(Read More... | 1390 bytes more | comments? | Score: 0)

Happy New Year to all!

There is also a "Happy Birthday" to be observed. Yes, the venerable TCP/IP protocol suite turned 25 on January 1st (http://blogoscoped.com/archive/2008-01-01-n53.html). In computer time that is a lot of years, but it seems to just keep maturing and doing the job. The next big advance may very well be the adoption of IPv6, but that may not filter down to the desktop for a while yet as providers use IPv6 with their backbone connections but retain IPv4 internally.

So, what else is in store for the new year?

(Read More... | 12 comments | Score: 0)

In the aftermath of the extremely intensive Denial of Service attack on www.castlecops.com the site has emerged even stronger than before. One of the new "strengths" is the mirroring of databases used by HiJackThis analysts all over the internet. In Paul's own words:

The research database lists at www.castlecops.com are now mirrored at the following location:

http://mirrors.castlecops.com

Each of the mirror nodes checks the health of www.castlecops.com in real time. If they find it to be down, the nodes will open up like a book and permit immediate browsing -- just like you are used to at the main site.

The links are also the same, for instance, if you are trying to access the following and the site is down:

http://www.castlecops.com/tk1391-msdoh_dll_random_Class_ID.html

http://mirrors.castlecops.com/tk1391-msdoh_dll_random_Class_ID.html

Simply replace "www" with "mirrors" and it'll come up. Currently three mirrors are online offering data distribution in a total of four different ISPs and geolocs -- more nodes are on the way.

As formidible as the attack was, the main results achieved have been an increase in the site's resiliency and a new slogan "We Will Not be Silenced!" displayed at the top of each page. Kudos to Paul and all cooperating parties for establishing these mirrors.

(Read More... | 7 comments | Score: 0)

The long awaited version 2 of Counterspy from Sunbelt Software went gold today. Official communications from Sunbelt can be found at both the official press release and the Sunbelt Blog. This newest version can be downloaded from the Counterspy home page.

Current users can get a free upgrade and newusers can (and should) take advantage of a 15 day trial offer.

I have tested this product since it was pre-beta and am pleased to report that it ameliorates the performance issues that dogged v1.5. Other exciting improvements include a greatly enhanced Active Protection functionality which qualifies as full feature process firewalling and support for Windows Vista. Scan speed is excellent with a very light performance footprint.

Now that v2.0 has been released there will be articles posted in our Counterspy forum that deal with possible problem areas. If you have a problem and don't find an answer then please post the question.

Sunbelt has definitely done this version the right way and I encourage all CS users to upgrade.

(Read More... | 5278 bytes more | 28 comments | Score: 5)

There are people in every field of endeavor that would like to be something that they are not. Most get over it, move on, find another interest, etc. Those who just can't give it up and proceed to the point of pretending that they are something they are not are commonly called wannabees.

There is a particularly persistent wannabee at Castlecops right now. In case you don't know, Castlecops began the Phishing Incident Reporting and Termination (PIRT) team just about a year ago. In the time since, the team has handled tens of thousands of phish reports and, more importantly, terminated them while often collecting information that may actually identify the phishers. Team membership is subject to stringent vetting to ensure that the sensitive information that often surfaces will not be revealed to any who are not totally reliable.

It was probably inevitable that an effort of this magnitude and success would attract wannabees and it certainly has. By far the most interesting and persistent of these has been Antiphishing. The lengths that he has gone to to impersonate something that he is not make him a world class wannabee.

(Read More... | 3 comments | Score: 0)

Yes, it appears that Microsoft will push the long awaited (feared?) IE7 as an out of cycle critical update to all Windows XP SP2 customers sometime this month (Oct 2006).

I am personally looking forward to finally seeing it but there are some precautions to be taken. IE is deeply embedded into the OS and will be writing to registry keys across most (all?) hives. This app has been fully tested and doesn't need to cause problems but there are precautions that need to be taken during the update:

1. Set a restore point
2. Disable any active protection monitors that might interfere with writes to the registry
3. Shutdown all other running processes except the firewall. This is always a good idea but may be critical in this case.

One of the best experts in IE that I know is a fellow MS MVP named Sandi Hardmeier who has kindly published her thoughts on IE7 installation. You may want to read through her comments on the procedure.