Posts by Doug

Before the infection ?

How do you actually get 'infected', is there a working demo online where I can get infected by clicking on a URL ?

> "Before the infection, a default installation of Firefox 3.6.10 would prompt the user after the user clicks the Log In button on a Web page, asking whether he or she wants to save the password," Webroot researcher Andrew Brandt explains. "After the infection, the browser simply saves all login credentials locally, and doesn’t prompt the user."

software applications security

What OS do the vast majority of these bad-apps run on and shouldn't security be built into the Operating System.

re: Rock < User > Hardplace #

> In my personal pantheon of nastiness Google sits even higher the MS. I can't see why anybody would want to install a Google plugin on an MS browser.

Troll the web, and trash anything Google ;)

less is more

It isn't a only a choice between KDE and Gnome ..

http://en.wikipedia.org/wiki/Lubuntu

Chrome Psychedelic at 565

I have Chrome Psychedelic running at 565 on Lubunto running off a USB device ..

http://img831.imageshack.us/img831/8916/iepsychedelic.jpg

http://ie.microsoft.com/testdrive/

infected with malware ?

> Only jailbroken iPhones with default passwords have ever been infected with malware and even then only by a handful of high-profile worms, such as the Rickrolling worm in Australia and the D'oh bank credential stealing worm in the Netherlands, which both spread last November ..

Like, how did the Rickrolling and D'oh worms get onto the machines without using jailbroken iPhones and default passwords, and without any user action ?

computer botnets

What desktop Operating System is required for this 'botnet' to operate. How is the initial infection achieved on the computers. Is it by clicking on a malicious URL or opening an email attachment.

satire not noticed

> Sadly, Cartmel admitted the satire went completely unnoticed. He said: "Critics, media pundits and politicians certainly didn't pick up on what we were doing. If we had generated controversy and become a cause célèbre we would have got a few more viewers but, sadly, nobody really noticed or cared."

That's not strictly true, one of the best things about the series was the intelligent scripts aimed at the more mature audience. 'The Sun Makers' being another good example, where the entire solar system is privatised by the company. If the politicians didn't get it, we most certainly did.

The Collector of taxes being a sentient poisonous fungus type creature from the planet Usurius., Usurious, Usery .. get it .. eh ??

http://www.dailymotion.com/video/x9e91e_the-sun-makers-part-2_shortfilms

http://www.drwhoguide.com/who_4w.htm

root achieved on cellular devices

"Security researchers have turned their attention to femtocells, and have discovered that gaining root on the tiny mobile base stations isn't as hard as one might hope"

Whoever designed these devices should be sent back to computer school. An authentication device that can be bypassed is a contradiction in terms. Or as some pen pusher would put it in a report: an unantipicate security excursion. Did not anyone check these devices for security vulnerabilities. What are they teaching them in college nowadays ?

"Uh you've reached stewie and brian, we're not here right now, uh and if this is mom, uh send money because we're college students and we need money for books...and highlighters...and.... ramen noodles...and condoms, for sexual relations with our classmates"

a working demo

Is there a link to a working demo ?

user names and passwords

"A spokeswoman for Demon said the company had changed the passwords which were sent out and was in the process of changing user names too"

What were they doing storing passwords in the clear in the first place. What were they doing emailing this document around the company.

Microsoft patents and the OIN

This ..

"Microsoft has placed a clutch of Silicon Graphics patents in the hands of those trying to defend Linux and open-source against trolls"

Does not equate to this ..

"Microsoft didn't directly approach the OIN - one of the industry's largest buyers of patents - and went through the AST instead"

And there is no evidence that MS intended the patents to end up in the hands of the OIN

flaws in the program ?

"Flaws in the program are routinely exploited by criminals to install keyloggers and other malicious software on end-user machines"

Shouldn't that be flaws in the underlying platform allow for the installation of malicious software. That platform invariably being the WinTEL one. The one with the built-in buffer overflow feeture ?

disable USB drive for security

"After all the lost data from government departments WTF was the counsel employee doing with a USB stick in the first place", John G Imrie

Look, the presence or absence of a USB drive does nothing what-so-ever to increase/decrease security. If I can get you to visit a certain web site or open a certain attachment, I can own your computer ...

the website reflects poorly on Parliament ?

No, the website reflects poorly on the people who designed and configured the web site. What are their names again?, just so as we can avoid them ...

the end of the world as we know it

Won't the entire worlds economy grind to a halt if they ban msWord in sixty days?

W32/Induc-A virus being spread by Microsoft software

| headline corrected |

'When a file infected with W32/Induc-A runs, it looks to see if it can find a Delphi installation on the current machine. If it finds one, it tries to write malicious code to SysConst.pas'

Does the original W32/Induc-A require administrator rights to infect the machine. Is SysConst.pas normally required to be writable by administrator. Notice how they managed to not one mention Windows in the body of that 'report'.

