A bug in Microsoft Corp.'s Internet Explorer Web browser gives phishers a way to scan the hard drives of Google Desktop users, according to an Israeli hacker. Because of a flaw in the way Internet Explorer processes Web pages, a malicious Web site could use the attack to steal sensitive information such as credit card numbers or passwords from the hard drives of its visitors.

"Google Desktop users who use IE are currently completely exposed," hacker Matan Gillon said via e-mail. "An experienced attacker can covertly harvest their hard drives for sensitive information such as passwords and credit card numbers. Since Google also indexes e-mails which can be read in the Web interface itself, it's also possible to access them using this attack."  Full Article

Microsoft Corp. said Friday that some people who use its Hotmail and MSN e-mail services are not receiving e-mail sent from Comcast Corp. accounts and other Internet service providers.

Brooke Richardson, a group product manager with Microsoft's MSN online division, said the problem appears to be due to an increase in e-mail volumes, which it is attributed in part to the Sober Internet worm.

She said the high volumes are causing e-mail to either be delayed or not make it to MSN and Hotmail users at all.

Richardson said the problem began earlier this week. She would not name the other Internet service providers besides Comcast whose users were encountering the same problem. She also couldn't say when the problem would be fixed.

Comcast spokeswoman Jennifer Khoury said the problem is only affecting Comcast e-mail being sent to the MSN and Hotmail accounts, and that other e-mail is getting to recipients without delay. She said the company is working with Microsoft to resolve the problem.

Sharks aren't that bad!       Run the reel

Steven Hogg has some funny videos here. Under Scottish Funny Video Clips.

The source of the video is unknown but since someone went through this much work I thought it was worth making it available for everyone to see. Run the Reel

Starting with Windows 2003 Server, Microsoft security requires that all file types the server is going to host be registered with the server via MIME types. If you have recently migrated from an earlier server to a 2003 platform, you may notice your tours do not work until these MIME types are added to the server's configuration.

The MIME type info is as follows:
file extension=.ips   application/x-ipscript
file extension=.ipx   application/x-ipix

   AOL Releases Standalone Security App

This should give any knowledgable person a warm fuzzy feeling. As I was reading the news feed on this one today I was so excited I wanted to get some of this. NOT! Here is the article. This group of people actually astound me with their approach. A company which until recently did not offer anything but their proprietary mail server. They have never followed the RFC's with their own mail servers with omitting the abuse and postmaster mail accounts which is a requirement clearly defined.  Yet they think they can dictate to the world how everyone else should run their mail servers. Requiring a reverse look up is absolutely stupid. Most mail servers put a weight associated to reverse lookup and goes against determining what is spam. To do this simply blocks huge numbers of valid emails and honestly they have no easy way for their users to get the problem corrected.

Here is just what any rejected sender has to do to be whitelisted. AOL sender needs to do for a whitelist. AOL® Postmaster Hotline at 1-888-212-5537 I offer this number so everyone can give them a call with how stupid they really are to do this.

However, it seems to me if they had a proper mail server their users could have white list access themself. After all we are certainly familar with third level mail server software. We have to make sure these features are there for our clients. The artilce I refer to in this post has some great comments from other people about AOL and honestly is one of the many you can find world wide. I am focusing this post on email. I know how stupidly they do that! Heaven only knows what will be broken letting these people control your machines security. Given the vast number of unexperienced users they have, I am sure it is better than nothing. Afterall if they were knowledgable would they even consider AOL an option? I think that anyone who hires a company who thinks they can dictate standards to the world, gets exactly what they are paying for. Hopefully their clients will become so isolated on that island called AOL, that they decide rightly to simply leave.

I have had several people ask me just how am I going to replace QuickTime? If I decide to remove something from my system as with QuickTime and there is no solution I do without. Personally I feel no QuickTime Movie is worth leaving this third level plugin threat in ones machine that could allow someone to take it over without being patched.

A friend Baz Peracha recommended I check out this product, which simply adds the codecs to Media Player. I have refused for some time to install Real Audio due to the problems it has created in the past. This actually works as a great free cure to all these issues.

With the K-Lite Codec Pack you should be able to play all the popular movie formats and even some rare formats. This package is mainly for power users and people who do their own encodings.

K-Lite Codec Pack is a collection of codecs and related tools. The K-Lite Codec Pack is designed as a user-friendly solution for playing all your movie files.  Get it here

FlyakiteOSX 2.0

Anti-Spam Filter is now freeware! For Outlook or Outlook Express

SpamLiquidator's free Anti-Spam Filter is an innovative self-learning spam filtering system, offering you spam protection without deleting the important correspondence. The software maintains its own collaborative spam-tracking database, which uses the signatures of spam messages. It is different from other anti spam programs in the way that you're not the only one to "teach" it, but all of our project users contribute to it.

