-5248279.html
Infected Web site attack prevention
Infected Web site attack prevention:
"Criminal hackers (a.k.a. crackers) have launched a different kind of attack on the Internet this week. By simply visiting certain, infected popular Web sites, home and business Internet surfers using Internet Explorer on a PC may indirectly download a remote-access Trojan horse (RAT) onto their desktop computers, which in turn, may record keystrokes necessary to log into secure sites and relay that information to remote sources. This attack does not, however, slow or otherwise interfere with Internet traffic, and it affects only Internet Explorer browsers. Other browsers, including Opera and Mozilla, are not affected. Systems running Linux, Mac OS, Unix, and other operating systems are also unaffected. Microsoft is urging Web sites running on Windows 2000 servers with IIS Version 5.0 to update with the MS04-011 security patch. However, home and business Internet surfers using Internet Explorer are left with few options. Given the widespread but not yet epidemic nature of this attack, we're assigning this threat a Medium designation. "
How it works
There are two parts to this attack. Part one has already happened and affected Web site hosts. Earlier this week, crackers identified Windows 2000 servers with IIS Version 5.0 that have not applied the latest security patch from Microsoft, MS04-011. Some of these Web sites include popular search engines, shopping, and auction sites. The configurations of these servers were altered to include a small file that is in turn added to each file called upon by users.
The second part of the attack affects home and business users of the Internet and occurs whenever an Internet surfer stumbles upon a Web page served by an infected server. Unfortunately, you cannot immediately discern whether a page is infected, and some known pages include those hosted on major Web sites. The second part of the attack uses two vulnerabilities: one that can be patched with Microsoft security patch MS04-013, and another that can't be patched at this time. The flaws affected Internet Explorer only and allow malicious JavaScript from the infected Web server to execute on the desktop system. The JavaScript, in turn, downloads a remote-access Trojan horse from a remote site. This Trojan can record keystrokes used when logging into bank accounts and auction sites and using a credit card to make a purchase online.
For updates from Microsoft see http://www.microsoft.com/security/incident/download_ject.mspx
End users should install MS04-013, if they have not already done so, plus they should increase their security settings within Internet Explorer and update their antivirus settings to protect against known Trojan horses that may be installed because of this attack.
http://www.microsoft.com/technet/security/bulletin/MS04-013.mspx
http://techrepublic.com.com/5100-6265_11-5247988.html
"Criminal hackers (a.k.a. crackers) have launched a different kind of attack on the Internet this week. By simply visiting certain, infected popular Web sites, home and business Internet surfers using Internet Explorer on a PC may indirectly download a remote-access Trojan horse (RAT) onto their desktop computers, which in turn, may record keystrokes necessary to log into secure sites and relay that information to remote sources. This attack does not, however, slow or otherwise interfere with Internet traffic, and it affects only Internet Explorer browsers. Other browsers, including Opera and Mozilla, are not affected. Systems running Linux, Mac OS, Unix, and other operating systems are also unaffected. Microsoft is urging Web sites running on Windows 2000 servers with IIS Version 5.0 to update with the MS04-011 security patch. However, home and business Internet surfers using Internet Explorer are left with few options. Given the widespread but not yet epidemic nature of this attack, we're assigning this threat a Medium designation. "
How it works
There are two parts to this attack. Part one has already happened and affected Web site hosts. Earlier this week, crackers identified Windows 2000 servers with IIS Version 5.0 that have not applied the latest security patch from Microsoft, MS04-011. Some of these Web sites include popular search engines, shopping, and auction sites. The configurations of these servers were altered to include a small file that is in turn added to each file called upon by users.
The second part of the attack affects home and business users of the Internet and occurs whenever an Internet surfer stumbles upon a Web page served by an infected server. Unfortunately, you cannot immediately discern whether a page is infected, and some known pages include those hosted on major Web sites. The second part of the attack uses two vulnerabilities: one that can be patched with Microsoft security patch MS04-013, and another that can't be patched at this time. The flaws affected Internet Explorer only and allow malicious JavaScript from the infected Web server to execute on the desktop system. The JavaScript, in turn, downloads a remote-access Trojan horse from a remote site. This Trojan can record keystrokes used when logging into bank accounts and auction sites and using a credit card to make a purchase online.
For updates from Microsoft see http://www.microsoft.com/security/incident/download_ject.mspx
End users should install MS04-013, if they have not already done so, plus they should increase their security settings within Internet Explorer and update their antivirus settings to protect against known Trojan horses that may be installed because of this attack.
http://www.microsoft.com/technet/security/bulletin/MS04-013.mspx
http://techrepublic.com.com/5100-6265_11-5247988.html
MSN Hotmail Joins Storage Race
MSN Hotmail Joins Storage Race:
"Free MSN Hotmail users will be gaining 250 megabytes of storage, up from 2MB today, while premium users, for $19.95 a year, will be receiving 2 gigabytes of storage, MSN will announce."
http://zdnet.com.com/2100-1104_2-5245523.html?tag=adnews
Over the past few years, Yahoo and Hotmail have both taken steps to decrease memory in hopes of convincing free users to become paying subscribers.
http://www.eweek.com/article2/0,1759,1616649,00.asp
"Free MSN Hotmail users will be gaining 250 megabytes of storage, up from 2MB today, while premium users, for $19.95 a year, will be receiving 2 gigabytes of storage, MSN will announce."
http://zdnet.com.com/2100-1104_2-5245523.html?tag=adnews
Over the past few years, Yahoo and Hotmail have both taken steps to decrease memory in hopes of convincing free users to become paying subscribers.
http://www.eweek.com/article2/0,1759,1616649,00.asp
Researchers warn of infectious Web sites - News - ZDNet
Researchers warn of infectious Web sites - News - ZDNet:
"The researchers believe that online organized crime groups are breaking into Web servers and surreptitiously inserting code that takes advantage of two flaws in Internet Explorer that Microsoft has not yet fixed. Those flaws allow the Web server to install a program that takes control of the user's computer.
Late Thursday, Microsoft advised customers to increase their browser security to the highest settings, although that could cause some Web site functions to stop working.
