Monthly Archives:December 2005

F-Secure: News from the Lab

The Inquirer’s post

Please DO NOT USE Windows media player right now. Also do not surf via ANY browser to any sites that are not known to be safe. This includes Outlook since quite a few e-mails are sent HTML. Do not double-click any e-mails in Outlook until this security issue is patched. Also you can get infected via a dos prompt or by simply using windows explorer to browse your hard disks.

*edit* An unofficial patch has been issued to fix this problem. Download it here. This is only for windows 2000, windows XP, and windows 2003. Windows NT, ME, 98, and 95 users are out of luck. No fix will be coming. Time to upgrade to XP or server 2003.

*update* microsoft has released their patch. run windows update to get it.

*update2* Leo Laporte and Stever Gibson talk with Ilfak Guilanov the producer of the unofficial patch for the WMf flaw. It’s a great listen.

Map Database Upgrade

Well this is almost nuts..:) My clan has just upgraded their maps database to 8000 maps. Right now with 3400 mpas a maps listing can take 30 seconds. It should be interesting to see how long it takes for 8000 maps rofl!

A growing number of fellow conservative blogs are buying the adminstrations constant assertions that the Patriot Act is alone responsible for stopping another terrorist attack. Unfortunatly the loudness of the conservative blogs is growing, along with the post i am using to track it. Frankly, I think my fellow conservatives are totally wrong on this one.

“Analog hole” legislation introduced

This will instantly criminalize me as i will use whatever i have to do use the content in ways i wish to. i will not share it illegally with other folks but telling me that i cannot timeshift, record, save, or whatnot while inside my home..well..to heck with them.

FOXNews.com – Politics – Congress Taking Action in Weekend Session
A fresh controversy flared when House Republicans, in a move designed to hinder Democratic-aligned political groups, pressed a last-minute bid to pass legislation limiting individual donations to independent groups.

Now then..where’s Congress’s concern for our Constitutional rights?

At Stake: The Net as We Know It
BellSouth, for one, wants to guarantee that an Internet-TV viewer doesn’t experience annoying millisecond delays during the Super Bowl because his teenage daughter is downloading music files in another room.

this is not a problem caused by google or other websites. This is caused by sharing your internet connection at the end user. This is simply a money grab by ISP’s and large corporations, nothing more, nothing less.

Well,

Emmanuel Computer Consutling just recieved it’s first BIG contract. Mind you this is a volunteer one but still it’s big. The total cost is $15,000 is hardware and software. The scope is to take the entire facility of approximatly 25 machines and one server and relicense the facilty. The clients are a mix of xp, 2k, and 9x with the server 2k advanced server. The reson for this massive overhaul is record keeping was not properly done so proof of licensing is unattainable. Keep me in your prayers as i begin to migrate the entire network over to the standrd configuration of:
Windows Server 2003 Small Business Edition
Windows XP Professional
Diskkeeper pro
Trend Anti-virus
Other accouting packages.

I am intentionally leaving out details to protect the client’s privacy and security. I have already install a linux firewall machine to protect the network. Keep an eye on this post for updates.

*UPDATE*

Well politics have come into play..kinda. The Board of Directors wants justificaton for every machine and staff employee. Of course they had to ask for this AFTER they approved the expenditure..:) However it appears we will be able to standardie on one accounting package instead of two. I am having to also add VPN access so i can remotely administer the network..:) Next up, the yearly budget for IT Services.

WorldNetDaily:

This article lists a lew of cases of female teachers preying on their male students. Reverse the roles and the men would have been put under the jail. The penalties leved against many women predators though are much less severe.

KRT Wire

I am not normally a fan of any democrat. If Fiengold filibusters and gets a few others with him, I’ll cheer him on until this despicable act dies and gets buried. Andrew Cochran of the counter-terrorism blog disagrees.

Next up, the DMCA.

*UPDATE* The amount of disagreement with trashing the Patriot Act is quite distrubing. I am beginning to see some of the more conservative blogs on the internet supporting the assault on the Consititution that the Act entails.

The Captain supports the renewal of the act.

