Slashdot Mirror

Pick one?

Pick one?

Pick one?

Pick one?

Basically, IE/Outlook users can get owned by visiting sites fitting with the ANI exploit, which is reported to be in the wild. Read more here.

There are four issues here
The number of code vulnerabilities (will never be known).
The number of code vulnerabilities that have been exploited by hackers (will never be known).
The number of exploited code vulnerabilities or bugs that have been found by security experts. (known).
The number of exploited code vulnerabilities (security bugs) that get fixed.

Since the real security measure of an OS is actual number of code vulnerabilities and this is based on the number of lines of code, the language, the known exploits types, the experience in security of the programmers, how much time programmers have to make the OS, security testing, the security tools used and many more items. This means the actual security of an OS is unmeasureable.

The next best step to try and measure OS security is to see the number of code vulnerabilities that have been exploited. The more hackers focused on an OS given the same number of code vulnerabilities will result in more exploits found. Since the imagination of the hacker and the OS surface area for exploitation on these OS are so large the number of exploited code vulnerabilities can't be found. This means your PC is never safe when connected to the internet because the number of exploits will always be more than the number of known security bugs which will always be more than the number of fixed security bugs.

Looking for known exploits is next best step to see how secure a OS is. What is being measured here is exploited code vulnerabilities that have been found and this in no way determines the security of an OS, but just a guesstimate. 90+% of the hackers and security experts are focused on Windows OS. This is driven by the business community. This means the database tools used by security analysis are filled with mostly Windows bugs. Using these databases gives you a unbalanced picture of Windows security when compared to other OS. It will make the other OS look better than they are due to the lack of non Windows bugs (example Messenger service bugs).

The number of exploited code vulnerabilities that get fixed is a good measure to see how serious a company is about security, which in turn will reflect in a reduction of code vulnerabilities due to security vidulance. OSX is now using Unix and there are a lot of good hackers who love Unix/Linux, OSX is now very vulnerable due to the low number of Mac security experts vs the large number of Unix/Linux hackers. There are a lot of Unix bugs that have been fixed by the open source community that haven't been fixed in OSX. Apple has generally refused to discuss the security of its Mac OS X operating system with the media, which should raise some eyebrows. It also has been very slow in fixing known security bugs. Here is an article that shows a Mac security expert getting hit with an exploit at a hackers conference. The exploit was an unknown. http://www.securityfocus.com/news/11375

We noticed

Me too.
Speaking of Evil Genius(TM):

Researchers: Rootkits headed for BIOS

http://www.securityfocus.com/comments/articles/113 72/33500/threaded#33500

Arhiveus Ransomware Trojan Analysis

http://www.secureworks.com/research/threats/arhive us/

It almost appears that we'd run in to the the "loving" arms of DRM (etc.) to escape future, more powerful variants.
These "guys" (in general) are PhDs/Engineers and are not competing anymore, they're leading the "innovators", (look at AV Companies and the all struggling) OpenSource has been the only real response. ... tap, tap, tap, ... what to do, what to do.

A great bargain alternative is the Dell Truemobile 2300, it runs DD-WRT perfectly, and can usually be found for less than $20 on ebay thanks to a critical vulnerability in the stock firmware that Dell chose not to address.

"If you're a bad guy and you want to frustrate law enforcement, use a Mac."

"If you're a bad guy and you want to frustrate law enforcement, use a Mac."

Interesting idea, unfortunately MS bypasses the hosts file for its own servers:
See here

Microsoft bypasses the hosts file for their own hosts.

this treaty is old news but as far as i can tell not enforced as such, i.e. we don't have terabytes of packet captures laying around my cubicle. bleh. just read the article and it doesn't even link the treaty http://conventions.coe.int/Treaty/EN/Treaties/Html /185.htm happy reading! oh and for the USA signing it, we did back in 2004! can you say old news? how do i get to tag stuff? OFN! http://www.securityfocus.com/news/8529

Teun:
"Haratio, is he related to that famous character called Horatio? '

I bet you're right, and I bet you pretty much know what I meant.
Have you got anything to contribute, as per the subject? Or, are you just checking hall passes?