The extent of the attacks is unknown, but the security community has seen numerous cases of personal computers infected when the user merely visits a Web site.
'It is not epidemic, but it is being seen,' said Alfred Huger, senior director of engineering for security company Symantec. 'Do we think it is serious? Yeah. It's a concern and it's insidious.…' "
http://zdnet.com.com/2100-1105_2-5247187.html
"The researchers believe that online organized crime groups are breaking into Web servers and surreptitiously inserting code that takes advantage of two flaws in Internet Explorer that Microsoft has not yet fixed. Those flaws allow the Web server to install a program that takes control of the user's computer.
Late Thursday, Microsoft advised customers to increase their browser security to the highest settings, although that could cause some Web site functions to stop working.
The extent of the attacks is unknown, but the security community has seen numerous cases of personal computers infected when the user merely visits a Web site.
'It is not epidemic, but it is being seen,' said Alfred Huger, senior director of engineering for security company Symantec. 'Do we think it is serious? Yeah. It's a concern and it's insidious.…' "
http://zdnet.com.com/2100-1105_2-5247187.html
Using Accesskeys is Easy
Using Accesskeys is Easy:
"Quite a few Web developers still get a glint of terror in their eyes when someone suggests they add accesskeys to their sites. Well, don't be scared. This article is very short for a very good reason. If you want to use them, accesskeys are so easy to add, you'll wonder why you never did before."
So, what are accesskeys? For the uninitiated, they are a means for people to jump immediately to a specific part of an HTML page by pressing ALT (PC) or CTRL (Mac), followed by the appropriate key on the keyboard, as defined by you via an accesskey parameter.
They're particularly useful for people with mobility issues who don't use a mouse and have a keyboard for their every movement on a computer. Accesskeys allow them quickly and easily to hop around the content of your Web pages. Able-bodied users can find them equally useful as shortcuts, too.…
http://www.sitepoint.com/print/accesskeys
"Quite a few Web developers still get a glint of terror in their eyes when someone suggests they add accesskeys to their sites. Well, don't be scared. This article is very short for a very good reason. If you want to use them, accesskeys are so easy to add, you'll wonder why you never did before."
So, what are accesskeys? For the uninitiated, they are a means for people to jump immediately to a specific part of an HTML page by pressing ALT (PC) or CTRL (Mac), followed by the appropriate key on the keyboard, as defined by you via an accesskey parameter.
They're particularly useful for people with mobility issues who don't use a mouse and have a keyboard for their every movement on a computer. Accesskeys allow them quickly and easily to hop around the content of your Web pages. Able-bodied users can find them equally useful as shortcuts, too.…
http://www.sitepoint.com/print/accesskeys
Exhibitor Shortage Puts Brakes on Comdex
Exhibitor Shortage Puts Brakes on Comdex:
"Last year's Comdex, the first run by MediaLive, attracted more than 40,000 qualified technology buyers and 550 exhibiting companies, according to MediaLive officials.
But the show's total attendance was just 51,000, compared to nearly 125,000 in 2002, according to the Las Vegas Convention and Visitors Authority. That lowered Comdex's nongaming economic impact on Vegas to just $69 million from $170 million the year before, according to the LVCA.
The LVCA projected numbers virtually identical to those of 2003 for this year's Comdex.… "
http://www.eweek.com/article2/0,1759,1616762,00.asp
"Last year's Comdex, the first run by MediaLive, attracted more than 40,000 qualified technology buyers and 550 exhibiting companies, according to MediaLive officials.
But the show's total attendance was just 51,000, compared to nearly 125,000 in 2002, according to the Las Vegas Convention and Visitors Authority. That lowered Comdex's nongaming economic impact on Vegas to just $69 million from $170 million the year before, according to the LVCA.
The LVCA projected numbers virtually identical to those of 2003 for this year's Comdex.… "
http://www.eweek.com/article2/0,1759,1616762,00.asp
Experts Study Developing Internet Attack, Infection Tries to Implant Software
Chicago Tribune | Experts Study Developing Internet Attack:
"Government and industry experts warned late Thursday of a mysterious, large-scale Internet attack against thousands of popular Web sites. The virus-like infection tries to implant hacker software onto the computers of all Web site visitors.
Industry experts and the Homeland Security Department were studying the infection to determine how it spreads across Web sites and find adequate defenses against it.
'Users should be aware that any Web site, even those that may be trusted by the user, may be affected by this activity and thus contain potentially malicious code,' the government warned in one Internet alert.… "
http://www.chicagotribune.com/technology/sns-ap-internet-attack,1,905229.story
"Government and industry experts warned late Thursday of a mysterious, large-scale Internet attack against thousands of popular Web sites. The virus-like infection tries to implant hacker software onto the computers of all Web site visitors.
Industry experts and the Homeland Security Department were studying the infection to determine how it spreads across Web sites and find adequate defenses against it.
'Users should be aware that any Web site, even those that may be trusted by the user, may be affected by this activity and thus contain potentially malicious code,' the government warned in one Internet alert.… "
http://www.chicagotribune.com/technology/sns-ap-internet-attack,1,905229.story
Wednesday, June 23, 2004
Online Journalism Review article: States' Shield Laws Might Not Cover Online Journalists
States' Shield Laws Might Not Cover Online Journalists:
"The Internet has lowered the barriers to entry for publishers. This complicates the question of who qualifies as a journalist when it comes to laws designed to protect the confidentiality of sources. How inclusive should shield laws be? A test case for this murky issue has yet to emerge. First in a two-part series."
http://ojr.org/ojr/law/1086825172.php
"The Internet has lowered the barriers to entry for publishers. This complicates the question of who qualifies as a journalist when it comes to laws designed to protect the confidentiality of sources. How inclusive should shield laws be? A test case for this murky issue has yet to emerge. First in a two-part series."
http://ojr.org/ojr/law/1086825172.php
Online Journalism Review article: The Best (and Worst) Video Feeds Online
The Best (and Worst) Video Feeds Online:
"Video quality has improved, but it's still a struggle to find feeds on many news sites."
http://ojr.org/ojr/technology/1087947933.php
"Video quality has improved, but it's still a struggle to find feeds on many news sites."
