Categories
Uncategorized

.ani exploit via e-mail: you’d think hackers would know how to spell ‘Britney Spears’

As I noted yesterday in my blog, there is a new patch that addresses the animated cursor vulnerability as noted in Security Bulletin MS07-017. This patch is prevents remote code execution (so an attacker can not take over your PC remotely) delivered via a malicious Web site or viewed via a bogus e-mail.


I was asked today, how will people try to take advantage of this vulnerability? I have an answer via eWeek in their article on how malevolent  hackers may try to hook users via email promising “hot pictures of britiney Speers.” 


<Ahem> that’s Britney Spears, thank you. (Not that I’m a fan.)



“…Spam promising “Hot Pictures of Britiney Speers [sic]” is linking to sites hosting the Windows ANI exploit, Websense discovered today. The e-mail, coming from “Nude BritineySpeers.com,” is written in HTML and contains text that allows it to skirt anti-spam rules in the HTML comments.


“The come-on is from a server hosted in Russia that Websense says is the same one used previously by groups to install rootkits, password-stealing Trojans and other malware. Users who fall for the Britney bait and click on links in the spam are redirected to one of several sites containing hidden JavaScript. The JavaScript sends users to a site hosting Windows animated cursor exploit code.


“Without user interaction, a file is then downloaded and installed. The file, called 200.exe, looks like a new variant of a file infector with operating system hooks and spamming capabilities, Websense said in an alert.


So, what to do if you get an email offering such photos of public figures?


Delete it.


And if you haven’t, ensure that you’ve turned on Automatic Updates. For more, see my past note on how there’s no immunity from security vulnerabilities.


More info:



Tags: , , , , , .

Categories
Uncategorized

Quick note for consumers on security: turn on Automatic Updates

What’s all this talk about animated cursors and exploits on Windows?


Some times, email attachments and web sites aren’t what they appear to be on face value.


You might’ve seen a security announcement or press coverage on a new security patch that addresses a vulnerability associated with .ani files, which are associated with web site and animation attachments. (See the full technical bulletin here.) 


Christopher Budd’s post and Mike Reavey’s (both from the MSRC team) post more info on MS07-017 on the MSRC Technet blog.


In short, if you’re a consumer or small business and you manage your updates via Microsoft Automatic Updates (aka “AU”) the update will be automatically installed. And if you’re a sysadmin or IT Professional, we encourage you to test and deploy this update via WSUS and SMS.


Visit the Microsoft Security at Home web site for more on protecting your computer.

Categories
Uncategorized

Your questions: Tech & Gadgets asks “Is your digital photo collection under control?”

MSN Tech and Gadgets is asking the question I have heard numerous times:



“Is your digital photo collection under control?”


“OK, so you’ve got tons of digital pictures on your computer — how do you actually organize and share them? Are there any features “missing” from your camera or computer that would make it easier for you to organize your collection?”


Although only a few people have added their thoughts to the thread, but I’ll add my relatively basic, low-tech approach: I recall images temporally, and store them by folder accordingly, by month and year. For instance, our summer pictures of the kids are stored in various sub-folders folders in My Pictures, starting with the “2006-06” folder. Images are then backed up to an external USB 2.0 hard disk using OneCare’s incremental back-up software (as well as drag copy archive to CD-Rs, and more recently to DVD-R discs). Each image from our Canon PowerShot SD500 Digital ELPH (7.1 Megapixels) runs about 3 to 4MB.


Using the the MS Office Picture Manager provided good basic editing features ’til I upgraded to Digital Image Pro 10. I archive all photos in the original format and then also save a smaller thumbnail in a simple format of “eventname_date_sm.jpg” — and any edited photos are saved in Digital Impage Pro .png format to preserve quality.


Windows Photo GalleryFor more info and help on managing pictures, check out on Windows Vista, the Memories subsite on Microsoft.com Windows Vista site. Windows Photo Gallery makes it even easier to store, sort and search your photo library. 


Also see  public discussions in Windows Vista Music, Pictures, and Video forum.


 


Also, see the Windows XP Digital Photography site on Microsoft.com (snippet below)

















Digital Photography How-To Center
Digital photography how-to center








Capture Manage Edit Share Print












Take great pictures
Explore your digital camera, learn to take great photos, and start transferring images to your PC.
Manage and back up your photos
Take advantage of digital technology to organize and archive every precious image.
Enhance and fix
Windows XP and photo editing software help you get the looks you want, even from flawed photos.
Share your photos
Share photos via e-mail, over the Web, in print format, or as one-of-a kind creations.
Print and scan your photos
Print crisp, clear photos from your desktop?plus scan your old photos and bring them into the digital age.


Also see the “Manage your pictures” in the Photos and digital images section in the Windows XP Online Product Documentation.


And here’s a link a review of the Canon PowerShot on Steves Digicams.


