Reselling stolen information

Haxdoor rootkit-equipped backdoors are widely used. The toolkit itself is sold on the Internet by its author. Now, people who use such backdoors quickly collect a lot of information from infected computers.

Read the rest HERE.

Will Linux die in 2018?

If we look at the future, Linux seems to be doomed to a slow death in a dozen years: DRM, proprietary hardware, technologic innovations and political choices are behind this forecast.

I really appreciate Linux, and Open Source in general: a common base, open and free, foster freedom of individuals and better distribute richness. In the last few months I took interest in Linux and Open Source in a long-term perspective. What I see in the future is terrible: Linux's death. It's just a forecast, I know: it's up to you, after reading this document, to decide if it is reliable or not.

Read the article HERE.

Google news

Google is turning into the evil empire

Okay so I was googling to find the citation for the famous Linda Evangelista quote "I don't get out of bed for less than $10,000" when my OEM installed XP MCE computer got an update from it's OEM installation of the Google toolbar...notice please how if I just blindly click "Ok" Google can and will easily change my default search engine to it?

Read the article HERE.
[The comments also make excellent reading]

==============================================
Why am I receiving someone else's email ?

You aren't really. If you receive a message that is addressed to a variation of your email address, it might seem like you are getting someone else's mail, but we promise you aren't.

Gmail doesn't recognize dots (.) as characters within usernames, so you can add and remove them, creating many email address variations.

For example, messages sent to GoogleAmy@gmail.com and Google.Amy@gmail.com are delivered to the same inbox.

For your protection, you can't log in to your account using a variation of your address - you'll need to enter the exact username you used to create your account. If you entered dots as part of your username when you signed up for Gmail, please enter them each time you log in to your account.

If you believe that a message was accidentally sent to you, you may want to contact the sender to inform him or her of an incorrect address.

Read the article HERE.

==============================================
New Google Reader

As of today, Google Reader has a new look — and even more important, a lot of new features that we think you'll like. So what's new? First, we've added some things you've been asking for, such as unread counts and "mark all as read." Folder-based navigation makes it easier to organize your subscriptions, and the new expanded view lets you quickly scan over several items at once. And we've made sharing much easier - with a single click of the "shared" icon, you can publish an interesting item on your public sharing page for your friends to see.

Read more at the Google Reader Blog HERE.

Internet Explorer - New Vulnerability

Another day - another exploit. A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by remote attackers to crash a vulnerable browser or potentially take complete control of an affected system. This flaw is due to a buffer overflow error when processing a "WebViewFolderIcon" object with a specially crafted "setSlice()" method, which could be exploited by attackers to cause a denial of service or execute arbitrary commands by convincing a user to visit a specially crafted Web page.

The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2. Other versions may also be affected.

Note : A fully functional exploit has been publicly released

Secunia - Extremely Critcal Rating
FRSIRT - Critical Rating
Demonstration

Original Advisory: H D Moore

==============================================
HD Moore Unplugged

HD Moore got his first real job in security research eight years ago, at the tender age of 17. He worked for the U.S. Department of Defense. Today, most everything Moore, 25, does is watched closely by the commercial world, especially by software companies like Microsoft. All of this activity has made him one of the most respected -- and sometimes criticized -- security researchers.

Read the article HERE.

MS antisphishing tool wins MS bakeoff

Microsoft sponsored a study comparing the effectiveness of antiphishing technologies and, surprise surprise, the company's IE 7 anti-phishing technology came out on top, according to a post on the IE Blog.

The study, which was conducted by 3Sharp, compared antiphishing toolbars from Microsoft, NetCraft, Google/Firefox, AOL, EarthLink, eBay, Geotrust, Netscape and McAfee. The study used a "standardized set of 100 known phishing Web site URLs and 500 known good URLs to see how well each anti-phishing technology flagged both phish and legitimate URLs."

Microsoft's Phishing Filter (MPF) in IE 7 Beta 3 received the highest "composite score" at 172, followed closely by NetCraft's toolbar with a composite score of 168. But when you dig into the numbers, another story emerges.

Read the article HERE.

'Shopadmins' And the ID Theft Cycle

The washingtonpost.com today published a story based on the 10 hours of lurking Brian Krebs did on a variety of underground chat and Web channels frequented by identity and credit card thieves. They then confirmed recent data breaches at four online merchants that were unaware that hackers had broken into their databases until we contacted them.

Read the article HERE.

Identity theft means cash in your pocket

Computer Associates has a new plan to win over customers to its security software—offer them a warranty. The company has partnered with Warranty Corporation of America (WaCA) to offer cash benefits if users of its software are victims of identity theft or virus infestations.

Read the article HERE.

Identified by your 'clickprint'?

Almost certainly - and if you're wondering what a clickprint is, it is "a unique pattern of web surfing behavior based on actions such as the number of pages viewed per session, the number of minutes spent on each page, the time or day of the week the page is visited, and so on." That's the description used by Professor Balaji Padmanabhan, at the Wharton School at the University of Pennsylvania, and Professor Catherine Yang, of the Graduate School of Management at the University of California, Davis.

Read the article HERE.

The Net's Real Security Problem

Forget "phishing" for bank account passwords. The deepest threats to online security are the weaknesses in the fundamental protocols that run the Internet.

Read the report HERE.

Firefox 2.0 RC 1

The first release candidate of Firefox 2.0 is now available for download. The Firefox 2.0 RC 1, while close to final release, is intended for power users and testers. Firefox 2.0's chrome is more polished. Buttons and tabs are a bit faded out until you mouse over them, and then they highlight and pop ever so subtly, just asking to be clicked. Not a huge new feature, but slick and pretty.

Read the article [with snapshots] HERE.

Outpost Firewall Pro 4.0 Released

This new version of the award-winning software provides home, small-office and mobile corporate users with powerful protection against spyware, keyloggers, Trojans, hackers, identity theft, rootkits, wireless network hijacking, and other Internet-borne attacks.

Read the press release HERE.

Ruxcon 2006

An underground community of Australia's "elite" will meet in Sydney for the fourth annual hacker conference. Just a note to remind all my fellow Australians that Ruxcon 2006 will be held this weekend - 30 September to 1 October at the University of Technology, Sydney. Doors will open at 8:30am and the first presentation commences at 9:30am.

More info HERE and HERE.

VaporStream to raise eyebrows

Key to Void's Web-based VaporStream service is the fact that at no time does the body of the message and the header information appear together, thus leaving no record of the interaction on any computer or server. The message cannot be forwarded, edited, printed or saved, and, once it's been read, it disappears; nothing is cached anywhere. No attachments allowed.