Upon studying many spam detection algorithms, we have come to a conclusion that only a human being is truly a hundred percent capable of discriminating spam against regular messages. Even the most complex algorithms make mistakes, and can either pass the spam through ("false negative") or, much worse, delete an important letter. They call it "false positive". The only way of generating a real spam killer is uniting all of our efforts.

How does it work? Aside from initial filters provided by our program and created by our developers, Anti-Spam Filter presents a claim submission practice, in case you have got some spam coming through. The process is ultimately simplified - to report spam and make a filtering rule created you just have to make two mouse-clicks.

The development of the Spam Liquidator project has begun in September 2002. As of February 20 2003, the project has been open to public via Internet. Our software functions are regularly being updated and supplemented. We are open for all suggestions and propositions. "Get it here"

Recently my own anti-virus software attacked an removed a .dll within the installed path of QuickTime Player. This caused me a good deal of concern. I assumed at first that the anti-virus software was being over zealous. Today I was trying to remove the QuickTime Player and thought I would simply uninstall and reinstall a new version. This is where we all start laughing out loud.

Well no big deal I thought, just go trash all the keys. I had no idea just how many keys were assoicated to this software. Go Apple! So after about an half hour of trashing the keys I decided I would look into the problem before I reinstall. I was abit taken in by the topic I was exploring here. Seems when it comes to Apple everyone acts like no negative comments can be made. Personally I have the solution to this problem. Remove it untill apple decides to get it right. I am quickly reminded of the Sony Deal. Are companies actually no longer responsible for setting people up to Remote Code Execution?

eEye Security has posted these short bits on their site. EEYEB-20051031 | EEYEB-20051117a | EEYEB-20051117b

Researchers at eEye Digital Security have taken a bite out of two popular Apple Computer Inc. products, flagging two critical vulnerabilities in the iTunes and QuickTime applications.

The flaws, which put millions of Windows users at risk of code execution attacks, remain unpatched.

Steve Manzuik, security product manager on eEye's research team, said the newest version of iTunes, which was released by Apple earlier this month, contains the vulnerability.

eEye, of Aliso Viejo, Calif., has posted two brief notices on its Web page for upcoming advisories warning that the flaws carry a "high risk" label. "Full Article"

E Ink® Imaging Film is a simple ink sheet component that can be integrated into a device to create a high resolution display with all of the unique attributes of electronic ink: long battery life, a wide viewing angle and a paper-like reading experience. While current devices using E Ink® Imaging Film have rigid backplane electronics, the Imaging Film itself is plastic and can be flexed and rolled, combining the complete look and feel of a paper document. Once electronics manufacturers are able to mass produce flexible backplanes, E Ink® Imaging Film will bring the E Ink founders' vision of a flexible newspaper with the versatility of digital control and wireless update to life. Learn More

gumstix products

Products that enable – dream, design, build using gumstix basix and connex platforms!

In keeping with the theme between now and Christmas Holiday season. It's time the System Administrator gets rewarded for their thankless job. The admin for deadtroll.com did this.

So see the movie here!

Expect more spam. Lots more. It's a recurring theme seemingly as inevitable as Christmas carols and fruitcake, as internetnews.com has reported in 2002, 2003 and 2004.

Security experts at anti-spam and anti-virus vendor AppRiver expect the volume of spam to double during the holidays. The irritating messages accounted for 81 percent of all e-mails its customers saw in August. But spammers pull out all the stops for the holiday deluge, with good reason.

One of the trends AppRiver officials see with spam is that while many of the offers feature the generic replica watches, weight loss pills and the like, spammers are including name brand items to give the e-mails a hint of legitimacy.

The expected spam surge also likely coincides with the recent rash of viruses spreading throughout the Internet.

The Federal Bureau of Investigation (FBI) released an advisory Tuesday warning consumers of e-mail purportedly coming from the agency but are in fact spoofed e-mails (define)containing a variant of the Sober virus.

The spoof claims the FBI has tracked the user's IP address to a number of illegal Web sites and tells them to open an attachment containing what the e-mail states are a list of questions to answer.

A new initiative set up to dispel confusion over virus-naming, the Common Malware Enumeration (CME), was launched on Wednesday Oct.7 2005. It has been a long time coming but finally there is a way to find a common name.

