Secure delete (Windows)

在操作系统里，文件删除后，并且从垃圾桶里清空之后，文件所在的页面被标为“可用”(unused)，待下次有文件写入需要这个空间的时候，这个页面才会被改写：所以说，这时候这“已删除文件”并没有真正被删除。

好处：如果你反悔，有可能能把这些文件内容找回来。

如果你真的要删除这些文件，把这些文件内容彻底改写，在Windows环境可以使用微软出品的 sdelete (Secure Delete). 它把所有unused的页面都写上0，那些“已删除文件”被彻底抹掉：

 sdelete -cz C:  

在Linux 环境下可以用dd生成极大的文件（内容都是0）充满整个硬盘，把所有“可用”(unused)页面都用起来，然后把这个文件删除掉（scrub能做完这个事情）。

好处：1，硬盘这些空间都写上电荷0，可以减轻重量，减少环境污染。

2，如果你这个环境是一个虚拟环境(virutal machine)，比如VirtualBox 或者Vmware, 而且你的虚拟硬盘是动态分布的，那么在做完这个操作，把未用空间都填0之后，在host环境可以把这些未用空间收回来，缩小这个虚拟硬盘的实际大小（它的最大空间不变，随着你以后写入文件，它的实际尺寸以后还会长大）。

用VirtualBox的话，命令是：

VBoxManage modifyvdi xxxx.vdi --compact

附注：FBI有一些硬盘探测工具能够读取硬盘磁道的残留信息，找出该扇区在被改写之前的字节，以及在那之前的字节，以及...。即使在用sdelete的时候可以用 -p 来指定写入的次数（比如说，一百次？），也不能保证你的数据百分百没有被读出的可能。

关于微信（其实不只是微信，几乎所有中国开发的苹果app）的恶意病毒 xcodeghost

微信跟其它许多软件一起，iOS版本都发现了问题，因为没有用正版苹果开发软件来开发，所用的盗版开发软件在编译后得到的结果软件偷偷把一些信息传给坏人。在这个安全公司的网站上有当前发 现该问题的所有软件，包括微信、滴滴打车、网易云音乐等。
http://researchcenter.paloaltonetworks.com/2015/09/malware-xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of-millions-of-users/

新版本的微信声称已经解决了问题。强烈建议大家修改Apple ID密码，和所有相关的密码。我将会把这些软件卸载并修改Apple ID 密码。


一人据称是始作俑者，是他把正版苹果开发软件xcode下载之后加上一些恶意代码，放到百度云等地方，并在许多论坛里放上链接让人下载，使网易、腾讯等公司的程序员都中了招。他宣称只是一个“苦逼iOS开发者的”的"一次错误的实验"，并把一段代码公布出来。

我读了一下那段代码，没有什么恶意攻击的地方，只是简单地收集一些很大众的信息并上传到一个我没办法查到有用信息的网站。

首先我怀疑这段代码是不是真的、所有的代码；其次，可能有别的黑客把这段代码加工之后做一个新的xcode，据知现在找到的恶意代码起码有三个不同版本；然后，仅就这段代码而言，编码很老练，没有什么废话；风格很成熟，不是新手所为；再有，那个网站隐藏自己很老到，所牵涉到的注册商等都在美国；它也曾在另一个iOS病毒KeyRaider里使用；而且，在各论坛里发帖，把自己的百度云下载地址拉到搜索的前面，这也很需要搜索引擎优化技术，不是普通程序员的风格。连迅雷下载拿到的都是中毒的。

联想到在国内下载正版苹果开发软件xcode很慢、且不停断线，以至于实际上不可能下载成功，我有理由怀疑这是国家行为：由网络长城来挡住正版的下载，然后用注入了恶意代码的版本来取代正版。

5年前Symantec就首先通过分析代码，提出在伊朗核设施里找到的超级病毒Stuxnet是美国、以色列、德国合作的成果。可见国家层面的恶意代码是事实存在的，并非怀疑论者的臆测。

---附： 一个记录
http://blog.jobbole.com/91646/

并非敌人Not the enemy

译者前言：有感于国内正在收紧网络言论的控制，罔顾网民（人民）的隐私/权利，我把2600去年夏天的编辑弁言Not the enemy的一段翻译一下。黑客只是好奇于手册中没有记载的漏洞，热爱追求自由的一群人。他们不是敌人。

