Wednesday, October 27, 2004

Mastering Internet Video: A Guide to Streaming and On-Demand Video - WebReference.com-

Mastering Internet Video: A Guide to Streaming and On-Demand Video - WebReference.com-:
"This chapter, titled 'Video Security and Digital Rights Management', is excerpted from the new book, 'Mastering Internet Video: A Guide to Streaming and On-Demand Video,' authored by Damien Stolarz, ISBN 0-321-12246-1, copyright 2005 by Pearson Education, Inc. To learn more, visit http://www.awprofessional.com/title/0321122461.

How to Control Your Internet Video Distribution"

In This Chapter

  • The Hope of Digital Rights Management
  • A Tale of Two Consumers...or How to Feel Like You Are Protecting Content When You Are Not
  • DRM Conceptual Ingredients
  • Under the DRM Hood: Encryption Technology
  • Encryption Concepts
  • Tools in the Encryption Toolbox
  • Truly Effective DRM


http://www.webreference.com/multimedia/video/index.html

Windows Security Updates for October 2004

Windows Security Updates for October 2004:
"The Microsoft Windows security updates for October 2004 address newly discovered issues in Windows, including Microsoft Internet Explorer, a component of Windows. If you have any of the software listed on this page installed on your computer, you should visit the Windows Update Web site to install related updates."

http://www.microsoft.com/security/bulletins/200410_windows.mspx

Friday, October 22, 2004

Build your own Database Driven Website using PHP & MySQL - Third Edition [Tutorials]

Build your own Database Driven Website using PHP & MySQL - Third Edition [Tutorials]:
"Kevin Yank began developing for the Web in 1995 and is a highly respected technical author. He wrote 'Build your own Database Driven Website using PHP and MySQL', a practical step-by-step guide published by SitePoint.com, and he's editor of the SitePoint Tech Times, a bi-weekly newsletter for technically-minded Web developers. Kev believes that any good Webmaster should have seen at least one episode of MacGyver. "

These articles are aimed at intermediate or advanced Web designers looking to make the leap into server-side programming. You'll be expected to be comfortable with simple HTML, as I'll make use of it without much in the way of explanation. No knowledge of JavaScript is assumed or required, but if you do know JavaScript, you'll find it will make learning PHP a breeze.

By the end of the series, you can expect to have a grasp of what's involved in setting up and building a database-driven Website. If you follow the examples, you'll also learn the basics of PHP (a server-side scripting language that gives you easy access to a database, and a lot more) and Structured Query Language (SQL — the standard language for interacting with relational databases) as supported by MySQL, one of the most popular free database engines available today. Most importantly, you'll come away with everything you need to get started on your very own database-driven site in no time!

What's in this Series?

This series comprises the following 4 chapters. Read them in order from beginning to end to gain a complete understanding of the subject, or skip around if you need a refresher on a particular topic.
Chapter 1: Installation

Chapter 2: Getting Started with MySQL

Chapter 3: Getting Started with PHP

Chapter 4: Publishing MySQL Data on the Web

http://www.sitepoint.com/article/php-mysql-tutorial

Thursday, October 14, 2004

How To Do Radio

How To Do Radio

Radio Journalism 101

Want to work in Radio and need help getting started?

Want to suggest a story for NPR?

The Poynter Institute of Journalism site advertises itself as "Everything you need to be a better journalist". Highlights include an excellent and comprehensive High School Journalism Guide, and Nelson, an excellent search engine that searches by Newspapers, Print/TV, Beats or Journalism Organizations.

The Radiocollege.org site has excellent articles and suggestions on how to get your career off the ground, learn more about what you are doing or even find a school of Journalism to attend. Looking for scholarship money? There are quite a few organizations that offer such opportunities.

At AIRMedia.org you can join an organization made up of dedicated professionals who make a living (!!!) doing the kinds of stories public radio is known for.

Want to report for the BBC? They have a huge site dedicated to training and development.

The Minidisc Community Portal features links, forums, mailing lists, cool uses, etc.

Transom.org Tools editor Jeff Towne has gone through the transom discussion boards and created a list of FAQs.

NPR Technical Advisor Flawn Williams answers all your audio questions in our Ask The Engineer section. Caution: some of this may be redundant or you may find slightly differing opinions. You should read for similarities, not difference of opinion.

http://www.npr.org/about/nextgen/howto/index.html

Will Satellite, 'Podcasting' Bring a Renaissance to Radio Journalism?

Will Satellite, 'Podcasting' Bring a Renaissance to Radio Journalism?

Build your own radio station

While satellite radio will always have limited appeal due to the monthly charge, podcasting offers a free way for you to create your own radio station on the fly each day, listening when you want. Satellite radio services have been loathe to allow people to record their programs due to copyright concerns. XM Radio threatened legal action against the maker of TimeTrax software, which lets users record satellite shows on MP3s.

But Reuters reported that XM is planning its own TiVo-like devices soon that will allow users to pause and rewind live satellite broadcasts. Plus XM has a deal for streaming its programming onto the next generation of TiVo television recorders.

Still, podcasting goes much further, giving listeners full control over what they listen to, depending on the available RSS feeds. Basically, you need a portable MP3 player -- not necessarily an iPod -- Apple's free iTunes software, and the new iPodder software. The latter is an open source application, birthed by Adam Curry, the former MTV VJ, blogger and serial entrepreneur now based in Amsterdam.

Curry runs the iPodder site, which includes a nascent directory of podcasting feeds with everything from music to news to audiobooks. So far, the selection is weighted to technology radio shows, and it sometimes seems as if a small group of people are just listening to each other.

"So this morning, here in my hotel room, I listened to the latest edition of Adam Curry's Daily Source Code, Dave Winer's Morning Coffee Notes about the open-sourcing of Frontier, and a conversation between Adam and Dave about all the above, iPodder, Trade Secrets Radio and much more," wrote Doc Searls in his Weblog about his new fascination with podcasting.

But Curry is optimistic that podcasting will catch on with a much wider audience. He thinks MP3 player manufacturers will be able to build iPodder functionality right into their devices. "Mass appeal is likely, since the installed base of MP3 players is huge," he said. "Most of them have gigabytes of empty disk space and users are apparently really enjoying this new use for their players."

Beyond the smaller productions, there are now more polished podcasts from public radio station WGBH as well as KOMO 1000 AM news in Seattle. KOMO is the first commercial news station to take the leap into podcasting. The station's assistant director of news and programming, Stan Orchard, told me that his station has always been on the cutting edge with technology, launching a Web site in 1994 and an RSS feed last year. Podcasting was an easy addition.

"For the user it's easy-squeasy," Orchard said via e-mail. "They just install iPodder or some other such program and type in our podcast feed URL. That's it. As for setting it up at this end...all it takes is a RSS feed which we already had. We just had to tweak it a bit. Then we had to crank out some stories. Again, we were already doing that for the Web site so it wasn't much [work]."

One of the challenges for KOMO was getting the radio reporters to think a little differently, according to Orchard. Now they have to consider three formats while producing a story: the radio broadcast, the MP3 podcast and a written story for the Web site.


While podcasting is only in its embryonic stage, people are already looking beyond time-shifted radio on portable MP3 players. NPR's Mitchell, for one, thinks that ubiquitous wireless Net connections could bring on-demand radio to a variety of devices, cutting out the computer as content server.

"The next big thing is...I think eventually you'll be able to wirelessly download something, stick on some headphones, and sit with your iPod or phone and listen to a program," Mitchell said. "I think you'll eventually be able to do that. Handheld devices will keep shrinking. You can already download and listen to shows online."

Plus, Mitchell notes just how cheap radio production has become. Now a college student can spend about $1,000 on audio equipment, maybe $2,000 on an Apple laptop, and with the right training, start reporting stories and put them online. "I don't have to burn CDs unless someone wants to purchase it," Mitchell says. "It's extremely cost effective. All the barriers are coming down. It's becoming extremely decentralized."

