"Quis Custodiet Ipsos Custodes?"

ICANN to Probe Network Solutions` Domain Registration Policies:

Quis custodiet ipsos custodes? is a Latin phrase from the Roman poet Juvenal, variously translated as "Who will guard the guards? ...

"Questions remain.

ICANN will investigate Network Solutions’ domain registering policy in the wake of reports that the company was automatically registering domains based on user searches.

ICANN’s decision to investigate comes just as Network Solutions reportedly is changing the policy.
In a brief note to eWEEK, ICANN (Internet Corporation for Assigned Names and Numbers), the international body in charge of TLDs (top-level domain name registrants) and Internet addressing, stated that it will be looking into Network Solutions’ new policy of registering any domain name that is searched for on its site.

However, Network Solutions told ICANN about this policy change before it implemented them.

'Network Solutions informed us when they launched this process,' said Jason Keenan, ICANN's media adviser. It was only after Network Solutions quietly implemented this policy and users noticed the change and protested about it online that ICANN took note of it. Now, 'ICANN has begun looking into the matter to see if it is in compliance with the Registrar Accreditation Agreement,' said Keenan."

Who will investigate ICANN?

http://www.eweek.com/c/a/Security/ICANN-to-Probe-Network-Solutions-Domain-Registration-Policies/?kc=EWKNLENT011108STR1

eventdv.net: NewTek Offers More than 10 Hours of Free LightWave Training

eventdv.net: NewTek Offers More than 10 Hours of Free LightWave Training:

"NewTek Offers More than 10 Hours of Free LightWave Training

NewTek, Inc., manufacturer of industry-leading 3D animation and video products, today announced the availability of over 10 hours of free online training. These tutorial videos provide practical steps to accomplish a broad range of 3D projects including: general modeling, hard surface modeling, organic modeling, surfacing, texturing, animation, particles, dynamics, lighting, rendering and compositing. The tutorials created by William Vaughan, DAVE School instructor and LightWave® evangelist are freely available at: www.newtek.com/3dtutorials.

These tutorials represent the first 10 hours of an extensive series. Throughout 2008 additional tutorials will be added that cover other aspects of 3D artistry and will include tutorials specifically requested by users. "The goal is to make 3D accessible to everyone," comments William Vaughan. "There are so many amazing things you can do with LightWave, but the learning process can be a bit daunting. With these tutorials we keep it simple, direct and you can always return to them for reference."

"Truly these are all outstanding techniques. I just watched the cloth video with the shirt and the buttons and tried a few things and had great results... but all the others I've watched have been tremendously helpful as well," said Michael James, LightWave user and NewTek forum member. "And I love the way you've kept them straight to the point, my knowledge of LightWave has more than doubled since watching the tutorials. And each one of those videos has opened a world of possibilities I really never knew could be so straightforward and simple."

At $895.00 US Lightwave hardly wualifies as a tool everyone should own, but it has becaome one of the standards in professional 3D. The tutorials are worth a first second and third look.

http://www.eventdv.net/Articles/ReadArticle.aspx?ArticleID=40499

Brokers Wield Automated Tools In Battle For Online Tickets - Security - IT Channel News by CRN and VARBusiness

Brokers Wield Automated Tools In Battle For Online Tickets - Security - IT Channel News by CRN and VARBusiness:

"What do Colorado Rockies fans, music lovers, and parents with young daughters caught up in the Hannah Montana craze have in common? They've all recently endured the frustration of being unable to buy event tickets through online ticketing systems, an experience often accompanied by smashed keyboards and the shouting of expletives.

Organizations that choose to sell tickets online often do so in the interest of fair access, but industry experts say online ticketing systems have weaknesses that are easy to manipulate. By using bots, or software that automates the process of buying tickets online, brokers can buy up mass quantities of tickets and re-list them on auction sites for prices well in excess of face value.

A relatively recent wrinkle is the ability for bots to get around captchas, which commonly take the form of squiggly text strings that Websites use in online ticketing forms to prevent abuse of the system. "

http://www.crn.com/arrnl/security/202601656

63% of Malware Emerges from U.S. Sites, Report Says

63% of Malware Emerges from U.S. Sites, Report Says:

"U.S.-based Web sites hosting malware are responsible for the majority of malware distributed on the Internet, according to a report by security company Cyveillance. (PDF) The company's 'Online Financial Fraud and Identity Theft Report' found that Web surfers visiting sites based in the United States are more at risk from malware attacks and online identity theft than visitors to sites based in other countries, with more than 63 percent of malware distributed to visitors via tainted U.S.-based Web sites.

In addition, 25 percent of malware-hosting sites, where the actual binary malware files are hosted and served up, are based in the United States. China leads the way with 34 percent of malware-hosting sites, the report found.

"We believe that this is simply a case of following the money," said Todd Bransford, vice president of marketing at Cyveillance, based in Arlington, Va. "The criminals want access to the computers of U.S. citizens so they can eventually tap into their financial resources. Therefore, they distribute malware on sites visited by U.S consumers."

Malware drop sites collect sensitive and personally identifiable information; 50 percent of sush sites are hosted in the United States, the report found. The percentage surprised Bransford, who explained that researchers expected to see a higher percentage of these sites in Eastern Europe and Asia.

"Obviously, a drop site hosted in the United States can be accessed from anywhere in the world, so the high percentage of U.S.-based drop sites may be more a factor of the simplicity and level of automation afforded by U.S. service providers to criminals … with a stolen credit card number," he said.

The report includes data collected and analyzed between April 1 and June 30, 2007, based on information collected from more than 200 million unique domain name servers and 150 million unique Web sites. Some 2 million URLs were found to be distributing malware. "

http://www.eweek.com/article2/0,1895,2173456,00.asp

Blog This: » Make this an open source Christmas | Open Source | ZDNet.com

Blog This: » Make this an open source Christmas Open Source ZDNet.com

Make this an open source Christmas by ZDNet's Dana Blankenhorn -- Don't think of this as just a Christmas gift. Follow-up. Make certain this new account is serviced. See to it that workers there are trained, and that they train others. Toss in some old books on computer programming, either from your own library or from others.

Trackback URL for his post: http://blogs.zdnet.com/open-source/wp-trackback.php?p=857

Yesterday, I installed Ubuntu (Dapper Drake) in an old Dell Optiplex that had a 10 Gig hard drive and 256 Megs of Ram. My state representative Monique D.Davis bought about twenty of these boxes from a suburban Chicago School that was upgrading its network so the OS had already been removed. Some of them only have 128 Megs, so I'll either have to go with an older version of Ubuntu or use a different distribution, but I really like Drake. Haven't tried the Eft but I've put in an order for the disks at http://shipit.ubuntu.org. I'm going to have to either do a lot of downloading or use GParted and do some imaging, since for reasons unknown my last order for disks was cancelled. Maybe I should hace used the community center's address, but I had no problems ordering to my home the first time around.

Security Watch from PC Magazine - Dealing With Downloaders

Security Watch from PC Magazine - Dealing With Downloaders:

"Downloaders are very simple programs that do nothing harmful directly by themselves. Instead, they go out to other sites and download a second payload and execute it."

This article is a cautionary tale and a must read for anyone responsible for a network or server.

http://www.pcmag.com/article2/0,1895,2061213,00.asp

Dark Reading - Desktop Security - The Ten Most Dangerous Things Users Do Online - Security News Analysis

Dark Reading - Desktop Security - The Ten Most Dangerous Things Users Do Online - Security News Analysis:

"No matter how many times they train them, no matter how many classes they hold, most IT professionals still watch helplessly as end users introduce new malware because they 'just couldn’t resist looking at the attachment.' Security pros cringe as their users download software for personal use, turn off firewalls to speed up a connection, or leave their passwords stuck to their laptops.

Wouldn’t it be nice if you could give end users a list of the most dangerous things they do online every day, and then tell them why those activities are particularly risky?"

