Posts tagged “security”
A quick tour through decades of US government surveillance programs, from COINTELPRO's mail-opening in the 50s through Carnivore, ECHELON, Room 641A, DCSNet, and now PRISM. The names change, the methods evolve, but the core activity stays the same. PRISM shouldn't surprise anyone paying attention.
Got hacked again, but caught it faster this time and found the entry point. Hopefully that's the end of it.
My hosting account was hacked Friday: phishing sites, bulk emailers, the works. My host caught it after 11 hours and shut me down. I've been cleaning up since, but the hole may still be open. Upgrades and migrations are coming. I feel awful about being an unwilling accomplice to criminals.
The DVD industry's CSS encryption failed because they had to give users the tools to decrypt it. Airline security has the same flaw: publishing the rules tells attackers exactly what to work around. Security theater with a known ruleset is just a temporary inconvenience for a determined adversary.
I have an Amazon wish list if you want to buy me something. Also, I finally secured my WiFi after a neighbor started hogging our bandwidth. Sorry to any innocent freeloaders, but they left me no choice.
Got a frighteningly convincing PayPal phishing email today. The tone, look, and serial numbers were spot-on. Only caught it because the recipient address was a spam honeypot, which prompted me to inspect the link more carefully. Stay vigilant.
Bluewater's hoodie ban is a lazy, blunt instrument that will catch chemo patients and cold-eared tourists alongside actual troublemakers. Give security staff the discretion to make real judgements. Zero-tolerance policies are an abdication of responsibility, not a solution.
Received a brilliantly clever piece of spam today: the message is hidden entirely in the whitespace between random characters. The text itself is harmless gibberish. Good luck filtering that one.
Fed up with comment spammers taking down my server. Disabling all MT comments until further notice and likely ditching MovableType entirely.
A grab-bag of links: Bush action figure, scary nuclear-isomer weapons, the Chewbacca defense, a serial killer vs. programmer quiz, and the Blaster worm, which hit me personally. At least the worm's source code had a funny message for Bill Gates.
Visiting Evil Dan in Edinburgh and his PC is drowning in adware and spyware. Use Spybot Search and Destroy to clean that crap up.
The US declared it doesn't need permission to act on security. The UN and NATO disbanded, citing irrelevance. Also, read the Borowitz Report. He's a self-satisfied dickhead, but worth it.
Bad week for Microsoft: XP is 11% slower than Win2K at best, and .NET Passport has already been cracked, leaking credit card numbers via malicious Hotmail emails. Avoid .NET and Microsoft products where possible.
Post-9/11, the Nimda virus feels trivial by comparison. Still, it's notable as the first virus you can catch just by viewing a webpage, exploiting an IE 5.5 security hole. Here's a demo and the CERT advisory if you want details.
The first DMCA arrest just happened: a guy exposed a flaw in Adobe's security and got arrested for it. Improve your security, don't criminalize people who point out weaknesses. If Microsoft follows Adobe's lead, I'm in serious trouble.
Got a data entry job after two weeks broke on vacation. MSIE is a security disaster, Netscape is garbage, Mozilla shows promise but crawls. The MSIE patch doesn't even fix it, meaning HTML emails can execute arbitrary code. I miss when email viruses were just hoaxes.