Everyone makes mistakes, ... don't you agree?
Don't feel bad - It' a human condition, you'll get over it, I did.

http://slashdot.org/comments.pl?sid=221826&cid=179 73182

"... claiming their IP is being infringes upon and ..."

Here, check this out, it's pretty fascinating stuff (PC-wise):

The quest for ring 0

http://www.securityfocus.com/columnists/402

Joanna Rutkowska's research is catching up to a truth few realized until just recently, This is just the tip of a whole can of worms that has been wiggling right under our noses for years.

If you check the comments below, (to a very good article) some commenters are rather hysterical, (in a bad way) and for good reason, but reflect the truth.

Rootkits headed for BIOS
Comments:

http://www.securityfocus.com/cgi-bin/index.cgi?c=a rticlecomments&op=display_comments&ArticleID=11372 &expand_all=true&mode=threaded

After reading this, if you don't have experience in these matters please refrain from commenting.
Rather, go read more of what Ms. Rutkowska has so expertly revealed:

http://invisiblethings.org/papers.html

"There are more things in heaven and earth , Haratio, than are dreamt of in your philosophies."

According to this blog entry (see http://zetarace.blogspot.com/2007/03/dont-use-teln et.html), his honeypot network caught one of the worm attempt.

[**] [1:10136:3] TELNET Solaris login environment variable authentication bypass attempt [**]
[Classification: Attempted Administrator Privilege Gain] [Priority: 1]
03/01-13:44:29.556771 192.18.17.206:1134 -> 192.168.0.34:23
TCP TTL:46 TOS:0x0 ID:52835 IpLen:20 DgmLen:86 DF
***AP*** Seq: 0xED89493C Ack: 0x9D57147C Win: 0xC4E0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/22512%5D

However, looking at the source ip attacking his honeypot machine.. seems it's coming directly
from Sun network range:

whois 192.18.17.206

OrgName: Sun Microsystems, Inc
OrgID: SUN
Address: 4150 Network Circle
City: Santa Clara
StateProv: CA
PostalCode: 95054
Country: US

NetRange: 192.18.0.0 - 192.18.194.255
CIDR: 192.18.0.0/17, 192.18.128.0/18, 192.18.192.0/23, 192.18.194.0/24
NetName: SUN1
NetHandle: NET-192-18-0-0-1
Parent: NET-192-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.SUN.COM
NameServer: NS2.SUN.COM
NameServer: NS7.SUN.COM
NameServer: NS8.SUN.COM
Comment:
RegDate: 1985-09-09
Updated: 2003-10-10

RTechHandle: IS189-ARIN
RTechName: Sun Microsystems, Inc.
RTechPhone: +1-303-272-7000
RTechEmail: Netmaster@sun.com

OrgTechHandle: IS189-ARIN
OrgTechName: Sun Microsystems, Inc.
OrgTechPhone: +1-303-272-7000
OrgTechEmail: Netmaster@sun.com

It seems to me that Sun is spreading the Worm.^H^Hd.

This stinks of self-promotion.

Of course it's self-promotion. Why does the guy stick his picture on the front of the article?

Attention geek bloggers: You are not attractive. Stop posting pictures of your dorky looking selves at the top of your blog.

(Note: in case you're wondering how I got so many pictures to prove my point, I simply looked up the fud tag on Slashdot and started clicking away :)

Well, I think the author may have a few points considering that the government itself does not know how to use encryption properly...

http://www.securityfocus.com/news/11393 [Security Focus]

Why we'd expect the average Joe to do it right is beyond me.

Even if the crypto chip become widely available the NSA/CSA/ big bro will have pulled some patriot act shenanigans to get a back door put in anyway.

VIVA LA PGP!

According to this researcher, Apple IS using the TPM modules. Wonder which is true?

Sure, it'd be pretty tedious to do that by hand, but if we automated the process somehow...

Oh, wait.

I imagine that if you ran a script by yourself, your e-mail address would be targeted as belonging to a valid sucker, and passed around on lists, so you'd be spammed even more. The efforts of a scrappy community of geeks are no match for the millions of pwned PCs around the world.

