Computer Security Weekly, May 31, 1999

Never attribute to malice that which can be adequately explained by automated stupidity. CyberSitter, of course, holds the unchallenged title for "Internet Filtering Software With a Hidden Agenda:" it blocks a number of sites with left leaning political views (regardless of pornographic or violent content) and also those that explain what CyberSitter is doing. However, it was recently discovered that SurfWatch was blocking a number of sites that had no content on them at all. SurfWatch itself was surprised: it has recently instituted an automated assessment function that appears to be generating a number of false alarms.

---

It seems that Microsoft's Autoroute Express 2000 has a bit of a bug. The British version does not seem to be aware that Motorway rest areas are directly attached to the highway. If you ask the system to plan a route that includes rest stops, it can add up to 33 kilometres to the trip by finding the "nearest" path down secondary and side roads. No report yet on other versions.

---

There was a recent report of a virus scanner generating false positive alarms on utility software developed in house at one software pubisher. The alarm was caused by the use of a scan string common to a particular compiler. With the slow rise of compiled virus code this kind of problem has become more familiar (in fact, one particular antivirus company is rather known for it). More responsible companies, like F-PROT, find at least two unique strings for each virus, and only give a definite identification if both strings are present.

---

Still on the virus scanning front, Microsoft's HotMail has an option to scan incoming mail. There is a recent report that it does not do a very good job. In particular, it does not identify the Win.Ska/HAPPY99 worm.

---

And yet one more. Recently a sysadmin at one site did a scan on a machine that ran the company's email. The mail server software was Microsoft Exchange, which stores all mail in a monolithic database of its own format. Somehow, though, the scanner detected the CAP macro virus, and attempted to disinfect the file. Predictably, the file was corrupted, and the mail was lost. *All* the mail was lost. Notes to administrators:

1. Avoid programs that use monolithic file structures.
2. Avoid proprietary formats.
3. Anonimizing services (they can generally access anything on the net)

---

More on cookies: Chapters new online bookstore has apparently taken heed of complaints by early users of the first site - they no longer demand that you have cookies enabled. Microsoft has not learned the lesson: recently they instituted a mandatory cookie policy on HotMail, and a number of users suddenly seemed to lose access.

Go To Page: 1 2

Articles in this Topic    Discussions in this Topic