Contents:

• Page 2: Clicking on email attachments from unknown senders
• Page 3: Installing unauthorized applications
• Page 4: Turning off or disabling automated security tools
• Page 5: Opening HTML or plain-text messages from unknown senders
• Page 6: Surfing gambling, porn, or other legally-risky Websites
• Page 7: Giving out passwords, tokens, or smart cards
• Page 8: Random surfing of unknown, untrusted Websites
• Page 9: Attaching to an unknown, untrustworthy WiFi network
• Page 10: Filling out Web scripts, forms, or registration pages
• Page 11: Participating in chat rooms or social networking sites

http://www.darkreading.com/document.asp?doc_id=107771

from Security Watch in PC Magazine - Change the Privileges of an Application

Security Watch from PC Magazine - Security Tips Galore: "Change the Privileges of an Application"

"From a security standpoint, running with your user privileges as low as possible is always best. On the other hand, running as an Administrator is especially bad. But even if you supervise a network and need to do much of your work logged in as an administrator, you still shouldn't run certain dangerous applications—most prominently Internet Explorer—as Administrator.

You can drop the privileges for such applications, though, using a capability that is new in Windows XP and Windows Server 2003, but not exposed in the user interface. A Microsoft Engineer has written a program to expose the facility and also penned an explanation in his article "Browsing the Web and Reading E-mail Safely as an Administrator".

Download and install the DropMyRights.msi file, which will install both the dropmyrights.exe program, and its source code on your system"

Dropmyrights.exe is a command-line utility that takes the program you want run as its first argument. The second argument is 'N,' 'C,' or 'U.' These correspond to Normal user (the default), Constrained user, and Untrusted user. For example:

DropMyRights.exe "c:\Program Files\Internet Explorer\iexplore.exe" c

runs Internet Explorer as a constrained user. For convenience, you can create a Windows shortcut that executes the command line and give the shortcut a descriptive name like "Internet Explorer (Constrained)." You'll find details about what these user levels mean in the Microsoft article.

Voice Extention Via Internet Protocol

I only pay a dollar a month for long distance, so I haven't given up my long distance carrier. I need my landline for DSL, but, the day naked DSL comes to Chicago, I'll have to give it serious consideration.

I used to limit my long distance calls to Sundays when the rates were lowest. Then I got Skype and made calls when
I needed to talk at just 2¢s ($.02) per minute. Now I call whenever I feel like talking to anyone in the U.S or Canada, at least until December.

I make most of my calls from my laptop. It's not as convenient as a cellphone, but it works for me. Just try taking notes and doing research, while recording the call from a cell.

Googles GTalk just added voicemail capability and it works. You can send voice messages to any Gmail account whether or not they have the GTalk client. The only problem I have with it is that there isn't a Mac client, so if your in a mixed (Mac/PC) relationship you can text chat, but only one of you can send voicemail.

Yes, I know Skype offers voicemail and has clients for both platforms, but Skype's voicemail isn't free and Gmail is everywhere.

Between the two platforms even a whisper can be heard around the world.

From VARBusiness | Phishers Snare Victims With VoIP

VARBusiness Security, Convergence News Phishers Snare Victims With VoIP: "By Antone Gonsalves, TechWeb.com
Tue. Apr. 25, 2006

A security firm on Tuesday reported discovering a phishing scheme in which the scammers used spam disguised as coming from a small bank in a large East Coast city, Cloudmark Inc., a messaging security firm, said. The message asked the recipient to dial a telephone number to talk with a bank representative.

The number went to an automated voice system that asked for an account number and personal identification number, or PIN, in order to access the caller's finances. The number was obtained through a regular provider of voice over Internet protocol services"

I'd say the other shoe just dropped, wouldn't you?

The scheme is the first Cloudmark has seen using Internet telephony. An investigation showed that the scammers used open-source software called Asterisk to convert a computer into aprivate branch exchange, or PBX, running an automated phone information system. The system sounds exactly like the bank's phone tree, directing callers to extensions, according to Adam J. O’Donnell, senior research scientist at Cloudmark.

He believes it's likely the phishers were using virus-infected computers that had been converted into a botnet to take calls over the Internet.

http://www.varbusiness.com/sections/news/breakingnews.jhtml?articleId=186701129

Mozilla users warned--upgrade now | Tech News on ZDNet

Mozilla users warned--upgrade now Tech News on ZDNet:
“The Computer Emergency Readiness Team (CERT) warned on Monday that earlier versions of Firefox, and other Mozilla software based on Firefox code, contain a clutch of vulnerabilities that expose users to attack.

The Mozilla Foundation released a new version of Firefox last week, version 1.5.0.2, which it said contained fixes for several security flaws.

According to security firm Secunia, there are a total of 21 flaws in the older versions of Firefox, such as Firefox 1.5, some of which it described as critical.

CERT advises people who use Mozilla's e-mail software, Thunderbird, and the Internet application suite Seamonkey to also upgrade to the latest versions (Thunderbird 1.5 and Seamonkey 1.0.1). CERT warned that any other products based on older Mozilla components, particularly the Gecko rendering engine, may also be affected.”

Is this the end of Faith-Based web browsing?

I seriously doubt it.

http://news.zdnet.com/2100-9588_22-6062713.html?tag=nl.e589

Do You Trust Yourself? - Highly Critical IE Flaw In The Wild

Security Watch from PC Magazine - Highly Critical IE Flaw In The Wild:

"Executive Summary
Name: Critical IE Flaw: 'Vulnerability in the Way HTML Objects Handle Unexpected Method Calls Could Allow Remote Code Execution'
Affects: All Internet Explorer versions on all current versions of Windows

Security researchers have found and publicized a vulnerability in all current versions of Internet Explorer on Windows. The vulnerability in the handling of the 'createTextRange()' method call applied on a radio button control is easily exploitable. Exploits are already circulating and by this past weekend, malicious Web sites began to appear to compromise computers through it.

Microsoft has announced that they are testing a patch for the vulnerability. At present it is scheduled to be released on the next regularly scheduled patch day, April 11, 2006, but the company will consider an earlier release if circumstances warrant. Such circumstances would probably involve widespread exploitation."

Do you trust your own judgement?

Do you run everything in administrator mode?

Do you feel lucky?

If you trust yourself, set Active Scripting to prompt. If you click first and ask questions later, set it to disable.

This vulnerability cannot be spread through HTML e-mail except through very old versions of e-mail clients which have not been patched in at least 5 years. Current Internet Explorer-based mail clients default to a model where scripting is blocked in all messages unless this setting is changed by the user.

To be exploited, the user would have to visit an affected Web page using Internet Explorer or an IE-based application. It is likely that many of the users who will be affected by this flaw have adware on their systems which will serve them advertisements containing the flaw. Such users, already compromised by the adware, are especially vulnerable to further attacks.

Consider the fact that this zero day exploit can turn your machine into somebody else's machine…!

http://www.pcmag.com/article2/0,1895,1943175,00.asp

VM Rootkits: The Next Big Threat?

VM Rootkits: The Next Big Threat?: "By Ryan Naraine
Lab rats at Microsoft Research and the University of Michigan have teamed up to create prototypes for virtual machine-based rootkits that significantly push the envelope for hiding malware and that can maintain control of a target operating system.

The proof-of-concept rootkit, called SubVirt, exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation.

Once the target operating system is hoisted into a virtual machine, the rootkit becomes impossible to detect because its state cannot be accessed by security software running in the target system, according to documentation seen by eWEEK.

…

Today, anti-rootkit clean-up tools compare registry and file system API discrepancies to check for the presence of user-mode or kernel-mode rootkits, but this tactic is useless if the rootkit stores malware in a place that cannot be scanned.

"We used our proof-of concept [rootkits] to subvert Windows XP and Linux target systems and implemented four example malicious services," the researchers wrote in a technical paper describing the attack scenario.

"[We] assume the perspective of the attacker, who is trying to run malicious software and avoid detection. By assuming this perspective, we hope to help defenders understand and defend against the threat posed by a new class of rootkits," said the paper, which is co-written by researchers from the University of Michigan.