Read the article HERE.

Microsoft news

If it's Tuesday it must be "Patch day"

Microsoft has released an out-of-cycle Internet Explorer update to fix a critical—and widely exploited—vulnerability exploiting the Vector Markup Language, but there's a general feeling among security experts that the company is shutting the stable door after the horse has bolted.

Read more HERE.

==============================================
Microsoft admits WGA is a "failure"

According to our analysis, 42% of the people who experienced problems with WGA and reported those problems to Microsoft's public forums during that period were actually running Genuine Microsoft Windows. That's not just our opinion, either. Those statistics were reported by the Redmond-approved Microsoft Genuine Advantage Diagnostic utility.

Read the article HERE.

Browser security holes surging in 2006

The number of security holes in Web browser has jumped this year, according to Symantec. The security company's twice-yearly Internet Security Threat Report, found that 47 bugs in Firefox and 38 bugs in Internet Explorer had been discovered in the first six months of this year - up significantly from the 17 and 25 bugs found respectively in the previous six months.

Even Apple's Safari browser saw its bugs double, from six in the last half of 2005 to 12 in the first half of 2006. Opera was the only browser tracked by Symantec that saw the number of vulnerabilities decline, but not by much. Its bugs dropped from nine to seven during the period.

Read the article HERE.

Trend Micro Unveils InterCloud Security Service

Trend Micro Incorporated today announced its next milestone in content security innovation with the release of InterCloud Security Service, the industry’s most advanced solution for identifying botnet activity and offering customers the ability to quarantine and optionally clean bot-infected PCs.

InterCloud Security Service specifically addresses the mounting threat posed by botnets—networks of compromised machines that can be remotely controlled by an attacker. Threats associated with botnets include click-fraud, distributed denial-of-service attacks (DDoS), spam, identity theft via phishing and pharming techniques and other crimeware-related activity.

Read more HERE.

If Only We Knew Then

If only we knew then what we know now about windows XP. Windows XP is turning five years old, but will anybody want to celebrate the occasion? Microsoft's long-anticipated replacement for "Win 9x" -- the series of releases that began with Windows 95 and ended with Windows Millennium Edition --was never supposed to stick around this long. But half a decade after it began shipping on new computers (followed a month later by its retail debut), XP lingers.

You can think of Windows XP as a house with a second floor built of spackle, wood filler and duct tape. And even with all those updates, the operating system has met only a few of its goals while falling short of others in a catastrophic manner.

Read the article HERE.

SanDisk Cruzer Titanium 2GB Review

Speed. Reliability. Portability. Security. These are all things that should be present in a flash drive worthy of being called a mobile office. As the crème de la crème of SanDisk's offerings, the new Cruzer Titanium has a lot to live up to. Now that it's been armed with U3 and a casing developed by Liquid Metal, we see how this flash drive handles the pressure. Literally.

Read on for the full review.

==============================================
NTI Ninja FREE No Restrictions! No Expiration!

NTI Ninja is software that maximizes data protection by using a driver level encryption technology to create private and public partitions on USB storage devices. Ninja allows you to easily access and share commonly used data on the public partition, and also restrict and hide access to confidential data on the private partition simultaneously.

Visit the website HERE.

Survey Reveals eBay Phishing Problems

In a recent survey of readers, AuctionBytes.com discovered that 98% of respondents have received phishing emails purporting to be from eBay, and 14% have responded to them. These hoax attempts come in the form of emails purporting to be from eBay that try to trick recipients into revealing sensitive information, such as passwords.

Read article HERE.

New Vista build temporarily available

Microsoft has quietly released a build of Windows Vista that is more recent than Release Candidate 1 (build 5600), which debuted at the beginning of this month. The new build is numbered 5728, and comes with a number of caveats. The big caveat is this: the build is only available for a limited time, and will not be available via CD. Get it now if you want it, for it could be gone at any moment.

Read the entire article HERE.

Microsoft download instructions page is HERE.

There is also a 64 bit version available - This is a Direct Download Link

Windows Vista startup sound is now [finally] optional. Learn how to disable HERE.

Use your Beta 2/RC1 product keys with this installation

WEP Key Generator

Tool for generating keys to keep your network secure.
Supports HEX + ASCII, choose 64 to 256-bit keys.

Visit the website HERE.

So where does a Partner turn?

A registered Microsoft partner had an issue with his Action pack version of Windows XP... it said it was not valid and set off a WGA notification... and while I applaud Microsoft for their efforts in trying to clean out the scum of the world who rip off intellectual property, the current manner in which WGA issues get attended to is still very annoying.

Read the article HERE.

Encryption expert teaches security

It must say something about our times that Bruce Schneier, a geeky computer encryption expert turned all-purpose security guru, occasionally gets recognized in public. "My life is just plain surreal," he says.

Read the article HERE.

==============================================
Schneier on Security

And while we are on the subject of "Bruce", if you are a frequent flyer, here is a story on how to make sure the airlines never lose your luggage. As Bruce concludes - I have to admit that I am impressed with this solution.

Read more HERE.

Running as Limited User - the Easy Way

Malware has grown to epidemic proportions in the last few years. Despite applying layered security principles, including running antivirus, antispyware, and a firewall, even a careful user can fall victim to malware. Malware-infected downloads, drive-by exploits of Internet Explorer (IE) vulnerabilities, and a careless click on an Outlook attachment sent by a friend can render a system unusable and lead to several hours with the Windows setup CD and application installers.

Read more HERE.

CIA Level Computer Security

Everyone wants to be a badass. Whether you want to admit it or not, if you are a self respecting geek, you want to protect your sensitive information in a way so the CIA can't even read it. An interesting list of 10 progz - including some I already use. From the ordinary to the "Now you are getting to the if you are using this program, you either are insane or likely to die soon under mysterious circumstances" level.

View the list HERE.

Weekend Reading

Bots Bedevil Data Security Barriers

According to Dave Rand, chief technology officer for Internet content solutions at Trend Micro Inc. in Cupertino, Calif., malware writers compromised 250,000 PCs during a six-day siege on computers in Latin America earlier this month. Now those machines are “bots,” mindless devices controlled by criminals seeking to steal information. If you think it’s just a case of lousy security management among south-of-the-border Internet service providers, think again. Rand points to an ISP in France that has more than a half-million malware-laced bots on its network.

Read more HERE.

