Vitalsecurity.org

2007-03-09T01:27:00.000-08:00

Click To Play

Matrix Online

2007-03-07T13:49:00.000-08:00

2007-03-07T13:21:00.000-08:00

2007-03-07T11:53:00.001-08:00

World of Warcrack - Documentary of a World of Warcraft Addiction

Add to My Profile | More Videos

pics4

2007-02-08T08:38:00.000-08:00

pics3

2007-02-07T23:52:00.000-08:00

pics2

2007-02-07T23:29:00.000-08:00

pics

2007-02-07T23:20:00.000-08:00

fgg

2006-12-08T01:17:00.001-08:00

rgrggr

uihuih

2006-12-07T23:57:00.001-08:00

test

2006-12-07T23:56:00.001-08:00

test

testlols

2006-07-15T12:00:00.000-07:00

test

2006-05-31T13:11:00.000-07:00

...let me show you what I mean!

First off, some news-type linkies summarising the fiasco that was yapbrowser:

Linky 1!
Linky 2!

And now for the notable quotables...

"Steve Stratz, public relations director for 180solutions, said the software bundle with the Yapbrowser was never publicly available. However, at least one copy of the bundle was obtained and eventually looked at by security experts, Stratz said."

At least one...?

From this post here:

Porter: Have you received payment from 180Solutions for the Zango downloads you delivered?

Yap's Response: By that time, no more than 5 downloads of my program were made...

I don't know about you, but...

1) I downloaded the application at least two or three times - due to the download corrupting. Then I downloaded once more, shortly after they'd brought their site back online - I wanted to see if it was still functional (it wasn't). Are we including attempted download attempts here too, or just "completed" ones?

2) Andrew Clover downloaded the application and tested it - so, there's another one.

3) Sunbelt wrote about it - presumably, they would've downloaded the application too.

4) McAfee cover the program on their listings here. One more download ftw.

5) Numerous other people - security buffs, "curious" passers-by and God knows who else will naturally want to play with the "latest nasty app" on the shop floor. Happens every time. And I imagine lots of sickos who got wind of the story would've downloaded it as fast as their little illegal pr0n legs would carry them. I even had a few people posting "Where can I get this thing" in my comments - I doubt it would've taken them long to get hold of it.

....and end extract.

Once again - if the thing was not publically available, why on Earth was it publically available to download?

"At least one copy was publically obtained" makes it sound like I went on some kind of Mission Impossible style jaunt, with ropes and masks and bungee jumps over skyscrapers and that. In reality, I heard about it on a mailing list.

Guess that's another bunch of downloads, then.

Sorry guys - if it's online, it's publically available. That's why you have test servers. Then again, nobody seemed to notice the neighbours Yapbrowser.com keeps so I can't say I'm surprised.

As for the Botnet here - it's currently still up. One or two Adware vendors have got in touch about it, and I responded in kind.

Guess who hasn't rang my bell yet?

2006-02-01T02:14:00.000-08:00

Well, I'm off to the ASC Conference next week and I couldn't help but notice this writeup by Bruce Schneier about the wonderful rubber-glove treatment you tend to get when visiting the States. Choice line:
One thousand bad guys, most of them not very bad, caught through US-VISIT. That's $15M per bad guy caught.

Surely there's a more cost-effective way to catch bad guys?

Yes, there is. It's called looking out for the guy with the tea-towel and the AK-47. So, to speed things up at the airport, I've come up with this top guide for the Immigration dudes:

.....can't wait for those rubber gloves!

2005-03-02T22:12:00.000-08:00

Haloscan commenting and trackback have been added to this blog.

Even Mario can't squash Nintendo's web-bugs

2005-01-21T02:35:00.000-08:00

Ever checked out Nintendo's privacy policy? 3162 (of spywarewarrior fame) did and the results are surprisingly dubious. Apart from the amazingly dodgy "privacy policy" for children wanting to sign up to Ninento's online services:

"Nintendo will collect and store the following types of personal information about a child under 13: child's name, child's e-mail address, child's mailing address, child's cell phone number (to receive text messaging), child's Nintendo Power member number (if one exists), parent's name, parent's mailing address, parent's phone number, and parent's e-mail address. Nintendo will also collect the child's date of birth and link it to the child's personal information after obtaining consent."

"We do not collect personal information about a child through the use of passive collection mechanisms such as cookies; however, information contained in a cookie may be linked to a child's personal information."

"Once a child's registration is collected with parental permission, the child's information will be used to provide the child the benefits that come with registration. These benefits may include participation in surveys, community features (such as chat rooms and message boards), and other site activities and features (e.g., submitting game reviews and uploading graphics). With a parent's permission, we may also use a child's information to send the child messages (via e-mail, regular mail, or text messaging) from Nintendo or on behalf of our partners."

...they also appear to have a nice line in trying to make web-bugs appear to be user friendly:"Nintendo uses a common Internet technology called "Web beacons" (a.k.a. "Web bugs," "action tags," "pixel trackers," or "clear GIFs") on some of our sites. Web beacons are small graphic images placed on a Web page, Web-based document, or in an e-mail message that is designed to allow us or our vendors to collect certain information and monitor user activity on our sites. Web beacons are invisible to the user because they are typically very small (only 1-by-1 pixel) and the same color as the background of the Web page, document or e-mail message. We do not use Web beacons to collect personal information about you.

Sorry, web-beacons! Have to remember to make them sound more cuddly than they actually are. And here was me thinking:

"non-personal information such as the IP address of the computer that the Web beacon is sent to, the URL of the page the Web user comes from, and the time the Web beacon is activated (such as when you view the Web page, advertisement, or e-mail that contains the Web beacon)."

...actually was personal (and personally identifiable) information. Oh well.

Reading on, the next line is a killer:

"In general, we do not link such non-personal information to personal information already collected about you; however..."

...if they want to, they will.

They also mention that any web-bugs their "vendors" employ will also be along the same lines. Oh, well that's okay then. I have no problem with such a vague and spurious privacy policy that outlines the bare minimum needed to get away with whatever merry hell they feel like. Who are these vendors? What do they do? When are they employing their web-bugs? For what purposes besides what Nintendo already outlined (if you could call it outlining?)

Allowing these vendors to occasionally "include" a web-bug in emails that they send out also smacks of web-bug spam, and before they send these mails out, are they first of all sending another mail out to warn users of the bugged mail - just in case, you know, you didn't actually want it?

I think not.

Anyone signing up to this policy is asking for very vague terms and conditions being applied to them without actually getting into the nitty gritty specifics of the issue at hand.

Added to this the creepy way the guardian permission PDF is spelt out (you might as well brand your child on the head and include their trouser size, considering the wealth of information they want about little Jimmy - and notice the BIG RED WARNING NOTE regarding charges incurred on the child's mobile for Nintendo texts without mentioning the exact policy for how these texts arrive on the phone...does the child enter a code to be sent them? Or do Nintendo just fire out a stream of cash sucking messages), and you have a rather alarming situation which has apparently been rumbling along for some time.

Is this a big "NO" to the Big-N?