Cross-Browser Command Injection Vulnerability

How many Firefox users disable, remove or entirely stop using IE once they install Firefox?

A new vulnerability has been discovered that allows IE to call Firefox and pass parameters that could compromise a users system and allow a remote attacker to take complete control over your computer. As of this writing, there is no official fix from either Microsoft nor the Mozilla group. After an initial flurry of finger pointing, this looks to be the fault of BOTH organizations: IE for not validating calls to external URI's, and Firefox for using a registered handler method that is outdated and known to be insecure.

If you have Firefox installed, then you are probably safe if you only use Firefox and if you set Firefox to be your default browser. You can also de-register the handler that IE uses to call Firefox.

If you don't have Firefox installed, you are immune to this particular attack.



Standard warnings and disclaimers apply if you edit your registry manually! Do so at your own risk. If you are not comfortable with the process, then wait for an official patch and browse cautiously.

Find and backup (export), then delete the FirefoxURL "command" reg key and it's default value at:
[HKEY_CLASSES_ROOT\FirefoxURL\shell\open\command]

The default value will look something like (depending on your Firefox install location):
@="C:\\PROGRA~1\\MOZILL~1\\FIREFOX.EXE -url \"%1\" -requestPending"

Reboot . . .

Note that if you update Firefox this reg key may be re-written - which is fine if that update includes a future as-yet-to-be-released patch for this problem.

Details about the vulnerability may be found at:

http://larholm.com/2007/07/10/internet-explorer-0day-exploit/
(Including a "safe" test to see if you are vulnerable - good to use after you implement the reg-key workaround above.)

http://secunia.com/advisories/25984/

http://news.com.com/8301-10784_3-9741435-7.html

Edit: Workaround no longer needed. Get patched instead with the new version of Firefox: http://www.mozilla.com/en-US/firefox/2.0.0.5/releasenotes/

Open Source cell phone arrives

Why I don't care about the iPhone . . .

A direct comparison between the iPhone and the OpenMoko Neo 1973.

Get one.

SDK and Developers Info.

(Links open in new tab or window)

This new device is first revision, and it's missing a few features, but the concept rocks. Look to the next version to fill in the missing pieces and enter the mass market.



Edit: Did I mention this is carrier agnostic? And Quad-Band?

You thought you were free . . .

The following is a slight rewrite of a small portion of the book "They Thought They Were Free, The Germans, 1933-45" by Milton Mayer.

My apologies to the original author and publisher for mangling Mr. Mayer's prose.


"What no one seemed to notice," said a colleague of mine, "was the ever widening gap, after 2007, between the government and the people. Just think how very wide this gap was to begin with, here in the United States. And it became always wider. You know, it doesn’t make people close to their government to be told that this is a people’s government, a true democracy, or to be enrolled in the National Guard, or even to vote.



"What happened here was the gradual habituation of the people, little by little, to being governed by surprise; to receiving decisions deliberated in secret; to believing that the situation was so complicated that the government had to act on information which the people could not understand, or so dangerous that, even if the people could not understand it, it could not be released because of national security. And their sense of identification with Bush and Cheney, their trust in them, made it easier to widen this gap and reassured those who would otherwise have worried about it.

"This separation of government from people, this widening of the gap, took place so gradually and so insensibly, each step disguised (perhaps not even intentionally) as a temporary emergency measure or associated with true patriotic allegiance or with real social purposes. And all the crises and reforms (real reforms, too) so occupied the people that they did not see the slow motion underneath, of the whole process of government growing remoter and remoter.

. . .

"But your friends are fewer now. Some have drifted off somewhere or submerged themselves in their work. You no longer see as many as you did at meetings or gatherings. Informal groups become smaller; attendance drops off in little organizations, and the organizations themselves wither. Now, in small gatherings of your oldest friends, you feel that you are talking to yourselves, that you are isolated from the reality of things. This weakens your confidence still further and serves as a further deterrent to — to what? It is clearer all the time that, if you are going to do anything, you must make an occasion to do it, and then you are obviously a troublemaker. So you wait, and you wait.