黑客们发现问题，告诉大众。他们是奥巴马所宣誓要支持的开放环境的最典范例子。他们不是从公司阴谋中取利的坏人，也没有满世界送垃圾邮件，或用病毒和蠕虫制造混乱。许多年来，媒体造成这样的形象：任何跟网络或计算机有关的坏事，都是黑客做的。讽刺意味的是，这使得那些做了那些坏事的人很骄傲地称自己为黑客。其实他们并不是。只要瞥一下本刊物(2600)上这些持续的对话，任何一个外行都能看出真正的黑客对于做坏事是很严肃的。如果给每个用键盘来做坏事的人这个标签，


-- 2014/03/22 注：这是2010年4月敲下来的，不知为何却没有发出去。

Why Linux is more secure than Windows

In Linux, by default, a common user can read almost all files, but she can only write to:

• /tmp
• /home/accountname

these 2 folders. Even if she accidentally execute a virus, the virus inherits her privilege and can not write to executables in other folders. That means that virus can not affect the system at all. When the user needs to modify other folders, for example, install a new software, she can use "su" to become super user temporarily, because she knows what she is doing.

In Windows, that is a different story.
In prior-Vista systems (Win 98, Win 2000, Windows XP...), a common user, by default is a local admin, can access to all files in the harddrive, so a virus can have admin privilege to do all it needs to do. In Windows XP, a user can be deliberately set as "Standard User" or "Restricted User", but user will experience difficulty when using the computer: Some applications failed silently because they could not get enough privilege to do their jobs, and the user is frustrated with application errors.
Vista has better security sense because a default user is like a "Standard User" in the Windows XP. When the user (or application) is trying to access system files, a window will pop-up for your permission to go ahead. That is called User Account Control (UAC). Windows learns that from "sudo" (or su, gsudo), but still it is a failure. In practice every Vista user disabled this functionality right after installing Vista. Yes, every single Vista user that I know of. If the user doesn't disable UAC because he is impotent to do so, he just blindly click "OK" to let the application have permission without looking at the prompt. Because the pop-up window is so annoying and user doesn't see any good from it.

The problem is not that the users are uneducated. The problem is that so many applications needs to access system files and triggers the pop-up window. Those applications assume to inherit administrator privilege from user.

Yes, those applications were not designed with security in mind. That was how Windows recommended. Even though Windows has change its recommendation, the software industry hasn't changed, because the old softwares are still being used or updated.

As I said, in Linux, a user can only write to /tmp and home folder. All application is designed to save personalized data in home folder. For example, Firefox writes the addons and configuration in .Mozilla folder under the user's home folder. It doesn't need to write to /bin folder, where all the applications stored.

But in Windows, applications are encouraged to write information to registry, where all the important information are stored. Also, a simple "WriteProfileString" function can write to Win.ini of %Windows% folder. The %Windows% folder is open for all applications. That is an invitation for bad-ware. The "WritePrivateProfileString" function, if a bare file name is given, write to the same folder with the application (usually under %Program Files% folder). So this folder is open to write access as well.

The Windows has another security features: Windows File Protection. Actually it is working pretty well in its scope: It keeps a copy of "important" windows files in %systemroot%\system32\dllcache\ folder. If these files are modified by bad-ware, WFP will restore the files quietly. This is very good, but it can not protect all legitimate files. For example, word.exe of Office is not protected. Also, because a folder is not protected, a fake system file, such as "C:\WINDOWS\system\svchost.exe" or "C:\WINDOWS\system32\svchost32.exe" or "C:\WINDOWS\system\svchost.dll" are often generated by bad-ware to trick users, pretending to be "C:\WINDOWS\system32\svchost.exe".

So far there is no real popular virus in Linux, because of the security feature mentioned above. A virus can not get elevated as admin to access applications to populate itself. Windows has a long way to go, and the Windows software industry needs to work together to get it straight.

Downadup病毒之以逸待劳

这个新病毒又名Conficker，感染了几百万电脑。它利用了08年10月发现的一个微软漏洞，只要你执行了Microsoft Update就可以避免。问题是：许多电脑用户，特别是使用盗版的中国用户，都把自动更新关闭了。

这不是我想要说的重点。重点是：这个病毒感染电脑之后，会自动上网下载一个文件并执行。因此下一个版本的病毒很容易就被发布到已经感染的电脑中。
这个病毒不是第一个尝试这样做的病毒。但是以前这样做的病毒，被分析出来之后，它所访问的那个联结就被砍断了。因为文件总是在一个服务器上，FBI只要给这个服务器打个电话，就可以删掉这个文件。
这个Downadup病毒最奇特的就在这里：它每天所尝试连接的文件联结都不一样。今天连接abcde.com/a.exe ，明天联结dskfsdf.net/a.exe，后天联结skeialja.org/a.exe。它根据每天日期算出今天应该联哪个域名：大多数域名甚至还没有注册。
也就是说，病毒作者预测10天之后，那些病毒将会访问qwqqqq.com，那么她写好新病毒，在9天之后注册这个域名，把新病毒放上去；半天功夫，新病毒又传遍全世界了。