*UPDATE 2*
This law is not responsible for stopping terrorism. It IS responsible for trampling on our Constitutional rights. I have to break from the growing number of conservative bloggers here as I think they are very very wrong here. The laws to stop terrorism were already on the books. The gov’t just did not want to use them becuase the Constitution “gets in the way.” Unfortunatly I ma seeing ore and more conservatives buying the lie that Bush is a conservative.

LaShawn is upset over the possible defeat of the Partiot act as well.

*UPDATE 3*

Powerline still says the Patriot Act is respondible for no terrorist attacks. The Partriot Act is also resonsible for more Constitutional rights erosion in one fell swoop than i have seen in quite some time. The Dems are actually perfectly responsible for killing this act. It is irresponsible of the repubs and other conservative bloggers to simply tow the party line without taken an objective look at what the Act truly entails. The NSA thing i am not concerning myself with at this time other than to say I agree with Vox Day. Not neccessarily for the NSA thing but for the blatant disregard for our nation’s safety and flautning of or nation’s immigraiton laws.

*UPDATE 4*
Dennis Lormel at the Counter-terrorism blog continues the drumbeat that killing hte Patriot Act euals a victory for terrorists. However what the growing list of fellow conservative bloggers understand is that giving up liberties for security equals a victory for terrorists AND those who wish to destroy us from the inside(aka leftists). The following quote is one i hear over and over again:

Are they on the verge of handing terrorism a victory? That may well be the case, should the Senate allow provisions of the PATRIOT Act to expire on December 31, 2005, as it appears they will. I find it absolutely appalling that the Senate cannot reach agreement to extend the PATRIOT Act. A group of Senators purport concern for civil liberties as justification. In reality, what they are stating is they do not trust law enforcement to exercise their sworn responsibility to ensure protection of civil liberties, while discharging their duties to protect innocent citizens from terrorism.

Of course I don’t trust law enforcement and the government. It is the governmnet via judges and legislature that has allowed many laws on the books that violate the very tenants of the Constitution this country was founded upon. The big fault lies with the electorate not wanting to be involved. Due to the general electorate’s laziness this drumbeat will only get louder and will become loud enough to be believable because of so few wishing to challenege those who wish to turn this form a Constitutional Republic into a totalitarian state.

*UPDATE 5*
The drumbeat continues. Powerline continues to try to justify more Gov’t actions..this time about the President not waiting for thei own secret court to approve warrants. I quote, Byron York explains why President Bush approved wiretaps without waiting for the FISA court to approve them. He notes that “when the president made his decision, there was widespread, bipartisan frustration with the slowness and inefficiency of the bureaucracy involved in seeking warrants from the special intelligence court.”

While this delves into the NSA wiretapping issue it also shows why more and more folks do not trust the gov’t at all. Things like the Patriot Act among others only hurts this administration’s cause. After all, if the excutive is not willing to “wait” for its own secret rubber-stamping court then who’s going to believe it will simply stay within the ever-expanding bounds the Patriot Act and others continuously give it?

*UPDATE 6*
Vox Day nails this totally.
I am not going to keep posting updates here. The number of posts justifying this from conservative bloggers has gotten to be too much.
Powerline, The Counter-Terrorism Blog, Michelle Malkin, The Captain’s Quarters are all going nuts trying to justify this garbage.

silicon.com

MOre of Sony’s cpoy protection software is now a security risk. They have cd’s out there that use copy protection by Suncomm that allow your ocmputer to be taken over by trojans if your computer is infecte with this software.

Mind you Sony says it will advise users of the flaw and patch via an advertisement in the copy protection software directly. Reminiscent of the rootkit debacle no?

JOLLYBLOGGER:

The large studios never would have touched this had Mel Gibson single-handidly thrust The Passion of The Christ onto the scene. Once that happened the large athestic studios know there is a market for movies like this so here they come. With LOTR such a smash it only figures they’ll try to make the entire Narnia series into movies. I was distrubed to see my church play the narnia trailer during the service and reccomend we all see it. I know why my pastor did it..however recognizing the true motives behind these movies being released by Disney is equally important.