"But the one great shocking occasion, when tens or hundreds or thousands will join with you, never comes. That’s the difficulty. If the last and worst act of the whole regime had come immediately after the first and smallest, thousands, yes, millions would have been sufficiently shocked - if, let us say, the illegal suspension of presidential term limits in 2008 had come immediately after the Twin Towers attack in 2001. But of course this isn’t the way it happens. In between come all the hundreds of little steps, some of them imperceptible, each of them preparing you not to be shocked by the next. Step C is not so much worse than Step B, and, if you did not make a stand at Step B, why should you at Step C? And so on to Step D.

"And one day, too late, your principles, if you were ever sensible of them, all rush in upon you. The burden of self-deception has grown too heavy, and some minor incident, in my case my little boy, hardly more than a baby, saying ‘Muslim swine,’ collapses it all at once, and you see that everything, everything, has changed and changed completely under your nose. The world you live in — your nation, your people — is not the world you were born in at all. The forms are all there, all untouched, all reassuring, the houses, the shops, the jobs, the mealtimes, the visits, the concerts, the cinema, the holidays. But the spirit, which you never noticed because you made the lifelong mistake of identifying it with the forms, is changed. Now you live in a world of hate and fear, and the people who hate and fear do not even know it themselves; when everyone is transformed, no one is transformed. Now you live in a system which rules without responsibility even to God. The system itself could not have intended this in the beginning, but in order to sustain itself it was compelled to go all the way.

"You have gone almost all the way yourself. Life is a continuing process, a flow, not a succession of acts and events at all. It has flowed to a new level, carrying you with it, without any effort on your part. On this new level you live, you have been living more comfortably every day, with new morals, new principles. You have accepted things you would not have accepted five years ago, a year ago, things that your father could not have imagined.

"Suddenly it all comes down, all at once. You see what you are, what you have done, or, more accurately, what you haven’t done (for that was all that was required of most of us: that we do nothing). You remember those early meetings of your department in the university when, if one had stood, others would have stood, perhaps, but no one stood. A small matter, a matter of hiring this man or that, and you hired this one rather than that. You remember everything now, and your heart breaks. Too late.

"You are compromised beyond repair."

More spam

Be alert for email claiming to be an e-card or online card.

Three managed email servers that I run just got spiked with hundreds of these in the last hour.

Variants of the subject line include:

You've received a postcard from a family member!
You've received a postcard from a friend!
You've received a postcard from your wife [/husband /spouse]!

And as states in his post about the topic:

This is how "zombie" systems are created. With a solid zombie PC network under their control, professional spammers can send out those millions of canadian drugstore/viagra/penis enlargement e-mails you get daily.

There's always a temptation to open a suspected attachment when you've got good virus scanning software installed. DON'T!!!:

Perhaps the most dangerous part is that, when SANS ran it through 30 different anti-virus programs, only a quarter of them picked up ecard.exe as a suspect download.

The goal of the virus programmer is to come with stuff that commercial virus scanners aren't aware of.

Just. Don't. Open. It.

Phishing / spoofed emails purporting to be from Microsoft

According to several sources around the Internet we've seen a dramatic rise this month in phishing emails claiming to be from microsoft.com. The gist of the scam is that a critical update for Outlook, Windows or some other Microsoft application is available and should be installed immediately. Reports state that some of these emails contain an attachment - the supposed fix - while others state that the email contains links to downloadable content.

These links or attachments are not real fixes, but instead are (typically) trojans designed to turn your computer into a botnet slave.

Worse, these spoofed emails often address you by name, which makes them harder to distinguish from the real thing. That also means they may originate from an infected computer of someone you know, and that person has your contact information.

You might have heard that Microsoft never sends out email about current or upcoming critical hotfixes. This is not the case, which unfortunately makes the phishing attempts easier to conduct.