http://ojr.org/ojr/technology/1087947933.php
Web Page Analyzer - free test speed, optimization, performance analysis, load test tool
Web Page Analyzer - free website speed test website optimization performance analysis faster web page download time load test webpage speed tool:
"Test your web site speed and improve website performance with our free web-based analyzer. Enter a URL below to calculate page size, composition, and page download time. The script calculates the size of individual elements and finds the total for each type of web page component. Based on these page characteristics the script then offers advice on how to improve page display time and website speed. The script incorporates best practices from HCI research into its recommendations."
http://www.websiteoptimization.com/services/analyze/
"Test your web site speed and improve website performance with our free web-based analyzer. Enter a URL below to calculate page size, composition, and page download time. The script calculates the size of individual elements and finds the total for each type of web page component. Based on these page characteristics the script then offers advice on how to improve page display time and website speed. The script incorporates best practices from HCI research into its recommendations."
http://www.websiteoptimization.com/services/analyze/
The real reason you should care about web standards
Design by Fire: The real reason you should care about web standards:
"The real reason you should care about web standards.
A well-written entry for a new, original reason why Web sites should be designed to follow Web standards. More and more corporate sites are making the move to standards "
http://www.designbyfire.com/000099.html
"The real reason you should care about web standards.
A well-written entry for a new, original reason why Web sites should be designed to follow Web standards. More and more corporate sites are making the move to standards "
http://www.designbyfire.com/000099.html
Monday, June 21, 2004
Dynamic Text Replacement: A List Apart
Dynamic Text Replacement: A List Apart:
"Text styling is the dull headache of web design. There are only a handful of fonts that are universally available, and sophisticated graphical effects are next to impossible using only standard CSS and HTML. Sticking with the traditional typefaces is smart for body text, but when it comes to our headings — short, attention-grabbing blocks of text — it would be nice to have some choice in the matter. We’ve become accustomed to this problem and we cope with it either by making the most of the few fonts we have, or by entirely replacing our heading-text with images.
Most sites that replace text with images do so using hand-made images, which isn’t so terrible when there are a set number of headings, but it quickly becomes unmanageable on a site that is updated several times per day. However the replacement is performed, each image needs to be bound to the text it is replacing. That binding usually manifests itself as an <img> tag, an embedded style sheet, or a custom id attribute. And over time, through layout changes and redesigns, that binding needs to be managed by someone.
We can forget all that nonsense. No more <img> or <span> tags, no more id attributes or wasted time in Photoshop, and no more messy CSS hacks. Using JavaScript and PHP, we can generate accessible image-headings using any font we like. And we don’t have to change the structure of our HTML or CSS at all.…"
http://www.alistapart.com/articles/dynatext/
"Text styling is the dull headache of web design. There are only a handful of fonts that are universally available, and sophisticated graphical effects are next to impossible using only standard CSS and HTML. Sticking with the traditional typefaces is smart for body text, but when it comes to our headings — short, attention-grabbing blocks of text — it would be nice to have some choice in the matter. We’ve become accustomed to this problem and we cope with it either by making the most of the few fonts we have, or by entirely replacing our heading-text with images.
Most sites that replace text with images do so using hand-made images, which isn’t so terrible when there are a set number of headings, but it quickly becomes unmanageable on a site that is updated several times per day. However the replacement is performed, each image needs to be bound to the text it is replacing. That binding usually manifests itself as an <img> tag, an embedded style sheet, or a custom id attribute. And over time, through layout changes and redesigns, that binding needs to be managed by someone.
We can forget all that nonsense. No more <img> or <span> tags, no more id attributes or wasted time in Photoshop, and no more messy CSS hacks. Using JavaScript and PHP, we can generate accessible image-headings using any font we like. And we don’t have to change the structure of our HTML or CSS at all.…"
http://www.alistapart.com/articles/dynatext/
Friday, June 18, 2004
Crypto-Gram: June 15, 2004
Crypto-Gram: June 15, 2004:
"A Must Read! Newsletter
Breaking Iranian Codes
Biometric IDs for Airport Employees
Crypto-Gram Reprints
Microsoft and SP2
News
Cell Phone Jamming and Terrorist Attacks
Photographing Subways and Terrorist Attacks
Counterpane News
The Witty Worm
Comments from Readers "
http://www.schneier.com/crypto-gram-0406.html
"A Must Read! Newsletter
Breaking Iranian Codes
Biometric IDs for Airport Employees
Crypto-Gram Reprints
Microsoft and SP2
News
Cell Phone Jamming and Terrorist Attacks
Photographing Subways and Terrorist Attacks
Counterpane News
The Witty Worm
Comments from Readers "
http://www.schneier.com/crypto-gram-0406.html
Antipiracy bill targets tech. ReplayTV, peer-to-peer, even the VCR could be outlawed.
Antipiracy bill targets technology - News - ZDNet:
"A forthcoming bill in the U.S. Senate would, if passed, dramatically reshape copyright law by prohibiting file-trading networks and some consumer electronics devices on the grounds that they could be used for unlawful purposes.
The proposal, called the Induce Act, says 'whoever intentionally induces any violation' of copyright law would be legally liable for those violations, a prohibition that would effectively ban file-swapping networks like Kazaa and Morpheus. In the draft bill seen by CNET News.com, inducement is defined as 'aids, abets, induces, counsels, or procures' and can be punished with civil fines and, in some circumstances, lengthy prison terms.
The bill represents the latest legislative attempt by influential copyright holders to address what they view as the growing threat of peer-to-peer networks rife with pirated music, movies and software. As file-swapping networks grow in popularity, copyright lobbyists are becoming increasingly creative in their legal responses, which include proposals for Justice Department lawsuits against infringers and action at the state level. "
Originally, the Induce Act was scheduled to be introduced Thursday by Sen. Orrin Hatch, R-Utah, but the Senate Judiciary Committee confirmed at the end of the day that the bill had been delayed. A representative of Senate Majority Leader Bill Frist, a probable co-sponsor of the legislation, said the Induce Act would be introduced "sometime next week," a delay that one technology lobbyist attributed to opposition to the measure.
