• Renting a Botnet on eBay

    It is getting better over time: Now you can rent a Botnet on eBay to increase your hitrate on YouTube (By the way: Free shipping is included):

    http://cgi.ebay.com/Guaranteed-100-000-views-for-your-YouTube-video_W0QQitemZ220279609299QQcmdZViewItem?hash=item220279609299&_trkparms=72%3A1163|39%3A1|66%3A2|65%3A12|240%3A1318&_trksid=p3286.c0.m14

    Roger

  • Suspended Jail for Hacking Tutorial in France

    This is pretty remarkable from my point of view: In 2005 our Forensic team together with our Investigators obtained the identification and arrest of M. Jean-Charles S. for the illegal distribution of a hacking tutorial against MSN Hotmail and MSN Messenger users. On June 12, 2008 the Tribunal Correctionnel (criminal court in France) sentenced this person with the following sanction (we announced that on September 17th):

    • 6 months of suspended jail;
    • 300 Euros in fine
    • 5 000 Euros in damages
    • 750 Euros in procedural costs
    • Confiscation of the computer

    Initially, in the first hearing the defendant was not present and he got the same sanctions with a fine on 8000 Euros. As he realized that this is becoming serious, he asked to be heard again and finally obtained a smaller fine which reflects his financial capabilities.

    This is actually the first time I heard about something like that but it is a very good step towards a safer internet on the enforcement side as well

    An article as initially published at PCinpact (in French – if you are in IE 8 Beta, right click and translate J):

    http://www.pcinpact.com/actu/news/46109-avocat-tutorial-MSN-piratage-messenger.htm

    http://www.pcinpact.com/actu/news/46070-pirateg-hacking-MSN-hotmail-diffusion.htm

    Roger

  • Why you should move to IPv6 – NOW!

    Honestly, if you are not living in China it might not be that urgent but read yourself: China running out of IP addresses

    Roger

  • This is about processes: Google Chrome Vulnerable to Carpet Bombing

    This is the kind of stuff I hate to see – definitely within Microsoft but to a similar extent within competitors. I think we have a joint mission: Make the Internet a safer (and more trustworthy) place.

    There was quite some noise yesterday around Google Chrome. And a lot of noise about "safer browsing" and security. Now, I started to read articles that Google built its new browser on a Safari version which is outdated and not yet patched against the Carpet Bombing flaw.

    This is about processes and quality assurance (and trust) and not about technology. This is about a Security Development Lifecycle with proper testing and QA. Google published a long comic on Chrome and talks extensively about testing – I think there is some real room for improvement here.

    Do not get me wrong: We are far away from perfect. We will never achieve the "perfect" level. But we worked hard to implement strong processes and even share them with the industry (see SAFECode). So, why do companies like Google, Oracle, sun, etc not join such initiatives to jointly make sure we do not release products with vulnerabilities in, which are known since a long time…

    Roger

  • Why I do not like e-Voting (Part 2)

    As you might know, I blogged on e-Voting recently (Why I do not like e-Voting) and got quite some reactions. A few here but most of them privately. Most of you seem to like e-Voting. Now, think again! Look at this article here Evaluating the Security of Electronic Voting Systems. There is a video in there showing what they did and how they hacked the system in order to fake the votes. If you are (like me) not to go to install QuickTime, the video is on YouTube (Part 1, Part 2).

    Have fun and re-think your view on e-Voting. The reason why I am so pushy on that is, that I think that voting is in the heart on every modern democracy

    Roger