This is NOT an "IIS" hole. That's a fact.
This is an Indexing Server hole. That's a fact.
Comparing this to 'apache never having an exploit like this' is wrong. That's a fact.
Comparing this to some apache module or CGI script being exploited, which has happened, and will continue to happen, is accurate. That's a fact.
The Russians, the Chinese, and every other country that routinely run 'agents' against the US of A.
As the chief counter-intelligence of the USA, the FBI is probably using these things against all sort of confirmed and suspected foreign agents.
And now the FBI'll be forced to explain exactly what the thing is, how it works, what it looks like, and a lot of 'spies' are going to check their computers....
Re:Why Symantec says that Code Red is medium.
on
Code Redux
·
· Score: 2
Go search google for 'morris worm.' Then repeat, one hundred times, "every problem that Microsoft is having with security, UNIX had, and continues to have."
Nope, he doesn't do the voice of Ben. Ben is some 60 year old radio guy. He does, however, do the voice of the trucker. Emmett, his name is, if I recall correctly. The guy with the Imperial symbol tattoo.
Re:I think someone needs to get laid
on
Mac Rants
·
· Score: 2
Has somebody actually sat down and benchmarked a piece of code that was FULLY OPTIMIZED FOR SSE2 versus a piece of code that was FULLY OPTIMIZED FOR ALTIVEC?
Not to my knowledge. Sure, altivec optimized versus stock x6 (i.e. maybe optimized for PPro, if they're using VC++6)
Until that happens, you're making shit up.
"Hi, I'm too fucking lazy to do my own needs assement and product research, so I'm hoping somebody will tell me what to do, so when I decide I don't like it, I can blame somebody else." gets posted, but the title of the next Star Wars movie gets rejected. But I'm sure somebody else will submit it, and a different/. editor will post it.
But I'm not bitter.
Y'all always complain when people who don't understand Linux make poor reviews of it. Well, this guy doesn't understand MS operating systems.
Easy networking setup? Been there since 95. 2K will put you on a DHCP TCP/IP network with nothing but an 'ok' click.
The 'temptation to use another person's account because the name is already in there?' So tell NT to clear the last user logged in dialog. But I guess things like system policies are a bit technical for this guy; after all, penguins with wrenches are more important to him.
GET/scripts/root.exe?/c+net+stop+"World+Wide+Web+Publ ishing+Service"
should shut down IIS.
net stop "World Wide Web Publishing Service" is the functional equivalent of '/etc/rc.d/init.d/httpd stop' on Linux and various UNIXs.
Partially that's because nothing tries to use the RAM bandwith properly.
Think of the Pentium IV vs the Pentium III as a PlayStation 2 versus a Playstation 1. The 2 is a completely different architecture, that throws all the traditional concepts out the window, and is a real bitch to program to. Sure, you can port your PS1/PC/DC/whatever to it, and it'll run, but not well. But if you program to it, it'll work fairly good. And it's an interesting direction to take, and successive generations should get better.
Of course, the Sega Saturn was similar, and look where it went....
An entire story that intimates, implies, and infers that Microsoft has decided to block competing products, then the last sentance says
does not prevent Black Ice or other programs from running per se -- but it does require them to use updated versions tailored for XP.
Ok, I'm all for bashing things that need bashing, but this is getting out of hand. How DARE Microsoft try to stop those damn BSODs! How DARE they actually stop you from doing something that has the possibility of rendering your machine unbootable. How DARE they let vendors know when they're seeing a lot of problems with a new driver revision!
Oh, but if something like this is on Linux, i.e. Ximian Red Carpet, then that's ok. Then it's great. They should download new versions automatically, and install them without asking. But if it's from Windows Update, then NO NO NO! IT'S WRONG!
Ah, but the flamethrower on the car isn't intended as an anti-theft measure, it's a self defense mechanisim.
The fact was that over there (somewhere in Africa, wasn't it?) it was a statisitical likelyhood that if you were a victim of a carjacking, you'd be killed. Therefore, the courts reasoned, it was reasonable to assume that a carjacking was an attempted murder. Therefore, you could actively defend yourself against a carjacker.
Great moments in interviewing, part 7:
Q: Do you like children?
A: Oh, yes, they're so wonderfully soft, and they smell so clean, and they're so innocent, as they look up at you with those bright, inquisitive eyes as you slowly guide your... I'm sorry, could we talk about the network topology some more?
For the humor impared, this is a joke. Similar to the "Why do you want to be a babysitter?" "Because my master, the Demon Lord of the 7th Pit of Hell has so instructed me. I do not presume to know his reasons." one.
For networking candidates I have found the best watermark is to give them a non-standard netmask (like/29) and an IP address and then ask them to tell me the network and broadcast addresses.
Out of curiosity, how would you react when I pull out my palm, run 'ipcalc,' input the information, and read off the result?
I do something similar to this in interviews. I have a laptop on the desk, with a big chunky PCMCIA NIC, with huge lights. It's plugged into the wall, but the cord is bad. Ergo, no hooge 'LINK' light on the NIC.
I say 'this laptop can't see the network. Start trying to fix it.'
So far, nobody has so much as glanced at the lights on the NIC.:-)
- Don't assume that there is a piece of knowledge that is an absolute marker of proficiency or understanding of a topic. Sure, any experienced network admin would probably know about tcpdump, but there are certainly sysadmins who don't have extensive networking experience.
