I think it'd be a perfect opportunity to show off Linux's advantages, though. Sure you can get infected by this. But most Linux users don't routinely run as root, Linux provides a nice firewall system and you need root privileges to alter that firewall. So even if someone's infected, if they've blocked UDP port 5503 ( and maybe higher ports, wherever the Trojan will listen ) with the firewall then even if they're infected the Trojan can't be contacted and exploited and a simple script can be put into crontab to check for a) the listening connection, b) the lockfile and c) the rejected incoming attempts and alert the user. It'd take me maybe an afternoon to come up with the scripts that'd run on any Linux system.
So let them hype this one up, then demonstrate the 2 minutes' work it takes to immunize your system against it if you're dumb enough to run unknown software manually, and then note that you aren't that dumb in the first place.
My thought is that quality won't improve until software makers and authors are held responsible in the same way any other manufacturer is for defective products. If Ford, say, tried to say they weren't responsible for defective products beyond paying for a replacement car, any judge around would smack them for contempt of court for ignoring precedent before letting the jury take them to the cleaners ( see the Pinto case ). Until the same thing happens to software companies, we won't see any change.
IMHO striking all those EULA provisions as illegal and enforcing consumer-protection rules for software would be a Good Thing.
One question, though: how do you determine which packets in the session are part of a password? And if you can't do that, how do you decide which timing information is to be used in breaking a password?
Seems to me this is not exactly a trivial job, and makes the attack fairly useless except in special situations where the attacker has knowledge of the exact sequence the user will be following.
I think this applies only to passwords typed during an SSH session, not the password during the authentication phase. As far as I know, during password authentication the password is collected and sent as a single unit, not character by character. Finding information about passwords by watching character timing's not a new attack, and there's one major problem with it: during an encrypted session, how do you tell when the user's typing a password, as opposed to moving around in an editor or something?
Simple. In all the cases that protected anonymous postings, none of them have given total protection. What they've said is that you wouldn't be able to force the revelation of the poster's identity just because you made an allegation, you have to prove that the posting was, for example, libel first. So you protect yourself by sueing John Doe for libel and proving he did libel you, then ask the court to force the message board to reveal his actual identity now that you've proved he did commit libel. And if you can't prove he committed libel, you've no legal grounds for demanding that he sign his name to it.
As for the ISP, you can get it removed by proving that the material itself is defamatory. You don't need to know who posted it to do that.
Version 3? Don't think so.
on
Code Red III
·
· Score: 5, Insightful
My suspicion is this is Code Red 2. One of the AV companies used "CodeRed.v3" or something similar to refer to Code Red 2, and I'd bet the journalists were just too clueless to figure out that the two names refer to the same thing.
I can think of a more effective solution: every time a Code Red probe goes out, deprovision the modem belonging to the customer with that IP address. They've got a proven AUP violation and a proven security problem that's disrupting their network. That's more than enough justification for jerking the account entirely. This has the dual benefits of shutting down Code Red and forcing people to actually learn how to secure their systems which makes future problems slightly less likely, and doesn't impact those of us who aren't susceptible to Code Red at all.
Re:I dove in, and found the pool empty.
on
Netscape 6.1
·
· Score: 2
That's odd. I find Mozilla 0.9.3 incredibly stable on my systems. Then again, I use it on Linux and Windows NT, which are both relatively stable base OSes. I have crashes in it on my Win98 system, but then I have crashes in IE5.5 on that system about as often. Which implies that it's the underlying system, not the browser, that's unstable. It's hardly news that Win98's not nearly as stable as NT4, and if you've installed any third-party software on that Win98 box, things get really hairy.
Then Symantec's done lost their minds. Remote root/shell access is the worst thing that can happen, because after that you're basically at the mercy of the cracker until you've sanitized the machine again. Complete destruction of the disks is nowhere near as bad as having someone who can eavesdrop on every password on your machine or steal any data he wants or alter any data he wants.
They're worried that they might be facing an injunction against shipping WinXP with everything they want buried in it, one forcing them to either not ship or make those things modular so they can be replaced by the consumer if they choose. They figure that by appealing to the Supremes now they can freeze the case's return to the District Court level and any possibility of an injunction until after they've shipped WinXP the way they want it, and that once the thing's in the field it'll be too late for the District Court to do anything about it. IOW, they want to stall until they can present the court with a fair accompli.
