June 2007 - Posts

Sorry for the blog downtime...

Nothing really scandalous or exciting like a denial of service or a hacking or something like that has happened - all it was was a hardware failure.  Susan may post the details to Yoda's blog some time soon.

Things may be shaky for a little while, and I've lost roughly half of my Feedburner subscribers  Sad But we're back now - onward and upward.

Posted by sandi with 2 comment(s)
Filed under:

Winfixer, real media and valueclick.... the fight continues

I don't know about you, but I feel like I am playing whack-a-mole most of the time.

I was asked to review a discussion through on dslreports today - a report that was complaining about malware incidents on the www.wfaa.com web site - the typical Winfixer via hostile banner advertisements carry on.

Cite: http://www.dslreports.com/forum/r18551684-Another-WinFixer-infiltrationthis-time-on-wwwwfaacom

So, let's go have a look.

I can state, conclusively, that the wfaa.com web site *is* exposing its users to fraudware - and Real Media and ValueCilck are both implicated.

Proof - Fiddler was running during an attempted infestation. - now, there are some bits and pieces stripped.... as much for the readers' convenience as for my privacy, but you get the gist...

The powers that be are welcome to the entire capture... you know who you are...

GET /pages/scanner/index.php?aid=alreadyx&lid=intl&ax=1&ex=1&ed=2 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Referer: http://ads.belointeractive.com/RealMedia/ads/Creatives/OasDefault/NtlZappinadsInc001A-rmn/NtlZappinadas728_061907.swf?clickTAG=http://ads.be
Content-Type: application/x-www-form-urlencoded
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)
Host: www.errorsafe.com
Proxy-Connection: Keep-Alive

HTTP/1.1 302 Found
Via: 1.1 SERVER
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Transfer-Encoding: chunked
Date: Tue, 26 Jun 2007
Location: http://adfarm.mediaplex.com/ad/ck/52853?aid=alreadyx_rdt&mpt=[CACHEBUSTER]
Content-Type: text/html
Server: Apache
X-Powered-By: PHP/4.4.2
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Set-Cookie: cnt=**; expires=Thu, 21 Feb 2008 00:13:36 GMT; path=/; domain=.errorsafe.com
Set-Cookie: lng=**; expires=Thu, 21 Feb 2008 00:13:36 GMT; path=/; domain=.errorsafe.com

GET /ad/ck/52853?aid=alreadyx_rdt&mpt=[CACHEBUSTER] HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Referer: http://ads.belointeractive.com/RealMedia/ads/Creatives/OasDefault/NtlZappinadsInc001A-rmn/NtlZappinadas728_061907.swf?clickTAG=http://ads.be
Cookie: svid=**
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)
Proxy-Connection: Keep-Alive
Host: adfarm.mediaplex.com

HTTP/1.1 302 Moved Temporarily
Via: 1.1 SERVER
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Content-Length: 0
Date: Tue, 26 Jun 2007 00:13:36 GMT
Location: http://pcturbopro.com/.download_now/index.php?p=18&ax=1&ed=2&ex=1&hv=10&j=1&aid=alreadyx_rdt&mpt=[CACHEBUSTER]
Server: Apache-Coyote/1.1
Cache-Control: no-cache

GET /.download_now/index.php?p=18&ax=1&ed=2&ex=1&hv=10&j=1&aid=alreadyx_rdt&mpt=[CACHEBUSTER] HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Referer: http://ads.belointeractive.com/RealMedia/ads/Creatives/OasDefault/NtlZappinadsInc001A-rmn/NtlZappinadas728_061907.swf?clickTAG=http://ads.be
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)
Host: pcturbopro.com
Proxy-Connection: Keep-Alive

Posted by sandi with 6 comment(s)

haute secure - how it works

Ok, so I've had the chance to chat to the developers behind Haute Secure, and I have a little more information about the how's and why's of the product.  I'll leave it to them to introduce themselves, and provide their Curriculum Vitae, in future days/weeks.

