Microsoft sends out security over bug scare

[DoctorDoom]

Microsoft is releasing a patch for serious security vulnerability that allows lone attackers who register particular internet domain names to seize control of millions of computers.

Ethical hacker and software engineer Beau Butler researched the bug and presented his findings to the inaugural Kiwicon security conference in Wellington, New Zealand, last month.

Microsoft was unaware of the bug until contacted by Next two weeks ago and has worked frantically to produce a fix.

[snip]

The vast majority of browsers affected were Internet Explorer, but Butler says the glitch is also present in the open source Firefox browser.Microsoft sends out security over bug scare (http://www.smh.com.au/news/security/microsoft-sends-out-security-over-bug-scare/2007/12/03/1196530575355.html)

Firefox has been updated to 2.0.0.11, but the Mozilla site doesn't mention the bug.

[mkafrica]

Yet another reason to be a Mac person :D

[DoctorDoom]

I use Opera, which is unaffected, and which has IAC seldom been attacked. That's one of the benefits to using a "little guy" browser. The scumbags generally ignore it because it isn't worth the effort to go after a browser that won't give them a sense of gratification.

Ditto Macs. There aren't enough of them to warrant extended effort by the a'holes, although Apple releases semi-regular security updates.

[CzechPrince]

Yes, that's one thing I love most about the Mac, plus our school gives us virus protection anyway, so I'm good to go.

[Phil Osophical]

Yet another reason to be a Mac person :D

Well just what is the difference in a PC and a Mac? I don't know much about computers and the one I'm sharing now is a PC. I'm thinking about buying my own. I keep seeing that ad on TV about PC vs. Mac. This PC works alright. It's hateful, stubborn, aggravating and frustrating sometimes. But I guess all of them are like that.

Does a Mac do everything a PC does plus other things? Are Mac's a lot more expensive? I don't need anything with a lot of bells and whistles. I mostly use the Word Processor, Paint feature, and the Net.

I'm thinking about buying one of these: http://www.theflip.com/support_video.shtml will it work with a Mac?

I've tried to research the issue on the Net, mostly to no avail. It's mostly tech talk that I don't fully understand.

[DoctorDoom]

Well just what is the difference in a PC and a Mac?Image, period. They use the same components, the same sound and video cards, the same hard drives, etcetera. But Macs cost two or three times as much for the same components.

The principal difference is the operating system. Apple uses Intel-incompatible CPUs. Therefore Mac software won't run on Wintel boxes and vice versa. And that allows Jobs to screw over his customers at the cash registers for the "advantage" of owning Macs.

The newest Mac Pros use Intel Xeon chips, but Apple still has its own OS.

Apple addresses a small submarket of people who use programs like PhotoShop, for which Macs are well suited. However, the hyperinflated claims by Apple of the speed of Macs compared to Wintel (Windows/Intel) machines is pure marketing.

I don't know if they still engage in it, but not long ago there were ads comparing the speed of Macs to Windows boxes running PhotoShop and complex scientific programs. Omitted from the ads was that Apple fine-tuned the Macs to optimize their performance with the chosen software, and compared them to off-the-shelf Windows boxes.

Repeating what I've often posted, Macs are good machines. For the niche market that Apple addresses (primarily graphics professionals and scientists), they are ideal. But for 99.999% of computer users, they're overpriced overkill. One does not need a $2500 computer (the cheapest Mac Pro) for email and Web-surfing.

Does a Mac do everything a PC does plus other things? Are Mac's a lot more expensive? I don't need anything with a lot of bells and whistles. I mostly use the Word Processor, Paint feature, and the Net.For your needs, a Mac would gain you nothing, and would severely limit your choice of available programs. Stick with Wintel (although if you can avoid Vista, do so—it's not ready for prime time).

[mkafrica]

I purchased a Mac in August '05, and I still love it today.

Yes, it is more expensive. But IMO, there are good reasons for it. There is a very good basic software package that comes with it, which, if you use, it you would be saving about $700 in equivalent Windows software. The programs included consist of video editing, sound recording and remixing, and DVD production.

The other advantage, is that since I've purchased my Mac, thanks to the OS, the computer has never slowed down, crashed, or needed a reboot to get it working again. You don't have to defragment your hard drive (because there is a different file structure) and I've never had problems with spyware or adware.

While this is starting to change (because of the growing popularity of Macs) I have never had to purchase anti-virus software, because there weren't any viruses. There are some now, but they still aren't able to create viruses that automatically install. The creators of a virus have to trick people into installing it themselves (such as a link in an email that they use as a scam). To me, that isn't a threat, except to stupid people.

IMO, it's worth the extra cost, because my Mac just works. Also, average battery life on my laptop, with the regular battery, is 6 hours. My brother has the 15" screen, and he gets about 5.

[Rhino]

As is typical, the danger is greatly overhyped.