Gods, yes. I have no solid idea what it is; I think it's a network sniffing program that dumps to a binary file. Who cares? Who cares if I know a specific tool? It's enough to know the concepts and usages of such tools. Individual tools can be learned; if you can use tcpdump you can use ethereal, network monitor, whatever. But if I don't know what a packet sniffer is in general, that's another story.
Go to either windows\startmenu or documents and settings\profile\sendto and put a shortcut to notepad in there. Then take a file, any file, right click, send to, notepad. Boom.
Slashdot Mirror
This is NOT an "IIS" hole. That's a fact. This is an Indexing Server hole. That's a fact. Comparing this to 'apache never having an exploit like this' is wrong. That's a fact. Comparing this to some apache module or CGI script being exploited, which has happened, and will continue to happen, is accurate. That's a fact.
The Russians, the Chinese, and every other country that routinely run 'agents' against the US of A. As the chief counter-intelligence of the USA, the FBI is probably using these things against all sort of confirmed and suspected foreign agents. And now the FBI'll be forced to explain exactly what the thing is, how it works, what it looks like, and a lot of 'spies' are going to check their computers....
Go search google for 'morris worm.' Then repeat, one hundred times, "every problem that Microsoft is having with security, UNIX had, and continues to have."
Nope, he doesn't do the voice of Ben. Ben is some 60 year old radio guy. He does, however, do the voice of the trucker. Emmett, his name is, if I recall correctly. The guy with the Imperial symbol tattoo.
Has somebody actually sat down and benchmarked a piece of code that was FULLY OPTIMIZED FOR SSE2 versus a piece of code that was FULLY OPTIMIZED FOR ALTIVEC? Not to my knowledge. Sure, altivec optimized versus stock x6 (i.e. maybe optimized for PPro, if they're using VC++6) Until that happens, you're making shit up.
"Hi, I'm too fucking lazy to do my own needs assement and product research, so I'm hoping somebody will tell me what to do, so when I decide I don't like it, I can blame somebody else." gets posted, but the title of the next Star Wars movie gets rejected. But I'm sure somebody else will submit it, and a different /. editor will post it.
But I'm not bitter.
Y'all always complain when people who don't understand Linux make poor reviews of it. Well, this guy doesn't understand MS operating systems. Easy networking setup? Been there since 95. 2K will put you on a DHCP TCP/IP network with nothing but an 'ok' click. The 'temptation to use another person's account because the name is already in there?' So tell NT to clear the last user logged in dialog. But I guess things like system policies are a bit technical for this guy; after all, penguins with wrenches are more important to him.
That's not 'multitasking' that's 'single tasking with ten seperate objects of type 'game.chess' in memory.
Ah, but don't forget that Quebec doesn't consider itself part of Canada, but still wants it's share of public funding.
GET /scripts/root.exe?/c+net+stop+"World+Wide+Web+Publ ishing+Service"
should shut down IIS.
net stop "World Wide Web Publishing Service" is the functional equivalent of '/etc/rc.d/init.d/httpd stop' on Linux and various UNIXs.
Let me clarifiy this a bit. The worm creates two more web directories, which point to the root of C drive and, if it exists, the root of D drive.
Nah, it's a country wide civic holiday, so it'll have different names in different areas.
Out of curiosity, why do you assume that any sex with a person under the legal age is going to be non-consenting?
Partially that's because nothing tries to use the RAM bandwith properly. Think of the Pentium IV vs the Pentium III as a PlayStation 2 versus a Playstation 1. The 2 is a completely different architecture, that throws all the traditional concepts out the window, and is a real bitch to program to. Sure, you can port your PS1/PC/DC/whatever to it, and it'll run, but not well. But if you program to it, it'll work fairly good. And it's an interesting direction to take, and successive generations should get better. Of course, the Sega Saturn was similar, and look where it went....
Just so you know, an NT admin would simply define a group policy to disable that option for XP installs on their network.
Ah, but the flamethrower on the car isn't intended as an anti-theft measure, it's a self defense mechanisim. The fact was that over there (somewhere in Africa, wasn't it?) it was a statisitical likelyhood that if you were a victim of a carjacking, you'd be killed. Therefore, the courts reasoned, it was reasonable to assume that a carjacking was an attempted murder. Therefore, you could actively defend yourself against a carjacker.
No highs, no lows! Must be BOSE!
What mailing lists do you subscribe to, or did you subscribe to at your last place of work?
Great moments in interviewing, part 7: Q: Do you like children? A: Oh, yes, they're so wonderfully soft, and they smell so clean, and they're so innocent, as they look up at you with those bright, inquisitive eyes as you slowly guide your... I'm sorry, could we talk about the network topology some more? For the humor impared, this is a joke. Similar to the "Why do you want to be a babysitter?" "Because my master, the Demon Lord of the 7th Pit of Hell has so instructed me. I do not presume to know his reasons." one.
I do something similar to this in interviews. I have a laptop on the desk, with a big chunky PCMCIA NIC, with huge lights. It's plugged into the wall, but the cord is bad. Ergo, no hooge 'LINK' light on the NIC. I say 'this laptop can't see the network. Start trying to fix it.' So far, nobody has so much as glanced at the lights on the NIC. :-)
Go to either windows\startmenu or documents and settings\profile\sendto and put a shortcut to notepad in there. Then take a file, any file, right click, send to, notepad. Boom.