FBI不可能把所有的可能的域名都关闭，或者禁止注册。上面的描述里我简化了技术细节。其实，它每天会尝试访问250个域名。

最糟糕的是：Downadup的病毒作者可以这样做，其实，天底下所有的病毒作者都可以这样利用这个方式来发布自己的病毒，只要破解了它的域名生成算法...可参看病毒的生态环境。计算机病毒之间相互竞争、相互协作，世界真是越来越有趣了。

安全专家必须每天监视250个域名，而病毒作者只要任一天的其中一个就可以发布新病毒。所以这应该是三十六计之：以逸待劳。

拒绝Tom-Skype

Skype.com所出产的Skype软件既是个优秀的实时通信软件，也是个IP电话软件。可以文本聊天、语音、视频对话。以我个人经验，它在语音、视频聊天时比MSN Messenger稳定流畅。

Tom.com是李嘉诚家族购买国产免费邮箱163.net后的门户网站。

二者合作生产Tom-Skype软件，专门在中国推广。10月2日，多伦多大学的Citizen Lab揭露：这个软件监测用户的即时通信，并且把涉及政治的言语及用户IP等记录下来。同时还有一些纪录与政治无关，估计是因为该用户被列入监视黑名单。

我看过报告原件，所记述的技术过程很可信。披露之后，Skype.com出来承认、道歉，Tom.com宣称这是符合中国法律的要求。所以，Citizen Lab的这个报告是被确认了。

Skype.com现在说：“这种做法是中国的要求，无法改变。唯一能做的事情是：确保用户知道，他们正在被监测。”同时保证：如果你用Skype.com的软件，即时聊天不会被记录。

为了你和他人的安全，请拒绝使用Tom-Skype软件。如果多人通信，只要有一个人使用的是Tom-Skype，所有通信都被记录在案。所以还要让你的所有Skype上的朋友都改用原版Skype。原版Skype软件其实有中文功能，安装、使用过程都可以用中文，对中国用户完全没有障碍。

如果对丑恶漠然、容忍，就是对丑恶的鼓励。

在中国访问 Skype.com 就自动被改向为 Skype.tom.com ，所以中国用户无法下载原版的Skype软件。（待已验证）。我放了一个拷贝在 ___ ，字节数 22,404,904字节， 版本号 3.8.0.180 （该连接随时可能失效）。 不反对改用其它即时通信软件，但是其它的就好么？（其它的就没有监测的可能么？）


中国媒体对这件事情的报道很少，都是粗描淡写，大多说“侵犯了用户的隐私权”。现在我用英文Google.com查 Tom Skype，所得到的90%都是讨论这件事情，使用security and privacy breaches，Chinese monitoring， TOM-Skype censorship， A Privacy Nightmare等关键字。而在百度查找，前两页都没有任何链接与这件事情有关，都是吹嘘Tom-Skype的好。在Google.cn查找，第一页有一个“tom skype的相关焦点”，是这件事情的新闻，除此之外没有任何负面消息；第二页有一个博客提到该新闻，且该页最后有一句话：

据当地法律法规和政策，部分搜索结果未予显示。

这就是政府行为了。


看看Tom-Skype在监测什么关键字（“奶粉”也在其中）：



我就不把中文打出来了，免得长城找我麻烦。

PHP Security Tips

There is a PHP Security Tips series in Zend, and here is the abstract:

1, Keep system up-to-date.
2, Don't output error message.
3, Use third-party security software or services.
4, Don't give critical files and folder default names.
5, Don't trust user. Filter Input, Escape Output.
6, Cast input numbers in SQL query.
7, Use session_regenerate_id(true) instead of session_regenerate_id().
8, Always validate user input. (AGAIN?)
9, Keep sensitive data and code out of your web tree.
10, Do not blindly send mail using information entered into a form to prevent email header injection.
11, Grant permissions to users only to the level needed.
12, Think carefully before using eval() for user input values. (AGAIN!)
13, PHPSecInfo. (TIP 3?)
14, Any data inside of a cookie can be potentially seen by others.(AND IT CAN BE MODIFIED AS WELL!)
15, Don’t forget to purge temporary system diagnostic files/code.
16, Keep Your Framework Up to Date.(TIP 1)
17, PHP Security Guide http://shiflett.org/php-security.pdf, design your application with security in mind.
18, Restrict the file types that you allow to upload, especially php file.
19, Consider your server network connection. For example, put database server behind firewall.
20, Read and learn.
21, Subscribe to the Security Focus newsletter, read and learn.