Stealth rootkits are bombarding Windows XP SP2 systems. Click here to read more.

A virtual machine is one instance of an operating system running between the hardware and the "guest" operating system. Because the VM sits on the lower layer of the operating system, it is able to control the upper layers in a stealthy way.

"[T]he side that controls the lower layer in the system has a fundamental advantage in the arms race between attackers and defenders," the researchers said.

"If the defender's security service occupies a lower layer than the malware, then that security service should be able to detect, contain and remove the malware. Conversely, if the malware occupies a lower layer than the security service, then the malware should be able to evade the security service and manipulate its execution."

The group said the SubVirt project implemented VM-based rootkits on two platforms—Linux/VMWare and Windows/VirtualPC—and was able to write malicious services without detection.

The paper describes how easy it is to get the VM-based malware on a target system.

For example, a code execution flaw could be exploited to gain root or administrator rights to manipulate the system boot sequence.

Once the rootkit is installed, it can use a separate attack operating system to deploy malware that is invisible from the perspective of the target operating system.

"Any code running within an attack OS is effectively invisible. The ability to run invisible malicious services in an attack OS gives intruders the freedom to use user-mode code with less fear of detection," the researchers said.

The group used the prototype rootkits to develop four malicious services—a phishing Web server, a keystroke logger, a service that scans the target file system for sensitive information and a defense countermeasure to defeat existing VM-detection systems.

The researchers also used the VM-based rootkits to control the way the target reboots. It could also be used to emulate system shutdowns and system sleep states.

While the prototype rootkits are theoretically offensive in nature, the researchers also discussed ways to defend against malicious use of VM. "

http://www.eweek.com/print_article2/0,1217,a=173285,00.asp

Apple Fixes Eight QuickTime Bugs

ChannelWeb Executive Briefing:

"'Most IT departments probably saw Apple's security update and thought 'that's a consumer application, I don't have to worry about security policies for that,'' said Marc Maiffret, co-founder of eEye and its chief hacking officer, in a statement. 'Those IT departments would be mistaken. There are few people that have not seen a co-worker with an iPod wandering the halls of their organization, and those iPods probably mean iTunes is on your network.'"

The bugs in QuickTime, Apple revealed in a security advisory, are in how the player parses a number of image file formats, including .gif, .tif, and .tga, as well as in other media file formats. Attackers who craft special files, and deliver those files to unsuspecting users, could trigger integer or heap buffer overflows, crash the computer and/or run code of their own choosing.

In response, Apple has posted QuickTime 7.0.4 for Mac OS X 10.3.9 and later, and Windows 2000 and XP. The update can be downloaded and installed via Software Update for Mac OS X users, or from this page for Windows users.

http://www.channelweb.com/nl/execbriefing/showArticle.jhtml?sssdmh=dm4.163137&articleId=175803624

The Sky is Not Falling

Wait for Windows patch opens attack window Tech News on ZDNet:
"A serious flaw in Windows is generating a rising number of cyberattacks, but Microsoft says it won't deliver a fix until next week.

That could be too late, security experts said. The vulnerability, which lies in the way the operating system renders Windows Meta File images, could infect a PC if the victim simply visits a Web site that contains a malicious image file. Consumers and businesses face a serious risk until it's fixed, experts said.

"This vulnerability is rising in popularity among hackers, and it is simple to exploit," said Sam Curry, a vice president at security vendor Computer Associates International. "This has to be taken very seriously, and time is of the essence. A patch coming out as soon as possible is the responsible thing to do."

Microsoft has come under fire in the past for the way it releases security patches. The company has responded in the past by instituting a monthly patching program, so system administrators could plan for the updates. Critics contend that in high-urgency cases such as the WMF flaw, Microsoft should release a fix outside of its monthly schedule.

Details on the WMF security problem were publicly reported last week. Since then, a number of attacks that take advantage of the flaw have surfaced, including thousands of malicious Web sites, Trojan horses and at least one instant messaging worm, according to security reports.

More than a million PCs have already been compromised, said Andreas Marx, an antivirus software specialist at the University of Magdeburg in Germany. He has found a hidden Web site that shows how many copies of a program that installs malicious software have been delivered to vulnerable PCs.

Microsoft has said that a patch will not be made available until Jan. 10, its next official patch release day. That delay could provide an opportunity for attackers, security provider Symantec said on Tuesday. "

The sky is not falling. Most major antivirus programs detect and block this vulnerability. The file has to be opened and it isn't a standard file the browser automatcally opens.

from <http://www.eweek.com/article2/0,1895,1907131,00.asp>
AV-Test, which tests anti-malware products, has been tracking the situation closely and has, so far, analyzed 73 variants of malicious WMF files. Products from the following companies have identified all 73:

• Alwil Software (Avast)
• Softwin (BitDefender)
• ClamAV
• F-Secure Inc.
• Fortinet Inc.
• McAfee Inc.
• ESET (Nod32)
• Panda Software
• Sophos Plc
• Symantec Corp.
• Trend Micro Inc.
• VirusBuster

There are work arounds and commonsense that can keep you safe until patch Tuesday, but nothing can protect you from your own bad habits. We've got to stop clicking on links when we don't know the consequences. When in doubt, click the close button.

http://news.zdnet.com/2100-1009_22-6016747.html?tag=nl.e539

Time Warner loses Missouri muni fiber fight

"Time Warner this week lost an appeal aimed at blocking the city of North Kansas City, Mo., from extending its fiber optic network to residents and local businesses.

A federal judge rejected the argument, that, under state law, the city could not offer cable television service without first getting voters' approval, and pointed out that although the city was moving forward with plans to provide high-speed Internet access (to which the state law does not apply), it had no plans to offer cable.

Time Warner's lawsuit was dismissedthis spring, and this week's ruling by a three-judge panel in the 8Th Circuit upheld that dismissal.

The city broke ground on the construction of the network on Dec. 8. and expects to begin offering services this spring. Extending the fiber optic network that already connects municipal buildings, the city hopes to offer five tiers of broadband service to nearly all of its 2500 homes and 900 businesses. Speeds will range between a 256 kb/s service for $15 per month to a 30 Mb/s for $160 per month. The standard offering will be a symmetrical 5-Mb/s service for $35 per month."

http://telephonyonline.com/home/news/time_warner_municipal_123005/

Is the Firefox honeymoon over? | George Ou | ZDNet.com

"Is the Firefox honeymoon over? Posted by George Ou @ 2:13 am

Note:
It's always difficult to know how much of someone else's work to quote, but this is important. I don't think Firefox is any more vulnerable than Explorer, but it's being downloaded by a lot of people who think it's invulnerable. Whatever browser you choose you will have to patch and upgrade. You'll have to be vigilant and informed, because software's not perfect, isn't likely to ever be perfect, and only informed users can exert the pressure to make any software better. Ignorance means someone else controls and owns your computer. You're just the one who paid for it.

Be informed. Don't keep paying in time, anguish or money.
Sermon ends here.
Alfred Ingram

[Updated: 9/16/2005 7:22PM] Now that Firefox has become the first viable contender to Microsoft Internet Explorer in years, its popularity has brought with it some unwanted attention. Last week's premature disclosure of a zero-day Firefox exploit came a few weeks after a zero-day exploit for Internet Explorer appeared on the Internet. Firefox not only has more vulnerabilities per month than Internet Explorer, but it is now surpassing Internet Explorer for the number of exploits available for public download in recent months.
Update: A lot of people have complained that I didn't list the number of actual 'in-the-wild' attacks against the two browser platforms. The problem with this theory is that they either didn't read the entire article or they don't understand what I meant by 'published exploits' in the second chart in this blog. When I say published exploit, I mean a downloadable script or source code that can be used to attack real live browsers in the wild. These are not simple advisories that talk about certain theoretical exploits. Published exploits are basically freebies for professional hackers and script kiddies to use in the wild.… "

Here is a break down of recent vulnerabilities:

Month	Firefox 1.x Vulnerabilities	IE 6.x Vulnerabilities
Sept 2005	1	0
Aug 2005	0	4
July 2005	10	1
June 2005	2	1
May 2005	3	1
Apr 2005	9	3
Mar 2005	15	0
Total	40	10

Note that this is not a count of the number of advisories because advisories can contain multiple vulnerabilities. This is a count of the actual number of vulnerabilities.