Tags: , , ,  

Categories
Uncategorized

Apple-EMI deal announced, but no Beatles catalogue on-line yet

Today’s press conference at EMI Music’s HQ in London with Apple CEO Steve Jobs launched DRM-free premium downloads on the iTunes Store, which will be the first online music store to sell EMI’s new downloads. MacRumors.com reports that when asked when were the Beatles coming to iTunes, the answer was “Don’t know yet.”



CNN.com reports that The Beatles are “still not for sale.”



“But a long-awaited announcement that The Beatles would be part of Monday’s deal was not to be. EMI and Apple said they were still hoping to make the Fab Four’s music available soon.”


EMI said that consumers purchased more higher-bitrate (translating into higher quality), DRM-free music than lower-quality DRM’ed music by a 10 to 1 margin.

Categories
Uncategorized

Your questions: How I Work at the office

How I Work: M3 Sweatt


No matter what anyone tells you, there’s still a bunch of paper in this digital world.


 


M3 Sweatt, Windows Core Operating System Division, Microsoft, U.S.A.


April 1, 2006: 5:53 AM PDT


 


REDMOND (BLOG) – I was asked recently how I made it here in one piece, working for so many years on many different computers – the bulk of my time on the Macintosh platform (up to System 8.5, thank you), using various Microsoft products (remember MS Mail?) – and eventually work at Microsoft. I recall in the spring of 1992, bringing one of the first IBM PCs with Windows 3.1 into our then all-Apple-Mac office and thinking “where is my elegant Macintosh IIfx.”


 


How Bill WorksHow interesting, if I’d known then what I know now, that we were living an early version (1.0) of what Bill calls the digital workstyle.


 


If you look at my office today there’s quite a bit of paper in it, and probably just as much or more than in 1984 (my trusty ImageWriter  was working nearly 24 hours a day). Now it’s Powerpoint presentations, research papers and proposals, newspapers and trade magazines, many that have still not made a full transition to digital web-based distribution. The paperless office is not mine, but I do my darnedest to employ the digital workstyle at work: on my desk I have three screens (one of which is attached to my Tablet PC) on two different computers, that covers my large office desktop, with two keyboards and two mice. On my Vista-powered Tablet PC, which sits atop a very stylish hardware dock, I can drag items from one screen to the next. That’s very cool and I often dedicate just one 19″ LCD screen (that sits atop a not so glamourous stack of copier paper) to Outlook. Having the PCs – plus a Pocket PC Phone (OK, a total of four LCD screens) – there are so many places not just to be productive, but more opportunities to misplace files. Just trying to recall what you were working on (and on which screen, much less which office) has a big impact on productivity.


 


The screen on my left is usually dominated by my Outlook e-mails of the day, unless I’m catching up on my news… then it’s all Internet Explorer 7 with multiple tabs opened on the many blogs, internal product group and resource sites, Oodles of news and the You-who video sites I read regularly… all work-related, of course. OK, so it’s just about always used for IE7, with a home page of our internal ‘//artiesoffice’ webcam site. On the center screen is usually an e-mail I’ve forgotten about given that the screen has a dead pixel in the lower right corner that bugs the beegeeses out of me.


 


My docked Tablet PC is on the right-hand screen, a screen much too small to actually read from my chair (unless I’m straining over my desktop to get a look at the screen in 1280×1024 pixel mode), especially challenging given I’m now in need of reading glasses. This layout of technology on my desk gives me the ability to keep my back to the door to my office (something Michael Corleone I’m certain would not condone) and ignore anyone passing by my office. Unlike others who keep their eBay screens out of sign by ensuring the back of the monitor faces their office doorway, I am able to portray my digital workstyle by keeping a mocked up detailed Excel spreadsheet at the ready (via ctrl-Shift-F3) with lots of nifty graphs and charts, just in case someone is interested in peeking at my much-too-confidential daily work.


 


At Microsoft, e-mail is used extensively given that walking has been reserved for getting to and from the soda fridges (Diet Cherry Coke and Talking Rain Berry, if you please), campus lunch cafés and conference rooms. E-mail is more effective than phone calls as people are rarely in their office. Everyone and their dog has a blog (and on the Internet, no one knows your a dog): I’m no different, with an internal blog (which I have let run dry over the last couple of months) and one on MSDN which I focus very little of my non-working hours. Live meetings with real people are often replaced with Live Meetings. Voicemails (from people you can’t possibly understand as they’re calling on a cell phone driving with the top down and into a tunnel) and faxes (here’s a link for those too young to recall these wonders, please) are available right in our Outlook in-boxes, which is fine… but when was the last time you received a fax that wasn’t spam?


 


I get about 400 e-mails a day, of which eight are work related. I try to apply rules and filtering to my mail to route the junk to the Junk Mail folder, mailing list mails to the Mailing Lists folder, and from anyone I know straight to the I’ll-get-to-it-soon Folder. And I often get mail from individuals I don’t know, asking me “Is that really your first name?”, inquiring as to the current time zone observed in Turk & Caicos, or “Why the heck does a project milestone have it’s own alias?” That’s one way I know people have too much time on their hands.