For the independent radio producer, the biggest barrier might be getting heard above the noise of so many like-minded folks online. Adam Curry says that skill, experience and talent will still set people apart. "There will be a lot of crap, and just like Weblogs, we'll also have our superstars," he said. "And everyone can have their 15 minutes [of fame]."

http://ojr.org/ojr/glaser/1097614994.php

Test Web pages in multiple browser versions

Until recently, having multiple versions of IE for Windows installed on a single computer has been problematic because of the tight integration of IE with the Windows operating system. Conventional wisdom was that you couldn't have more than one version of IE installed in a given copy of Windows.

As a result, many Web builders resorted to using several separate Windows computers for testing, each with a different version of IE installed. The only other option was to create multiple virtual machines on one hardware box using emulation software such as VMware.

And now a solution
In response to the Eolas lawsuit, Microsoft is circulating a developer's preview of a version of IE without the features that are covered by the Eolas patent. One of the most interesting things about the test version of IE is that it can coexist with a standard version of IE. (Read about the changes in IE as a result of the Eolas suit.)

Joe Maddalone, of Insert Title Web Designs, is credited with realizing which file (iexplore.exe.local) makes it possible to run more than one copy of IE and sharing that discovery with the rest of us. Another enterprising Web builder, Ryan Parman of Skyzyx.com, has packaged the iexplore.exe.local file with the core browser files for each of several versions of IE. These stand-alone versions of IE are available from his download page.

To install one of the stand-alone IE versions, you simply extract the files from the ZIP archive and place them in a separate directory on your Windows test system. (Almost any directory except the main IE directory will do.) To launch the stand-alone old browser, open the directory and double-click the iexplore.exe file.

http://builder.com.com/5100-6371_14-5157896.html?tag=nl.e601

Wednesday, October 13, 2004

Microsoft warns of 22 new security flaws | Tech News on ZDNet

Microsoft warns of 22 new security flaws | Tech News on ZDNet:
"Microsoft on Tuesday published 10 software security advisories, warning Windows users and corporate administrators of 22 new flaws that affect the company's products. "

The advisories, and patches published with the bulletins, range from an "important" flaw affecting only Microsoft Windows NT Server to a collection of eight security holes, including three rated "critical," that leave Internet Explorer open to attack. Microsoft's highest severity rating for software flaws is its "critical" ranking, while "important" is considered slightly less severe.

One flaw, in Microsoft Excel, even affects Apple Computer's Mac OS X.

The abundance of flaws could leave corporate PCs vulnerable to attack if administrators are not able to patch quickly. A similar situation occurred in April, when Microsoft published seven advisories detailing 20 flaws. While one security hole stood out among those 20--and led to the widespread Sasser worm--there are no standouts in the current gaggle of goofs.

"Our challenge is trying to guess what the criminals are going to attack," said Stephen Toulouse, security program manager for Microsoft's security response team. "The guidance we are giving in general is to treat the critical ones first."

A single computer would not be vulnerable to all the flaws, Toulouse added.

Oliver Friedrichs, senior director of Symantec's security response center, said three vulnerabilities could lead to a Sasser-like worm, but the danger is lessened by the fact that the vulnerable services are not started by default on most versions of Windows. These flaws are related to three network protocols that are not generally activated on Windows computers: Simple Mail Transfer Protocol (SMTP), Network News Transfer Protocol (NNTP), and Network Dynamic Data Exchange (NetDDE).

"Blaster and Sasser targeted core system vulnerabilities, where if you didn't have the patch you were vulnerable," Friedrichs said. "The key thing here is that these are not (generally) enabled by default.The question is how large is the deployment of vulnerable systems."

http://news.zdnet.com/2100-1009_22-5406550.html

Saturday, October 09, 2004

Trojan pretends to do good | Tech News on ZDNet

Trojan pretends to do good | Tech News on ZDNet:
"Security company Symantec is warning Internet users of a Trojan horse that removes adware but alters the settings in computers.

While Downloader.Lunii eliminates a variety of adware programs--often known as spyware--the Trojan also tries to maliciously change the security settings of Windows PCs and then downloads files from unknown Web sites, Symantec said.

'It's common that a Trojan will try to change as much security as possible,' said Nigel Beighton, Symantec's director of enterprise strategy. 'They often try to change Microsoft, Symantec and McAfee software.'

Symantec classified Lunii as a low-risk Trojan."

http://news.zdnet.com/2100-1009_22-5400982.html?tag=adnews

Microsoft to tune up Media Center PC

Microsoft to tune up Media Center PC:
"For the first time, Microsoft's Windows XP Media Center Edition is supporting multiple tuners, meaning that consumers will be able to watch one channel while recording another or record two stations at once, CNET News.com has learned. The feature is one of several improvements Microsoft has made with Windows XP Media Center Edition 2005, an update that the company plans to announce next week. "

At the same time, Microsoft is also allowing computer makers to create Media Center PCs that lack the TV recording feature altogether, a move that will allow computer makers to offer PCs with the operating system for less than $800. It's all part of an effort by Microsoft to position Media Center as a more mainstream consumer OS.

Without an all-new version of Windows until Longhorn in 2006, Microsoft is hoping that an improved Media Center OS can help reignite interest in the 3-year-old Windows XP operating system. The launch of the updated Media Center, along with several new companion products, will form a key part of Microsoft's fall marketing blitz designed to sell consumers on the benefits of XP.

The entertainment-oriented Media Center OS is similar to other flavors of Microsoft's flagship Windows XP, but adds a second interface that can play movies, music, digital pictures or television and be controlled via remote control. In its first two incarnations, Media Center has attracted only a niche of the PC market, largely those interested in recording TV shows onto their hard drives.

Microsoft has thus far been largely mum about the new version of Media Center OS, though details have begun to trickle out. As previously reported, the new version has several new features designed to address current shortcomings, such as the ability to burn CDs and DVDs from within the remote-controlled interface.…

http://techrepublic.com.com/5100-22_11-5398938.html?tag=nl.e103

Microsoft Fixes Vexing XP SP2 Incompatibility

Microsoft Fixes Vexing XP SP2 Incompatibility
Numerous applications, including some of Microsoft's own, have encountered compatibility problems with Windows XP SP2 (Service Pack 2). But one application in particular wreaked an inordinate amount of havoc until Microsoft created a removal tool, and now a patch, for it.

That application—which many industry watchers consider to fall more into the adware/spware category—was Total Velocity Software's TV Media application. TV Media hides on users' PCs and displays commercials.


A number of users with TV Media lurking on their PCs who attempted to load SP2 were hit immediately with the dreaded blue screen of death.

Microsoft posted a Knowledge Base article on its Web site in September that outlined the TV Media-SP2 problems. Microsoft posted a downloadable TV Media removal tool around the same time.

The company posted a patch Tuesday that it characterized as a "critical update," which is designed to head off the TV Media problem at the pass.

The TV Media problems were not discovered during SP2 beta testing, said Matt Fingerhut, PSS senior director of consumer technical support. But once Microsoft began rolling out the final SP2 version, TV Media in particular—and spyware in general—started botching SP2 installations.


http://support.microsoft.com/default.aspx?
kbid=885523&product=windowsxpsp2


http://www.microsoft.com/downloads/details.aspx?
amp;amp;amp;displaylang=en&familyid=
F94E8B27-B656-45CD-9668-73134A18231B&displaylang=en


http://www.microsoft.com/downloads/details.aspx?
amp;displaylang=en.&familyid=
65875203-CF1B-4D32-8F32-E00D004659F6&displaylang=en


Microsoft began advising customers a few weeks ago to
scan for and remove all spyware from their PCs before attempting to install SP2.


http://www.eweek.com/article2/0,1759,1667872,00.asp


Friday, October 08, 2004

37signals: An Introduction to Using Patterns in Web Design

37signals: An Introduction to Using Patterns in Web Design:
"The biggest challenge for web designers is the unthinkably huge number of possible ways to solve any given problem. We usually don't think of this because we have our habits and traditions to fall back on, but there are literally billions of possible pixel combinations for each page we make."

