Frequent JavaScript Errors on Major Web Sites

I have been seeing more and more JavaScript errors on all kinds of web sites.

I wonder if the owners of these web sites don't notice the errors because they have turned off JavaScript error reporting in their browsers (if you care about your security and your web site I would recommend not doing this and report any errors you find to the owner of the web site).

The other option is, the owner of the web site never sees the JavaScript error. Because JavaScript is a client side technology its execution will occur on the machine that is requesting the web site. If something is different on that machine then the web site owner may not see that error, unless they are testing every browser combination - and even if they are in the case of XSS and other client side attacks.

For instance I have some JavaScript that loads up some frames. I have one user that gets a bogus site when logging in and those frames are loaded up. That doesn't happen to any other user. Chances are that error is something specific to that computer or that network that I would never see had that person not reported the error.

That is why it is important for everyone to report any errors they see to the web sites they use regularly.

Sometimes the owners of the web site cannot see what you are seeing.

And on that note web site owners that support hundreds or millions of customers need to make their support staff aware that these things CAN and DO happen and not treat customers like morons who report them because the staff is looking at the page and not seeing the same thing.

One other comment on this topic is that one site having this problem is using Urchin which has some JavaScript and an iframe containing who knows what. A lot of major web sites use Urchin and all sorts of software to track advertising and marketing. Many times the marketing staff demands to do these partnerships which put their customers at risk, and actually can hurt rather than help their business. I would suggest never include an iframe on any page other than static html and definitely not on a login page or e-commerce web site - and even then, an iframe can be used to change the content the user is getting in the main page on a static site - so I would personally never use one with content hosted by a third party and/or code that is not highly scrutinized by security experts - not the average web developer. Also when using Urchin, etc. it is crucial to constantly test an monitor - client side, not just server side code execution. Also hackers are smart enough not to send their malicious code to your monitoring system in many cases.

Prefix Hijacking and Intercepting (MITM Attack)

Here's a paper by some students on prefix hijacking and how that can lead to a man in the middle attack.

Make sure you are using the latest version of Adobe Acrobat Reader before opening any PDF files.

Prefix Hijacking - Man In The Middle Attack

Contracting On Insecure Computers

Every time I get on a new assignment at a new company the first thing I have to do - every time - for any company large or small, is secure my computer. Each time I go in it seems like firewalls are off and patches are severely out of date, insecure end of life or out of date software is running (including Flash, Quicktime, etc). The one thing I cannot always do is turn off all unneeded services because I am not sure what is and is not required by the company but typically there are some that I know can be turned off which are hack-prone.

If this happens at even some of the biggest companies that tells you IT has a big problem. Machines are set up with insecure configurations and even if they are not - if someone leaves their desk with the machine logged in - someone else could jump on there and install some computer software as soon as you walk away. For instance at one company they had me log in and then go get coffee on a machine that was right next to another contractor I didn't know. Perhaps the guy is the greatest guy ever, but he's a contractor right? What if as soon as we walked away he jumped on my machine and installed something that gave him a back door into my machine??

Don't assume I am just paranoid. Read the security articles across web sites as I do every day and then tell me it is not possible. The number one source of security breaches is from internal employees - whether malicious, on purpose, or someone just trying to sabotage or skim.

Personally I think all employees should be told to lock their computer when away from their desk.

One company I was at had Ubuntu and that actually made me nervous because I wasn't quite sure how to secure Ubuntu as well as Windows. And since Ubuntu is made by some guy in South Africa and open source, how is this thing being audited for security? I have no idea.

But then if a company uses Microsoft products and doesn't install service packs until after they've been out for almost a year, might as well use Ubuntu. It's free.

IT Admins Should Be Checking Vulnerabilities Daily

Anyone working in IT supporting any systems that could possibly be hacked (which means anything) should be reading this list:

Secunia - Security Updates

HackerSafe - False sense of Security

This article suggests HackerSafe may lull web site owners into a false sense of security:

Hacker Safe - false sense of security

HackerSafe only tests a particular layer of hacking and as one consulting firm suggests, cannot provide in depth page by page testing of a company doing the work hands on. Additionally the article states that some hackers claim they have hacked hackersafe sites.

Ethical Hacking - Articles

Here's a whole list of articles from the Ethical Hacking web site which cover a wide range of hacker related topics from rootkits to data embedded in jpgs - wireless hot spots to audio and video and hacking the stack among other things:

Ethical Hacker Articles

More on Man-In-The-Middle Attacks

More on man in the middle attacks, on VPNS, banking sites, hot spots and more.

Man in the middle attack

Don't accept invalid certificates at a hot spot

This article shows hot spot exploits...and ways to validate SSID's however how many people actually do that...

http://www.ethicalhacker.net/content/view/66/24/

This is kind of scary for anyone using a hot spot.

The question is...what can Starbucks and T-mobile (among other popular hot spots) due to protect users of hotspots from this type of attack?

PHP hackers

Two related php hackers apparently referred by: http://www.delire.ru//modules/4nAlbum/public/doc/safe.txt?

61.250.95.201
inetnum: 61.248.0.0 - 61.255.255.255
netname: KRNIC-KR
descr: KRNIC
descr: Korea Network Information Center
country: KR



64.13.224.85
OrgName: Media Temple, Inc.
OrgID: MEDIAT-10
Address: 8520 National Blvd.
Address: Building A
City: Culver City
StateProv: CA
PostalCode: 90232
Country: US

NetRange: 64.13.192.0 - 64.13.255.255

Tool for Phishers - Is your Browser Vulnerable?

It is a bit bothersome to me that this is not yet fixed:

http://secunia.com/internet_explorer_7_popup_address_bar_spoofing_test/

Test your browser to see if you're a potential victim.

This could be used by phishers to pop up windows that look like links are pointing to valid sites when they are not, and trick someone into thinking they are at a bank for instance, instead of some hacker web site.

Not sure why this bug is not considered a top priority.

Facebook Image Uploader Exploit

This summary is not available. Please click here to view the post.

Antivirus Comparison

Here is a comparison of antivirus programs for 2008

Not sure if the source is good (haven't researched this or heard of them) and make sure you read the legend or some things may be misleading.

http://www.sunbelt-software.com/ihs/alex/avtestresults_2D2008q1.pdf

Man-In-The-Middle Attack - Mail Systems

What are the chances your webmail is affected by a man-in-the-middle attack?

Today I found some instructions for my webmail company's product that did not match the product I see when I login.

I also found it odd when I signed up that certain features that were supposed to be in there were not and "their programmers" had to fix it.

Additionally the SSL certficate isn't working (should it be? Are we getting to an imposter?) and we cannot send mail without errors to one of their domains but they are telling us the messages are still encrypted - are they?

In the instructions I found online I went to the site that was supposed to be the admin site. I got a page not found. Then I typed in the IP - and the admin site showed up - but my admin password does not work on that site. It does work on their main web site however.

For another mail company I tried out I called them up on the phone because the whole login thing did not make sense. When I was asking the guy on the phone where and how to login, and option that he was seeing on his screen was simply not on my screen - and I talked to two different people that said the same thing and the instructions did not match what I was seeing.

What are the chances that all these webmail systems out there that people are using every day to communicate are hacked? Gmail was hacked - people could login and read gmail messages of other people - so it could be happening to a lot of other mail companies with less resources.

Man-In-The-Middle: How to test

I asked a friend who has been in the business of email administration for large corporations for quite a while how to test your mail system for a man-in-the-middle attack.

His answer was another catch 22 for these problems which leaves you stranded and once again proves why they are so successful - and could be happening on your mail or web system right now.

Basically, to find a man-in-the-middle attack you have to try out the hack on the server you are trying to test. The caveat is, if your server is already hacked the test might NOT work...

And basically he summed it up saying that's why there's so many security folks out there that help people test for this kind of thing.

I still don't know exactly how to test this on a mail system...have to keep researching...

Spam Images Bypassing Outlook Image Blocker

Some of the recent spam mentioned is getting past Microsoft's image blocker in Outlook. It is coming out of rush as the 70% spam post I just posted.

Report Cyber Crimes To FBI

I reported on this article before but reading it again I would like to highlight a different part - the FBI would like IT executives to report crimes to them to help fight crime. If large vendors would analyze their firewalls and network logs and report thing such as the spam I found spewing out of my server and research problems with had with their Email systems instead of kicking us off their systems, maybe we could uncover crimes and help the whole country, in fact the world, in addition to their individual businesses and customers:

FBI can Help You Fight Cyber Crime

O'Brien wound up his presentation with a plea for IT executives to work with the FBI to nail cybercriminals, including those who operate outside the United States.

"Compared to when I started doing computer crimes four or five years ago the bureau today is very well positioned to run an investigation that involves botnets and foreign nexus. We have agents in over 50 embassies now around the world from countries as diverse as the United Kingdom and Yemen...[Our agents] work with foreign law enforcement."

IT executives can help the FBI crack cases by reporting incidents as soon as possible and by sharing network and other logs, as well as IP addresses involved, O'Brien says.

Is your home router hacked?

An example of an attacked home router is described in this article:

http://www.networkworld.com/news/2008/012208-drive-by-pharming.html

So if this is "on the rise" as the article points out, what can be done to stop it?

Phishing the Phishers

Here's a site with code to phish - but if you try to use it, ends up sending the info back to the people who wrote the code, not you:

http://news.netcraft.com/archives/2008/01/22/mrbrain_stealing_phish_from_fraudsters.html

So what is our government doing about this type of thing?

The infamous check cashing scam - again

Header followed by message text - this message is coming from Turkey, posing as a job for a company which entails cashing checks. Sound familiar?? Who hasn't heard of this one yet....

Return-Path:
X-Original-To: job@hunter.com
Delivered-To: job@hunter.com
Received: from dsl.static.85-105-31885.ttnet.net.tr (unknown [85.105.124.141])
by mail14.intermedia.net (Postfix) with ESMTP id 1B465439B1
for ; Fri, 25 Jan 2008 08:13:59 -0800 (PST)
Received: from [85.105.124.141] by edge2-3.sne1.net; Fri, 25 Jan 2008 18:38:55 +0200
From: "Gary Cramer"
To:
Subject: Job Center BOGATTO Company
Date: Fri, 25 Jan 2008 18:38:55 +0200
Message-ID: <01c85f81$89f4c980$8d7c6955@oxpogsog>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.3416
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.2300
Importance: Normal

The Bogatto Company has a current offering of part-time positions. Even if you are presently employed, this opportunity can add additional earnings to your Family budget!!! Here is a little information about our company:

Bogatto co-operates with more than 90 countries in Europe, North and South America, the Near East and Asia. Our company was founded 15 years ago. Today Bogatto has built up an excellent reputation based on stability and reliability. Activities for our company are various. We find firms or people and negotiate contracts with them. Bogatto is the guarantor between the employer and the employee, vendor and vendee, etc.