The problem is, when you get a virus sample and you have 15 minutes to get something going. 'You have to name it, work out how to handle it and then kick it back out ... Now every piece of malware will end up with just 18 names and a number.'

The industry group, backed by a string of global security companies, aims to provide a common name for high profile threats in the hope that customers will be able to protect their computers from malware attacks more effectively.

The need for a more uniform approach to virus-naming has been a long-standing issue for users. Many have grown increasingly frustrated with different anti-virus vendors relying on different naming conventions to refer to particular threats.

Companies signed up to the CME will work to apply the same identifier to each piece of malware discovered by the group. It will use identifiers that will follow the format of CME-N, where N is a unique series of numerical digits. The name will be adopted by the anti-virus vendors, which can then be used in products and websites. Link Here

Search engine darling Google Inc. has issued a patch to cover a range of potentially dangerous security flaws in the enterprise-facing Google Mini search appliance.

The company's patch was issued after researchers at the Metasploit Project pinpointed several bugs that can be exploited by malicious hackers to conduct cross-site scripting, file discovery and service enumeration attackers.

Metasploit creator H.D. Moore warned in an advisory that the most serious bug can lead to arbitrary command execution.

Security alerts aggregator Secunia Inc. rates the flaws as "highly critical."

According to Moore, Google's patch and advisory were only released to businesses that pay about $3,000 for the pizza box-sized appliance.

A spokesperson for Google said the company learned of the issue several months ago and quickly made a patch available to all enterprise customers. "No customers have reported any effect related to this issue," he added.

Metasploit's Moore said the flaw was discovered in a feature that allows customization of the Google Mini's search interface through XSLT (Extensible Stylesheet Language Transformations) style sheets. He explained that certain versions of the appliance allow a remote URL to be supplied as the path to the XSLT style sheet, and warned that the feature can be abused to perform malicious hacking attacks.

The computer security research organization's report reveals that cyber criminals have shifted targets. Over the past five years, most hackers went after operating systems and Internet services like Web servers and E-mail servers. In 2005, they took aim at software applications.

The applications under fire span a variety of operating systems. They include enterprise backup software, anti-virus software, PHP applications, database software, peer-to-peer file sharing software, DNS software, media player software, IM software, and Internet browsers.

The second major finding of the report is that vulnerabilities in network operating systems such Cisco’s Internetwork Operating System (IOS), which powers most of the routers and switches on the Internet, represent a significant threat.

"The bottom line is that security has been set back nearly six years in the past 18 months," Alan Paller, director of research for the SANS Institute, wrote in an E-mail. "Six years ago, attackers targeted operating systems and the operating system vendors didn't do automated patching. In the intervening years, automated patching protected everyone from government to grandma. Now the attackers are targeting popular applications, and the vendors of those applications do not do automated patching."

Security experts credit Microsoft's efforts to improve its software with forcing hackers to look for lower hanging fruit. Part of the reason we're seeing a more of the attacks go against things other than the Windows operating system is that the Windows operating system has gotten better.

Full Article

The new facet can be found at www.live.com, which Microsoft uses to deliver some of its software products. The Live.com Web site debuted about three weeks ago.

At Live.com, Microsoft now supplies e-mail and instant messaging features for any Internet domain (addresses used to network computers).

Analysts felt Microsoft is also trying to fend off challenges from Google Inc. and other competitors that have already adopted the same "live" view on software.

But it means a departure from Microsoft's historical way of offering services: licensing the applications to computer manufacturers or selling them to consumers on disks.

Has the time come where people really think their own machines and applications are best managed by someone else? I still remember people scoffing at Larry Ellison when he made statments about network applications years ago. Have the weaknesses of the OS and browser created yet another market? Was it a case where MS could take on Oracle and Sun easily. When the word Google is spoke they seem to respond in turn. 

 Please note that the $100 laptops—not yet in production—will not be available for sale. The laptops will only be distributed to schools directly through large government initiatives.

The MIT Media Lab has launched a new research initiative to develop a $100 laptop—a technology that could revolutionize how we educate the world's children. To achieve this goal, a new, non-profit association, One Laptop per Child (OLPC), has been created. The initiative was first announced by Nicholas Negroponte, Lab chairman and co-founder, at the World Economic Forum at Davos, Switzerland in January 2005.

Learn More

Trust SONY ?

On Oct. 31, Mark Russinovich broke the story in his blog: Sony BMG Music Entertainment distributed a copy-protection scheme with music CDs that secretly installed a rootkit on computers. This software tool is run without your knowledge or consent -- if it's loaded on your computer with a CD, a hacker can gain and maintain access to your system and you wouldn't know it.