Here are the facts:

1) Microsoft does send out email alerts, but only for those people that opt-in to receive such reports via Security, Technet, MSDN or Partners at microsoft.com. Each security email that Microsoft sends is signed with a certificate or PGP key (although it's up to the user to verify the key.)

2) Such emails NEVER contain executable attachments of any kind. Nor do they contain links that directly download installable patches.

3) The emails usually contain links to online reports hosted on microsoft.com about the vulnerability or bug in question.

What you should do:

If you know you've never signed up for such email notifications, delete any such unexpected emails you receive -- don't click attachments or links within them. Even better zap them before opening or reading them.

Whether or not you remember signing up for these email updates from Microsoft you should treat any email with caution. It's my recommendation that you not click links in such emails, but instead visit the official update.microsoft.com site to see what updates are available. From there you may also visit the reports or knowledge base articles about the updates.

Administrators for multiple systems should already know where to go to read about patch details for various operating systems and application groups.

Links embedded in this entry open in a new window or tab.

Ms. T.

Cats have a language all their own. Ms. T. had several ways of telling us what was on her mind.

The following is a short list that she taught us:

Merroowwww: "It's dinner time, and I'm starving, get busy already!" (Even though there was generally still some food in her bowl from lunch.)

Merl?: "Can I come up onto your lap? I know you're busy with the shiny screen, but I want up."

Mew! with head butting: "I need to be pet, brushed and loved. NOW!"

Silent look with slitted eyes: "I like you. A lot. Keep up the petting." (Note: this works in reverse - most cats respond favorably and will come to you when you slit your eyes at them without blinking.)

Matph!: "There's a spider in the kitchen, come take it away. I"M not touching it."

MerROW?: "Where are you?" (Repeated until we went to her -- or until she found us.)

Chi-i-i-i-rrruppur-r-r-r-r: "Absolutely contented with life, ahh yes, right there below my chin."

M-e-e-a-a-p??: "Can I please have another kitty cookie?" Alternately: "More catnip please?" (Sounds like a broken meow with spaces.)



I met Ms. T. a little over 10 years ago. She came as part of a package deal along with my soul mate. As I understand events, Ms. T showed up on a certain doorstep the day my partner moved into a new apartment. She had been abandoned by the previous occupant. My partner took her to a vet, who informed her that she had a very healthy 1+ year old cat. A few shots and a spaying later she was taken back home and began a journey across 16 years of life with my partner - 10 of which were shared with me.

I got used to having her on my lap while at the computer. She was very polite about it, would keep off the keyboard (mostly) and was content to snuggle into me for hours while I worked.

Last Friday she began having problems walking up and down the stairs. Saturday saw some improvement in mobility but she stopped eating. Sunday evening she started to slide downhill fast. Monday morning at 2:30 she woke us up crying under the bed. She was unable to walk, and could not understand why her back legs would not support her weight. Her body was already cooler than normal. All morning we kept her warm, gave her water via bottle and tried to make her comfortable. We had planned to take her to a Vet later that morning, but she didn't make it that long. I am not sure it would have made any difference anyway.

It feels odd blogging without her on my lap. I never thought it would be this hard to lose her. I've lost several pets over the years, but this seems far harder than those previous losses.

She was special. She was dearly loved as a part of our family.

The last thing she said early Monday morning to us was "MerROW?" She died in my arms shortly after . . .

In memory

. . . of Ms. T. April 15, 1990 to June 25, 2007.

The CPU war just escalated

The press release from NVidia reads NVIDIA® Tesla™ GPU Computing Processor Ushers In the Era of Personal Supercomputing. NVidia (so far) very carefully fails to mention any hint that their new Tesla branded GPU could possibly be a future competitor to AMD, Intel, or IBM's PowerPC CPU lines.

After all, it's a Graphics Processor Unit, right?