No, it's the same approach everyone else is talking about, just a different application of it. I already use this approach on my system, for example, to insure that Telnet/SSH traffic ( interactive sessions, low bandwidth ) gets priority over FTP and HTTP ( typically large downloads, high bandwidth ). That gets me fast response in terminal sessions without really hindering FTP/Web performance.
But the tool can be used both ways. Look at who's screaming for and pushing for QoS: businesses who want to sell things to you. You hear them talking about the larger, more intrusive ads as being better because they're harder for users to ignore. The fact that they interfere with the user seeing what he came to the site to see doesn't even come up. Those same companies are also the ones starting to pay ISPs to handle their content and otherwise give them preference. If you give them a tool that they can use ( or abuse ) to make their ads come up first and fastest, what use do you think they're going to make of it?
Simple. QoS allows providers to declare that one kind of traffic takes priority over another. X10.com can pay to have their ads declared high priority by their provider. You probably can't afford to pay to have your radio station declared high priority. X10.com's interests are served ( their ads get out faster ). Their provider's interests are served ( they get paid more ). Your interests get ignored. The interests of anyone who wants to listen to your station get ignored. Is this a good thing?
And we know that the first thing the big companies like AOL/Time-Warner and such will do once QoS goes into place is to make some nice, lucrative deals with the backbones to insure that their content is never declared low priority.
I don't believe that. The last boxed set I bought was RedHat 6.2 back in 1999. I bought StarOffice and WordPerfect since then, that's it. The rest has been downloaded from the net. Of course I only buy boxed sets for major upgrades, minor releases I upgrade piecemeal as needed.
When figuring Windows, you also need to consider functionality. Windows is cheap at under $200. Add in mail and news software and a browser that aren't security breaches waiting to bite you, a version control system, development tools, a database system, SSH client, a compression and archiving tool, a word processor and so on, and the Windows system starts to cost a lot more than the equivalent Linux system.
The problem is the costs involved. For example, suppose I go, as someone else said, and buy a copy of Exchange Server and a bunch of client licenses. I don't bother buying any Windows licenses because I'll be using the copies of Outlook Express that came with the computers I bought. But if the BSA comes along at Microsoft's behest and audits me, how do I prove I own those licenses? The paperwork's probably long gone, or at least buried deep in wherever I store company paperwork. I probably threw most of the original CDs away, if I even got them, because how many copies of the same CD do you really need? Can you find the license document for the copy of Windows you're probably running right now?
Actually there's precedent for having someone who wants to distribute a work they don't have publishing rights to be able to do so over the objections of the owner of the piece. It's called the compulsory license. Any broadcaster can play any song they want, whether the recording company likes it or not, as long as they pay the appropriate royalty for doing so. This would simply be an extension of that right.
And even the members of the RIAA are in favor of this sort of license, at least when it's them doing the broadcasting. They've already asked a court to consider their use of songs for their on-line music service to fall under the compulsory license rules so they don't have to negotiate individually with the artists for rights to use the songs.
Apparently you failed to read RFC2462, which addresses this. Hosts do not configure the high 64 bits of their address, they are told what it is by their router(s) during configuration of the interface. A site's local address topology is completely independent of the 48-bit prefix assigned to them by their provider. Creative abuse of the relevant RFC lets you do this even if your provider gives you a/64.
Actually pppp.pppp.pppp wil be assigned to the provider, ssss will be assigned to the user, and hhhh.hhhh.hhhh.hhhh can be assigned however the user wants. The RFCs specify that the host part should be derived from the Ethernet MAC address on Ethernet-based networks, but they can't really write in dependence on anything but the host part being unique within the subnet ( think about PPP, which doesn't have anything like a MAC address ).
Portable addresses are why the routing tables are so big. Compact routing tables require that everything down a given branch of the routing tree have the same address prefix. The larger the number of prefixes down a given branch, the larger the routing tables need to be. IPv6 tries to deal with this by a) insuring that there's enough room in the 'host' portion that customers can subnet their networks completely within it and b) the provider has a large enough address space to assign a single subnet to each customer. That's also why they've kept alive the idea of a subnet hierarchy within the rightmost 64 bits.
And don't try invoking a different addressing method. All of them eventually boil down to the address being a string of bits, and while the terms for each field in that string change the basic problem of the routing tree doesn't.