TITLE:
Microsoft Web Proxy Auto-Discovery Feature Security Issue

SECUNIA ADVISORY ID:
SA27901

VERIFY ADVISORY:
http://secunia.com/advisories/27901/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Exposure of sensitive information

WHERE:
From remote

OPERATING SYSTEM:
Microsoft Windows 2000 Advanced Server
http://secunia.com/product/21/
Microsoft Windows 2000 Datacenter Server http://secunia.com/product/1177/ Microsoft Windows 2000 Professional http://secunia.com/product/1/ Microsoft Windows 2000 Server http://secunia.com/product/20/ Microsoft Windows XP Professional http://secunia.com/product/22/ Microsoft Windows XP Home Edition http://secunia.com/product/16/ Microsoft Windows Vista http://secunia.com/product/13223/ Microsoft Windows Server 2003 Datacenter Edition http://secunia.com/product/1175/ Microsoft Windows Server 2003 Enterprise Edition http://secunia.com/product/1174/ Microsoft Windows Server 2003 Standard Edition http://secunia.com/product/1173/ Microsoft Windows Server 2003 Web Edition http://secunia.com/product/1176/

SOFTWARE:
Microsoft Internet Explorer 6.x
http://secunia.com/product/11/
Microsoft Internet Explorer 7.x
http://secunia.com/product/12366/

DESCRIPTION:
A security issue has been reported in Microsoft's Web Proxy Auto-Discovery (WPAD) feature, which can be exploited by malicious people to conduct man-in-the-middle (MITM) attacks.

The problem is that the WPAD feature resolves "wpad" hostnames up to the second-level domain, which is potentially untrusted. This can be exploited to conduct man-in-the-middle attacks against third-level or deeper domains.

Successful exploitation requires e.g. that the system has a primary DNS suffix configured (please see the vendor's advisory for details and other mitigating factors).

SOLUTION:
The vendor has provided various workarounds. Please see the vendor's advisory for details.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Beau Butler.

ORIGINAL ADVISORY:
Microsoft (KB945713):
http://www.microsoft.com/technet/security/advisory/945713.mspx• Customers who do not have a primary DNS suffix configured on their system are not affected by this vulnerability. In most cases, home users that are not members of a domain have no primary DNS suffix configured. Connection-specific DNS suffixes may be provided by some Internet Service Providers (ISPs), and these configurations are not affected by this vulnerability.

• Customers whose DNS domain name is registered as a second-level domain (SLD) below a top-level domain (TLD) are not affected by this vulnerability. Customers whose DNS suffixes reflect this registration would not be affected by this vulnerability. An example of a customer who is not affected is contoso.com or fabrikam.gov, where “contoso” and “fabrikam” are customer registered SLDs under their respective “.com” and “.gov” TLDs.

• Customers who have specified a proxy server via DHCP server settings or DNS are not affected by this vulnerability.

• Customers who have a trusted WPAD server in their organization are not affected by this vulnerability. (See the Workaround section for specific steps in creating a WPAD.DAT file on a WPAD server.)

• Customers who have manually specified a proxy server in Internet Explorer are not at risk from this vulnerability when using Internet Explorer.

• Customers who have disabled 'Automatically Detect Settings' in Internet Explorer are not at risk from this vulnerability when using Internet Explorer.http://www.microsoft.com/technet/security/advisory/945713.mspx

[DoctorDoom]

There is a very good basic software package that comes with it, which, if you use, it you would be saving about $700 in equivalent Windows software. The programs included consist of video editing, sound recording and remixing, and DVD production.Ay, there's the rub. IF you use it. However, those are programs for pro and semi-pro users, not for John Q. Average User. Buying a Mac for the usual things that the vast majority of folks do is a waste of money, rather like buying a Ferrari to drive to the supermarlket.

It just verifies my observation that Macs are not designed for the typical user.

You don't have to defragment your hard drive (because there is a different file structure) ...Because of the physical and electronic natures of hard drives, there is no such thing as one that doesn't need defragmenting over time. The file structure is irrelevant, since the puter is reading from and writing to the drive, storing files in clusters and sectors, deleting and adding files and finding places to put them. The best that a file system can do is stretch out the time between defrags.

It is of course entirely possible that it's being done automatically during idle periods, and you'd never notice it taking place.

[Rhino]

Right on both counts.

Learn about disk optimization and Mac OS X.

About optimization and fragmentation

Disk optimization is a process in which the physical locations of files on a volume are "streamlined." Files and metadata are re-arranged in order to improve data access times and minimize time moving a hard drive's head.

Files can become "fragmented" over time as they are changed and saved and as the volume is filled, with different parts of a single file stored in different locations on a volume. The process of collecting file fragments and putting them "back together" is known as optimization. However, if a failure occurs during optimization, such as power loss, files could become damaged and need to be restored from a backup copy....

...Fragmentation was often caused by continually appending data to existing files, especially with resource forks. With faster hard drives and better caching, as well as the new application packaging format, many applications simply rewrite the entire file each time. Mac OS X 10.3 Panther can also automatically defragment such slow-growing files. This process is sometimes known as "Hot-File-Adaptive-Clustering."...http://docs.info.apple.com/article.html?artnum=25668

[mkafrica]

Such is the case, but the important thing is, you don't have to worry about it. The system does so automatically. You're not taking 30 minutes to several hours of your time with maintaining your computer, etc.

[Rhino]

Windows has evolved similarly. Fragmentation is far less of an issue, but it still exists.

[DoctorDoom]

You're not taking 30 minutes to several hours of your time with maintaining your computer, etc.If done frequently, defragging takes only a few seconds on Windows machines. When it is seldom if ever done, and there are tens of thousands of fragments, it will take a good long while.