Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror

Comment Re:Same as before. (Score 1) 80

The proxy setting will show up - and can be removed with 2 clicks - in a HijackThis report. While Trend Micro bought it and supposedly has changed something (not sure what...) HJT remains a useful tool for anyone combating malware and ransomware.

The Firefox extension AC replied about will show up in a log from ComboFix though CFX won't remove the proxy by itself at this point -- perusing a ComboFix log features loads of information about a system and its infections.

Security

Submission + - Openwall Linux 3.0: no SUIDs, anti log spoofing (openwall.com) 2

solardiz writes: Openwall GNU/*/Linux (or Owl for short) version 3.0 is out, marking 10 years of the project. Owl is a small security-enhanced Linux distro for servers, appliances, and virtual appliances. Two curious properties of Owl 3.0: no SUID programs in default install (yet the system is usable, including password changing) and logging of who sends messages to syslog (thus, a user can't have a log message appear to come, say, from the kernel or sshd). No other distro has these. Other highlights of Owl 3.0: single live+install+source CD, i686 or x86_64, integrated OpenVZ (host and/or guest), "make iso" & "make vztemplate" in included build environment, ext4 by default, xz in tar/rpm/less, "anti-Debian" key blacklisting in OpenSSH. A full install is under 400 MB, and it can rebuild itself from source.

Comment Re:Obligatory question (Score 1) 380

"By morning Ira figured out a solution. Selenium may be a poison to the nitrogen-based aliens as arsenic is to carbon-based life-forms, based on their similar positions in relation to each other on the periodic table. Ira's two worst students, Deke and Danny Donald, reveal that selenium is the active ingredient in Head & Shoulders dandruff shampoo."

- Evolution, the movie :)

Comment Re:A new domain specific language is born (Score 2, Informative) 125

NSE isn't actually domain specific, it's the tried, tested, and fast Lua (with extensions to make it fit with the Nmap scanner). You get the speed of Nmap to find hosts/ports plus the NSE scripts backing it up to do deeper probes.

Wireshark, Snort, Nmap, and plenty of other tools use Lua for scripting, so it's a valuable language to learn. I recommend it!

Open Source

Submission + - Nmap Developers release a picture of the Web (nmap.org)

iago-vL writes: The Nmap Project recently posted an awesome visualization of the top million site icons (favicons) on the Web, sized by relative popularity of sites. Once again proving that they're the kings of scanning, this project used the Nmap Scripting Engine, which is capable of performing discovery, vulnerability detection, and anything else you can imagine with lightning speed. We saw last month how an Nmap developer downloaded 170 million Facebook names, and this month it's a million favicons. I wonder what they're going to do next?

Comment Re:How uneconomical is speed enforcement? (Score 1) 636

This is a really good point. The city of Madison, Wisconsin has a ridiculous team called TEST - Traffic Enforcement Safety Team. Funded with tax dollars from the police department's Field Operations budget, when TEST lays a speed trap, it means they sit one officer in an inconspicuous lawn chair at the end of a straightaway where speeding is common. This officer has a radio and a laser speed measuring device.

They then hide as many as SEVEN squad cars around the corner, completely out of sight. Usually one or two are higher-ranking undercover cars; in Madison, these are usually driven by police sergeants. The lawn chair officer proceeds to laser every car and radios in any going as few as 7-8 miles per hour over the speed limit, where a regular squad pulls out behind that person and pulls them over just around the bend or on a subsequent block so the traffic stop isn't visible to drivers on the straightaway.

This coupled with Madison's artificially low speed limits in many of these places makes for an easy revenue stream, but it can't possibly be a net positive, especially if some of these tickets are fought in court (like the 8mph ones -- hard to argue that 8mph over the already-low limit through a CEMETERY is particularly unsafe.) The court costs, plus officer salaries, plus the fact that while those squads are waiting for speeders the officers and their equipment are not doing productive things like combating the city's growing gang problem can't possibly make the whole thing a useful endeavor. Just one more reason I'm moving elsewhere...

Government

FCC Allows Blocking of Set-Top Box Outputs 288

bth writes with this excerpt of an AP story as carried by Yahoo: "Federal regulators are endorsing Hollywood's efforts to let cable and satellite TV companies turn off output connections on the back of set-top boxes to prevent illegal copying of movies. ... In its decision Friday, the agency stressed that its waiver includes several important conditions, including limits on how long studios can use the blocking technology. The FCC said the technology cannot be used on a particular movie once it is out on DVD or Blu-ray, or after 90 days from the time it is first used on that movie, whichever comes first."
Security

Submission + - Taking apart the Energizer Trojan (skullsecurity.org)

iago-vL writes: Researchers at SkullSecurity have written a tutorial on how they reverse engineered the Energizer Trojan and generated an Nmap probe to remotely detect infections. The Energizer Trojan is a great educational tool because its inner workings are very simplistic and it makes minimal efforts to hide itself or conceal its purpose; it even lists what appears to be the author's name — "liuhong" — in the source! From infecting a test machine to debugging and disassembling the Trojan to writing the actual probe, this tutorial is a great introduction to malware analysis!

Comment Re:Detect it with Nmap (Score 2, Informative) 260

Yeah, the simple xor 'encryption' is pretty oldschool. I can't believe I didn't notice that right away myself. I didn't see it till I started looking at the send/recv functions.

As to the CLSID, good thought, but no -- the CLSID isn't a real CLSID, it's just a way of identifying its own commands. Basically, it's a list of if(!strcmpi(command, "clsid1")) { do_this() } elseif(!strcmpi(command, "clsid2")) { do_that() } etc.

It only has those 9 or so CLSID's included, and if it isn't on the list the command is simply discarded.

And for what it's worth, the initial "'\x00\x00\x00" that you're seeing is a length (0x27 = the length of the CLSID = ').

Slashdot Top Deals

/* Halley */ (Halley's comment.)

Working...