Permanent IPv6 addresses that can roam screw up the routing tables. Right now the big problem on the backbone isn't the IPv4 address space, it's the sheer number of routing entries needed. If they force everyone connecting through a given provider to use the provider's network number, they drasticaly simplify the routing. And with 16 bits for the provider to subnet, and 64 bits that the end user can play with and subnet if they want ( none of the policies preclude dividing the 'host' portion up into sections by the end user ), handling dynamic network numbers isnt' nearly the problem it is under IPv4.
You overestimate the average parent. The competent ones already have a handle on what their kids are doing and aren't worried about the computer, any more than they're worried about their kid getting their hands on magazines they shouldn't. The majority of parents, though, don't want to have to actually work at raising their kids. They want somebody else to guarantee their kid never sees anything they wouldn't approve of. That way they won't have to go through the embarrassment of explaining to their kid why this kind of stuff is bad, and why they shouldn't be into Daddy's stash of it.
Chicanery it may be, but it's still in there, which means it should be enforced just as thoroughly as any of the other provisions. Make "USC Title 17 section 1201(c)(1)" words that every IP protection software maker hates to hear.
What Adobe did could arguably be a crime. In Russia, it is illegal to limit making backup copies of computer software. Adobe's e-book software limits that, which means it violates Russian law. Where the software was written, it would be Adobe being charged with a violation of the law and not Skylarov.
There's also the US law part of it. Making personal-use copies of copyrighted works is specifically protected as fair use. Making backup copies of computer media is as well. Selling your copy to someone else is as well. The DMCA specifically says that nothing in it shall be construed as limiting fair use rights. Adobe's software limits those fair use rights, and they cite the DMCA in direct contradiction of the DMCA itself. Maybe it's time to stop hacking around these things and start filing suit against these companies for violations of USC Title 17 Chapter 1 sections 107, 109 and 117. Basically, don't argue that breaking copy protection shouldn't be illegal, argue that putting the copy protection in in that manner is itself illegal.
Microsoft's argument that mixing IE and other code in libraries wasn't comingling sounds an awful lot like arguing that you didn't comingle salt and water when you poured salt in the glass of water and stirred it: it conveniently ignores the very definition of "comingle".
Theoretical max speed on a 56k modem is about 7K/sec ( 56 kilobits / 8 bits per byte ). Lowest speed I've recorded on Cox@Home is 18K/sec ( to Sunsite, on a high-traffic day ). 7K/sec is less than 18K/sec. QED.
Slashdot Mirror
I think it'd be a perfect opportunity to show off Linux's advantages, though. Sure you can get infected by this. But most Linux users don't routinely run as root, Linux provides a nice firewall system and you need root privileges to alter that firewall. So even if someone's infected, if they've blocked UDP port 5503 ( and maybe higher ports, wherever the Trojan will listen ) with the firewall then even if they're infected the Trojan can't be contacted and exploited and a simple script can be put into crontab to check for a) the listening connection, b) the lockfile and c) the rejected incoming attempts and alert the user. It'd take me maybe an afternoon to come up with the scripts that'd run on any Linux system.
So let them hype this one up, then demonstrate the 2 minutes' work it takes to immunize your system against it if you're dumb enough to run unknown software manually, and then note that you aren't that dumb in the first place.
My thought is that quality won't improve until software makers and authors are held responsible in the same way any other manufacturer is for defective products. If Ford, say, tried to say they weren't responsible for defective products beyond paying for a replacement car, any judge around would smack them for contempt of court for ignoring precedent before letting the jury take them to the cleaners ( see the Pinto case ). Until the same thing happens to software companies, we won't see any change.
IMHO striking all those EULA provisions as illegal and enforcing consumer-protection rules for software would be a Good Thing.
One question, though: how do you determine which packets in the session are part of a password? And if you can't do that, how do you decide which timing information is to be used in breaking a password?
Seems to me this is not exactly a trivial job, and makes the attack fairly useless except in special situations where the attacker has knowledge of the exact sequence the user will be following.
I think this applies only to passwords typed during an SSH session, not the password during the authentication phase. As far as I know, during password authentication the password is collected and sent as a single unit, not character by character. Finding information about passwords by watching character timing's not a new attack, and there's one major problem with it: during an encrypted session, how do you tell when the user's typing a password, as opposed to moving around in an editor or something?
Simple. In all the cases that protected anonymous postings, none of them have given total protection. What they've said is that you wouldn't be able to force the revelation of the poster's identity just because you made an allegation, you have to prove that the posting was, for example, libel first. So you protect yourself by sueing John Doe for libel and proving he did libel you, then ask the court to force the message board to reveal his actual identity now that you've proved he did commit libel. And if you can't prove he committed libel, you've no legal grounds for demanding that he sign his name to it.