The notes in capital letters are mine.

WordPress Plugin: Member Only

To create member only pages, I deployed Chad Butler's WP-Members plugin. The original plugin only support Posts, not Pages. And Chad makes it very complicate. So I modified the program and deleted most of his codes to make it simple. Now the code only has 20 lines, while the original one has 1000 lines.

INSTALLATION PROCEDURE:

* Upload memberonly.php to your plugins directory
* Login to the WP admin
* Go to plugins tab and activate the plugin
* Any post or page whith < !-- more -- > tag will be blocked from anonymous visit.

Download


PS: (Aug 30, 2007)
The WP-Members plugin integrated a sidebar login widget.


But the Sidebar Login Widget from Mike Jolley is better. Basically, I don't like the style of Chad Butler, putting several things in one package.

The Ghost In The Browser

I read Google's paper "The Ghost In The Browser Analysis of Web-based Malware". The fact is astonished: 10% ^note* of websites have malicious code to (at least try to) exploit visitor's computer, including my website.

In my website I deployed a free counter to send me report of visitors. From the report I can know when is the best time people visiting my page and how they found my website, and what kind of technology they are using: Most of my visitors are using 1024*768 monitors, which means that I should design my site according to this dimension. This kind of information is invaluable. In each page of my website I embed a short HTML code from the free counter provider to perform this survey. The provider's name was "NedStat", then changed as "webstats", and now it is "motigo webstats". I have been using this free counter since 2002.

In the Google's paper, this is an example telling webmasters to be cautious with Third-Party Widgets:

This widget used to keep statistics of the number of visitors since 2002 until it was turned into a malware infection vector in 2006... The web counter was benign for over four years and then drastically changed behavior to exploit any user visiting the site. This clearly demonstrates that any delegation of web content should only happen when the third party can be trusted.

Now it is deleted from my website.

note*: BBC said "One in 10 web pages scrutinised contained malicious code". Maybe that is not true. The origin word from the paper is:

We analyzed the content of several billion URLs and executed an in-depth analysis of approximately 4.5 million URLs. From that set, we found about 450,000 URLs that (is malicious)

So I would say that the rate is 450,000 out of several billion.

Is High Tech Fragile?

Today one news was about a fire in New Brunswick. It was a small fire; when the fire fighters came, it had been put out by the technicians. But because one cable was on fire, the communication of that city was interrupted: More than 100,000 residential phone were cut, and the 911 was not function either.

Update: The news was heard from TV. Now after I searched the Google News, it turns out the fire was in St. John, NewFoundland. The outrage lasted for four hours. Even the Internet, bank machines and ATM machines were interrupted in that four hours.

Why the backup system was not successfully started to replace the damage system? The company will investigate this problem on Monday. But this is truely frustrating. If a back up system can not take over the system, we have no reason to pay big money in the back up system. Expence of a back up system includes the hardware, software, labour to back up everyday, or the bandwidth for real-time backup.

It is such a small file, that even a technician can put it out. How can it cause trouble to the whole island for four hours? Is high tech that fragile?

What should you do before you call IT service?

In the eWeek, one article is talking about How to Stay in Your Help Desk's Good Graces:

1. You should know how to save and back up your work.
2. You and you alone are responsible for knowing your password.
3. You should know how to email effectively, securely and efficiently.
4. Do your part to secure your workstation.
5. You should troubleshoot before calling for help.

It is too complicate, and some might say the technology is so difficult. The thing is, those "difficult technologies" are becoming common sence, and IT professonals have something more difficult to do. The expectation from IT professionals to users is becoming higher, anyway.

The first one is reasonalble. You should know how to save and back up your work. Back up your work regularly, so when bad things happen, you are not that nervous. The computer is vulnerable. It is extremely vulnerable. Don't rely on it. This is the word from an old IT professional, please take it.

The second advice is to make sure you know your own password, and don't let others have it. Although you might not have anything important in your computer, you don't care too much about your password. But what if some people log in the system using your account? How will you get yourself out of the mess if the system log says you are the one who accidently deleted an important company file?

The next advice is about email. I would add "Internet" as well. Spam email, Phishing website, Trojan horse are common sense for Internet users. If you are not familiar with any of these three concepts, you should take some time to read some security articles. At least you should read the related pages in the wikipedia. Deleting useless email will release hard drive space of server, relieve the anxiety of the IT department; It actually give you more space to save useful email.

