Not SYSTEM-level access....
on
Code Red III
·
· Score: 1
Actually, while the copy of cmd.exe in/scripts and/msadc can be used to run arbitrary commands, these commands will be run with the privilege level of the IUSR_MACHINENAME account - which defaults to GUEST privileges. So you can't do something fun like grab sam._.
A 'wider' backdoor, I think, would involve uploading some type of privilege escalation tool, to give IUSR_MACHINENAME admin rights. Now _that_ would be useful...
...some doctors don't feel RSI is real. My insurance company sent me to one when I was diagnosed with tendinitis. He refused to believe I was actually injured, stating that I was having 'chronic arm pain' from a 'lack of conditioning'. That my wrists were just _tired_ from typing all day. And he prescribed physical therapy... which caused damage to my wrists that was much more severe than the original tendinitis had been. A crushed median nerve isn't exactly fun...
I have a good doctor now, and my wrists are healing (I can feel some of my fingers again), but a significant amount of damage was caused by a doctor's refusal to believe RSI exists.
Doctors who don't believe their patients' injuries are real will cause more injury.
"...and I am now the proud owner of a number of unopened Windows OS's, waiting for the day when Microsoft will give me my money back."
Check your EULAs. You can't return 'em to MS, you have to go through the OEM. If you haven't used the copy of Windows that came pre-installed on your machine, the OEMs legally must allow you to return the unused OS for a refund.
Email me (remove the sheep noises from my email, above) if you need any advice on how to do this - I still have the emails I sent emachines when I returned a pre-installed copy of Win98.
Ok, this caught my eye: "No printing is permitted on this book."
Now, I know it's probably a typo, and they meant to say 'of', not 'on'. But to stick to the text of the 'Permissions' page, you could print as many copies of it as you wanted. Just don't print anything ON the book.
Re:Obvious Question: Who read the EULA?
on
EULA In Games
·
· Score: 3
You mean you _don't_ read your EULAs?
Do you read all the way through contracts before signing them? Loan paperwork? Insurance policies? Rental agreements? Of course you do - you need to know what you're agreeing to when you sign.
So why is an EULA any different?
I read all the way through the EULA the last time I bought an off-the-shelf PC. And y'know what it said? Right at the top of the page - "This EULA is a legally binding agreement between you, the Manufacturer, and Microsoft Corporation." And a few paragraphs later - "If you do not agree to the terms and conditions of this EULA, then Manufacturer and Microsoft Corporation do not wish to license the software product to you. In such event, you should not use or copy the software product, and should promptly contact Manufacturer for instructions on return of the unused software product for a refund."
So I did. Kept the PC, returned the OS. Got a refund check.
THAT is one reason why you should read your EULAs.
We, as end-users, have few enough rights in the EULAs as it is - by not reading your EULAs, you prevent yourself from knowing, and therefore exercising, the few rights you have left.
If the MS advisories ever contained enough information to be useful, this might have an affect on us. But they were always very carefully worded to be vague. We'd know there was a problem, for example, in IIS, and that there was a patch - and that's all we'd know. Just that there was a patch. No information specific enough for us to use. A lot of the time, other people or groups would release more info, and that was great. But the rest of the time, well.....
They did the same thing with the pages for their Y2K patches last year, as well. It was hell trying to keep up-to-date with everything, when the pages would disappear, the information would change, and the patches would be modified. The patch you'd download from a site one day would be different the next.
PROOF???? You sound like the insurance company I have to deal with...
I've had a combination of tendinitis and carpal tunnel for over a year and a half now.... And I can tell you that it IS real, it IS serious, and it will fsck up your life if you don't realize it in time.
Maybe I'm missing something obvious here, but what the fsck was the yankees.com machine doing still connected to the 'net hours after it was known to be compromised?
If they were even halfway serious about preserving any evidence on the machine, the first thing to do is _yank_the_network_cable_. Then (depending on policy) you might dump the memory before switching the machine off.
