Probably it could have been exploited like in the Mac case, if was just Flash.
My idea was around time. The executables of this particular botnet runs on operating systems that are around since 10 years ago?. You give an executable, and it runs (depending on api used, probably) in most windows versions around. So if you make people to run them (as explained above, somewhat not so extremely hard) and you are successful. And think that in windows there is a culture of downloading executables/installers from practically anywhere and running them. Not sure about Mac, but in linux people usually finds most of what they need included or available from the distribution they are using.
Exploiting a vulnerability in flash, or acrobat, well, depend in certain range of versions, and maybe the OS/processor where it runs. If you have an older version, or a newer version, you are out of luck. You have far wider target (and odds of success) making a.exe, and it will be still valid after you release it (what could not happen for long if the vulnerability is fixed). Could be used very effectively to hack into a particular system, but wont have the same reach as with windows (even if you consider same size installed base).
If you are in windows, and click in a link pointing to a.exe file, you are presented with the direct choice (or not) of running it directly (indirectly is just saving in the desktop and clicking on it, not too far away).
Under linux what is the "fast lane" to run something from outside? dropping it into your desktop/home dir, chmoding, and then running it? Installing a.rpm/.deb asking for root password before? Opening a.tar.gz and clicking on whatever it contains? You get far more warnings and troubles before efectively being able to run it to have a hint in some point of the process, dancing bunnies or not.
You still can get infected with something very nasty, but probably the obstacles in the path will make % of infections far smaller than for Windows.
Anyway, what about non-native executables? Java warns you before letting applications to access your own files, but is a click away (and social engineering matters). Vulnerabilities in flash/acrobat/openoffice/etc could open a door too. But is different an "always open" door, than something that could be there tomorrow (or even yesterday, not all have all up to date) or not.
Ok, lets make an analogy. I rent a car. I use it to go to a movie. And because i was sick and dizzy (biological virus) or drunk (er... chemical virus? trojan?) i killed someone in the theater front.
Now, who must be liable here? The car real owner (the rental company)? The movie theater owner? or myself?
Of course, if i rent a car that is unsafe (no brakes, random turns of the wheel, complete drink bar attached at the side of the driver) maybe some responsibility goes to the car provider. But still, some government agency must attach a label saying "unsafe at any speed" and ban the use of those cars everywhere. But while that dont happens, you are the ultimate culprit, legally speaking.
Well, if an economist quits department of treasury, or a priest quits church, is something to note, someone is quitting from a place which main speciality is what does that person.
And now that kind of things happening to a company that is part of/. culture... yes, is stuff that matters.
If well that kind of virus could be made, and work, the odds of getting infected looks so low (EVEN for windows users) that probably wont be very widespread.
In the other hand, if you have already something ugly running as admin/root in your box in a way or another, it could deploy the MBR part, but dont see the advantage of this if is anyway already in control (afaik some rootkits/trojans (?) for windows hide themselves from scanners intercepting network/disk drivers or something similar, so no big advantage there)
If well Snow Crash and Cryptonomicon are good, i enjoyed much more the reading of Diamond Age (the best educative toy story after mimsy were the borogoves, and maybe even inspiration for the OLPC). Why those 2 are "the" books of Stephenson all over the story?
Don't be unfair, is not Microsoft intentionally delivering what they promise far later, is that they measure time in an exponential curve while we measure it in a linear one, so the last month for them of this wait will take several of ours (if happens in our lifetime, at least).
A nice percent of what we know didnt come from calculating that something should happen and that it happens actually, but from where something happens when it "shouldnt". Are we killing the experimental method here?
While the idea of tactile feedback is important, it is also the idea to bring really to the max the area where you can display information AND interact. Wonder how good some sort of tactile keyboard (flat keys, that can be pressed,even that have borders) could be used as screen. In the worst case, there are a lot of people that use external keyboard/mouses with laptops (and PDAs) today, could be another alternative.