The forth advice is to do your part to secure your computer. The previous advices tell you to be serious of security. While the responsibility for securing the corporation's network falls predominantly on the IT department, there are something the employees can do to ensure that their computers are not the stations that wave the bad guys in.
Among these, not opening risky attachments or downloading unknown software from the crazy Internet are near the top of the list. If in your work you desperately need some software which is introduced by a friend, talk to the IT guys, ask them to make an accessment, get their approval before you install it. They will be only too happy to do that, because they have the chance to check it first before a rampant virus is controling the network. Creating a strong (enough) password, and locking your computer when you leave it, are the rest of things you can do. It's not too difficult, isn it?

The last advice, troubleshooting before you call for help, is to show your respect to the IT guys' work. You don't want them to come over only to press the "Reset" button. Give them some challenging job, please. You can press the "Reset" button by yourself, you can check the plug of the computer/printer, and check the paper tray if it is empty. The biggest secrete in Microsoft's Windows system is: When you get error message now and then, save your work and reboot your computer. Mostly your computer returns to normal after a reboot.
Another meaning of troubleshooting is to find out "How to repeatreproduce the error message." Then you can communicate with IT guys in and effective way. This is the best way to Stay in Your Help Desk's Good Graces.

Eco System of Virus

Last Monday, a computer in my lab got infected of virus. The network admin tried several anti-spyware softwares, and tried to delete the virus manually in safe-mode. But after the softwares deleted several virus, one virus was still alive.

On Friday, the computer had become very slow, and a new message pop-up saying:"You computer has been slow down 40% because of virus. Please click the link to purchase xxxx anti-virus software". When the admin ran the anti-spyware software again, 5 virus were found, so the only way to deal with it is, of course, reinstallation.

There was only 1 virus on Wednesday, why 5 virus were found on Friday? Because the immortal virus created a port allowing other virus to intrude this computer. This is the Eco System of Virus.

Yes, when a virus is executed, it gets the privilege to run anything. The first thing is to create a back door, so that it can enter the system any time it wants. Other virus will take advantage of the back door, and get in this computer without permission of the origin virus. For example, in the Sony rootkit scandal, Sony's Badware hides itself from users by changing to operating system to hide file names begins with "$sys$", then the new virus are named with "$sys$". If your computer are infected with Sony's Badware, you can't notice the existence of the new virus.

In a eco system, co-existence is not the only relation between members. Competition is also important. Competition can create better generation, and eliminate the worse ones.

Even in the Eco system of Virus, there is competition. The famous case was between Netsky and Beagle. The war was in 2004, when one programmer accusing another programmer stole the source code. The virus can get rid of another one when it has the control of a computer. but in the second day, another one creates a new generation which can delete its rival.

The evolution of virus is also interesting. A virus can't prevail too long, because the security experts in the world will definitely find a solution to prevent the distribution. The authors of the virus know this well too. So, a virus must have next generation which has new feature to bypass the solution of previous generation. A virus (or the programmer) learns how to fight with the world during the evolution. It also learns how to take advantage of backdoor from other virus, and avoid attack of rivals. The Beagle virus is wise enough to set a deadline in it's program, because it knows one generation of virus can't stay for more than 1 month, and it knows clearly the next generation will be stronger, and the ancestor should suicide to release the resouce for the next one.

One question amazed a lot of peoples: How do police find out who is the author of a virus?
The answer is: The computer world is so complicate that a newcomer can't make (good) virus alone. So if a good virus is going around the Internet, the programmer must have experience, or acquire experience from some old-hands. So he must be an active member in hacker community, and he shows off his programs to his friends.

Let's talk about Reinstallation

Installing a system is quite strait forward. The modern operating systems including Linux and Windows are very easy to be installed. You simply put in the CD and run the installation program, answer several questions. Two hours later, you have a fresh operating system to play with.

But reinstallation is another story. Most computers which are required to reinstall a new system are abused. A lot of programs are installed and a lot of files are saved in those computers. Some files might contain virus. So it is important to save those programs, files, and settings of programs before installing a new operating system.

Reinstall a new system in the same folder as the old one without formatting the drive is not a good practice. The old system is broken because of some reason. Maybe the computer gets virus? Maybe the system files corrupt? At least, there are too many useless files in the system folder. If you install the new system in the same folder to replace old one, the useless files are kept to slow down the new system. So the best option is to format the drive to clean up everything before reinstallation. That’s why we need to save data before formatting.