==================================================================
WiFi security - or lack thereof (Part 1)

I have recently written about the relative ease by which a wireless network can be penetrated if not properly protected. Tools such as Netstumbler, Airsnort, and others are some of the staples of the WiFi hacker. It is these very same tools that will be used to attack your WiFi networks. These tools can be used with varying degrees of success. The deciding factor of whether or not your network will be cracked largely depends on how up to date your defenses are. There is little point in defending your network with a flyswatter if your attacker is wielding a gun. You must stay up to date with technology for your medium, which will be discussed later on in this article.

Read the article HERE.

==================================================================
Secrets of the digital detectives

How fraud-detection systems combine dozens of clues to spot suspicious patterns in mountains of transactions. THE pleasure of reading a classic detective story comes from the way that the sleuth puts together several clues to arrive at a surprising conclusion. What is enjoyable is not so much finding out who the villain is, but hearing the detectives explain their reasoning. Today, not all detectives are human. At insurance companies, banks and telecoms firms, fraud-detection software is used to comb through millions of transactions, looking for patterns and spotting fraudulent activity far more quickly and accurately than any human could. But like human detectives, these software sleuths follow logical rules and combine disparate pieces of data — and there is something curiously fascinating about the way they work.

Read the entire article HERE.

==================================================================
All Vista versions to ship on single disk

Users will be able to upgrade between versions simply by purchasing a new product key.

Microsoft has confirmed that all versions of Vista will be shipped on a single DVD, in a feature called Windows Anytime Upgrade.

According to a spokesperson for the company, "The idea is to provide customers with the most convenient user experience possible by enabling them to more easily and directly upgrade to a higher edition of Windows Vista from within their current edition".

Users would only be installing the version of the operating system that they had purchased, as the product key would be version-specific. Versions range from Starter to Ultimate editions.

Asked if this system meant upgrades would be cheaper, as production and retail costs for Microsoft will be lowered, the spokesperson said they could not give any details of pricing at the moment.

The spokesperson also denied that Windows Anytime Upgrade would prove an attractive target for hackers, saying Vista was "the most secure version of Windows yet".

[ Haven't I heard that same statement before ? My money is on the other team ]

Source : ZDNet

ZERT Launches Emergency IE Patch

A high-profile group of computer security professionals scattered around the globe has created a third-party patch for the critical VML vulnerability as part of a broader effort to provide an emergency response system for zero-day malware attacks.

The group, known as ZERT (Zero Day Emergency Response Team), is now emerging from stealth mode with an unofficial patch that offers temporary respite from a spate of drive-by malware downloads aimed at users of Microsoft's Internet Explorer browser.

The patch, which was created and tested by a roster of reverse engineering gurus and virus research experts, is available from the ZERT Web site for Windows 2000 SP4, Windows XP (SP1 and SP2), Windows Server 2003 (SP1 and R2 inclusive).

Those of you that are sceptical about installing a non-Microsoft patch may like use a workaround to avoid this exploit. Instuctions on how this is done may also be found in the article.

Read more HERE.

IM Worm Cloaked In Virtual Card Hoax

There's an MSN network instant messenging infection currently on the prowl that has a little fun at the good guy's expense, and toys with the notion of making a Net urban legend come to life. How is this done? Well, it's fairly subtle and not everyone would appreciate the rather warped humour. Assuming someone on your contact list has been infected, you'll see a message similar to the below appear on your screen:

Have a look HERE.

Cracking DES - Full Transcription

Updated: 21 September 2006. Add Chapters 5, 6, 7, and 8. These chapters were formerly located outside the United States due to encryption export restrictions in 1998, and have been added because they are no longer available at those sites. This is now the full transcription of Cracking DES.

Read entire article HERE.

Mozilla Add-ons Feeds

If you're having trouble keeping up with the latest Firefox and Thunderbird extensions and plug-ins, then you have to bookmark the Mozilla Add-ons Feeds page. There are three lists of Extensions and Themes - Firefox, Thunderbird, and Mozilla - with each list separated into Most Popular, Recently Updated, Highest Rated, and Newest.

Visit the website HERE.

Security Of Your Bluetooth Devices

These days, all forms of communication technology face the problem of security and theft of personal details , and 'bluetooth' is no exception to these concerns, nor should it be. Most everybody knows by now that all email programs and networks need protection and security. What users of 'bluetooth' really do need to comprehend is that 'bluetooth' requires the same protection measures as email programs and other communication programs.

Read the entire article HERE.

So why do we change passwords?

So when you set that policy to change passwords... don't just set one for 60 days 'cause everyone else sets it like that.... think about what you are protecting, what mitigations you've done, why do you set the policy for the days you set it....and think about why you are changing them to protect the data behind them.

Read the entire article HERE.

IE7.com

Thinking of going to www.ie7.com to find information on the new IE7 Microsoft browser ? Well, all you will find is a very big logo of Firefox.

Have a look HERE.

Panda Internet Security receives certification

Panda Internet Security 2007, the new security suite from Panda Software aimed at home users, professionals and small businesses, has received certification in the Desktop/Server Anti-Virus Detection category from ICSA Labs for its detection of security threats in Windows XP., without returning false positives.

Read more HERE.

Steganos Released Steganos Safe 2007

Steganos has launched Steganos Safe 2007. New features in Steganos Safe 2007 include the ability to use picture sequences as passwords, support for Apple iPods to be used to store encrypted data or keys, and protection of data in Microsoft Outlook. The maximum size of each safe has been quadrupled to 256GB.

Read more HERE.

Hacktivismo Releases Torpark

Hacktivismo, an international group of computer security experts and human rights workers, just released Torpark, an anonymous, fully portable Web browser based on Mozilla Firefox. Torpark comes pre-configured, requires no installation, can run off a USB memory stick, and leaves no tracks behind in the browser or computer. Torpark is a highly modified variant of Portable Firefox, that uses the TOR (The Onion Router) network to anonymize the connection between the user and the website that is being visited.

Read more HERE.

Other sources for portable USB apps are Portable Apps and TrueCrypt .

More on zero day IE exploit

Based on our investigation, this exploit code could allow an attacker to execute arbitrary code on the user's system. Thus far the attacks appear targeted and very limited.

Just for fun, Sunbelt researcher Adam Thomas (who discovered the VML exploit yesterday) has cataloged what is installed with one installation he observed. Epic quantities of junk.

Microsoft has tested the following workaround. While this workaround will not correct the underlying vulnerability, it helps block known attack vectors. When a workaround reduces functionality, it is identified in the following section.

Read the article HERE.

Is Antivirus Ready for Open Source?