Here is a break down of recent published exploits:

Month	Firefox Exploits	IE Exploits
Sept 2005	1	0
Aug 2005	0	3
July 2005	4	1
June 2005	0	0
May 2005	4	0
April 2005	2	2
Total	11	6

http://blogs.zdnet.com/Ou/?p=103&tag=nl.e550

http://blogs.zdnet.com/Ou/wp-trackback.php?p=1

Podcast for Ransom, as Easy as 1 2 3

Update: Podcast 'Hijacker' Says Business as Usual

December 6, 2005
Things are a bit more complicated than they originally seemed.

In fact, ther may be no villain here.

“According to George Lambert, creator of the Podkey redirection service that allegedly hijacked a Podcast and held it for ransom, the alleged victim registered with his service to begin with and the "ransom" simply represents fees that would be required to do the custom coding the Podcaster has demanded.

The alleged victim, Podcaster Erik Marcus, recently found that Apple Computer Inc.'s iTunes and Yahoo Inc. were using a URL and RSS feed that were not his in order to direct traffic to Marcus' Podcast: Vegan.com's "Erik's Diner" show.

Yahoo's Podcast page gives an RSS feed belonging, not to Vegan.com, but to Lambert's Podkeyword.com.

Marcus contacted Lambert to ask that his listing be removed. Lambert did so. This, however, caused Marcus' listenership to crash by some 75 percent, he claimed. Marcus then asked that his listing temporarily be reinstated on Podkeyword while he worked to fix things with Apple Computer Inc.'s iTunes.

Lambert responded that it would be reinstated only if Marcus provided an unspecified payment or agreed permanently to his terms—a description that sounds like hijacking and extortion and that has resulted in Lambert's being harassed around the clock by profane e-mail and phone calls.

However, as Lambert told Ziff Davis Internet News and also explained on a Podcast by David Lawrence, the request for reimbursement was simply to compensate him for the custom coding that Marcus reportedly demanded.

Specifically, Marcus reportedly requested that Lambert allow individuals to find his feed via keyword but not to allow OPML directories to have the feed any longer.

"He wanted me to make sure no other directory services got the information from me, but I can't tell who are directory services, because we're not submitting anything," Lambert said. "People are coming to look at our list. I have a choice: I remove it from anywhere or I [don't] remove it. You can't restrict who comes to look at your Podcast. So his request wasn't technically practical.

"If you want me to come up with a solution, I can try, but that's consulting," he told Ziff Davis Internet News. "That doesn't fall within the bounds of a free service—one that's there to make people's lives better. Is that extortion?"

"I met his [original] request immediately and without reservation," Lambert said. "I said I'd reinstate it for free if he met my terms. If you're asking me to do something custom, you have to pay me to do [it]. That's not unreasonable, and that's not extortion."

…

While Marcus is seeking legal redress for what he refers to as a new form of Internet extortion, Podcasters happy with the redirection service provided by Podkey aren't hesitating to come to its defense.

One such comment demonstrates the possibility of a user having registered with Podkey and then forgotten about it: "From my own experience, I have to say, my dealings with George have always been on the up and up," Podcaster Kevin Devin wrote on Lambert's blog.

"I too had created a Podkeyword for my Podcast WAY back in late 2004. Interestingly, I had actually forgotten about Podkey until iTunes hit with their Podcast directory, which ended up including two different listings for my feed. The Podkey one, and my actual."

…

As it is, Lambert runs the service free of charge, on funds that flow out of his own pocket. "I went and did something, I was volunteering," he said. "They took my free service and now they called it extortion, hijacking. And to be threatened to be sued, and harassed … why would I ever want to do something for people on the Internet again?"

Beyond the profane response to Lambert's alleged wrongs, calmer minds are pointing out that the heart of the problem is this: Once the wrong RSS feed gets into a directory, it's extremely difficult to find out and to fix it.

"I have that problem with one Podcast where some of the listings point to a staging server and not the real server," wrote Dan Bricklin, well-known blogger and the developer of VisiCalc.

"I think in the early days someone subscribed to the staging server while I tested out the Podcast series and some list picked that up and other lists copy from each other.

"This is a big problem. It's not like Google where things are somewhat self-correcting as people point to the one the owner points to," Bricklin wrote. "Once this points wrong it just perpetuates itself and you can't fix it. In this case, the RSS feed owner [Podcaster] got into a bad situation."

http://www.eweek.com/article2/0,1895,1896434,00.asp”

“The manner in which the purported hijacking occurred exemplifies the fact that RSS feeds are far more vulnerable to squatters than Web site domains. The method doesn't require stolen passwords or other overtly illegal methods.

Rather, it merely involves finding a target Podcast and creating a unique URL for it on a Web site that the hijacker can control. The hijacker then points his URL to the RSS feed of the target Podcast.

Next, the hijacker does whatever it takes to ensure that, as new Podcast engines come to market, the page each engine creates for the target Podcast points to the hijacker's URL instead of to the Podcast creator's official URL. ”

Podcast Hijacked, Held for Ransom from eWEEK

By Lisa Vaas

“In an assault reminiscent of the early days of the Internet, Podcaster Erik Marcus recently found that his RSS feed had been inexplicably redirected.

According to Marcus, rather than fully cooperate to address the situation, the cyber-squatter is demanding payment or permanent agreement to terms, and Marcus is seeking legal redress for this new form of Internet extortion.

Marcus publishes Vegan.com and the "Erik's Diner" Podcasts.

Over the course of the past year, Marcus has built his listenership from 100 people per show up to some 1,500. Over the past few weeks, he noticed that Yahoo Inc. had created an entry for his show on its beta site, Podcasts.yahoo.com.

The page had an RSS feed belonging not to Vegan.com, however, but to a site named Podkeyword.com.…

Marcus e-mailed Podkeyword directly in order to "nip this problem in the bud rather than let it grow," he said in his letter to his lawyer, Colette Vogele.

Podkeyword honored his request, Marcus said, after which his listener numbers abruptly collapsed. Marcus came to find that Apple Computer Inc.'s iTunes service, which shields RSS information from its users, had also picked up the Podkeyword URL.

"This has cost me more than 1,000 listeners per show," Marcus wrote in the letter.…

The manner in which the purported hijacking occurred exemplifies the fact that RSS feeds are far more vulnerable to squatters than Web site domains. The method doesn't require stolen passwords or other overtly illegal methods.

Rather, it merely involves finding a target Podcast and creating a unique URL for it on a Web site that the hijacker can control. The hijacker then points his URL to the RSS feed of the target Podcast.

Next, the hijacker does whatever it takes to ensure that, as new Podcast engines come to market, the page each engine creates for the target Podcast points to the hijacker's URL instead of to the Podcast creator's official URL.

Vogele, a non-residential fellow at Stanford University's Center for Internet and Society and head of the firm Vogele & Associates, told Ziff Davis Internet News that she is mulling over a number of approaches to determine which laws might pertain in the case, including claims of unfair competition, trademark infringement/dilution, computer fraud and abuse, trespass, right of publicity and misappropriation.…

Marcus suggested that Podcasters can protect themselves from hijacking by checking to make sure that all Podcast directories and search engines list RSS feeds that point to their official URLs/RSS feeds.

Also, if Podcasters learn of a hijacking, they can write to the hijacker and demand that they cease and desist. Hijacked Podcasters should also write to the Podcast directories and search engines to point out the misconduct.

