Slashdot Mirror

A web app lives and dies on the whim of the developer, which can go bankrupt or be DDoS'd out of existence overnight

So do some kinds of native app if they can no longer connect to the developer's server that provides user license verification, communication with other users, or communication with your other devices running the same app. Examples include applications in Adobe Creative Cloud (once your subscription expires or once Adobe stops offering a particular application), MSN Messenger (which was shut down in favor of Skype), and the "Copy" file sync client (which was discontinued), respectively. Another example is any game for the original Xbox (2001) that uses Xbox Live.

After all, how many people run an web browser offline?

The goal of things like Service Workers is to make this practical. Google has lately been promoting "Progressive Web Apps".

https://techlib.barracuda.com/...

You can't change the keys, so if you want to use SSHFS to backup systems that aren't agent supported, you've potentially given root access to anyone who's extracted the private key from the appliance (and leaked it to the internet). I wouldn't be surprised if the agents used the same craptastic cryptographic fail.

I've investigated a half dozen or so of these. It has been going on for a while; the first one I saw was about a year ago.

Some of the common characteristics:

They know the names, email addresses, and nicknames of the CEO, and the Treasurer and/or Controller.

They address the Controller by name, a little bit of social pleasantries, and often say what account the "expenditure" should be coded to. The first contact is pleasant, but says it's urgent, and needs to be done right away. Subsequent emails get progresively more demanding.

Early ones asked for the wire transfer to go to a bank in Shanghai, Singapore, or something. More recent ones are transfers to an indivdual's account in a U.S. bank. (Doubtless belonging to some poor gullible person who answered one of those "Well Paid Part Time Job Working From Home as a Financial Agent" spams.)

Registering a .co domain to spoof a .com is popular, as are various other typosquatting tricks. Some cheapskate crooks just use a hotmail-type Reply-To, though.

If the victim sends the money, another request will follow. Then another, and another, as long as they'll keep doing it.

From last September: http://blog.barracuda.com/2014...

https://techlib.barracuda.com/... About 2-3 dozen customers a week are setting this up.

Can work through their or standalone web service. They also have just about the best customer service of any company I have ever worked with.

https://www.barracuda.com/products/emailsecurityservice

They do publish source. On that page, I found a link to the complete source of their Linux distribution.