Security Today

Microsoft fixes the "TimerStop" activation hack.

It appears that the Windows Vista has spontaneously activated its Problem Reports and Solution engine, which is itself a broken implementation of the now-familiar Windows XP error reporting dialog box (sadly, Microsoft decided to pull their Vista implementation of the Microsoft WSYP program in lieu of consumer demand for Vista DRM). Today I got a dialog box that asked me if I wanted to check on the status of the sixty-two errors that have been reported to Microsoft since I installed Vista on my laptop over the New Years holiday weekend.

So I submitted the reports from my laptop which resulted in this amazingly informational status update page. {sigh}

Then I got a call from a friend of mine, whose Vista Ultimate installation had come back with this error message:

"Windows has detected that an unauthorized change was made to your Windows license. This alert appears when a copy of Windows is unlicensed or if Windows activation has been bypassed."

--oops!

Looks like Microsoft finally "fixed" the hack that was used to bypass the Vista Activation, which was reported to be the TimerStop fix.

But have no worries, my friend, the hackers of the world have been busy! Just like the AACS protection scheme that is used to protect the Blu-Ray HD-DVD content, it appears that the Vista Activation system has been completely, permanantly and irreversably circumvented as well, this time by means of sheer brute force.

So, if you're keeping score: Hackers +2, Microsoft +0.

-Joel Helgeson

Microsoft: Bringing *.* to /dev/null since 1975

Nigerian 419 Scams

The real problem is ignorant users "There's a Sucker Born Every Minute" - Unknown.             (often incorrectly attributed to P. T. Barnum)

Nigerian 419 Scammers have been around since the 1970's. Back then, they would type up their letters and mail them out to mailing lists of corporate executives. I remember when I got my first Nigerian scam letter via international mail back in the early 90's when I was running my first corporation. It was pretty obvious to me that it was a fraud. I shared it with my father who told me that he'd been getting the same letter periodically for years, dating back to the mid 70's. If I had only known then what the 419 scam would have become, I would have framed that letter.

 

My point:

People have been falling for that same old scam for decades. Funny thing is that the 419 scammers are just as surprised as we are that people keep falling for it - therefore they see it as their responsibility, their duty, to defraud us "rich Americans". This pathetic scam still works. In fact, the only innovation the scam has seen since moving online was WHEN THEY STARTED WRITING THEIR MESSAGES IN ALL CAPS.

 

I happen to be a landlord. I had a tenant that was behind on her rent and her boyfriend pulled me aside and promised that he would be able to pay everything later that month. He stated that he had a rich uncle pass away and was expecting his inheritance.  I sarcastically quipped, "This rich uncle didn't happen to be from Nigeria..." whereupon his face went slack and replied with "how did you know!?".

EV SSL Certificates, are they worth it?

In this post:

EV SSL - What is it? Why Extended Verification doesn't work Stanford U. and Microsoft conclude that it hurts security The criminals are getting better, and better The real problem is naive users, not security certificates

EV SSL - What is it?

Extended Validation or EV SSL Certificates are the newest, neatest iteration of encryption certificates that are intended to supply "enhanced security features".  Secure Sockets Layer (SSL) certificates have been in use for years, it is the internet equivalent of a Notary Public that enables websites to encrypt their traffic using HTTPS instead of the standard HTTP.  I covered the subject of SSL certificates in the entry I wrote in the Blackwell Encyclopedia of Management: Management Information Systems.

 

My friends over at SpiDynamics have written an excellent post on the subject, but in my opinion they are asking the wrong questions:

"With the explosion of phishing attacks and identify theft, a new form of SSL certificate is ready to hit the Internet. This new certificate is known as an Extended Validation (EV) SSL certificate and is designed "to provide users with a trustworthy confirmation of the identity of the entity that controls the website they are accessing". In addition to the confidentiality provided by traditional SSL certificates, EV SSL certificates also aim to instill trust in web users by validating the identity of the web site proprietor. Is this the silver bullet that we've been looking for or a wolf in sheep's clothing?"

I say EV SSL is a sheep in wolf's clothing.  It looks good, but does it help anything?