There is a better way to manage this vast complexity than by making big decisions up front and hoping for the best. To make better sites — sites that are functional, beautiful, and "usable" — we have to break our design problems up into small independent chunks based on the real issues within our requirements. Christopher Alexander, who came up with this stuff, calls these chunks patterns.

http://37signals.com/papers/introtopatterns/


A Search Engine For Java Code

A Search Engine For Java Code:
"Can't find that last bit of Java code to complete your project? IBM is developing a search engine it claims will let Java developers find even the briefest code examples in a fraction of the time it now takes. "

Code-named "Prospector , http://snobol.cs.berkeley.edu/prospector-bin/search.py," the engine seeks out code examples that use any or all of J2SE 1.4, Eclipse 3.0, and Eclipse GEF (Graphical Editing Framework) code. IBM is working with the U.C. Berkeley Computer Science Department to fund the venture with a fraction of its $1 billion annual developer budget.

The search engine is currently in beta testing with plans for completion by the end of the year.

http://www.internetnews.com/dev-news/article.php/3417991


Web Analytics: A User's Guide, Part 1

Web Analytics: A User's Guide, Part 1:
"Web analytics is an umbrella term that refers to the tracking of many different indicators: total site usage, which products are selling (and which aren't), trends in usage, type of visitors (age, income, location), where visitors come from, and other factors. Web analytics data guides site managers as they improve their site, and their bottom line.

Running a Web site without such data is like steering a ship without reliable indicators of wind level and sun position: there's no way to find your direction.

Inherent in Web analytics are two key concepts: First, that a site manager examines her data on a regular basis, perhaps weekly or even daily. Second, that a site manager changes her site based on that data, then continues to track that data over time to watch the effect of those decisions. If the new data indicates the change was profitable, stick with it; if not, try a different direction.

The central idea is to trust the data more than your preconceived notions of shopper opinion, or what other sites are doing, or the ego of the CEO. In short, the numbers don't lie. And only by truly following the numbers can a site's revenue be maximized. "

http://www.ecommerce-guide.com/solutions/customer_relations/article.php/3416791

Wednesday, October 06, 2004

Video-Editing Power For Non-Pros by PC Magazine

Video-Editing Power For Non-Pros by PC Magazine:
"While earlier consumer-level packages shunned advanced concepts such as multitrack editing and chroma key capabilities, software developers have recognized that many early adopters are ready for more powerful software—but aren't ready or willing to tackle the $500-and-up packages intended for videographers. The newest entries in this upper-entry-level segment are Adobe Premiere Elements and Pinnacle Studio Plus 9.

To compare these programs, PC Magazine created a 12-minute video project that included a variety of transitions and effects, including slow motion, chroma key, and picture-in-picture (PiP). Studio Plus won two of three trials, producing our DVD in 35 minutes 13 seconds, compared to 50:22 for Premiere Elements; and rendering to a Windows Media file in 31:36, compared to 38:12 for Premiere Elements. That better performance, combined with the program's polish and versatility, make Pinnacle Studio Plus 9 our PC Magazine's Choice among consumer video-editing products."

http://www.pcmag.com/print_article/0,1761,a=135822,00.asp

Tuesday, October 05, 2004

WinXPnews Open Control Panel Applets from the Run Box

WinXPnews Open Control Panel Applets from the Run Box :
"Open Control Panel Applets from the Run Box

Are you a keyboard whiz who prefers typing commands to navigating through a bunch of windows with the mouse? Here are the commands for opening some popular Control Panel applets (just type them in the Run box): "

http://www.winxpnews.com/control_panel_applets.cfm

New Phishing System Takes Advantage of JPEG Bug

New Phishing System Takes Advantage of JPEG Bug:
"Symantec Corp.'s Threat Analyst Team has discovered an exploit in the wild that utilizes the recently announced JPEG vulnerability in Microsoft Corp.'s GDI+ library to install a new and sophisticated phishing system.

eWEEK.com spoke with Oliver Friedrichs, senior manager of Symantec Security Response, who said the infected image is not able to attack a system from within Internet Explorer or Outlook, but only from within Windows Explorer, the file system browsing utility. Therefore, an attacker would likely need to entice a user to view the file from within the file system. Perhaps for this reason, Symantec says the spread of the attack is limited for now."

This was the most feared scenario for this vulnerability. Because of the nature of this particular attack, as a heap-based integer underflow vulnerability, implementations of the attack are likely to be specific to the application, perhaps even versions of the application, in which the image is viewed. Friedrichs says that it may not be possible to exploit the vulnerability from within Outlook or Outlook Express.

Once the user views the infected JPEG image, named ducky.jpg, the exploit code launches and downloads a file named ll.exe from the site maybeyes.biz. This file is saved as y.exe in the c:\ directory and executed. y.exe then downloads a second file from maybeyes.biz, upd.exe, and saves it as divxencoder.exe in the %SYSTEMROOT% directory (usually c:\windows) and executes it. This file then injects a DLL file embedded in it into Windows explorer.exe.

The DLL, now infecting Windows Explorer, contacts a different system on the same provider network as maybeyes.biz and downloads from it an XML-based template file. This file describes the phishing spam message to be sent from the infected system and the e-mail addresses to which it should be sent. Analysis on the DLL is not complete.…

http://www.eweek.com/article2/0,1759,1664909,00.asp?kc=ewnws100404dtx1k0000599

Monday, October 04, 2004

Skype for Pocket PC
Skype for Pocket PC is free and simple software that enables you to make free calls anywhere in the world with your handheld. Created by the people who brought you KaZaA, Skype uses innovative P2P (peer-to-peer) technology to connect you with other users. It is quick and easy to install and offers several features, including SkypeOut calling from Skype to regular and mobile phones worldwide, free conference calling, and secure file transfer. Skype calls have better sound quality than your regular phone and are highly secure with end-to-end encryption.

Publisher:Skype
Date added:September 16, 2004
License:Free
Minimum requirements:400 MHz XScale processor,WiFi-enabled
Uninstaller included?:No

http://downloads-zdnet.com.com/Remote-PC-Access/3000-7240-10319519.html?tag=list

Zombie armies behind cyberscrime sprees | Tech News on ZDNet

Zombie armies behind cyberscrime sprees Tech News on ZDNet:
"Security experts are beginning to see a pattern in cybercrimes.

According to communications firm Energis, online crime appears to be occurring in cyclical patterns related to the creation of botnets--zombie armies of PCs that have been taken control of without the owners' knowledge.
'When you see the creation of zombie networks, you can almost see the life cycle of a spam and virus attack,' said Malcom Seagrave, head of security strategy for Energis. 'It's the same with DDoS [denial-of-service] attacks and those who steal data.'
'It's almost predictable. We can't prove it, but we think they are related. They are well-organized and they are beating the security industry.'
Seagrave said combined threats, such as keystroke-logging Trojans embedded in spam, were causing serious damage to company networks.
'Some of their methods, we just can't work out,' he said. 'But the most important way to stop this is user education.' "

Botnets are readily available for hire on the Internet. According to anti-spam campaigner Steve Linford of Spamhaus, botnets are first set up for spammers to hire and then sold on--often for DDoS attacks--when they have been blocked by anti-spam firms.