Virus experience

AdWare Experience

A computer in my lab got an AdWare today.I don't know what the girl did to her computer, but when she asked me about the installation of EditPlus, I noticed her computer was slow. Suddenly, a message popped up:” Your computer is infected with AdWares, Please visit xxxx.com". Yes, that AdWare’s function is to promote a software to delete adwares...First of all, the girl is a Computer Science graduate student, like me. So we can assume she knows the basic idea of computer and Internet.Second, Norton Antivirus Corporation Software is running in her computer. This is mandatory in all our labs, and the virus-library is updated. Also, the Windows XP is updated as required.Third, there is a firewall in the campus network.With all these 3 factors, we still can't protect a computer from attack of AdWare, what a brutal world!Then I tried to help her to get rid of the AdWare. She doesn't know too much about computer security, and I don't want her to bother me all the time. But 10 minutes later, I gave up.There is one system tray icon indicating this software, but the only function is to bring up the "Your computer is infected with AdWares" message. There is no "exit" or "close" menu attached with it at all.Since Norton Antivirus is installed, the standard procedure is to run it to scan the whole computer. Of course it failed as I expected. Since the BadWare is running in memory, there is no way to find it out, if it is smart enough. Five years ago, an Antivirus software can capture a running virus and kill the process before it deletes virus files. Now the virus knows how to hide itself from Antivirus softwares, especially when the virus is running with admin privilege. So I tried to kill the virus process manually. From the Windows Task Manager, I saw too many processes. After all other windows are closed, I saw several suspicious processes: ishost, hostsys, and some others. I am familiar with most of the system processes, and I am sure these two processes are not related to system. But after I killed "ishost", it appears again. Yes, this virus is smart enough to run several processes, and each of them can initial another, if one process is terminated. I actually tried to use "Ctrl" key to select both processes, but the Windows Task Manager doesn't support this operation.Since the virus procedure is running and it has administrator privilege, I know I can't delete it. So I checked the startup registry and the running service list. There're too many software installed in this computer, and I can't say I know everyone of them. So I gave up.I know the correct way to kill the virus is to restart into Safe Mode, and delete the virus files and registry entries of virus manually. But because it’s hard to tell the virus files and entries from normal files and entries, especially when the computer is not managed by me, I decided to leave this task to network admin. I think he may suggest to reinstall Windows, or leave the virus alone :D No kidding! Sometimes, if the virus is harmless, we leave them alone in our computer, if the expense of reinstallation is too much.

What is the expense to reinstall system? Let’s talk about this topic tomorrow.


-----------------
In the above article, I mixed AdWare, BadWare, and virus. AdWare is installed in computer without user’s permission, and the function of it is to show commercial Ads. Virus’s function is to destroy your file and use computer resource in your computer to distribute itself. Anyway, BadWare, or MalWare, includes everything we don’t like.
People are familiar with the word of “virus”, and we used to call any unwanted software as virus. But that is not correct. Virus, in computer history, has its own definition. A virus is a program which can conceal itself, and redistribute itself to other computers, and do something bad to the computer when the situations is met. Concealment, redistribution and bad action are the three signs of virus. BadWare is a new word, which can include virus, adware, spyware, Trojan horse, and joke program.

Update:
The Network Admin ran Cleanup!, Ewido Security Suit and AVG Anti-Spyware at the same time. After running them several times, that adware’s icon disappeared, but there is another popup message in some language I don’t know:
NON HO TROVATO NESSUN MODEM PER LA CONNESSIONELooks like an unclean program.

Sony: Again?

Sony recalled all the laptop battery.

The war of toolbar

Yahoo has inked an agreement with HP to install Yahoo toolbar in HP's new personal computers. HP users will have Yahoo services automatically. If they don't like Yahoo email, Yahoo messenger, and Yahoo search, they can uninstall the toolbar afterward. How many of them will do so?

We all know that users are lazy. Most users use tools which are easy to get. If Yahoo search is the default search engine, they don't want to change it to others, as long as the Yahoo servers are alive. To promote their services, Yahoo and Google has started a war in user's desktop: Yahoo signed contract with computer makers HP and Acer, when Google had deals with Dell, Adobe, News Corp. If you occupied user's desktop, you are the king.

Not only Yahoo and Google know this rule. Microsoft has its MSN Toolbar. A lot of spyware are designed as a toolbar too. Toolbar has gotten a little bit out of control recently. Most toolbars have similar features: Internet searching, Ad Blocking, Shortcuts to different channels. If you trust the host, and you like using those services, toolbar can actually facilitate your Internet browsing. But many PC users have many toolbars installed. Some toolbars are installed by BadWare quietly, but the users are too lazy to uninstall them: Because they may be reinstalled, if the users don't know how to prevent BadWare.