Though the Induce Act is not yet public, critics are already attacking it as an unjustified expansion of copyright law that seeks to regulate new technologies out of existence.
"They're trying to make it legally risky to introduce technologies that could be used for copyright infringement," said Jessica Litman, a professor at Wayne State University who specializes in copyright law. "That's why it's worded so broadly."
Litman said that under the Induce Act, products like ReplayTV, peer-to-peer networks and even the humble VCR could be outlawed because they can potentially be used to infringe copyrights. Web sites such as Tucows that host peer-to-peer clients like the Morpheus software are also at risk for "inducing" infringement, Litman warned.…
http://zdnet.com.com/2100-1104_2-5238140.html
"A forthcoming bill in the U.S. Senate would, if passed, dramatically reshape copyright law by prohibiting file-trading networks and some consumer electronics devices on the grounds that they could be used for unlawful purposes.
The proposal, called the Induce Act, says 'whoever intentionally induces any violation' of copyright law would be legally liable for those violations, a prohibition that would effectively ban file-swapping networks like Kazaa and Morpheus. In the draft bill seen by CNET News.com, inducement is defined as 'aids, abets, induces, counsels, or procures' and can be punished with civil fines and, in some circumstances, lengthy prison terms.
The bill represents the latest legislative attempt by influential copyright holders to address what they view as the growing threat of peer-to-peer networks rife with pirated music, movies and software. As file-swapping networks grow in popularity, copyright lobbyists are becoming increasingly creative in their legal responses, which include proposals for Justice Department lawsuits against infringers and action at the state level. "
Originally, the Induce Act was scheduled to be introduced Thursday by Sen. Orrin Hatch, R-Utah, but the Senate Judiciary Committee confirmed at the end of the day that the bill had been delayed. A representative of Senate Majority Leader Bill Frist, a probable co-sponsor of the legislation, said the Induce Act would be introduced "sometime next week," a delay that one technology lobbyist attributed to opposition to the measure.
Though the Induce Act is not yet public, critics are already attacking it as an unjustified expansion of copyright law that seeks to regulate new technologies out of existence.
"They're trying to make it legally risky to introduce technologies that could be used for copyright infringement," said Jessica Litman, a professor at Wayne State University who specializes in copyright law. "That's why it's worded so broadly."
Litman said that under the Induce Act, products like ReplayTV, peer-to-peer networks and even the humble VCR could be outlawed because they can potentially be used to infringe copyrights. Web sites such as Tucows that host peer-to-peer clients like the Morpheus software are also at risk for "inducing" infringement, Litman warned.…
http://zdnet.com.com/2100-1104_2-5238140.html
New worm terminates antivirus apps - News - ZDNet
New worm terminates antivirus apps - News - ZDNet:
"A new worm variant that can terminate antivirus applications was discovered last Friday, prompting Internet security vendor F-Secure to issue a level two warning.
The variant, called Zafi.B, is spread through e-mail attachments in PIF, EXE or Com attachments, and according to F-Secure, the worm 'terminates all applications that have 'firewall' or 'virus' in their file-name'.
The worm is capable of transmitting in several languages, including English, Italian, Spanish, Russian, Swedish, German or Finnish, said F-Secure, and spreads itself by collecting e-mail addresses from the recipient's address book.… "
http://zdnet.com.com/2100-1105_2-5236264.html
"A new worm variant that can terminate antivirus applications was discovered last Friday, prompting Internet security vendor F-Secure to issue a level two warning.
The variant, called Zafi.B, is spread through e-mail attachments in PIF, EXE or Com attachments, and according to F-Secure, the worm 'terminates all applications that have 'firewall' or 'virus' in their file-name'.
The worm is capable of transmitting in several languages, including English, Italian, Spanish, Russian, Swedish, German or Finnish, said F-Secure, and spreads itself by collecting e-mail addresses from the recipient's address book.… "
http://zdnet.com.com/2100-1105_2-5236264.html
Judge tosses online privacy case - News - ZDNet
Judge tosses online privacy case - News - ZDNet:
"In a decision dated June 6, U.S. District Court Judge Paul Magnuson ruled that seven consolidated class action lawsuits against Northwest had no merit--in part because the privacy policy posted on the airline's Web site was unenforceable unless plaintiffs claimed to have read it. The plaintiffs had contended that the airline, in giving passenger information to the government in the wake of the Sept. 11, 2001, terrorist attacks, violated laws and its own privacy policy.
'Although Northwest had a privacy policy for information included on the Web site, plaintiffs do not contend that they actually read the privacy policy prior to providing Northwest with their personal information,' Magnuson noted. 'Thus, plaintiffs' expectation of privacy was low.'"
Privacy advocates assailed that part of the decision, saying it rendered Web site privacy policies all but unenforceable.
"I don't think it's relevant whether or not they actually read the privacy policy first," said Lee Tien, senior staff attorney for the Electronic Frontier Foundation (EFF) in San Francisco. "Think of all the 'fine print' we run into every day--warranties and the like. Rather than focus on what the plaintiffs actually read, we should focus on what Northwest said it would do."
"The rationale the court uses calls into question the assurances of any policy posted on any Web site," said David Sobel, general counsel for the Electronic Privacy Information Center (EPIC) in Washington, D.C.…
http://zdnet.com.com/2100-1104_2-5234971.html
"In a decision dated June 6, U.S. District Court Judge Paul Magnuson ruled that seven consolidated class action lawsuits against Northwest had no merit--in part because the privacy policy posted on the airline's Web site was unenforceable unless plaintiffs claimed to have read it. The plaintiffs had contended that the airline, in giving passenger information to the government in the wake of the Sept. 11, 2001, terrorist attacks, violated laws and its own privacy policy.
'Although Northwest had a privacy policy for information included on the Web site, plaintiffs do not contend that they actually read the privacy policy prior to providing Northwest with their personal information,' Magnuson noted. 'Thus, plaintiffs' expectation of privacy was low.'"
Privacy advocates assailed that part of the decision, saying it rendered Web site privacy policies all but unenforceable.