The open source software movement has come a long way. A decade ago, nobody but the actual participants in open source projects and other IT enthusiasts gave the movement much chance of succeeding, but today, it's tough to deny the success of open source products. However, when it comes to security tools and antivirus software--the thin blue line separating our computers from certain infection on the Internet--there is less agreement that open source can secure as well as traditionally developed, closed-source products.

Read the article HERE.

GreenBorder Pro Now Protects Firefox Users

GreenBorder Technologies today announced support for Firefox with a new release of GreenBorder Pro, the company’s unique Web security software. In June, Green Border released a consumer version of its enterprise-grade sandbox, but only supported Internet Explorer. Firefox users can now leverage GreenBorder Pro to protect themselves against exploits encountered online or hidden inside downloaded files.

Visit the website HERE.

Eight Security Sandboxes Reviewed and Rated HERE.

Users forum at Wilders Security HERE.

Newly Detected IE Exploit

Researchers at Sunbelt Software [screenshot dislpay here] discovered the exploit last week while conducting some routine online surveillance of known crimeware gangs. According to Sunbelt researcher Eric Sites, the exploits at the moment appear to be hosted mainly on hardcore porn sites. But if past experience with new IE exploits holds true, we may soon see this exploit being sewn into the fabric of legitimate, but poorly programmed, business Web sites that hackers can manipulate to their advantage.

Read the article HERE.

Code cracking is the new pot of gold

If you think the password protection on your MS Word file is keeping it safe from prying eyes, chances are you're wrong. The time it takes to crack password-protected Microsoft Office files has tumbled from a 25-day average to a matter of seconds, thanks to a decades-old code-cracking technique that until recently was not viable.

Read more HERE.

UltraVNC SingleClick

Need to connect two computers securely.

Read the article HERE.
[PS - also read the comments - lot of useful stuff there]

Securing your PC: free v paid

Some security is better than no security, said Bruce Schneier, a computer security expert with Counterpane Internet Security Inc. "I can complain about them (the free products), but going out free to millions and millions of users, you have to like that."

Read the entire article HERE.

MySpace

Analyzing 20,000 MySpace Passwords

In a day where browsers are coming out with anti-phishing tactics, I can’t believe how many people still fall for phishing. It’s all over the news, and most email clients display warnings. I still get those letters from Nigeria saying they need my help transferring millions of dollars out of the country. If nobody was falling for that they wouldn’t be doing that, I’m sure. So when I got an email from “Admin@MySpace.com” I kind of chuckled. It was the usual scam trying to get me to login to their fake MySpace login page.

Read the article HERE.

==============================================
MySpace Music Player Hacked

Here is a little program - MySpace MP3 Gopher - with which you can download any song from MySpace as an MP3 even if it is marked to disable downloading.

Visit the website HERE.

Top Five IM Security Risks for 2006

Instant messaging continues to be the fastest growing communications medium, with an estimated 390 million IM users by the end of 2006. Though widely adopted, IM is generally unprotected and unmonitored in environments, leaving it vulnerable to attacks and exploits.

Visit the website to download this white paper HERE.

Spam

The End of Spam

It has occurred to me from time to time that spam should not be so hard to beat. I am reminded again now, reading a news article about the sudden swell of pic spam that is so hard for filters to identify, that spam solutions all overlook the most common characteristic of spam. If that characteristic were used properly, it would seem to me that our fight against spam would take a leap forward that would make us wonder why we never took such a simple step before!

Read the article HERE.

==============================================
How to Build an Effective Mail Server Defense

When speaking of mail server-related security, one tends to limit the issue to message applied security measures, and even more to Antivirus and Antispam protection. This is however only one stage in the more complex process of securing your server. This article aims at identifying and explaining all security layers, highly important when choosing a certain mail server and consequently when configuring and using it.

Learn how to HERE.

==============================================
The Inner Working of a Bayesian Spam Filter

The Bayesian Theory, when applied to spam mail, is a very effective method of detecting which emails are legitimate or not. Bayesian filters calculate the probability of a message being spam according to its content. The more emails it sees, the more effective it gets. At first, the filter will not be perfect, but if you provide it with hundreds of emails to analyze, it should eventually achieve approximately 99.5% of efficiency.

Read more HERE.

Security in the World of Web 2.0

In its most basic sense, Web 2.0 refers to any tool or application that's delivered over the Internet and allows people to interact—by contributing, editing and sharing content. Any time there is a new advancement in technology, there is a new set of security problems. Hackers are still learning, but the ability to post malicious tools is easier.

Read the article HERE.

Weekend Reading

What is a Hacker?

A hacker is someone who thinks outside the box. It's someone who discards conventional wisdom, and does something else instead. It's someone who looks at the edge and wonders what's beyond. It's someone who sees a set of rules and wonders what happens if you don't follow them. A hacker is someone who experiments with the limitations of systems for intellectual curiosity.

Read the entire article HERE.

===============================================================
Computer defenders win elite hacker contest

In their cyber circle of friends, Jordan Wiens and John Sawyer are 31337 H4X0RZ.

It means "elite hackers" in a coded language of numbers and letters used by many computer enthusiasts. The two University of Florida computer security engineers earned the distinction in Las Vegas over the summer by helping their team win the prestigious "Capture the Flag" competition held in conjunction with Defcon 2006, the world's largest hacker conference.

Read the entire article HERE.

===============================================================
The Three Letters

A man takes a new job in an IT shop and finds three letters in his desk from the former head of the department. Each letter is only to be opened in an emergency.

Read this [old] very funny short story HERE.

===============================================================
The programs that slow down Windows

The PC Spy web site ran several tests to determine which applications, when installed on your Windows computer, are doing the most to slow down your system. Each new application was installed on a totally fresh machine, and the tests were repeated 3 times each.

The results? Read the article HERE.

Are we seeing a trend here ?

Patch Tuesday now seems to be followed by Attack Thursday on a regular basis. Attackers are aware of the Microsoft schedule and now lay in wait. The new exploits they release will have 30 days of freedom to do their dirty work - if Microsoft issues a patch for the exploit that works. [ This months updates contained the third version of an IE fix - the first two were useless ]

Those of us using Opera or Firefox are, of course, not interested in this post.

============================================================
Microsoft IE6 Security Advisory

Microsoft is investigating new public reports of vulnerability in Microsoft Internet Explorer on Windows 2000 Service Pack 4, on Windows XP Service Pack 1, and on Windows XP Service Pack 2.

Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors.

The Microsoft Security Advisory may be read HERE.
Then scroll down to General Information ---> Suggested Actions ---> Workarounds

Foxit PDF

In the past, you have to download a huge 85Mb Adobe Acrobat Reader, go through a lengthy installation process and wait for an annoying splash window to disappear just to open a PDF document. Moreover, if you want to annotate a PDF document, you have to pay USD299 to buy Adobe Acrobat Standard.

