Free Republic

9/11: Stories of Courage, Heroism and Generosity We are pleased to announce 9/11: Stories of Courage, Heroism and Generosity with an introduction from Tim Zagat, Co-founder and CEO of Zagat Survey, along with contributions from former New York City Mayor Rudy Giuliani and former New York Governor George Pataki. Upon reflection of the 9/11 attacks, the random acts of kindness displayed by selfless individuals are too often overlooked. As the 10-year anniversary of this fateful day approaches, Zagat honors these heroes for their contributions to rebuilding and uniting a country in the wake of destruction. Order Now: Regular Price: $24.95...

"Here You Have" Virus Email spreading. DHS US-CERT Computer Emergency Readiness Team looking into issue. will issue bulletin.

The upcoming Black Hat security conference in Las Vegas offers an annual parade of security researchers revealing new ways to break various elements of the Internet. But few of the talks have titles quite as alarming as one on this year's schedule: "How to Hack Millions of Routers."Craig Heffner, a researcher with Maryland-based security consultancy Seismic, plans to release a software tool at the conference later this month that he says could be used on about half the existing models of home routers, including most Linksys, Dell, and Verizon Fios or DSL versions. Users who connect to the Internet through...

Malware-infected USB key the culprit. Delegates to AusCERT, Australia's premier information security event held this week on the Gold Coast, have taken home a little of the stuff they spent the week agonising over - a virus. In an email this afternoon, IBM advised visitors to its AusCERT booth that its complimentary USB key was infected with a virus. An IBM spokesman and conference organisers confirmed the email was genuine. It is the second time in two years that clumsy exhibitors have infected their customers with viruses. "At the AusCERT conference this week, you may have collected a complimentary USB...

The co-founder of progressive blog The Huffington Post, Arianna Huffington, has attributed the West Virginia mining disaster, along with virtually every other accident under the sun, as a direct result of small-government and corporate greed in the April 13 Huffpo column "The West Virginia Mining Disaster and the Financial Crisis Have the Same Root Cause." "Officials say it's too soon to pinpoint the exact cause of the tragic explosion at the Upper Big Branch mine in West Virginia that took the lives of 29 miners, but we certainly know enough to identify the root cause," Huffington began. "It's the same...

Democratic Socialists of America (DSA) is an highly influential organization. While only 6,000 strong, DSA has considerable strength in the labor movement, non profits, education and inside the Democratic Party. While Marxist based, DSA’s innocuous sounding name, allows the organization to operate in ways and places that their allies in the the Communist Party USA cannot. After using its clout to push through “healthcare reform” DSA is now using its influence in the giant union SEIU, to promote “immigration reform”.

Say, Charles -- it's been awhile! But we're pleased as punch to see that you're back to your old ways, poking around within OS X's mainframe just looking for ways to remotely control the system, snag credit card data and download a few interoffice love letters that are carefully stashed 15 folders down within 'Documents.' The famed Apple security expert is planning yet another slam on OS X at CanSecWest, where he'll reveal no fewer than 20 zero day security holes within OS X. According to Miller, "OS X has a large attack surface consisting of open source components, closed...

The Holocaust only gets media coverage because of affluent Jews' financial backing, military might and lobbying fronts, presenting a skewed version of events to the world, a high-ranking Polish bishop told a Catholic news portal on Monday. Tadeusz Pieronek, a Polish bishop and professor and a friend of the last pope, John Paul II, claimed that "the Holocaust as such is a Jewish invention" promoted in the press by Jews to gain support for Israel. Pieronek told the Web site Pontifex.roma that while the Holocaust was not exclusively Jewish, Jews had monopolized it in lieu of encouraging "serious historical debate,...

Security researchers yesterday said they'd discredited Microsoft's claim that the year's first critical Windows vulnerability would be "difficult and unlikely" to be exploited by attackers. On Tuesday, Immunity Inc. updated a working exploit for the TCP/IP flaw spelled out Jan. 8 in Microsoft's MS08-001 security bulletin, and posted a Flash demonstration of the attack on its Web site. The exploit, which was released to customers of its CANVAS penetration testing software -- but is not available to the public -- was a revised version of code first issued two weeks ago. "This demonstrates conclusively that the MS08-001 IGMPv3 vulnerability is...

Fourteen-year-old Cara and her 15-year-old cousin, Stacy (not their real names) walked out of their homes in Toledo, Ohio on a rainy May day in 2005 to get milkshakes. A few blocks away, a couple driving a Lincoln Continental pulled alongside the cousins and asked if they wanted a lift. Believing the man’s claim to be a schoolmate’s father, the girls stepped into the car — and entered a nightmare world of sexual slavery. The couple drove the girls to a house and locked them in. As their families frantically searched for them, the teens were sold over and over...