Toolbars are not only providing shortcuts to searching service of their host, but also collecting users' browsing activities. Most websites are ad-driven, and the websites wants to know users' browsing habit so that they can put corresponding advertisements to users, and increase the chance that users actually read the advertisements and purchase the items: That is how the advertisement companies and websites earn money.In this deal, user's privacy is compromised. The websites get the browsing habits of user, and they sell this information to advertisement companies.

Some toolbars also collect user's personal information, even credit card number, social security number, bank account/password.

Be aware of your fragile security. Antivirus software and Firewall can not protect you from this kind of software, because they look like legitimate software.

If you like the service of toolbars, please select toolbar from reputable company. At least, you should aware of the dangeous of toolbar. You should aware of dangeous of any software you install into computer. Any software can be virus, can be trojan horse, and it can destroy all data in your computer or steal your information. So, please make sure you know what you are doing when you download and install software from Internet. Internet is a very dangeous territory, and there are many bad guys out there looking for xxxx(?). My suggestion about installing new software is:

1, Think again: do you really need this software? If you randomly come cross a software, don't install it. Unless you need a new software to do your job, or your best educated friend introduced a software to you, don't install anything new. If you get a prompted message saying "Please install xxxx software to browse this website" when you are surfing Internet, always click "no".

2, Is this software made by a trustful company? If you know the software developer who make this software, and you know she won't attack you, go ahead to install it. If it is made by a small company you've never heard of, you should Google the company to check its reputation. If it is made by a big company like Sony, you can trust it. It might be a badware too, but the chance is very low.

3, Is it downloaded from trustful source? Some users Google software's name and download it from any website. Some hackers create virus using the same name of a useful software and distribute them to Internet. Some websites save these virus thinking of them as useful software. So if a software is not downloaded from trustful source, your company can be compromised.

4, Do you have antivirus software and latest patches?

Gain System Privilege in Windows?

Gea-Suan Lin quoted Bruce Schneier's blog which introduced an article talking about how to get System Privilege:

On many machines this can be exploited even with the guest account.

And Gea-Suan Lin's blog name is "I love Microsoft". They all think Microsoft is so bad in security.

But that is not true. I tried a guest account in my computer, but failed to get system privilege. So I tried a user account and failed again. Finally I tried an administrator account, and successfully get the so-call system privilege. If an intruder has administrator account, he can do anything he want, he doesn't need to "steal" system account.

The method the article instroduced is to add a task into schedule:

at 15:15 /interactive "cmd.exe"

Then when the task "cmd.exe" is executed, a new DOS window with System privilege is created, and from this DOS window you can execute commands with System privilege.

The problem is: without administrator's (or higher) privilege,
(Please read the second comment below)
xxxxxxxxxxxxxxx

So, this is a false news. How many people have read it?
The blog of original article has 29 subscribers in bloglines.
Bruce Schneier’s blog has 3052 subscribers.
Gea-Suan Lin’s blog has 496 subscirbers.
According to my feedburner’s statistics, when 130 visitors visited my feed, 70 of them subscribed from bloglines. So I would say:
First blog has 60 visitors.
Second blog has 6000 visitors.
Third blog has 1000 visitors.
And these visitors are those readers who know to use blog tools to visit RSS feeds. Let’s assume 10% of the bloglines subscribers have their own blogs, and 10% of those blog owners write blogs about this news.
The first blog only attract one blog writer, Bruce Schneier.
60 blogs were written after reading Bruce Schneier’s blog, and each of them have 1000 visitors as Gea-Suan Lin’s. We call these blogs “third level blogs”.
5 blogs were written after reading third level blog, and each of them have 130 visitors as mine’s.

First level has 1 blog, 60 visitors
Second level has 1 blog, 6,000 visitors
Third level has 60 blogs, 60,000 visitors
Forth level has 300 blogs, 39,000 visitors
Totally there are 362 blogs writtern, and 105,060 visits.

That’s interesting. How many of these visitors know this is a false news, and how many of them think Microsoft is a crap?

Btw: Bruce Schneier’s blog is in English, and Gea-Suan Lin’s blog is in Traditional Chinese, and today I’ve seen one blog talking about this topic in Simplified Chinese.

StopBadWare.org

StopBadWare.org is setup by Harvard, Oxford, Google, Lenovo, Sun and other companies. It helps Internet users to avoid disaster when browsing the net:

You or someone you know has downloaded something from the internet that seemed harmless enough at the time. Next thing you know, the computer has slowed to a crawl. Pop-up advertising starts to appear out of nowhere. Private information gets sent to some company you've never heard of. And the worst part? Trying to uninstall the software sometimes makes the problem worse.