Personally i like the idea of an all-screen laptop, where the keyboard or whatever media of interaction is displayed along with the info, but in the proposed ones, i prefer the ones that optionally at least can be used with a (mostly?) horizontal keyboard and vertical screen.
... usually end causing it. Wonder in which (or in how many) sci-fi stories about oppresive governments they got that idea, but sound a lot like taken from there.
Try to prove to some hard-religious people, using just pure logic (no need to go to obscure science), that that word have an internal contradiction (do something that can't be undone later, then there is something in some point that you can't do) is already pretty hard already (something similar could be done with most all-something attributes of any god). Evolution? things that happened more than 6000 years ago? Earth not center of creation? Thats even harder to see. Proof can be faked, devil could had put the tail, or just "dont believe", and, of course, as everything, must be seen with the right glasses.
If this one starts to be deployed, maybe we should reconsider what are our favorite monsters. The Scary Hellish Giant Spy Bat of Doom definately must be top in all the list.
Torrents/p2p uses its own ports and protocols, and here you just target client machines. You can easily (?) filter them. Much different is something that is just mail, and there you get it from your mail server, whatever it is, whatever measure is taking. And one of the most used techniques to reduce spam (greylisting) is specifically targetted by Snzbi (the bot responsible back at the time this was published, almost 3 weeks ago, of 39% of the spam), so it dont stop this particular botnet.
What could Microsoft do to defeat such enemy? Just use the old, proven tactics to win, including:
- Put their own lawyers on the case. To extra effect, make Ballmer shout "Lawyers, Lawyers, Lawyers" - Buy another law, rename to MS Law, include it with new versions of Vista for free, and put the Moore Law out of the market - Patent something related to some of the words of the moore law, and sue anyone trying to use it - Finance a dying company to sue Moore for prior art. - Add some undocumented code in Windows, to make it stop working if the Moore law tries to come into effect (they already are doing a good work in this direction)
There are computers behind all services, they know about Windows (most should think its behind all those computers too) and they know that BSOD happens. IS oversimplification of the problem, but once you reach that point you dont need to go further.
The tree is not letting you to see the forest. Is not "just another cellphone", $800 or not. Is how that could turn mobile technology in the next few years, not just for phone calling, Could be a step forward in wearable computing, or at least having a not so tiny or bulky interface for whatever a cellphone provides. Something that could eventually change somewhat our culture probably fits under my "stuff that matters" area.
... is a big problem. Your report could look honest, open, have some humor etc etc, and that will have nothing to do with the fact that it is good or bad science. You can even honestly think that your are an expert in whatever topic is about. But still, it could be very wrong. As in the universe there is no single atom of justice (Pratchett dixit), the same goes for that kind of bells and whistles you want to see in the "truth" (or how it is presented). Wonder how much scientific reports presenting that the earth were flat, or the center of the universe, or that we were created by a superior being had all those attributes, even with the addendum of being of "common sense" at that time.
Still is pending how you distinguish good from bad science, of both can be presented in similar ways. Maybe some trusted authority/organization/etc can say that it is good, or at least, that the followed methodology is right.
Where you must draw the line in "user education" to make this safer?
Fake bank web sites is just one of the dangers, as isnt the only (main?) way to give away your login info. Trojan/Keyloggers are far more dangerous, as you dont need to do anything "unsafe" like putting your id/password in an untrusted/unsecure site, but identify as usual in your current safe/certified/encrypted site, and you could be giving away not just your user/password, but also where you are using them.
How you educate an average windows user to really avoid becoming part of a botnet, or installing trojans, giving the amount of ways you can become infected, or how they are disabling detection methods lately?
Slashdot Mirror
Probably it could have been exploited like in the Mac case, if was just Flash.
.exe, and it will be still valid after you release it (what could not happen for long if the vulnerability is fixed). Could be used very effectively to hack into a particular system, but wont have the same reach as with windows (even if you consider same size installed base).
