Archive | 2004

Tomalak’s Realm links to InfoWorld: Experts agree on method, not scope of IIS attacks.
“We don’t have significant reports of Web sites compromised or of
people sending us examples of the new Trojans,” he said. “I’d rate this
a low risk if you’re patched and a medium risk if you’re not.” Still,
other security companies reported widespread infections.

Three exploits took place at once: the IIS 5.0 servers had an SSL flaw
(patched in MS04-011) that allowed them to be infected. The Windows PCs
had two flaws: an MHTML handling problem in Outlook Express and IE
(also patched, in MS04-013) and a cross-site scripting exploit
identified last week that remains unpatched.

If you must use IE (for example, I can’t get to the Microsoft KnowledgeBase without it), make sure to do the following:

1. Set your IE security level to high (Tools, Options, Security:
   Select ‘High’ from the drop-down and then ‘Reset’ – you’ll want to note
   your previous settings and record them somewhere in case you’re having
   problems browsing), and
2. Make sure your virus scanners up to date. Even though I had
   upgraded to NAV 2004 on Friday and updated to the most recent files
   then, I download two updates this morning (Sunday) with 1.2Mb+ of new
   stuff in them.

Microsoft Watch from Mary Jo Foley reports Another Good Reason to Download XP SP2 RC2.
“Microsoft says folks running the recently delivered release candidate
2 of Windows XP Service Pack 2 aren’t vulnerable to the new “Download
Ject” attack that’s romping across the Web.” 

So, instead of getting a patch for IE, you can download a *beta* version of a service pack Woody Leonhard calls a “seriously risky patch job” or you can choose to use another browser that’s not affected. Hmmm…

InfoWorld: Top News reports: “Web attack aims to steal surfers’ financial details.
A new Internet attack discovered late Thursday was designed by an
infamous group of Russian virus writers to steal credit card and other
financial information from Web surfers and send it to Web sites where
it can be retrieved by hackers, security experts warned Friday.” The
key paragraphs:

Make sure you’ve patched IIS with the
Sasser patches. Raise the shields high on IE, or better yet, get a
secure browser. According the article, some *major* sites have been
hacked, so watch those credit card bills!

Update: According to this article on Netcraft, the trojan can be installed silently on fully-patched versions of Internet Explorer. Until the extent of the exploit is known, you may want to hold off surfing with IE.

Microsoft patents a method to transmit data and power over the human body.
Today Microsoft was granted patent 6,754,472 for “Method and apparatus
for transmitting power and data using the human body.”  [Ars Technica]

Open Source Paradigm Shift.
“This article is based on a talk that I first gave at Warburg-Pincus’
annual technology conference in May of 2003. Since then, I have
delivered versions of the talk more than twenty times, at locations
ranging from the O’Reilly Open Source Convention, the UK Unix User’s
Group, Microsoft Research in the UK, IBM Hursley, British Telecom, Red
Hat’s internal “all-hands” meeting, and BEA’s eWorld conference. I
finally wrote it down as an article for an upcoming book on open
source,”Perspectives on Free and Open Source Software,” edited by J.
Feller, B. Fitzgerald, S. Hissam, and K. R. Lakhani and to be published
by MIT Press in 2005.” [Tim O’Reilly, O’Reilly Network]

Interesting reading.