Seagrave said he thought that online retailers needed to beef up their security in time for Christmas: "You'll almost certainly see a DDoS attack coming before Christmas. Retailers will have to be wary as you can expect a growth in attacks this year."

http://news.zdnet.com/2100-1009_22-5392694.html?tag=adnews


Saturday, October 02, 2004

MSN Ends Hotmail's Free Outlook Access

MSN Ends Hotmail's Free Outlook Access:
"Citing a rise in spam abuse, Microsoft Corp.'s MSN division has ended free access to its Hotmail Web-based e-mail service through the Outlook and Outlook Express clients.

MSN had offered its 187 million active Hotmail users the ability to read and send e-mail through the e-mail clients rather than a Web interface using a protocol called Web-based Distributed Authoring and Versioning, or WebDAV."

But as of Monday, news users wanting to make use of WebDAV will have to pay for the service, said Brooke Richardson, product manager for MSN's communications services. MSN plans to transition current WebDAV users to subscription plans in the next few months as well.

"We really wanted to try and keep it available to customers for free," Richardson said. "[But] in the last few months we were seeing spammers going more and more after this particular protocol."

WebDAV-based spam abuse has risen following anti-spam measures over the past year, such as enforcing a 100-message daily cap and requiring the solving of proofs to open accounts, Richardson said. The latest move targets spammers who are writing automated scripts for WebDAV to send the daily maximum amount of e-mails from multiple Hotmail accounts.

Hotmail users now will have to sign up for one of two MSN Hotmail subscriptions to gain Outlook access—either MSN Hotmail Plus for $19.95 a year or MSN Premium for $99.95 a year, Richardson said.

WebDAV is a set of HTTP extensions that allows for the reading and writing of documents through the Web. MSN Hotmail was one the few Web-based e-mail services to offer free downloading of e-mail to clients, and between 5 percent and 7 percent of users signed up for it, Richardson said.

Most other services, such as Yahoo Inc.'s Mail, include it in premium offerings and use POP3 (Post Office Protocol 3).…

http://www.eweek.com/article2/0,1759,1652391,00.asp

Friday, October 01, 2004

New Bagle Variant Raises Alarms

New Bagle Variant Raises Alarms:
"The new version is known by a variety of names: McAfee Inc. calls it Bagle.az, Trend Micro Inc. has dubbed it Bagle.AM and Symantec Corp. refers to it as Beagle.AR. All three companies have elevated the threat level for this worm because of increased submissions to their monitoring services compared with the average Bagle variant."

All the major companies offer protection against the worm. Symantec also has a removal tool http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle@mm.removal.tool.html.

Many e-mail programs, including Microsoft Outlook and Outlook Express will, in the default configuration, delete the infected executable attachment to the e-mail message in which the worm arrives.

According to Trend Micro's description http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BAGLE.AM, the message comes from a spoofed address. The subject line is either "Re: Hi!," "Re: Thank you!," or "Re: Thanks :)," and the message body is always ":))." The message comes with an attachment with a file name of "Joke" or "Price," which has an extension of either ".com," ".cpl," ".exe," or ".scr."

Once the user runs the executable, it drops a copy of itself in the user's Windows System folder and sets Windows to load it when the computer boots up.

The worm attempts to propagate by copying itself to shared folders for LANs and peer-to-peer networks, and through a conventional e-mail distribution using a built-in SMTP engine. It attempts to terminate a large number of security-related programs, such as anti-virus software.

http://www.eweek.com/article2/0,1759,1662430,00.asp

Wednesday, September 29, 2004

Security Watch Letter: Inside the JPEG Virus

Security Watch Letter: Inside the JPEG Virus:
"The end of summer lull for viruses and worms continues. We're still seeing new versions of RBots, and a new Bagle, but nothing with teeth. The big news appears to be the anticipation of a viral exploit of the JPEG vulnerability that Microsoft patched earlier this month. Within days of the release of the security bulletin, there was proof of concept code available on the web. As the exploit was analyzed by various security groups, it was found that it was similar to a four year old Netscape vulnerability reported by Openwall project.

Shortly after the initial proof of concept code was posted, some C language code was posted that would create a JPG file that starts a command prompt shell in Windows and opens a port. A hacking tool also became available that would allow anyone to create exploitable JPG files. On Monday, Easynews, a newsgroup service company reported getting the first JPG exploit virus."

Top Threat: JPEGS of Death

Executive Summary

Name: Windows GDI+ JPEG parsing vulnerability
Affects: Unpatched Windows 9x/Me/2000/XP systems, and other Microsoft Software.

What it does: Currently there is no real viral threat. A malicious JPG was reportedly found in porno newsgroups that downloads and executes a Trojan which opens a port on the victim's system if a specific JPEG file is viewed on a non-patched system. It also may crash Explorer on some systems.

How to prevent it: Apply either Windows XP SP2 update, or the MS04-028 update. Avoid downloading JPEGS from newsgroups. Update your antivirus (most if not all vendors are detecting the exploit).

Details

While no worm currently exists that uses the JPEG vulnerability, security experts are saying it is only a matter of time. For worm authors, the vulnerability may be the holy grail of infection vectors, as it can be passed through e-mail, web sites, IM, or downloaded programs. Additionally, many, many kinds of applications (and OS versions) can view JPEGS, offering innumerable paths for the malicious files. A worm with this kind of infection power could make Blaster's epidemic pale in comparison.

The first truly malicious version of the JPEG exploit showed up as a pornographic image on a newsgroup. Usenet newsgroup service Easynews.com posted an alert claiming they had found several JPEG images that, when viewed, will download a Trojan via an external FTP site. The images were found in porn newsgroups under the user name "Power-Post 2000". The alert claims that the Trojan is downloaded and executed. Currently the code does not propagate, only infecting the one machine the JPEG is viewed on. However, the Trojan could allow the victim's machine to be controlled remotely, possibly for propagation or other purposes.

Sample C source code dubbed "JPEG of death", published on K-Otik and Easynews, can be compiled to create JPEG files that create a shell (execution environment) and open and bind ports to the shell on the victim's system. Comments in the code indicate that the JPEG can also be named .BMP or .TIF and Windows will still execute the code. The comments also hint that a more dangerous worm may not be far behind.

As if the posting of C language source code isn't bad enough, iDefense reports that a utility is available to make it easier for anyone to create the files. The utility lets a hacker wannabe specify a web site, and file which is built into a specially crafted JPEG file. If the JPEG is viewed on an unpatched system, it will download and execute the file.

The vulnerability itself is a buffer overflow flaw in the JPEG parsing engine contained in the GDIPlus.DLL file. The file is used by the operating system, as well as many applications [[link to application list]]. It can be exploited by a specially crafted JPEG image. The JPEG specification allows the embedding of comments in the JPEG file. The comment sections start with a hex value of 0xFFFE to signal the start of the comment, followed by a two byte value. The value specifies the length of the comment, plus 2 bytes (for the field itself). The two byte field theoretically allows 65,533 bytes of comment data (invisible when the JPEG is viewed). If the comment field is empty, the length value must contain the minimum length, or a value of 2. (2 bytes in length). However, if a specially crafted JPEG file sets this length to a 0 or 1 (illegal values), it causes a buffer overflow condition, which overwrites memory structures in the DLL.

http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/winxpsp2.mspx

http://www.pcmag.com/print_article/0,1761,a=136159,00.asp

Tuesday, September 28, 2004

Building Websites with the ASP.NET Community Starter Kit - WebReference.com-

Building Websites with the ASP.NET Community Starter Kit - WebReference.com-:
"In this chapter from Building Websites with the ASP.NET Community Starter Kit, we illustrate how easy it is to create a a complete and functional community website from scratch with a personalized look and feel."

http://www.webreference.com/programming/asp-net-com/

Saturday, September 25, 2004

Web Development Bookmarklets

Web Development Bookmarklets:
"These bookmarklets let you see how a web page is coded without digging through the source, debug problems in web pages quickly, and experiment with CSS or JS without editing the actual page."

