This could be very bad... In a news.com article published Friday, a couple of security companies (it's the good guys this time, at least - but they are planning to present it at Black Hat this week...) discuss how they've discovered a way to use your web browser and its built-in JavaScript engine to access information and resources inside the network where the browser resides and send it off to someone else or to launch attacks that appear to come from inside the network. This may be the next big wave of attacks.

SPI Dynamics is one of the companies mentioned in the article. They're discussing the results of their research at the Black Hat event this week, but they have also posted the article and a sample ("proof of concept" as they say) web page that does some of what they've discovered for all to see, use... and copy for that matter.

SPI Dynamics, by the way, has a quality set of expert articles, white papers, webcasts, and more on their web site.

Not sure how I feel about publishing this kind of stuff, but in the real world the bad guys will figure it out quickly enough anyhow, and I imagine they already have. The key to keeping this from becoming a major security event will be making sure cross-site scripting attacks cannot happen on web servers and using protective systems that catch malicious script on client machines before it gets run. Ultimately, JavaScript really needs to be revisited, but to do that probably means changing the way web sites work and coming up with a whole new standard.

JavaScript opens doors to browser-based attacks By Joris Evers
http://news.com.com/2100-7349_3-6099891.html

Malicious JavaScript embedded in a Web site can let a miscreant map a home or corporate network and attack connected devices ...

... "We have discovered a technique to scan a network, fingerprint all the Web-enabled devices found and send attacks or commands to those devices," said Billy Hoffman, lead engineer at Web security specialist SPI Dynamics. "This technique can scan networks protected behind firewalls such as corporate networks" ...

... Both SPI Dynamics and WhiteHat Security came up with the JavaScript-based network scanner at about the same time, he said. The companies plan to talk about their findings at next week's Black Hat security event in Las Vegas.

Tell me what you think, share what you know... In large part, I help catch bad guys for a living. So I have my own perspective and base of experience, but please share yours.

You may already be familiar with the term "phishing" and possibly you have a good idea of what it means. If you're not familiar with the term, you should be. Essentially, bad guys set up fake "phishing" web sites, typically by copying an online banking or other e-commerce site. The bad guys then send out emails or use other means to try to get you to visit the fraudulent web site they've set up, in hopes you'll think it's legitimate and "update" your banking or other private information there. In reality you're not communicating with the actual bank or e-commerce company at all, and you're not really updating anything - Rather, you are providing confidential identity and financial information to cyber-criminals. The bad guys then use that information to steal money, defraud you and others, and to create a new identity or leverage yours for their own gain. They're good at what they do, and the fact of the matter is, it works well enough for those who are the best in their "industry" (and it is its own micro-industry, as we'll discuss) to be motivated to make a career of it.

The general technique of convincing you via trickery to give up your private and sensitive information is called "social engineering." Bad guys act in ways that cause you think you're communicating with a legitimate business, but in reality you're being defrauded of information and - in turn - your financial and identity assets. More recently even myspace.com and similar sites have been faked, so we know these criminals are creative and go after us where we live. Whether it's a phone call from someone who sounds like a legitimate business person or a web site that looks like it's the real thing, it's all social engineering - tricking you into believing you're communicating information to a legitimate person or business when you're not.

You've likely seen emails show up in your in-box that pretend to be from ABC Bank or XYZ Credit Union. Beware any email that request information from you. The emails typically say something has happened to your account or that they;re verifying information, and you need to update your information by clicking a link to go to the bank's web site. But those emails are fakes, and so are the sites that load when you click the link. They're sent (well, spammed really) to anywhere from a few thousand to millions of people at once. Even when only a very small percentage of victims actually take the bait (hence the term phishing, eh?) , the bad guys win and come out ahead - big time.

Unfortunately, people do take the bait. I see it every single day in my work. Just the other day I dealt with a situation in which someone who provided their information to a phishing site fraudster was ripped off for $19,000. We're talking about serious stuff here... Now, when you lose money it's sometimes recoverable (but not always - you can sometimes be held responsible for giving away security secrets, after all). But if someone steals your private identifying information - things like driver's license numbers, dates of birth, social security numbers and the like - it's bad news. You're in trouble. Recovering from a stolen identity can be nearly - and oftentimes completely - impossible. You can get a couple thousand dollars back if you get tricked into giving up a password, but you can't take back your social security number once someone knows it.

You get the picture.

So, phishing is when someone sends an email and tries to get you to provide your secret information on a web site that looks like a legitimate one, but which is really just a fake copy that some bad guy controls. A lot like walking into what you think is your favorite coffee chain and walking out with a Strychnine latte, really. And on top of that, you paid the bad guy who you thought was your friendly barista $5 for it - and left a tip.

We've covered some of the basics of phishing fraud - just the first thin layer of the problem, actually. Over the course of some future posts, we'll dig a bit deeper into the details of what makes up a phishing campaign and what can be done about it. We'll also discuss pharming, spear-phishing and other cute terms that start with "ph" but which are really just about the farthest thing from cute you can imagine.