Read the EULA again. There are two particularly relevant bits. The first is at the very top, where is says "This End User License Agreement is a legally binding document between you, the Manufacturer, and Microsoft Corporation." Keep this in mind.
The second part is normally partway through the first paragraph. It may be slightly different with different EULAs, but mine said: "If you do not agree to the terms and conditions of this EULA, then Manufacturer and Microsoft Corporation do not wish to license the Software Product to you. In this event, you may not use or copy the Software Product, and should promptly contact Manufacturer for instructions on return on the unused Software Product for a refund."
So it's up to the OEM to issue your refund. Call them. Go through customer service and tech support. It will take a while, but you _will_ get your refund.
I didn't get my Windows refund until after I sent an email to a VP at the OEM, politely stating that if they did not behave as the EULA required them to, I would take them to the local Small Claims Court for Breach of Contract.
If you need help or moral support with your refund efforts, feel free to email me - I know a couple other things that might work as well.
There's already exploit code out there. Links to it were provided in the USSR Labs' advisory, which appeared on NTBugTraq this morning. Their advisory can be found in the NTBugTraq archives, here.
Outlook doesn't check the length of one of the date fields - a long string of data in that field will overflow a buffer. Once this has occurred, arbitrary code can be executed.
The fix is to install IE 5.01 SP1 on any affected Windows platform. Or you can install IE 5.5 - but not on Win2K.
More information is available in the posts to BugTraq and NTBugTraq, which is where I got the above information.
I haven't seen the Prius yet, but I was able to rent an Insight for a few days a while back. It was great - except for space. The batteries take up so much room, there's just barely enough trunk space for a bookbag. Although I did get about 65 - 70 mpg while I was driving it. Very nice.
The main issue, though, is one of cost. I would love to buy a hybrid car. But these things start around $20 - 21K. I expect the prices will drop as more models become available, but for right now they're a bit out of my price range.
The problem, as I see it, is a social one. In this country, at least, the majority of girls are told - whether outright, or more subtly - that they: 1 - shouldn't learn about computers because they'll never be good at it; 2 - shouldn't use computers because it's not girly/feminine/appropriate for a female-type person to use, whether for social, religious, or other reasons; 3 - shouldn't use computers because it would take their attention away from what should be their priorities, which are marriage and children; 4 - shouldn't learn about computers because it makes them less attractive to guys.
Before anyone tries to argue these, I have to mention that I, as a geek girl, have been given ALL of those arguments.
In discussions with my female geek friends, I have found that - guess what? - they have also had to go through the same things.
At every level of school - from elementary, junior high, high school, and even college - girls are discouraged from pursuing anything even remotely geeky. Hell, I once was told by a high school guidance counselor that I should take home ec (rather than pre-calc) because "You're a girl. Girls don't need math. Girls need to know how to cook for their husbands." This was when I told him I wanted to go to college and major in math.
I have had to fight opposition from teachers, school admin, other students, and even my own family. And once I got through all of that, and got out into the 'real world'... I found that it's not much better sometimes.
We can look at statistics and argue them for years, but we're not going to see a change until we, as a society, begin to encourage any girls who want to be geeks, rather than suppressing them.
Just my estrogen-filled $0.02...
Re:Don't you mean Virgil? (A bit OT)
on
Publius
·
· Score: 2
The Romans had an interesting way of structuring their names. For men, a name would be composed of individual name, family name, and father's name.
So Publius Virgilius Maro would have been called Publius, or Publius Virgilius. His father's name would have been Maro Virgilius and whatever Maro's father's name was.
If Publius Virgilius had any sisters, they would have all had the same name - Virgilia. Yep - the female form of the family name. If there were more than one, they would have had nicknames of some sort, but technically...well...let's just say Roman women didn't have much in the way of name choice.
Here's another example, from one of the textbooks used in my Latin classes - Quintus Horatius Flaccus. The fifth son of the flabby man. You're probably familiar with 'Horace', right? Same guy. We know he had four older brothers (else why the 'Quintus'?). And any female siblings he had would have all been named 'Horatia'.
