Memex 1.1

Well, well. Even I’m surprised by this.

Following in the footsteps of Germany last week, France is now advising its population to use an alternative browser pending a patch for an Internet Explorer vulnerability.

The French Computer Emergency Response Team (CERT) published an advisory on Friday January 15 stating “pending a patch from the publisher, CERT recommends using an alternative browser.” In the advisory Internet Explorer 7 and 8 are both listed despite Microsoft confirming the vulnerability is only exploitable on Internet Explorer 6.

Last week the German Federal Office for Security in Information Technology (BSI) issued a similary advisory urging its population to stop using IE. According to the BSI the flaw will, put simply, “perform reconnaissance and gain complete control over the compromised system.” The BSI noted that even running Internet Explorer in Protected Mode isn’t enough to stop the flaw. Microsoft issued further insight into the vulnerability this morning in a company blog posting. The software giant confirmed the exploit is only effective against Internet Explorer 6.

Wonder if French and German users will pay any attention to this.

Latest spam message:

We wish to inform you that you are one of the winners of
STATE EDUCATIONAL STUDENT AWARD July 2009,your e-mail address won and
Therefore you have been approve for a lump sum of (900.000.00 Usd)
Nine Hundred Thousand Dollars to support your Education through the
internet Wedsite .This promotional program takes place every year,and
is promoted and sponsored by eminent personalities like the Sultan of
Brunei,Billgate of Microsoft and other corporate organizations.

N/B: This is to IMPROVE THE LEVEL OF EDUCATION WORLDWIDE AND TO
ENCOURAGE THE USE OF INTERNET AND COMPUTERS WORLDWIDE.

PAYMENT PROCESSING FORM FILL IT AND SEND IT TO THE BANK FOR CLAIM .

(1) My Name is ……….i came from……..i hereby apply to claim
my prize that i won, as winner of the STATE EDUCATIONAL STUDENT
AWARD,i am requested to claim my prize of…… which my school email
id was among winners of the year July 2009.
(2) AGE………..(3) SEX…………(4) COUNTRY…………
(5) PHONE NUMBER ………(6) OCCUPATION:………..

Contact the bank and call them:
Name: ALI HASSAN
Email: fund_transferofficedept@yahoo.com
Email: trustbankplc@rocketmail.com
PRO ACCOUNT Officer In charge.
Phone:+234-704-0960-772.

Can’t wait!

Er, who falls for this crap? Somebody must.

According to the latest report (pdf format) from MessageLabs, 90.4% of all email is spam. The percentage is unchanged from last month. Other highlights from the report:

• Viruses – One in 269.4 emails in June contained malware (an increase of 0.06% since May)
• Phishing – One in 280.4 emails comprised a phishing attack (unchanged since May)
• Malicious websites – 1,919 new sites blocked per day (an increase of 67.0 % since May)
• 58.8% of all web-based malware intercepted was new in June, an increase of 24.6% since May
• The Cutwail Botnet bounces back
• 83.2% of all spam was sent via botnets in June
• Image spam continues, accounting for 8-10% of all spam in June
• Instant Messaging malware increases – 1 in 78 IM-based hyperlinks point to malicious websites

Tech Review reports that a team of researchers at the Georgia Institute of Technology has come up with a potentially more efficient approach to identifying spam. The researchers analyzed 25 million e-mails and discovered several characteristics that could be gleaned from a single packet of data and used to efficiently identify junk mail. For example, legitimate email tends to come from computers that have a lot of ports open for communication, whereas bots tend to keep open only the SMTP port. They also found that geographical mapping of IP addresses helps. Spam, it turns out, tends to travel farther than legitimate email.

This tweet by Rory Cellan-Jones sent me to Twittercounter, which produced this chart:

Suggests that something strange is going on. Compare, for example, with the chart for my account, which accurately reflects data coming from email notifications from Twitter.

Hmmm… Is a spambot signing up ‘followers’ of Rory?

LATER: Now he’s back to his original track.

Which suggests that there’s something wrong with Twittercounter?

Moral: put not your faith in these statscounting services.

If you want a measure of how far we’ve moved from the days of simple HTML, then just install the NoScript add-on for Firefox. It detects every script that a site is running within the page and asks you to make a decision about whether to allow it or not. It’s an eye-opener. The image shows what happened when I opened a normal page from the Wall Street Journal.

The sad fact is that there’s so much AJAX-like stuff out there that running NoScript is a bit of a pain. The old adage about the price of liberty being eternal vigilance needs updating. The price of online security is endless hassle.