Those who posted responses to Vogele's Weblog entry on the matter suggested other defensive strategies. One is to rename Podcast audio files on occasion and point to the new names in the legitimate RSS feed, thus causing the malicious site's RSS feed to stop working and hence to cease gaining popularity.

Another tactic is to look at the referrer's tags for Podcast downloads in a Podcaster's Web server logs. Names of malicious sites that point to a Podcast will come up in the logs, and a large number of off-site listener referrals should raise flags.

Another tactic proposed on Vogele's blog is to mention the site and feed URL in each Podcast. Those who take the time to notice what URL they're using may notice that the URL is in fact not the official one. ”

http://www.eweek.com/article2/0,1895,1894827,00.asp

1 Million Digitized Images Now Available Online from The Library of Congress

“Long before The Library of Congress (LC) made the announcement last week about planning a World Digital Library (WDL), they've been digitizing material of all types for many years along with cataloging books (as you might expect) and offering MANY other services.

One searchable digitized collection from LC that you should know about is a catalog of imagery from the The Library of Congress Prints & Photographs Division. As of today, 1 million digitized images are now available via the catalog. Access to the catalog is free.

It's possible to search the entire collection or individual collections one at a time. It's also possible to browse some of the collections. Finally, most of the images have been given subject access using the Thesaurus for Graphic Materials that now includes hyperlinked subjects for many images. I've also blogged about this thesaurus in the past. For the latest on what's happening at the Prints & Photographs Division, check out this 'What's New' page.”

From the SearchEngineWatch blog Posted by Gary Price

http://blog.searchenginewatch.com/blog/051128-205524:

Google Base Raises Features Bar Well Above Craigslist

from Poynter Online - E-Media Tidbits:
Posted by Steve Outing on Thursday, November 17, 2005 at 3:19:11 PM

“Google Base obviously is a BIG deal. (See Peter M. Zollman's blog item here yesterday for the basics.) There's no shortage of coverage, analysis, and opinion about it on news sites and on blogs.

Base is many things, it seems, not just a new (and, to newspapers, threatening) classifieds player. A number of observers have called its classifieds function 'Craigslist on steroids.' ”

http://www.poynter.org/column.asp?id=31&aid=92357

Danger! Will Robinson that Does Not Reprint!

In his article on searchEngine Watch “Indexing Versus Caching & How Google Print Doesn't Reprint” Danny Sullivan takes a serios look at the controversy over Google’s moves to index libraries.

His points are well taken.
Here are more in from the Sullivan Webliography.

Author Wants To Be In Google Print, But Publisher Says No

Google Print Press Review & Just A Bit About Search Inside the Book

Google Print "Only" Interfaces Now Available For More Countries

Stay Current With New Free Full Text Books With RSS Feed from the Online Books Page

Great Google Print Controversy Bibliography & Google Scholar Citing Issues

Is Google Print Headed for Congressional Hearings?

Google Gears Up to Resume Book Scanning

Google Print Now Publishing Out-Of-Copyright Works Gained Through Library Scanning Program

Google Print Is Google's Ninth Most Popular Service

Upcoming Google Print Debates

Google Print--Is it Time to Change Copyright Laws?

And highly recommended to read:

The Difference Between Google Print & Google Library

Common Sense for a Change

Rafe Needleman's c|net article Works for Me: Killing the killer app - CNET reviews provides an often missing balance to the hype about the web being all we need.

As rich and useful as Web 2.0 apps are, today we still need both local and remote applications on a daily basis.

Reports of Microsoft's End are Greatly Exaggerated, Way Premature, and Wishful Thinking

This article: Microsoft's 'big bang' could be its last - page 2 | Tech News on ZDNet is long on schadenfreude and short on reality.

Something like this comes out every time Microsoft announces a ship date (and they should be called slipped dates) for a new product or service. It ignores the one important fact, which is that Microsoft's biggest competitive problem is other Microsoft products.

Isn't it funny how those new capabilities eventually become a competitive necessity? They aren't the Borg, but resistance is futile, we will be upgraded.

Office 12 makeover takes on 'feature creep' | Tech News on ZDNet

“For years, Microsoft has been trying to add features to Office without them getting in the way of people who already know their way around the software.

Unfortunately, the company was a little too successful at making its innovations unobtrusive. In user testing, Microsoft found that nine out of every 10 features that customers wanted to see added to Office were already in the program.

'They simply don't know it's there,' Chris Capossela, a Microsoft vice president, told a developer crowd last week. 'It's just too hard to find it.'

Indeed, Office has become a case study for feature creep--the phenomenon in which a simple technology becomes complicated and unmanageable through the addition of new features. Office, which once had 100 commands neatly organized into menus, ballooned to contain some 1,500 commands located in scores of menus, toolbars and dialog boxes.

Having sensed that the software has reached the limits of functionality, Microsoft has been preparing its most radical overhaul ever for Word, Excel and friends. With Office 12, due next year, the company plans to do away with a system that depends on people remembering which series of menus lead to a particular command. Instead, users will see a 'ribbon' of different commands above their document, with the options changing depending on the task. Microsoft previewed the new look for Office at last week's Professional Developer Conference in Los Angeles.

The move could help Microsoft in its perennial quest to come up with enough reasons to prompt current Office users to upgrade, and might also stem some defections to rivals, such as OpenOffice. At the same time, it risks alienating some loyalists, as well as prompting some businesses to question the cost of retraining those accusaccustomed to the current Office.”

I don't see how a ‘ribbon’ is going to solve the problem. Features will still be hidden from users.

I don't believe the problem has ever been features people want to use all the time, but, features used rarely that usually come up when there's a deadline, leaving you barely enough time to do the task. Never enough time for the luxury of searching documentation online or off for the function you need.

Barring a breakthrough in A.I. combined with a telepathic program, I don't see how this is going to work. I think they're assuming a general familiarity with program features most users just don't have. Most people I deal with are only familiar with the specific features they use to accomplish their daily tasks.

Alfred Ingram

http://news.zdnet.com/2100-3513_22-5873597.html?tag=nl.e589

Court Unseals Files on Apple 'Asteroid' Probe

"A California appeals court has agreed with the Electronic Frontier Foundation's request to unseal documents relating to Apple Computer Inc.'s legal campaign to force reporters for three Web sites to reveal their sources for articles that disclosed details about Apple's 'Asteroid' audio product.

A redacted version of the documents, which the California 6th District Court of Appeals ordered unsealed last week, is available on the EFF Web page that covers the history of the case: O'Grady et al v. Superior Court, also known as 'Apple v. Does.'

Three sites—PowerPage.org, ThinkSecret.com and AppleInsider.com—posted articles outlining details about an Apple product code-named Asteroid, which is a FireWire-based audio interface unit that will work with GarageBand, Apple's music composition application.

The EFF said that the documents show that Apple did not exhaust other avenues of investigation, as required by law, before seeking subpoenas against the three sites, which published information about the product before it was released. The EFF is one of the organizations providing legal representation for AppleInsider.com and PowerPage.org.The documents are declarations from two of Apple's security personnel who described the measures they took in investigating the source of the leak of the Asteroid information. They described tracking who had access to the documents and who accessed files on a secure internal serrver. "At a minimum," Opsahl said, "[Apple] should have asked for depositions or
testimony under oath from employees under suspicion.

"While they're willing to seek subpoenas for people without associations with Apple, they failed to review laptops or e-mails," Opsahl said. He added that no investigations were made as to whether confidential information was sent via a Web-based e-mail client or copied to a physical medium.

Apple has claimed that publication of the Asteroid information, and complicity in the leaking of the information, constituted a violation of the Uniform Trade Secrets Act as defined in California Civil Code 3426.1. The act states that if a company takes reasonable measures to protect information and this information has value in being kept secret, California courts should rule that such information should be afforded protection as a trade secret.

