Slashdot Mirror

SecurityFocus published an interview with a German lawyer:

Germany is passing some new laws regarding cybercrime that might affect security professionals. Federico Biancuzzi interviewed Marco Gercke, one of the experts that was invited to the parliamentary hearing, to learn more about this delicate subject. They discussed what is covered by the new laws, which areas remain in the dark, and how they might affect vulnerability disclosure and the use of common tools, such as nmap.

Read more at http://www.securityfocus.com/columnists/448

it's been a while since anyone mentioned the malformed tag as a problem
http://www.securityfocus.com/archive/1/319360/2003 -04-20/2003-04-26/0

Would all the anti IE folks please put this on their site immediately so I don't have to spend time on them ;)

It occurred to me that in this situation, it was completely legal, completely ethical, and completely necessary

Not so simple as that I'm afraid - http://www.securityfocus.com/infocus/1765

Bear in mind that the core, being in kernel mode, is less likely to fail as it's running completely separate from any ISAPI filters, user-applications, etc. Regardless, we are talking an extremely simple part of the kernel which deals with the lowest level of HTTP - anything more complex is pass onto an appropriate user-mode process, which for anything remotely dangerous will be running in its own isolated application pool.

After reading TFA I didn't see any mention of any steganographic analysis. To me, that's the juicy stuff. This may be off topic, but, has anyone (publically) been doing stego analysis on these videos?

"The secret to success is simple: make a good product and sell it at a fair price."

Guess Michael Moore's movie must have been a bad product at a hugely inflated price then.

Even the stuff that's not yet for sale.

Good thing that only happens to games.

Though KisMAC is still out there, there are alternatives such as Airsnort, Airattack, WepLab, Web,.. Can a live CD such as this one http://www.securityfocus.com/infocus/1814#auditor be booted off a macintelatosh?

Here is Larry Gill's self-serving post. Sounds like he's saying, "None of these bugs are important, because we don't have any important bugs in our software." Don't we all know people/companies like this, who won't own up to anything? The submitter is making a bit much of the data cloaking comment, if you ask me.

http://www.securityfocus.com/archive/1/474727/30/0 /threaded

Most everyone hates botnets, but no one wants to actually do anything about it. I commend them for actually doing something about it.

Congratulations on doing the wrong thing about it. But I guess the appearance of action is better than a wise and considered inaction.

In case you didn't know, botnets don't use static IRC services for command and control any more. (http://www.mcafee.com/us/local_content/white_pape rs/threat_center/wp_vb2006_myers.pdf) (http://honeyblog.org/archives/32-Steganography-in -Botnet-Command-Control.html) (http://www.securityfocus.com/news/11473).

This unsanctioned action by the ISPs is simply fighting the last war with untargeted dumb weapons. The only thing they're accomplishing is collateral damage.

Right...just like they do with WEP.
Yes, you'd have to be stupid not to encrypt wireless traffic. That doesn't make it safe, though, assuming the data is actually worth obtaining.

He can post whatever he wants on his own blog. He didn't ask for his story to be posted on Slashdot so that idiots like you who will
comment on something they know nothing about.

http://www.securityfocus.com/bid/24924

I guess I am one of the bazzilions of Mac users who have not upgraded to Tigger. I can't use launchctl.

The answer is right in front of you. Governments and spy shops pay for exploits before they're made public, so they can use them to enter your machine as they need to. In this case, we don't know how CIPAV was delivered, but it might be as simple as an undiscovered exploit in Outlook or a browser-based email system. While none of us trust government, I equally don't trust my fellow citizens, so the "ethics" of this point are moot.

You guys are right. My bad.

Security focus blog has a link to the now dead ISC diary page.

My bad. I guess one alleged but unproven lab only virus for Mac might be as bad as 0 to pwned in 20 minutes for pre-sp2 XP.

Hey, there's a worm in my apple...

I have never heard someone call code "ugly" because they couldn't understand it. Ugly usually means "repulsive" and this usually means that it is an aesthetic and expressive difference.