Thoughtful article by Glyn Moody.

Email is dying. Time and again I come across comments to the effect that people have given up on their email inbox, and simply junked their messages. Increasingly, people are turning to Twitter, Facebook and LinkedIn as their messaging medium. It’s not hard to see why. These are opt-in services: you get to choose who can contact you, unlike email.

This has led to the scourge of spam, which now represents 94% of all email, according to Google’s Postini subsidiary. A classic Tragedy of the Commons has resulted, whereby a few selfish individuals exploit and ultimately destroy a resource used by all. Sadly, it looks like the battle against spam is lost; even though services like Gmail offer extremely efficient filtering in my experience, it’s a poor substitute for a messaging service that can assume that you want to see everything that is sent to you, because only people of interest are allowed to contact you.

The more Facebook and Twitter spread, the more people will be turning to these opt-in networks for their communications; email, as a result, will dwindle in importance, turning into a kind of digital wasteland inhabited mostly by those too poor, uninformed or lazy to move on, and by spamming parasites who prey on them. I don’t imagine that Thunderbird wishes to become the software of choice for either…

This makes sense. As our communications ecosystem evolves, so too should the software. From now on we will need comms clients wwhich do everything — including email. I guess that’s where Tweetdeck et al are headed. Maybe that’s how Thunderbird should evolve?

Salutary blog post by Dave W.

I switched because I was Mired In Malware.

I got a new EeePC 1000HE last week, and after just a few hours of use, it’s infected with a rootkit virus of some kind. Really clever. Spent three hours last night trying to eradicate it, but in the last three or four years, the malware guys have gotten a lot more clever.

Contemplating switching to the Hackintosh flavor of netbook.

Ran Ad-Aware, getting ready to run Spybot. Downloaded Combofix. I’m going to try to resurrect this baby. Also considering doing a fresh install of Windows but that sounds like more work that Leopard. And then you’re still using Windows.

Yep. I switched to Mac in 1999. Never had any trouble since. Touch wood.

JUST IN: This via Glyn Moody:

Appointments for cancer patients had to be rescheduled after a computer virus infected the networking systems at two Scottish hospitals last week.

The infection of laboratory PCs at the Stobhill and Gartnavel General hospitals meant the bookings of 12 patients attending the Beatson West of Scotland Cancer Care Centre in Glasgow were postponed, The Glasgow Herald reports. Systems were taken offline for two days to allow computer technicians to clean up the mess…

Now, I wonder which OS they were running.

Tim Weber’s report from the Davos discussion.

The threat of cybercrime is rising sharply, experts have warned at the World Economic Forum in Davos.

They called for a new system to tackle well-organised gangs of cybercriminals.

Online theft costs $1 trillion a year, the number of attacks is rising sharply and too many people do not know how to protect themselves, they said.

The internet was vulnerable, they said, but as it was now part of society's central nervous system, attacks could threaten whole economies.

The past year had seen “more vulnerabilities, more cybercrime, more malicious software than ever before”, more than had been seen in the past five years combined, one of the experts reported.

But does that really put “the internet at risk?”, was the topic of session at the annual Davos meeting.

From Observer.co.uk.

Google placed the internet on a blacklist today after a mistake caused every site in the search engine’s result pages to be marked as potentially harmful and dangerous.

The problem affected internet pages across the whole planet, and lasted for around 40 minutes before engineeers were able to fix it.

The glitch centred on Google's malware detector, which is designed to keep internet users from visiting sites Google believes may install malicious software when users browse them. Google blamed “human error” when an engineer tried to add one web address to the list of those deemed suspicious, and mistakenly added them all.

“We periodically receive updates to that list and received one such update to release on the site this morning. Unfortunately (and here’s the human error), the URL of ‘/’ was mistakenly checked in as a value to the file and ‘/’ expands to all URLs. Fortunately, our on-call site reliability team found the problem quickly and reverted the file,” Google said in its official blog.

The incident occurred at around 2.40pm.

Phew! I thought it was just me.

Conventional wisdom is that phishing represents easy money. In this paper we examine the economics that underly the phenomenon, and find a very different picture. Phishing is a classic example of tragedy of the commons, where there is open access to a resource that has limited ability to regenerate. Since each phisher independently seeks to maximize his return, the resource is over-grazed and yields far less than it is capable of. The situation stabilizes only when the average phisher is making only as much as he gives up in opportunity cost.

From “A Profitless Endeavor: Phishing as Tragedy of the Commons” by Cormac Herley and Dinei Florencio of Microsoft Research.