My idea was around time. The executables of this particular botnet runs on operating systems that are around since 10 years ago?. You give an executable, and it runs (depending on api used, probably) in most windows versions around. So if you make people to run them (as explained above, somewhat not so extremely hard) and you are successful. And think that in windows there is a culture of downloading executables/installers from practically anywhere and running them. Not sure about Mac, but in linux people usually finds most of what they need included or available from the distribution they are using.
Exploiting a vulnerability in flash, or acrobat, well, depend in certain range of versions, and maybe the OS/processor where it runs. If you have an older version, or a newer version, you are out of luck. You have far wider target (and odds of success) making a
If you are in windows, and click in a link pointing to a .exe file, you are presented with the direct choice (or not) of running it directly (indirectly is just saving in the desktop and clicking on it, not too far away).
.rpm/.deb asking for root password before? Opening a .tar.gz and clicking on whatever it contains? You get far more warnings and troubles before efectively being able to run it to have a hint in some point of the process, dancing bunnies or not.
Under linux what is the "fast lane" to run something from outside? dropping it into your desktop/home dir, chmoding, and then running it? Installing a
You still can get infected with something very nasty, but probably the obstacles in the path will make % of infections far smaller than for Windows.
Anyway, what about non-native executables? Java warns you before letting applications to access your own files, but is a click away (and social engineering matters). Vulnerabilities in flash/acrobat/openoffice/etc could open a door too. But is different an "always open" door, than something that could be there tomorrow (or even yesterday, not all have all up to date) or not.
Ok, lets make an analogy. I rent a car. I use it to go to a movie. And because i was sick and dizzy (biological virus) or drunk (er... chemical virus? trojan?) i killed someone in the theater front.
Now, who must be liable here? The car real owner (the rental company)? The movie theater owner? or myself?
Of course, if i rent a car that is unsafe (no brakes, random turns of the wheel, complete drink bar attached at the side of the driver) maybe some responsibility goes to the car provider. But still, some government agency must attach a label saying "unsafe at any speed" and ban the use of those cars everywhere. But while that dont happens, you are the ultimate culprit, legally speaking.
REALLY have the world against them.
Well, if an economist quits department of treasury, or a priest quits church, is something to note, someone is quitting from a place which main speciality is what does that person.
/. culture... yes, is stuff that matters.
And now that kind of things happening to a company that is part of
If well that kind of virus could be made, and work, the odds of getting infected looks so low (EVEN for windows users) that probably wont be very widespread.
In the other hand, if you have already something ugly running as admin/root in your box in a way or another, it could deploy the MBR part, but dont see the advantage of this if is anyway already in control (afaik some rootkits/trojans (?) for windows hide themselves from scanners intercepting network/disk drivers or something similar, so no big advantage there)
With that surname he should have a hint about who are the real terrorists in the the computer world, and who is their leader,Larry bin Wall.
If well Snow Crash and Cryptonomicon are good, i enjoyed much more the reading of Diamond Age (the best educative toy story after mimsy were the borogoves, and maybe even inspiration for the OLPC). Why those 2 are "the" books of Stephenson all over the story?
Don't be unfair, is not Microsoft intentionally delivering what they promise far later, is that they measure time in an exponential curve while we measure it in a linear one, so the last month for them of this wait will take several of ours (if happens in our lifetime, at least).
A nice percent of what we know didnt come from calculating that something should happen and that it happens actually, but from where something happens when it "shouldnt". Are we killing the experimental method here?
While the idea of tactile feedback is important, it is also the idea to bring really to the max the area where you can display information AND interact. Wonder how good some sort of tactile keyboard (flat keys, that can be pressed,even that have borders) could be used as screen. In the worst case, there are a lot of people that use external keyboard/mouses with laptops (and PDAs) today, could be another alternative.
Personally i like the idea of an all-screen laptop, where the keyboard or whatever media of interaction is displayed along with the info, but in the proposed ones, i prefer the ones that optionally at least can be used with a (mostly?) horizontal keyboard and vertical screen.