SQL-Ledger code is about as ugly as Perl code gets. Heck I think it would make anyone who know.s Perl cry. As I say, the author hit (as far as I could tell) 75% of the programming anti-patterns listed in Wikipedia, and many of them he managed to extend in bizarre and disturbing ways. For example, he has magic strings in his *comments.* Delete the comments and things break. I kid you not. Then there are the points where he takes the spaghetti metaphore rather literally (say a function that wanders between six or seven files because of different files overwriting functions which are called inside). Then he has the God object which again is quite literal because it is the *only* object and does *everything.*

If that wasn't bad enough, the Perl is just plain ugly. You will have calls like: AP->transactions(\%myconfig, \%$form); ($form is the God object.) Note that the only reason why %myconfig is not a hashref is because he decided to dereference it on return of another function.

He also insists on parsing the HTTP request himself rather than relying on standard libraries, and where he can't avoid using CPAN, tends to copy and paste the relevant portions of the code into his software (as you can see in SL/Mailer.pm). He didn't do this with DBI and DBD::Pg, though.

Is it any wonder that a year ago, the code was vulnerable to a serious security bypass issue because he was using timestamps for session ids and not checking them against what was actually issued (he was only checking to see whether the timestamp was somewhat recent-- the real session key was the login)? You can read more about that at http://www.securityfocus.com/archive/1/445512. To be fair, since we have moved away from SQL-Ledger, that program *has* patched all auth bypass security issues we have reported to DWS, but most other security issues have not been patched because the author doesn't see insider threat as a real issue.

Hello ye old purveyor of facts:

Feast thy eyes on this little article then

http://www.theregister.co.uk/2005/11/09/sony_drm_w ho_cares/

I'll quote the most delicious sentence ""Most people, I think, don't even know what a rootkit is, so why should they care about it?" he huffed." as said by The President of Sony BMG's global digital business division Thomas Hesse.

The article also goes on about the damages

And this article

http://www.eff.org/IP/DRM/Sony-BMG/

Also gives some nice info on the Rootkit case.

But you mentioned damages, let's take a look at this article

http://www.securityfocus.com/brief/34

It tells about the ruckus the rootkit caused that made cheating in games such as World of Warcraft a lot more difficult to detect, impossible at that time even (don't know if it can be now), Blizzard probably lost customers over this, they had to program pieces of extra security software like "the Warden" to check for known cheating/botting programs, costs I don't think that will be covered by the nice chaps at Sony.

So don't mind me if I agree with the other poster on the opinion that you are a fanboy, nothing wrong with that, your choice, but don't feign innocence.

"Fuzzing is probably the easiest way to find flaws, because you don't have to figure out how the application is dealing with input," said Moore, a well-known hacker and the co-founder of the Metasploit Project. "It lets me be a lazy vulnerability researcher."

Knowing the username and password is a separate way of using this attack, in which they trick you into (first) logging in and (then) doing the bad stuff.

This is one of the reasons that home routers, which often use HTTP Basic Authentication, are ironically more secure: HTTP Authentication pops up that annoying box we all hate. It's a pretty big signal that Something Weird Is Going On.

See Drive-By Pharming at http://www.securityfocus.com/archive/1/460251 or the article linked from TFA, http://labs.calyptix.com/csrf-tracking.php

Release: 2006/10/25
First DoS: 10/23
Breach of privacy: 10/25
Another DoS: 10/31

Alan Ralsky

Scott Richter

Ryan Pitylak

Sanford Wallace

The first ten results on Google give four different Spam Kings, none of which is the guy here, one of which involves Burger King and real Spam.

http://www.securityfocus.com/bid/17192
http://www.securityfocus.com/bid/8641
http://www.securityfocus.com/bid/8649
http://www.securityfocus.com/bid/6991
http://www.securityfocus.com/bid/6548
etc...