"2: I'm sure that if the article related to barcoding cattle and soldiers, you'd have received similar comments. To be honest, I don't want RFID or barcodes printed on me for the world to see."

I'd go out on a limb and guess that what he meant was that it was alarmist. This isn't about the use of RFID as such. It's just a new innovation using the technology. Mentioning that humans could be tattooed as well is superfluous and not at all different from saying the same thing about any tracking technology used for animal life. "Barcodes/RFID/generic radio tags/GPS/ect is used to track animals and could be used to track humans, too! Your privacy is at risk!". It'd be slightly annoying to have to read that every time some sort of identification technology was frontpaged on Slashdot.

I think a major reason this concerns people is when it is mandated by law. Right now you cannot get a passport in certain countries (including the US) that does not contain an RFID chip. There are companies now that require you to have an RFID chip emplanted in you in order to work for them. Now we hear you can have RFID tattoos. How long before companies or governments require these tattoos for everyone? It could start with the military, sure, but you never know.

Meanwhile people like you have been saying all along that this will never happen. And now that it has you're still denying the possibility. I wonder why the people that are concerned about this sort of thing do not believe you. It boggles the mind how far denial can go. It's this kind of denial that allows governments to do things like repeal human rights with impunity. After all, why get our panties in a bunch over a little thing like that?

Nevermind that some people think of this sort of technology fulfills an apocolyptic prophecy. It does not help that the word used in the phrase "mark of the beast" is also used for a tattoo.

I have no problem with RFID being used for the purpose for which it was designed, tracking stock. It is great for supply chain and inventory management. Unfortunately governments are already showing that our fears that we are considered their stock are better-founded than one would think. I would expect it to be strictly tinfoil-hat stuff, but it is really happening. The price of liberty is eternal vigilance. Whenever something like this happens, there is always a debate between the "alarmists" and the naysayers. We only see which side is right in the cases where naysayers win but are wrong. Otherwise it is a matter of conjecture whether the nefarious does not occur because it was not going to happen or because it was prevented because people raised alarm.

The lack of code signing hasn't prevented Cingular from selling Treos.

It appears they are working on it: http://www.securityfocus.com/archive/142/449695/30 /120/threaded

But I don't expect Apple to change with code signing in place.

This is not the same control provided by Symbian. I can download the Symbian SDKs without a contract or NDA, and I can deploy code to the vast majority of Symbian-based devices. Symbian is an open platform.

I say screw IE7, 6, 5, and all others. Seriously. No two flavors of IE render alike, and quite a few high profile sites (newspapers especially) simply don't render correctly at work (IE6). I find it annoying when graphics cover up the text. I don't have that problem at home with Firefox on Linux.

Just code to specs and forget about the idiots who can't write a decent browser (I'm talking to YOU, Microsoft programmers). When womeone emails you with "your site is shit" write back with "no, your BROWSER is shit, download one that CSS actually WORKS in that will have a nice side effect of not making you vulnerable to exploits 284 days a year. Get Firefox, Opera, or anybody else's browser."

Nobody who knows anything at all about computers uses IE. NOBODY. Yeah, grandma uses it but she's pwned, isn't she?

Code to spec. When everybody does, Microsoft will have to write a browser that actually WORKS.

According to the discoverer, this is patched. Get version 8.0.

All this is a little fun exercise and a public service, if you will. Also, anyone can examine the code.

How do you uninstall these quick fixes? Simple. They'll almost all invariably be runtime fixes with Application Enhancer (APE). APE modules are just self-contained directories; nothing more. They can be unloaded on demand, and APE itself can be easily installed, uninstalled, disabled, and modules can be loaded and unloaded at will.

Also, Landon Fuller is anything but an "Apple fanboy", or in any way remotely interested in "saving Apple's rep". The idea is to look at the bugs, and see if a quick technical solution or remediation can be provided. No one has to install them. Since the code is available, anyone can see what's being done, including the rest of the community. If one wishes to wait for Apple's official patches, fine.

Aside from all of this, of course Mac OS X, like any other operating system or large software project, has bugs. Some of these bugs will enable vulnerabilities that can be exploited. I fail to see how any of this is surprising. If you're actually interested, I've summed up my thoughts on this here.

