Journal of Internet Banking and Commerce ISSN: 1204-5357
ISSN: 1204-5357
+44-175-271-2024Your Host: Keith Dawson
http://www.tbtf.com/archive/04-27-98.html
http://www.tbtf.com/archive/05-11-98.html
http://www.tbtf.com/archive/05-18-98.html
TBTF home and archive at http://www.tbtf.com/. To subscribe send the message "subscribe" to tbtfrequest@ world.std.com. TBTF is Copyright 1994-1998 by Keith Dawson, dawson@world.std.com. Commercial use prohibited. For non-commercial purposes please forward, post, and link as you see fit.
Visit for more related articles at Journal of Internet Banking and Commerce
284 Congressional hypocrites
JavaScript privacy bugs hit Netscape, then Microsoft
Access to government cookies denied
Digital execs say Microsoft killed their project
New backdoor in town
Bottom-fishing the bulletin boards
A comparison of virus scanners
Fiber bites backhoe
Say it ain't so, Luke
The Starr Report may have damaged the Presidency, Congress, and families -- but not the Net
When the report of Independent Counsel Kenneth Starr hit the Net,to the immense relief of Web workers everywhere it was in text Form. Its 7 files total 854K; the largest is 466K. Many newspapers andnews sites obtained the report from the Associated Press, which setup an FTP server with a zipped text file, a Mac Stuffit file, and a Unix tar archive, each under 300K. I had dreaded the vision of clue-less government functionaries distributing the 445 pages as PDFfiles or even as scanned GIFs. They seem to have obtained a cluesomewhere along the way. (Do you think the 46 TBTF subscribers in the .gov domain helped? Nah...)
The report appeared on House of Representatives sites and mirrors[1], [2], [3] as advertised; almost immediately it was hosted and linked from the top pages of most news sites and some ISPs, such as AOL and @Home. The result was that, while overall Net traffic jumped to record levels around 2:00 PM eastern time on Friday 9/11, no site or handful of sites caused a bottleneck. CNN reported record traffic levels of 5600 hits per second [4], but was handling the load. Traffic through the MAE-East exchange point jumped by 100 MBit/sec at 2:00. Here is a picture [5] derived from a posting to the NANOG net-work operators' mailing list.
One other aspect of the Starr report is germane to TBTF concerns,and that is the confluence of prurience with politics and public policy. Had the Supreme Court not struck down the Communications Decency Act, passed as part of the omnibus Telecommunications Reform Act in 1996, anyone posting the Starr report to the Web might have been liable for a fine of $250,000 and a jail sentence of 5 years.
How many of the Congress people who voted for the CDA do you suppose also voted to release the report that reads like a borderline pornographic dime-store romance written by a Texas preacher's son?
The question of who voted for both the CDA and the release of the Starr report is not cut-and-dried, because Congress did not record aroll-call vote for the CDA in isolation, but only for its vehicle the Telecommunications Reform Act. Also, the vote to post the Starr report was primarily a vote to start up impeachment machinery.
Nevertheless, if accountability to the voters means anything in this republic, the Congress members who voted "Aye" on both February 1,1996 and September 11, 1998 ought to come in for a bit of uncomfortable public exposure.
To compare the votes we turn to Thomas [6], [7]. By my reckoning 365 individuals were Members of Congress during these two votes, 196 Republicans and 169 Democrats. Of that total, 284, or 77.6%, voted Aye both times. 185 of the Republicans, or 94.4%, voted Aye both times. 96 of the Democrats, or 56.8%, voted Aye both times.
Here are the names of the two-hundred eighty-four most hypocritical members of the US House of Representatives on the subject of the Internet [8].
Thanks to Dan Kohn and Alexander Blakely, who first suggested this exercise in democracy and public accountability; Dan Thompson wasn't far behind.
Dan Brumleve wrote with word of a new vulnerability he had discovered in all versions of Netscape Navigator. (Internet Explorer is immune.) See the exploit page [9]. The exploit, which Brumleve calls Cache-Cow, captures the entire browsing history of the victim's copy of Navigator, including all form data that has ever been sent via the GET method -- including any passwords. The exploit uses Java-Script to compromise all versions of Navigator prior to 4.06; aslightly reworked version of the CGI script [10] fells 4.06 as well.
According to one security researcher, the same vulnerability can be exploited via e-mail. This means your browser cache could be stolen if you simply read an e-mail message.
