<?xml version="1.0" encoding="UTF-8"?>

<rss version="2.0" xmlns:blogChannel="http://backend.userland.com/blogChannelModule">

<channel>
<title>Security forum - dslreports.com community</title>
<link>http://www.dslreports.com/forum/security</link>
<description>Security forum current topics</description>
<language>en</language>
<copyright>Copyright 2007, dslreports.com</copyright>
<pubDate>Tue, 24 Nov 2009 15:16:18 EDT</pubDate>
<lastBuildDate>Tue, 24 Nov 2009 15:16:18 EDT</lastBuildDate>

<image>
<title>dslreports.com</title>
<url>http://i.dslr.net/bbrdisc1.gif</url>
<link>http://www.dslreports.com</link>
<width>19</width>
<height>18</height>
<description>bbr disc</description>
</image>

<item>
<title>Just curious Routers,</title>
<link>http://www.dslreports.com/forum/remark,23382175</link>
<description><![CDATA[am just curious,when your using a solfware firewall like zone alarm,or ?? its gets updated... what??,(every month or so) niy just wondering 

WHY when an ISP sends you their routers to use they ""may" update once a year or every 2 yrs, 
any idea why isp do not update their routers on a regular basis?
                   thanks for the information, 
                            W.W. ]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23382175</guid>
<pubDate>2009-11-23 08:12:09</pubDate>
</item>

<item>
<title> Climate Change Scandal Erupts After Email Hack.</title>
<link>http://www.dslreports.com/forum/remark,23381128</link>
<description><![CDATA[ Climate change scientists have been manipulating and fixing data according to bloggers that are spreading information contained in hundreds of hacked emails.

Bloggers say the 62 mb worth of emails were hacked from the Climate Research Unit, part of Britain&#146;s University of East Anglia and released onto the Internet. The file containing the emails were packaged and posted on blogs by an anonymous hacker.

&#147;We feel that climate science is, in the current situation, too important to be kept under wraps,&#148; said the hacker on the climate skeptic site Air Vent on Friday. &#147;We hereby release a random selection of correspondence, code, and document.&#148;

The file contained data, code, and emails from Phil Jones, director of Britain's leading Climate Research Unit (CRU), to and from many people. Jones confirmed to Investigate magazine's TGIF Edition Friday night that his organization had been hacked.

"It was a hacker,&#148; Jones told TGIF. &#147;We were aware of this about three or four days ago that someone had hacked into our system and taken and copied loads of data files and emails."

The blog "Watts up with that" said they had seen the file and it appeared to be genuine. &#147;Others who have seen it concur&#151;it appears genuine. There are so many files it appears unlikely that it is a hoax. The effort would be too great.&#148;

The "No consensus" blog apparently had the files sent to their site as well.

&#147;This is the biggest news ever broken here,&#148; said the blog. &#147;The first thing I have to say is that I have no connection to the source of these files. It was left as a link on my blog while I was hunting for cloaked deers (fruitlessly) in the Upper Penninsula. These files are real [in my opinion] but they cannot be one hundred percent verified as such.&#148;

The emails are uploaded on a site called &#147;an elegant chaos.&#148;

In one email, scientists appear to admit they can't find the data to back up their global warming theory.

&#147;Well I have my own article on where the heck is global warming? We are asking that here in Boulder where we have broken records the past two days for the coldest days on record. We had 4 inches of snow. The high the last 2 days was below 30F and the normal is 69F, and it smashed the previous records for these days by 10F. The low was about 18F and also a record low, well below the previous record low.

&#147;The fact is that we can&#146;t account for the lack of warming at the moment and it is a travesty that we can&#146;t. The CERES data published in the August BAMS 09 supplement on 2008 shows there should be even more warming: but the data are surely wrong. Our observing system is inadequate.&#148;

Another email thread talks about manipulating data. It is apparently from Phil Jones.

&#147;Once Tim&#146;s got a diagram here we&#146;ll send that either later today or first thing tomorrow. I&#146;ve just completed Mike&#146;s Nature trick of adding in the real temps to each series for the last 20 years (ie from 1981 onwards) amd from 1961 for Keith&#146;s to hide the decline. Mike&#146;s series got the annual land and marine values while the other two got April-Sept for NH land N of 20N. The latter two are real for 1999, while the estimate for 1999 for NH combined is +0.44C wrt 61-90. The Global estimate for 1999 with data through Oct is +0.35C cf. 0.57 for 1998.&#148;

Another email talks of the potential to excluding some research contrary to the global warming theory.