E-mails containing malicious PDF files have been putting computers at risk since Friday, Finnish security software firm F-Secure said on Saturday. "The e-mails sent in bulk looked like credit card statements, and contained an attachment called 'report.pdf'," its Chief Research Officer Mikko Hypponen said in a statement. When such PDF files are viewed on vulnerable machines, they start downloading software from servers in Malaysia or Sweden, which are now being cleaned, he said. "There will be more such attacks." "We are worried about this case, as PDF attachments are typically not filtered at e-mail gateways." A security update for Adobe...

There is a major zero day bug announced in solaris 10 and 11 with the telnet and login combination. It has been verified. In my opinion NOBODY be should running telnet open to the internet. Versions of Solaris 9 and lower do not appear to have this vulnerability. The issue: The telnet daemon passes switches directly to the login process which looks for a switch that allows root to login to any account without a password. If your telnet daemon is running as root it allows unauthenticated remote logins. Telnet should be disabled. Since 1994 the cert.org team has recommended...

Exploits against the unpatched vulnerability in Microsoft's Internet Explorer are increasing and attackers are gathering momentum, researchers said Thursday. They warned that the problem would become worse if cyber criminals attack via e-mail next. "It might come to nothing, but it feels like a storm's coming," said Roger Thompson, the chief technology officer at Exploit Prevention Labs. "The potential is there. Call it a storm watch, not a storm warning." At least two different exploits have appeared this week, said Thompson, one linked to the Russian-made hacker exploit kit called WebAttacker, the other posted early Thursday on the xSec gray-hat...

Although Microsoft has acknowledged that in-the-wild exploits are taking advantage of an unpatched flaw in Internet Explorer, the developer has not committed to cranking out a fix before next month's regularly-scheduled update on Oct. 10. Users who want to protect themselves now, however, do have options. Disable the vulnerable .dll: In the security advisory posted yesterday, Microsoft suggested that users can disable the vulnerable "Vgx.dll" from the command line. -- Click Start, choose Run, and then type -- regsvr32 -u "%ProgramFiles%\Common Files\Microsoft Shared\VGX\vgx.dll -- Click OK, then click OK again in the confirmation dialog that appears. To undo the command,...

An unpatched vulnerability in all editions of Microsoft's Internet Explorer browser is being exploited, security researchers said Tuesday, with the attack dumping a broad range of adware, spyware, and Trojans onto PCs whose users simply surf to an infected or malicious site. First reported by Sunbelt Software -- although rival Internet Security Systems claimed it was the first to discover the bug -- the vulnerability is in how IE renders VML (Vector Mark-up Language), an extension of XML that defines on-the-Web images in vector graphics format. The previously unknown -- and thus unpatched -- bug inside IE is already being...

Attack code for a new security hole in Excel has surfaced on the Internet, just as Microsoft is scrambling to respond to a separate bug in the spreadsheet program. The latest vulnerability could cause Excel to crash after a malicious file is opened, according to an alert Symantec sent to customers on Monday. The security company also said there was a risk that an intruder could commandeer a PC. "Attackers may also be able to execute arbitrary code…but this has not been confirmed," it said. The security hole exists because Excel fails to properly check user-supplied input before copying it...

A dangerous new exploit in Internet Explorer could put PCs and data at risk, Microsoft has admitted. The flaw, for which code has already been published on the internet, could be exploited to set an email-borne virus free on the unsuspecting public. Potential viruses could come as an attachment that conceals the code, or could possibly redirect users to a site that will unleash the code on the user's machine, leaving the computer open to remote attack. Once the PC is being controlled by a malicious user, it can then be used to launch attacks on other PCs. Even supposedly...

Windows Vista won't have a backdoor that could be used by police forces to get into encrypted files, Microsoft has stressed. In February, a BBC News story suggested that the British government was in discussions with Microsoft over backdoor access to the operating system. A backdoor is a method of bypassing normal authentication to gain access to a computer without to the PC user knowing. But Microsoft has now quelled the suggestion that law enforcement might get such access. "Microsoft has not and will not put 'backdoors' into Windows," a company representative said in a statement sent via e-mail. The...

This is a transcript from a show Steve Gibson did with Leo LaPorte. The link to the audio is at the above link. Also, I will excerpt a little of the relevant information here.Steve: And so, you know, because I'm a developer when I'm not being a hacker, I wanted to understand - oh, and the other thing is, I want to write a robust testing application, you know, that always works all the time. So I wanted to know, like, okay, what bytes have to be set which way, what matters, what doesn't. Because, you know, that's the way...