<insert payload>

"W32/Induc-A virus being spread by Delphi software houses"

"If you believe that you may be using software written in Delphi you would be very wise to ensure that your anti-virus software is updated. Actually, regardless of whether you use Delphi-written apps that's a good idea"

</insert payload>

OpenSUSE support forum

I used to be an Open SuSE enthusiast but dropped out because of the very low activity on the forum. That, and they barred me for asking questions about the covenant with Microsoft. The one that says you can't even work on OpenSUSE in your own companies time. And you don't own your own code contributions. Now, I'm a Ubuntu enthusiast.

<a href ="http://i25.tinypic.com/2prisyg.jpg">Slashdot Advert</a>

insert GPL fud

"The spirit of the GPL, and its purpose, were pretty straightforward and in my view honourable. But beware - it's more than it looks. Large companies can use it to harrass small ones. Small ones can use it to harrass large ones", David Coveney

The 'spirit' of the GPL is hardly the issue as the terms have been explicidly laid down in the actual text of the license. What large/small companies harrass other small/large companies. Please point out where actual harrass took place rather than the requirement that the terms of the GPL be adhered to. GPL 3 was specifically designed to prevent anyone coming after you for patent royalties ..

http://www.gnu.org/copyleft/gpl.html

http://www.gnu.org/licenses/gpl-2.0.html

the root of the problem is the OS

Wouldn't it be simpler to design on OS that is immune to defects in the applications that run on top of it.

don't work on Firefox

Don't work on Firefox 3.5.1

insert bogus personal anecdote

"Until someone can come up with a way to stop employees from working against their companies, just so they can spend their working days goofing around on Facebook and Twitter"

You're kidding, since when were people allowed to twitter on NHS patent record systems. Any evidence to the contrary?

" I work for a company that works very closely with the NHS .. A patient faking illness just pops it in lets the malware off " SNORT !!!

Chrome OS - a vanity project ?

> The idea of a desktop running a thin OS served by the cloud is fine - until you want to do image processing, or make music or videos .. Linux is a fine OS until you get to the applications - ah, yes... GIMP - and integration with the real-world,doing stuff your Mum needs to do.

Your Mum must be way cleverer than mine if she can do image processing, or make music videos videos. For most people the browser is the PC and a quick perusal of the specs tells us that Chrome OS does a lot more. Given that a number of hardware manufacturers have climbed on board, Chrome OS will make the desktop obsolete.

> Linux is a fine OS until you get to the applications - ah, yes... GIMP

Andrew, what planet have you been living on up to recently. Here are some Linux systems sophisticated enough for even your Mom to find interesting.

http://www.youtube.com/watch?v=Yx9FgLr9oTk

http://www.youtube.com/watch?v=Cz_2vKq5cZk&

http://www.youtube.com/watch?v=JQgPt0NsPJ4

patent promise is *NOT* conveyed

"Microsoft is promising not to pursue patent claims against Linux and open-source software using the open-source implementation of .NET, Project Mono"

Except the do-not-sue promise is *not* passed on to downstream customers using the Open Source project Mono !!

re: How long does it take some people to learn? #

"McAffee has been a terrible product for many years", Henry 9

What doesn't it do different than the others apart from scanning files for known patterns ?

the politicians were clearly ill advised

@AC2 'the politicians were clearly ill advised'

No, the politicians concocted a fake dossier and pretended to believe it. As a pretext to invading Iraq. Which they had no choice in doing. At least the ones in this little ole US colony.

changes cause problems

'You make a small innocuous change to a minor component and something you thought was totally unconnected falls over. That's the nature of the game', Richard Porter

No it isn't, it's the nature of a badly designed agile Web 11 thingy .. :)

open source hard to implement fud

"if you have something that by its very nature...is very complex with many roles and the way you configure it...then you need open source to have many instances of it because no one will be able to do an independent implementation of it"

They speak a different language out there in Redmond, microspeak, where 'open source' and publically documented standards mean the exact opposite.

it isn't about the desktop !!!

"Doing that general purpose operating system is a nightmare, and you lose your shirt on it," Smith explains. "At the end of the day, you have to do something that puts rice in the bowl", Jordan Smith Xandros

It isn't about the desktop, it never was, it was always about getting control of the customer experience. The battle for the desktop was fought and won, by Microsoft, a long time ago. MS, always late to the party, recognizes this, which is why it is moving to services based round the xbox and 'the cloud'. They realize that if you don't control the total stack, from the desktop to the server, then you're just the delivery people. Which is why Apple making money out of the iTunes on Windows is total anathema at Redmond. How dare Apple make a buck out of the Microsoft Desktop without paying the MS tax.