When contacted for comment on the court's decision to unseal the documents, an Apple spokesperson simply restated the company's reasons for filing the complaint. "Apple has filed a civil complaint against unnamed individuals who we believe stole our trade secrets and posted detailed information about an unannounced Apple product on the Internet," the spokesperson said. "

http://www.eweek.com/article2/0,1895,1859271,00.asp?kc=ewnws091505dtx1k0000599

Threats Spread Thick

Top 5 vulnerabilities as reported by ThreatFocus for Monday, August 22nd, 2005

Date	Title	Severity
8/19/2005	Microsoft [Security Advisory: A COM Object (Msdds.dll) Could Cause Internet Explorer to Unexpectedly Exit]	High
8/17/2005	Adobe [Acrobat / Reader Plug-in Buffer Overflow Vulnerability]	High
8/16/2005	Apple [Security Update 2005-007]	High
8/19/2005	Red Hat [php security update]	High
8/17/2005	Debian [New Mozilla packages fix frame injection spoofing vulnerability]	High

http://www.pcmag.com/article2/0,1895,1850852,00.asp

Worm Could Squirm on Windows XP

"It is important to note that Simple File and Print Sharing is only available on Windows XP machines that are not part of a Windows Active Directory Domain. However, configuring a Windows XP SP1 host to share network resources prior to joining an Active Directory Domain will leave it in the vulnerable state even after the Domain is joined," the company warned.

By Ryan Naraine
“Microsoft late Tuesday warned that the Zotob worm could start squirming through certain configurations of Windows XP SP1 (Service Pack 1).

The worm, which squirms through a flaw in the Windows PnP (Plug and Play) service, has wreaked havoc on unpatched Windows 2000 machines, but new information suggests some Windows XP users could also be at risk.

Late Tuesday, Microsoft Corp. issued a new advisory that confirmed the expanded threat and recommended that users implement workarounds to thwart a new worm outbreak.

Users of Windows XP SP2 are not vulnerable to remote attacks.…”

http://www.eweek.com/article2/0,1895,1851908,00.asp?kc=ewnws082505dtx1k0000599

8 Out Of 10 Enterprise PCs Spyware Infected

The number of malicious sites hosting spyware has quadrupled since the start of the year, said Richard Stiennon, Webroot's director of threat research, and now number over 300,000 URLs.

By Gregg Keizer, TechWeb News
“On average, enterprise PCs have 27 pieces of spyware on their hard drives, a 19 percent increase in the last quarter alone, while a whopping 80 percent of corporate computers host at least one instance of unwanted software, whether that's adware, spyware, or a Trojan horse.

Worse, said Stiennon, evidence is accumulating that spyware is becoming more malicious than ever.

"The actual maliciousness of it is increasing," he noted. "There's simply more malicious activity per piece of spyware. They're not satisfied with making their seven cents a click by flooding systems with adware; now they're focusing on identity theft, sometimes from within an organization. Spyware's being used by insiders to, in essence, hack their employer or boss."

Instances of such activity during the second quarter included a scandal in Israel and a stymied multi-million dollar bank robbery in the U.K. that was based on spyware.

Part of the bump-up in spyware infection rates and most of the reason behind its increasing nastiness is due to pressure on spyware-as-a-business, Webroot claimed.

"There's an underlying principle that often gets overlooked: spyware's a business like any other," said C. David Moll, the chief executive of Boulder, Colo.-based Webroot. "Like any business, spyware developers are committed to increasing their profit margins by expanding their distribution channels, utilizing new products, and entering new markets.…" ”

http://www.crn.com/nl/crnupdate/showArticle.jhtml?articleId=169600391

Zotob Proves Patching 'Window' Non-existent

By Gregg Keizer, TechWeb News
“Although the initial attack on Windows 2000 PCs by bot worms exploiting a week-old vulnerability hasn't grabbed much traction, the way hackers jumped on the bug is proof that the patching "window" is virtually non-existent, said security experts Tuesday.

"The last week showed once more that there is no more patch window," wrote Johannes Ullrich, chief research officer at the SANS Internet Storm Center, in the group's daily alert. "Defense in depth is your only chance to survive the early release of malware."

Exploits were circulating within three days of Microsoft disclosing the Plug and Play vulnerability and offering up a patch, and within five days, several bot worms -- notably Zotob.a and Zotob.b -- were attacking systems.

"Microsoft must be fuming that virus writers are exploiting security holes in their software so quickly," said Graham Cluley, senior technology consultant for security vendor Sophos, in a statement. "It's not only embarrassing for the software giant, but a real headache for businesses who need to move quickly to roll out security patches."

The reason for the fast hacker turn-around, said Ullrich, is that attackers are sharing more and more information. "Malware can only develop as fast as it is developing in this case because of extensive code sharing in the underground," Ullrich said. "The only way we can keep up with this development is by sharing information as efficiently.

"We need to outshare the attackers.…" ”

http://www.crn.com/nl/security/showArticle.jhtml?articleId=168602090

Spyware Researchers Discover ID Theft Ring

“Sunbelt Software Inc., makers of the enterprise-grade CounterSpy spyware protection product, made the discovery during an audit of "CoolWebSearch," a program that routinely hijacks Web searchers, browser home pages and other Internet Explorer settings.

During the research, Sunbelt researcher Patrick Jordan deliberately installed the "CoolWebSearch application on a machine and immediately noticed that the infected system became a spam zombie that was placing callbacks to a remote server.

When Jordan visited the remote server, he was shocked to find that it was being used to distribute sensitive personal information from millions of PC users infected by the spyware application.

"We found the keylogger transcript files that are being uploaded to the servers. We're talking real spyware stuff…chat sessions, usernames, passwords, bank account information, full names, addresses," said Sunbelt president Alex Eckelberry.

…Eckelberry said the sophistication of the operation suggests it's the work of a "massive identity theft ring" that used keystroke loggers to grab confidential information that could be used to create fake online identities.

…"This is the most repulsive thing I've ever seen. It's very painful to see what's in these log files that are being uploaded in real time. We're seeing a lot of bank information and usernames and passwords to get in," Eckelberry said.

The log files included logins to one business bank account with more than $350,000 and another small company in California with over $11,000, readily accessible.

"There are lots of eBay account information and names and addresses of the people owning those accounts. Names, passwords, all matched up," Eckelberry added

He said the server, which is hosted out of a data center in Texas, was effectively a "massive repository of stolen data" that was being replenished in real time.

"As the [log] file gets to a certain size, it gets taken down and a new file starts generating. This goes on nonstop. We've been watching it for a few days while trying to get to the FBI, and it just keeps growing and growing."

While the site is being hosted in the United States, Eckelberry said the domain name is registered to an offshore company. The huge size of the log files is a clear indication that thousands of machines are pinging back daily.

Where users appeared to be at immediate risk of losing a considerable amount of money, Sunbelt has contacted the affected individuals.

Eckelberry said the "CoolWebSearch" payload included a typical adware download that immediately scanned the infected machine for e-mails to use for spam runs. It then sets up a "very intelligent keylogger" that looks for very specific information, noting that the keystroke logger was able to pick up identity-related data for delivery to the remote server.

Anti-virus vendor Trend Micro Inc. provides a free online scanning tool that detects and deletes the "CoolWebSearch" application. ”

http://www.eweek.com/article2/0,1895,1845248,00.asp?kc=ewnws080905dtx1k0000599

Effective professional blogging

“TechRepublic VP Bob Artner explains what it takes to be an effective professional blogger. He advises avoiding the mistakesof many personal blogs, which he says Bloviate and are Loud,Obnoxious and Gabby.”



http://ct.zdnet.com.com/clicks?c=354577-56849759&brand=zdnet&ds=5&fs=0

Spyware Costs

“A survey of more than 1,000 IT managers and end users reveals that spyware and other unsanctioned downloads are resulting in average monthly costs of $130,000 to IT enterprises. The survey also found that spyware incursions appear to be growing at a rate twice that of computer virus incidents.

…applications that are downloaded and installed on end user PCs without IT sanction, are increasingly represented by instant messaging. "Within the next six months, virtually all end users will have deployed some type of greynet application," the report states. "Based on stated intentions, this number will rise to 93 percent in the next six months."