Looking forward to the week ahead, I find myself in the very peculiar position of having to say something that I don't believe has ever been said here in the Handler's diary before: "Please, trust us." I've written more than a few diaries, and I've often been silly or said funny things, but now, I'm being as straightforward and honest as I can possibly be: the Microsoft WMF vulnerability is bad. It is very, very bad.

Excerpt - NEW YORK -(Dow Jones)- Microsoft Corp. (MSFT) plans to release a patch for a new security flaw at its next scheduled update release on Jan. 10, leaving users largely unprotected until then from a rapidly spreading computer virus strain. "Microsoft's delay is inexcusable," said Alan Paller, director of research at computer security group SANS Institute. "There's no excuse other than incompetence and negligence." "It's a problem that there's no known solution from Microsoft," said Alfred Huger, senior director of engineering at Symantec Corp.'s (SYMC) security response team. SANS Institute, via its Internet Storm Center, has taken the unusual...

Computer security experts were grappling with the threat of a newweakness in Microsoft’s Windows operating system that could put hundreds of millions of PCs at risk of infection by spyware or viruses. The news marks the latest security setback for Microsoft, the world’s biggest software company, whose Windows operating system is a favourite target for hackers. “The potential [security threat] is huge,” said Mikko Hyppönen, chief research officer at F-Secure, an antivirus company. “It’s probably bigger than for any other vulnerability we’ve seen. Any version of Windows is vulnerable right now.” The flaw, which allows hackers to infect computers using...

* New exploit released for the WMF vulnerability - YELLOW (NEW) Published: 2006-01-01, Last Updated: 2006-01-01 00:06:40 UTC by Tom Liston (Version: 6(click to highlight changes)) New exploit On New Year's eve the defenders got a 'nice' present from the full disclosure community. The source code claims to be made by the folks at metasploit and xfocus, together with an anonymous source. The exploit generates files: * with a random size; * no .wmf extension, (.jpg), but could be any other image extension actually; * a random piece of junk in front of the bad call; carefully crafted to be...

This alert is a follow-up to a post made yesterday on our blog: http://www.websensesecuritylabs.com/blog/ Websense® Security Labs™ has discovered numerous websites exploiting an unpatched Windows vulnerability in the handling of .WMF image files. The websites which have been uncovered at this point are using the exploit to distribute Spyware applications and other Potentially Unwanted Soware. The user's desktop background is replaced with a message warning of a spyware infection and a "spyware cleaning" application is launched. This application prompts the user to enter credit card information in order to remove the detected spyware. The background image used and the "spyware...

Security researchers have released instructions for exploiting a previously unknown security hole in Windows XP and Windows 2003 Web Server with all of the latest patches applied.

If you use the Firefox browser .. read this !! .. Two vulnerabilities in the popular Firefox browser have been rated "extremely critical" because exploit code is now available to take advantage of them. The cross-site scripting and remote system access flaws were discovered in Firefox version 1.0.3, but other versions may also be affected, said security company Secunia, which issued the ratings Sunday.

Exploit code for the latest version of open-source browser Firefox was published Wednesday, potentially putting users at risk of a denial-of-service attack. The exploit code takes advantage of a bug in the recently released Firefox 1.5, running on Windows XP with Service Pack 2. Firefox, which initially debuted over a year ago, has moved swiftly to capture 8 percent of the browser market. The latest Firefox flaw exists in the history.dat file, which stores information from Web sites users have visited with the Firefox 1.5 browser, according to a posting on the Internet Storm Center, which monitors online threats. "If...

I hate vanity posts, but I am wondering if anyone in FR land knows anything about the Spy Axe 3.0 virus. It has set up shop in my toolbar and has hijacked my home page. eTrust isn't touching it. Help?!?!

My computer apparently picked up a virus from spyaxe.net. I have a pop-up window saying I have spyware and "it is recommended to use antispyware tools to prevent data loss." Everytime I close the popup it pops up again. I got tired of closing it and installed it then removed it with "Add/Remove Software" in the control panel. The pop-up is back. Can anyone help?

Microsoft acknowledged Tuesday that malicious software targeting an unpatched bug in Internet Explorer is on the loose, and urged users to run a complete system scan on its new Windows Live Safety Center -- which has a quirk of its own -- to detect and delete the code. In an update of a security advisory issued Nov. 21, Microsoft noted that both proof-of-concept code and an exploit are in circulation. The exploit can compromise PCs running IE on a host of the company's operating systems, including Windows 98, Windows Me, Windows 2000, and Windows XP. The bug, which was reported...

