Category Archives: Security

Attachment manager

You learn something new every day. Or maybe every week. This week I learnt about Attachment Manager.

Remember how we wailed when, back in 2000, Microsoft patched Outlook to block extensions from dozens of file types that were useful, but dangerous err powerful. Initially the extra security was optional, but it came built into later versions of Outlook.

Some of us resorted to hacks like Attachment Options to tell Outlook to STFU and give us the attachment.

From XP SP2 they’ve replaced it with the Attachment Manager (via David), which provides an extra prompt when you try and open/run the file. The file attribute even survives the file being moved around, provided it’s on NTFS. And it covers numerous applications, including Outlook, IE and MSN IM.

In some cases it simply won’t let you open/extract the file. For those you need to go into the Properties and Unblock it manually. Just another hoop to jump through.

Microsoft: please stop using Word

There’s a Zero-Day attack targeting MS-Word. This is the work-around:

Do not open or save Word files that you receive from untrusted sources or that you receive unexpectedly from trusted sources. This vulnerability could be exploited when a user opens a specially crafted Word file.

Don’t open Word files, not even in the Word viewer.

Nice.

I think I’ll just keep using Open Office.

Dan’s Adware Adventure

Earlier I wrote about how a Microsoft employee admitted some malware burrowed so deep into Windows the only way to remove the spyware from the computer it was to nuke it from orbit. Now Dan of Dan’s Data fame has just recounted his adventure removing some spyware, with it playing a Robin Hood and Friar Tuck game with him where the answer, in this instance, boiled down to using Prevx.

How to buy a 65â€ Plasma for $.99

e-commerce sites utilizing hidden fields are susceptible to manipulation, such as selling a 65â€ Plasma for $.99. The way it works is the hidden field containing the price gets its value changed from many thousands of dollars to less than one, and the form is submitted to the server. The server blindly trusts the web client, and instead of actually using its own database-stored pricing (which is where the price no doubt came from originally) uses the price supplied by the client.

Hilarity ensues.

The author wants to call this process eShoplifting. I call it redistributing wealth (from the stupid to the clever).

AVG IS still free

AVG is moving its free anti-virus from version 7.1 to 7.5. Never fear, it’s still free, despite the announcement implying that it won’t be after January 2007. What it’s actually saying is that version 7.1 won’t be supported after that time, but a lot of people are misreading it.

The optimist in me says it’s just worded badly. The cynic in me notes that some recall the switch from version 6 to 7 was worded in a similar way and it smells a little bit of the Real Player page that featured a big advert for the paid version, and a tiny link to the free one. But hey, the bottom line is AVG is still free, and millions of home users can continue to protect their PCs. Can’t really argue with that.

Free version 7.5 download here.

Other freebie anti-virus packages for Windows include Avast, Trend’s free adhoc (online) scan and the open-source ClamWin.

Elevator illusion

The missing elevator floor illusion – now here’s a business idea: sell this illusion to cash-rich, time-poor pranksters. Just make them measure the dimensions of the elevator in question, then print up a massive sticker for them to use.

Releases and recalls

Another major release of iTunes, another batch of complaints about glitches and poor performance. I’ll wait for an x.02 or x.03 release.

Mind you it could be worse… a recall of Segways cites random reversing. At least if iTunes skips a track you’re not risking your life.

Another password list

This time, the author says where they got the passwords from – phishing. MySpace… hmmmm… phishing…. don’t know about the validity of the passwords, but there you go…

Is our world just a little paranoid?

iPods also have lithium-ion batteries. Perhaps that’s why they grounded the plane.

HSBC.co.uk Security Sistem

From: HSBC Bank PLC
To: josh_parris@leakeddomain.com
Cc:
Subject: HSBC.co.uk Security Sistem

Dear HSBC Member,

We have reason to suspect that your HSBC account may be in use by an unauthorized party.

….

I think I should click on the link to check out this sicurety pblum. What do you think?

Credit cards

Here’s the algorithm for checksumming a credit card number, plus information on what all the fields are.

But you can checksum the numbers all you like, if the signature doesn’t match the transaction never happened.

How do you name your computers?

These days just about every computer is networked, and that means they have to have a hostname. So how do you name yours? Assuming there’s no particular corporate standard you have to follow, do you make up a theme, or just give them random names?

At home we have lano and woodley.

At my girlfriend’s place, they’ve called them crunchie and munchie.

The company I use for web hosting names their servers after towns and cities around Australia.

At one job I had, we went Red Dwarf, and ended up with holly (main server), kryten (test server) and hudzen (temporary server).

At another job, we started on The Simpsons, with maggie, marge, homer… then moved onto Asterix, with getafix (very appropriate for a machine that needed patching) and obelix.