Home > Daily Link List > Daily Link List

Daily Link List

January 27th, 2007 Leave a comment Go to comments

I know I throw these up every now and then.. They're my way of sharing short blurbs without long blog posts... I've got a few things I want to mention (actually quite a few) so... on with the show.

The first isn't really a list... It's some interesting spam that I received today in the comments of a post...

Author : Spam Bot (IP: 128.61.82.147 , r82h147.res.gatech.edu)
E-mail : spamtester@gmail.com
URI :
Whois : http://ws.arin.net/cgi-bin/whois.pl?queryinput=128.61.82.147
Comment:
Please forgive this post, it is simply a test to see if your site is spamable. Code: XXXXXXXX

I've X'd out the code in case the bot is going to return to confirm it's existence. Nothing to comment, except that if someone is actually testing for research's sake, they should provide a link to explain themselves... if it's a spammer.. why not just spam like all the other spammers.. why test first..

Now... On with the links.

The first link belongs to a blog post by a good friend of mine, J_K9. It's a decent write-up introducing Metisse, which is "not just another 3D Desktop"... The description of it proves interesting... and the videos are definitely worth watching.

Next we've got the link that everyone and their brother has blogged about already, which is why I'm not dedicating a full post to it... most people have already read about it... Basically... GoDaddy is run by sniveling cowards. They also don't respect their customers... it makes me glad that they aren't my registrar.

Bill, from Bits from Bill, questions what defines a vulnerability. I enjoyed reading the post but ultimately I have to disagree with him... He looks at things like the new Microsoft Word 2000 "0-Day" Vulnerability. By Bill's definition these are flaws... His reasoning: First he defines vulnerable (Vulnerable – “open to assault; difficult to defend; capable of being wounded or hurt”), then he blames user interaction... To me, user interaction still leaves you "open to assault"... Let's look at this from another angle. Let's say the foundation of your house has a crack in it... You might say you have a flaw in your foundation... I might say that your foundation is vulnerable to earthquakes... These are both true statements.. If a flaw can make you vulnerable... then a flaw is a vulnerability. In fact, "define: Vulnerability" in Google returns this definition: "A flaw or weakness in system security procedures, design or implementation that could be exercised (accidentally triggered or intentionally exploited) and result in a harm to an IT system or activity"

Up next is a post from Matt Blaze's Exhaustive Search. He's asking that security researchers and crypt-analysts stop using terms such as "breaking into" and "cracking" because of the negative connotations that they have. I like the idea... so now the question is... Can we find new terms that we can all agree on?

I guess my quick list of short posts is turning into something rather long... but I swear I'm almost half done.

One of the things I've done with my blog is join the Security Bloggers Network... which provides a nice RSS feed with several blogs all rolled into one. One of the blogs belongs to the "founder" of SBN, Alan Shimel, who has a... well... interesting blog. I'm quite often surprised, shocked and sometimes left shaking my head at posts that he writes (I've never met him, so I don't know if he's gutsy or stupid :) (although I'm going with gutsy))... but sometimes they inform me of something I didn't know. Today I thought I'd been informed of something I wasn't aware of... a secret meeting on security being held by Microsoft. Then Matasano cleared things up for me. The meeting has an agenda online (complete with information on who could register and how to register)... Then I remembered why it seemed so familiar... there'd been an email to one of the mailing lists inviting ISOI attendees to dinner and drinks (membership to the mailing list is required).

Item 1 Million on today's daily link list: A new version of honeytrap has been released.  That was so short that I'm going to stick a second link in the same paragraph: An article claiming that 25% of computers on the internet are involved in botnets.

Another interesting tidbit was an article on Emergent Chaos regarding the Three Types of Authentication. The linked article (and driver for the post) is definitely worth the read.

One more site that will only get a brief mention.... Security Bullshit... weekly cartoons based around the security industry... So far there are 4 and they are all worth a laugh.

Lastly (I think), we have a small write-up by Anton Chuvakin on the ROI on Getting your Ass Whooped. It was inspired by another blog post, one with non-humourous content, but even without reading it, you're sure to get a kick out of Anton's post.

Categories: Daily Link List Tags:

This website uses IntenseDebate comments, but they are not currently loaded because either your browser doesn't support JavaScript, or they didn't load fast enough.

  1. J_K9
    January 27th, 2007 at 05:49 | #1
    Reply | Quote

    I can back up the criticisms of GoDaddy with a short story of my own. I ordered an SSL cert from them a few months ago, and received a code with which I could (supposedly) log in and download the cert. I tried the code on the GoDaddy site but it just wouldn’t work. So, in despair, in contacted them – I hadn’t found a way of sending a new code or resetting it. Can you guess what they replied? Let me show you:

    Dear Sir/Madam-

    Thank you for contacting Online Support.

    Please follow the instructions below to activate your SSL certificate credit and begin the verification process.

    IF YOU ARE HOSTING YOURSELF OR WITH A THIRD PARTY PROVIDER:

    . Go to our homepage.
    . Select ‘My Account’ from the top of the page.
    . Log in using your account username (which may be the same as your customer number) and password.

    If you have trouble logging in, our password reset form may help you. You can find this form by selecting ‘Password Recovery’ from the ‘Manage’ drop-down menu in the upper right corner of the page.

    Once logged in just follow these steps:

    . Under the “Other Stuff” icon click on the “Secure Certificates” link.
    . From the SECURE CERTIFICATES page click on the “Setup New Certificate” link.*
    . Select hosting option “At a third-party provider”.
    . Click the “Start a New Certificate Request” button.*

    *NOTE: This action will use a Certificate credit.