What I don't understand is why people feel they have to shorten or mutilate the Romans' names... I mean, sure, I can understand referring to a person by their surname/family name. But why change it?
And don't even let me get started on the butchery done to Latin poetry when it's 'translated' into English. So much is lost and changed that reading it in the original Latin is a completely different experience.
The email they send you has a tracking number, which you must include in the Subject field of any response you send.
Here's the catch - the tracking number is made up of the date and a.blank.-digit number, for example.blank. The numbers used, other than the date, are sequential. Which means - guess what? - the numbers can be predicted with only a very little bit of work. Just include the predicted tracking number in the spoofed email, and there you go!
"If you've provided adequate security"... ...then your box won't be hacked. Which means that it can't be used in another attack. So if your box isn't used to launch another attack, you can't be sued for it.
The point with Refund Day was that the vendors were refusing to honor the EULA. It clearly states that if you don't agree to it, you should contact the OEM.
The problem is that the OEMs do not want to let you get a refund. It took me almost four months to get mine - four months of dealing with them saying: 1 - I could return the software only if I returned the hardware as well (which is not how it's stated in the EULA); 2 - They couldn't give me a refund because MS wouldn't let them return the license: 3 - They couldn't give me a refund because MS wouldn't let them re-use the returned license for another machine; 4 - They wouldn't let me return Windows because MS put the EULA in the box, they didn't, and therefore it wasn't their EULA, and so they weren't bound by it; 5 - They didn't believe that the EULA said what it did (I sent them a few copies).
And so on. I ended up having to send an email to one of the company's VPs, in which I quoted the relevant section of the EULA, stated that they were bound by it as much as I, and made it clear that if they kept refusing, I would take them to the local Small Claims Court for breach of contract. It worked.
These EULAs, if they are going to be enforcable, need to be enforced just as much on the vendors as on the users. If the EULA states that you have the right or the ability to do something, then do it - and if the vendor objects, well, then the contract assumed in the EULA has been broken, and is therefore considered void.
"Once the right type is developed, it can be distributed to poor countries. The company can eliminate the reproductive gene for commercial sales in developed countries."
This scares the hell out of me.
They're going to try to develop two varieties of a crop - one that can reproduce, and one that can't. How long do you think such a setup would last before they "accidentally" mixed some sterile seed in with the non-sterile? Then a year later, poor farmers who needed to save seeds from the previous year's crops will plant them, but nothing will grow. And this will spread.
We've already seen that some varieties of GM crops - even the ones that are supposedly sterile - will cross-pollinate with other varieties. (Remember last year, Monsanto was suing a farmer who did not purchase GM seeds from them, simply because his crops were cross-pollinated by his neighbor's GM plants? Don't remember? Check http://www.inetex.com/joanne/monsanto_sues_farmer_ over_gen.htm. More info can be found at http://burn.ucsd.edu/~mai/news4/monsanto2.html.)
And can we really trust a company with a history of suing its own customers over patent infringment to release non-sterile seed, out of the goodness of their corporate hearts?
God....and we thought Microsoft was bad. These people want to control every gene in every plant, and sue anyone who dares to be so impudent as to grow crops that might be cross-pollinated by their patented varities.
This patenting of life forms and genetic material needs to stop, and needs to stop now. It's only going to get much, much worse.
Slashdot Mirror
Actually, while the copy of cmd.exe in /scripts and /msadc can be used to run arbitrary commands, these commands will be run with the privilege level of the IUSR_MACHINENAME account - which defaults to GUEST privileges. So you can't do something fun like grab sam._.
A 'wider' backdoor, I think, would involve uploading some type of privilege escalation tool, to give IUSR_MACHINENAME admin rights. Now _that_ would be useful...
Hey, according to a friend who's there, the SJ protests are still going on. I'm heading over there now...