I couldn't find any "critical security flaws" for postfix. I did, however, find this: http://cr.yp.to/maildisasters/postfix.html

http://www.securityfocus.com/bid/17192
http://www.securityfocus.com/bid/8641
http://www.securityfocus.com/bid/8649
http://www.securityfocus.com/bid/6991
http://www.securityfocus.com/bid/6548
etc...

I couldn't find any "critical security flaws" for postfix. I did, however, find this: http://cr.yp.to/maildisasters/postfix.html

http://www.securityfocus.com/bid/17192
http://www.securityfocus.com/bid/8641
http://www.securityfocus.com/bid/8649
http://www.securityfocus.com/bid/6991
http://www.securityfocus.com/bid/6548
etc...

I couldn't find any "critical security flaws" for postfix. I did, however, find this: http://cr.yp.to/maildisasters/postfix.html

http://www.securityfocus.com/bid/17192
http://www.securityfocus.com/bid/8641
http://www.securityfocus.com/bid/8649
http://www.securityfocus.com/bid/6991
http://www.securityfocus.com/bid/6548
etc...

I couldn't find any "critical security flaws" for postfix. I did, however, find this: http://cr.yp.to/maildisasters/postfix.html

http://www.securityfocus.com/bid/17192
http://www.securityfocus.com/bid/8641
http://www.securityfocus.com/bid/8649
http://www.securityfocus.com/bid/6991
http://www.securityfocus.com/bid/6548
etc...

I couldn't find any "critical security flaws" for postfix. I did, however, find this: http://cr.yp.to/maildisasters/postfix.html

Remember this?

MacForensicsLab

http://www.macforensicslab.com/

http://www.macforensicslab.com/mfl_analysis.html

If you are a super criminal you have state protection, See:
Attorney General Alberto Gonzales:

http://politics.slashdot.org/article.pl?sid=07/05/ 16/0137205

http://tedscolumn.blogspot.com/2007/05/more-from-d epartment-of-injustice.html

http://news.com.com/8301-10784_3-9719339-7.html

But if you've got something [below] this insidious, you're just screwed:

http://www.securityfocus.com/cgi-bin/index.cgi?c=a rticlecomments&op=display_comments&ArticleID=11372 &expand_all=true&mode=threaded

You'd need Fred: [site is run off a locked volume - DVD]

http://all.net/

He also has, White Glove Linux, LE is for law enforcement only. [click "prices" on left]

http://all.net/WG/dist/index.html

Fred's, The Man(TM)

Mod security is an even bigger joke than your ubuntu article! No web app should be vulnerable to directory traversal, XSS or SQL injection in 2007. If developers have made these simple mistakes, there's a strong possibility they made others that a band-aid will not fix.

Users should 'fix' wordpress by keeping upto date with the latest stable versions of PHP and wordpress; security is a process and not a product. Personally I wouldn't use wordpress, it may be one of the better written PHP web-apps but unfortunately that isn't saying much at all.

Seriously, how stupid do you have to be to think "OMG, Haxxors?" Answer: work at Homeland inSecurity, or be a Congresscritter. They already figured it out. It was a controller for a specific piece of equipment that flooded the network and triggered a bug in the variable-frequency-drive controllers for pumps.

As someone who used to work in system's engineering for a sister BWR, I think the inspection is a good idea. Oh, there's dumb and there's nuclear dumb but this is not a case of either. Nuclear dumb involves putting machine guns nests inside the plant. Finding the root cause of the accident is a good idea.

Handwaving about a PLC device won't do. What ultimately caused the PLC malfunction needs to be answered at a component level. There's going to be something wrong with it and that should be reported and every other device like it needs to be ripped out and trashed. If there is not component failure, there's a software problem which also must be understood.

Yes, it could have been hackers. The "internal control network" might at some point hits a desk that's connected to the wider world. It could be something mundane and unintentional, like an operator's virused up laptop.