Digital Video Recorders, set-top boxes, subscription services and 'other tiny computing devices' will sell, but the real money is in subscription services. As long as the consumers are using your devices, else you're just the delivery people.

sophisticated Defense Department tools

"The hacks are troubling in that they appear to have rendered useless supposedly sophisticated Defense Department tools and procedures designed to prevent such breaches. The department and its branches spend millions of dollars each year on pricey security and antivirus software and employ legions of experts to deploy and manage the tools"

No amount of tacked-on 'security' will secure 'webservers'. What is needed is embedded hardware providing a secure VPN and PKI infrastructure. That way you only have a single set of nodes to watch instead of multiple/differing Windows configurations. That way if a 'webservers' is vulnerable to an 'SQL injection attack', the hackers won't see it. Else you expend energy in futile solution such as above.

pool overruns ?

I hadn't heard the term before, and I do try and keep up. Are there any actual examples of 'pool overruns', in the public domain, that can be successfully run on OS X and Linux

"Independent Security Evaluators has successfully exploited weaknesses in Windows, OS X and Linux. "I think they're trying to stay ahead of the curve"

“This simple check blocks the most common exploit technique for pool overruns,”

http://www.ditii.com/2009/05/28/microsoft-fortified-windows-7-kernel-with-safe-unlinking-overrun-buster/

Like, where and how did MS come out with a fix so quickly and why not design a MMU that isn't vulnerable to 'pool overruns' rather than havign to check for them, after the fact.

"It doesn't mean pool overruns are impossible to exploit, but it significantly increases the work for an attacker."

ex-commies would be pro-BNP

> Griffin writes that the "BNP website [was] taken offline in largest cyber attack in recorded history" .. The email .. claims that the assault originated from "eastern Europe and Russia" and was also directed against Clear Channel, a firm which reportedly provides billboard advertising to the BNP, as well as the party website.

I would have thought that the ex-commies would be pro-BNP as they would tend to undermine the current blair-bushite regime. Besides can we really believe him. A borked upgrade over the weekend being more likely.

I have personal knowledge of two such incidents. One was blamed on some fascist regime far-far-away. The other caused free long distance mobile calls for the entire weekend. They were both down to a flakey system, failed upgrades and incompetent staff.

tree style tabs

This is good, now I would like the tab menu to disappear until I move the mouse to the left of the screen ..

-------

"I use tree style tabs, It changes the tab layout to a tree style (hence the name), very good for using loads of tabs on a widescreen monitor"

By Anonymous Coward Posted Saturday 16th May 2009 06:59 GMT

The Safe C Library

"The Safe C Library provides bound checking memory and string functions per ISO/IEC TR24731. These functions are alternative functions to the existing Standard C Library"

See safe_lib.h .. of Dr. Dobbs Feb 2009

http://www.ddj.com/cpp/214502214

This reminds me of when Microsoft patented SUDO ..

http://taint.org/2004/08/20/024522a.html

scrapped last year for undisclosed reasons"

"SCOPE .. was scrapped last year for undisclosed reasons"

Conflicker Worm Invades Hospital Instruments

http://crackerboy.us/2009/04/30/conflicker-worm-invades-hospital-instruments/

"Various Royal Navy warships and Royal Navy submarines, and hospitals across the city of Sheffield turned to be down under Conflicker’s attack"

http://downadups.wordpress.com/

"ATM virus that steals money from banks"

http://www.zeenews.com/news518262.html

Novell contributing code from openSUSE

Which begs the question as to why they didn't create their own Moblin type project and launched that on the low-powered mobile market, instead of advertising their competitors products on their own web site !

the solution is obvious

Create a network of VPN nodes with multiple redundan routes, that utilize end-to-end encryption and authentication and connect your 'computers' to that. Now don't tell how/why it can't be done, tell me how it can be !

"when hackers took control of Federal Aviation Administration computers in Alaska. By exploiting the administration's interconnected networks"

"Two separate attacks in 2006 hit the FAA's remote maintenance monitoring system and its air traffic control systems. The latter forced the FAA to shut down a portion of ATC systems in Alaska"

"The report went on to fault the FAA for employing woefully inadequate IDS, or intrusion detection systems. .. none of the IDS sensors monitor mission critical ATC operation systems"

One would be wrong

"One would think that a setup like this would run up its generators every few days to check all was well with the engine, alternator and transformers etc. and note if the damn thing works properly", rhydian

One would be more accurate to speculate that the maintenece was outsourced to a company that hired another company that outsourced to another company that hired on cheap east european contract labor. At least that's the way they do it round here.

why Microsoft objects ..

The reason why Microsoft objects is that they invented 'cloud computing' :)

Not Microsoft's problem?

"I for one can't see why they should be obliged to ignore IP violation (if that is genuinely what has occurred here) simply because the other party *chose* to use Linux", anonymous coward

Tom Tom uses third party and GPL software in its products. Neither of which are owned by Microsoft. Therefore it owes nothing, nada, zilch to Redmond ..