---
reverend lola
the titanium sheep
...some doctors don't feel RSI is real. My insurance company sent me to one when I was diagnosed with tendinitis. He refused to believe I was actually injured, stating that I was having 'chronic arm pain' from a 'lack of conditioning'. That my wrists were just _tired_ from typing all day. And he prescribed physical therapy ... which caused damage to my wrists that was much more severe than the original tendinitis had been. A crushed median nerve isn't exactly fun...
I have a good doctor now, and my wrists are healing (I can feel some of my fingers again), but a significant amount of damage was caused by a doctor's refusal to believe RSI exists.
Doctors who don't believe their patients' injuries are real will cause more injury.
---
reverend lola
the titanium sheep
*siiiiiiiiigh* I can't believe I'm posting this...
... N, I, N, E, ... six by nine..."
1. The Answer. From H2G2, pages 96 and 97:
"Alright," said Deep Thought. "The Answer to the Great Question..."
"Yes...!"
"Of Life, the Universe, and Everything..." said Deep Thought.
"Yes...!"
"Is..." said Deep Thought, and paused.
"Yes...!"
"Is..."
"Yes...!!!...?"
"Forty-two," said Deep Thought, with infinite majest and calm.
... From further down page 97:
"Exactly!" said Deep Thought. "So once you do know what the question actually is, you'll know what the answer means."
2. The Question.
From Restaurant at the End of the Universe, page 136:
"...what do you get if you multiply six by
--- reverend lola
the titanium sheep
"...and I am now the proud owner of a number of unopened Windows OS's, waiting for the day when Microsoft will give me my money back."
Check your EULAs. You can't return 'em to MS, you have to go through the OEM. If you haven't used the copy of Windows that came pre-installed on your machine, the OEMs legally must allow you to return the unused OS for a refund.
Email me (remove the sheep noises from my email, above) if you need any advice on how to do this - I still have the emails I sent emachines when I returned a pre-installed copy of Win98.
Ok, this caught my eye: "No printing is permitted on this book."
Now, I know it's probably a typo, and they meant to say 'of', not 'on'. But to stick to the text of the 'Permissions' page, you could print as many copies of it as you wanted. Just don't print anything ON the book.
You mean you _don't_ read your EULAs?
Do you read all the way through contracts before signing them? Loan paperwork? Insurance policies? Rental agreements? Of course you do - you need to know what you're agreeing to when you sign.
So why is an EULA any different?
I read all the way through the EULA the last time I bought an off-the-shelf PC. And y'know what it said? Right at the top of the page - "This EULA is a legally binding agreement between you, the Manufacturer, and Microsoft Corporation." And a few paragraphs later - "If you do not agree to the terms and conditions of this EULA, then Manufacturer and Microsoft Corporation do not wish to license the software product to you. In such event, you should not use or copy the software product, and should promptly contact Manufacturer for instructions on return of the unused software product for a refund."
So I did. Kept the PC, returned the OS. Got a refund check.
THAT is one reason why you should read your EULAs.
We, as end-users, have few enough rights in the EULAs as it is - by not reading your EULAs, you prevent yourself from knowing, and therefore exercising, the few rights you have left.
Well, no, not really. With Open Source, you can _see_ what the changes are.
If the MS advisories ever contained enough information to be useful, this might have an affect on us. But they were always very carefully worded to be vague. We'd know there was a problem, for example, in IIS, and that there was a patch - and that's all we'd know. Just that there was a patch. No information specific enough for us to use. A lot of the time, other people or groups would release more info, and that was great. But the rest of the time, well.....
They did the same thing with the pages for their Y2K patches last year, as well. It was hell trying to keep up-to-date with everything, when the pages would disappear, the information would change, and the patches would be modified. The patch you'd download from a site one day would be different the next.
PROOF???? You sound like the insurance company I have to deal with...
I've had a combination of tendinitis and carpal tunnel for over a year and a half now.... And I can tell you that it IS real, it IS serious, and it will fsck up your life if you don't realize it in time.
Have you tried going to a local Linux Users' Group for help? The one here (SVLUG) has a monthly installfest for just this kind of thing...