An outage like that is something that's going to have both NRC and corporate ass-chewers looking at everything. Corporate might want to paint a nice picture for the NRC, but the poor devil that lies to them goes to jail. In either case, the problem will be identified and eliminated.

You might also have noted in the article that this is not the first plant to go thumbs down over some winblows born virus. In 2003, the slammer worm caused havoc at an offline Ohio plant. Yes, that was hackers. They did not mean to do it, but the plant's systems were open to it and failed. That's not acceptable from any standpoint.

Despite the better advice of the computer people at the plants, Entergy is a big M$ Partner. They take the big dogs out fishing and sell them the works. Ten years ago, M$ had something worth while and interesting. It was used in places it should not have been. Worse, the flaws from ten years ago have not been addressed or fixed. A good clean up is in order.

Actually, it was. However, the hack wasn't released until a month after it was patched, and attempting to "depatch" a system will brick it.

http://www.securityfocus.com/archive/1/461489/30/0 /threaded

Sounds like a familiar idea. Too bad it didn't work.

The problem is that any coordinated effort will also likely have a single point of failure.

Tons of break-in attempts everyday, and my Slackware just resists all of them.

I'm glad you think so; I take that as a compliment! ;)

Unix is a far more secure platform than Windows; and it has been proved since it's more exposed to heavy attacks all the time.

No, all you've established, if we can call "stating something" to be establishing it, is that servers with "well known open ports" are more secure than desktops with users installing software, visiting potentially malicious sites, etc. And frankly it doesn't matter what ports are open; what matters is that you know what ports are open, and why. It should go without saying that this knowledge is much more common in serverland than in userland (and it could be argued that it's more common among Unix administrators than Windows, at least historically).

I don't really care (nor am I qualified) enough to do my own proper research, but I compared search results for Linux and Windows privilege escalation. A search on SecurityFocus returned results in similar proportions: Linux and Windows.

Of course this is not evidence of anything other than more discovered bugs returning those particular keywords, and I'm not going to argue that one OS is more secure than another -- I only assert that your comparison is inadequate.

Tons of break-in attempts everyday, and my Slackware just resists all of them.

I'm glad you think so; I take that as a compliment! ;)

Unix is a far more secure platform than Windows; and it has been proved since it's more exposed to heavy attacks all the time.

No, all you've established, if we can call "stating something" to be establishing it, is that servers with "well known open ports" are more secure than desktops with users installing software, visiting potentially malicious sites, etc. And frankly it doesn't matter what ports are open; what matters is that you know what ports are open, and why. It should go without saying that this knowledge is much more common in serverland than in userland (and it could be argued that it's more common among Unix administrators than Windows, at least historically).

I don't really care (nor am I qualified) enough to do my own proper research, but I compared search results for Linux and Windows privilege escalation. A search on SecurityFocus returned results in similar proportions: Linux and Windows.

Of course this is not evidence of anything other than more discovered bugs returning those particular keywords, and I'm not going to argue that one OS is more secure than another -- I only assert that your comparison is inadequate.

I'm talking more poor applet security than poor Java desktop security. Java 6 makes Java *applications* sizzle. But for applets...

1) Poor auto-update features for client-side JVM (People do not tend to update their Java client JVM)
2) A vulnerability in the JDK or Java plugin may move all your clients into the attackable surface
3) Older JVM's (in the past) could force the application to use an older vulnerable JVM if installed
4) Stuff like java.lang.Runtime().getRuntime().exec("cmd.exe")
5) 2006 hall of fame!
http://www.kb.cert.org/vuls/id/759996
http://www.securityfocus.com/bid/17981
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id =4396719
Intesting tidbit:
http://www.securityfocus.com/archive/1/434001

PS: Consider taking http://www.sans.org/ns2007/description.php?tid=447

I'm talking more poor applet security than poor Java desktop security. Java 6 makes Java *applications* sizzle. But for applets...