My regular readers will know that I had a few questions about Haute Secure:

"There is a lot still to be learned about Haute Secure - for example, exactly how does it work and how often is the database updated - is information transmitted encrypted - is it a fully dynamic service or is information stored locally - what classes as malware - does the site have to actually attempt to install software to be blocked, or is a known download site for fraudware (such as sites used by the Winfixer family of fraudware) also blocked - how will it handle malicious banner advertisements or pop-ups - will it go down the "all adverts are bad" route taken by the popular protective HOSTS files, or will it try to differentiate between good ads and bad ads (which is going to be a real technical challenge)."

I won't go in to too much depth now - the product is still in alpha, and the developers are very open to feedback, therefore the entire situation is still very malleable - it is more appropriate to consider the following as current thinking rather than set-in-stone "this is how it is going to work" type information.  Please, be gentle on the guys.. they're talking to the best people in the business (including me, forgive the arrogance) so things could, and likely will, change, as they go forward.

Data and synching

There is a locally cached copy of the master database. The data store itself is locked very early in the boot process and the application has the only interface to it.  The client regularly syncs a copy of the database with Haute's web service.  The data that comes down to the client is hashed and signed.  The resynch interval is still being tweaked, but it's very regular, certainly comparable with IE7's phishing filter.

Haute Secure's client application and web service relationship

The client provides both 'passive' and 'active' protection. Passive protection is the block list which will pop up the block/warn dialog on the client if the user navigates to a site that has previously been identified as having bad content.  Active protection is a behavioral analysis that watches for and then protects against sites exhibiting malicious behavior. This way if a user hits a malicious site that Haute Secure has never encountered before it can protect them even though the site isn't on the block list. The client protects the user by blocking the malicious behavior AND reporting the malicious site to Haute's web service.  This report is then validated and propagated out to all other clients via the web  service.

The service

The backend is proactively going out and scanning for malicious sites, and is the primary way that the block list is populated.  The service also validates sites that the client behavioral analysis believes is malicious and then passes them through to the web service.

The current thinking is that Haute Secure will not block all ads BUT they are already picking up malicious ads in their backend scanning. Since they have behavioral analysis and  protection on all the clients they hope to pick up and block malicious ads that get served that have not previously been encountered (and, of course, once one client picks an ad up, it goes back to the web service and then gets propagated out to all the other clients).

They don't tackle fraudware - yet.

As Haute explains it, fraudware is a very hard problem to solve in an automated way (and heavens knows I, and every advertising network out there, will agree with them). Watch this space for possible developments on that point.

I admit to being very excited about the potential for good in this product.  Malware served via banner advertisements, hacked web sites and malicious blog comments is a growth industry.  I've had discussions with antivirus companies that I have connections with about the need to actively honeypot the various advertising networks because of the reality of hostile creatives, but reality is that they can't help out in a way that can make a real difference. 

I hope, I hope, I hope, I hope, I hope that going forward services such as Haute Secure can make a real difference in the fight against malware and betrayware, and the attempts by the bad guys to get on to our system via Web 2.0 ... fingers crossed...

 More to come later as the product develops.

Streaming content stops, and you may receive an error message when you click "Next" in Windows Media Player

I'll be honest - this is one of the most unhelpful KB articles that I have encountered.  Basically, the KB says the problem occurs when IE7 is installed, and that Microsoft is aware of the problem, and that's the entirety of the advice that they give.

In Microsoft Windows Media Player, you play streaming content from a Microsoft Windows Media Services 9 Series server. When you click Next to skip the content, the content stops. You may receive the following error message:

Windows Media Player cannot access the file. The file might be in use, you might not have access to the computer where the file is stored, or your proxy settings might not be correct.

You might not receive this error message, depending on when the content switches to the next unit of content.