How do this website implement such a big task? When you use google to search information, if the search result contains a malicious website which has "BadWare", and you want to visit that website, Google will bring you to warning page first, let you know the dangeous of visiting this website. If you think it you are confidence to visit that website, sure you can still do whatever you want, but at least, you've been warned.

The definition of "BadWare" is ambiguous. Usually we think a software that can install itself quietly without user's permission is not welcome by users. At least it is unsolicited. If a software doesn't provide an elegant way to uninstall itself, that makes user hard to delete it, and its existence againsts user's will, then we can call it "bad". Talking about actions of them, some softwares do something in the user's back, such as sending out personal information without permission. These are infamous Spyware. Some softwares pop up advertisement windows so that the developer can get money from ad venders. These are Adware. There are some other BadWare such as virus, trojan horse and joke ware. Yes, sometimes joke ware is treated as bad. You get an email from a friend, but when you open the attachment, you are told that your documents are deleted. It is only a joke, but maybe you don't want to get caught by this kind of surprise.

If you read yesterday's blog, apparently Sony's rootkit is a badware: It install itself without permission; It doesn't provide uninstall function; It do things user doesn't like; And it send user's personal information to its website.

Today when I tried to search serial number of a software. (/shame, sometimes I do that)I clicked two links from the search result, and both of them bring me to a StopBadWare.org page:

Warning: The site you are about to visit may harm your computer!

I am quite confidence with my computer, because I know every software I installed, and I have up-to-date antivirus software, I disabled unwanted system service, I update my Windows system on time, and I have firewall running. So I clicked the link to visit those websites. But I don't see anything special. I got the serial number I wanted from both website, and none of them send me any BadWare.

Sony Rootkit Scandal

Sony distributed spyware with its Music CDs last year. I heard of rumous at that time, but I didn't pay attention to this scandalit. Today after I read the documents about it and found it is big because Sony is big, and usually people trust big companies.

Those Music CDs are equipped with XCP software. You can still play them using CD Player as usual, but if you put them into computer, the computer will install XCP software automatically from the disks. Consequently, all the activities of CD will be monitored by XCP software. If you tried to copy music, or do anything not permitted by Sony, this XCP software will stop the action. Yes, the intention of this software is to protect the copyright of CDs. "XCP" stands for Extended Copy Protection.

Looks fine, right? But the software is installed without user's permission. According to Wiki, The software is installed silently before EULA(End User License Agreement) is showed, which means, when you see the EULA, although you don't agree onwith it, the software is installed already. Actually EULA doesn't mention this software at all. And, there is no easy way to uninstall it. Manually uninstall it might lead to defuntionmalfunction of your CD Drive.

These areThis is not the main reason why we call it "spyware". To conceal itself, this software changes system files (Microsoft Windows and Mac OS) so that it is not shown up in the system. The intruded system will hide any process/file/registry key if the processfile/registry key name begins with "$sys$". This is how we call it "rootkit". It has the root privilege to hide itself from being detected. With this privilege, this software can do anything it likes! It is reported that personal information was sent to Sony website by this software.

Ten days after it was discovered by Mark, virus which takes advantage of this software was found in Internet: The virus has the name start with "$sys$", so if your computer installed XCP, you can't detect this virus by any means.

This is not the whole story. Sony had to give out uninstall software under presure, but the uninstall software was found with a bigger problem. It doesn't uninstall anything. It simply shows/reveals the hidden files. The worse is that it installs aditional software that can not be uninstalled. (More on Sony: Dangerous Decloaking Patch, EULAs and Phoning Home)

The last patch of Windows 98

Microsoft announced today that this is the last patch of Windows 98/ME, which means that these two operating systems are abandoned from the production line.

Windows ME (Mellennium Edition) has never become a mainstream product, because the previous version, Windows 98, was too successful, and the next edition, Windows 2000, which has better security features, is more attractive for users.

Let's talk about the history of Windows.

Windows 1 was a toy, and Windows 2 got a little bit of attentions. But Windows 3.0 was the first successful Windows openrating system. The graphic interface is more accessible than the urgly DOS interface. The later version, Windows 3.1, became popular through out the world.

Because the Windows 3.0 was developed for desktop users, and many security problem were found by computer experts, Microsoft decided to make another OS, based on Windows 3.0. Windows NT 3.1 is the result of this decision. There are two versions of Windows NT 3.1: Workstation and Server.