1) Poor auto-update features for client-side JVM (People do not tend to update their Java client JVM)
2) A vulnerability in the JDK or Java plugin may move all your clients into the attackable surface
3) Older JVM's (in the past) could force the application to use an older vulnerable JVM if installed
4) Stuff like java.lang.Runtime().getRuntime().exec("cmd.exe")
5) 2006 hall of fame!
http://www.kb.cert.org/vuls/id/759996
http://www.securityfocus.com/bid/17981
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id =4396719
Intesting tidbit:
http://www.securityfocus.com/archive/1/434001

PS: Consider taking http://www.sans.org/ns2007/description.php?tid=447

maybe we also accept responsibilities, unlike others... http://www.securityfocus.com/archive/1/468057

Heh... I reported this via Bugtraq on August 19, 2005, and CISCO responded to it 3 days later...

http://www.securityfocus.com/archive/1/408603/30/0 /threaded

As in, they've known about this for at least 20 months...

OpenLDAP is one such package.
Fedora Directory Server is another.
Heck, you can even use Active Directory *and* Linux.

The intent was always that the rules would be progressively relaxed - see http://www.securityfocus.com/archive/142/464216/30 /0/threaded from last month.

Lets see how quickly Apple responds to this hack. I recall an Ubuntu vulnerability being patched within the week that it was reported - I don't think Apple (or MS for that matter) could respond so quickly.

I have yet to see (apart from that clause in Vista's EULA - which actually according to Paolo from Microsoft means that you aren't allowed to run the same copy of Windows as a guest where it is also installed as the Host OS, which is pretty "well, DUH!" anyway) any EULA which tries to remove a right other than the inevitable warranty disclaimer.

That's not what the license says. The exact wording is as follows:

4. USE WITH VIRTUALIZATION TECHNOLOGIES. You may not use the software installed on the licensed device within a virtual (or otherwise emulated) hardware system.

This precludes running it as the guest OS even if it isn't the host, and you're only using it once. The text of the legal document takes precedence over the BS statements of some random Microsoft employee, you know!

No, because for it to mean that, then it would read "4. USE WITH VIRTUALIZATION TECHNOLOGIES. You may not use the software within a virtual (or otherwise emulated) hardware system" which it does not. It states that you may not use the software which is installed on the licensed device (the physical hardware) within a virtual or otherwise emulated environment (of course this DOES mean you can't boot Mac OS X via Boot Camp, and load a Vista partition with Parallels, but who cares?).

Oh, and here's an official Microsoft statement from the Windows Server team: http://blogs.technet.com/windowsserver/archive/200 6/10/17/Virtual-Hard-Disk-format-becomes-open.aspx

I would be interested in seeing some of the more bizarre EULA clauses, so if you have any examples to share, please do.

• Some EULAs, such as those for various database programs (Oracle and MS SQL, I think), disallow publishing benchmark results (or require running the tests in a specific "approved" way).

Yeah, that's stupid.

The Vista EULA prohibits accessing any DRM'd stuff from within a virtualized OS session.

That would be a restriction required of them by the MPAA and RIAA and their scummy ilk. Are you really surprised by this?

EULAs are often non-transferable, and thus prohibit resale of the software.

No, OEM EULAs are non-transferable, and that's because they sell them at less than half the price (on the precondition that it's bundled with something, or you're bundling it) - which sounds fair to me. Any other type of non-transferable EULA is never enforced and usually just there for some bizarre legal reason. Exemption: MMORPGs. I don't know why this is, but although they don't necessarily prohibit transfer of your software license, you can't transfer your game account.

The Vista EULA only allows you to install the software on a different device once. After that, it's worthless.

"15. REASSIGN TO ANOTHER DEVICE. a. Software Other than Windows Anytime Upgrade. You may uninstall the software and install it on another device for your use. You may not do so to share this license between devices"

It doesn't ANYWHERE in this clause say that you can only transfer it once. Please also note that I pulled this from the Home Basic/Premium EULA, the lowest common denominator.

(Source for Vista EULA info.)