The fundamental nature of your job will primarily consist of the following:
We send you a check that you cash utilizing a check cashing service
You take the money from this check and send it to our agent (If our partner is in the USA, you send the money to him through Travel Express)
If our partner is not in the USA, it is necessary for you to use Western Union
Your salary will be 10% from the sum of every check.
The more checks you receive - the more money you earn. Moreover, if you collaborate with us successfully during your first month, you will get an increase in pay.
After 2 months of successful employment you will get bumped up to 20% from the sum of every check.


Many of our clients conduct business via checks. But financial institutions in other countries are either not always equipped and/or charge huge fees when transferring funds.

That's why Bogatto is in need of people who can help us solve this problem and while doing so, earn a decent salary! This creates a nice win-win situation for us both.

If you are interested in our offer or have any questions about this offer, please complete the following information attentively and in block letters:

Full name:
Address:
City:
State:
Zip:
Phone:
E-mail:

Please send your information via e-mail to: bogatto.information@gmail.com

Please, write your data correctly! The checks of our clients will be sent to your name and your address. If it is required we'll call you. If you agree, you will receive further instructions.

Thanks for your attention and best regards,

The Bogatto Company


Frequently Asked Questions

#1 Who will I get checks from?
You will receive checks from our clients who cannot send funds to another country but can only transfer funds by check within that country.
#2 How much will the wages compile?
Your wages will equal 10 percent from the sum of the check. In the other words you get the check, take 10 percent from the sum of the check and the remainder of the check is sent to our clients(ex: the sum of the check is 4,000 USD, you get 400 USD) you get the money this way from every check.
#3 Where is, the check cashed ?
Charges on cashing the check can be taken from this check. It would be better if you could cash the check on the day you receive it. To cash check fast you can use the offices "Check cashing service" "Check Cash Express" and others.
#4 Can cashing services be paid?
Yes, they can; Cashing services can be paid. In this case these services can be paid from the sum of the check.
#5 How is the money transferred by Western Union?
Information about the person who you need to send the money to will be highlighted in an e-mail sent to you. After you have transferred money by Western Union you will be given a MTCN (Money Control Transfer Number). It consist of 10 digits. Then you need to send this number to our e-mail on the same day.
#6 Where should the money be taken from to pay the Western Union fees?
The Western Union fees should be taken from the sum of the check.
#7 The Western Union system doesn't allow more than 3000 USD to be sent at at time?
If the sum of the transfer is more than 3000 USD then you must divide the sum into smaller transfers (it is obligatory) under the 3000 USD Limit. And as it was said above you need to tell us the MTCN s of the transfers.
#8 Can money be sent by another system?
No, it can't. Transfer can be done only by Western Union.
#9 Who will pay tax?
Sums of our checks are not more than 5000 USD. Reports are not sent to the IRS. Don't worry, you won't have to pay taxes on these sums of money.
#10 How many checks a month can you send and what sum of money?
We can send checks at a rate of 50,000 USD, and the quantity of the checks depends on their sum.
#11 Will the person have to go anywhere?
Your job won't be difficult, you won't have to go anywhere, you can do most everything from home and you don't need to invest money.
#12 Are the operation of the company legal?
All the operations of the company are legal and subject to International Judicial System, what is proved by appropriate documents.
#13 What is approximate wages?
Approximate wages a month is between 4000-5000 USD, with a minimum of time and effort.
#14 Who is responsible if the clients are not satisfied?
Our company is.
#15 Should we provide you with information about our bank account?
We don't need any information about your bank account..


-- Bogatto Company -- Contacts: 1-800-516-3170
support@bogatto.com

SSL and Man-In-The-Middle Attacks

Here is a lot of information on man in the middle attacks.

http://en.wikipedia.org/wiki/Man-in-the-middle_attack

I just wish I understood it better...and that more people would pay attention to and help stop this type of attack.

Before you buy that software...

Before you buy software check Secunia to see if there are any advisories on that software and how quickly they were fixed:

http://secunia.com/

Also check the true roots of the software maker and other products developed by that same company or a previous company with the same owner.

Check for third party, credible reviews of the software but also, don't believe everything you read. Do your homework and find out what other companies are using the software and who the reviewer is - related to the company? And is the reviewer technical enough to offer true advice on the software?

Make sure that reviews are not just of the features, but also of the underlying security of the product as well. A piece of software may look cool and have nifty features but also have a back door into your trusted environment.

Domain Registry of America - Shady Tactics

Domain Registry of America sends out letters to people long before their domains are up for renewal and tries to trick them into paying a "bill" which would actually transfer the domain to a new vendor. This needs to stop.

Recent Spammer

Got an interesting email from this spammer IP recently: 83.98.156.20

I have a feeling this particular email is more than meets the eye.

Search Engine Spam - Report It

Have you been searching in Google and found garage looking web pages that all look the same and are what I would call "search engine spam"? There is obviously some company or set of companies that have purchased countless numbers of domain names that are not being really used other than to spit out a bunch of useless content and links on pages that all look basically the same and link back to other sites they are probably providing SEO service to...these sites are a waste of everyone's time and money. They are garbage sites full of links probably set up to help their customers improve seo rankings artificially, because obviously these sites are not very useful.

Examples:
http://artmam.net
http://dania.com

Next time you are searching in Google and come across a garbage site, make sure you report it. There is a link at the bottom of the list that says "disatisfied with results?" Click it and report these search engine spammer sites so they can get kicked out of the rankings.

Login forms should be on HTTPS urls

This article is interesting - I especially like the part about why login pages should be https urls, not just the form you're submitting the login to...

http://blogs.msdn.com/ie/archive/2005/04/20/tls-and-ssl-in-the-real-world.aspx

Horde Security Flaw

I've been noting problems with various webmail systems.

Here are some posts to backup what may be causing some of these problems, as I have noted most of the mail systems I've used are horde or php. These advisories came from Secunia today:

Horde:
http://secunia.com/advisories/28020/

PHP:
http://secunia.com/advisories/28393/

Now...will someone please look into these AJAX systems as well? Something seems a little fishy with some of those.

Be Honest. Get Customers. What a Concept.

In light of all the things I have been writing here, about companies accepting responsibility for things going wrong and fixing them instead of sweeping them under the carpet, I find this to be an inspiring article for those companies still not convinced it is the best thing to do. I mean if you can't do it because it is the right thing to do, maybe you'll do it because you'll get more customers:

http://www.wired.com/wired/archive/15.04/wired40_ceo.html

Manta.com publishing inaccurate information

Manta.com is publishing completely bogus information about companies - information they have no way of knowing. Take a look at your company profile on Manta and in you find something that is inaccurate, report it to the search engines, the company and post it on your blog so this misuse of the web can be stopped.

Security Investment Opportunity

There are a lot of security vendors out there touting all kinds of security products from encrypting hard drives and emails to virus checking and spyware scanning, secure email products, and compliance auditing for those who have access to the systems directly.

However as far as I know, there is no good solution for monitoring and quickly pinpointing a man-in-the-middle attack.

This type of thing seems like it would require cooperation on both ends of a network. It may involve traces through networks and honeypots and traps to catch such attacks.

The more I think about it the more I think that is what is going on with our email service. But I cannot prove or disprove that fact because our email vendor, USA.net, will not help us resolve the problems.

Cisco Fraud Shut Down

Cisco theif shut down - one for the good guys.

http://www.networkworld.com/community/node/22850?nlhtsec=rn_121107&nladname=121107securityal

Don't the rest of us small businesses wish that we had the money and support to catch people hacking and stealing from us...

PCI Compliance

This company that recently moved their headquarters from Europe to Chicago and wants to get involved in PCI compliance testing of devices. This could be good or bad depending on the true motives of the people involved. I would love it if someone would step up and find and fix security flaws, as long as they are one of the good guys....

http://www.networkworld.com/news/2007/121007-nss-labs-pci.html?nlhtsec=rn_121107&nladname=121107securityal

Vendors trying to hide or ignore vulnerabilities

I agree with this article regarding vendors trying to sweep vulnerabilities under the rug:

Vendors trying to hide vulnerabilities

My beef in this whole blog lately is not that vendors have problems with their software - because hackers and foreign governments and organized crime rings are at war with us - but I do have a beef when vendors do not take responsibilities for problems and fix them.

I think the same applies to bugs, which may be nothing - or may be a shadow of a clue that a system is compromised in some way. Vendors should get to the bottom of bugs and in a technical, engineering approach, resolve or at least explain why a problem occurred if it is possible.

Recently I get the feeling that email hosting providers would rather kick a "whiny" customer off the system - who finds a flaw in their software - rather than take the time to get to the bottom of exactly what is causing the problem. In fact some of them turn around and blame the customer and tell them it was something they did that caused the problem even if they cannot prove it (and it is not true).

I had some employees like this in the past. A customer was complaining that her web site was failing randomly and they blamed the customer's computer and didn't really bother to ever truly research and pin down the problem. I finally had to let them go. The problem was a database server that was overloaded. An engineered approach to resolving the problem would have enlightened us all much sooner. I never blame a customer for the problem without the facts to provide a customer to show them that it looks like something they did caused the problem. If the customer denies they did that thing...maybe something else is still going on even if it looks like the customer did something to cause it.

My customer with a mac has nailed down the problem with USA.net's webmail program. The problem happens when she's using her mac - or any mac in the office - with a particular mail account (and no others). USA.net claims it is not their problem and that a system administrator changed something - no one on our end has touched anything. The Internet Service Provider came out and tested the modem - they claim there is nothing wrong with the network or the modem. All other web sites are operating just fine on these machines for this customer. USA.net has finally said they would escalate the problem. I doubt this will do any good however. This is probably all smoke to placate the customer until we move to a new email hosting provider. I'll let you know if it gets fixed before then.