http://www.squarefree.com/bookmarklets/webdevel.html

Choose Your Camera

Choose Your Camera:
"Like PCs, cell phones, and cars, digital cameras come in many sizes, shapes, and configurations. And your buying decision is likewise one you'll have to live with for a while. So break the decision down into a series of factors, then compare cameras based on how well they meet your needs, factor by factor. To determine which camera is best for you, consider image quality, performance, ergonomics, and style, your level (current or hoped for) of photographic skills, and price."

http://www.pcmag.com/print_article/0,1761,a=135159,00.asp

http://www.pcmag.com/article2/0,1759,1648802,00.asp

Friday, September 24, 2004

Internet Task Force Shuts Down MARID Anti-Spam Working Group

Internet Task Force Shuts Down MARID Anti-Spam Working Group:
"Citing a lack of agreement on basic issues in the discussions of the working group, the IETF (Internet Engineering Task Force) has disbanded the MARID (MTA Authorization Records In DNS) working group. The group had been working to create a standard for mail authentication for the fight against spam, mail worms and other e-mail abuse.

The group's short history has been fraught with controversy. The most recent crisis was over intellectual property claims by Microsoft over technologies in some of standards under consideration, and the Microsoft license to those claims. Open source advocates and many others rejected the terms as burdensome and incompatible with their own licensing practices. "

But there has been more disagreement than consensus in the group in other areas as well. Advocates for similar methods of authentication have continued to argue strenuously for their favorite approaches, many of which may be covered under the claims of Microsoft in their patent applications.

There have been other problems. Recently it was noted that the name "Sender ID," which had been used by the standards documents for many of the proposals, has a trademark claim by a company that does related work.

In an e-mail to the working group, the co-Area Director Ted Hardie said that effort to formulate a single standard was hampered by a lack of real-world experience with the proposals. The directors recommended that the work of the various proponents move forward to Experimental RFC status, and that actual tests of the proposals proceed. They hope this experience will clarify some of the debates in the group.…

Questions may also be raised over potential actions by the US government. In June the FTC rejected calls to create a Do-Not-Spam registry and noted that it couldn't work without a system of authentication. The FTC report actually contemplates mandating a system of authentication if the industry doesn't agree on one after a period of time.

http://www.eweek.com/article2/0,1759,1649763,00.asp?kc=ewnws092304dtx1k0000599

Code to exploit Windows graphics flaw now public | Tech News on ZDNet

Code to exploit Windows graphics flaw now public | Tech News on ZDNet:
"A sample program hit the Internet on Wednesday, showing by example how malicious coders could compromise Windows computers by using a flaw in the handling of a widespread graphics format by Microsoft's software.

Security professionals expect the release of the program to herald a new round of attacks by viruses and Trojan horses incorporating the code to circumvent security on Windows computers that have not been updated. The flaw, in the way Microsoft's software processes JPEG graphics, could allow a program to take control of a victim's computer when the user opens a JPEG file.

'Within days, you'll likely see (attacks) using this code as a basis,' said Vincent Weafer, senior director of security response for antivirus-software company Symantec. 'This is dangerous in a sense that everyone processes JPEG files to some degree.' "

The program is the latest example of "exploit code," a sample that shows others how to create attack programs that can take advantage of a particular flaw. Such code preceded the Sasser worm by two days and the MSBlast worm by nine days.

The critical flaw the program exploits has to do with how Microsoft's operating systems and other software process the widely used JPEG image format. Because the software giant's Internet Explorer browser is vulnerable, Windows users could fall prey to an attack just by visiting a Web site that has JPEG images.

The flaw affects various versions of at least a dozen Microsoft software applications and operating systems, including Windows XP, Windows Server 2003, Office XP, Office 2003, Internet Explorer 6 Service Pack 1, Project, Visio, Picture It and Digital Image Pro. The software giant has a full list of the applications in the advisory on its Web site. Windows XP Service Pack 2, which is still being distributed to many customers' computers, is not vulnerable to the flaw.…

http://news.zdnet.com/2100-1009_22-5378260.html

Identity Theft and Spyware- The New Threat

Identity Theft and Spyware- The New Threat:
"Obviously one of the latest and most dangerous threats to privacy in the digital age lies at the doorstep of spyware. Spyware can be used to surreptitiously gather all types of confidential information and in most cases the user has no idea the information is being taken. This form of “snoopware” lets the spy access everything you do online including usernames, passwords, online shopping purchases and e-mail or chat correspondence. In the hands of an identity thief this type of information is a deadly treasure trove.

Many of today’s most popular spyware applications promise the ability to execute via “remote installation”. Remote installation is the ability to put a spyware program on a computer without having physical access to the machine. Obviously this is crossing a thin line into illegal behavior and this type of software should be classified as a Trojan horse. Nevertheless, these programs are sold every day to consumers who want to monitor their kids, employees, or spouse and perhaps to people that have more nefarious purposes in mind. While there are certainly legitimate uses for monitoring software we find it hard to believe there is any legitimate scenario where a parent or employer would need to use remote installation to install a monitoring program. Make no mistake that spyware can certainly be used to illegally obtain your personal information"

http://www.spywareguide.com/articles/identity-theft.html

Spyware Guide Database - Spyware, Malware and Adware

Spyware Guide Database - Spyware, Malware and Adware:
"The Spyware Guide was created to provide an all inclusive and updated resource on spy ware applications, what they do and how they’re used. These resources include: which software applications can detect and defeat spyware, an extensive database of all known spy software and adware applications and contact information as well as other privacy related products."

http://www.spywareguide.com/

Spychecker - download spyware removal and Internet privacy tools

Spychecker - download spyware removal and Internet privacy tools:
"Whether you are concerned about your online privacy or have suspicions that someone may be spying on your PC activities, you'll find a solution here that you can download and try, or even use it for free. All software has been downloaded and tested before it was listed."

The Spychecker Web site contains a database of applications known to have spyware attached. If you are considering installing a questionable application, try searching for the application in the Spy Checker database (powered by Spyware-Guide) to see if it contains spyware. http://www.spywareguide.com/

http://www.spychecker.com/home.html

Wednesday, September 22, 2004

Weekend Project: How to punch up your portable - CNET reviews

Weekend Project: How to punch up your portable - CNET reviews:
"The 20-year reign of sealed, proprietary laptops is nearly over. Today's mobile PCs are well on their way to becoming almost as upgradable as desktop PCs. You can often swap out everything from the memory to the CPU and, in some cases, even the graphics card--pretty much everything under the keyboard, other than the motherboard.

Not all laptop lines are equally upgrade-friendly, though, and most vendors still resist articles encouraging readers to grab their screwdrivers and muck around inside their laptops. (We're not sure whether they're worried about accidental hardware damage or lost service revenue.) In general, you'll have an easier time working on a second-tier brand, or a whitebook, because the internal components in these models are usually easier to reach and replace. "

http://reviews.cnet.com/4520-10163_7-5506183-1.html?tag=bnav

Om Malik on Broadband: The Voice over IP Insurrection

Om Malik on Broadband: The Voice over IP Insurrection:
"The $3 billion dollar budget at Bell Laboratories did not include a single project addressing the use of data networks to transport voice when VocalTec Communications released InternetPhone in February 1995. As of 2004, every project at the post-divestiture AT&T Labs and Lucent Technologies Bell Labs reflects the reality of voice over Internet Protocol. Every major incumbent carrier, and the largest cable television providers, in the United States has announced a VoIP program. And even as some upstart carriers have used VoIP to lower telephony prices dramatically, even more radical innovators threaten to lower the cost of a phone call to zero—to make it free.