This problem occurs when Windows Internet Explorer 7 is installed on the computer on which you are viewing the content.

http://support.microsoft.com/default.aspx/kb/934113

Posted by sandi with 1 comment(s)
Filed under:

haute secure - a new add on dedicated to fighting malware sites

How can I best describe Haute Secure, a yet to be released toolbar for Internet Explorer (x86 and x64).  Well, we all know how successful the Phishing Filter has been at protecting web surfers from phishing sites - a big part of the success of the Phishing Filter has been the data sharing that happens - whether it be data sharing between Microsoft and various corporate data providers, or IE7 users sharing their phishing site discoveries with Microsoft.

The developers of Haute Secure are very aware of the new risks associated with Web 2.0, whether it be social networking, blogs, search engines, widgets or banner ads.  Regular readers of my blog will know that such risks are a primary focus and interest for me as well - I've been right in the thick of the fight to get malware out of the various advertising networks and trying to shut down compromised web sites, and heaven knows I'm sick of having to carefully check blog comments just in case the URL of the poster is a malware or compromised Web site.

Haute Secure is a step towards using the same sort of communal mind-share that is the foundation stone of the Phishing Filter's success, but this time the target is malware.  Users are protected as follows:

  1. Bad sites are blocked before they can load.
  2. Even if the site has not been encountered before, Haute Secure can stop sites from downloading malware via the use of behaviour based algorithms.
  3. Every time the software blocks a malware download, the incident is reported to Haute Secure's malicious link database. What was once an unknown bad site becomes a known bad site, protecting future visitors to the site who are using Haute Secure.

As you'll see from the screenshot below, Haute Secure installs a toolbar in IE7.  It looks small, but it is kind of eye catching - the toolbar changes color, moving from a gray tone to red, and back again.  BTW, the Find toolbar you can see in the screenshot is "Find As You Type", available at www.enhanceie.com.

image

CAVEAT: Please bear in mind that I am running a pre-release build of Haute Secure - the look and behavior of the product could, and likely will, change a lot between now and later builds

Haute Secure is not yet available to the general public.  The home page is live, but there is not much to see.

Known bad sites are blocked:

image

False positives can be reported:

image

Clicking on "Let us know" brings you to this page:

image

Clicking on the toolbar when an alert is triggered gives us various options - you can continue to the site if you wish, and even add the site to an ignore list.

image

The more info screen:

image

There is a lot still to be learned about Haute Secure - for example, exactly how does it work and how often is the database updated - is information transmitted encrypted - is it a fullly dynamic service or is information stored locally - what classes as malware - does the site have to actually attempt to install software to be blocked, or is a known download site for fraudware (such as sites used by the Winfixer family of fraudware) also blocked - how will it handle malicious banner advertisements or pop-ups - will it go down the "all adverts are bad" route taken by the popular protective HOSTS files, or will it try to differentiate between good ads and bad ads (which is going to be a real technical challenge).

I'll post again once a build is available to the public and as I learn more.

Dell backs down on bloatware

A while ago my boss (a Mac aficionado) pointed out the Mac v PC bloat video as just one more piece of evidence proving that Macs are better than PCs because, and I quote what he said, "Macs don't come with any of that crap".

Video in question:
http://movies.apple.com/movies/us/apple/getamac/apple-getamac-fat_480x376.mov

So here's the thing.  How many people remember the various complaints and lawsuits Microsoft has faced over time because whatever third party software provider is crying because their software is not part of a standard Windows OEM build?

I find it amazingly ironic that, on the one hand, Microsoft is hammered for anti-competitive behaviour and unfair business practices (hello!! It isn't Microsoft that is restricting computers to "you get what you're given and you'll *like* it"), and on the other hand, we see stuff like the video advertisement put out by Mac about bloat.