*note* One of the links in the linked story is simply a list of small posts so i am posting the relevant text here:

Say “Narnia,” Collect $1000
12/5/2005
posted by Philip Ryken

Sunday’s Philadelphia Inquirer reports that Walt Disney Pictures is offering a free trip to London and a thousand dollars in cash to the winner of its promotional sermon contest. To qualify, a sermon has to mention Disney’s new Narnia film. So welcome to a new medium of marketing: the sermo-mercial. It would seem that something more than Aslan is on the move. I wonder: Would mentioning the film while decrying the absurdity of the promotion qualify one’s sermon for the contest?

WorldNetDaily:

As WorldNetDaily reported, John Casoria, general counsel for the network, responded yesterday to Lindsey’s contention that the weekly program “International Intelligence Briefing” had been canceled for December, and possibly permanently, because its message was deemed “too pro-Israel and too anti-Muslim.”

Casoria initially replied, “That is absolutely, 100 percent false.”

But now, after talking with network programming officials, he says a secondary reason for pre-empting the show was that it “placed Arabs in a negative light.”

The overwhelming reason, he still insists, is TBN requires all its programming during December to have a Christmas theme.

“When a programmer chooses not to do so, they are pre-empted so that TBN can focus its attention on the holidays,” Casoria said. “Hal is very well aware of this.”

The Attorney goes on to say:

Casoria said he could not recall specific examples from Lindsey’s programs that were anti-Arab or anti-Muslim, but he expressed the network’s concern about how Muslims are portrayed.

“TBN is a worldwide ministry; we have an entire channel that airs 24 hours a day, seven days a week in Arabic,” he said. “We are trying to reach the Islamic world and open a dialogue with them regarding Christ and Christianity.”

Casoria explained, “We do not feel that the best witness of Christ is to bash them but rather to show them the nature of Christ – the way Christ said to present himself – and that is through love, understanding and the presentation of the gospel to them.”

Hal has posted his reponse on his website here.

Sounds like typical liberal PC-ism to me. This is sad. More and more churches and “Christian” organizations are doing this. Last time i checked we aren’t to become part of this world but to simply live in it. Too many Christians are tyring to become part of the world thinkking it will help their acceptance. The truth however is a totally different story.

MSNBC.com

The ACLU and the judge in this case apparently are ignoring one major fact. This person is a minor and therefore is under her parents perview. Under legal rules since she is 17 she can’t bring a court case on her own behalf and no attorney can either without parental consent. Of course we know that parental consent to the liberals doesn’t mean a thing as long as they gt the kids away fromt he parents for their own indoctrination into the socialist/communist way they want to push forward.

My responses to Security now! Episode 16:

I have some comments and I also must point out some huge flaws in Steve Gibson?s replies to some questions:

Storing stuff on a USB key really should be encrypted. Especially if the USB key is going onto a public computer. Otherwise that unencrypted file can be read by malicious software and your passwords are now compromised.

Traffic on a switch CAN be heard by other ports rather easily. A switch can be turned into a hub very easily by either putting an Ethernet card into promiscuous mode, which means it then effectively turns the whole switch into a hub for that nic. Some switches can guard against that..but those advanced switches can also have a port turned into promiscuous mode hence doing the same thing. Putting a nic into promiscuous is very very easy, especially under Linux. So by doing this you can still get the benefits of a switch for the other ports and you can sniff your traffic like you would be able to on a hub. Why steve would use a hub when a switch can do the same thing is a bit mystifying.

RC4 has been crakced via the RC4 DC project. It took a while but RC4 is not uncrackable..J

A switch is NOT going to protect your internal network from the unencrypted network traffic. If you want to run two wifi networks they need to be on their own lans. AKA Ipcop can support a 4 nic setup. One nic is green(for internal wired clients) then a blue network you can use for the encrypted wifi, then orange for the unencrypted wifi and then the RED inet interface. Traffic between gree,blue, and orange are totally iolated unless you specifically tell ipcop to pass traffic betweent he htree. To suggest that a switch will protect secured users from unsecured users is patently wrong and Steve needs to restate this.