The VoIP insurrection over the last decade marks a milestone in communication history no less dramatic than the arrival of the telephone in 1876. We know data networks and packetized voice will displace the long standing pre-1995 world rooted in Alexander Graham Bell's invention. It remains uncertain whether telecom's incumbent carriers and equipment makers will continue to dominate or even survive as the information technology industry absorbs voice as a simple application of the Internet.

The roots of the VoIP insurrection trace back to four synchronistic events in 1968. The Federal Communications Commission (FCC) ruled MCI could compete with AT&T using microwave transport on the Chicago to St. Louis route. The same year, the FCC's Carterfone decision forced AT&T to allow customers to attach non-Western Electric equipment, such as new telephones, and modems, to the telephone network. The Department of Defense's Advanced Research Project Agency issued a contract to Bolt Beranek and Newman for a precursor to the Internet. And in July 1968, Andrew Grove and Gordon Moore founded Intel. Innovation in the communication sector remained the proprietary right of AT&T for most the 20th century, but events in 1968 breached the barriers that kept the telecom and information technology industries apart. For the first two-thirds of the 20th century, AT&T had manned Berlin Wall separating telecommunications and computing, but eventually, these two enormous technology tracks would be unified.

Two entrepreneurs barely out of their teens, Lior Haramaty and Alon Cohen, founded VocalTec Communications in 1993 based on the promise of packet voice technology they observed as members of the Israel Defense Force. Most military command and control used the highly survivable TCP/IP distributed data networks since the 1980's. The challenge of transporting voice over the networks arose as an imperative to support certain very sensitive voice commands like "drop the bomb", but the idea of commercializing packet voice did not occur to anyone until the arrival of Lior and Alon. How could slicing voice into 50 millisecond packets improve the telephone business? The tradition bound telephone industry types or "bellheads" spent their time before 1995 improving the Public Switch Telephone Network (PSTN) not replacing it."

http://www.gigaom.com/2004/09/the_voice_over_i.php

RSS Comes with Bandwidth Price Tag

RSS Comes with Bandwidth Price Tag:
"Popularity comes with price, as Web publishers of XML syndication feeds are learning the hard way.

According to feed publishers, as the use of Really Simple Syndication news feeds grows so too does the bandwidth they consume and the demands they put on Web servers. Some Weblogs and technology Web sites are rethinking the way they publish their RSS feeds as they find that frequent requests from newsreaders, the applications that aggregate feeds, can strain their resources."

http://www.eweek.com/article2/0,1759,1648627,00.asp?kc=ewnws092104dtx1k0000599

Tuesday, September 21, 2004

Overview - Windows NT 4.0 and Windows 98 Threat Mitigation

Overview - Windows NT 4.0 and Windows 98 Threat Mitigation:
"This guide identifies security issues in networks that include computers running the Microsoft® Windows NT® 4.0 and Windows® 98 operating systems, and explains the best hardening strategies that an organization can use until they are able to upgrade these operating systems."

http://www.microsoft.com/technet/security/guidance/threatmi.mspx

Open Source Security: Still a Myth

Open Source Security: Still a Myth:
“by John Viega

Does the open source process guarantee better security than proprietary development methods do? Not necessarily, warns John Viega. There are several security challenges facing open source software that many developers have so far failed to recognize.”


“In the real world, it's rare that someone reviewing code for security will perform a thorough audit. Line-by-line review is often not feasible, simply because the human mind can't retain a detailed understanding of a large code base. Generally, people have tools to support them. Those tools are a starting point for manual inspection, which focuses on the findings of the tool and looks to see whether there's actually anything to the problem.

"Real" analysis tools are just starting to hit the market. The tools people use tend to be simple ones that don't do sophisticated analysis--grep-like tools such as RATS and flawfinder. A few commercial companies offer "web scanners" that look for common vulnerabilities in an application using a fuzz-like approach (you pick the inputs you think might exercise a common problem, give it a go, and see what happens). The problem with black-box testing for security is that most programs are complex and have states that an automated crawler isn't likely to find. Security problems are often buried in complex systems. Finding them with such an approach would require heavy user interaction to put the system into a large number of different states.

With both the grep-like tools and the black-box testing tools, you will almost always have a large number of false positives to sift through. Most potential auditors throw up their hands in frustration pretty quickly. Those who don't will usually focus on only a few of the reported issues. Even research tools such as BOON tend to have incredibly high false-positive rates.”

The Myth of Open Source Security , http://www.developer.com/tech/article.php/626641

Why Open Source Software/Free Software? Look at the Numbers! , http://www.dwheeler.com/oss_fs_why.html

http://www.onlamp.com/pub/a/security/2004/09/16/open_source_security_myths.html

Download details: Application Compatibility Guide for Windows XP SP 2

Download details: Application Compatibility Guide for Windows XP SP 2:
"Windows® XP SP2 introduces new security technologies to better enable Windows XP computers to withstand viruses, worms and other kinds of attacks. This guide will assist IT Professionals to test and mitigate application compatibility issues arising from these more stringent security technologies."

Microsoft® Windows® XP Service Pack 2 (SP2) introduces a set of security technologies that improve the ability of Windows XP systems to withstand malicious attacks, and provides the IT administrator with system wide security configuration capabilities.

SP2 is more secure by default, and thus automatically provides Windows XP systems with improved protection. However, because system security becomes more restrictive upon initial installation, SP2 may also expose application compatibility issues. It is important that an investigation into possible application compatibility issues takes place prior to full deployment.

This guidance discusses the security technologies, an application testing process, incompatibility symptoms, mitigation techniques, and deployment scenarios. It makes no assumption about the size or complexity of the network, and is as relevant to peer-to-peer environments as it is to Active Directory environments.

File Name:

AppCompat-XPSP2.msi

Download Size:

2956 KB

Date Published:

8/25/2004

Version:

1.0


http://www.microsoft.com/downloads/details.aspx?familyid=9300becf-2dee-4772-add9-ad0eaf89c4a7&displaylang=en

Visual Web Developer 2005 Express Edition Beta

Visual Web Developer 2005 Express Edition Beta:
"Visual Web Developer 2005 Express Edition is a lightweight, easy-to-use and easy-to-learn development tool focused exclusively on Web development. Inside, you will find everything you need to begin building exciting, dynamic Web applications with ASP.NET 2.0. "

Visual Web Developer 2005 Express Edition provides everything you need to begin building Web applications with ASP.NET 2.0. It provides:
  • Visual designers that make creating Web applications easy via an easy-to-use drag-and-drop interface
  • Powerful code editor with rich functionality such as IntelliSense that makes writing code and HTML faster
  • Quickly create data-driven Web applications using the built-in data controls and integrated access to Microsoft SQL Server 2005 Express
  • Support for multiple languages, including Visual Basic, C#, and J#
  • Get started using the built-in, fully functional starter kits like the Personal Web Starter Kit

Simple management

Create your applications in Visual Web Developer 2005 Express Edition, and then easily deploy using the built-in Copy Web tool that streamlines the process. Visual Web Developer 2005 Express Edition includes support for creating and consuming Web services, validating applications across multiple browsers, and easily running and debugging your code using the built-in test Web server, without having to have access to IIS.