Foxit Reader 2.0 is a free PDF document viewer and printer, with incredible small size [only 3.7 Mb], breezing-fast launch speed and amazingly rich feature set. Foxit Reader 2.0 supports Windows 95/98/Me/2000/XP/2003. Its core function is compatible with PDF Standard 1.6.

Version 2.0 introduces many exciting new features, including interactive form filler, multi-language UI support, on-demand download of add-on, self upgrade, Javascript support, improved printing speed, streamlined UI and much more.

Visit the website and download HERE.

====================================
Hacker Discovers Adobe PDF Back Doors

A British security researcher has figured out a way to manipulate legitimate features in Adobe PDF files to open back doors for computer attacks.

Read more HERE.

====================================
Backdooring PDF Files

This article will give two practical examples of how Adobe Professional and Adobe Reader can be backdoored. There are 7 or more points where an attacker can launch malicious code. Both of the attacks discussed below are attached to the “Page Open” event.

Read the article HERE.

Is RSS secure?

During the last year or so, many people have been asking an important question. Is RSS secure? It's vital that this question be answered in the next few months — before Microsoft releases its Internet Explorer 7 browser, which makes it much easier for novices to subscribe to RSS feeds, and before it releases Vista, which has RSS support built in. Both of these releases will have malware purveyors looking for ways to exploit the products' RSS integration.

Read the article HERE.

Router user names and passwords

For those bad days when the memory is blank, you have lost the manual, or are just helping a friend, here is a list of default usernames and passwords for hundreds of routers.

View the very long list HERE.

Attack code targets new IE hole

Computer code that could be used to hijack Windows PCs via a yet-to-be-patched Internet Explorer flaw has been posted on the Net, experts have warned.

The code was published on public Web sites, where it is accessible to miscreants who might use it to craft attacks on vulnerable Windows computers. Microsoft is investigating the issue, the company representative said in a statement on Thursday in the US.

Read the article HERE.

Phising Exploit in ‘Google Public Search Service’

Yesterday I mentioned that I had discovered an exploit in a little known service from a major web company. It turns out that that exploit is in a little known service called ‘Google Public Service Search’. This service is meant for universities or other non-profit organizations to add a ‘Google’ search to their website. It differs from the other free Google site search in that it allows you to customize the header and footer of the search results page. It’s interesting to note that the code for your header and footer is actually hosted by Google, on their server.

Read the entire article HERE.

Unfreeze The Deep Freeze

Deep Freeze use a unique method of disk protection to preserve the exact original standard system configuration on over five million Windows and Macintosh computers worldwide!

According to the Faronics(Developers of Deep Freeze): "Deep Freeze instantly protects and preserves baseline computer configurations. No matter what changes a user makes to a workstation, simply restart to eradicate all changes and reset the computer to its original state - right down to the last byte."

Step by Step tutorial to bypass the Deep Freeze security HERE.

New spammers trick to harvest email addresses

Experts at SophosLabs have warned computer users to think before forwarding chain letters after discovering a new scam being used by spammers to collect email addresses.

Read the entire article HERE.

Searching the web

Protecting Your Online Search Privacy

Google, MSN Search, Yahoo!, AOL, and most other search engines collect and store records of your search queries. If these records are revealed to others, they can be embarrassing or even cause great harm. Would you want strangers to see searches that reference your online reading habits, medical history, finances, sexual orientation, or political affiliation?

Recent events highlight the danger that search logs pose. In August 2006, AOL published 650,000 users’ search histories on its website. Though each user’s logs were only associated with a random ID number, several users’ identities were readily discovered based on their search queries. For instance, the New York Times connected the logs of user No. 4417749 with 62 year-old Thelma Arnold. These records exposed, as she put it, her “whole personal life.”

Read this excellent article HERE.

==================================================================
Essential Yahoo Search Shortcuts

Do you use Yahoo's Open Search Shortcuts? If not then you should check into it. This is one of the handiest hacks on the Web and I bet a lot of people don't tap into it. Using Yahoo Open Search Shortcuts (OSS) you can turn Yahoo into the ultimate "one box" search tool. You won't need to go anywhere else to search your favorite sites - even Google or MSN Search. Using OSS any Yahoo search box - even one built into your browser - can become a tool that lets you directly query other sites.

Learn more HERE.

==================================================================
Introducing GahooYoogle

For all those who find Yahoo and Google search engines tedious and time-consuming, a new website known as GahooYoogle has come up with a solution. This website combines the search engines of Yahoo and Google on one screen. Using a split screen to display the search results of both the engines, this website is proving to be convenient for many net surfers.

Visit the website HERE.

Digging for Rootkits

In this TestRun podcast, eWEEK Labs Senior Writer Anne Chen talks to eWEEK Labs Technical Analyst Andrew Garcia about his review of Webroot's Spy Sweeper Enterprise 3.0, the first enterprise anti-spyware product Andrew has tested that detects and removes rootkits.

Click here to download this [mp3] podcast.

Free Google GMail : The high price you pay

Do you believe the contents of every personal and business email you ever write or send should be recorded and permanently archived on third party servers located in countries throughout the world, to which you have no access? If you are one of the millions of GMail users, you have indicated to Google that you most certainly do.

Read more at ZDNet HERE.

Response [ also from ZDNet ] HERE.

When relationships end - so does security

When personal relationships go bad, a boyfriend, girlfriend, spouse or other significant other may access their partner's email for a variety of reasons: curiosity, suspicion, evidence-gathering, and revenge are just a few. The person doing the accessing is in an ideal position to either know the email password outright – having been told it or having seen it being typed – or to guess it using intimate knowledge gained during the relationship.

Read the entire article HERE.

PandaLabs detects a new spam technique

PandaLabs has detected a spam message that uses subliminal advertising techniques. At first glance, it is an advertisement that gives the user the opportunity to but certain stocks online. However, the user not only sees a static image, but also a sequence of images that are displayed extremely rapidly. To be more specific, there are four images, three of which show the word Buy in different positions.

Read the article HERE.

Managing cookies in Firefox

Using the Firefox ‘Clear Private Data tool’, I set my privacy settings on my Firefox to clear the following when closing - browsing history, saved form information, download history, cache and authenticated sessions.

Trouble is, when I needed to log into Gmail, maintain my Google search preferences, my Blogger login – you name it, I had to re-submit my credentials each time. But here is the way to do it without installing any add-ins or extensions.

Learn how to HERE.