"I don't think it's relevant whether or not they actually read the privacy policy first," said Lee Tien, senior staff attorney for the Electronic Frontier Foundation (EFF) in San Francisco. "Think of all the 'fine print' we run into every day--warranties and the like. Rather than focus on what the plaintiffs actually read, we should focus on what Northwest said it would do."
"The rationale the court uses calls into question the assurances of any policy posted on any Web site," said David Sobel, general counsel for the Electronic Privacy Information Center (EPIC) in Washington, D.C.…
http://zdnet.com.com/2100-1104_2-5234971.html
'Zombie' PCs caused Web outage, Akamai says - News - ZDNet
'Zombie' PCs caused Web outage, Akamai says - News - ZDNet:
"The attack that blacked out Google, Yahoo and other major Web sites earlier this week involved the use of a 'bot net'--a large network of zombified home PCs--Internet infrastructure provider Akamai Technologies said Wednesday.
The attack, which blocked nearly all access to Apple Computer, Google, Microsoft and Yahoo's Web sites for two hours on Tuesday, took aim at the key domain name system (DNS) servers run by Akamai. These servers translate word-based URLs, such as www.microsoft.com, into the numerical addresses used by the Internet. Using compromised home computers, the attackers sent a flood of data to the DNS servers, preventing them from providing that translation and effectively shutting surfers out of the four companies' pages, according to Akamai.
The deluge of data that hit the infrastructure provider was 'so large that it (couldn't have) come from a couple of servers,' said Tom Leighton, chief scientist and co-founder of Akamai. 'Working with our network partners, we were able to identify a bot network that appeared to be operating and managed to shut it down, which resulted in stopping the attack.' "
Bot networks are collections of computers that have been compromised by software specifically designed to create a network of systems for attack. A bot--also known as remote-access Trojan horse program, or RAT--seeks out and places itself on vulnerable PCs. It then runs silently in the background, letting an attacker send commands to the system while its owner works, oblivious. The computers are essentially turned into zombies, controllable from afar.…
http://zdnet.com.com/2100-1105_2-5236403.html
"The attack that blacked out Google, Yahoo and other major Web sites earlier this week involved the use of a 'bot net'--a large network of zombified home PCs--Internet infrastructure provider Akamai Technologies said Wednesday.
The attack, which blocked nearly all access to Apple Computer, Google, Microsoft and Yahoo's Web sites for two hours on Tuesday, took aim at the key domain name system (DNS) servers run by Akamai. These servers translate word-based URLs, such as www.microsoft.com, into the numerical addresses used by the Internet. Using compromised home computers, the attackers sent a flood of data to the DNS servers, preventing them from providing that translation and effectively shutting surfers out of the four companies' pages, according to Akamai.
The deluge of data that hit the infrastructure provider was 'so large that it (couldn't have) come from a couple of servers,' said Tom Leighton, chief scientist and co-founder of Akamai. 'Working with our network partners, we were able to identify a bot network that appeared to be operating and managed to shut it down, which resulted in stopping the attack.' "
Bot networks are collections of computers that have been compromised by software specifically designed to create a network of systems for attack. A bot--also known as remote-access Trojan horse program, or RAT--seeks out and places itself on vulnerable PCs. It then runs silently in the background, letting an attacker send commands to the system while its owner works, oblivious. The computers are essentially turned into zombies, controllable from afar.…
http://zdnet.com.com/2100-1105_2-5236403.html
Spying on spyware - News - ZDNet - one of every three computers scanned was infected.
Spying on spyware - News - ZDNet:
"EarthLink and Webroot Software released a report Wednesday, revealing that nearly one of every three computers scanned in April for Trojan horse programs or system monitor spyware was infected.
Internet access provider EarthLink and security software maker Webroot scanned nearly 421,000 computers for their April Spy Audit report. Trojan horses and system monitors accounted for 133,715 pieces of the spyware found on those computers--representing almost one in three machines.
System monitors track users' computer activity, capturing virtually everything they do online. Trojan horses appear to be software programs a user has requested but actually aid hackers in stealing computer data. That information is then used to gain unrestricted access to users' computers while they are online.…"
http://zdnet.com.com/2100-1104_2-5236735.html
"EarthLink and Webroot Software released a report Wednesday, revealing that nearly one of every three computers scanned in April for Trojan horse programs or system monitor spyware was infected.
Internet access provider EarthLink and security software maker Webroot scanned nearly 421,000 computers for their April Spy Audit report. Trojan horses and system monitors accounted for 133,715 pieces of the spyware found on those computers--representing almost one in three machines.
System monitors track users' computer activity, capturing virtually everything they do online. Trojan horses appear to be software programs a user has requested but actually aid hackers in stealing computer data. That information is then used to gain unrestricted access to users' computers while they are online.…"
http://zdnet.com.com/2100-1104_2-5236735.html
Thursday, June 17, 2004
Flaw pops up in the core component of Linux kernel
Flaw pops up in Linux kernel - News - ZDNet:
"Linux users have been urged to fix a flaw in the core component of the open-source operating system, following the public release of code that could be used to crash Linux systems.
The flaw, found by two software programmers, could give a user with access to a Linux system the ability to crash the system using two dozen lines of code written in the C programming language, said an advisory posted over the weekend on linuxreviews."
"Assume your kernel is (vulnerable) unless you have good reason to believe it is safe," Oyvind Saether, one of the discoverers of the flaw, said in the advisory.
The program, dubbed "evil.c," causes problems with the code sent to the floating-point unit, the part of the processor that handles noninteger calculations, according to a note in a source code patch published by Linux founder Linus Torvalds.
The open-source Linux operating system has fallen prey to its share of flaws and attacks this year. Several flaws were found in the Concurrent Versions System, CVS, a commonly used application for managing open-source code under development. In March and April, online attackers targeted Linux and Solaris systems at many academic high-performance computing centers.…
http://zdnet.com.com/2100-1105_2-5235028.html
"Linux users have been urged to fix a flaw in the core component of the open-source operating system, following the public release of code that could be used to crash Linux systems.
The flaw, found by two software programmers, could give a user with access to a Linux system the ability to crash the system using two dozen lines of code written in the C programming language, said an advisory posted over the weekend on linuxreviews."