I don't think so. I think the CPU market just entered a revolutionary battle unlike any we have seen in the past. If the claims are true (and they seem to be verified by several leading research centers, see links from the press release) then this is more than an incremental improvement -- it's a major jump in processing technology available this coming August that surpasses anything Intel or AMD has announced into the next two years.

Here's a hint: MRI (Magnetic Resonance Imaging) processing speeds increased on Tesla from 245 to 415 times previous speeds over CPU or older GPU based computing solutions. There's more, but you can read the details yourself over on the NVidia site. (links pop) Performance increases are so good that in many cases scientific computing that took weeks and a cluster of machines can now be done in days or hours on a single machine.

My feeling is that this is NVidia's shot across the bow of the entrenched CPU market leaders. They may not remove the misleading "GPU" designation for a while yet, but make no mistake: this technology has the potential to completely change what we consider a "Desktop PC." And it's about time!

And they've done it right: the first generation of Tesla can be installed onto almost any existing PC with a modern PCI express bus. They've released a free API. There are several open source simulations that you can immediately download. The entry barriers (other than price, tba) are very low.

We moved from slide rules to programmable calculators and were amazed at the changes to our lives. Then we moved to the personal computer -- that box sitting under or near your desk today contains more power than most supercomputers built 12 years ago.

It's time for a jump in processing power to the next order of magnitude.

Raccoon update

Mom-coon made it back twice last night and retrieved two of her young - both of the females. I sat near our kitchen window in the dark until 4 AM and saw her make the snatch both times. Her new nest must be some distance away, as it took her about 90 minutes round trip. I surmise that she spent the rest of the night foraging since the male baby was still there this morning.

Everything I found via Google indicated that if we could keep him warm, hydrated and fed for the day she may very well retrieve him tonight. According to the sources she won't try during daylight.

So my partner and I made the trip out to a local pet store and found something called Kitten Milk Replacement. Normal cows milk has lactose, which does not agree with young raccoon tummies. He's taken two feedings so far, and seems to like the stuff.



Tonight I will set him back by the tree and see if his mother will come get him. If not, we'll take a trip to Boulder on Sunday to deliver him to professionals.

If anyone is interested, here are the links I've been using as sources today:
http://www.nancycarolwillis.com/pages/faq.html#raccoons
http://www.mnsi.net/~remocoon/babies.htm

Edit - 12:30 AM June 3rd: I think we were successful at re-uniting him with his mother tonight. I missed the snatch, but he was gone as of 12:20 AM. Funny how one can become so attached to something for which one gave care - even as short a time as it was.

Fair hunting little brother. Perhaps someday you will cross my yard at night while I stand outside for air and you will -- for a moment -- gaze back and wonder. But I really hope you scoot your butt into the shadows and play it safe.

Abandoned coon babies

Nothing like a nice romantic fire to warm up an unseasonably cool spring evening. Arrange the tinder, get the match lit . . . and frantically put it out when one hears sudden cries of panic and mad scrabbling from the flu. A few minutes of dusty investigation revealed a family of raccoons living in the chimney. Mom grabbed one of the young ones and lit out for parts unknown . . . and never returned.

Called animal control -- in this town they don't deal with coons. Suggested we call a pest control company. Called two and they can't make it out until Monday. Asked them what would happen to the babes and were told they would be euthanized.

Bleah . . .

After some creative engineering, much sneezing and a twisted back I extracted three more young coons. They can't walk, much. So cute you want to pet them - but I know better. Two females and a male.



Went to the hardware store for wire mesh and blocked off the chimneys (both of them, just in case mom-coon got any ideas about an easy move.)

Placed the three baby coons into a bucket with a towel and set them at the base of the one and only tree close enough to the house where mom-coon would most likely access our roof and chimneys.

That was four hours ago and the poor things are still there. Hungry and cold.

So now what? Anyone know the best method of reuniting the kids with mom? Any suggestions would be welcome!