Slashdot Mirror
The Evolution of the Phisher
gurps_npc writes "An article at CNN discusses the how Phishers have moved beyond the typical email scam. Last month, Secunia (Danish security firm) documented a case where a phisher somehow modified a windows host file so that when you type in the correct url in the address, it redirects you to the phisher site.
Worms and spyware are being built for the purpose of phishing, and it is also believed that phishers are attempting to compromise domain name servers. If one of these go down millions could lose their security instantly, even if they themselves have maintened the security of their computers."
Fishermen fish.
Phishermen phish.
It's not "Fishers fish".
Carrying the analogy further, IE becomes a "phishing net" and Windows becomes a "phishing boat". The intarweb may be viewed as the "ocean" and your average AOLer a dumb "phish". Smarter geeks could be viewed as smarter"dolphins".
Interesting, huh.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
That's why you have all the stuff you need to patch it on a floppy/CD/flash drive, and don't have it connected to the internet right away. Common sense. Okay, maybe not common sense to most people.
Grammar Nazi
Let's be perfectly blunt. The average human being is functionally retarded. They're perfectly capable of being taught a few neat tricks like reading the newspaper or buying a member of the opposite sex a drink before groping them, but when it comes right down to it, about 95% of the species H. sapiens are gibbering morons who will refuse to listen to constant warnings about opening suspicious attachments, paying attention to certificate warnings, but will happily supply their credit card numbers to the first guy that comes along and says "We're from PayPal and we need to verify your account information".
I used to think something should be done about this, but since the average daft ninny who bought a computer from Big Ticket Computer Store is pretty much incapable or unconcerned about these matters, I figure what the hell! Let the scammers steal their money and their identities. People this idiotic and unwilling to learn even the rudiments of keeping themselves safe on the Internet deserve everything they get.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Then you must not get out much. As they were talking about a DNS becoming compromised such that even secured systems become redirected, your argument makes absolutely no sense. It's akin to saying that since your new car has just come off the sowroom floor, it should be entirely unaffected by that bridge out ahead.
For further instructions, consult own advice.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
I have noticed this lately as well... so now I scrutenize every email I get, hovering over links, and occasionally, entering the first line or so into google. I do consider myself to be pretty good at figuring out if it's a phish or not though. I found a fun little phishing-finding-outting test to take on i-am-bored.com. Try it out and see how well you do!
~/.sig: No such file or directory
It's bad enough that most users have no clue to begin with, but you should try working within the DoD. Or maybe it's just the Air Force that's so screwed up. But they've been pushing so hard on a poorly-implemented PKI plan that all their users are now conditioned to automatically accept invalid, expired, or untrusted certificates dozens of times per day to get their jobs done.
Enablement... yeah, that's a perfectly cromulent word...
I haven't tried this, but I heard that it is possible to create an un-signed certificate set to use 'plaintext' encryption which most web browsers will not complain about. No encryption is done and no signature is possible or required.
Does anyone know if that is correct? If so, then this is possibility.
--Jeff++
ipv6 is my vpn
Not only that, but what if the "new" computer you are buying has been opened, modified, reboxed, and sold to you? Do you trust the store where you bought it, or just buy on price? This doesn't have to be totally the store's fault either (but could be).
Also, what if someone on the inside were to modify the master disk used to image the hard drives at a factory. Sure it might make the news and eventually you'd hear about it, but it still wouldn't be fun to be one of the people affected?
Avoid Missing Ball for High Score
When you set up XP Pro for the first time, it asks you for a bunch of user names to create accounts for. Every one of them will be Adminstrator accounts, and as you say, the entire FS is R/W by default.
Yes, XP has security mechanisms. You can buy an off the shelf with XP preloaded and those mechanisms will not help you.
But honestly, no user would be happy with a system that didn't let you surf on IE and happily click 'Install' when you hit a site with Quicktime, Flash or some other plugin you are missing. We, as geeks, understand the danger in such a system, but we'll never convince everyone else.
Add to that society's information overload and most users will click without batting an eye.
If it's a brand new computer, unless it's fully patched and defended against these specific threats, you would likely already be hit long before you browsed your first site, let alone a critical one.
That's a good reason not to buy your computer from BestBuy. Our company is a local reseller who offers as good (or better) prices than the big box stores, financing options, better components, better warranties, etc. When we deliver a system, it's fully patched, AV installed with latest defs, anti-spyware installed.
Strangely, we have the hardest time getting home users to buy our systems. For whatever reason, over 95% of our customers are businesses.
It's easier to wear the spandex than to do the crunches. --David Lee Roth
If you don't want those risks, go doing those tasks the traditional way.
You mean like giving your credit card to slacker teens working at the mall?
Though this may be getting a little offtopic, I think it is a valid question and should be addressed.
But why are you linux guys so hung up on the admin/user bit?
From what I was able to gather from your post, you are trying to convey to everyone that it should not matter if a user runs under a "Limited" account, or an "Administrator" account (using Windows terminology).
Unix was designed with multiple users in mind. In fact, many system services run under their own user account. The one, all powerful account is 'root', and is normally used only under special circumstances (i.e. installing a software package). Most other times, even the sysadmin logs on to a limited user account.
The theory is, a system service can only do so much damage as it's user account permits. Similarly, a user can only do so much damage as his/her account permits. If there is some hole in MySQL server, and an attacker is able to exploit it, they gain all the privilages of the MySQL user account. The rest of the system should theoretically remain unaffected.
What does this have to do with Windows? In my experience in a computer repair shop, I have fixed XP box after XP box brought to it's knees by viruses and spyware. The removal of these malware programs can prove to be a quite tedious undertaking, because the entire family who owns the computer each has their own Administrator logon account. If the RPC service is comprimised (a la Blaster), it was running with Administrator privileges and the whole system is vulnerable. If a web site exploits a flaw in IE, the whole system is vulnerable because the user runs as Administrator.
Windows XP is simply designed to where home users need to have administrator privilages, otherwise many things will not seem to work right. For example, many DirectX games will not load at all unless run as an Administrator.
So to answer your question, a "stupid" user could only do so much damage with a unix-based security model. Lets imagine a family using a Linux computer. Assuming a 13 year old kid installed a program that secretly contained a keylogger, the keylogger would be powerless against the mother and father. The keylogger could not wedge itself deep down in the system files, therefore cleaning it would be a relatively painless task for a moderately competent user.
In conclusion, I would like to say that the fact you have never had any unexpected malware (spyware, viruses, etc) installed on your windows machine whatsoever is unusual. You are either mistaken, haven't used your computer much, or are both smart AND lucky. This is my understanding of the current state of security affairs as far as Windows and *nix are concerned - if anyone has anything to add, I'd like to hear it.