<?xml version="1.0" encoding="UTF-8"?>

<rss version="2.0" xmlns:blogChannel="http://backend.userland.com/blogChannelModule">

<channel>
<title>Security forum - dslreports.com community</title>
<link>http://www.dslreports.com/forum/security</link>
<description>Security forum current topics</description>
<language>en</language>
<copyright>Copyright 2007, dslreports.com</copyright>
<pubDate>Mon, 09 Nov 2009 07:45:54 EDT</pubDate>
<lastBuildDate>Mon, 09 Nov 2009 07:45:54 EDT</lastBuildDate>

<image>
<title>dslreports.com</title>
<url>http://i.dslr.net/bbrdisc1.gif</url>
<link>http://www.dslreports.com</link>
<width>19</width>
<height>18</height>
<description>bbr disc</description>
</image>

<item>
<title>Anti Virus Program? Tried Avast-Looking For Better Program</title>
<link>http://www.dslreports.com/forum/remark,23300669</link>
<description><![CDATA[Looking for a the "best" anti virus program that works with Windows 7. Tried Avast and do not like. Besides AVG what is the safest and best anti virus program out there? Thanks.
--
Love That SpongeBob! Great Forum]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23300669</guid>
<pubDate>2009-11-06 08:57:52</pubDate>
</item>

<item>
<title>Framed for child porn 151; by a PC virus</title>
<link>http://www.dslreports.com/forum/remark,23311849</link>
<description><![CDATA[http://tech.yahoo.com/news/ap/20091108/ap_on_hi_te/us_tec from http://it.slashdot.org/article.pl?sid=09/11/08/2135245 ...

"The Associated Press tells the story of Michael Fiola, a former Massachusetts government employee who was arrested in 2007 after child porn was found on his state-issued laptop computer. He was eventually cleared of all charges after some digging by the defense found that the laptop was infected with malware that was 'programmed to visit as many as 40 child porn sites per minute &#151; an inhuman feat. While Fiola and his wife were out to dinner one night, someone logged on to the computer and porn flowed in for an hour and a half. Prosecutors performed another test and confirmed the defense findings. The charge was dropped &#151; 11 months after it was filed.' The article also discusses the technical aspects of how it could happen and about similar cases in the United Kingdom in 2003."
--
Ant @ http://antfarm.ma.cx and http://aqfl.net. Please do not IM/e-mail me for technical support. Use the forum! Disclaimer: The views expressed in this posting are mine, and do not necessarily reflect the views of my employer]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23311849</guid>
<pubDate>2009-11-08 20:29:37</pubDate>
</item>

<item>
<title>Kid&#x27;s site query</title>
<link>http://www.dslreports.com/forum/remark,23305331</link>
<description><![CDATA[I am not sure how to approach this one.

I know I can email them in regards what I consider a breach, however I thought I'd run it past the experts first.

I know my kids account have been used by others, they buy/sell cloths etc, and there has been movement when they have not been on.....no a biggie you say. However comments have been made in their name as well. 

So obviously, regardless of whether the password has been breached or the site has been exploited, I'm wondering first, has anyone else noticed this? Do you trust a site as such if you want to pay to join? (another separate question to my main concern)

they have no youtube or such accounts and only use a couple of accounts on kids game sites. How do you look into these? Hope the admin care enough to listen? If the site is breached, then are the admin careful enough?

Any advice for a concerned parent, even though so far it is harmless, even with the derogative comments posted in their absence, how do you approach this to help others? 
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23305331</guid>
<pubDate>2009-11-07 06:12:50</pubDate>
</item>

<item>
<title>SEO redirect: ip-lookup.net</title>
<link>http://www.dslreports.com/forum/remark,23268892</link>
<description><![CDATA[Can anyone verify this?
Google search term 'iplookup'.
First result shown is ip-lookup.net.

If I click the first result, I get a delay, and firewall warning blocking the following from connecting:

r2prod.com at 213.186.206.199, which I think might be a redirect via SEO poisoning. If others don't see this, then I'll have to conclude its locally sourced.
Browser here is FF 3.0.14, but confirmed on IE6 as well. Also worth noting is that the block is effectively (only) coming from the CoU IP blocklist. Thanks Donna and the entire CalendarofUpdates Team.
You continue to produce an outstanding resource for the rest of us.
Thanks in advance to any who offer insight on this.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23268892</guid>
<pubDate>2009-10-30 22:15:01</pubDate>
</item>

<item>
<title>removed by OP</title>
<link>http://www.dslreports.com/forum/remark,23310463</link>
<description><![CDATA[no replies.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23310463</guid>
<pubDate>2009-11-08 14:47:18</pubDate>
</item>

<item>
<title>New Cookie Attack - Google, Facebook, Others at Risk</title>
<link>http://www.dslreports.com/forum/remark,23293217</link>
<description><![CDATA[From The Register
4th November 2009 - said by Dan Goodin :Newfangled cookie attack steals/poisons website creds
Google, Facebook risk

A security researcher has discovered a weakness in a core browser protocol that compromises the security of Google, Facebook, and other websites by allowing an attacker to tamper with the cookies they set.