Kevin Finisterre, security researcher, founder of Digital Munition, and co-presenter of the Month of Apple Bugs, has also responded on the SecurityFocus focus-apple list to some of my concerns, expanding on some of the motivations and reasoning behing MOAB (followup).

Also, the second bug was just posted a few minutes ago: a udp:// URI handling vulnerability in VLC Media Player that affects both the Mac OS X and Windows versions of VLC Media Player. While not exactly what I'd call an "Apple bug" (yes, yes, I know the FAQ says they're also looking at "popular applications" that run on Mac OS X as well), it is interesting to note that vulnerabilities in cross platform applications may transfer more easily to the Intel-based Macs running Mac OS X...

In any event, Apple's immediate technical response and longer-term strategic response to MOAB should be interesting.

(Disclaimer: I am the story submitter.)

Kevin Finisterre, security researcher, founder of Digital Munition, and co-presenter of the Month of Apple Bugs, has also responded on the SecurityFocus focus-apple list to some of my concerns, expanding on some of the motivations and reasoning behing MOAB (followup).

Also, the second bug was just posted a few minutes ago: a udp:// URI handling vulnerability in VLC Media Player that affects both the Mac OS X and Windows versions of VLC Media Player. While not exactly what I'd call an "Apple bug" (yes, yes, I know the FAQ says they're also looking at "popular applications" that run on Mac OS X as well), it is interesting to note that vulnerabilities in cross platform applications may transfer more easily to the Intel-based Macs running Mac OS X...

In any event, Apple's immediate technical response and longer-term strategic response to MOAB should be interesting.

(Disclaimer: I am the story submitter.)

Kevin Finisterre, security researcher, founder of Digital Munition, and co-presenter of the Month of Apple Bugs, has also responded on the SecurityFocus focus-apple list to some of my concerns, expanding on some of the motivations and reasoning behing MOAB (followup).

Also, the second bug was just posted a few minutes ago: a udp:// URI handling vulnerability in VLC Media Player that affects both the Mac OS X and Windows versions of VLC Media Player. While not exactly what I'd call an "Apple bug" (yes, yes, I know the FAQ says they're also looking at "popular applications" that run on Mac OS X as well), it is interesting to note that vulnerabilities in cross platform applications may transfer more easily to the Intel-based Macs running Mac OS X...

In any event, Apple's immediate technical response and longer-term strategic response to MOAB should be interesting.

(Disclaimer: I am the story submitter.)

Venders build mission critical apps on Windows all the time. It is easier to use what you know than the best tool for the job.

http://www.securityfocus.com/news/6767

The worst case I ever saw in person was at an assisted living facility. Their pull chains (that the residents pull when they are in trouble) was being monitored by a PC running Windows 95 (this was in 2006).

>You're not supposed to use a consumer grade OS for mission critical apps anyway. So if you went with a vendor that >builds its apps on such an OS, then you are at fault.

more story here http://www.securityfocus.com/brief/391 hehehe... He also reminds me of that city manager from oklahoma.. what's that guy name ?

So does this give me any kind of legal precedence against the Macrovision Corporation for installing their unsolicited SafeDisc copy protection driver to my PC? It is suggested there may be a local local privilege-escalation vulnerability similar to the kind that Microsoft has patched in their own services: http://www.securityfocus.com/bid/17070/info/

O yes, if you've Installed any games or programs using SafeDisc *and there are lots of them* it is there.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Secdrv

I wouldn't be at all surprised if Sony's own SecuROM protection has something similar.