Maybe I'm missing something obvious here, but what the fsck was the yankees.com machine doing still connected to the 'net hours after it was known to be compromised?
If they were even halfway serious about preserving any evidence on the machine, the first thing to do is _yank_the_network_cable_. Then (depending on policy) you might dump the memory before switching the machine off.
Read the EULA again. There are two particularly relevant bits. The first is at the very top, where is says "This End User License Agreement is a legally binding document between you, the Manufacturer, and Microsoft Corporation." Keep this in mind.
The second part is normally partway through the first paragraph. It may be slightly different with different EULAs, but mine said: "If you do not agree to the terms and conditions of this EULA, then Manufacturer and Microsoft Corporation do not wish to license the Software Product to you. In this event, you may not use or copy the Software Product, and should promptly contact Manufacturer for instructions on return on the unused Software Product for a refund."
So it's up to the OEM to issue your refund. Call them. Go through customer service and tech support. It will take a while, but you _will_ get your refund.
I didn't get my Windows refund until after I sent an email to a VP at the OEM, politely stating that if they did not behave as the EULA required them to, I would take them to the local Small Claims Court for Breach of Contract.
If you need help or moral support with your refund efforts, feel free to email me - I know a couple other things that might work as well.
There's already exploit code out there. Links to it were provided in the USSR Labs' advisory, which appeared on NTBugTraq this morning.
Their advisory can be found in the NTBugTraq archives, here.
...it's a buffer overflow.
Outlook doesn't check the length of one of the date fields - a long string of data in that field will overflow a buffer. Once this has occurred, arbitrary code can be executed.
The fix is to install IE 5.01 SP1 on any affected Windows platform. Or you can install IE 5.5 - but not on Win2K.
More information is available in the posts to BugTraq and NTBugTraq, which is where I got the above information.
I haven't seen the Prius yet, but I was able to rent an Insight for a few days a while back. It was great - except for space. The batteries take up so much room, there's just barely enough trunk space for a bookbag. Although I did get about 65 - 70 mpg while I was driving it. Very nice.
The main issue, though, is one of cost. I would love to buy a hybrid car. But these things start around $20 - 21K. I expect the prices will drop as more models become available, but for right now they're a bit out of my price range.
I have to laugh at this. M$ created their own little astroturf support group, demanding that they be given the "Freedom to Innovate".
They've always had the freedom to develop innovative products. I just don't see that they've ever done it.
The problem, as I see it, is a social one. In this country, at least, the majority of girls are told - whether outright, or more subtly - that they: 1 - shouldn't learn about computers because they'll never be good at it; 2 - shouldn't use computers because it's not girly/feminine/appropriate for a female-type person to use, whether for social, religious, or other reasons; 3 - shouldn't use computers because it would take their attention away from what should be their priorities, which are marriage and children; 4 - shouldn't learn about computers because it makes them less attractive to guys.
Before anyone tries to argue these, I have to mention that I, as a geek girl, have been given ALL of those arguments.
In discussions with my female geek friends,
I have found that - guess what? - they have also had to go through the same things.
At every level of school - from elementary, junior high, high school, and even college - girls are discouraged from pursuing anything even remotely geeky. Hell, I once was told by a high school guidance counselor that I should take home ec (rather than pre-calc) because "You're a girl. Girls don't need math. Girls need to know how to cook for their husbands." This was when I told him I wanted to go to college and major in math.
I have had to fight opposition from teachers, school admin, other students, and even my own family. And once I got through all of that, and got out into the 'real world'... I found that it's not much better sometimes.
We can look at statistics and argue them for years, but we're not going to see a change until we, as a society, begin to encourage any girls who want to be geeks, rather than suppressing them.
Just my estrogen-filled $0.02...
The Romans had an interesting way of structuring their names. For men, a name would be composed of individual name, family name, and father's name.
So Publius Virgilius Maro would have been called Publius, or Publius Virgilius. His father's name would have been Maro Virgilius and whatever Maro's father's name was.