"Assume your kernel is (vulnerable) unless you have good reason to believe it is safe," Oyvind Saether, one of the discoverers of the flaw, said in the advisory.
The program, dubbed "evil.c," causes problems with the code sent to the floating-point unit, the part of the processor that handles noninteger calculations, according to a note in a source code patch published by Linux founder Linus Torvalds.
The open-source Linux operating system has fallen prey to its share of flaws and attacks this year. Several flaws were found in the Concurrent Versions System, CVS, a commonly used application for managing open-source code under development. In March and April, online attackers targeted Linux and Solaris systems at many academic high-performance computing centers.…
http://zdnet.com.com/2100-1105_2-5235028.html
Wednesday, June 16, 2004
Yahoo Mail Popped Instead of Pumped.
Yahoo Chokes Upon Offering Additional User Storage:
"Yahoo Inc., which on Tuesday meant to pump up users' free e-mail accounts to 100MB, popped instead.
On the morning of its splashy debut, Yahoo users were greeted with notices of the upgrade, which boosted standard accounts from 4MB of e-mail storage to 100MB.
However, the vastly popular e-mail service was sluggish, if it worked at all. Starting Tuesday morning, users began complaining about the site's groggy response time—if, in fact, they could even get the www.yahoo.com site to load at all.
Predictably enough, postings on Slashdot show that Yahoo users are looking the gift horse in the mouth.…"
http://www.eweek.com/article2/0,1759,1612683,00.asp?kc=ewnws061504dtx1k0000599
"Yahoo Inc., which on Tuesday meant to pump up users' free e-mail accounts to 100MB, popped instead.
On the morning of its splashy debut, Yahoo users were greeted with notices of the upgrade, which boosted standard accounts from 4MB of e-mail storage to 100MB.
However, the vastly popular e-mail service was sluggish, if it worked at all. Starting Tuesday morning, users began complaining about the site's groggy response time—if, in fact, they could even get the www.yahoo.com site to load at all.
Predictably enough, postings on Slashdot show that Yahoo users are looking the gift horse in the mouth.…"
http://www.eweek.com/article2/0,1759,1612683,00.asp?kc=ewnws061504dtx1k0000599
Tuesday, June 15, 2004
Yahoo Expands E-Mail Storage
Yahoo Expands E-Mail Storage, in Nod to Google:
"Starting today, Yahoo will offer users of its free e-mail service 100 megabytes of storage. That is one-tenth of what Google offers but is still far more than the four megabytes Yahoo previously offered. It will also introduce a premium e-mail service, called Yahoo Mail Plus, with two gigabytes of storage for $19.99 a year.…"
http://www.nytimes.com/2004/06/15/technology/15mail.html
"Starting today, Yahoo will offer users of its free e-mail service 100 megabytes of storage. That is one-tenth of what Google offers but is still far more than the four megabytes Yahoo previously offered. It will also introduce a premium e-mail service, called Yahoo Mail Plus, with two gigabytes of storage for $19.99 a year.…"
http://www.nytimes.com/2004/06/15/technology/15mail.html
A bug in fully patched versions of Microsoft's Internet Explorer Invites Phishing Attacks
URL Parsing Bug in IE Invites Phishing Attacks:
"A bug in fully patched versions of Microsoft's Internet Explorer Web browser allows violations of the browser's security zones, with the result that an unknown malicious site could assume the privileges of more trusted zones.
Researchers on several security mailing lists have been discussing the bug since yesterday and appear still to be learning about it.… "
http://www.eweek.com/article2/0,1759,1611102,00.asp?kc=ewnws061404dtx1k0000599
"A bug in fully patched versions of Microsoft's Internet Explorer Web browser allows violations of the browser's security zones, with the result that an unknown malicious site could assume the privileges of more trusted zones.
Researchers on several security mailing lists have been discussing the bug since yesterday and appear still to be learning about it.… "
http://www.eweek.com/article2/0,1759,1611102,00.asp?kc=ewnws061404dtx1k0000599
ZDNet AnchorDesk: Is your antivirus app working? Are you sure?
Is your antivirus app working? Are you sure?:
"You have a desktop antivirus app installed now, and you know the signature file subscription is current with the vendor, but still you're seeing viruslike symptoms or perhaps you actually know that you have a virus. Since the first of this year, many new viruses have been shutting down antivirus and firewall apps, or, in other cases, disabling the software's automatic update feature, leaving your system vulnerable to future attack.
It's actually an old trick. The virus MTX, for example, released in 2000, blocks access to antivirus software Web sites. But these recent antivirus-disabling attacks are more effective because of their sheer volume: with some 30-odd variations of Bagle appearing within a 10-week period, each one better than the last, you might have been hit and not even realized it."
http://reviews-zdnet.com.com/AnchorDesk/4520-7297_16-5138927.html?tag=adss
"You have a desktop antivirus app installed now, and you know the signature file subscription is current with the vendor, but still you're seeing viruslike symptoms or perhaps you actually know that you have a virus. Since the first of this year, many new viruses have been shutting down antivirus and firewall apps, or, in other cases, disabling the software's automatic update feature, leaving your system vulnerable to future attack.
It's actually an old trick. The virus MTX, for example, released in 2000, blocks access to antivirus software Web sites. But these recent antivirus-disabling attacks are more effective because of their sheer volume: with some 30-odd variations of Bagle appearing within a 10-week period, each one better than the last, you might have been hit and not even realized it."
http://reviews-zdnet.com.com/AnchorDesk/4520-7297_16-5138927.html?tag=adss
Friday, June 11, 2004
How Much Is Spam Costing Your Company?
How Much Is Spam Costing Your Company?:
"Two research firms' recent reports say spam is costing your company mucho bucks. Security Center Editor Larry Seltzer sees whether the numbers add up."
By now, you've probably seen the stories about the outrageous cost of spam to businesses. Most of it came from research firm Nucleus Research.
eWEEK's story also cited research from MessageLabs, a respected mail security service.
The report from Nucleus, here in PDF form, made some electrifying claims, the big one being that spam is costing an average of $1,934 per employee a year of lost productivity. The cost in July 2003 was $874 per employee a year.