PC says "it's all this trial software; they packed my hard drive full of all this software; all these programmes that don't do very much unless you buy the whole thing or are just plain useless; it really slows me down; -sigh- you know how it is"

MAC responds "Well, actually I don't; MACS just come with the stuff you want like itunes, imovie, iphoto, iweb; it's all part of ilife"

Jeez, I tell ya, if Microsoft tried to restrict PCs to just their software (for example, if they tried to restrict PCs to a mythical software set such as pctunes, pcmovie, pcphoto, pcweb and pclife), just their hardware, just their whatever, the baying of the one-eyed hounds would be deafening.

Anyway, what triggered this rant? Oh yeah, Dell are patting themselves on the back because they're going to remove "bloatware" from their PCs - you know, the bloatware that companies went to court to to be able to include on new PCs - the bloat that people then complained about and MAC users made jokes about?

Cite: http://news.zdnet.co.uk/software/0,1000000121,39287685,00.htm

I quote from the article:

""When you configure a system on Dell.com, you [now] have the option of choosing "No software pre-installed" for things like productivity software, ISP software and photo and music software," wrote Michelle Pearcy, Dell's worldwide client software manager, in a blog.

Pearcy added that "no software" would become the default option on most XPS systems, and an option on Dimension desktops and Inspiron notebooks.

However, three types of software will remain mandatory. These include trial versions of antivirus packages, "because many of our customers simply expect their PCs to be protected at first boot and beyond", according to Pearcy.

Other mandatory software will include Acrobat Reader so users can view essential system documentation, and Google tools."

What the hell?? Google tools and Adobe Reader are mandatory???? Why the hell would Adobe Reader and Google tools be mandatory???  What about the other free PDF readers that are out there?  Why aren't Dell users given a choice of PDF Reader software!!  What if I want to be given the choice to use PrimoPDF?  Or Nitro?  Or pdf995?  Or cutepdf?  Or an open source PDFcreator or reader?  It's anti-competitive I tell ya... anti-competitive!!! Bring out the hangman and stocks!!!  Somebody call the EU!!  -cough-  Oh, sorry, we're not talking about Microsoft, are we... my apologies (yes I am being SARCASTIC damn it)

As for Google tools, how DARE Google have their stuff as mandatory after the tricks they have been playing lately:

Complaining about IE7's search bar - complaint rejected by the powers that be:
http://msmvps.com/blogs/spywaresucks/archive/2006/05/02/93180.aspx
http://msmvps.com/blogs/spywaresucks/archive/2006/05/18/95661.aspx

Did Google steal Yahoo's IE7 download page design?
http://msmvps.com/blogs/spywaresucks/archive/2006/12/12/414322.aspx

Feedburner users: give your data to Google or lose your account:
http://msmvps.com/blogs/spywaresucks/archive/2007/06/04/941419.aspx

Google announced that a member of its video team had sent the worm, W32/Kasper.A@mm, to members of a Google Video Blog discussion list. The worm wipes out files.
http://www.itnews.com.au/newsstory.aspx?CIaNID=41990

Google Desktop. When I say "no" I mean "NO!!!"
http://msmvps.com/blogs/spywaresucks/archive/2006/03/05/85482.aspx

And as for the other "mandatory" software, Adobe Reader - who remembers how Adobe forced MS to remove their PDF ability from Office 2007?
http://msmvps.com/blogs/spywaresucks/archive/2006/06/03/98950.aspx

NitroPDF is a hell of a lot cheaper than Adobe Acrobat anyway!!  And their technical support is a hell of a lot better!!
http://msmvps.com/blogs/spywaresucks/archive/2006/07/12/104508.aspx
http://msmvps.com/blogs/spywaresucks/archive/2006/10/21/193880.aspx

I ask you, just who is the predatory business nowadays?  I tell you, this stuff gets me nearly as angry as so-call Office Managers who are so inexperienced that they cannot tell the difference between "managing" or, more importantly, "mentoring" staff and "controlling" staff (but that's a story for another day).