If Publius Virgilius had any sisters, they would have all had the same name - Virgilia. Yep - the female form of the family name. If there were more than one, they would have had nicknames of some sort, but technically...well...let's just say Roman women didn't have much in the way of name choice.
Here's another example, from one of the textbooks used in my Latin classes - Quintus Horatius Flaccus. The fifth son of the flabby man. You're probably familiar with 'Horace', right? Same guy. We know he had four older brothers (else why the 'Quintus'?). And any female siblings he had would have all been named 'Horatia'.
What I don't understand is why people feel they have to shorten or mutilate the Romans' names... I mean, sure, I can understand referring to a person by their surname/family name. But why change it?
And don't even let me get started on the butchery done to Latin poetry when it's 'translated' into English. So much is lost and changed that reading it in the original Latin is a completely different experience.
The BugTraq discussion thread about this issue can be found here.
"Why didn't NSI think of this years ago?"
.blank.-digit number, for example .blank. The numbers used, other than the date, are sequential. Which means - guess what? - the numbers can be predicted with only a very little bit of work. Just include the predicted tracking number in the spoofed email, and there you go!
Umm....They did.
The email they send you has a tracking number, which you must include in the Subject field of any response you send.
Here's the catch - the tracking number is made up of the date and a
For a better description, check here.
"If you've provided adequate security"...
...then your box won't be hacked. Which means that it can't be used in another attack. So if your box isn't used to launch another attack, you can't be sued for it.
Isn't that the point of security, anyway?
The point with Refund Day was that the vendors were refusing to honor the EULA. It clearly states that if you don't agree to it, you should contact the OEM.
The problem is that the OEMs do not want to let you get a refund. It took me almost four months to get mine - four months of dealing with them saying:
1 - I could return the software only if I returned the hardware as well (which is not how it's stated in the EULA);
2 - They couldn't give me a refund because MS wouldn't let them return the license:
3 - They couldn't give me a refund because MS wouldn't let them re-use the returned license for another machine;
4 - They wouldn't let me return Windows because MS put the EULA in the box, they didn't, and therefore it wasn't their EULA, and so they weren't bound by it;
5 - They didn't believe that the EULA said what it did (I sent them a few copies).
And so on. I ended up having to send an email to one of the company's VPs, in which I quoted the relevant section of the EULA, stated that they were bound by it as much as I, and made it clear that if they kept refusing, I would take them to the local Small Claims Court for breach of contract. It worked.
These EULAs, if they are going to be enforcable, need to be enforced just as much on the vendors as on the users. If the EULA states that you have the right or the ability to do something, then do it - and if the vendor objects, well, then the contract assumed in the EULA has been broken, and is therefore considered void.
From the article:
_ over_gen.htm. More info can be found at http://burn.ucsd.edu/~mai/news4/monsanto2.html.)
"Once the right type is developed, it can be distributed to poor countries. The company can eliminate the reproductive gene for commercial sales in developed countries."
This scares the hell out of me.
They're going to try to develop two varieties of a crop - one that can reproduce, and one that can't. How long do you think such a setup would last before they "accidentally" mixed some sterile seed in with the non-sterile? Then a year later, poor farmers who needed to save seeds from the previous year's crops will plant them, but nothing will grow. And this will spread.
We've already seen that some varieties of GM crops - even the ones that are supposedly sterile - will cross-pollinate with other varieties. (Remember last year, Monsanto was suing a farmer who did not purchase GM seeds from them, simply because his crops were cross-pollinated by his neighbor's GM plants? Don't remember? Check http://www.inetex.com/joanne/monsanto_sues_farmer
And can we really trust a company with a history of suing its own customers over patent infringment to release non-sterile seed, out of the goodness of their corporate hearts?
God....and we thought Microsoft was bad. These people want to control every gene in every plant, and sue anyone who dares to be so impudent as to grow crops that might be cross-pollinated by their patented varities.
This patenting of life forms and genetic material needs to stop, and needs to stop now. It's only going to get much, much worse.