As for the ISP, you can get it removed by proving that the material itself is defamatory. You don't need to know who posted it to do that.
My suspicion is this is Code Red 2. One of the AV companies used "CodeRed.v3" or something similar to refer to Code Red 2, and I'd bet the journalists were just too clueless to figure out that the two names refer to the same thing.
I can think of a more effective solution: every time a Code Red probe goes out, deprovision the modem belonging to the customer with that IP address. They've got a proven AUP violation and a proven security problem that's disrupting their network. That's more than enough justification for jerking the account entirely. This has the dual benefits of shutting down Code Red and forcing people to actually learn how to secure their systems which makes future problems slightly less likely, and doesn't impact those of us who aren't susceptible to Code Red at all.
That's odd. I find Mozilla 0.9.3 incredibly stable on my systems. Then again, I use it on Linux and Windows NT, which are both relatively stable base OSes. I have crashes in it on my Win98 system, but then I have crashes in IE5.5 on that system about as often. Which implies that it's the underlying system, not the browser, that's unstable. It's hardly news that Win98's not nearly as stable as NT4, and if you've installed any third-party software on that Win98 box, things get really hairy.
Then Symantec's done lost their minds. Remote root/shell access is the worst thing that can happen, because after that you're basically at the mercy of the cracker until you've sanitized the machine again. Complete destruction of the disks is nowhere near as bad as having someone who can eavesdrop on every password on your machine or steal any data he wants or alter any data he wants.
They're worried that they might be facing an injunction against shipping WinXP with everything they want buried in it, one forcing them to either not ship or make those things modular so they can be replaced by the consumer if they choose. They figure that by appealing to the Supremes now they can freeze the case's return to the District Court level and any possibility of an injunction until after they've shipped WinXP the way they want it, and that once the thing's in the field it'll be too late for the District Court to do anything about it. IOW, they want to stall until they can present the court with a fair accompli.
No, it's the same approach everyone else is talking about, just a different application of it. I already use this approach on my system, for example, to insure that Telnet/SSH traffic ( interactive sessions, low bandwidth ) gets priority over FTP and HTTP ( typically large downloads, high bandwidth ). That gets me fast response in terminal sessions without really hindering FTP/Web performance.
But the tool can be used both ways. Look at who's screaming for and pushing for QoS: businesses who want to sell things to you. You hear them talking about the larger, more intrusive ads as being better because they're harder for users to ignore. The fact that they interfere with the user seeing what he came to the site to see doesn't even come up. Those same companies are also the ones starting to pay ISPs to handle their content and otherwise give them preference. If you give them a tool that they can use ( or abuse ) to make their ads come up first and fastest, what use do you think they're going to make of it?
Simple. QoS allows providers to declare that one kind of traffic takes priority over another. X10.com can pay to have their ads declared high priority by their provider. You probably can't afford to pay to have your radio station declared high priority. X10.com's interests are served ( their ads get out faster ). Their provider's interests are served ( they get paid more ). Your interests get ignored. The interests of anyone who wants to listen to your station get ignored. Is this a good thing?
And we know that the first thing the big companies like AOL/Time-Warner and such will do once QoS goes into place is to make some nice, lucrative deals with the backbones to insure that their content is never declared low priority.
I don't believe that. The last boxed set I bought was RedHat 6.2 back in 1999. I bought StarOffice and WordPerfect since then, that's it. The rest has been downloaded from the net. Of course I only buy boxed sets for major upgrades, minor releases I upgrade piecemeal as needed.
When figuring Windows, you also need to consider functionality. Windows is cheap at under $200. Add in mail and news software and a browser that aren't security breaches waiting to bite you, a version control system, development tools, a database system, SSH client, a compression and archiving tool, a word processor and so on, and the Windows system starts to cost a lot more than the equivalent Linux system.
Odds on they're in for a suprise. I suspect the Digital Playback uses the same mechanism used to 'rip' tracks from the CD.
The problem is the costs involved. For example, suppose I go, as someone else said, and buy a copy of Exchange Server and a bunch of client licenses. I don't bother buying any Windows licenses because I'll be using the copies of Outlook Express that came with the computers I bought. But if the BSA comes along at Microsoft's behest and audits me, how do I prove I own those licenses? The paperwork's probably long gone, or at least buried deep in wherever I store company paperwork. I probably threw most of the original CDs away, if I even got them, because how many copies of the same CD do you really need? Can you find the license document for the copy of Windows you're probably running right now?