&#147;The other paper by MM is just garbage &#150; as you knew. De Freitas again. Pielke is also losing all credibility as well by replying to the mad Finn as well &#150; frequently as I see it. I can&#146;t see either of these papers being in the next IPCC report. K and I will keep them out somehow &#150; even if we have to redefine what the peer-review literature is!&#148;
Source:
http://www.theepochtimes.com/n2/content/view/25478/]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23381128</guid>
<pubDate>2009-11-22 22:23:58</pubDate>
</item>

<item>
<title>Several MS Updates today (11/24/2009).</title>
<link>http://www.dslreports.com/forum/remark,23389216</link>
<description><![CDATA[It's the fourth week's Tuesday, and MS decided to release updates. I saw these on my updated XP Pro. SP3 machine:

High-priority updates 
 
Update for Windows XP (KB973687)
Download size: 1.5 MB , less than 1 minute 
Install this update to prevent applications from sending too many HTTP requests while a well-known Document Type Definition (DTD) is included. After you install this item, you may have to restart your computer.  Details... 
Don't show this update again 
 
Update for Microsoft XML Core Services 4.0 Service Pack 2 (KB973688)
Download size: 5.4 MB , less than 1 minute 
Install this update to prevent applications from sending too many HTTP requests while a well-known Document Type Definition (DTD) is included. After you install this item, you may have to restart your computer. Once you have installed this item, it cannot be removed.  Details... 
Don't show this update again 
 
Update for Windows XP (KB976098)
Download size: 500 KB , less than 1 minute 
Install this update to resolve issues caused by revised daylight saving time and time zone laws in several countries. This update enables your computer to automatically adjust the computer clock on the correct date in 2009. After you install this item, you may have to restart your computer.  Details... 
Don't show this update again 

--

Optional software updates 
 
Update for Root Certificates [November 2009] (KB931125)
Download size: 316 KB , less than 1 minute 
This item updates the list of root certificates on your computer to the list that is accepted by Microsoft as part of the Microsoft Root Certificate Program. Adding additional root certificates to your computer enables you to use Extended Validation (EV) certificates in Internet Explorer 7, a greater range of security enhanced Web browsing, encrypted e-mail, and security enhanced code delivery. After you install this item, you may have to restart your computer. Once you have installed this item, it cannot be removed.  Details... 
Don't show this update again 
 
Update for Root Certificates
Download size: 295 KB , less than 1 minute 
This item updates the list of root certificates on your computer to the list that is accepted by Microsoft as part of the Microsoft Root Certificate Program. Adding additional root certificates to your computer enables you to use Extended Validation (EV) certificates in Internet Explorer 7, a greater range of security enhanced Web browsing, encrypted e-mail, and security enhanced code delivery. After you install this item, you may have to restart your computer. Once you have installed this item, it cannot be removed.  Details... 
Don't show this update again 
--
Ant @ http://antfarm.ma.cx and http://aqfl.net. Please do not IM/e-mail me for technical support. Use the forum! Disclaimer: The views expressed in this posting are mine, and do not necessarily reflect the views of my employer]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23389216</guid>
<pubDate>2009-11-24 13:54:08</pubDate>
</item>

<item>
<title>Killing the source - Google bans advertisers, not just ads</title>
<link>http://www.dslreports.com/forum/remark,23383776</link>
<description><![CDATA[Rather than continuing to play whack-a-mole by taking down fraudulent ads for phony products and shady sellers who rip off customers, Google is banning the advertisers. They whack the affiliates who put up the ads. Google says they have ways to detect banned advertisers who try to create new accounts. It will be interesting to see how effective their methods are. 

... Google has made a minor shift in its policy that has major implications. Up until now it has taken action against ads, not advertisers. If an ad violated one of Google&#146;s terms of use, the search giant would take it out of circulation, but that&#146;s it. Google briefed TBM on its new policy: It will now ban the advertiser, not the ad, effectively neutering the advertiser&#146;s ability to shift from one ad and shell site to another. Think of it like the struggle between the police and a graffiti vandal. Up until now Google has only been erasing the tags after they&#146;ve been put up. Going forward, they&#146;re going to take away his spray cans and put a GPS collar on him, making sure he never does it again. ...
Complete article here.

Related article here. 
--
The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding. -- Justice Louis D. Brandeis]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23383776</guid>
<pubDate>2009-11-23 14:06:22</pubDate>
</item>

<item>
<title>News Corp, MS Teaming Up In Plan To Pay for Obscurity ?</title>
<link>http://www.dslreports.com/forum/remark,23384341</link>
<description><![CDATA[From: Wired Epicenter
 quote: News Corp has rattled its saber in Google&#146;s direction for months, as chairman Rupert Murdoch accused the company of &#147;stealing stories&#148; by posting links and short article excerpts on its search engine. Now, he appears ready to strike, by pulling his company&#146;s news articles from Google and putting them on Microsoft search engines instead, in return for payment.