If you actually READ the page you just linked, you'd realise you can transfer licenses to other machines legitimately. It was either a mistake or they backtracked (according to Microsoft, it was just a poorly thought out decision. THAT I believe). Oh, and of course ... "Scott Granneman teaches at Washington University in St. Louis, consults for WebSanity

Erm, a book is licensed too.

No, it's not. Books are bought, not licensed.

You don't, for example, have the right to make a copy of the whole book. But you are granted all rights but that.

That has nothing to do with some imaginary "license." All those rights are granted by the Doctrine of First Sale, as they are for all goods, and then copyright law takes away the right to make a copy.

Now, here's where the stupidity comes in: According to the current theory, software is different from every other product in the universe because the program code has to be copied into the computer's memory in order to run. This causes copyright law to kick in, meaning that you need extra permission (above and beyond the Doctrine of First Sale) in order to use it. This is the ridiculous, asinine, dumbass court decision that needs to be overturned.

I have yet to see (apart from that clause in Vista's EULA - which actually according to Paolo from Microsoft means that you aren't allowed to run the same copy of Windows as a guest where it is also installed as the Host OS, which is pretty "well, DUH!" anyway) any EULA which tries to remove a right other than the inevitable warranty disclaimer.

That's not what the license says. The exact wording is as follows:

4. USE WITH VIRTUALIZATION TECHNOLOGIES. You may not use the software installed on the licensed device within a virtual (or otherwise emulated) hardware system.

This precludes running it as the guest OS even if it isn't the host, and you're only using it once. The text of the legal document takes precedence over the BS statements of some random Microsoft employee, you know!

I would be interested in seeing some of the more bizarre EULA clauses, so if you have any examples to share, please do.

• Some EULAs, such as those for various database programs (Oracle and MS SQL, I think), disallow publishing benchmark results (or require running the tests in a specific "approved" way).
• The Vista EULA prohibits accessing any DRM'd stuff from within a virtualized OS session.
• EULAs are often non-transferable, and thus prohibit resale of the software.
• The Vista EULA only allows you to install the software on a different device once. After that, it's worthless.

(Source for Vista EULA info.)

And I'm sure there are many other absurd, unfair clauses in EULAs; these are just the few that 3 seconds of searching Google found.

For example, CVE-2006-3648 and Exploiting the Otherwise Non-exploitable on Windows details how MS exeption handling in Internet Explorer can be exploited. Why should I have faith that the effects of this crash are not exploitable as well.

Additionally, just because something was initially reported as a crash, does not mean researchers won't find a way to later exploit it. Again, visiting the MS IE browser: Javascript window() issue in IE was publicly reported as a DoS in May 2005 and was ignored, until being reported as exploitable in November 2005. Why could not the same thing happen here?

Oh, I get it, Mr. LeBlanc at MS wants to tout his SafeInt class... well, being Office is closed source, vulnerability researchers cannot really examine this "security feature". I guess this offers MS a safety net to claim that these "features" are "3... meant it to blow up, and [are] clearly not exploitable", while protecting themselves from the vulnerability community finding exploitable flaws in the SafeInt code.

'The grid (as was shown by the outage on the east coast a couple years ago) is not very redundant'

Actually the grid used to more redundant until the utility companies stopped building standby generators and connected local systems to a central control station, to save on staff and to save money. They managed this by lobbying in Washington to get the regulations diluted.

The actual blackout was caused by the MS Blaster worm that caused the SCADA units to freeze. These Windows based units are used to provide remote reading of Remote Terminal Units (RTUs). As the operators were unaware that a single generator had tripped out in Ohio, they failed to respond when too much power was been drawn in from a neighboring area. This in turn tripped out other generators in a domino effect. Coincidentally enough ten months previously the SQL worm caused a similar crash of the SCADA units at a nuclear power plant owned by the same company.

Years later a report found (a) Unix to be responsible for the outage and (b) an operator had switched off a key piece of equipment and then went to lunch. This despite the fact that telephone transcripts showed that the operators were fully aware that something was wrong in the minutes preceding the blackout.