HOTFIX: An application uses the Favorites folder of IE7 as the root directory when the application calls the DoOrganizeFavDlg function

This problem occurs because Internet Explorer 7 ignores the specified pszInitDir parameter.

http://support.microsoft.com/default.aspx/kb/933014

A comprehensive list of IE7 related Knowledge Base articles can be found here:
http://www.ie-vista.com/kbase3.html

Posted by sandi with no comments
Filed under:

Multiple windows open when you start IE7 after you upgrade from Windows XP to Windows Vista

This issue may occur if Internet Explorer was configured to include a trusted Web site in Windows XP. When you upgrade to Windows Vista, Internet Explorer 7 inherits the list of trusted Web sites from Windows XP.

In Internet Explorer 7, trusted Web sites and Web sites that are not trusted do not appear in the same window. By default, protected mode is disabled for Web sites that are registered as trusted Web sites. Protected mode is enabled for Web sites that are not registered as trusted Web sites.

When Internet Explorer 7 starts for the first time, it is redirected from a Microsoft Web site to the http://runonce.msn.com/runonce2.aspx Web site. This Web site is used to set various configuration settings. If you register "*.microsoft.com" as a trusted Web site, Internet Explorer 7 starts with protected mode disabled to access the Microsoft Web site. Then, Internet Explorer 7 redirects you to the home page that is set in the preferences. However, if the home page is not a trusted Web site, protected mode is enabled. Therefore, a new Internet Explorer 7 window opens.

http://support.microsoft.com/default.aspx/kb/931954

A comprehensive list of IE7 related Knowledge Base articles can be found here:
http://www.ie-vista.com/kbase3.html

Posted by sandi with no comments
Filed under:

HOTFIX: The InternetQueryOptionW function returns a value of true when you use the INTERNET_OPTION_URL option flag as the second parameter in IE7

This problem occurs because of an error in the Wininet.dll file and does not occur in earlier versions of Internet Explorer.

http://support.microsoft.com/default.aspx/kb/935776

A comprehensive list of IE7 related Knowledge Base articles can be found here:
http://www.ie-vista.com/kbase3.html

Posted by sandi with no comments
Filed under:

HOTFIX: The buffer size of the InternetQueryOptionW function is half of its actual size if you use INTERNET_OPTION_URL as the second parameter in IE7

This problem occurs because of an error in the Wininet.dll file and does not occur in earlier versions of Internet Explorer

http://support.microsoft.com/default.aspx/kb/935777

A comprehensive list of IE7 related Knowledge Base articles can be found here:
http://www.ie-vista.com/kbase3.html

Posted by sandi with no comments
Filed under:

HOTFIX: IE6 and IE7 may not find the text even though the Web page contains the text

This problem occurs because the maximum number of paragraphs that Internet Explorer can search is 32,000 paragraphs. Internet Explorer may not find the text if the text is located after the maximum number of paragraphs.

http://support.microsoft.com/default.aspx/kb/936955

A comprehensive list of IE7 related Knowledge Base articles can be found here:
http://www.ie-vista.com/kbase3.html

HOTFIX: Error message when you use Outlook to open an e-mail message that contains a PDF attachment from an external mail system: "There was an error opening this document. The file is damaged and could not be repaired"

You install security update 931832 on a server that is running Microsoft Exchange Server 2003 Service Pack 2 (SP2). Additionally, you configure the Microsoft Office Outlook client in Microsoft Exchange Server mode. When you use Outlook to open an e-mail message that contains a PDF attachment from an external mail system, you receive the following error message:
There was an error opening this document. The file is damaged and could not be repaired.