There are solid reasons for this madness that plagues the financial service and e-commerce industries. But truly understanding the problem means more than just knowing what phishing emails look like and avoiding fake sites. The fact that the sites are even there in the first place, that the email actually reaches your in-box, that you can't tell a fake site from the real one - all of these things are problems in and of themselves. To truly prevent the problem - and let's face it, prevention is the golden key here - we need to know and understand much, much more.

For instance, do you know why certain banks, credit unions and online retailers are targeted over others? Here's a hint: It's not always about how many customers they have to target or how big a name the bank is, although that can be a factor. Many of the biggest targets are credit unions with just a few thousand customers. And do you know what the phishers actually do with the information they fraudulently trick you into providing?

Do you have any idea who the bad guys are?

That's a taste of what we'll be discussing here over the next few weeks. I'll publish some of my thoughts on these topics and more. Not the secret stuff that lets us catch them, but the information consumers and institutions can use to help combat the problem. It's an opportunity to learn and share information. If you have ideas, thoughts or comments about the phishing problem, or online fraud in general, please leave a comment on this entry, or write about it on your own blog, or alternatively you can email me (but please use the comments if it's safe and reasonable to do so in order to provide the benefit to others - I tend to get a lot of emails that would be much better from a community standpoint if they were posted instead as comments). I'll leverage my own thoughts as well as the thoughts of others like you to help build parts of the future discussion. With hat tips all along the way, of course.

Lots of people get credit card applications in the mail. Recently (possibly as a result of increasing interest rates and therefore the potential to make more and more money) it seems like the number and frequency of credit card applications arriving in my mailbox has gone though the roof. Last week alone I received over 20 of these pre-approved applications. It's just nuts.

Another crazy thing is, one credit card company will send several each week. They're spending lots of money mailing me fancy color-printed paper to try to get me to sign up for a credit card at an interest rate (and a variable one at that) which I'd never touch. The ones with the low fixed rates are more appealing, but I really don't want or need more credit cards.

There's a lot better deals out there. What's the best credit card deal these days? Is there such a thing?

Internet phone service is bad and getting worse, according to a new survey released last week. That's interesting, since I have been using Vonage at home for quite a while now and my experience has been that it's improved significantly over time. These days its much better than the local "classic" wired telephone service. But apparently my VOIP experience might not be the norm, at least if you believe the people doing the testing:

Nearly one in five Internet phone calls are “unacceptable” in quality - with annoying woes ranging from echoes to clicking sounds. The problem is lines clogged with video, audio and other data that interfere with service, said the study by Brix Networks, which makes products that test the quality of so-called Voice Over Internet Protocol...

...Brix arrived at its conclusion after almost one million Internet phone tests were conducted by users at the company’s web site, testyourvoip.com. The tests, started in late 2004, immediately revealed quality problems and Brix continued with the tests through early this year, before compiling and releasing its results...

All I can say is I really like Vonage. Between the call quality I get (very good) and the extra features, not to mention the lower price relative to POTS service, there's no way I'd go back.

(story via the Boston Herald)

Forget "Hello, World." More like "Look Out, World!" Greg's gonna learn how to program. Just enough to be dangerous, I am sure... I mentioned this more than a year ago, but have yet to take advantage of it. And at the time all the content was not yet available.

Microsoft has more than 10 hours of online video training geared toward beginners (that would be me) on how to program using Visual C# 2005 Express. Woah, cool.  Dubbed the Absolute Beginner's Video Series, it takes you from "Hello, world" to a RSS reader app. This is totally for me. Not only that, you can choose to stream the video or download it, and the project files are right there to download, as well. Nice - I can spend some airplane time learning how to program!

There's also a C# Windows Forms Controls video series and for those wanting VB.net instead of C#, the same series is also available for that language.

I'm glad to see this kind of content available - it's exactly what getting-old management types like me who wish they'd learned to program a modern language need.

The content of the C# and VB.net tutorials was provided by http://www.learnvisualstudio.net/, which has a whole slew of great looking content available for people wanting to learn programming, from absolute beginner to more advanced level programmers, as well as people in-between.

Jay Rosen at PRESSthink has an idea, and one that is certainly quite interesting. In his post "Introducing NewAssignment.Net," Rosen describes his idea, which would meld the best of what the Internet mob has to offer with the typically-careful approach of professional Journalism, into a new hybrid-type of news gathering and creation process.

What can "networked journalism" do in the real world? What does news without the media look like? Check out Rosen's thought provoking and interesting post for that and more:

Alright, what is it?

In simplest terms, a way to fund high-quality, original reporting, in any medium, through donations to a non-profit called NewAssignment.Net.

The site uses open source methods to develop good assignments and help bring them to completion; it employs professional journalists to carry the project home and set high standards so the work holds up. There are accountability and reputation systems built in that should make the system reliable. The betting is that (some) people will donate to works they can see are going to be great because the open source methods allow for that glimpse ahead.

In this sense it’s not like donating to your local NPR station, because your local NPR station says, “thank you very much, our professionals will take it from here.” And they do that very well. New Assignment says: here’s the story so far. We’ve collected a lot of good information. Add your knowledge and make it better. Add money and make it happen. Work with us if you know things we don’t.

But I should add: NewAssignment.Net doesn’t exist yet. I’m starting with the idea.