The Sony code modifies Windows so you can't tell it's there, a process called "cloaking" in the hacker world. It acts as spyware, surreptitiously sending information about you to Sony. And it can't be removed; trying to get rid of it damages Windows.

This story was picked up by other blogs (including mine), followed by the computer press. Finally, the mainstream media took it up.

The outcry was so great that on Nov. 11, Sony announced it was temporarily halting production of that copy-protection scheme. That still wasn't enough -- on Nov. 14 the company announced it was pulling copy-protected CDs from store shelves and offered to replace customers' infected CDs for free.

Full story here.

The new Google Base (beta) service means you can add all types of information that they will host and make searchable online. Describe any item you wish to post with attributes, which will help people find it when searching Google Base, which may also be included in the main Google search index and other Google products like Froogle and Google Local.

Its free and all types of online and offline information and images are accepted. Interesting items already posted include non-profit organisations and recipes for tikka masala.

Google have also set out guidelines for what is prohibited such as product endorsing, gambling, illegal goods and hacking.

For more information visit: http://base.google.com/base/default

Why are you clicking on attachments still???? Do you just like pain or what?

Both Kaspersky Lab and Symantec have detected worm variants. Kaspersky noted three variants of E-mail-Worm.Win32.Sober, which Symantec identified as W32.Sober.S@mm.

The variants are modifications of the same program, according to Kaspersky. A "large number of samples" of the variants have been intercepted in e-mail traffic, indicating that the worms are spreading by spam containing infected messages, Kaspersky said in a statement. The variants arrive as an attachment to infected messages.

The messages might not have a subject line or text, but can be identified by the attachment name. The attachment names thus far identified are: Exceltab-packed_list.exe; Liste.zip; Reg-List-Dat_Packer2.exe; reg_text.zip; Word-Text.zip; Word-Text_packedList.exe; Word-Text_packedList.zip.

The worm activates only if a computer user clicks on the attachment, which causes a false error message, "WinZip Self-Extractor. WinZip_Data_Module is missing ~Error," to pop up, Kaspersky said. The worm variants copy themselves to the Windows system directory and then register the files to the system Registry so that the worm launches every time Windows is rebooted.

The Sunnyvale, Calif., chip maker is aiming to roll out a quad-core-capable processor family during 2007 and switch to an all-new processor architecture later this decade.

The quad-capable family will result in a wide range of four core processors, including offerings for desktops, notebooks and one for servers that can fit into machines with as many as 32 processors.

AMD aims to use its ability to step up on processor cores in 2007, along with its move to a new processor architecture around 2008 or 2009 as a means to meet its goals of maintaining what it sees as a technical lead over Intel Corp., its larger rival, while fostering a grow rate that's at least two-times the market average, company executives said in a meeting for analysts on Tuesday.

AMD hopes to use its Opteron chip's recent wins in rack-mount servers to gain more acceptance in areas such as blade servers, corporate desktops and business notebooks, over time, executives explained at the meeting.

Poor Skype. They started out last week with the best of intentions, releasing what they called an independent security evaluation of their VOIP product, and ended up with egg on their virtual faces as high risk security vulnerabilities came to light.

Skype, based in Luxembourg, has positioned its VOIP product as superior to any one else's in the field because the voice data is encrypted. Since Skype hasn't made its encryption scheme public, this has led to some questions on just how secure it is (and how much of a Calera backdoor was built in.) The author of the report, Tom Berson of Anagram Labs, is well respected in the security field and would seem to be a good choice to author such a reassuring effort.

Of course, to make matters worse, vulnerabilities in the code showed up at the same time as the report's release. Skype says that the vulnerabilities affect Skype software for Windows, Mac OS X, Linux and Pocket PC. Skype goes on to say, "Skype can be made to execute arbitrary code through a buffer overflow when Skype is called upon to handle malformed URLs that are in Skype-specific URI types callto:// and skype://." Also, Skype could launch malicious code "during importation of a VCARD that is in a specific non-standard format."  "Full Article"

DRAM output continuing to grow, oversupply in the DDR and DDR2 segments will continue over the upcoming months, and the effects on memory price trends in both the contract and spot markets.

InSpectrum noted that the output ramp from both Taiwan and US makers were fairly stable in October, while a Germany-based memory maker reported output growth from its partners. Japan and Korea based vendors, in the meantime, continue to report escalating output.

Contract prices in the second quarter of November should drop further as some PC OEMs may receive special offers from memory makers. Heavy trading may expose traders to dramatic price drops, of up to 5% in single day, InSpectrum predicted.