This problem occurs only in Exchange 2003 SP2. You can open the PDF attachment as expected before security update 931832 is installed. Additionally, POP3 mail clients or IMAP4 mail clients may still synchronize messages and then open PDF attachments successfully after security update 931832 is installed.

http://support.microsoft.com/default.aspx/kb/937625

Posted by sandi with no comments
Filed under:

Error message when you use OWA to open a signed e-mail message that is sent as an attachment to an unsigned e-mail message: "The message has a digital signature, but it was not validated"

To resolve this problem, install this hotfix. After you install this hotfix, you must enable it by adding a CheckEmbeddedSmime registry entry to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeWEB\OWA registry subkey. To do this, follow these steps:

1. Click Start, click Run, type Regedit, and then click OK.

2. Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeWEB\OWA

3. On the Edit menu, point to New, and then click DWORD Value.

4. Type CheckEmbeddedSmime, and then press ENTER.

5. Right-click CheckEmbeddedSmime, and then click Modify.

6. In the Edit DWORD Value dialog box, under Base, click Decimal.

7. In the Value data box, type 1, and then click OK.

8. Exit Registry Editor.

http://support.microsoft.com/default.aspx/kb/937851

Posted by sandi with no comments
Filed under:

McKenna Announces Settlement with Privasafe and SurfSafe Operators - Thousands of Washington Consumers Eligible for Refunds

ANNOUNCEMENT – Attorney General Rob McKenna today announced that thousands of Washington consumers are eligible for refunds under a settlement with the operators of www.privasafe.com and www.surfsafeinternetservices.com that could ultimately cost the defendants $1 million.

“Consumer Digital Services, JSE Direct and their subsidiaries advertise on their Web sites that they will ‘protect your computer and privacy’ and guard you from ‘unscrupulous marketers,’” said Attorney General Rob McKenna. “But an investigation by our Consumer Protection Division High-Tech Unit found that their business practices were in conflict with their marketing pitch. While promoting their Privasafe and SurfSafe products, the defendants sold the personal information of thousands of consumers and billed consumers for services they did not want.”

In a consent decree filed today in King County Superior Court, defendants did not admit to any wrongdoing but agreed to provide full refunds to Washington consumers who were billed for Privasafe or SurfSafe Internet services anytime since Jan. 1, 2004. Defendants will notify eligible consumers by e-mail and mail.

The following defendants are parties to the settlement: Consumer Digital Services, LLC, and its subsidiary Privasafe, LLC; JSE Direct, LCC; and its subsidiary SurfSafe Internet Services; Leverage-CDS, LCC; CDS Family Trust; AMP-CDS, LCC and JG-CDS, LCC. All are located in Fort Lee, N.J.  Gary Salmirs, manager of Leverage-CDS, is also a defendant. According to a complaint filed by the Attorney General’s Office, Salmirs controlled Consumer Digital Services’ policies and practices.

The defendants agreed to a variety of injunctive provisions related to how they conduct business in the future and will pay $100,000 in civil penalties and $200,000 in attorneys’ fees. An additional $200,000 in civil penalties is suspended as long as they comply with the settlement terms.

The Attorney General’s Office alleged the defendants lured Washington consumers with online offers for “free” gift cards and merchandise including flat-screen monitors. The “free” products were promoted through pop-up ads, Web site banner ads and e-mail messages.

Consumers submitted their personal information including their address, e-mail address, telephone and birth date, believing they would receive the “free” product. They were subsequently charged $14.95 charge on their monthly phone bills for defendants’ Internet-related services, including e-mail accounts, security-related products and increased Internet connection speed. Defendants used third-party billing companies such as ACI Billing Services and ILD Telecommunications to place the charges.

“More than 13,000 Washington consumers have been billed for Privasafe and SurfSafe since January 2004 to a tune of more than $750,000,” McKenna said. “Only one Washington consumer received the advertised ‘free’ item.”

The bottom of the Web page, viewable only by scrolling down, included a statement that individuals who completed the form would be charged and that only those who paid the $14.95 monthly fees and remained in good standing for 90 days would receive the “free” item.

The statement also included a link to a privacy policy that waives the consumer’s rights under federal laws that restrict telemarketing. The Attorney General’s Office alleged the defendants sold personal information provided by thousands of Washington consumers to numerous third-party marketers.