Netscape acknowledged the Cache-Cow vulnerability [11] and released version 4.07 of Navigator and Communicator to fix it. Five days later Brumleve posted Son-of-Cache-Cow [12] (Cache-Calf?). It steals the cache off of 4.07 in exactly the same way. Netscape has acknowledged [13] this one too, calling it the Injection Bug. Unlike the earlier acknowledgment [11], this one does not mention Brumleve byname. Perhaps they're getting annoyed with him.
A more serious security threat affecting Internet Explorer 4.01 was discovered by Web developer Juan Carlos Garcia Cuartango. Using the Cuartango Hole [14], an attacker can steal any file off your disk for which the name and location are known or can be guessed. Here is the discoverer's exploit page [15]. Microsoft has confirmed the problem and is working on a fix, Wired reports [16], but I couldn't find any mention of Cuartango on Microsoft's security site [17].
TBTF for 11/24/97 [18] brought you news of Geoffrey Davidian's lonely fight against the forces of darkness in the town of Cookeville, Tennessee. Davidian, publisher of a local muckraking newspaper, brought suit in federal court after being denied access to browser cookie files from the town government's computers. Davidian wanted to check whether public servants were accessing pornography on the public'snickel, he said. In late September U.S. District Judge Thomas Higgins dismissed the publisher's lawsuit but left the legal question of whether cookie files are public records up to the state [19]. (Those who prefer sites that don't force-feed cookies can read coverage here[20].) Davidian has said he will appeal the decision.
Five current and former executives at Digital Equipment Corp. (now owned by Compaq) charged that Bill Gates forced Digital to abandonan Internet product under development using Oracle's Network Computer technology. A NY Times story [21] (free registration and cookies required) quotes one researcher who worked on the Shark project: "It was a bad week. Princess Diana, Mother Teresa, and the Shark all died during the same week." Oracle head Larry Ellison is quoted assaying that then-Digital CEO Robert Palmer had called him in July 1997 to tell him that he (Palmer) was cancelling Shark. Ellison said that Palmer wouldn't reveal the reason for his decision, but told the Oracle executive, "If I'm subpoenaed, I'll tell the truth." Through two levels of hearsay the Times quotes Gates as telling Palmer: "You have to decide if you're Larry's friend or my friend."
NetBus is a remote-control application implanted via a Trojan horse program, like the better-known Back Orifice [22]. But NetBus is no BO clone; it's been around since the spring. At first its interface was in Swedish, which limited its spread. It lets a perpetrator do annoying things to a remote computer such as swap the functions of left and right mouse buttons, bring up any URL in the default browser, and send keystrokes to the active application. NetBus runs on Windows 95/98 and also on NT, which Back Orifice does not.
The security firm ISS has updated their advisory, originally covering BO, to include information on identifying and removing NetBus as well. I've posted the advisory on the TBTF archive [23]. NetBus communicates between client and server using TCP/IP on ports 12345 and 12346. Unlike BO, these port numbers are not modifiable. Its communications are not encrypted.
The Wall Street Journal reports [24] (subscription required) that Microsoft has subpoenaed the contents of internal Netscape discussion lists. Microsoft is particularly interested in two complaint bulletin board called "Bad Attitude" and "Really Bad Attitude" founded by early Netscaper Jamie Zawinski, now a driving force in Netscape's Mozilla opensource initiative. Microsoft hopes to bolster their contention that internal bad management,not predatory competition, dragged Netscape down in the browser wars. The WSJ attributes the following quote to Zawinski, but he fingers [25] Netscaper Sarah Clatterbuck as its source.
And I keep thinking to myself, Microsoft is going to pay some jack ass lawyer $200 an hour to find out that we hate our cafeteria food, don't like the security posters, had a sucky news feed, and think "Navigator" was a cooler name than "Communicator." And I smile.
Shake Communications Pty Ltd. has released the results of an independent study of the top 20 virus-scanning products on the market. Here are the press release [26] from Shake and coverage in an Australian newspaper [27]. The complete results appear in the September issue of the Shake Security Journal [28], a semimonthly, subscription-based publication (3 issues US$25, 6 issues US$40).
The study tested each product in a "hot zone" of 16,000+ viruses --including executables, Word and Excel macro viruses, Microsoft Access viruses, Lotus 123 viruses, Trojans, and bait files. Shake says that few of the programs performed consistently across all virus categories. The company cautions that a product's ranking on this list is only one of a number of factors to consider when choosing a scanner. Here is a capsule of the survey's results, in terms of the percentage of viruses detected. Thanks to Simon Johnson simon.-johnson@shake.net for forwarding this table, not available in the cited public sources.