Sony's controversial copy-protection scheme had been in use for seven months before its cloaking rootkit was discovered, leading one analyst to question the effectiveness of the security industry. "[For] at least for seven months, Sony BMG Music CD buyers have been installing rootkits on their PCs. Why then did no security software vendor detect a problem and alert customers?" asked Joe Wilcox, an analyst with JupiterResearch. "Where the failure is, that's the question mark. Is it an indictment of how consumers view security software, that they have a sense of false protection, even when they don't update their anti-virus and...

When the news first broke in the mainstream press that Windows expert and blogger Mark Russinovich (he wrote a book about Windows for Microsoft) had found that Sony's anti-piracy efforts had gone too far and that Sony's DRM was installing an undetectable rootkit on customers' computers which they couldn't safely remove, the first reaction from Microsoft was guarded. They were concerned, they said, and were evaluating what, if anything, to do: Microsoft, which also ships an anti-spyware program, recently renamed "Windows Defender," hasn't yet decided whether it will also flag the Sony DRM software as malicious code, the spokesperson said....

More than one-half million networks infected by Sony including U.S. military and various countries. Dan Kaminsky, http://www.doxpara.com/ ,is the expert who broke this and did the work. His U.S. and Europe infection maps are shown below and are frightening. Dan did a hell of a good job. Search Google News for "sony numbers trouble" for more in an excellent article today that is very worth reading.

I have been receiving an email since mid-afternoon. I guess its really huge and I tried to get the program to quit, but it won't. How do I stop this? PLEASE HELP!

Just days after announcing that it planned to halt development on Outlook Express, Microsoft has been forced to change its position following internal confusion and an outcry from customers. As reported earlier this week on silicon.com Microsoft had planned to stop product development on Outlook Express, which forms part of the Internet Explorer code bundled with consumer versions of Windows. At the time Dan Leach, Office product manager, said: "The technology doesn't go away, but no new work is being done." Under that vision, consumers would have been directed towards the company's MSN software, while businesses would be encouraged...

It might be the world's most widely distributed e-mail client, but Microsoft has confirmed that it has no intention of further developing Outlook Express. "[Outlook Express] just sits where it is," said Dan Leach, lead product manager for Microsoft's information worker product management group. "The technology doesn't go away, but no new work is being done. It is consumer e-mail in an early iteration, and our investment in the consumer space is now focused around Hotmail and MSN. That's where we're putting the emphasis in terms of new investment and new development work." While Outlook Express has always been...

<p>Microsoft Corp. on Friday said that a patch it released Thursday for an Outlook Express vulnerability erroneously tells users they need a different version of Internet Explorer in order to install the fix. In fact, the patch requires IE 6, but users who have installed Service Pack 1 for the browser are already protected against the new flaw. Thus when these users try to install the new patch, they receive an error message.</p>

Outlook Express flaw speeds hacking By Robert Lemos Staff Writer, CNET News.com October 11, 2002, 10:40 AM PT Microsoft warned Outlook Express users late Thursday that a software flaw could allow an online vandal to control their computers. A critical vulnerability in the e-mail reader could allow an attacker to send a specially formatted message that would crash the software and potentially take control of the recipient's computer. The flaw occurs in how the software handles messages that include components using secure MIME (multipurpose Internet mail extensions), a standard that allows e-mail messages to contain encrypted data and digital signatures....

My system: Dell Dimension 8100 with windows ME which I have since upgraded to 2000 I cannot utilize Outlook Express. Everything is read-only, if I attempt to forward, reply or even open, I get the following message: msimn.exe has generated errors and will be closed by windows. You will need to restart the programs.Couple weeks ago had a major break down, lost files, computer wasnt working properly, and while on phone to Dell support, system died. Dell sent me a new mother board which I have since installed. Downloaded IE 6.0, and have since uninstalled it and loaded 5.5. Still ...

Several vulnerabilities were reported in Outlook Express (OE). A remote user can send malicious e-mail with an attachment that will bypass OE's malicious file type filter and misrepresent the name and size of the file. http://securitytracker.com/alerts/2002/Jul/1004805.html

Bank customers know to shield their ATM passwords from prying eyes. But with the rise of online banking, computer users may not realize electronic snoops might be peeking over their shoulder every time they type. In a twist on online fraud, hackers and identity thieves are infecting computers with increasingly sophisticated programs that record bank passwords and other key financial data and send them to crooks over the Internet. That's what happened to Tim Brown, who had account information swiped out of the PC at his Simi Valley store. "It's scary they could see my keystrokes," said Brown, owner of...

