J-Soft Blog

Saturday, June 26, 2004

There's yet another exploit out affecting Windows users. It installs a keysniffer that records keystrokes ie. steals passwords, credit card numbers, and whatever else you happen to type when you're online. It is spread by websites served by Microsoft IIS webserver and exploits Internet Explorer under Windows.

"...Users should be aware that any website, even those that may be trusted by the user, may be affected by this activity and thus contain potentially malicious code,..."

Don't worry, this website is served by apache webserver, so at least you won't catch it here. I suppose the only way to be relatively safe is to abandon windows altogether. Having abandoned windows long ago, I can sit back and smugly laugh the whole thing off while the rest of the world wastes its time fixing another of Microsoft's bizarre "features".

See also:

• This article from ZDNet



• This article from wired news



• Microsoft's recommended solution (My solution would be to avoid Windows at all costs, or at least stop using Internet Explorer and Outlook. Those two programs are festering cesspools of virus exploits)

posted by Jesse at 12:17 AM #


Wednesday, June 23, 2004

I know I'm getting a bit heavy on the browser evangelism, but I have to post this. To give the case against IE some clout here's a piece by an MCSE: Why You Should Dump Internet Explorer

"...Since information security is my hobby/job/obsession, this particular topic is near and dear to my heart. Just about everyone reading this has seen computers that have been beaten down with spyware - the evil junk that hijacks IE and renders a system virtually useless. How many times have you been called to a family member's house to clean up their system? Or had to call your techie friend to come clean yours? It's often quite awkward - the system slows to a crawl and every other mouse click conjures up some species of perverse, obscene image. What most people don't realize, however, is that there is a very simple and powerful way to defend your system (and/or the systems of your loved ones) in one fell swoop.

Don't use Internet Explorer.

What makes other browsers better than IE at protecting vs. spyware and other attacks? Well, it's simple really - most other browsers don't make it so easy to install malicious software on your system without you knowing about it. IE makes it relatively trivial through two features called ActiveX and Active Scripting. These technologies were designed specifically for the purpose of giving websites more control over a user's computer. Unfortunately, as we have seen with exploit after exploit - that's not always a good thing.

In addition to the spyware issues, IE in general has had a terrible track record when it comes to all types of serious security issues..."

posted by Jesse at 4:38 AM #


Wednesday, June 09, 2004

Spammers are diversifying. Email spam is rampant, and as if the daily bombardment of email spam wasn't enough, spammers are branching into other media. For some time now there have been bots crawling the web leaving spam on weblogs in the form of comments. Movable Type seems to be exploited pretty heavily. I have also seen a few instances of comment spam against Reblogger users. Movable Type has created a comment spam blacklist, which performs a similar function to its email counterparts such as spamhaus, only for comment spam. Given that comment spam will undoubtedly get much worse before it gets better, I'm aiming to include support for the MT-blacklist in the next reblogger release.

Today, while perusing my server logs I came across an unusual entry. Further investigation revealed that I have fallen victim to yet another form of spam: log spam. That's right, log spam! They're even befouling server logs!
posted by Jesse at 2:17 AM #


Tuesday, June 08, 2004

I've rediscovered my record(vynil) collection again for the millionth time. I hadn't listened to any vynil for a while, not for any particular reason. Earlier today I heard Well You Needn't blaring from a car parked outside and was reminded of a spectacular recording of that tune by the Cannonball Adderley Quintet that I have(on vynil). I put it on and realized what treasures I had been neglecting.

Time for Tyner(McCoy Tyner),
V.S.O.P Quintet,
The Other Village Vanguard Tapes (Coltrane),
Another Earth(Gary Bartz),
Dialogue (Bobby Hutcherson, Freddie Hubbard et al.),
True Blue(Blue Mitchel, Dexter Gordon,Sam Noto ...)
Thelonius Monk Orchestra at Town Hall,
Mingus Mingus Mingus Mingus Mingus,
........

I've been thirsting for some playing. I really should get to some of the Rex jams, but I'm reluctant, given the current state of disrepair my chops are in. I really should get doing some serious practicing.
posted by Jesse at 1:33 AM #