No more ph.
Thanks for all of the ph words from yesterday. We're full now, so please don't send any more.
If you want to see the creativity of your fellow readers, check out their ph-word suggestions from . But, again, no more, thank you.
Internet Fraud Article
If you want some news, check out about the costs of on-line theft to banks in Australia, sent to us by alert reader Malcolm Murray.
Nathan, an observant reader, pointed out some unusual Google issues today. Seems that, in some browsers, when you do a Google search, your search results actually include a link back to Google, which then forwards your browser to your intended search target. Nathan mentions:
>> Searching on TCPMP yields several results.
>> In the 9th result, look at the
SSH Probing Reveals Big-Time Probs
Another alert reader sent in a message about yet another SSH userID and password-guessing scan that showed up in his logs. ?Yawn,? I?m sure you?re thinking. But wait? there?s more. Turns out, this scan was coming from a pretty sensitive institution with pretty sensitive information. The reader said he was concerned about compromise of such a place, which made fellow-handler Kyle Haugsness urge me to contact them. I phone the organization whose server was used to launch the scan. At first, they thought it was just an unimportant file server that had been hacked and used as a launch point for further attacks on other sites? But, before long, they realized it was a massively important server in their environment! We worked with them to handle that issue, but we all need to keep in mind ? It?s absolutely crucial to have a strong handle on your asset inventory. Know what your organization has connected to the Internet, and watch those boxes carefully!
In this particular case, the bad guys had activated sshd so they could get strongly encrypted access to the machine. If you ever have a system that doesn?t have an sshd running, and then one suddenly starts up, please investigate immediately. I?m not saying that sshd is bad. It?s an extremely useful tool in managing your systems securely. However, if you don?t use it, but then see it start running mysteriously, look into it immediately.
So, in the end, what started out as a yawner was really a fascinating (albeit somewhat scary) case.
Further Reports of Exploits Against MS05-037
A reader desiring anonymity told us that he?s seen some exploits of his systems by malicious websites using Microsoft Internet Explorer Javaprxy.DLL COM Object Instantiation Heap Overflow Vulnerability (described in MS Security Bulletin MS05-037) to install malware. Looks like we better step up that patch rate, since this one could be a big problem.
Over and out?
ed (at) intelguardians.com
Jul 20th 2005
1 decade ago