don't blame the victims

http://www.securityfocus.com/bid/14088

http://www.securityfocus.com/bid/15248

http://www.securityfocus.com/bid/15249

http://www.securityfocus.com/bid/15250

http://www.securityfocus.com/bid/14129

http://www.securityfocus.com/bid/13164

http://www.securityfocus.com/archive/1/312076

http://www.securityfocus.com/bid/6557

don't blame the victims

http://www.securityfocus.com/bid/14088

http://www.securityfocus.com/bid/15248

http://www.securityfocus.com/bid/15249

http://www.securityfocus.com/bid/15250

http://www.securityfocus.com/bid/14129

http://www.securityfocus.com/bid/13164

http://www.securityfocus.com/archive/1/312076

http://www.securityfocus.com/bid/6557

don't blame the victims

http://www.securityfocus.com/bid/14088

http://www.securityfocus.com/bid/15248

http://www.securityfocus.com/bid/15249

http://www.securityfocus.com/bid/15250

http://www.securityfocus.com/bid/14129

http://www.securityfocus.com/bid/13164

http://www.securityfocus.com/archive/1/312076

http://www.securityfocus.com/bid/6557

don't blame the victims

http://www.securityfocus.com/bid/14088

http://www.securityfocus.com/bid/15248

http://www.securityfocus.com/bid/15249

http://www.securityfocus.com/bid/15250

http://www.securityfocus.com/bid/14129

http://www.securityfocus.com/bid/13164

http://www.securityfocus.com/archive/1/312076

http://www.securityfocus.com/bid/6557

don't blame the victims

http://www.securityfocus.com/bid/14088

http://www.securityfocus.com/bid/15248

http://www.securityfocus.com/bid/15249

http://www.securityfocus.com/bid/15250

http://www.securityfocus.com/bid/14129

http://www.securityfocus.com/bid/13164

http://www.securityfocus.com/archive/1/312076

http://www.securityfocus.com/bid/6557

don't blame the victims

http://www.securityfocus.com/bid/14088

http://www.securityfocus.com/bid/15248

http://www.securityfocus.com/bid/15249

http://www.securityfocus.com/bid/15250

http://www.securityfocus.com/bid/14129

http://www.securityfocus.com/bid/13164

http://www.securityfocus.com/archive/1/312076

http://www.securityfocus.com/bid/6557

don't blame the victims

http://www.securityfocus.com/bid/14088

http://www.securityfocus.com/bid/15248

http://www.securityfocus.com/bid/15249

http://www.securityfocus.com/bid/15250

http://www.securityfocus.com/bid/14129

http://www.securityfocus.com/bid/13164

http://www.securityfocus.com/archive/1/312076

http://www.securityfocus.com/bid/6557

don't blame the victims

http://www.securityfocus.com/bid/14088

http://www.securityfocus.com/bid/15248

http://www.securityfocus.com/bid/15249

http://www.securityfocus.com/bid/15250

http://www.securityfocus.com/bid/14129

http://www.securityfocus.com/bid/13164

http://www.securityfocus.com/archive/1/312076

http://www.securityfocus.com/bid/6557

I haven't googled the Matrix or anything to check my facts, but my memory says Trinity did nmap on the 10.0.0.0/16 subnet and then sshnuke to get root on one of the terminals controlling parts of the power grid. sshnuke only works against older sshd v1.

Huh, wikipedia agrees with me. Cool movie!

Now that would be old news.

How about Penetration engineer?

Man that'd make a badass business card.

Yes, technologically VMWare can run all the Vista variations.

Unfortunatelly the Vista EULA for some of their versions apparently prohibit it[...]

Vista's EULA Product Activation Worries: Mark Rasch looks at the license agreement for Windows Vista and how its product activation component, which can disable operation of the computer, may be like walking on thin ice.

The terms of Microsoft's End User License Agreement (EULA) for its upcoming Vista operating system raises the conflict between two fundamental principles of contract law. The first, and more familiar, is that parties to a contract can generally agree to just about anything, as long as what they agree to doesn't violate the law and isn't "unconscionable." The second principle is that the law generally disfavors the remedy of "self-help." That is to say that, if there is a violation of the terms of a contract, you usually have to go to court, prove the violation, and then you are entitled to damages or other relief.

The terms of the Vista EULA, like the current EULA related to the "Windows Genuine Advantage," allows Microsoft to unilaterally decide that you have breached the terms of the agreement, and they can essentially disable the software, and possibly deny you access to critical files on your computer without benefit of proof, hearing, testimony or judicial intervention. In fact, if Microsoft is wrong, and your software is, in fact, properly licensed, you probably will be forced to buy a license to another copy of the operating system from Microsoft just to be able to get access to your files, and then you can sue Microsoft for the original license fee. Even then, you wont be able to get any damages from Microsoft, and may not even be able to get the cost of the first license back.