... usually end causing it. Wonder in which (or in how many) sci-fi stories about oppresive governments they got that idea, but sound a lot like taken from there.
Try to prove to some hard-religious people, using just pure logic (no need to go to obscure science), that that word have an internal contradiction (do something that can't be undone later, then there is something in some point that you can't do) is already pretty hard already (something similar could be done with most all-something attributes of any god). Evolution? things that happened more than 6000 years ago? Earth not center of creation? Thats even harder to see. Proof can be faked, devil could had put the tail, or just "dont believe", and, of course, as everything, must be seen with the right glasses.
If this one starts to be deployed, maybe we should reconsider what are our favorite monsters. The Scary Hellish Giant Spy Bat of Doom definately must be top in all the list.
Torrents/p2p uses its own ports and protocols, and here you just target client machines. You can easily (?) filter them. Much different is something that is just mail, and there you get it from your mail server, whatever it is, whatever measure is taking. And one of the most used techniques to reduce spam (greylisting) is specifically targetted by Snzbi (the bot responsible back at the time this was published, almost 3 weeks ago, of 39% of the spam), so it dont stop this particular botnet.
Seems to not break any phisical law (?) and will have a good impact in... well, anything not related with the oil industry.
What could Microsoft do to defeat such enemy? Just use the old, proven tactics to win, including:
- Put their own lawyers on the case. To extra effect, make Ballmer shout "Lawyers, Lawyers, Lawyers"
- Buy another law, rename to MS Law, include it with new versions of Vista for free, and put the Moore Law out of the market
- Patent something related to some of the words of the moore law, and sue anyone trying to use it
- Finance a dying company to sue Moore for prior art.
- Add some undocumented code in Windows, to make it stop working if the Moore law tries to come into effect (they already are doing a good work in this direction)
How you tell them also matters... what if the messages were more or less like:
Tourism site: All your air bases are belong to us
USAF: Measure 1
Tourism site: All your air bases are still belong to us
USAF: Measure 2
Is so outrageos this way.
If happens close enough, the remaining 40% will be superpowder.
There are computers behind all services, they know about Windows (most should think its behind all those computers too) and they know that BSOD happens. IS oversimplification of the problem, but once you reach that point you dont need to go further.
... welcome our massive stealth alien observation ship owners overlords
The tree is not letting you to see the forest. Is not "just another cellphone", $800 or not. Is how that could turn mobile technology in the next few years, not just for phone calling, Could be a step forward in wearable computing, or at least having a not so tiny or bulky interface for whatever a cellphone provides. Something that could eventually change somewhat our culture probably fits under my "stuff that matters" area.
... is a big problem. Your report could look honest, open, have some humor etc etc, and that will have nothing to do with the fact that it is good or bad science. You can even honestly think that your are an expert in whatever topic is about. But still, it could be very wrong. As in the universe there is no single atom of justice (Pratchett dixit), the same goes for that kind of bells and whistles you want to see in the "truth" (or how it is presented). Wonder how much scientific reports presenting that the earth were flat, or the center of the universe, or that we were created by a superior being had all those attributes, even with the addendum of being of "common sense" at that time.
Still is pending how you distinguish good from bad science, of both can be presented in similar ways. Maybe some trusted authority/organization/etc can say that it is good, or at least, that the followed methodology is right.
Understanding ourselves IS a vital work.
Where you must draw the line in "user education" to make this safer?
Fake bank web sites is just one of the dangers, as isnt the only (main?) way to give away your login info. Trojan/Keyloggers are far more dangerous, as you dont need to do anything "unsafe" like putting your id/password in an untrusted/unsecure site, but identify as usual in your current safe/certified/encrypted site, and you could be giving away not just your user/password, but also where you are using them.
How you educate an average windows user to really avoid becoming part of a botnet, or installing trojans, giving the amount of ways you can become infected, or how they are disabling detection methods lately?