AdAware issuing False Positives

Users of AdAware Personal spyware are having problems with False Positives. The 09/08/06 update v268.12.2/442 seems to be generating false positive virus warnings for both the AdAware and Spybot programs, reporting that they are infected with Backdoor.Netbus.

Nobody at this stage knows the answer to the problem. The suggestion for the time being is to wait before you remove anything permanently. Just ignore them for now until Lavasoft Research has had a chance to look, and then issue a corrected update.

See examples of false positives and discussion of problem at forum HERE.

Apple and Microsoft Release Software Patches

Apple and Microsoft today released updates to fix security problems in their software, including a patch bundle for the popular QuickTime [if you have iTunes, you have Quicktime] media player, as well as fixes for computers running Windows and Microsoft Office.

Microsoft also re-released two patches that it issued in August, including the Internet Explorer update that caused problems for some people running IE on Windows 2000 and Windows XP systems that do not have Service Pack 2 installed.

Read more from Brian Krebs at Security Fix HERE
or at eWeek which has an excellent article this month.

Forensic toolkit harvests PDA data

A new breed of forensic tools, designed with the help of Whangarei-based Thackray Forensics, can now access and clone the full contents of a mobile phone or PDA within seconds. Managing director John Thackray is one of a handful of qualified instructors in the use of the .XRY toolkit worldwide and is the only qualified instructor in the Southern Hemisphere.

Read more HERE.

Wi-Fi gives kids access to unchaperoned Net

Wireless cities may be the new Wild West for parents who want to control their kids' Internet access. An increasingly wide range of mobile devices are giving the kids who use them entry points to wireless broadband outside of the home and parental control.

Read the article HERE.

Toshiba develops Hybrid DVD and HD-DVD

I have included this article because a lot of people back up their data to a removable disc. The current format war [HD DVD v Blu-ray] is confusing most consumers, but this new product could be lifeline to most people. Regardless of how you do it, keep backing up your data - one day you will be very glad you did.

Toshiba, in collaboration with disk manufacturer Memory Tech Japan, has successfully combined a HD-DVD and DVD to a single 3-layer, twin-format disk. The resulting disk conforms to DVD standards so it can be played on DVD players, and also on HD-DVD players after upgrading the firmware. The disk can have either Single Layer DVD (4.7GB) + Dual Layer HD DVD (30GB); or Dual Layer DVD (8.5GB) + Single Layer HD DVD (15GB). There will not be a long wait as the new disk can be produced on the existing HD-DVD mass production line with minor process additions. With identical manufacturing process Toshiba plans the new 3 layer discs in the market very soon. However no exact release date and pricing is provided.

Source : Newlaunches.com

Off-Site Backup for Home Users

A few musings about off-site backup for home users and the usefulness of TrueCrypt. Off-site backup hasn't been an issue for many home users. Perhaps this is because most people haven't assembled enough critical digital data to justify the effort of implementing off-site backup.

They haven't even set up an on-site backup scheme.

For the longest time my off-site backup scheme involved burning by data into DVDs once in a while, and taking the disks to a friend's house. This scheme wasn't effective because:

Read more HERE.

Software releases

Outpost Firewall PRO 4.0 Release Candidate

Outpost Firewall Pro 4.0 Release Candidate is available for public download and testing. This version delivers proactive security functionality that blocks all currently-known techniques for bypassing security protection (leak tests), so it fully prevents sensitive data leakage from individual PCs.

Its new spyware signature analyzer provides even more accurate spyware detection to increase users' protection against all known and even unknown malware.

Outpost Firewall Pro 4.0 uses a new, ultra powerful Secure Hash Algorithm (SHA) 256 verification routine to identify applications while automatically creating network access rules through ImproveNet.

Read the press release HERE.

==================================================================
GRISOFT Launches Beta Program

GRISOFT, the supplier of AVG security software, announced the availability of a public beta version of AVG Internet Security 7.5, its new comprehensive anti-malware security suite. In addition to the new security suite, public beta versions for entire AVG 7.5 computer security portfolio are available, including new products, as well as updated versions with significant improvements.

Read the press release HERE.

Portscan your computer for security holes

If you're smart and you're connected to the net, you're concerned about computer security. Open ports on your computers are invitations to criminal hackers and other evildoers to wreak havoc - and if you don't protect yourself, no one else will.

Read more HERE.

CryptoDox

This wiki-based website, set up on 21-Dec-2005, aims at developing a free encyclopedia on cryptography and information security. It provides a database of articles on cryptography and information security.

Read more HERE.

Crackdown on TOR-node operators

The public prosecutor's office of Konstanz raided computing centres of seven providers in Germany, seizing ten servers because of the proliferation of child pornography. Nothing new, things like that happen all the time, the juicy detail is that some of the servers were merely running a copy of the TOR, a software to anonymize the usage of the internet to protect your privacy.

Those servers were most probably configured to be TOR Exit-Nodes, so their IP-addresses might have shown up in the server logfiles of the child-porn servers in question. One could argue that this is an attempt to frigthen german TOR-node operators, but I’d just keep calm for the moment. I guess that the attorney of state is just after logfiles, they knew that those servers were operating as TOR-nodes. If you IP-address pops up in a child-porn case surely your IP looks interesting to the police.

Read more HERE.

What is Information Assurance?

When someone talks about computer security, what do you think of? For many people computer security is all about programs that are running on your computer to prevent bad things from happening. What many people do not realize is that security is about processes not programs. A computer application is only as good as the person who wrote the program, the person who maintains the program or the person who implemented the program. The term information assurance is the same as computer security, it is a matter of preference.

Read the article HERE.

Secure [Stealth] File Transfer

If you ever need to transmit some confidential information from your place of work, use the steps below to encrypt your data and send it stealthily to yourself.

Read the article HERE.

Avast! Antivirus For Windows Vista RC1

Avast! Antivirus now has a FREE [beta] version available for download that is Vista RC1 compatible. Visit the forum, read the posts, but it seems to be standing up well. The download links are also there.

Visit the website HERE.

AIM Encrypt - Free Security Certificate for AIM

Have you been wondering what those locks next to peoples screen names are? That means they have an encryption certificate, you can obtain one for free by following the tutorial.

Visit the website HERE.

Money Bots: Hackers Cash In on Hijacked PCs

Botnet hunters tracking the latest MS06-040 worm attack estimate that one malicious hacker earned about $430 in a single day by installing spyware programs on thousands of commandeered Windows machines.

Security researchers are the German Honeynet Project discovered a direct link between the botnet-building attack and DollarRevenue, a company that pays between a penny and 30 cents per installation of its heavily criticized ad-serving software.