…Noting that in addition to instant messaging, greynet applications can include P2P file sharing, Web conferencing, Web mail, adware/spyware, and VoIP applications such as Skype, the study found that even among IT managers who have installed perimeter security measures, 77 percent of them had a spyware incident in the past six months. Most of the IT managers said spyware incidents are occurring at the same or greater frequency as six months ago.… ”

http://www.crn.com/nl/security/showArticle.jhtml?articleId=167100251

Not Sure About that Phish? Throw It Back

Recommended Action: If you receive an e-mail from your bank asking you to sign in to verify or update your account then follow these steps:

1. close the email
2. open a new browser window
3. go to the banks web site using your regular bookmark or by typing in the address
4. log in there to see if there are any problems.

http://www.pcmag.com/article2/0,1895,1842338,00.asp

Next Explorer to fail Acid test | Tech News on ZDNet

"'We will not pass this test when IE7 ships,' Chris Wilson, lead program manager for the Web platform in IE, wrote in the IE blog. 'We fully recognize that IE is behind the game today in CSS support. We've dug through the Acid2 test and analyzed IE's problems with the test in some great detail, and we've made sure the bugs and features are on our list--however, there are some fairly large and difficult features to implement, and they will not all sort to the top of the stack in IE7.'

Standards advocates and Web developers have criticized Microsoft for letting Internet Explorer go without a significant upgrade for years. This spring it became clear that Microsoft would finally address long-standing standards-compliance issues in its planned version 7 upgrade.

Microsoft last week came out with a test, or 'beta' version, of its Windows Vista operating system and IE 7.

Wilson said the broad range of Acid2's demands made it more of a 'wish list' than a 'compliance test.'

'As a wish list, it is really important and useful to my team, but it isn't even intended, in my understanding, as our priority list for IE7,' Wilson wrote.

The Web Standards Project responded positively to the announcement, hailing Microsoft's standards to-do list and its openness in acknowledging the test."

http://news.zdnet.com/2100-9588_22-5813897.html?tag=nl.e539

Weekend Project: Get your hard drive back in the fast lane - CNET reviews

If your PC isn't the speedster it used to be, chances are a bloated hard drive is to blame. Steer clear of PC bottlenecks by making the most of Windows' built-in maintenance tools. Just mouse over to your System Tools folder and get ready to fine-tune your PC.

http://reviews.cnet.com/4520-10163_7-5555103-1.html?tag=nl.e501

Is the XP SP2 firewall getting a raw deal?

A current report on a new denial of service vulnerability involving Windows RDP (Remote Desktop Protocol) blaming the Windows XP SP2 (Service Pack 2) firewall has touched off firestorm of inaccurate coverage fthat gets "blindly regurgitated in the forums." George Ou sets us straight.

“A recent report on a new denial of service vulnerability involving Windows RDP (Remote Desktop Protocol) blaming the Windows XP SP2 (Service Pack 2) firewall has touched off a rash of sensationalism from other media outlets that gets blindly regurgitated in the forums. This has caused some unwarranted confusion and fear in the IT industry. The original story incorrectly blamed the XP SP2 firewall for failing to protect against the RDP flaw. This was a false characterization of the XP SP2 firewall which has a history of being mischaracterized as something that breaks a lot of applications or is somehow unreliable. This has resulted in some harm to the general public because too many windows users are refusing to protect themselves with Windows XP SP2. Larry Seltzer did a wonderfully accurate and educational assessment on XP SP2 but is drowned out by all the doom and gloom sensationalism.

When Microsoft first came out with XP SP2 last year, its new firewall feature was incorrectly blamed for breaking hundreds of applications when in fact any personal firewall installed without the proper holes drilled would have caused the exact same issues. This latest story on the RDP vulnerability seems to be yet another slam on the SP2 firewall with the incorrect accusation that it fails to protect against this new RDP denial of service vulnerability. While it's technically true that a SP2 firewall with port TCP 3389 (used by RDP) opened to anyone will result in a successful denial of service attack to an unpatched windows machine, this is the normal behavior of any stateful packet inspection firewall.… ”

You can protect all the PCs in your office or home by simply implementing a router with a basic firewall or just NAT (Network Address Translation) capability. A router for the home with a built-in switch can be purchased for less than $40. Not only does the router protect you from a vast array of attacks, it also acts as an Internet sharing device. Another easy thing to do is to turn on the Windows XP SP2 firewall make sure that the RDP service is either entirely blocked or only permitted to enter from trusted network sources. You can find more in-depth information here to turn off the RDP service entirely or configure the XP SP2 firewall. One of the nicest features of the XP SP2 firewall besides the fact that it's free with Windows is that it can easily be managed from a central location. This can be done from a legacy Windows NT 4.0 domain environment using a script or better yet from a group policy in a Windows 2000/2003 Active Directory. This allows a Microsoft network administrator to quickly configure every single windows XP computer in the company with a single login script or a single group policy.

http://blogs.zdnet.com/Ou/index.php?p=81&tag=nl.e539

Domain Hijacking

“Domain-name hijacking occurs when someone fraudulently takes control of a domain name, often by masquerading as the legitimate administrative contact for a domain name.

The e-mail addresses of administrative contacts, widely available in the WHOIS database of domain registrations, are used to verify domain-name holders.

The domain-name hijacking report, available here as a PDF, came from ICANN's Security and Stability Advisory Committee.

The report, announced Wednesday during an international meeting of the ICANN (Internet Corporation for Assigned Names and Numbers) in Luxembourg, followed at least two high-profile incidents this year of what is known as domain-name hijacking—one hitting New York-based ISP Panix and another affecting e-mail provider Hushmail Communications Corp.

The committee advises the domain-name system overseer's board of directors and constituents such as the registrars that sell domain names to individuals and business and the registries that manage domains such as .com and .net.

While the Panix and Hushmail cases were widely reported, the ICANN committee report also cited a dozen other examples of stolen domain names. The hijacks hit such high-profile names as wifi.com, commericials.com, nike.com and ebay.de.

Committee members expressed optimism that the report will lead to swift action, but it was still unclear as of late Wednesday whether ICANN's board planned to address the report's findings and recommendations at its meeting later this week.”

http://www.eweek.com/article2/0,1895,1836820,00.asp?kc=ewnws071505dtx1k0000599

Hollingsworth Rambles

“Not a Podcast?
Latlely I've been hearing a lot of chatter on the podoshpere ragging on conventional broadcasters who make their shows available as podcasts. The line of reasoning seems to be that when Mr. and Ms. Big Broadcaster post their conventional broadcasts on the Internet as downloadable mp3s, they're just posers jumping on the bandwagon.

Agreed, professional broadcasts lack the home-made charm of many current podcasts. That's probably more of a threat to the podcast producers than the podcast listeners.… ”

http://hollingsworthrambles.blogspot.com/2005/06/not-podcast.html

Does OS matter anymore for security?

by George Ou
“…It's usually taken as gospel in many IT circles to assume that Windows Security is an oxymoron; anyone who dares to suggest using Microsoft IIS 6.0 for a public web server faces serious ridicule. To see if there was any truth to this presumption that Windows Server is fundamentally insecure, I looked up these hacking statistics from www.zone-h.org for 2003 to 2004. Not only did it not show that Windows was hacked more often, but just the opposite. The Linux servers were actually getting hacked and defaced far more often than the Windows server and Apache was also being hacked and defaced more than Microsoft IIS.