What could be causing this problem? If someone is in the path between my customer and the email hosting vendor, perhaps they could do something to the request. Perhaps there is something in one of the emails in that account that is causing the problem. Perhaps there is some software glitch in Safari on a mac for that particular web site. The only way to pin this down is for the makers of the web site to check their logs and maybe add additional logging and perform some network traces to pin this down. If they won't do it, as far as I can tell we are out of luck.

Small businesses don't protect their data

Here's a report about small businesses not protecting their data - they don't understand the risks and threats as a result of this...and vendors like the ones I have used are not helping. Sometimes I think their are people employed by large managed hosting companies that are related to the espionage mentioned in a previous article. And because small companies don't understand exactly what is going on or the risks involved - they don't complain about it like I do here.

Small business security

Security Threats - New levels of Sophistication

CRN magazine reports in November 26, 2007 article:

"Many security professionals dispute exactly what constitutes the most serious security threat. But almost all sources agree that over the past two to three years, the tactics cybercriminals are using have become amazingly professional. What was onece about bragging rights is now about high-stakes payoofs illigitimately gained by large-scale Internet fraud andinfiltration."

For more informaiton go to security threats

Top Spy Threat

Information week reports in an article entitled "The Techno-Spy Threat" in the Nov 27, 2008 article the following:

"Chinese spying is the top threat to U.S. technology, says the U.S.-China Economic Security Review Commision in it's 2007 Report to Congress.

China's espionage activities in the United States are so extensive that they comprise the single greatest risk to the security of American technologies, according to a summary of the report from the congressionally appointed gropu of experts. Espionage saves China the time and cost of researching and developing advanced technologies, it says."

Security Threats

Traffic Patterns - How Hackers Work

Here's how hackers are working their bots or whatever right now to generate traffic by hiting a site about 5-6 times in a row in groups from different IPs. These groups of IPs are related in more ways than one.

We have a site that gets very low traffic and pretty much has nothing linking to it and nobody looking at it. And yet somehow this site gets blocks of hits in a row out of nowhere - 5 or 6 at a time - then stops for another hour.

Here's an example:

12/7/2007 4:08:58 PM 218.234.21.33
12/7/2007 4:09:04 PM 68.189.175.164
12/7/2007 4:09:25 PM 24.0.54.125
12/7/2007 4:09:33 PM 207.172.248.72
12/7/2007 4:09:36 PM 70.236.22.31
12/7/2007 4:09:43 PM 70.236.22.31

Here's an exmaple of traffic from the Ukraine which is probably hackers hitting that same site:

80.91.186.250

inetnum: 80.91.186.0 - 80.91.186.255
netname: INTERCONNECTIONS-DATAGROUP
descr: Subnets /30 for interconnections to DATAGROUP's clients
country: UA

I'm guessing all these IPs are related bots and hackers that hit this site in Decemeber:

1 172.129.227.254 12
1 193.47.80.38 12
2 200.107.59.51 12
1 200.226.134.53 12
1 200.226.134.53 12
1 200.226.134.53 12
2 200.226.134.53 12
1 200.88.114.166 12
2 202.115.130.23 12
1 202.115.130.23 12
1 203.88.192.104 12
1 207.172.248.72 12
1 218.234.21.33 12
1 218.246.118.22 12
2 218.249.83.87 12
1 221.100.70.25 12
1 222.221.6.144 12
1 24.0.54.125 12
2 24.164.91.236 12
1 58.65.235.194 12
1 58.65.235.194 12
1 58.65.235.194 12
1 61.247.217.35 12
4 61.61.132.129 12
2 62.85.45.65 12
2 62.85.45.65 12
4 62.85.45.72 12
1 64.22.93.154 12
3 64.22.93.154 12
1 64.246.161.30 12
3 64.86.69.5 12
3 65.32.175.224 12
1 66.56.149.238 12
1 67.100.29.213 12
2 68.166.98.6 12
1 68.189.175.164 12
2 70.236.22.31 12
1 72.232.25.226 12
3 72.36.134.242 12
3 72.36.134.242 12
1 75.125.47.162 12
1 76.168.39.111 12
3 77.50.7.167 12
2 80.91.186.250 12
3 80.91.186.250 12
3 80.91.186.250 12
3 83.31.185.72 12
3 85.114.133.77 12
1 85.194.127.10 12
1 85.21.125.100 12
1 85.228.96.63 12
1 86.123.67.229 12
1 87.111.102.25 12
3 87.118.106.4 12
2 87.118.116.8 12
2 87.240.5.90 12
1 88.131.106.2 12
1 97.76.5.224 12

Here's the same type of traffic from November:

2 122.214.249.116 11
2 122.252.226.40 11
1 122.252.226.40 11
1 125.177.43.78 11
1 125.7.195.10 11
4 131.107.151.157 11
2 148.167.202.141 11
1 148.235.92.34 11
1 189.32.175.26 11
1 192.18.100.7 11
2 193.111.120.47 11
1 194.109.141.137 11
1 194.72.238.61 11
2 194.83.70.20 11
1 194.83.70.20 11
1 195.229.242.57 11
1 195.244.128.215 11
2 195.244.128.215 11
1 195.244.128.215 11
2 195.244.128.215 11
2 195.244.128.215 11
3 195.244.128.216 11
1 195.248.93.105 11
1 195.251.249.101 11
1 195.67.48.130 11
1 195.76.242.227 11
1 200.226.134.53 11
1 200.226.134.53 11
1 200.226.134.53 11
2 200.226.134.53 11
1 200.88.114.166 11
2 200.88.114.166 11
1 200.88.114.166 11
1 200.88.114.166 11
1 200.88.114.166 11
1 201.43.185.180 11
1 201.45.221.40 11
1 201.70.159.236 11
1 202.105.182.87 11
2 202.115.130.23 11
3 202.44.135.35 11
2 202.44.8.100 11
1 202.72.240.22 11
1 203.111.13.69 11
1 203.111.13.69 11
3 203.121.71.169 11
2 203.121.71.169 11
2 203.121.79.95 11
3 203.121.79.95 11
1 203.234.156.57 11
1 203.234.156.57 11
1 203.234.156.57 11
4 203.234.156.57 11
2 203.88.192.104 11
2 203.88.192.104 11
1 206.51.237.152 11
1 207.192.203.218 11
3 208.72.168.160 11
1 209.124.116.65 11
1 210.22.158.132 11
1 210.34.14.186 11
5 210.34.22.226 11
1 210.34.4.18 11
1 210.51.51.24 11
1 210.75.12.100 11
1 210.82.89.246 11
1 211.100.34.11 11
3 211.117.62.81 11
1 211.117.62.81 11
2 211.196.166.94 11
3 211.196.166.94 11
1 212.124.234.37 11
1 213.180.137.72 11
1 216.145.17.190 11
1 216.145.5.42 11
1 216.23.162.164 11
1 216.40.220.18 11
3 217.126.65.126 11
1 218.210.231.93 11
1 218.56.8.72 11
3 219.87.178.116 11
1 220.1.121.46 11
1 221.225.1.241 11
2 222.63.132.15 11
1 24.131.212.124 11
4 24.148.20.137 11
1 24.7.24.112 11
1 38.117.88.77 11
1 58.147.0.228 11
1 59.77.16.162 11
1 60.190.79.18 11
1 61.135.219.15 11
1 61.142.81.37 11
1 61.148.97.26 11
4 61.178.18.96 11
1 61.19.221.29 11
2 61.28.1.91 11
3 61.61.132.129 11
1 62.143.133.68 11
1 62.175.191.139 11
3 64.5.62.170 11
1 64.92.199.44 11
1 64.92.199.61 11
2 66.199.253.187 11
3 67.149.190.246 11
1 67.202.6.152 11
1 68.228.168.71 11
1 68.7.17.104 11
1 68.82.44.72 11
4 69.113.227.23 11
1 69.121.170.57 11
1 69.143.249.51 11
1 69.208.130.11 11
1 69.221.169.25 11
1 69.59.28.163 11
2 69.73.94.125 11
1 70.135.109.51 11
2 71.109.156.19 11
1 71.194.213.68 11
1 71.224.150.100 11
1 71.59.220.219 11
2 71.83.130.152 11
3 71.83.130.152 11
1 72.224.254.87 11
1 72.224.254.87 11
3 72.232.7.242 11
3 72.232.7.242 11
1 72.232.7.242 11
2 72.44.50.103 11
1 72.44.57.55 11
1 74.137.217.73 11
1 74.208.11.169 11
2 75.26.182.48 11
3 76.101.38.233 11
1 76.170.241.248 11
1 76.31.23.129 11
3 76.84.107.198 11
2 78.107.255.115 11
1 80.216.144.92 11
1 80.37.201.86 11
3 80.91.186.250 11
3 80.91.186.250 11
3 80.91.186.250 11
3 81.84.141.117 11
3 82.179.236.154 11
1 82.216.116.203 11
1 82.224.98.76 11
1 82.237.74.200 11
2 83.208.212.151 11
3 83.237.199.152 11
3 83.31.211.14 11
2 84.141.19.229 11
2 85.140.24.250 11
3 85.140.249.139 11
3 85.140.251.119 11
1 85.21.125.100 11
1 85.216.173.226 11
2 85.227.185.181 11
1 85.84.197.236 11
1 85.85.59.35 11
1 86.51.3.194 11
1 86.51.3.196 11
3 87.106.135.26 11
5 87.118.106.4 11
2 87.118.108.79 11
2 87.118.110.213 11
2 87.118.110.213 11
2 87.118.112.237 11
3 87.118.116.245 11
3 87.118.118.12 11
2 87.118.96.104 11
1 87.118.96.60 11
3 87.118.98.9 11
3 87.118.98.9 11
2 87.174.45.224 11
1 88.131.106.2 11
1 88.131.153.91 11
1 89.149.236.54 11
1 89.182.95.144 11
1 89.31.204.49 11
3 89.77.80.235 11
3 90.156.169.218 11
3 91.76.57.242 11

And here's October...