XA/21
http://www.nipc.gov/dailyreports/2003/August/DHS_I AIP_Daily_2003-08-18.pdf

MS Blaster
http://www.theregister.co.uk/2003/08/20/slammer_wo rm_crashed_ohio_nuke/

We have no idea what happened
http://www.cnn.com/2003/ALLPOLITICS/09/04/blackout .hearing/index.html

transcripts
http://www.cnn.com/2003/fyi/news/09/04/transcript. fri/

potential vulnerability of plant computer network to worm infection
http://www.nrc.gov/reading-rm/doc-collections/gen- comm/info-notices/2003/in200314.pdf

an engineer .. disabled an automatic periodic trigger
http://www.computerworld.com/securitytopics/securi ty/recovery/story/0,10801,87400,00.html

RTUs
http://www.securityfocus.com/news/41

was: Re:What about a boogeyman attack?

It is trivial to break in to a laptop when one has unrestricted physical access.

It is usually non-trivial to break into a server that is in a data-center behind firewalls given zero-knowledge.

Fortunately for the bad-guys, laptops have been proven over and over to contain network information, passwords, and raw protected data:

Chicago Public Schools
FBI
Boeing
Starbucks
Towers Perrin
US Commerce Department
US Department of Transportation and Sovereign Bank, et al.
US Navy
US Department of Veteran Affairs
Federal Trade Commission
Equifax
Ernst & Young (many times)

Unless "Get competent administrators" is software that prevents users from putting data on their laptops, this suggestion is meaningless.

"Get competent administrators" is a finger-waving nebulous non-solution from those that have no idea what competent administration looks like.

Competent adminstrators recognize that security problems are not simple and they are only solved by tangible, disciplined, and rigorous solutions, rather than dismissive statements of "be smarter."

It is trivial to break in to a laptop when one has unrestricted physical access.

It is usually non-trivial to break into a server that is in a data-center behind firewalls given zero-knowledge.

Fortunately for the bad-guys, laptops have been proven over and over to contain network information, passwords, and raw protected data:

Chicago Public Schools
FBI
Boeing
Starbucks
Towers Perrin
US Commerce Department
US Department of Transportation and Sovereign Bank, et al.
US Navy
US Department of Veteran Affairs
Federal Trade Commission
Equifax
Ernst & Young (many times)

Unless "Get competent administrators" is software that prevents users from putting data on their laptops, this suggestion is meaningless.

"Get competent administrators" is a finger-waving nebulous non-solution from those that have no idea what competent administration looks like.

Competent adminstrators recognize that security problems are not simple and they are only solved by tangible, disciplined, and rigorous solutions, rather than dismissive statements of "be smarter."

Lexar Discussion: http://www.securityfocus.com/bid/11162/discuss
This was also on slashdot: http://slashdot.org/article.pl?sid=04/09/14/185523 2

I wouldn't trust USB stick security unless there was a 3rd party assessment of the security from a reputable security firm and that assessment was published. Customers need to start demanding this. What track record do these companies have on security?

The bad thing about hardware is how do you patch the security hole? All hardware these days should have the ability to do a USB firmware upgrade. These devices have a USB port build in already but can't be upgraded.

The tricks of the trade are beyond your comprehension. Read the following articles* and decide for yourself how much you know. You should be very concerned. There are two possible reasons why your network hasn't been cracked yet.

One: all your base stay turned off 24/7.
Two: Your network security people have managed to stay one step ahead of the crack.

[*]
http://rootprompt.org/article.php3?article=403
http://www.securityfocus.com/news/11392

For this configuration exploit, this SNMP vulnerability, this IP sequence generation problem, this ICMP vuln, this H.323 problem, and this buffer overflow.

NOTE: Some of the listed problems indicate a "Cisco 3200 Catalyst", which may not be the same as the orbiting "Cisco 3200 Mobile Access Router". IANACG (I am not a Cisco geek).