A little piece of code in each article that would make articles from News Corp publications such as the Wall Street Journal, New York Post and several international titles visible only to search engines that pay. According to the Financial Times (subscription required), Google&#146;s rival Microsoft intends to do exactly that.

In the short term, this could be disastrous to News Corp&#146;s publications.

Google doesn&#146;t need the news &#151; or, to be more precise, it doesn&#146;t need any specific news source. If bloggers have taught the world anything, it&#146;s that one journalist&#146;s facts can become the basis of another journalist&#146;s story. (Case in point: This article is a follow-up to the Financial Times article and includes similar information, albeit with another layer of analysis.) If the Wall Street Journal becomes invisible to Google, people who go there to find the news will simply click on articles from other publications that cover the same story.

Full story at above link.
--
siljaline 

Support your local NGO]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23384341</guid>
<pubDate>2009-11-23 15:44:48</pubDate>
</item>

<item>
<title>IE Bug Leaks Private Details From 50 Million PDF Files</title>
<link>http://www.dslreports.com/forum/remark,23387965</link>
<description><![CDATA[From The Register
23rd November 2009 - said by Dan Goodin :A bug in Microsoft's Internet Explorer browser is causing more than 50 million files stored online to leak potentially sensitive information that could compromise user privacy, a security researcher said.

The documents stored in Adobe's PDF format display the internal disk location where the file is stored, an oversight that can inadvertently expose real-world names and login IDs of users, the operating system being used and other information that is better kept private. The data can then be retrieved using simple web searches.

Google searches such as this one expose almost four million documents residing on users' C drives alone. Combined with searches for other common drives, the technique exposes more than 50 million files that display the local disk path, according to Inferno, a security researcher for a large software company who asked that his real name not be used.

"If they have those kind of PDFs, somebody can use search engines to find out user names or do more reconnaissance on the operating systems used," he told The Register. "That actually invades the privacy of a user."

The potentially sensitive data is included in PDFs that have been printed using Internet Explorer. The full path location is appended to its contents as soon as the Microsoft browser is used to print the document. Although the data isn't always exposed when the document is viewed with Adobe Reader, it is easily readable when the file is opened in editors such as Notepad, and the text is also available to Google and other search engines.

This PDF, for example, was stored at C:\Program Files\Wids7\WizardReport.htm at time of printing. The path makes it clear that the file was stored on a Windows machine that has software from Worldwide Instructional Design System installed. Other PDFs give up directory names that reveal authors, projects or other data that may have been designated confidential.

The only way to remove the path is erase the text in an editor and save the document.

All versions of IE suffer from the bug. A Microsoft spokeswoman said company engineers are working to reproduce the reported behavior. "We can confirm that this is not a vulnerability," she wrote in an email.

Adobe representatives didn't reply to requests for comment. Inferno's report is here.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23387965</guid>
<pubDate>2009-11-24 09:37:51</pubDate>
</item>

<item>
<title>Zero-day Flaws in Firefox Extensions Found</title>
<link>http://www.dslreports.com/forum/remark,23387213</link>
<description><![CDATA[Extensions in the Mozilla world do not follow any security model, and Firefox, for instance, trust extension code completely. They aren't isolated or sandboxed, and can even modify one another. Any Mozilla application supporting extensions suffers from this issue, and the code is completely platform independent. It can lead to fully compromised systems. 

When looking into this problem, researchers found several issues in popular Firefox extensions Sage 1.4.3, InfoRSS 1.1.4.2, and Yoono 6.1.1 (including all previous versions). A flaw in Sage, for instance, allows a malicious RSS feed to change your NoScript settings, adding sites to NoScript's whitelist. Flaws in IngoRSS and Yoono can even lead to fully compromised systems. 

http://www.osnews.com/story/22513/Zero-day_Flaws_in_Firefox_Extensions_Found]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23387213</guid>
<pubDate>2009-11-24 02:30:33</pubDate>
</item>

<item>
<title>[VULNERABILITY] IE6 and IE7 0-Day Exploit Reported</title>
<link>http://www.dslreports.com/forum/remark,23378073</link>
<description><![CDATA[SANS | 2009-11-22

http://isc.sans.org/diary.html?storyid=7624

A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by attackers to compromise a vulnerable system. This issue is caused by a dangling pointer in the Microsoft HTML Viewer (mshtml.dll) when retrieving certain CSS/STYLE objects via the "getElementsByTagName()" method, which could allow attackers to crash an affected browser or execute arbitrary code by tricking a user into visiting a malicious web page.