1 123.236.96.154 10
4 124.128.248.88 10
5 131.107.151.157 10
2 144.118.29.81 10
1 147.29.152.239 10
1 147.29.152.239 10
2 17.149.0.104 10
1 189.52.78.146 10
1 190.7.62.202 10
1 193.137.239.115 10
5 193.219.28.144 10
5 193.219.28.146 10
2 195.2.114.1 10
2 195.2.114.1 10
3 195.2.114.1 10
3 195.2.114.1 10
2 195.2.114.33 10
1 195.2.114.33 10
1 195.76.242.227 10
1 196.20.65.210 10
1 200.130.24.21 10
1 200.206.242.52 10
2 200.83.4.3 10
1 200.83.4.3 10
1 200.83.4.6 10
2 200.88.114.166 10
2 201.220.124.165 10
1 202.28.27.3 10
1 203.113.137.131 10
2 203.121.71.169 10
2 203.121.71.169 10
2 203.121.71.169 10
2 203.121.79.95 10
1 203.213.211.206 10
1 203.69.39.251 10
1 203.88.192.104 10
1 207.38.5.194 10
1 207.44.238.95 10
1 209.10.61.194 10
1 209.59.180.114 10
1 210.21.12.94 10
1 210.34.22.226 10
1 210.42.140.5 10
2 211.117.62.81 10
1 211.117.62.81 10
1 211.140.138.39 10
1 211.214.198.55 10
1 211.239.150.148 10
2 211.239.150.148 10
1 211.239.150.148 10
1 212.11.191.67 10
1 212.72.30.140 10
1 212.72.30.140 10
1 213.180.137.71 10
1 213.180.137.73 10
1 213.61.157.93 10
1 216.145.14.142 10
3 217.127.161.223 10
1 217.171.176.46 10
3 217.174.98.198 10
1 218.233.166.197 10
2 218.234.21.33 10
1 218.234.21.33 10
3 218.234.21.33 10
2 218.234.21.33 10
1 218.234.21.33 10
1 218.58.136.4 10
1 218.58.136.4 10
1 218.58.136.4 10
1 218.63.252.219 10
1 218.66.103.253 10
1 218.71.136.105 10
1 218.71.136.105 10
1 219.148.197.154 10
1 219.240.36.173 10
1 220.202.69.18 10
1 220.75.215.78 10
4 221.142.222.235 10
1 221.232.159.112 10
1 221.233.134.87 10
1 221.233.134.87 10
1 222.221.6.144 10
1 222.221.6.144 10
2 222.231.63.18 10
1 222.231.63.18 10
1 24.13.0.209 10
1 24.131.61.205 10
4 24.161.224.99 10
3 24.179.161.48 10
1 24.37.128.57 10
1 24.98.188.175 10
1 41.204.194.181 10
2 58.127.102.142 10
1 59.17.63.2 10
3 59.17.63.2 10
1 59.77.17.173 10
3 59.77.21.250 10
1 59.77.21.250 10
1 60.12.17.10 10
2 60.190.228.93 10
2 60.190.79.18 10
1 60.190.79.18 10
1 61.139.37.12 10
1 61.142.81.37 10
3 61.144.78.167 10
1 61.144.78.190 10
1 61.144.78.190 10
1 61.27.78.51 10
3 62.141.52.219 10
2 62.141.58.167 10
3 62.141.58.167 10
1 62.231.243.139 10
1 62.231.243.139 10
1 62.94.22.196 10
1 62.94.22.196 10
1 64.127.57.5 10
1 64.237.57.194 10
2 64.246.161.190 10
1 64.246.165.160 10
1 64.246.187.42 10
2 64.5.62.170 10
1 64.5.62.170 10
2 64.59.139.153 10
2 65.102.234.72 10
1 65.196.51.21 10
1 65.44.66.100 10
3 66.232.100.156 10
1 66.232.125.138 10
1 66.249.2.50 10
1 66.25.72.150 10
2 66.250.64.30 10
1 67.159.44.8 10
6 67.202.12.183 10
1 67.202.4.188 10
1 67.62.84.180 10
1 68.106.204.9 10
1 68.197.36.143 10
1 68.199.229.88 10
1 68.74.112.43 10
1 68.81.222.236 10
3 69.121.127.225 10
1 69.141.53.8 10
2 69.141.53.8 10
1 69.245.195.3 10
1 69.245.195.3 10
1 69.250.241.42 10
1 69.36.158.19 10
1 69.74.165.135 10
1 69.9.167.198 10
2 70.255.107.115 10
1 70.48.115.231 10
3 70.84.55.194 10
1 70.87.230.66 10
2 70.87.7.56 10
1 71.109.113.203 10
1 71.158.214.55 10
1 71.193.86.213 10
1 71.59.220.219 10
1 71.65.60.93 10
1 71.87.113.228 10
1 72.232.61.162 10
2 74.52.245.146 10
1 75.3.9.109 10
3 75.43.208.130 10
3 75.53.1.246 10
1 75.69.76.233 10
3 75.69.76.233 10
1 76.101.38.233 10
1 76.190.177.232 10
1 76.210.34.207 10
1 76.25.195.169 10
2 76.25.195.169 10
1 76.26.251.165 10
3 76.73.131.148 10
1 76.98.227.200 10
3 77.50.7.167 10
3 80.91.186.250 10
3 80.91.186.250 10
3 80.91.186.250 10
3 80.91.186.250 10
3 80.96.191.144 10
3 80.96.191.144 10
3 80.96.191.144 10
3 81.0.232.77 10
1 81.190.75.54 10
3 81.29.251.17 10
1 82.158.197.63 10
1 82.230.82.38 10
1 82.232.80.128 10
1 82.243.246.184 10
1 82.247.201.64 10
1 82.67.175.47 10
3 83.10.100.89 10
1 83.141.161.100 10
2 83.149.95.109 10
3 83.167.116.7 10
3 83.31.183.135 10
2 83.31.254.59 10
1 84.108.215.96 10
2 84.112.144.174 10
2 84.16.227.85 10
3 84.16.235.197 10
3 84.19.188.158 10
2 84.240.45.110 10
2 85.140.181.5 10
1 85.65.22.214 10
1 85.69.127.206 10
5 87.118.106.4 10
5 87.118.106.4 10
2 87.118.110.213 10
2 87.118.112.237 10
2 87.118.112.237 10
2 87.118.112.25 10
3 87.118.112.25 10
3 87.118.112.25 10
2 87.118.112.30 10
2 87.118.112.30 10
3 87.118.116.8 10
3 87.118.116.8 10
3 87.118.98.9 10
3 87.230.30.38 10
1 87.240.14.95 10
3 87.99.76.124 10
1 88.131.153.91 10
1 88.198.25.14 10
2 89.149.202.137 10
2 89.77.80.235 10
3 91.124.141.47 10
3 91.124.163.50 10
3 91.124.163.50 10
3 91.124.163.50 10
3 91.124.163.50 10
3 91.192.104.2 10
1 91.90.183.53 10
1 98.194.76.111 10

Solid Oak - Symantec flagged as virus - is it?

This company Solid Oak is complaining because Symantec flagged their software as a virus - this article has the details:

http://www.pcmag.com/article2/0,2704,2229576,00.asp

Now the company is complaining that because symantec deleted or disabled files in their program people had to "rebuild their entire operating systems".

I don't know about you but if some software is doing things that cause me to have to rebuild my entire operating system if it fails or gets deleted - I'd have to say what the heck is that software doing and I definitely wouldn't want it on my machine - for security reasons.

Someone should take a closer look at exactly what this software does exactly and why removal of files would have such a disastrous effect.

I wonder if PCMag checked to make sure that the real problem does not lie with the software vendor.

Server problems - related to /_vti_bin/owssvr.dll?

We got three requests for /_vti_bin/owssvr.dll a short time before our server had some serious issues. We were getting database connection errors and our SSL functionality was hosed. These requests were made by two different IPs. there is one similar request at the bottom from an earlier date. Some actions today also deleted all our request logs prior to: 05/12/2007:20:55:17 -0800

However I have some backup logs.

Not sure if the two are linked by here is more information so far related to this hack:

A few different requests were made, first from 216.104.48.200 and then from 130.76.32.144

Rquest details:
ipAddress: 216.104.48.200
server:
referer:
queryString: UL=1&ACT=4&BUILD=6551&STRMVER=4&CAPREQ=0
method: GET
uri:
session: 27pg82u8olfo6
existing session
session created: Wed Dec 05 15:15:48 PST 2007Accept: */*
XVermeerContentType: application/octetstream
AcceptEncoding: gzip, deflate
UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)
Host:
Connection: keepalive
CacheControl: nocache
CAPREQ: 0
STRMVER: 4
ACT: 4
BUILD: 6551
UL: 1

Could be this person at Valley Medical Center doesn't know their machine is hacked...or an accident by some IT person but I doubt it based on the consistency at which this appears in our logs.

OrgName: Valley Medical Center
OrgID: VMC-11
Address: 400 S 43rd Street
City: Renton
StateProv: WA
PostalCode: 98055
Country: US

NetRange: 216.104.48.0 - 216.104.63.255


Second set of requests for this particular file were from:

******WEBTOOLS.DUMPREQUEST**********
ipAddress: 130.76.32.144
server:
referer:
queryString: UL=1&ACT=4&BUILD=6551&STRMVER=4&CAPREQ=0
servletPath:
method: GET
uri:
session: 3gero4ss5ih8m
new session
session created: Wed Dec 05 15:04:58 PST 2007Accept: */*
UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Boeing Kit; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host:
Connection: keepalive
XBlueCoatVia: 996B7CB4B02B592C
XVermeerContentType: application/octetstream
Pragma: nocache
CAPREQ: 0
STRMVER: 4
ACT: 4
BUILD: 6551
UL: 1
************

I also had a related but not exactly the same request from New Zeland IP 125.236.206.207

Could this be the same guy who was just stopped by the BotRoast program?

Network Speed Test Results

Here is a summary of speed test results:

Comcast "power boost" - 28922 KBPS download 1466 upload
Clearwire - approx 1200 download - 225 upload
AT&T Wireless Modem (Cellular)143 KPBS upload 170 kbps download
T-mobile hotspot at popular Starbucks - 1400 upload and download (may vary by location as I believe this is a fixed line from an ISP called The Planet.)
Qwest (not sure which specific service and this particular IP range has a name assigned to it- so I don't know if this is the service for the whole office building or what...) - 4172 download 431 upload

The story:

I am testing out a new Internet provider and have to say the guy was to the point and provided most excellent service. I tried uploads from this company and get constant speed of 25K - even 9K when FTP'ing files up to another location. He was able to quickly and thoroughly show me that their service is actually working at the speed they profess (well very close to it) and that probably this is a problem with the ftp server, VPN or something else on the network. So now...to my server hosting company and let's see if they can be as helpful in pinning down this problem.