“The product promotions were a means to obtain personal information. Consumers never saw the statement or the privacy policy,” said Assistant Attorney General Katherine Tassi, of the Consumer Protection High-Tech Unit. “Defendants discouraged scrolling by placing a large button starting ‘click here to continue’ at the bottom of the viewable portion of the Web page.”

The Attorney General’s Office said many consumers who discovered the charges on their phones bills had no idea what they were paying for and who was billing them. To date, more than half of Washington consumers who were billed for the services have requested refunds. Fewer than 5 percent of Washington consumers who were billed ever downloaded the software necessary to use the service.

As a result of the Attorney General’s investigation, the defendants are no longer billing Washington consumers. Today’s settlement prohibits them from selling or sharing any information collected from or about Washington consumers since Jan. 1, 2004.

The settlement terms require the defendants to disclose costs and billing methods for its products prior to collecting personal information from consumers and accurately represent the purpose for collecting and using personal information. They must clearly and conspicuously disclose the terms that apply to any “free” offer and cannot use a pre-checked box to indicate a consumer’s authorization to be billing for a product or service.

Consumer Refunds:

Washington residents who were billed for Privasafe or SurfSafe Internet Services since Jan. 1, 2004, are eligible for full refunds. Under the settlement agreement with the Washington Attorney General’s Office, the defendants must notify eligible Washington consumers that they are entitled to a refund.

Washington residents who believe they are eligible for a refund should monitor their e-mail for a message from the defendants that they are eligible for a refund pursuant to the settlement agreement reached between Consumer Digital Services and the Washington Attorney General’s Office. Consumers should receive the e-mail within the next month.

Letters will be mailed to consumers who haven’t replied to the e-mail within 60 days. Therefore, consumers who do not receive an e-mail within the next month should monitor their mailboxes.

Consumers who receive an e-mail message or letter must submit forms within 60 days of receipt.

Both the e-mail message and mailed letter will include a claim form that instructs consumers to provide their name, telephone number billed by the defendants, mailing address and the amount they paid.

Important warning for consumers: Con artists have sent letters to Washington residents informing them that they have received payments from a lawsuit settlement. The mailings often include counterfeit checks. You should be especially suspicious of letters and phone calls originating from outside the United States in which you are asked to provide money or personal information. If you receive a legitimate e-mail from Consumer Digital Services, you will not be asked to provide a bank account number or other financial information.

Additional Materials:

Consumer Digital Services et al Complaint:
http://www.atg.wa.gov/uploadedFiles/Home/News/Press_Releases/2007/CDSComplaint062107.pdf

Consumer Digital Service et all Consent Decree:
http://www.atg.wa.gov/uploadedFiles/Home/News/Press_Releases/2007/CDSConsentDecree062107.pdf

Posted by sandi with no comments

Found on Endgadget - Russian ATM runs on unactivated copy of Windows

6-9-07-russian_atm

Source: http://www.engadget.com/2007/06/09/russian-atm-runs-on-unactivated-copy-of-windows/

That beats my pic of electronic ticketing system used by our public transport infrastructure.

Posted by sandi with no comments
Filed under:

Extended validation certificates: Now available to more businesses

Back in February 2007 when the original draft for EV Certification Guidelines was released, there were some complaints because EV certificates could only be purchased by incorporated businesses and government entities.  One particular example that comes to mind that was shared with me was the example of an online knitting supplies store that grandma runs from her spare bedroom going bankrupt because nobody would buy from her anymore (a complaint that, to be honest, missed the point of the exercise - if *everybody* could obtain an EV, no matter how insubstantial their "business" is, then the primary benefit of said EVCs would be lost).

Version 1 of the Guidelines has been released, and it is now possible for unincorporated businesses (eg: sole proprietorships or general partnerships) to obtain an EV Certificate as long as they meet strict conditions. 