The weakness stems from RFC 2965, which dictates that browsers must allow subdomains (think www.google.com) to set and read cookies for their parent (google.com). The specification also states that if a cookie for a subdomain doesn't already exist, the browser should use the cookie belonging to the parent instead.

The arrangement makes it possible for attackers to steal or even alter the cookies that websites use to authenticate their users. Attackers would first have to identify an XSS, or cross-site scripting, bug in some part of the site they are targeting. But because virtually any subdomain will suffice, the scenario isn't unrealistic, two web security experts said.

"Most websites actually will store session IDs in a cookie and that's actually how they keep track of users throughout the use of their website," said Mike Bailey, a senior researcher for Foreground Security who first documented the flaw at last month's Toorcon hacker conference. "Using the same techniques to attack those cookies, I can really damage sessions and cause some problems."

Bailey's paper goes on to demonstrate how he used the technique to bypass a feature Google recently implemented to beef up security on Gmail and other properties. By exploiting a minor vulnerability in sites.google.com, he was able to falsify the contents of his global Google cookie. Google has since fixed the XSS hole in the subdomain.

In turn, that allowed him fool the Google protection, which checks to make sure the value in the cookie matches a hidden parameter of the login page.

Bailey lists several other sites that have been known to be vulnerable to similar attack techniques. Using an XSS hole on www.advertising.expedia.com, he found it was possible to poison the global cookies for the entire expedia.com domain. Because the site didn't set the cookies with proper escaping, an attacker could have used the weakness to inject malicious javascript into expedia pages.

Chase.com, capitalone.com and chasevisasignature.com either are or were vulnerable to similar attacks because they shared code with images.bigfootinteractive.com, which was vulnerable to XSS exploits.

Bailey said it's not hard to imagine university websites would be vulnerable to such attacks because the domain names frequently use names such as psychology.school.edu, geography.school.edu and so forth. A single bug in a student-maintained computer science project might be enough to compromise personal data stored on the college's student enrollment server, he said.

Websites can guard against attacks by regularly checking their pages for bugs, but because the attack exploits the way browsers are supposed to handle cookies, a more comprehensive fix will probably require a change to the underlying protocols. Which means this attack will probably be around for a while to come.

The paper is here.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23293217</guid>
<pubDate>2009-11-04 20:44:14</pubDate>
</item>

<item>
<title>Please Help, I think my computer is being monitored</title>
<link>http://www.dslreports.com/forum/remark,23304736</link>
<description><![CDATA[Recently, I'd say within the last few weeks I have begun noticing through TcpView that my computer seems to be periodically connecting to a site called "objectsciences.com". The connections take place in both Firefox/IE and even Yahoo IM. They appear as for exp.- "host4.objectsciences.com" "host50.objectsciences.com" etc. and so on. I have scanned my computer and it appears clean. The thing that worries me though is that after searching for info on this site, I have found that it apparently resolves to a company called SAIC which apparently is a large contractor for NSA, FBI, CIA, Homeland Security, DOD and whomever else I really dont know.

I am just a typical novice home computer user and have honestly not done anything illegal. Can someone possibly offer any info on what this all may be? What is this site? Should I inquire with my ISP? Should I contact a lawyer? Should I expect that the FBI or something is going to come to my door?  Assuming I am in fact for whatever reason somehow being monitored, is that even Legal then for them to do? 

I really am in desperate need of some help or advice or any info here. Please can anyone help me?

Thank you  ]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23304736</guid>
<pubDate>2009-11-06 23:10:04</pubDate>
</item>

<item>
<title>online web tool &#x22;web sniffer&#x22;</title>
<link>http://www.dslreports.com/forum/remark,23308759</link>
<description><![CDATA[http://web-sniffer.net/
let the server do the dirty work.
--
&#9786;]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23308759</guid>
<pubDate>2009-11-08 00:51:30</pubDate>
</item>

<item>
<title>Remote Desktop via SSH and error message</title>
<link>http://www.dslreports.com/forum/remark,23309168</link>
<description><![CDATA[http://theillustratednetwork.mvps.org/Ssh/RemoteDesktopSSH.html

I tried to configure SSH server (let us call this PC : Server PC) and putty (let us call this PC: Client PC) exactly as described in the link above (step by step).

I have got two PC with XP Profe OS,,,,one PC (Where SSH server is installed) is on cable modem and other PC (where PUTTY is installed ) is on dialup.

I was able to establish a SSH Tunnel  but I could not access RDP,,,,I do not know where was the problem.

Port forwarding is okay no problem otherwise I would not be able to establish SSH tunnel

from PC where PUTTY is installed (let us call it Client PC) when I tried to type in the ip address (for the PC where SSH server is installed let us call it Server PC) with source port number (for Client PC) I received the below error message :

  

http://img687.imageshack.us/i/errormessagessh.jpg/

Any idea what troubleshoot should I perform ?]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,23309168</guid>
<pubDate>2009-11-08 06:53:44</pubDate>
</item>

</channel>
</rss>