Next I did a test to the part of the country in which my server is located. Same thing - I got good speed on this new network.

OK so that pins it down to either my computer, or the computer at the other end, or the VPN. Right? Unless it is my hosting providers network...so I start with my ftp software. I switch out WSFTP with Globalscape - and the average speed goes up to 88-95K. MUCH better....! More here FTP Software

So, back to Comcast. Now that I have this nifty little site I run the test on comcast network. At speedtest.net I get 28922 KBPS and 1466 KBPS. A file upload still is far less than these speeds report - about 300KBPS, though better than the other provider so far.

Note that the Comcast test was not done during peak hours. I will post more results later. Comcast degrades when more people are online so I need to compare at different times of day. Basically if you live in a crowded area with lots of other people on comacst in your area your speed will be slower because more people are sharing it. If you live next to a gamer and you use Comcast, I'm sorry.

IP looking for perl - eNet Inc.

IP looking for perl: 209.51.212.82

OrgName: eNET Inc.
OrgID: ENET
Address: 3000 East Dublin Granville Rd.
City: Columbus
StateProv: OH
PostalCode: 43231
Country: US

NetRange: 209.51.192.0 - 209.51.223.255

IPs trying to access /_vti_bin/owssvr.dll

The following IPs have been trying to access this file on our server: /_vti_bin/owssvr.dll


11/30/2007 5:15:55 PM 71.231.107.92
11/30/2007 5:15:41 PM 71.231.107.92
11/30/2007 3:48:04 PM 66.165.57.43
11/29/2007 4:12:52 PM 64.122.102.72
11/29/2007 4:12:38 PM 64.122.102.72
11/29/2007 3:09:41 PM 205.229.151.150
11/29/2007 3:07:34 PM 205.229.151.150
11/28/2007 11:30:07 AM 63.166.226.83
11/28/2007 12:56:21 AM 206.81.222.24
11/27/2007 9:09:48 AM 130.76.32.182
11/27/2007 9:09:35 AM 130.76.32.182

Some of these IPs belong to large companies such as Boeing, REI and F5 which I find somewhat odd. Are their servers hacked or people randomly hitting the wrong IP address on accident?

Fight Spam

I love this - if you hate spam, check out this site. Better yet, contribute to the fight:

Fight Spam

Spyware - biggest threat?

Some business owners feel spyware is the biggest threat suddenly:

Spyware threat

Spyware. Servers can be taken down - and rebuilt. Spam spewing out of servers is a big nasty pain. If someone takes over a server that is really bad because they can divert your revenue and steal your source code.

But spyware seems like the evilist of evils. Why? Because with spyware someone can do all of the above easily and more. With spyware someone can log all your passwords - like when you log into your online banking site or your server or VPN. Spyware can potentially allow reading any communications you are sending so someone can know what you want and are going to do before the third party to whom the message is being sent. For instance are you sending a quote? They can undercut your bid easily and woo your potential customer.

With spyware a hacker can learn about your infrastructure and potentially find ways to intercept, block and change messages in transit. I am not 100% certain how much of this is possible or why or why not -- but don't tell me it is not possible because hackers find a way to do everything.

If you know you have a hacker on your system and use your computer in any way to communicate about it, they can read it. A great engineer I knew who worked at Excite way back in the day said they were fighting a hacker and called him some name in an email communication. They then all got a response "My name is Jim".

How can you fight someone who knows your every move? Spyware is the ultimate cyber evil and cyber espionage tool.

And these days, hackers are more crafty and harder to spot than ever, so I could be sitting here typing this while some guy in Russia is reading every letter using a keylogger. How should I know?

List of Criminals Arrested for Bots

This article details criminals arrested for spreading bots:

Botnet Criminals

And here's another one of the criminals targeted by Botroast:

New Zealand Bot hacker

This one is interesting because I was getting a lot of bad traffic from a New Zealand network with the word "hug" in it. I wonder if this is related in any way.

Report Hacker Sites at Google

This is cool. Google set up a site to help catch hackers:
Google helps track down malicious sites

Governments Using Hackers - On The Rise

Governments using Internet espionage is nothing new. I've been posting links about this for a long time and suggesting it is more prevalent than we think here. So is this really "on the rise" or is it that people are just noticing it? I've been digging in the Internet trenches here for years and seeing oddities that look like a bit more than a 13 year old kid messing around...Whatever the reality is, I am glad someone is noticing:

Cyberattacks by Governments

MSN Messenger Trojan - Spreading like Wildfire

MSN Messenger seems to be infected with a trojan that is infecting machines very fast.
http://www.eweek.com/article2/0,1895,2218894,00.asp?kc=EWKNLBOE112407STR1

If you get a link in MSN messenger don't click it unless you are positive the person on the other end meant to send it to you. Ask them.

I have written about the insecurity of IM in the past as a potential vehicle for maliciousness...and now it is coming to pass.

We need more security on the Internet - fast. And more government and crime fighting organizations looking into the depths of Internet traffic and trends...that is where the next battlefield lies.

If the other guys have access to your bank accounts and know your every move - how can you possibly win a battle? And if they can send a virus that spreads so fast it takes down the entire infrastructure we rely on - for just about everything...

Think about it.

SQL Server - Authentication Override

Here is a somewhat in depth discussion of sticking code into SQL Server 2000 to bypass pretty much any security or logging. So in other words - just because it isn't in your logs, doesn't mean you aren't hacked.

http://www.ngssoftware.com/papers/violating_database_security.pdf

Email. There must be a better way.

If someone could fix the email problems of the world I think they'd pretty much be a millionaire for sure (as long as they hire a decent sales person).

Here's the deal. This week I could not GET emails from Vericenter which is a tier 1 hosting provider, nor could I send emails to Network Solutions, and they are obviously a big Internet company. I also had a friend who was not getting my messages. So hmmm. Is this all just random? I mean really, c'mon - something has to be going on.

Let's say someone could intercept my messages and choose which ones they wanted me to get - or not - and which ones they wanted to go out - or not. Everyone says, oh, no this is not possible. Right. Just like the hack on my server was not possible that had a built in virus checker and was spewing out spam.

Ok moving right along, let's say this hacker is really good - and they usually are. My mail company traces a message and it goes all the way to Network Solutions machine. Let's say the hacker DID send a message all the way to Netsol. But it wasn't my message. It was a piece of spam half way through the route. It LOOKS like the message went through. On NetSol side, they say they have no message from me - it's not in their spam filter, yada yada.

Think out of the box...it IS possible. Don't tell me it's not.

But anyway back to the problem at hand. So I try to tell Network Solutions and they are a big company and one fo the best customer support people I've ever worked with...says there is nothing he can do. I asked him to contact his help desk and let them know - but what are the chances they fix it? They will say, "Everyone else is able to send and receive - it must be a problem with [your mammoth, top of the line] mail company [that supports major corporations].

So where does that leave me? SCREWED.

I am trying to work with and get help from all the people that are saying they cannot send to me or receive mail from me, however unless I can get two vendors on two sides of the equation to cooperate - this problem CANNOT BE FIXED.

If someone would run a mail company that would proactively call and work with other companies when this thing happens, on behalf of the person with the email account, they would make millions.

And by the way if it is a hacker, you could get reimbursed for this time via a lawsuit because of a new law that just passed....see my previous posts.

Stealing someone's email is a form of identity theft. This past year spam criminals in Seattle were charged this way - and sent to jail.

Installing Network Solutions SSL cert on Java web server?

If you're using Network Solutions site info to install their certs on a Java Web Server...don't. They are wrong and have been for over a year now. Call them to get the correct instructions.

Take Cyber Criminals to Court for Damages. New Law...

This is cool:

The U.S. Senate has passed a bill that would allow victims of online identity theft schemes to seek restitution from criminals and expands the definition of cyberextortion.

http://www.networkworld.com/news/2007/111607-senate-cybercrime.html?nlhtsec=rn_111907

It's about time criminals pay the price. Unfortunately some of them are out of this jurisdiction.

And by the way, does anybody believe me yet?

"Identity theft and data breaches have become organized crime's number one business." CSIA President Tim Bennett said in a statement.

Monster Spam - Money Scam

Received: from gwsin06.mbox.net [.19] by via mtad (C8.MAIN.3.40I) with ESMTP id 546LkTB1x0269M02; Tue, 20 Nov 2007 01:52:49 -0000
Return-Path:
Received: from gwsin06.mbox.net [127.0.0.1] by gwsin06.mbox.net via mtad (C8.MAIN.3.40I) with ESMTP; Tue, 20 Nov 2007 01:52:48 -0000
Received: from [.30] by gwsin06.mbox.net via mtad (C8.MAIN.3.40I) with ESMTP id; Tue, 20 Nov 2007 01:52:45 -0000
X-USANET-Routed: 1 gwsin-bmrelay Q:bmrelay
X-USANET-Routed: 2 gwsin-vs R:localhost:1825
X-USANET-Routed: 100 IN-RELAY R:cmsbackend.postoffice.net:525
Received: from smtp100.biz.mail.re2.yahoo.com [206.190.52.46] by via smtad (C8.MAIN.3.34P) with ESMTP id; Tue, 20 Nov 2007 01:52:45 -0000
X-USANET-Source: 206.190.52.46 IN Heather@Monster.com smtp100.biz.mail.re2.yahoo.com
X-USANET-MsgId: XID447LkTB1t0437Xma
Received: (qmail 73404 invoked from network); 20 Nov 2007 01:52:44 -0000
Received: from unknown (HELO localhost) (info24@qwbgtrbt543cvj.com@71.237.236.159 with login) by smtp100.biz.mail.re2.yahoo.com with SMTP; 20 Nov 2007 01:52:44 -0000
X-YMail-OSG: jYWPRfwVM1kU6Ince4b3cRwMQwOyx4BnAewRFJuHSQkx5tOVzBl7wHDcK9tJm2gmLUHNGHhDIzkk4X6ZGRd2sQ--
From: Heather Barnes Add to Address Book Block Sender Allow Sender
To: <>
Subject: , Monster.com have the new job for you Allow Subject
Reply-To:
Date: Mon, 19 Nov 2007 20:50:06 -0000
X-Mailer: MIME-tools 5.503 (Entity 5.501)
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
Message-ID:
Mime-Version: 1.0
Content-Type: multipart/mixed;boundary="9246daffa5a6153600e6ef7b36aef7ee2b78215"
: Job offer

We have reviewed your resume at Monster.com and are eager to inform you that we are ready to offer you a vacant position of the "Money Agent".Mz AwZ


We looked through your skills and became sure that you correspond to our requirements.MTc 5YjF


The position of the money agent will require from you a half-day activity.
Your work will consist in transferring money among our clients.