Personal Web Starter Kit
Inside Visual Web Developer 2005 Express Edition is the Personal Web Starter Kit , a fully functional sample application that will help you get up and running quickly. This Starter Kit provides all the basic functionality you need to build your own personal Web site, including a balanced and customizable look and feel, a Web-based administration system, rich photo gallery, membership, role management, and more.
http://lab.msdn.microsoft.com/express/vwd/starterkit/default.aspx

http://lab.msdn.microsoft.com/express/vwd/default.aspx

Saturday, September 18, 2004

How to Handle Copyright Infringement Found by the Search Engines

How to Handle Copyright Infringement Found by the Search Engines:
"
  1. Take screen captures of the pages
  2. Download Google/Yahoo/SE cache as proof (if available)
  3. Document whois information and figure out who the ISP is
  4. Call or Email the number (if any) listed on the contact us page
  5. If no response in a few days, send an email to the ISP with the subject Digital Millennium Copyright Act Copyright Infringement with the proof listed above. I ask them to take down the pages that were stolen, providing the file names and paths.
  6. Send email/fax to the search engines
    - Google's DMCA
    - Yahoo's Copyright Infringement & Yahoo's Page Deletion Process
    - Ask Jeeves TOS, scroll down and you will see 'Copyrights and Copyright Agent' section with a form."

http://www.seroundtable.com/archives/000826.html

Serious Kerberos flaws affect Cisco and Mac, but not Windows

Serious Kerberos flaws affect Cisco and Mac, but not Windows:
"MIT's Kerberos authentication utility has been found to have some serious vulnerabilities. Windows is not affected, but other widely used products from Cisco and Apple are definitely vulnerable, as are many third-party applications that rely on Kerberos 5."

http://techrepublic.com.com/5100-6264-5366280.html

Friday, September 17, 2004

Don't get phished again: Check trustwatch.com | Tech News on ZDNet

Don't get phished again: Check trustwatch.com | Tech News on ZDNet:
"Noting that businesses lost close to $50 billion in 2003 as a result of covering the costs of identity theft, GeoTrust on Monday made available a free domain-verification service that consumers can use to check the security and trustworthiness of Web sites.

Before providing a credit card number, personal identification information or other confidential data to a Web site, a consumer can use the TrustWatch service to check that the site has been verified by a trusted third party and is using appropriate safeguarding measures.

Typing a Web site address or domain name into a search box on the TrustWatch site will return a confidence rating based on GeoTrust's data about that site. "


http://news.zdnet.com/2110-3513_22-5367650.html

Thursday, September 16, 2004

Add clickable icons to your links

Add clickable icons to your links:
"When you're working with CSS, sometimes the obvious technique doesn't produce the effect you might expect or desire. Fortunately, there's a good chance that you can achieve the effect you want if you're willing to look beyond the obvious and try other methods. "

http://builder.com.com/5100-6371_14-5354381.html?tag=e601

Major graphics flaw threatens non XP SP2 Windows PCs | Tech News on ZDNet

Major graphics flaw threatens non XP SP2 Windows PCs | Tech News on ZDNet:
"The critical flaw has to do with how Microsoft's operating systems and other software process the widely used JPEG image format and could let attackers create an image file that would run a malicious program on a victim's computer as soon as the file is viewed. Because the software giant's Internet Explorer browser is vulnerable, Windows users could fall prey to an attack just by visiting a Web site that has affected images.…"

"The potential is very high for an attack," said Craig Schmugar, virus research manager for security software company McAfee. "But that said, we haven't seen any proof-of-concept code yet." Such code illustrates how to abuse flaws and generally appears soon after a software maker publishes a patch for one of its products.

The flaw affects various versions of at least a dozen Microsoft software applications and operating systems, including Windows XP, Windows Server 2003, Office XP, Office 2003, Internet Explorer 6 Service Pack 1, Project, Visio, Picture It and Digital Image Pro. The software giant has a full list of affected applications in the advisory on its Web site. Windows XP Service Pack 2, which is still being distributed to many customers' computers, is not vulnerable to the flaw.…

http://news.zdnet.com/2100-1009_22-5366314.html

Windows XP Security Guide Overview

Windows XP Security Guide Overview:
"The Windows® XP Security Guide v2.0 describes the features and recommended settings for Microsoft Windows XP Service Pack 2 (SP2). The Guide includes thoroughly tested templates for security settings for Windows Firewall, which replaces Internet Connection Firewall (ICF). Information is provided about closing ports, Remote Procedure Call (RPC) communications, memory protection, e-mail handling, Web download controls, spyware controls, and much more."

In addition to describing the features and recommended settings for Windows XP
SP2, this guide includes thoroughly tested templates for security settings for
Windows Firewall, which replaces Internet Connection Firewall.

http://www.microsoft.com/technet/security/prodtech/winclnt/secwinxp/default.mspx

The Great Debates: Pass Phrases vs. Passwords. Part 1 of 3

The Great Debates: Pass Phrases vs. Passwords. Part 1 of 3:
"Information security fosters some interesting debates. The issues range in importance, but they all demonstrate that the field is still growing and exciting. I would like to summarize some of these debates, and offer my own partial entries. For the first set of these articles, I will enter the passwords fray and address the issue of pass phrases versus passwords."

OK, maybe “pass phrases versus passwords” is really “the other great debate” or the “kind of boring and few people care” debate. In any case, which is more secure, pass phrases or passwords? The answer is not as clear-cut as it may seem.…

http://www.microsoft.com/technet/security/secnews/articles/itproviewpoint091004.mspx

Download details: Visual Basic and C# Code Samples

Download details: Visual Basic and C# Code Samples:
"This download includes a master set of Visual Basic and Visual C# code samples demonstrating various aspects of the language in the following areas: syntax, data access, Windows Forms, Web development and Web services, XML, security, the .NET Framework, file system and file I/O, interop and migration issues, COM , ADO.NET, and advanced topics including graphics with GDI , remoting, serialization, MSMQ, and Windows services."

Download Size: 6578 KB - 13400 KB
Date Published: 3/11/2004
Version: 7.1

CSharp.msi 6578KB
http://download.microsoft.com/download/6/4/7/6474467e-b2b7-40ea-a478-1d3296e78adf/CSharp.msi
VisualBasic.msi 6822KB
http://download.microsoft.com/download/6/4/7/6474467e-b2b7-40ea-a478-1d3296e78adf/VisualBasic.msi


http://www.microsoft.com/downloads/details.aspx?FamilyId=08E3D5F8-033D-420B-A3B1-3074505C03F3&displaylang=en

Wednesday, September 15, 2004

Deploying Windows Firewall Settings for Microsoft Windows XP with Service Pack 2

Download details: Deploying Windows Firewall Settings for Microsoft Windows XP with Service Pack 2:
"Windows XP Service Pack 2 (SP2) includes the Windows Firewall, a replacement for the Internet Connection Firewall (ICF) in previous versions of Windows XP. Windows Firewall is a stateful host-based firewall that discards unsolicited incoming traffic, providing a level of protection for computers against malicious users or programs. To provide better protection for computers connected to any kind of network (such as the Internet, a home network, or an organization network), Windows XP SP2 enables Windows Firewall on all network connections by default. This new behavior can impair some types of communications. This article describes how to deploy the appropriate configuration settings for Windows Firewall on an organization network so that it is enabled and providing protection, and so that communications are not impaired."

File Name:

WF_XPSP2.doc

Download Size:

942 KB

Date Published:

8/12/2004

Version:

2.4


Manually Configuring Windows Firewall in Windows XP Service Pack 2
http://go.microsoft.com/?linkid=664515

http://www.microsoft.com/downloads/details.aspx?FamilyID=4454e0e1-61fa-447a-bdcd-499f73a637d1&displaylang=en

Saturday, September 11, 2004

Windows XP Service Pack 2 Resources for IT Professionals

Windows XP Service Pack 2 Resources for IT Professionals

Explore the new features of Windows XP SP2 and find out what makes it a worthwhile update.

Get information on planning, testing, installing, application compatibility, and configuring your network.


Get details on managing Windows Firewall, controlling users’ access to the Internet, and using Group Policy.


Download and Deploy Service Pack 2 to Multiple Computers


Download and Install Service Pack 2 on a Single Computer

Order the Service Pack on CD


http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/winxpsp2.mspx

New MyDoom Variants Could Forewarn Major Attack

New MyDoom Variants Could Forewarn Major Attack:
"The arrival of four new variants of the MyDoom worm within the last 24 hours has anti-virus experts worried that the virus creator may be preparing to release a major onslaught."