NEW YORK (AP) - Anticipating that the Hurricane Katrina recovery will be a big story for months to come, both NBC and CNN said Thursday they are opening full-time news bureaus in New Orleans. NBC News said its bureau will operate out of space at WDSU-TV, its local affiliate, and will help the network and MSNBC originate shows in the city. Brian Williams anchored the "NBC Nightly News" from there on Thursday in advance of President Bush's speech. Frieda Morris, currently chief of NBC's Atlanta bureau who has been living out of a trailer in Biloxi, Miss., since the storm,...

New Orleans, LA (LifeNews.com) -- Pro-life advocates say Planned Parenthood, the nation's largest abortion business, continues to exploit victims of Hurricane Katrina. The organization previously said it would provide morning after pills to victims, instead of food or shelter, and is now raising money off of the hurricane for its local abortion centers. On its national web site, Planned Parenthood solicits funds for Hurricane Katrina support efforts. In fine print, the abortion advocacy group explains that all of the money raised will be used to support its local abortion businesses. Under a headline "Help Those Affected by the Hurricane," Planned...

Computer users are being urged to be on guard for a bogus e-mail that pretends to offer news updates about Hurricane Katrina as a means to infect their PCs. The malicious e-mail gives a brief news bulletin on the disaster before urging people to click "read more" and be taken to the full story on a website. Yet once directed to the website, a virus is sent to the user's computer. People are also being told to watch out for fraudulent e-mail scams pretending to raise cash for Katrina victims. It's sickening to think that hackers are prepared to exploit...

Microsoft Corp. warned users of its Windows operating system on Tuesday of three newly found "critical" security flaws in its software, including one that could allow attackers to take complete control of a computer. Computer security experts urged users to download and install the patches, which are available at www.microsoft.com/security. "Users (should) apply the updates as quickly as possible," said Oliver Friedrichs, senior manager of Symantec Security Response, part of security software company Symantec Corp. SYMC.O. Microsoft said that vulnerabilities exist in its Internet Explorer Web browser, the most severe of which could allow an attacker to take complete control...

Microsoft on Tuesday issued alerts on several security flaws in Windows, the most serious of which could allow an attacker to gain control over a victim's computer. Microsoft released six security bulletins as part of its monthly patching cycle, three of which it deems "critical." The Redmond, Wash., software gives that rating to any security issue that could allow a malicious Internet worm to spread without any action required on the part of the user. One bulletin addresses three flaws in Internet Explorer. Of all the issues Microsoft offered fixes for Tuesday, these put users at most risk of attack,...

Nova Scotia July 19, 2005 -- SpyCop today announced that the use of commercial monitoring spy software is on the rise in Internet phishing schemes, the latest scam used to steal personal information and even entire identities. The Anti-Phishing Working Group, web site at www.antiphishing.org, explains: "Phishing attacks use both social engineering and technical subterfuge to steal consumers' personal identity data and financial account credentials... Technical subterfuge schemes plant crimeware onto PCs to steal credentials directly, often using Trojan keylogger spyware." The commercial spy software market has made available over 525 payware spy programs which include URL recorders, keyloggers, chat...

SAN FRANCISCO, July 15 - Add personal computers to the list of throwaways in the disposable society. On a recent Sunday morning when Lew Tucker's Dell desktop computer was overrun by spyware and adware - stealth software that delivers intrusive advertising messages and even gathers data from the user's machine - he did not simply get rid of the offending programs. He discarded the whole computer. Mr. Tucker, an Internet industry executive who holds a Ph.D. in computer science, decided that rather than take the time to remove the offending software, he would spend $400 on a new machine. He...

NEW YORK - Internet users worried about spyware and adware are shunning specific Web sites, avoiding file-sharing networks, even switching browsers. Many have also stopped opening e-mail attachments without first making sure they are safe, the Pew Internet and American Life Project said in a study issued Wednesday. "People are scaling back on some Internet activities," said Susannah Fox, the study's main author. "People are feeling less adventurous, less free to do whatever they want to do online." Like no other Internet threat before it, spyware is getting people's attention, she said. "It maybe will bring more awareness of all...

As part of its monthly patching cycle, Microsoft on Tuesday plans to release three security alerts for flaws in Windows and Office. Two of the security bulletins apply to Windows, and at least one of them is deemed "critical," Microsoft's highest risk rating, the company said in a notice posted on its Web site Thursday. Its Office productivity suite will get one bulletin, also rated critical. The notice did not specify whether one of the patches will be for Internet Explorer. Microsoft earlier this week offered a workaround for a known flaw in the Web browser that opens the door...