http://www.alistapart.com/articles/secureyourcode

I’m predicting that the “Web 2.0″ (or 3.0 some think) will soon hit critical mass, meaning interfacing with interactive web sites will become a daily part of life. Unfortunately, this atmosphere strikes me as the ‘cool lets do everything’ environment of personal computers just coming onto the Internet. Often when a new area of technology comes out people are quick to propel its strengths and forget about it’s weaknesses. Then 2 years later their once pristine machine is a smoldering pile of crap filled with more junk salesman trying to sell you pills and software and the ex-king of Nigeria just won’t go away.

The web can do an amazing amount of things but it is only now that the people are starting to see the security issues that might exist in sites already wildly out of control. The well publicized “Worm of MySpace” helped bring these dangers to people’s attentions. I predict that over the next year the ‘research / hacking’ community will focus much more on these ‘web 2.0′ sites and find major security issues. Depending on how big of a site and how sensitive the data, it may or may not become as large spread of a problem as spyware is.

Will all these hyper configurable community sites because the next bastion for spyware and viruses? Will MySpace get into a contest on wither it or the Russian Botnet Armies have more power to do damage?

For anyone who wants the true story, The Register has just published an in-depth report about the security of Windows and Linux. This report was written by Nicholas Petreley, who is a Linux supporter but is also a highly regarded Technology Writer and has written columns for InfoWorld and ComputerWorld.

The report itself is very detailed and backed by lots of hard facts. The Register has a good summery of the report but I encourage anyone who is interested to read the full report. Here are the links:

The full report in HTML format: Click here
The full report in PDF format: Click Here
The Register article about the report: Click Here

What is really sad, but not very surprising, is how simple this exploit is. Simply by replacing a ‘/’ in a URL with a ” or a ‘%5C’ a web browser can gain access to a “password protected” area of the web site. For example, say your site has an administration section located at “http://www.mysite.com/admin/” which is only accessible with your user and password. Well, now anyone on the net can go to “http://www.mysite.com%5Cadmin/” and wreck havoc to your web site by changing all your settings or installing a virus.

Microsoft is supposedly focused on security but I just can’t believe they could let such simple security problems get into their code in the first place. Sometimes I think they took the so-called “Infinite Monkey Theorem“, the one about monkeys sitting at typewriters eventually reproducing Shakespeare, a little too serious and decided to employ a couple million monkeys to write their crappy code. What type of peer review process do they have where such obvious security problems can slip through the cracks?

For those interested, here is the link to Microsoft’s security advisory: Click Here

I have known for years that Microsoft is an evil company but this sinks to a new low. Now they are using the rampant security problems in Internet Explorer, which is built into all versions of Windows since 98, to force their customers to upgrade to Windows XP. Many customers have chosen not to shell out the $99+ to upgrade their version of Windows because they feel that what they have works good enough. In fact, according to IDC, 49.2% of Windows users don’t currently
run Windows XP. With Microsoft’s next version of Windows not being released until sometime after 2006, it looks like Microsoft had to get ‘creative’ to find a way to get people to give them more money.

So, what should you do to protect yourself? I would start with dumping Internet Explorer and using Firefox instead. It is free, secure, and fast. But, because Internet Explorer is built into Windows, you still will be vulnerable, although by not browsing the Internet with IE you will have some protection. You should still make sure to run a virus scanner and firewall. If you really want to be secure, install Linux on your PC or go buy a Macintosh.

I recommend taking a look at the article yourself and then go to your bike shop and get a lock not based on the “axial pin tumbler” locking mechanism. A strong chain with a combination lock would even be better, even though chains are pretty easy to cut. The vulnerable type of locks are also used for locking down laptops so you should replace those as well.

Here is the link to the Wired article: Click Here

I highly recommend that everyone who is using Microsoft Windows go to http://windowsupdate.microsoft.com and install the fix. You should also go to http://office.microsoft.com/officeupdate/ to fix this problem in Microsoft Office products.

The good news is that there isn’t a virus that takes advantage of this latest problem with Windows and other Microsoft products. But, if the past is any indication, there will be viruses released in the next month that will spread using this security problem. So, every Windows user needs to install the updates before it is too late.

Here is a good article from CNet: Click Here

Here is the link to Microsoft’s security bulletin: Click Here

Delivery Status (Failure)
failed transaction
failure delivery
mail failure
returned mail
server error

The attachment to the email is the virus so do not open it! More technical information about the virus can be found on Symantec’s Security Response page.