To paraphrase the official website, an EVC is designed to provide a reasonable assurance to the user of an Internet browser that the website the user is accessing is controlled by the specific legal entity identified in the EV Certificate by name, address of place of business, jurisdiction of incorporation or registration and registration number or other "disambiguating information".  It is also designed to help establish the legitimacy of a business claiming to operate a website, and provide a vehicle that can be used to assist in addressing problems related to phishing and other forms of online identity fraud.   In short, the primary goal of an EV certificate, its "raison d'être", is to ensure that the certificate holder is who they claim to be, that the business is not a fly-by-nighter that is here today and gone tomorrow, and that it is not a shell set up to impersonate another, legitimate, business.  If the aforementioned Grandma has no type of business registration, she has no business bank account, and the only means of contact with her is via cell phone and/or a PO Box, then she isn't going to get an EVC.  

Internet Explorer, Firefox, Opera and KDE are all taking part in the EV initiative and qualifying businesses are re-audited yearly to ensure that they still qualify for an EVC.

The full guideline, all 78 pages of it, can be found here:
http://cabforum.org/EV_Certificate_Guidelines.pdf

your questions answered: printing does not work via ie7 on vista

Unfortunately, the totality of the information provided is:

"I have not been able to print anything from the web using IE7 and Vista.  My printer does work during normal usage but not with the net.  Are there any fixes or should I go to Firefox."

Potential fixes:

If using an HP printer, download the latest HP Director software:
http://h10025.www1.hp.com/ewfrf/wc/genericDocument?lc=en&cc=us&docname=c00802504

If you see an error like this:

or this:

"An error has occurred in the script on this page.
Line:   2026
Char:  1
Error:  Object required
Code:  0
URL:    res://ieframe.dll/preview.dlg
Do you want to continue running scripts on this page?
[Yes] [No]"

Your permissions may be wrong, especially if you have moved your temp folder from its standard location.  This command will set the permissions properly for you:

icacls C:\Users\<yourname>\AppData\Local\Temp\Low /setintegritylevel (OI)(CI)low

Make sure that the path in bold, and yellow, is correct for your machine.

Posted by sandi with 2 comment(s)
Filed under:

HOTFIX: When you try to open an FTP site by using a Web proxy in IE7, you cannot open the FTP site

When you try to open an FTP site by using a Web proxy in Windows Internet Explorer 7, you cannot open the FTP Web site. This behavior occurs if the Web site URL contains the following entry:

domain\username

You may be unable open the FTP site even after you replace the backslash (\) by using its URL-encoded form (%5c)

http://support.microsoft.com/default.aspx/kb/932562

A comprehensive list of IE7 related Knowledge Base articles can be found here:
http://www.ie-vista.com/kbase3.html

Posted by sandi with no comments
Filed under:

Error message when you try to log on to a Web site that requires Kerberos authentication by using IE7 on a Windows XP SP2 computer: "Access is denied due to invalid credentials

You try to log on to a Web site that requires Kerberos version 5 protocol authentication. However, you are prompted three times for your user credentials, even though you enter the correct information every time that you are prompted to do this. When you try to log on the Web site for the third time, you receive the following error message:

HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Internet Information Services (IIS)

This problem occurs if the Web site uses a CNAME resource record in the Domain Name System (DNS) to contact the server that initiates Kerberos authentication. When you use Internet Explorer 7 to access the Web site, Internet Explorer 7 uses the host name of the server instead of the CNAME resource record to contact the server. However, only the Service Principal Name (SPN) for the CNAME resource record is registered on the account that the server uses for the authentication. Therefore, the authentication process does not work.

http://support.microsoft.com/default.aspx/kb/938305

A comprehensive list of IE7 related Knowledge Base articles can be found here:
http://www.ie-vista.com/kbase3.html

Posted by sandi with no comments
Filed under:
More Posts Next page »