My goodness, that's a lot of money. "What will we do?" some might ask. But I ask, "Where did they get that number?"
Fortunately, the report answers the question. It assumes that an employee makes $30 per hour and works 2,080 hours per year, stating that employees in May got 29 spam messages per day. The increase from July 2003 comes from the average number of spam messages increasing from 13 to 29.
I don't know where they get those last two numbers on the increase in messages; maybe they're accurate, maybe not. Seems like more of a jump than I've seen, but it could be right.
They also assume 30 seconds per spam message. This is where I have a real problem. It seems like an awful lot of time to me. The average spam message that gets through my filtering takes me a second at most to delete.
I'm probably also on the phone while I do this, further complicating the productivity calculation. Let's assume it takes three seconds to dispose of a spam message, quite a long time if you ask me; that cuts the cost per employee from $1,934 to $193.40, nothing to sneeze at but a whole lot less.…
http://www.eweek.com/article2/0,1759,1609427,00.asp
"Two research firms' recent reports say spam is costing your company mucho bucks. Security Center Editor Larry Seltzer sees whether the numbers add up."
By now, you've probably seen the stories about the outrageous cost of spam to businesses. Most of it came from research firm Nucleus Research.
eWEEK's story also cited research from MessageLabs, a respected mail security service.
The report from Nucleus, here in PDF form, made some electrifying claims, the big one being that spam is costing an average of $1,934 per employee a year of lost productivity. The cost in July 2003 was $874 per employee a year.
My goodness, that's a lot of money. "What will we do?" some might ask. But I ask, "Where did they get that number?"
Fortunately, the report answers the question. It assumes that an employee makes $30 per hour and works 2,080 hours per year, stating that employees in May got 29 spam messages per day. The increase from July 2003 comes from the average number of spam messages increasing from 13 to 29.
I don't know where they get those last two numbers on the increase in messages; maybe they're accurate, maybe not. Seems like more of a jump than I've seen, but it could be right.
They also assume 30 seconds per spam message. This is where I have a real problem. It seems like an awful lot of time to me. The average spam message that gets through my filtering takes me a second at most to delete.
I'm probably also on the phone while I do this, further complicating the productivity calculation. Let's assume it takes three seconds to dispose of a spam message, quite a long time if you ask me; that cuts the cost per employee from $1,934 to $193.40, nothing to sneeze at but a whole lot less.…
http://www.eweek.com/article2/0,1759,1609427,00.asp
Thursday, June 10, 2004
Adware purveyor used security flaws to install a toolbar on Internet Explorer
Pop-up toolbar spreads via IE flaws - News - ZDNet:
"An adware purveyor has apparently used two previously unknown security flaws in Microsoft's Internet Explorer browser to install a toolbar on victims' computers that triggers pop-up ads, researchers said this week.
One flaw lets an attacker run a program on a victim's machine, while the other enables malicious code to 'cross zones,' or run with privileges higher than normal. Together, the two issues allow for the creation of a Web site that, when visited by victims, can upload and install programs to the victim's computer, according to two analyses of the security holes.… "
http://zdnet.com.com/2100-1105_2-5229707.html
"An adware purveyor has apparently used two previously unknown security flaws in Microsoft's Internet Explorer browser to install a toolbar on victims' computers that triggers pop-up ads, researchers said this week.
One flaw lets an attacker run a program on a victim's machine, while the other enables malicious code to 'cross zones,' or run with privileges higher than normal. Together, the two issues allow for the creation of a Web site that, when visited by victims, can upload and install programs to the victim's computer, according to two analyses of the security holes.… "
http://zdnet.com.com/2100-1105_2-5229707.html
833786 - Identify and to protect yourself from deceptive (spoofed) Web sites and malicious hyperlinks
833786 - Steps that you can take to help identify and to help protect yourself from deceptive (spoofed) Web sites and malicious hyperlinks:
"When you point to a hyperlink in Microsoft Internet Explorer, Microsoft Outlook Express, or Microsoft Outlook, the address of the Web site typically appears in the Status bar at the bottom of the window. After you click a link that opens in Internet Explorer, the address of the Web site typically appears in the Internet Explorer Address bar, and the title of the Web page typically appears in the Title bar of the window.
However, a malicious user could create a link to a deceptive (spoofed) Web site that displays the address, or URL, to a legitimate Web site in the Status bar, Address bar, and Title bar. This article describes steps that you can take to help mitigate this issue and to help you to identify a deceptive (spoofed) Web site or URL.… "
http://support.microsoft.com/default.aspx?scid=kb;[ln];833786
"When you point to a hyperlink in Microsoft Internet Explorer, Microsoft Outlook Express, or Microsoft Outlook, the address of the Web site typically appears in the Status bar at the bottom of the window. After you click a link that opens in Internet Explorer, the address of the Web site typically appears in the Internet Explorer Address bar, and the title of the Web page typically appears in the Title bar of the window.
However, a malicious user could create a link to a deceptive (spoofed) Web site that displays the address, or URL, to a legitimate Web site in the Status bar, Address bar, and Title bar. This article describes steps that you can take to help mitigate this issue and to help you to identify a deceptive (spoofed) Web site or URL.… "
http://support.microsoft.com/default.aspx?scid=kb;[ln];833786
Friday, June 04, 2004
Yahoo Anti-Spy Doesn't Default to Detect Adware
Yahoo Plays Favorites with Some Adware:
"When it comes to blocking intrusive Internet software, Yahoo Inc.'s new Anti-Spy gives adware the benefit of the doubt.
The beta version of the spyware-fighting toolbar add-on, which Yahoo released last week, doesn't default to detect adware—a category of software in which Yahoo's paid search division has a financial stake.
Instead, users who want to identify adware in their systems via Anti-Spy must check a box each time they conduct a scan.…"
http://www.eweek.com/article2/0,1759,1606054,00.asp
"When it comes to blocking intrusive Internet software, Yahoo Inc.'s new Anti-Spy gives adware the benefit of the doubt.
The beta version of the spyware-fighting toolbar add-on, which Yahoo released last week, doesn't default to detect adware—a category of software in which Yahoo's paid search division has a financial stake.