1 Anywhere Anti-Virus 99%
2 F-Secure 94%
3 Norton Anti-Virus 93%
4 Find Virus (Dr Solomon's) 93%
5 Inoculan AntiVirus 93%
6 Avast 93%
7 McAfee VirusScan 91%
8 Thunderbyte 91%
9 LANDesk Virus Protect 90%
10 Sophos 88%
11 AntiViral Toolkit Pro 87%
12 House Call 86%
13 ViruSafe 79%
14 Vet 73%
15 Virus & Macro Buster 2%+-|
16 Quick Heal n/a|
17 Panda Anti-Virus n/a|
18 Guard Dog n/a|
19 Fiber n/a+-
The NANOG mailing list, stalwart of network operators everywhere,has lately carried news of more than the usual number of optical-fiber bundles cut by rampaging backhoes. Last Thursday this note,from a local newscast, was posted to the list:
[Atlantic County, NJ] While attempting to wreak havoc on the world's telecommunications infrastructure, a backhoe mistook a gas main as a fiber optic cable. The evil yellow beast was destroyed in the resulting fireball.
The ensuing discussion thread [29] "Internet 1, Backhoe 0" turned up many examples of the Net's revenge fantasies; two of the bestare Bizarro Land's [30] and Adam Rothschild's video realistic essay[31] (103K).
Transmeta, the Silicon Valley company that employs Linus Torvalds,isn't saying what kind of technology it's working on. (Their Website says, succinctly if paradoxically, "This web page is not here yet.") The Red Herring tried to find out what they are up to --or perhaps their account of the attempt, "Stalking Transmeta," [32]is all in good fun. PC Magazine prints a more substantial guess [33]:
[Transmeta] has been working for about two years on a CPU for PCs, which is rumored to have its own internal instruction set but to use a fast software translator to execute x86 instructions. Transmeta has raised a large (undisclosed) amount of venture capital and is well staffed; a product debut is like lyin 1999.
In the NY Times for 8/31, John Markoff relays a rumor [34] that he says has some Sili Valley techies quite upset.
Markoff's article is mostly about evidence of increasing strain in the "Wintel" alliance. One factor contributing to the wobble is the rapid growth of technology areas such as telephony and personal digital assistants that do not use Intel hardware or Microsoft software. Microsoft has an entrant at this end of the market -- Windows CE -- but Intel is seen as concentrating increasingly on the shrinking top end. (Its purchase of Digital's StrongArm technology may have been reduced in value by the defection of key technical talent.)
If Transmeta, which was founded by a former Sun Sparc architect,is working on a platform for portable computing -- let's call ita "media chip" [35] -- what OS will it run? Well, with Linus onboard, you would assume the answer would be "Linux, duh." Some flavor of Java would certainly be a contender. But Markoff says the word is that Transmeta may run Microsoft software. A hardware designer is quoted thus:
It would be a little like hiring Luke Skywalker and then turning the whole organization over to Darth Vader.
The TBTF title for 9/7 nods to the Black Sox baseball scandal of 1919,when eight Chicago White Sox accepted bettors' bribes to rig the outcome of the World Series. They were blacklisted from the game for life. Shoeless Joe Jackson, called the greatest natural hitter the game has known (this was before Mark McGwire and Sammy Sosa), was among those implicated. The famous incident with the kid outside the courthouse imploring Jackson, "Say it ain't so, Joe!" was made up by Charley Owens of the Chicago Daily News -- good story, but it never happened. Jackson was acquitted in a court of law in 1921 but didn't appeal his banning to the baseball commission. Fans and supporters today [36] agitate for removing the blot from Jackson's escutcheon and for elevating him to the Baseball Hall of Fame. Eric Asinof and Stephen Jay Gould have written an engaging history of the affair titled "Eight Men Out" [37]; John Sayles made a movie of it in 1988[38]. From the blackbetsy.com site [39] (Black Betsy was the name Shoeless Joe bestowed on his Louisville Slugger):
Contrary to popular belief, the name Black Sox was not given to the 1919 White Sox because of the 1919 World Series scandal. The name was given to them because they played in dirty uniforms because their owner... used to charge the players 25 cents for cleaning [them]. The players refused to pay...
For a complete list of TBTF's (mostly email) sources, see http://tbtf.com/sources.html .TBTF home and archive at http://tbtf.com/ . To subscribe send themessage "subscribe" to tbtf-request@world.std.com. TBTF is Copy-right 1994- 1998 by Keith Dawson, dawson@world.std.com. Commercial use prohibited. For non-commercial purposes please forward,post, and link as you see fit.
Keith Dawson dawson@world.std.com
Layer of ash separates morning and evening milk.
Copyright © 2024 Research and Reviews, All Rights Reserved