Job scheme will comprise the following:NmQx ZD


1. You get a check by mail. ZT Jl

2. Than you cash itMjdj Zjh

3. You transfer the money to our clientsOTg 4MDU


Your earning will be 8 % of the amount of each check. NzE yO

Additionally we are going to effect you $ 1500 as your salary at the end of each month. OT UzN


Required skills to start this job:OWRi YzNi


- Honesty, responsibility and promptness in operations; YmM zN

- Prior customer service experience is a good benefit;MTY 0Mz

- Internet and e-mail skills; Experience in online work; NTM3 Zj

- Good communications skills ZDI0 Mm

Njli NjM4

This job will allow you to:
Njli NjM4

- Develop high selfrespect and esteem. MGFk ZT

- Efficiently work at home; MGFk ZTU0

- Get financial independence working only 3-5 hours per day; MGFk ZT

General requirements:
Nj li

- Internet and e-mail skills; Experience in online work; YjRj ZTBh

- Ability to create good administrative reporting; YjRj ZTB

- Prior customer service experience is a good benefit; Ym Yz

- Willingness to take the responsibility to set up and achieve goals; YzZl NDk4


In addition we will be able to offer you $ 2500 as a monthly payment after completion of the trial period. ZmV iOW


In case you are interested in the position, please answer this message. We will get in touch with you within 2 working days. NDJ iNj

Hidden IP addresses

Well here's another criminal activity supporting product...

http://www.hide-my-ip.com/faq.shtml

Basically they set up a proxy IP for a user so the end web host cannot tell who the real user is.

I have to sort of revise what I said about this service prior as I just thought of something.

First of all if you don't want these unknown Ips hitting your sites - block them out. They cannot change the IPs that fast and get so many that you can never block them all - because that would not be cost effective - to continually switch networks like that. The only way they could change IPs that fast is if they were doing some sort of criminal activity to get those IPs by hacking in and using IPs owned by other people. This would be a form of identity theft and very unwise so I doubt this is going on here.

My initial reaction was that that for security reasons, this should be outlawed. If you have to hide your IP address (which can be dynamically assigned from a huge company and always changing anyway) then you are probably doing something you shouldn't be doing.

However there are some instances where this can be used for good. For instance when you are trying to protect your identity because you are reporting criminals and they don't like it, such as I do here.

But I still think this is a hotspot for surveillence of illegal activity.

91.190.88.177 in Russia bombing our sites

This IP 91.190.88.177 was apparently performing some sort of DOS attack at about: 11/16/2007 7:28:46 AM

inetnum: 91.190.88.0 - 91.190.88.255
netname: StartTelecom-NW
descr: P-t-P networks
descr: JSC Start Telecom, North-Western branch
descr: St.Petersburg, Russia
descr: 191119, St.Petersburg, Ligovsky pr., 108B
country: RU

Princeton Premier

Spam or not? Phishing or not? Underlying crummy business model or unscrupulous ulterior motives? You make the call...

http://answers.yahoo.com/question/index?qid=20070810121143AApf9Tq

Network solutions - no way to add spf records?

I am using a Networks Solution system for domain management and find it pretty much insane that they do not offer their domain owners a way to enter SPF records.

Managed Hosting

A rant on my last managed hosting company (a big company that many people use). First regarding my last post on SPF records --(The managed company we used before that was the same way) -- It's almost like they don't want you to set up an spf record. Heck if a spammer gets on your machine and sends enough spam you'll be paying for the bandwidth so what do they care? Not sure why they don't help customers setup SPF records as it would enhance security for all their customers.

How to create SPF records

I found this cool tool from Microsoft that helps create SPF records and seems a lot easier to use than the ones RackSpace and Datapipe sent to me - rather than tell me anything about whether my spf records were right or wrong.

But anyway, here's the tool from Microsoft: http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/

Microsoft Update Bug

I've seen this bug a number of times. I go to Microsoft update and the error message says that background intelligent transfer, event log and automatic updates are not turned on. I turn the services on and still continue to get this error message. This happens going to https://www.update.microsoft.com

The reason for going to that particular url is to ensure you are really at a Microsoft site and cannot be spoofed to download some garbage from a hacker.

Finally I went to some other link like http://update.microsoft.com and this site told me to install some ActiveX control, and then I could go through the whole update process.

Seems like Microsoft needs to ensure whatever this ActiveX control is can be downloaded from their https site as well. (or if by some chance this is the work of a hacker, find and fix it from https://www.update.microsoft.com.

I don't think this is the work of a hacker as was on a new machine but without using SSL cannot neccessarily be 100% confident.

PCI Compliance

Good point here:

PCI compliance mandate's power raises conflict-of-interest questions, 11/08/07: Businesses accepting credit cards have to assure their networks are secured according to the Payment Card Industry Data Security Standard, and to achieve that, they often make security investments based on the advice of the organization setting the standard and its 60 or so qualified security assessors empowered to judge whether a business is PCI compliant or not.

http://www.networkworld.com/news/2007/110807-pci-compliance.html?nlhtsec=1105securityalert5&&nladname=110907securityal

Russian Crime Ring Down

Here's good news for the good guys:

http://www.networkworld.com/news/2007/110807-major-russian-crime-hub-suddenly.html?nlhtsec=1105securityalert5&&nladname=110907securityal

Keep bloggin' and reporting the Internet mischief on your network.

Someone in Russia trying to spam reputations

Apparently this group in Russia:

a@softsearch.ru

and probably related are trying to spam people's reputation. Feel free to email them from a throw away email account and tell them to stop their nonsense.

I also saw a ton of spam about an investor acquaintance of mine - a nasty insulting page repeated over and over and over again on the net.

I think Google needs to look into this repetitive harmful content. It is obviously spam by someone who wants someone else to take a fall.

The next generation of smileys

That last version of smiley faces were full of adware and other undesirable attributes. I wonder if these new smileys are just as two-faced:

http://media.fastclick.net/w/pc.cgi?mid=154031&sid=15400

Hopefully someone is looking into this.

Storm - Largest Botnet

Network World has an article about Storm which they report is potentially the largest botnet in the world:

Storm

In another article they write:

The most important thing about Storm, and the point on which everyone seems to agree, is that it creates botnets. Once a PC visits an infected Web site and Storm is downloaded, the PC is considered compromised, which means it can be controlled by someone else without the user knowing it. Together these compromised PCs create botnets that can be used to covertly send spam, launch distributed denial-of-service attacks, or host Web sites that download more malware.

Storm FAQ

The thing I don't yet understand about Storm is exactly how to figure out your computer is affected with this malware since the file names change constantly and the hacker is constantly changing the way it works. Is there something in the way of network traffic that can pin down an affected machine? Is there some way to define this when someone clicks on a link and goes to your web site? Someone needs to look at it from this level to help nail this down. If someone could track when someone clicks on a web site that is infected and trace that back to the hosted web site and stop the problem there, that would help.

More Grub

More computeres infected with the grub-worm (intentionally or not I'm not sure)

9/19/2007 19:01 166.70.146.22 Mozilla/4.0 (compatible; grub-client-2.6.0)
9/19/2007 14:42 70.21.113.185 Mozilla/4.0 (compatible; grub-client-2.6.0)
9/19/2007 14:16 82.91.56.67 Mozilla/4.0 (compatible; grub-client-2.6.0)
9/19/2007 11:14 75.152.151.162 Mozilla/4.0 (compatible; grub-client-2.6.0)
9/19/2007 10:42 24.97.214.156 Mozilla/4.0 (compatible; grub-client-2.6.0)
9/19/2007 7:52 88.176.176.60 Mozilla/4.0 (compatible; grub-client-2.6.0)
9/19/2007 7:27 24.97.214.157 Mozilla/4.0 (compatible; grub-client-2.6.0)
9/19/2007 4:34 82.56.126.238 Mozilla/4.0 (compatible; grub-client-2.6.0)
9/19/2007 3:58 66.30.137.58 Mozilla/4.0 (compatible; grub-client-2.6.0)
9/19/2007 1:11 67.87.117.17 Mozilla/4.0 (compatible; grub-client-2.6.0)
9/19/2007 0:41 75.152.151.162 Mozilla/4.0 (compatible; grub-client-2.6.0)

Romanian Hacker Bomb

This Romanian computer bombed our server: 83.218.203.111 at 9/18/2007 9:25:41 AM

In the midst of that this IP sent a completely invalid request from Japan: 219.103.236.49

Skype and Ebay Hacked?

I have been getting repeated calls from odd numbers lately. I do not recognize them or know anyone in those area codes so I figure if they are for real they will leave a message and I will call back.

The latest such odd nuber is 202 580 8200. I looked it up online and found this post on ebay (and I recently posted a couple things up there), so I figure this is some hacker/scammer that has cracked skype and uses it to call people without being identified.

http://72.14.253.104/search?q=cache:DdeHN0U5tW8J:forums.ebay.com/db2/thread.jspa%3FthreadID%3D1000403037%26tstart%3D0%26mod%3D1166256674699+202-580-8200&hl=en&ct=clnk&cd=1&gl=us

This is the post on ebay - I would wonder if it is related to their Romanian hacker fan. Hopefully Skype will get serious about this problem soon - it is too bad because this is a really cool service -- if you could trust that your phone calls were not all hacked:
___________

I recently used Skype to place a call from the UK to a 800 number (love it - it is the easiest, sure-fire way to make a free 800 call trans- internationally) and made several purchases using my credit card

Subsequently the credit card was rejected - when I called the card company, they said a security block had been added, and unless I could identify a given phone number the card would be cancelled. The card had become "associated" with a phone number used in fraudulent transaction. 202 580 8200 - is the number.