Product activiation in the Vista license

Suppose you buy a new computer after January 2007, or purchase an early upgrade for one of the various flavors of Vista. The first problem is, you may think you bought a copy of the operating system. Actually, the OS is still owned by Microsoft. You may own a physical DVD, but what you have "bought" is the right to use the software subject to any of the terms and conditions of the End User License Agreement (EULA), which you may or may not have access to at the time you buy the computer or disk. Typically, the EULA will be contained in micro-print on the outside of a DVD, or may be on a splash screen that prompts you to unequivically declare, "I agree.." as a condition precedent to installing or booting the software. Courts have pretty much established that this manner of acquiescence is okay, provided that there is some way for you to get your money back if you don't agree to the EULA.

The Vista EULA informs the licensee that Vista will automatically send information about the version, language and product key of the software, the user's Internet protocol address of the device, and information derived from the hardware configuration of the device.

The EULA ominously warns that "Before you activate, you have the right to use the version of the software installed during the installation process. Your right to use the software after the time specified in the installation process is limited unless it is activated. This is to prevent its unlicensed use. You will not be able to continue using the software after that time if you do not activate it. " What does this mean? Essentially, if you buy a license to the software from a reputable dealer, but choose not to transmit information to Microsoft, you forfeit your ability to use the licensed software.

What is interesting is not whether you have the right to use unactivated-but-properly-purchased software, but how Microsoft enforces its right. What Microsoft says is that the software will simply stop working. So, where is the proof that the software is not activated? Who has the burden of proof? What if you assert that you did activate the product, but Microsoft claims you did not? What if you attempt to activate the product, but Microsoft's serve

"we must assume a level of technical ability
Remember your Forum peers are often engineers and scientists who don't take kindly to conjecture .

How does it move from machine to machine, How is it installed ?
As an engineer /I know that I can learn from this one ."

The learning curve is wicked.

http://www.securityfocus.com/comments/articles/113 72/33500#33500

TCP/IP
Data over RF
UHF
Microwave
Daisy chained IR
Printer (IPP)
Universal HardwareOS (over-rides)
Microcode seeds in disk drivers, bios/OF/EFI, redunants: CD/DVD/ ...
Chip-crowding (flash)
Font worlds
Virtual ports (code assembly, execution staging). ...

This is what I've been talking about.
The ramifications are chilling. This is not new, I first saw this in '97 when they were using hidden-persistent RAM disks (on 68k Macs) accessing VRAM space (NuNV N^NuNV ( ... ) _DATAINIT etc.) and swapping it in and out like a poor mans GPU.
Yes, Macs.

http://www.securityfocus.com/columnists/402

http://www.securityfocus.com/comments/columns/402/ 33600/threaded#33600

http://slashdot.org/comments.pl?sid=190931&cid=157 06785

http://slashdot.org/comments.pl?sid=193487&cid=158 76421

http://www.osnews.com/permalink.php?news_id=16282& comment_id=175413

http://www.osnews.com/permalink.php?news_id=16257& comment_id=176371

http://www.osnews.com/permalink.php?news_id=16374& comment_id=178043

You tell me.

http://www.wolfware.dk/intro/welcome.asp

This is what I've been talking about.
The ramifications are chilling. This is not new, I first saw this in '97 when they were using hidden-persistent RAM disks (on 68k Macs) accessing VRAM space (NuNV N^NuNV ( ... ) _DATAINIT etc.) and swapping it in and out like a poor mans GPU.
Yes, Macs.

http://www.securityfocus.com/columnists/402

http://www.securityfocus.com/comments/columns/402/ 33600/threaded#33600

http://slashdot.org/comments.pl?sid=190931&cid=157 06785

http://slashdot.org/comments.pl?sid=193487&cid=158 76421

http://www.osnews.com/permalink.php?news_id=16282& comment_id=175413

http://www.osnews.com/permalink.php?news_id=16257& comment_id=176371

http://www.osnews.com/permalink.php?news_id=16374& comment_id=178043

You tell me.

http://www.wolfware.dk/intro/welcome.asp