    You will be redirected to the Starfield Technologies Login page.

    . Go to the Starfield account login page Starfield Account Login Page
    . Select “Account Login”, if you already have a Starfield Technologies account or “Log In/Create Account”, if you are new customer.
    . Log in using your account username and password or fill out the requested information to create a new account and click “Create Account”.

    If you have trouble logging in or have forgotten your password, use our password reset form. You may find this form via the following link:

    Password Reset Form

    . In the MANAGE CERTIFICATE CREDITS page click the “Unused Credits” link.
    . Read the “Secure Certificate Services Subscriber Agreement” and select either “Accept” or “Decline”** at the bottom of the page.

    **NOTE: Selecting “Decline” will return you to the previous page.

    . Step 1 – In the APPLY FOR YOUR CERTIFICATE page select the type of certificate that you are applying for; “Business” or “Individual”.
    . Step 2 – Enter the Certificate Requestor Information.
    . Step 3 – Copy and paste your server generated Certificate Signing Request (CSR) in the “CSR” field; select “Web Server Type” from the drop down menu.
    . Select “Cancel”*** or “Continue”.

    ***NOTE: Selecting “Cancel” will cancel your certificate request.

    . Confirm that ALL information is correct.
    . Select “Back” to edit or “Continue”.
    . Click “Done” at the bottom of the page.
    . Log out of your Starfield account.
    . Fax the required Proof of Identity and financial documents to Starfield RA.

    IF YOU ARE HOSTING WITH US:

    . Go to our homepage.
    . Select ‘Login’ from the ‘Manage’ drop-down menu in the upper right corner of the page.
    . Log in using your account username (which may be the same as your customer number) and password.

    If you have trouble logging in, our password reset form may help you. You can find this form by selecting ‘Password Recovery’ from the ‘Manage’ drop-down menu in the upper right corner of the page.

    Once logged in just follow these steps:

    . Under the “Other Stuff” icon click on the “Secure Certificates” link.
    . From the SECURE CERTIFICATES page click on the “Setup New Certificate” link.
    . Select one or two years.
    . Select “Here at XXXCompanyNameXXX”.
    . Click on the “Setup your hosting account” link or “Click here to view available hosting plans”.
    . Purchase and/or setup your hosting account.
    . Specify domain name, username and password.
    . Choose “Enable SSL”.
    . Click “SAVE SETTINGS”.*

    *NOTE: This action will use a Certificate credit

    Your hosting will be available for website upload after a brief setup period; however your domain name must also be pointed to our hosting servers.

    . You will be redirected to the Starfield Technologies Log in screen.
    . Select “Account Log In” or “Log In/Create Account”.
    . Enter your User ID and password or all information to create a Starfield account.
    . Click “Log In” or “Create Account”.

    If you have trouble logging in or have forgotten your password, use our password reset form. You may find this form via the following link:

    Password Reset Form

    . Once you are logged in to your Starfield account select read the “Secure Certificate Services Subscriber Agreement” and select either “Accept” or “Decline”.**

    **NOTE: Selecting “Decline” will be return you to the previous page.

    . In the MANAGE CERTIFICATES page, click the “Unused Credit” link.
    . Step 1 – In the APPLY FOR YOUR CERTIFICATE page, select the type of certificate; “Business” or “Individual”.
    . Step 2 – Enter Certificate Requestor Information.
    . Select “Cancel”*** or “Continue”.

    ***NOTE: Selecting “Cancel” will cancel the request

    . Confirm that ALL information is correct and select “Back” to edit or “Continue”.
    . Click “Done”.
    . Log out of your Starfield account.
    . Fax the required Proof of Identity and financial documents to Starfield RA.

    Sincerely,

    Chris P.
    Online Support
    Technician

    Great. The guy ticked a few boxes and replied. However, that was not an answer to my question… Good job, support team. I replied again asking for help with my account (it wasn’t letting me log in with my login details – I needed specific help, not a reply generated by a few ticked boxes and a script), and they replied with a password reset form :roll: I’d already TRIED that.

    The company is useless. I don’t think I’ll be using any of their services any time soon.

  2. J_K9
    January 27th, 2007 at 05:55 | #2
    Reply | Quote

    Thanks for the links. By the way, what do you think of the ‘25% computers on the internet are part of a botnet‘ article? I’m having trouble believing that the percentage is that high.. Perhaps 15-20%, but 25%?

    Oh, and thanks for the trackback :)

  3. Datasecurity
    January 27th, 2007 at 12:02 | #3
    Reply | Quote

    Hmm.. maybe we need to tell more jokes in the blog. =)

  4. Tyler Reguly
    January 27th, 2007 at 12:30 | #4
    Reply | Quote

    J_K9: 1and1 tech support isn’t much better… I have to explain to them how to do the tasks I’m asking about… Hostprince was the worst though… I wanted a custom application installed (a C program I wanted my page to interface with), so I asked for the hell of it… they said no problem, they’d install it… but then I had to tell them how to compile it.

    DataSecurity: I enjoy your blog… especially having taken part in portions of PCI lately… which is why I still shared your blogs link :)

  5. Bill Pytlovany
    January 27th, 2007 at 13:10 | #5
    Reply | Quote

    Hey Tyler,

    Glad to hear you stop by my Blog and appreciate you bringing up the discussion.

    I’ll admit the whole overblown storm coverage had me in rant mode. Microsoft has posted information about the new Word issue.
    http://www.microsoft.com/technet/security/advisory/932114.mspx
    They’re calling it a vulnerability so I guess if they admit it’s a vulnerability I can deal with it. :)

    Bill

  1. No trackbacks yet.