While most security research comparing various operating systems and applications focus on statistics for the number of vulnerabilities and their criticality, zone-h takes a completely different approach by looking at actual server compromises. Even more significant is that these are not theoretical hacks in the laboratory but actual website defacements that were confirmed by the public. Zone-h is essentially a centralized "score board" for hackers who want bragging rights for their handy work. While the source of the data is highly despicable, there is no denying the value of such data being collected regardless of the source because of its accuracy. When a website is hacked and defaced, there is little room for interpretation for what has transpired because the proof is in the humiliating public defacement. While these particular defacements are often the work of recreational hackers who hack for sport and not the work of a professional criminal who hacks for financial gain, the techniques uses to compromise the servers are usually identical.…

At the end of the zone-h report for 2003-2004, the author concludes (accurately, in my experience) that the argument about which OS is more secure is totally irrelevant since most modern exploits are against applications and not the operating system hosting them. This is true because servers are rarely deployed wide open on the Internet without a firewall. A properly configured firewall minimizes the vulnerability footprint to only permit the ports necessary for a specific application to work, which means the application is the only thing exposed to the hacker. The zone-h report doesn't actually prove which OS is more secure, only that the OS is mostly irrelevant and the Windows server security jokes are more myth than fact.”

http://blogs.zdnet.com/Ou/?p=77&part=rss&tag=feed&subj=zdblog

PCs Have 50-50 Shot At Infection In Just 12 Minutes

By Gregg Keizer, TechWeb News
6:04 PM EDT Wed. Jul. 06, 2005

Sophos estimated that a new PC stands a 50-50 chance of being infected by a worm within 12 minutes of being connected to the Internet. (Other analysts, such as the Internet Storm Center, put the current average survival time at around 34 minutes.)

“The number of new viruses, worms, and Trojans are up nearly 60 percent in the first half of 2005, a U.K.-based security company said Wednesday, while the length of time an unprotected PC survives on the Internet has shrunk to a measly dozen minutes.

Sophos reported that it had pinpointed 7,944 new pieces of malicious software in the first six months of the year, an increase of 59 percent compared to the first half of 2004.

The firm's researchers tracked an even larger spike in the number of keylogging Trojan horses. According to Sophos, that category has tripled in number.

"We are seeing a large amount of new Trojan horses on a daily basis, representing what may be the most significant development in malware writing," said Gregg Mastoras, a Sophos senior security analyst, in a statement.”

http://www.crn.com/nl/security/showArticle.jhtml?articleId=165700440

Sell It on eBay: the Web Site Why not add a Buy It Now?

"Want to use a Reserve Price...why not add a Buy It Now?

eBay Live is off and running and I just picked up a terrific tip in a session taught by Janelle Elms, eBay University instructor and author of eBay Your Business.

It is common knowledge the buyers are very put off by Reserve Price auctions. Buyers understand that sellers need to protect their bottom line, but the hide-and-seek of figuring out what someone's reserve price is can be awfully frustrating."

why not simply add the Buy It Now feature to any reserve price auction as well. If you set the Buy It Now amount to be the same as your reserve, potential buyers examining your auction can snap up your item immediately, at the price you want.

http://sellitonebay.blogspot.com/

VARBusiness | It's a Microsoft World...Where Do You Fit In?

“Taken as a whole, the sheer size of the Microsoft platform broadens the opportunity for consulting services and custom-development engagements for partners, many of whom are increasingly buying into the all-Microsoft mantra. In fact, studies reveal that devoted loyalists are growing by a staggering number, even by Microsoft's standards. That's despite the company's late attempt to catch Google in search, its ongoing struggles to meet its own product deadlines involving Longhorn and other wares, its never-ending battle with hackers--anyone not know someone impacted by spyware?--and its ever-growing complexity when it comes to licensing, its product portfolio or even its basic value proposition. Despite these challenges, the number of people, companies and initiatives that depend on Microsoft technology are simply jaw-dropping… ”

http://www.varbusiness.com/nl/insider/showArticle.jhtml?articleId=164303410

Down to the Wire

Thomas Bleha
From Foreign Affairs, May/June 2005

“In the first three years of the Bush administration, the United States dropped from 4th to 13th place in global rankings of broadband Internet usage. Today, most U.S. homes can access only "basic" broadband, among the slowest, most expensive, and least reliable in the developed world, and the United States has fallen even further behind in mobile-phone-based Internet access. The lag is arguably the result of the Bush administration's failure to make a priority of developing these networks. In fact, the United States is the only industrialized state without an explicit national policy for promoting broadband.

It did not have to be this way. Until recently, the United States led the world in Internet development. In the late 1960s and 1970s, the Department of Defense's Advanced Research Projects Agency conceived of and then funded the Internet. In the 1980s, the National Science Foundation partially underwrote the university and college networks -- and the high-speed lines supporting them -- that extended the Internet across the nation. After the World Wide Web and mouse-driven browsers were developed in the early 1990s, the Internet was ready to take off. President Bill Clinton and Vice President Al Gore showed the way by promoting the Internet's commercialization, the National Infrastructure Initiative, the Telecommunications Act of 1996, and remarkable e-commerce, e-government, and e-education programs. The private sector did the work, but the government offered a clear vision and strong leadership that created a competitive playing field for early broadband providers. Even though these policies had their share of detractors -- who claimed that excessive hype was used to sell wasteful projects and even blamed the Clinton administration for the dot-com bust -- they kept the United States in the forefront of Internet innovation and deployment through the 1990s.

Things changed when the Bush administration took over in 2001 and set new priorities for the country: tax cuts, missile defense, and, months later, the war on terrorism. In the administration's first three years, President George W. Bush mentioned broadband just twice and only in passing. The Federal Communications Commission (FCC) showed little interest in opening home telephone lines to outside competitors to drive down broadband prices and increase demand.

When the United States dropped the Internet leadership baton, Japan picked it up. In 2001, Japan was well behind the United States in the broadband race. But thanks to top-level political leadership and ambitious goals, it soon began to move ahead. By May 2003, a higher percentage of homes in Japan than in the United States had broadband, and Japan had moved well beyond the basic connections still in use in the United States. Today, nearly all Japanese have access to "high-speed" broadband, with an average connection speed 16 times faster than in the United States -- for only about $22 a month. Even faster "ultra-high-speed" broadband, which runs through fiber-optic cable, is scheduled to be available throughout the country for $30 to $40 a month by the end of 2005. And that is to say nothing of Internet access through mobile phones, an area in which Japan is even further ahead of the United States.

It is now clear that Japan and its neighbors will lead the charge in high-speed broadband over the next several years. South Korea already has the world's greatest percentage of broadband users, and last year the absolute number of broadband users in urban China surpassed that in the United States. These countries' progress will have serious economic implications. By dislodging the United States from the lead it commanded not so long ago, Japan and its neighbors have positioned themselves to be the first states to reap the benefits of the broadband era: economic growth, increased productivity, technological innovation, and an improved quality of life.…”

http://www.foreignaffairs.org/20050501faessay84311/thomas-bleha/down-to-the-wire.html

The red herring of data protection | Between the Lines | ZDNet.com

by Eric Norlin
"Set aside for a moment the debate about why, all of a sudden, we're hearing about all of this. Instead, focus on the reasons behind the data loss: physical tapes lost in transit, hackers, malicious insiders, bad network security practices. Notice that the reasons behind the loss are all over the map. We're told the solution is better network security, better encryption, better corporate safeguards, and better 'data protection.' Of course, all of these 'solutions' are a bit specious, as they're always accompanied by the corporate lawyer caveat, 'we cannot guarantee that this won't happen again.'

All of this will ultimately result in some bloated piece of federal legislation around 'data privacy and protection' that will impose new restrictions on corporate security practices and result in a wave of new spending on IT solutions to help solve that problem. But will we have solved it, really? "

I don't think so.

In the end, this "data loss" problem isn't really about data loss, data protection or data safeguarding at all. That, my friends, is a red herring. The real question to be asked is: Why do all of these corporations need to store all of this personal data in the first place? Why does my credit card company need to store my social security number? Why does Amazon need to store my credit card number? Why shouldn't every company store only what I tell them they can store? And why shouldn't the data that they store be as little as they possibly need to conduct business?

Assuming that there's even a smidgen of validity in my line of questioning, the next question becomes how — how do we go about making the possibility behind these questions a reality?

http://blogs.zdnet.com/BTL/index.php?p=1529&tag=nl.e540