Symantec has verified the exploit:

November 21, 2009 - "A new exploit targeting Internet Explorer was published to the BugTraq mailing list yesterday. Symantec has conducted further tests and confirmed that it affects Internet Explorer versions 6 and 7 as well. The exploit currently exhibits signs of poor reliability, but we expect that a fully-functional reliable exploit will be available in the near future... To minimize the chances of being affected by this issue, Internet Explorer users should ensure their antivirus definitions are up to date, disable JavaScript and only visit Web sites they trust until fixes are available from Microsoft."Symantec: http://www.symantec.com/connect/blogs/zero-day-internet-explorer-exploit-published
SecurityFocus BugTraq: http://www.securityfocus.com/archive/1/507984/30/0/threaded
--
Smokey's Security Forums http://www.smokey-services.eu/forums/
Smokey's Security Weblog http://smokeys.wordpress.com/
Official Jetico Inc. Support Forums http://www.smokey-services.eu/]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23378073</guid>
<pubDate>2009-11-22 05:37:05</pubDate>
</item>

<item>
<title>Google Chrome OS Security - Sandboxing, Code Verification</title>
<link>http://www.dslreports.com/forum/remark,23365524</link>
<description><![CDATA[From The Register
19th November 2009 -   said by Cade Metz :Google open sources early Chrome OS

Today, via webcast from its Mountain View headquarters, Google vp of product management Sundar Pichai and engineering director Matthew Papakipos unveiled an early version of Chrome OS, the much-discussed browser-based operating system that company first announced this past summer. This initial build has been open-sourced as the Chromium OS, with Pichai saying that outside developers will be able to work hand-in-hand with internal Google coders on the same code tree.

Along with the code, the company has released some user interface experiments and design documents sketching out intentions for future development.

Google also said the OS - "initially" intended for netbooks - would debut "in a year." This summer, the company had said it would arrive in the second half of 2010.

The OS is essentially Google's own Chrome browser running atop a Googlized Linux. Pichai said that application running on chrome OS would be browser-based application. No, applications will be run locally. Likewise, he said, all user data will be stored "in the cloud," meaning on web services provided by Google and others.

The OS is designed to boot quickly. The company demonstrated the Os booting in 7 seconds. The OS boots entirely from flash-based devices - not traditional spinning hard drive media.

Though Pichai said he expected it to change over the next year of development, he also demoed the operating system's current user interface. The, yes, browser-like interface uses tabs to juggle web-based applications. This isn't that different from what you'd expect from today's browser, but there's also an new, in-browser window pane that pops up to display certain media files.

Each application will be run its own security sandbox, and Google says that every time the OS boots it verifies the integrity of its own code.

Chrome OS will run on both x86 and ARM chips, and Google is working with multiple partners on commercial devices, including Acer, Asus, Freescale, Hewlett-Packard, Lenovo, Qualcomm, Texas Instruments, and Toshiba. Google has very specific ideas on how these machines will be designed. As said, the OS does not support hard drives, and Pichai said there would be other hardware restrictions as well.

Pichai declined to say how much Chrome OS devices would cost. But he said prices would be not unlike "what computer buyers expect today."

You can visit the code base here, the user interface experiments here, and the design documentation here.

[some emphasis added]

The design documents feature a section describing system hardening.

More info:
&#149; Everything You Need To Know About Chrome OS
&#149; Google's Chrome OS revealed -- with video!
&#149; Google&#146;s Chrome OS &#150; First Look]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23365524</guid>
<pubDate>2009-11-19 14:13:03</pubDate>
</item>

<item>
<title>looking for an on-demand scanner</title>
<link>http://www.dslreports.com/forum/remark,23381954</link>
<description><![CDATA[I'm looking for something along the lines of an on-demand anti-virus scanner. A stand alone program that can scan and clean, but only when loaded. I don't want any processes running in the background when it's not in use.

Reason being is that I use a somewhat older laptop to run windows 7, and also play WoW. My framerates suffer even more with an active scanner running in the background. And the start up time increases annoy me.

I'm not terribly worried about the risks involved in not having an active scanner. I don't browse porn, don't download shady torrents/files, and I run no-script along with site advisor in firefox.

Any suggestions would be appreciated. =)]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23381954</guid>
<pubDate>2009-11-23 05:08:36</pubDate>
</item>

</channel>
</rss>