Actually there's precedent for having someone who wants to distribute a work they don't have publishing rights to be able to do so over the objections of the owner of the piece. It's called the compulsory license. Any broadcaster can play any song they want, whether the recording company likes it or not, as long as they pay the appropriate royalty for doing so. This would simply be an extension of that right.
And even the members of the RIAA are in favor of this sort of license, at least when it's them doing the broadcasting. They've already asked a court to consider their use of songs for their on-line music service to fall under the compulsory license rules so they don't have to negotiate individually with the artists for rights to use the songs.
Apparently you failed to read RFC2462, which addresses this. Hosts do not configure the high 64 bits of their address, they are told what it is by their router(s) during configuration of the interface. A site's local address topology is completely independent of the 48-bit prefix assigned to them by their provider. Creative abuse of the relevant RFC lets you do this even if your provider gives you a /64.
Actually pppp.pppp.pppp wil be assigned to the provider, ssss will be assigned to the user, and hhhh.hhhh.hhhh.hhhh can be assigned however the user wants. The RFCs specify that the host part should be derived from the Ethernet MAC address on Ethernet-based networks, but they can't really write in dependence on anything but the host part being unique within the subnet ( think about PPP, which doesn't have anything like a MAC address ).
Portable addresses are why the routing tables are so big. Compact routing tables require that everything down a given branch of the routing tree have the same address prefix. The larger the number of prefixes down a given branch, the larger the routing tables need to be. IPv6 tries to deal with this by a) insuring that there's enough room in the 'host' portion that customers can subnet their networks completely within it and b) the provider has a large enough address space to assign a single subnet to each customer. That's also why they've kept alive the idea of a subnet hierarchy within the rightmost 64 bits.
And don't try invoking a different addressing method. All of them eventually boil down to the address being a string of bits, and while the terms for each field in that string change the basic problem of the routing tree doesn't.
Permanent IPv6 addresses that can roam screw up the routing tables. Right now the big problem on the backbone isn't the IPv4 address space, it's the sheer number of routing entries needed. If they force everyone connecting through a given provider to use the provider's network number, they drasticaly simplify the routing. And with 16 bits for the provider to subnet, and 64 bits that the end user can play with and subnet if they want ( none of the policies preclude dividing the 'host' portion up into sections by the end user ), handling dynamic network numbers isnt' nearly the problem it is under IPv4.
You overestimate the average parent. The competent ones already have a handle on what their kids are doing and aren't worried about the computer, any more than they're worried about their kid getting their hands on magazines they shouldn't. The majority of parents, though, don't want to have to actually work at raising their kids. They want somebody else to guarantee their kid never sees anything they wouldn't approve of. That way they won't have to go through the embarrassment of explaining to their kid why this kind of stuff is bad, and why they shouldn't be into Daddy's stash of it.
Chicanery it may be, but it's still in there, which means it should be enforced just as thoroughly as any of the other provisions. Make "USC Title 17 section 1201(c)(1)" words that every IP protection software maker hates to hear.
What Adobe did could arguably be a crime. In Russia, it is illegal to limit making backup copies of computer software. Adobe's e-book software limits that, which means it violates Russian law. Where the software was written, it would be Adobe being charged with a violation of the law and not Skylarov.
There's also the US law part of it. Making personal-use copies of copyrighted works is specifically protected as fair use. Making backup copies of computer media is as well. Selling your copy to someone else is as well. The DMCA specifically says that nothing in it shall be construed as limiting fair use rights. Adobe's software limits those fair use rights, and they cite the DMCA in direct contradiction of the DMCA itself. Maybe it's time to stop hacking around these things and start filing suit against these companies for violations of USC Title 17 Chapter 1 sections 107, 109 and 117. Basically, don't argue that breaking copy protection shouldn't be illegal, argue that putting the copy protection in in that manner is itself illegal.
Microsoft's argument that mixing IE and other code in libraries wasn't comingling sounds an awful lot like arguing that you didn't comingle salt and water when you poured salt in the glass of water and stirred it: it conveniently ignores the very definition of "comingle".
Theoretical max speed on a 56k modem is about 7K/sec ( 56 kilobits / 8 bits per byte ). Lowest speed I've recorded on Cox@Home is 18K/sec ( to Sunsite, on a high-traffic day ). 7K/sec is less than 18K/sec. QED.