Read the article HERE.

Weekend Reads

Session Hijacking Explained

'Session Hijacking' is a high level attack vector which many systems are completely open to. Most systems are vulnerable to this type of attack as most systems use Transmission Control Protocol (TCP), the standard communication protocol used on the Internet and internal Local Area Networks (LANs). This paper assumes a level of network competency by the reader to being equivalent to that of a network engineer or experienced administrator.

Visit the website HERE.

==================================================================
[IN]SECURE Magazine

Issue 8 - September 2006 is now online with 10 interesting topics.

Read the magazine HERE.
Warning : This 84 page document is 6Mb in size

==================================================================
Norton AntiVirus detects itself!

I don't know if this is for real or not. But I don't care.
I hate this programme with a passion.
A resource hog that barely delivers on its promises.
This is definately the funniest thing I've seen for some time.

Take a look HERE.

==================================================================
MSN Hacking part 4

Part of the continuing series on using MSN as a hacking tool. This morning boingboing put out a note on their web site about searching for the phrase confidential "do not distribute" which was highly amusing, so decided to try it in MSN. The search string [ link ] returned around 15,000 results or a lot less than the 68,000 results from Google, but amusing none the same.

Looking up private or confidential information in the web search engines is today's lessons. This is purely an academic exercise and should be used to determine if you have any private or confidential information in the search engines.

Read the article HERE.

==================================================================
Banking Trojan Captures User's Screen in Video Clip

"Keylogger" trojans are hidden programs that collect and store the keys pressed by the user to forward them to a third party. This way, the attacker receives a file containing the information the affected user has written (passwords, messages, etc.).

Many banking institutions have introduced the so-called "virtual keyboard", in an attempt to mitigate the activity of this type of trojans. It is an on-screen graphical representation of a keyboard, that the user can use to enter his data by pressing the virtual keys with his mouse instead of using his traditional keyboard.

Read more HERE.

ICQ Heap Overflow Exploit

Core Security released two ICQ related advisories today. One for ICQ tool bar for IE and another for AOL's ICQ client. Since Core Security states they used a fuzzier to discover these issues I suspect there will be other ICQ vulnerabilities discovered and announced by them in the future.

A vulnerability in AOL’s ICQ Pro 2003b instant messenger client could lead to denial of service attacks and remote compromise of systems running vulnerable versions of the client.

The AOL/Mirabilis ICQ client is a popular Instant Messaging (IM) program that enables users to communicate through instant messaging, chat, e-mail, SMS and wireless-pager messages as well as transferring files and URLs, among other features.

Read more HERE.

Just how buggy is Firefox?

Security researchers that carried out a code analysis of popular open source browser Firefox using automated tools, have discovered scores of potential defects and security vulnerabilities despite coming to the conclusion that the software was generally well written.

Several versions of the software were put through their paces by Adam Harrsion of Klocwork using Klocwork's K7 analysis tool. The analysis, which culminated in an examination of Firefox version 1.5.0.6 unearthed 611 defects and 71 potential security bugs.

Read more HERE.

It's "Microsoft Tuesday" next week

Microsoft Security Bulletin Advance Notification

On 12 September 2006 Microsoft is planning to release Security Updates. Two of the updates address security flaws in Windows, the highest severity rating for these is important. The third patch deals with Office, the highest severity rating for these is Critical.

Microsoft also advised that it expects to issue several non-security "high-priority" updates, but it did not supply any information on what those updates might be. Microsoft will host a webcast next week to address customer questions on these bulletins. For more information on this webcast or the security updates please see below:

View the details HERE.

==================================================================
How fast does Windows Update update?

Readers have asked me, "How quickly is my computer protected after Patch Tuesday, if I have auto-updates turned on?"

The question arises because most of the patches that Microsoft posted on Aug. 8 took a lot longer than usual to download. It appears that Windows Update, when configured to download and install patches automatically, didn't start downloading most patches until three days after Patch Tuesday. Some PCs didn't auto-install all of the security patches until nine days had passed.

Read the article HERE.

==================================================================
Third-party patching: Prudent or perilous?

Third-party patching, a hot topic in recent months given the increased prevalence of zero-day flaws, was among the issues dissected at the recent Black Hat USA 2006 conference in Las Vegas.

In one presentation, Alexander Sotirov, a reverse engineer on the security research team at Redwood City, Calif.-based vulnerability protection firm Determina Inc., said third-party patching provides another security option for IT shops that need to block exploits before an official patch is developed, and that those patches are easy to uninstall after an official patch is released.

Read the article HERE.

Windows Vista RC 1 - in screenshots

Release candidate software is a final product with most bugs resolved, so when Microsoft offered the Windows Vista RC 1 for download yesterday, I hopped right on it like a kid on a bus to Disneyland. The Vista Beta was a neat preview of what's to come from Redmond, so I expected a lot from Vista RC1, and I wasn't disappointed.

View the new Vista HERE.

Samsung website hosts password stealing trojan

Samsung's US Web site is hosting a Trojan horse that logs keystrokes, disables antivirus applications and steals online banking access codes, according to Internet security firm Websense.

According to an advisory published by Websense, "The server appears to have been compromised and has been hosting a variety of files for some time. The most current code, which is still available for download, is a Trojan Horse that attempts to disable antivirus programs, modify registry keys, download additional files, and log keystrokes when connecting to banking Web sites."

Read the article HERE.

Microsofts Quickest Ever Patch

If you really want to see Microsoft scramble to patch a hole in its software, don't look to vulnerabilities that impact countless Internet Explorer users or give intruders control of thousands of Windows machines. Just crack Redmond's DRM.

So Microsoft wasted no time; it issued a patch three days after learning about the hack. There's no month-long wait for copyright holders who rely on Microsoft's DRM.

This clearly demonstrates that economics is a much more powerful motivator than security.

Read the article HERE.

Protecting against EFS based attacks

The trojan creates an administrator login account with a random name and random password. Using this login key pair it then encrypts the downloader component that it drops. It then creates a random service that points to the encrypted file with logon properties of the newly created login and password. This service can be arbitrarily started. The encrypted file is executed with the logon credentials that the trojan created, to download the updated variants of spy-agent.bf. Some variants of this trojan also drops a Browser Helper Object, a DLL file in alternate data streams. The DLL file is obfuscated as well and tries to download updated copies of Spy-Agent.bf trojan.

Read the article HERE.

Zombies crawl over wiki exploits

Hackers are exploiting vulnerabilities in wiki software packages to establish networks of compromised computers. Software bugs in Pmwiki and Tikiwiki software applications are being actively used to create botnets, the SANS Institute's Internet Storm Centre reports.