It turns out that this number often shows up as the original number for call id. Evidently this is known issue, but Skype either cannot or will not correct this.

So,be aware, and decide how you want to deal with it...Myself, I was able to find this information out while on the phone with the credit card company and said I recognized the number - card was not cancelled. I guess everyone needs to make their own decision about how they will use Skype, and the ramifications

Peer-2-Peer Hacking

Here is a report on peer to peer hacking. What this leads me to wonder is if people can get hooked up on peer to peer networks without knowing it:

Peer-2-Peer Hacking

Preventing man-in-the-middle attacks on wireless networks

This book has some information on preventing man-in-the middle attacks on wireless networks.

Specifically:

Static ARP Entries
To protect against ARP man-in-the-middle attacks, which are described in
Chapter 2, set static ARP entries using a startup item script similar to the one
described for the firewall.

It goes on to explain how to do this.

Man-In-The-Middle on Wireless Networks

Man-in-the-middle Attack

This site has a pretty good explanation of a Man-In-The-Middle attack and different ways of doing this.

Man-in-the-middle Attack

This page explains how SSL might not always prevent man-in-the-middle attacks:

SSL not preventing man-in-the-middle attacks

Computer Weekly says RSA warns of more man-in-the-middle attacks as of August 15, 2007 due to free phishing kits being circulated:
Man-in-the-middle on the rise

I suggest the federal government puts out a free phishing tool - that sends the phishers details to the FBI.

This page suggests Firefox extensions are subject to Man-In-The-Middle attacks:
Firefox Man-In-The-Middle vulnerability

What we need are some good patterns out there to prevent this type of thing at all levels - network, application, and server configuration.

Also what is the fastest way to spot a man-in-the-middle attack?

Snail Mail Nigerian Scam

I call this the Nigerian scam becuase it is related to all those types of scams you get out of Nigeria on the Internet but I don't really know where this comes from.

My friend got a letter in the mail with a check. It said she won $50,000 and all she needed to do was pay the UK taxes. She had to cash a check for $2600 and pay the $2400 for the tax and supposedly she'd be getting the rest of the $50,000.

Of course the check probably was coming from a bank account not belonging to the person who sent her the letter.

Of course I recommended that she report this - not just trash it. Send a copy to the CIA, FBI and local police.

Could this be related to the Monster scam? Or just another scam out of Nigeria to transfer money out of bank accounts that do not belong to them?

When is our government going to get serious about these problems and crack down on these people in a big, big, painful way?

Cisco Clean Access

If you paid a lot of money to buy this:
http://www.cisco.com/en/US/products/ps6128/index.html

Read this:
https://nerp.net/~jcarlson/cca_.html#how

Monster hacker server in Ukraine

FROM:

http://www.networkworld.com/news/2007/082407-the-monstercom.html?nlhtsec=0827securityalert2

How was the information stolen? The Infostealer.Monstres Trojan runs batch searches by sending HTTP commands to the Monster Web site to navigate through folders, said Hidalgo. The malware then parses the output that appears in a pop-up window that holds the job seeker profiles that match the search criteria. Essentially, the Trojan worked as an automated search bot that located candidates, captured their contact information and sent it to a remote server controlled by the criminals. Symantec said that the server, though located in Russia, was hosted by a company out of Ukraine.

Essentially the article claims Monster was not hacked. I would claim that Monster needs to do a better job of scouring it's traffic and users and protecting those who posted resumes there in the past - like me.

PCI Compliant Managed Hosting

Someone needs to offer PCI compliant managed hosting with appropriate security auditing.

For instance firewall rules should be able to be seen by the end customer at ANY time and the customer should be able to have a third party test and audit all firewall rules and DNS rules that are supposed to be in effect without the knowledge of the managed hosting company and staff.

All touches on a server or network related to an ecommerce system or system with sensitive data including hardware, software and any network devices along the way should be logged and that log should be available to customers at any time upon request or possibly available at any time through a secure system.

Make sure customers are always up to date with latest VPN client software. My hosting company with highest industry uptime server rating was letting me run with out of date VPN software.

Monster Hacked

Monster was hacked and personal information was stolen.

Until our government gets serious about prosecuting intnernational hackers and system admins take seriously good and bad internet traffic and do more to protect apps, networks, VPNs, routers, etc....

This will continue.

And it may be the fall of Rome.

We built the computer. We created the problem. Let's fix it.

Length of SQL strings

If you are using SQL to record actions and log errors, make sure to validate the lenghth of all inputs before inserting into the database. If hackers can pass in a string that is too long they can cause an error that can allow their actions to bypass logging functions going into a database.

Hacking Regular Expressions

If you are using regular expressions you will want to filter out these characters from strings which may be used by hackers to change the meaning of your regular expressions when input is passed into them:

\, *, +, ?, , {, [, (,), ^, $,., #, and white space

Google Bot Blocking Software

Google bot-blocking software blocked me out of Google adwords on one computer I am using. When I write to customer support I can't get it resolved.

If I didn't have a secondary computer to get in and change my ads - I could possibly be blocked out and continuously charged for something I am trying to shut down.

I have bot blocking software on my site - but if someone calls and provides the appropriate information I can easily resolve any false-posistives. This is an unhelpful response I received - I hope that Google does something about this:


Hello

Thank you for writing back to us. As I mentioned in my previous email, we are unable to provide you the information regarding what is leading to your IP address getting blocked while making certain changes in your AdWords account. I suggest that the next time you get this problem, please delete your system's cache and cookies and log in after a couple of hours.
If the problem persists, you will need to figure out the reason for the IP getting blocked yourself. I apologize for any inconvenience this may cause.

If you have additional questions, please visit our Help Center at https://adwords.google.com/support to find answers to many frequently asked questions. Or, try our Learning Center at http://www.google.com/adwords/learningcenter/ for self-paced lessons that cover the scope of AdWords.

We look forward to providing you with the most effective advertising available.

Sincerely,
Sandhu
The Google AdWords Team

TRANSLATION:

"Sorry we cannot let you back into the administrative site we are charging you for and therefore you may get charged eternally -- but you have to figure out what the problem is with our software, not us."

I know for a fact that there are amazing, smart technical people at Google who can resolve this issue in a matter of minutes. I wonder if they realize this is happening.

ProjectHoneypot.org

While searching for an explanation of the IEMB3 user agent string - which I can find no useful information about - I ran across this site which at first glance has a very interesting thing going on. The way I got here searching for IEMB3 was kind of odd since the page was just telling me they have no informationa bout IEMB3, however the concept of what they are doing, if legit, can help track down bots and spammers across multiple web sites across the Internet:

http://www.projecthoneypot.org/

How it works is you set up a monitor on your IPs and they tell you if they see any malicious behavior from your IP space. Of course you have to trust these guys to not be doing some monitoring for their own malicious purposes but hopefully someone will look into that. The concept is interesting and by so doing some unsuspecting web site owners may be alerted if their servers are being used by command and control servers to perform dirty work.

Monitor Your Monitoring System

Do you know if your monitoring system is really monitoring what it is supposed to be monitoring? Have you audited it? Do you have a way to be notified if it is doing the wrong thing?

In my case I found out my monitoring system at DataPipe was set up to monitor IP address, not the urls I had requested. The problem with this is while the monitoring system may show you that your server is up, it doesn't tell you if there is a DNS error that is disallowing people from accessing your site - or worse - sending them somewhere else via a man-in-the-middle DNS spoofing attack.

Monitor your monitoring systems. Audit your hosting company.

Forum for Women Entrepreneurs Email List Hacked

Members of that group got this total spam email - with the organization's name in the subject line:

Official letter to Forum for Women Entrepreneurs

My name is Rev. Clysta de Armas,the president of the Fellowship of Baptist Church.
We are writting you this letter because we have recieved your recommendation from the Baptist christian organization in your country. You have been recomended as one who is trustworthy and our institution has decided to chose you for a humanitarian mission, one which will be greatly rewarding in financial terms.
The crisis in Zimbabwe has rendered many kids from european decent orphans and most of them have managed through the help of our missionary work to find themselves in South Africa and under the care of the Baptist Church world wide. In one major case a set of twin orphans were left with a treasure under the care and protection of the Baptist Church because one of our reverends was present at the hospital where the father passed away and the father had to entrust the safey and upkeep of the twins in the custody of Baptist organization.
Their father was a co-founder of the commercial farmers corperative union and in his will he entrusted all his estates to the two twin sons. We were also made executors of the last will and testament hence on the demise of Late Mr. Stevens, the sum of 15.5 Million dollars inherited by his sons Patrick Stevens and Mattew Stevens secured in VEF BANK in Riga Latvia was moved down to South Africa and secured in a special reserve account opened in the name of our church on behalf of young Patrick since is not mature enough to hold an account with any financial institution in South Africa.
God’s call comes clearly when we are listening for His voice. It is not just a one time call to salvation. That is the first call on our lives. But it is also a daily call to follow Christ in every situation.As I have tried to answer the call on my life, it has not always been easy or convenient, but it has always been the best for me. I challenge us all to take to heart our new emphasis and "Live the Call" each day. When we hear Jesus calling, let’s jump up and run to Him just as Mary did.
We would like you to help Patrick and his Twin brother Mattew. You may wonder, what do we want you to do for them.
1. Our church organization has no business ideas in mind to plunge this funds.
2. We are not involved in financial matters hence we lack fund management skills
3. We are prepared to raise Patrick and his twin brother Mattew until they are upto the age of 21 when they can manage their own affairs and be free from the orphanage but we need someone who will manage this funds for a period of 15 years because they are only 6 years old now.
4. We also need someone who will receive this fund oversea for this investment purpose.
5. We need a trustworthy and God fearing someone who will give proper accountability and also report events concerning the funds from time to time as shall be required by our organization.
6. For helping in the relocation of the funds to an overseas account, we are prepared to compensation you with 10% of the total funds and also in securing the funds in a solid investment we are prepared to offer you 30% of every yearly profit that shall accrue in the said investment.
7. The terms and conditions of this matter shall be put in a formal business and fund manager contract.
8. In your response, I shall send you some vital information that will enhance your decision making.
I am too busy with official matters regarding the church so please contact Rev. James Willis at the email below:
jameswillismail@sify.com
You can call him on the phone number: +27 79 753 3836
He has been given full authority by our church organization to facilitate this process and shall work in collaboration with you to actualize same so feel free to contact him.
Please respond to this call in the name of humanity.
On getting your response you shall be properly informed on what to do.
Thanks and may the blessings of God be with you.
He awaits your response,