Instead, users who want to identify adware in their systems via Anti-Spy must check a box each time they conduct a scan.…"
http://www.eweek.com/article2/0,1759,1606054,00.asp
Thursday, June 03, 2004
New Windows Media DRM Announced!
Microsoft Windows Media - Digital Rights Management (DRM):
"Windows Media digital rights management (DRM) is a proven platform to protect and securely deliver content for playback on a computer, portable device, or network device. It's flexible to support a range of business models from single downloads or physical format delivery. The latest version of Windows Media DRM enables new scenarios and provides consumers even greater access to protected audio and video content."
http://www.microsoft.com/windows/windowsmedia/drm/default.aspx
"Windows Media digital rights management (DRM) is a proven platform to protect and securely deliver content for playback on a computer, portable device, or network device. It's flexible to support a range of business models from single downloads or physical format delivery. The latest version of Windows Media DRM enables new scenarios and provides consumers even greater access to protected audio and video content."
http://www.microsoft.com/windows/windowsmedia/drm/default.aspx
Wednesday, June 02, 2004
The Search Engine Report - Number 91 - May 27, 2004
A worm that uses seven mechanisms to spread itself.
Kibuv Worm, Bobax Trojan Try Many Methods:
"Security experts are tracking two new threats that have emerged in the past few days, including a worm that uses seven mechanisms to spread itself.
The worm is known as Kibuv, and researchers first noticed its presence Friday. Kibuv affects all versions of Windows from 98 through Windows Server 2003 and attempts to spread through a variety of methods, including exploiting five Windows vulnerabilities and connecting to the FTP server installed by the Sasser worms. "
Once it's installed on a PC, Kibuv starts its own FTP server that can be used to distribute copies of the worm. It also connects to a remote IRC chat server and listens for commands, according to an analysis done by Symantec Corp. Kibuv also listens on TCP port 420 for commands.
The worm has not spread too widely as of yet, but with its variety of infection methods, experts say the potential exists for it to infect a large number of machines.
The second piece of malware that has surfaced is a Trojan that is capable of spreading semi-automatically. Known as Bobax, the Trojan can only infect machines running Windows XP and seems to exist solely for the purpose of sending out large amounts of spam, according to an analysis by LURHQ Corp., a managed security services provider.
http://securityresponse.symantec.com/avcenter/venc/data/w32.kibuv.b.html
http://www.eweek.com/article2/0,1759,1594848,00.asp?kc=ewnws051904dtx1k0000599
"Security experts are tracking two new threats that have emerged in the past few days, including a worm that uses seven mechanisms to spread itself.
The worm is known as Kibuv, and researchers first noticed its presence Friday. Kibuv affects all versions of Windows from 98 through Windows Server 2003 and attempts to spread through a variety of methods, including exploiting five Windows vulnerabilities and connecting to the FTP server installed by the Sasser worms. "
Once it's installed on a PC, Kibuv starts its own FTP server that can be used to distribute copies of the worm. It also connects to a remote IRC chat server and listens for commands, according to an analysis done by Symantec Corp. Kibuv also listens on TCP port 420 for commands.
The worm has not spread too widely as of yet, but with its variety of infection methods, experts say the potential exists for it to infect a large number of machines.
The second piece of malware that has surfaced is a Trojan that is capable of spreading semi-automatically. Known as Bobax, the Trojan can only infect machines running Windows XP and seems to exist solely for the purpose of sending out large amounts of spam, according to an analysis by LURHQ Corp., a managed security services provider.
http://securityresponse.symantec.com/avcenter/venc/data/w32.kibuv.b.html
http://www.eweek.com/article2/0,1759,1594848,00.asp?kc=ewnws051904dtx1k0000599
unless they're shut down by the company that installed them, RFID tags can be read
Zombie RFID tags may never die - News - ZDNet:
"Item-level tagging is some way off yet, mainly due to cost rather than retailers' lack of enthusiasm but, when it does kick off in earnest, it's worth putting money on consumers being at loggerheads with retailers over when exactly to switch off and kill the chips.
RFID tags can be read--either by a store or by an unrelated third party--unless they're shut down by the company that installed them in the product. "
While a consumer might quite fancy the idea of walking up to the checkout and having his new $9,000 plasma-screen TV scanned instantaneously, he might not be so pleased that any passer-by with a reader can find out what he's got in the back of his car. He may also just not like the idea of a supermarket being able to scan his goods after he's left the store.
But when should the tag's tracking powers be turned off? Kill commands, as they're known, do exist. The idea is that when a shopper passes a certain point, any active RFID chip essentially shuts itself down (German supermarket Metro tried similar technology with its RFID rollout and was rather red-faced to find its kill commanders were more like a nasty-kick-in-the-shins commands).
The question remains: why would we want to keep the tags active once we've left our local Tesco and should retailers be allowed to?…
http://zdnet.com.com/2100-1103_2-5214648.html?tag=zdaresources
"Item-level tagging is some way off yet, mainly due to cost rather than retailers' lack of enthusiasm but, when it does kick off in earnest, it's worth putting money on consumers being at loggerheads with retailers over when exactly to switch off and kill the chips.
RFID tags can be read--either by a store or by an unrelated third party--unless they're shut down by the company that installed them in the product. "
While a consumer might quite fancy the idea of walking up to the checkout and having his new $9,000 plasma-screen TV scanned instantaneously, he might not be so pleased that any passer-by with a reader can find out what he's got in the back of his car. He may also just not like the idea of a supermarket being able to scan his goods after he's left the store.
But when should the tag's tracking powers be turned off? Kill commands, as they're known, do exist. The idea is that when a shopper passes a certain point, any active RFID chip essentially shuts itself down (German supermarket Metro tried similar technology with its RFID rollout and was rather red-faced to find its kill commanders were more like a nasty-kick-in-the-shins commands).
The question remains: why would we want to keep the tags active once we've left our local Tesco and should retailers be allowed to?…
http://zdnet.com.com/2100-1103_2-5214648.html?tag=zdaresources
Subscribe to:
Posts (Atom)
Posts