Read more HERE.

Scan Those Links Before Visiting

In an era when simply clicking on a link sent to you via e-mail or instant message can spell speedy doom for Microsoft Windows users, it's nice to have yet another resource for checking the validity and security of Web links.

Visit the website HERE.

Could virus writers start to target hardware?

On August 25th, security firm Symantec engineers announced they had discovered a virus that leveraged a flaw in the AMD64 CPU. This virus, Any patch applied to fix a hardware fault could be disabled or circumventedcalled W32/W64.Bounds, was capable of binding itself to Windows executables in such a way that made it hard to detect. However, it's now been shown that this virus doesn't have anything to do with in AMD CPUs, but instead with the X86-64 instruction set itself.

Read the article HERE.

Microsoft - Security - OUCH!!

As many who know me are aware that I am a strong advocate of running as a non-administrator privilege user. This means, no “good” application should be writing to the system areas like “Program Files”. Well, I have a retail copy of SBA 2006 [ Microsoft Office Small Business Accounting 2006 ] right here next to me and it proudly displays that logo. But, something that really bothered me about SBA is that it stores all of the letters and document templates in the Program Files folder. OUCH!! So much for Microsoft following its own certification program.

Read the article HERE.

Email Headers

Emailheaders.org has a free tool to assist users in determining the origin of e-mails received. The IP Address Extractor will extract all IP Addresses from a full set of header information. Simply copy the full header information, paste it into the box and hit submit.

Visit the website HERE.

==================================================================
Spam origin Locator Tool

This spammer's origin locator service is provided for FREE by Geobytes, inc to assist you in locating the geographical location that an email originated from. (You can also use it to determine the geographic location of senders of legitimate email as well.)

Visit the website HERE.

USB Switchblade

In this segment we'll overview a few of Microsoft Window's security weaknesses and show how to build a custom USB key that will retrieve vital information from a target computer, necessary for auditing password strength. A major flaw in the way Windows stores password information is the use of the legacy LM, or LAN Manager hash.

Read the article HERE.

Sleuth Kit now has Windows binaries

If you don't know, Sleuth Kit is an excellent set of OSS computer forensic tools to help you investigate data on harddisks. My favorite tool is mactime, which lets you build a timeline of access to a file, helping to determine just what an attacker did on the system. If you can't afford EnCase, Sleuth Kit is a powerful set of tools you might find useful. Check it out.

Visit the website HERE.

Source : Dana Epp

myFairTunes6

Open source program myFairTunes6 is designed to remove the digital rights management (DRM) from your iTunes Music Store-purchased songs. Personally, when DRM limits me beyond a certain point, I'm all for stripping - unfortunately the Man might not agree with me.

Read more HERE.

Computer steals passwords and credit details

About three weeks ago, Cheryl Lambert bought a £179 surfboard on eBay for her daughter. Soon after, she noticed her computer started to behave erratically and within a few days it had ground to a halt.

A few days after her desktop machine was unplugged from the internet, Lambert’s personal details appeared on a Russian website.

Her home phone number, her address, her credit card number and her e-mail address with Tesco were all listed on a forum where criminals and computer hackers trade stolen identities.

Read the article HERE.

"Wide open" means extra security

There’s a reason nearly every security appliance vendor uses open source tools, and it has little to do with licensing. The vast majority of these devices -- ranging from spam and spyware filters to network scanners to intrusion detection and prevention systems -- are not only built on an open source platform such as Linux or FreeBSD, but they also actively use other open source products to accomplish their given tasks.

Read the article HERE.

Hacking 101

Cracked! Part 1: Denial and Truth

A seven part series about defending networks, tracking down a cracker and rebuilding networks from scratch. An enjoyable read for anyone that is interested in computer and network security.

Read the articles HERE.

The Hack FAQ

This FAQ is intended to explain and show the theory and practice behind hacking. While it serves both administrator and hacker alike, the perspective is from the intruder.

Visit the website HERE.

It's all about spam

The black art of spamming

McAfee publish a list of the top 10 spam subject lines, because of the work done by their threat research and filtering labs as well as customer feedback, and the latest for July shows how the spammer is now concentrating more on ID theft and less on helping you achieve sexual satisfaction or financial security. Certainly comparing the current subject lines with those from other surveys that have crossed my path over the years makes for interesting reading, in a spam threat evolving without end kind of a way.

Read the article HERE.

==================================================================
The worst spam flood I have seen in a long time...

This must be THE WORST spam flood I've seen in a long time, even worse than the Swiss Jobs spam, and who would have thought *that* would be possible. Each spam dump comes from a different IP address. Here's hoping not too many people get ripped off.

Read the article HERE.

==================================================================
URL Obfuscation

A very good explanation on how spammers and other junk head will hide real urls. If you know anything about the internets, you probably know what is an IP address, and what it is used for. If you don’t, I’m not gonna tell you - you will need to google it for yourself. But, not everyone knows that browsers will try to resolve IP addresses, even if they are not typed in the traditional dotted decimal notation.

Read the article HERE.

This Email Will Self-Destruct

People who want to open email from patent attorney Andrew Currier have to know the drill. First, they must answer a predetermined question, such as "Where did we first meet?" If they answer correctly, they will then be allowed to view the contents of the email -- but they can't alter it or forward it to anyone else.

Concerned about privacy, the Toronto-based lawyer has begun using a new service that encrypts his emails and tries to keep unintended recipients from reading the contents.

Read the article HERE.

Port Forwarding Guide

PortForward.com offers help setting up port forwarding on your router or firewall. Many Internet users are not aware of how to configure their router or firewall in order to use applications like Peer-to-Peer file sharing (PtoP), Internet Games, Web serving, FTP serving, WebCams, IRC DDC, and Instant Messaging such as AIM, ICQ, Yahoo and MS Messenger. These how to guides make it easy to setup your router or firewall for any application you may need.

Read the guide HERE.

Experts warn of devious phishing attacks

Phishing attacks will use more sophisticated social engineering, targeting consumers for financial and identity theft and businesses for intellectual property theft. The days of crude phishing emails which consumers have learned to spot are coming to a close, warns the report. You will be sent an email personally addressed to you from your bank with your correct address and postcode.

Read the article HERE.

Browzar is fake and full of adware

Social news rave about Browzar - they claim it a new secure browser leaving no footprints. After looking at it closer, I found out that it’s not a browser at all, and moreover, this software thrusts search via it’s own PPC-SE full of ads on user.

Read the article HERE.