Rev. Clysta de Armas

Take note , send your response to this email only to Mr. James Willis at jameswillismail@sify.com and additionally kindly call him at his phone number
+27 79 753 3836


Received: from gwsin04.mbox.net [165.212.64.16] by cmsmail03.cms.usa.net via mtad (C8.MAIN.3.27X) with ESMTP id 629LHRgwE0189M03; Sat, 18 Aug 2007 06:22:31 GMTReturn-Path: <clystamail_2006@sify.com>Received: from gwsin04.mbox.net [127.0.0.1] by gwsin04.mbox.net via mtad (C8.MAIN.3.31J) with ESMTP id 917LHRgwd0383Ms4; Sat, 18 Aug 2007 06:22:29 GMTReceived: from esmail01.eservices.usa.net [165.212.64.8] by gwsin04.mbox.net via mtad (C8.MAIN.3.31J) with ESMTP id 905LHRgwb0309Ms4; Sat, 18 Aug 2007 06:22:27 GMTX--Routed: 1 gwsin-bmrelay Q:bmrelayX--Routed: 2 gwsin-vs R:localhost:1825X--Routed: 100 IN-RELAY R::525Received: from fdvhgdf [63.147.22.100] by esmail01.eservices.usa.net via smtad (C8.MAIN.3.34P) with ESMTP id XID944LHRgwb8606Xma; Sat, 18 Aug 2007 06:22:27 -0000X--Source: 63.147.22.100 IN clystamail_2006@sify.com fdvhgdfX--MsgId: XID944LHRgwb8606XmaFrom: "Clista De Amas" <clystamail_2006@sify.com>To: [x@x.com]Subject: Official letter to Forum for Women Entrepreneurs - Seattle Date: Fri, 17 Aug 2007 23:21:50 -0700MIME-Version: 1.0Message-ID: <>Reply-To: clystamail_2006@sify.comContent-Type: multipart/alternative; boundary="--=_NextPart_0CEAF315_76FDB910_01C9F258.D84EF1C0"

Cisco Open Source Safe Mapping Software

Cisco released some open source software here aparently. Did someone verify this is really from Cisco? Just wondering.

http://www.networkworld.com/community/?q=node/18481&nlhtsec=0813securityalert5&

URIs can create security holes

URIs in your registry can launch applications according to this article. Some vendors make registry entries with these URIs to make it easier for people to launch applications, however this can lead to serious security flaws:

http://www.networkworld.com/news/2007/081507-new-uri-browser-flaws-worse.html?t51hb&nladname=securityal

Check your registry. Maybe we need Microsoft to wire a tool that reports all these URIs so you can remove them if you don't need or want them on your system.

Is your web reporting accurate?

You may not be getting all the referer information you think you are getting. Some data may be completely lost depending on what browsers and search engines are used.

I got to this article because something called GLinkPing.aspx was doing something funky on our server.

Check this out:

http://www.webmasterworld.com/website_technology/3076218.htm

and this:

http://www.javascript-examples.com/track-outgoing/

This article has some good points...

but what I liked best was the grand finale about the author blurb:

Jon Espenschied has been at play in the security industry for enough years to become enthusiastic, blasé, cynical, jaded, content and enthusiastic again. He manages information governance reform for a refugee aid organization, and continues to have his advice ignored by CEOs, auditors and sysadmins alike.
I feel your pain. Auditing and information security is way too lax in this country. It is an esoteric topic that the end user doesn't get so it can be swept under the rug by politicians (or maybe they don't understand it either). People in organizations don't know enough about it and trust people who don't want any more work or look ignorant to do to tell them everything is just fine.

Fight Spammers - Block their Sites - Google - Help!

This article suggests fighting spam by blocking out the sites that host spam related products:
http://www.networkworld.com/news/2007/080707-uc-researchers-take-antispam-fight.html?nlhtsec=0806securityalert4&

This is an intersting approach to making spam less profitable and protect people on networks where these web sites are blocked, though it may not initially affect the amoung of mail in people's in boxes. The spam will still come - you just won't be able to get to the web site (which is good).

I think penalizing the web hosts that knowingly host these web sites for spammers when it is clear what they are doing is a better approach. Drive up the cost of running these businesses and send the people who support them to jail as accomplices.

Being a hosting company I know this is tricky. I don't want to go to jail because one of my customers sent spam - so this would have to be done knowingly. There would have to be proof of the actions and that may prove difficult when the hosting company says "we didn't know".

However requiring hosting companys that have had 2-3 spam incidents to perform certain types of audits like monitoring outbound mail traffic levels and such might help. If they see an exhorbitant amount of mail coming from a particular customer the should be able to determine if the actions are suspect. Typically you can tell a crappy, spammy web site or email when you see it. You can also find out if that company has a double opt in policy and a clear way to get off the list.

Another concept would be to require spammers to include footers that send complaints back to the top level hosting providers or networks. Each spam message would need to have a clear and easy to read abuse email address that goes to the hosting provider that way they cannot say "we didn't know"...

Obviously there are a lot of web hosting companies and server owners whose systems and networks abused without their knowledge, but some of these people are catering to the bad guys. Those people should be penalized along with the people they support.

Blocking Both Ways - China

Here's an interesting post on what China is blocking out due to censorship. Hey maybe they will block out my blog now. Cool.

http://www.schneier.com/blog/archives/2006/06/ignoring_the_gr.html

Anyway it's quite ironic that I want to block my sensitive information from an abundance of hackers coming out of China (and elsewhere) and China wants to block their end users from valid, useful, true and honest information that, once discovered, my help make the world a better place.

We can all learn from our mistakes.

China Building Cyberwarfare Units

Not sure how I missed this one. China is promoting cyberwarfare. Our country created the computer and it is the monster that may be the thing that knocks us off our pedastal if we don't get with the game and get our systems up to speed.

Just recently I went to a governmental web site and the security mechanisms and web site were absolutely pathetic. It is scary that we trust our data and put it all online for anyone to rip off behind these pathetic security models.

I hope that our government will make this one of our top priorities. Are you listening presidential candidates? Our country needs to focus on Internet security, intelligence, protecting our money and our identities.

Core Security Patterns - Wish List

I have pretty much read the Core Security Patterns book from Sun. Ok I skimmed a couple issues we aren't reading but I read some parts 3 or 4 times looking for the information I wanted.

The book is very good, but as I read it I realized I was doing a lot of things in it without having anyone tell me it is a "pattern" because they are just common sense.

The part I found missing was a basic comprehensive example of managing user logins and lost passwords and clearly identify when you send out someone's password that you are sending it to the right user (sending being as an encrypted email, or via allowing them to reset their password online). I understand to some degree this is in the book but from a comprehensive standpoint:

Ok so I store my user passwords as a one-way hash and that's fine and dandy.

But when a user wants to reset their password - what is the best and most secure way to do that? How do you ensure someone who has ripped off the hash cannot reset the password to whatever they want?

Also why do some places have additional questions you have to answer before you login or photos that have to match what you expect - otherwise you know you're at the wrong site. There could be security patterns for this as well for these type of double logins. Do they have login information coming from two different sources in that case?

And how do you know when someone is on dynamic IP addresses and moving from location to location that it is really the same person - you have to assume the user name and password are good enough?

And it talks about man-in-the middle attacks but as I read this it seems like all the discussion is one way - from the client to the server. The client ends up on a different web site.

What about from the server to the client? How can you really know that that the person you think is sending you the request is really that person? This is related to the above issue. What if someone submits a request and your server gets hacked and the person is redirected elsewhere from that point and all future requests are from another source that is then controlling that user? I would like some discussion on how and why that would or would not be possible.

Also your firewall should prevent IP spoofing, but does it in all cases? This is something I wonder because I have actually seen IPs missing in request logs, but perhaps this is some xss in interjection technique and my backup logs are getting all the data. I haven't had time to drill into this in more detail.

There is information about filtering requests but the book does not go into detail about how to filter out invalid characters for XSS and sql injection attacks. Why not put a chunk of sample code and say - use this for JavaScript, this for SQL, this for Java, this for Perl, etc. etc. etc. so people can drop this code into their apps for better security.

What about random request keys so requests cannot be duplicated as in the case of a hiddne form submitting from another tab open in the browser to your site? How can this be determined if the hidden frame does not pass the referrer with the request?

These are just some things I wondered about as I read this book.

Social Security Administration - Technology

It is amazing how poor the Social Security Administration web site and support are. It is no wonder we have a problem with identity theft in this country. I was trying to register for their online system to submit information for my company - W2 forms, etc. - and it doesn't recognize the information I am inputting - which is correct - and which matches the document they sent to me. The only thing I can figure out is that they don't have my correct birth date perhaps. Everything else is matching up.

The person on the phone was very non-technical and told me to call some technical support number if I get stuck again. I think someone needs to definitely review this web site and the security around it. It would probably be a good idea for someone to read the security patterns book mentioned in previous posts here.

Additionally they could at least install and SSL certificate on the main site so you can verify that you are at the official social security web site.

WinHTTP Web Proxy - Hack or Bug or?

Hmm. I logged in to review my logs today and saw a lot of errors surrounding this particular service, which to my knowledge is not be started or run by anything I expect or want to be running on my server:

The WinHTTP Web Proxy Auto-Discovery Service service depends on the DHCP Client service which failed to start because of the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

A proxy can be used to forward requests to one server to another server - so has this service been exploited somehow to forward requests to our web site to some other server?

I hope someone at Microsoft can look into and resolve why this is happening and write a patch so that this service is only run when explicitly requested. I don't quite see why it should be required.

JVM Security Wish List

I wish when you installed the Java JVM on a server you could have fine grained control to include only the components you are actually going to use and a security wizard to set up the default security policies, for instance. This would allow not installing additional unneccessary code and potential exploits. I try to remove each jar or directory I know I do not need but I do not know what every single file in the jdk is and whether I can safely remove it or not.