On Thursday afternoon, MyDoom.U, V, W and X all appeared within a couple of hours of one another. None of the variants is particularly worrisome or innovative on its own, but taken as a whole, the release of four versions so close together is of some concern, experts said. The last time so many variants of one virus were released in such a short period of time was in July when four minor versions of the Bagle virus emerged, followed by a major new strain. http://www.eweek.com/article2/0,1759,1624970,00.asp

Anti-virus researchers say the MyDoom author could be following a similar pattern.

"The last time this happened was with Bagle, and the next one was a big one," said Sam Curry, vice president of the eTrust Security division at Computer Associates International Inc., in Islandia, N.Y. "Plus, we're getting close to the end of the alphabet and a lot of times the Z and AA variants have some extra impact."

Curry also noted that with the third anniversary of the Sept. 11 terrorist attacks coming up Saturday, virus writers may be looking to make a splash.

http://www.eweek.com/article2/0,1759,1644713,00.asp


Friday, September 10, 2004

Using special characters as typographic niceties

Using special characters as typographic niceties:
"Using special characters on Web pages
Generally speaking, you can use any of the characters that appear on the standard computer keyboard in the text of your Web page. The only exceptions are the ampersand (&), less than (<), and greater than (>) symbols, which have special meaning in HTML/XHTML code and are reserved for that use.

The standard keyboard characters are only a limited subset of the characters available. There are many other special-purpose characters available in the extended character set of most fonts, including accented letters, math symbols, and an assortment of punctuation characters and symbols.

In order to use one of the reserved symbols (&, <, >) or an extended character in a Web page, you must use an escape sequence, which is a sequence of characters that forms a special code instructing the browser to render the character identified by the code instead of the individual characters that make up the code. "

http://builder.com.com/5100-6371_14-5341208.html?tag=e601

Thursday, September 09, 2004

The Search Engine Report - Number 94

The Search Engine Report - Number 94:
"In This Issue

Search Engine Milestones for August 2004
SearchDay, Sept. 1, 2004
http://www.searchenginewatch.com/searchday/article.php/3402251

Everything You Ever Wanted to Know About URL
SearchDay, Aug. 24, 2004
http://www.searchenginewatch.com/searchday/article.php/3398511

http://searchenginewatch.com/sereport/article.php/3405411

Microsoft Sets a New Deadline for XP Service Pack 2

Microsoft Sets a New Deadline for XP Service Pack 2:
"On Tuesday, Microsoft began notifying customers that it has established new deadlines regarding how long they will be able to block Windows XP Service Pack 2 (SP2) from downloading automatically to their systems.

Microsoft made available to customers in August a couple of different tools to temporarily disable the delivery of SP21 to users machines via its Windows Update/Automatic Update patching services. A number of customers had requested these tools, claiming they were not ready to take delivery of SP2, as they had not tested SP2 adequately to make sure it did not break their applications."

this deadline to 240 days, or eight months, from August 16. As a result, Microsoft will now begin pushing SP2 to all Windows XP and Windows XP Service Pack 1 customers automatically via Windows Update and Automatic Update as of April 12, 2005.

Microsoft noted the change in its patch-blocking dates2 on its TechNet IT portal Web site, as well as in a note it sent to corporate customers via e-mail.

Microsoft released SP2 to manufacturing on August 6 and has been rolling it out in stages to its various XP customer bases over the past month.

Even though Microsoft has deemed SP2 a "critical" update, some corporate and home users have been leery to install it. Microsoft has acknowledged that a number of applications, including several of its own3, do not work properly with SP2 unless certain settings are changed. And a number of third-party hardware and software vendors still have yet to provide patches and updates to their products that will allow them to work with SP2.

1. http://www.microsoft-watch.com/article2/0,1995,1639208,00.asp

2. http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2aumng.mspx

3. http://www.microsoft-watch.com/article2/0,1995,1636071,00.asp

http://www.microsoft-watch.com/article2/0,1995,1643925,00.asp

Wednesday, September 08, 2004

Building a Wi-Fi Antenna Out of a Tin Can

Building a Wi-Fi Antenna Out of a Tin Can:
"While there are many commercial antennas available on the market today, they can be expensive. And hey, let's face it, attaching a commercial antenna to your Wi-Fi network will not turn heads like making your own will.

There are several different types of antennas that you can build. The most famous Wi-Fi antennas are made from either a coffee can or a Pringles potato chip can. In this chapter you learn how to build your own antenna from a regular, metal coffee can. You will be able to build it quickly and cheaply. As an added bonus, you will have lots of coffee which will come in handy in staying awake for the other projects in this book."

http://www.extremetech.com/print_article/0,1583,a=134389,00.asp

PC Magazine Feature: External Storage: Little Big Drives

PC Magazine Feature: External Storage: Little Big Drives:
"Backup has gotten personal: Small drives that match your lifestyle have changed the face of storage and backup. Add-in drives are out of the question now that notebooks are steadily replacing desktops. Fast interfaces such as USB 2.0 and FireWire have made plug-and-play external drives practical, and skyrocketing capacity and plummeting costs have made them affordable.

The files you're storing have changed, too. You're more likely to need room for your digital photos, gigabytes of music, Web site backup, or video-editing projects. IDE drives have become orders of magnitude more reliable in recent years, so the emphasis in backup has moved from generational data sets and disaster recovery to a clean working copy of your hard drive."

http://www.pcmag.com/article2/0,1759,1639442,00.asp

Saturday, September 04, 2004

Register for the Microsoft Security Newsletter for Home Users

Register for the Microsoft Security Newsletter for Home Users:
"This newsletter provides practical security tips, topical security guidance, useful resources and links, pointers to helpful community resources, and a forum for you to provide feedback and ask security-related questions.

Available in text and HTML formats, the newsletter is a convenient way for you to stay up-to-date on the latest issues, insights, and events surrounding Microsoft"

http://www.microsoft.com/athome/security/secnews/default.mspx

Friday, September 03, 2004

Windows XP won't boot after installing SP2 – a BIOS update may be necessary

Windows XP won't boot after installing SP2 – a BIOS update may be necessary:
"Installing Microsoft Windows XP Service Pack 2 on a PC with a 'Prescott' CPU and certain chip sets can cause it to fail to reboot completely. The problem can be solved with a workaround or a BIOS update. "

Depending on the chipset, motherboard manufacturer, BIOS version, and CPU, installing Microsoft Windows XP Service Pack 2 can result in an unbootable computer system. The problem is generally associated with Intel "Prescott" CPUs and its chipsets, but not every such combination will cause a problem. As of this writing, motherboards exhibiting the behavior include:

Albatron PX865 PE Pro
Shuttle SB61G2
Jetway i875P
Soyo P4I865P
Aopen AX4SG Max
Asus P4P800-E deluxe
Abit IS7-V
Foxconn 865A01-G-6EKRS


Technically speaking, the problem revolves around the machine's BIOS not installing a production level microcode update. To check whether the BIOS is at the correct level, download the Intel Processor Frequency ID utility. The microcode version is identified by this utility as CPU Revision, which should equal at least 8.

http://techrepublic.com.com/5100-6268_11-5330486.html?tag=fdnew

Thursday, September 02, 2004

Kerberos Flaws Allow Access to Protected Networks

Kerberos Flaws Allow Access to Protected Networks:
"The Massachusetts Institute of Technology has disclosed a number of serious security flaws in the Kerberos v5 authentication system, the worst of which could give unauthorized users access to protected corporate networks. "

http://www.eweek.com/article2/0,1759,1641644,00.asp?kc=ewnws090104dtx1k0000599