 


We’re at the point now where the challenge isn’t how to communicate effectively with e-mail, it’s ensuring that we only communicate via email and never, ever meet with people in person. You spend all of your time on e-mail. OK, maybe IM to keep up on fantasy sport scores and the Colbert Report. I use powerful, integrated tools like “forward” to pass on the latest viral video clip via e-mail, and the delete key for messages with little real content and no importance. (There’s this funny clip making the rounds now with James Earl Jones as Darth Vader, but dubbed with audio from many of Jones’ other films, it’s a hoot.)


 


I’ve not met anyone who actually uses Tasks in Outlook. Do you want to know how to really annoy someone? Send them an Outlook Task via e-mail with a status of “Waiting on someone else” and a deadline assigned to it. Talk about reactions: people get that “dog staring into a fan look” when they see that one arrive in their Outlook In box. Instead, for my own tasks and to-do lists, I use one of the many pads of paper I can find left behind in conference rooms, or attach a Post-It note to the side of my LCD screen, right next to my Vista Side Bar. That way, when I walk up to my desk, I can see if I have any old notes from a meeting a year ago, written so quickly that I can no longer discern what the heck I wrote in the first place, or that I have to pick up the boys for Cub Scouts at 7:00PM.


 


Outlook also has a little semi-transparent notification box that comes up in the lower right whenever a new e-mail comes in. It is so frickin’ annoying but I love it when someone is presenting a Powerpoint deck and they have the “toast” pop up (that’s what we call it) with a personal e-mail from their spouse referring to them by a pet name in the first line of the e-mail (my lips are sealed on the exec known as “Pookie-boo”), or a notification that the Dr. Who DVD they’ve been waiting for is now available at NetFlix.


 


Staying focused is one issue, staying awake is another. That’s the problem of information overload: you get so darned tired wading through the Outlook meeting invitations and cc’ed mail. The other problem is “information underwhelm” where you are flooded with information doesn’t make any sense or written in such a way that you have no idea what the heck someone wants.


 


I deal with this by using SharePoint, and setting up meaningful, dedicated sites to new projects. I’ll include words like ‘secret’ and ‘confidential: internal, eyes only’ in the page headers, set up categories, special pages, calendars, discussion boards, and other really important-looking pages… and then never, ever use it. And I’ll restrict access to only me, so just about anyone in the company who tries to access it after finding it with our internal SharePoint search tool will be denied access and become incredibly annoyed.


 


Right now, we’re getting ready for our vacation to California. We’ll go off to see SeaWorld and LegoLand, and I’ll catch up on the what’s what in trashy industry gossip magazines (sorry, “business trade periodicals”) that document the details of various Microsoft “behind the scenes” confidential. You know, the All-the-President’s-Men-type source-reported incidents that actually never happened. (C’mon, have you every tried to toss a Herman-Miller Aeron chair across a room?) We haven’t been on a real vacation in more than 12 years: trips to Disneyland with children who succumb to a virulent flu and air sickness lasting the entire trip, and for days after you return home, don’t count.


 


I’m now far more efficient in picking vacation spots that are closer to home and within quick driving distance to an all-night pharmacy and urgent care centre with Windows Live Local so we can deal with the issues as they happen in real time.


 


Microsoft now has more than 71,000 employees, so when I’m thinking, “Hey, where do all these people go when they need to pick up Italian take-out on the way home from the office?” or “What’s a great way to apologize to your wife for working nightly and pulling into the driveway as David Letterman delivers his Top Ten list?” I write it down on my internal SharePoint site. Then people can see it and respond: “Hey, you gotta try Salvatore’s Firenze” or “Trader Joe’s now has frozen Orange Chicken in a bag, and they sell flowers by the bunch along with a reasonably priced Argentinian malbec.” That’s where SharePoint shines.


 


Another digital tool that has had a big effect on my productivity is desktop search and a very valuable multifunction toolbar. No, not that desktop search and toolbar. It has transformed the way I access information on my PC, on servers, and on the Internet. I now have a way to spend hours at a time searching through gigabytes of information on my PC and servers for old Nigerian e-mail scams, stupid pet trick videos and the ultimate Crème Brûlée recipe.


 


Paper is no longer a big part of my day, it’s become a huge part. When I go to a meeting and take a few notes, I usually use the back of a napkin or a lunch receipt. That fully syncs with my office layout of Post-Its, so all my notes are roughly the same size and format (except the napkins are that recycled paper so they’re a little darker). And finding files in my office has never been easier: instead of having to navigate through folders to find that one document where I think a piece of information might be, I simply look through the stacks of print outs I keep of all the e-mails and documents that I mark up with Post-It notes and coloured highlighters that are at my fingertips in various piles around the office.


 


The one low-tech piece of equipment still in my office is my much coveted round table, which fills the office and used as a landing pad for all of this paper. My kids will come into the office and use it as a canvas with all sorts of pens and markers, which I attribute as my own thoughtful doodles. Just above the table in terms of usefulness is my old printer: I haven’t been able to get a replacement cartridge for it lately, so it just takes up space. The printers in many Microsoft buildings have the ability to copy, scan, print, collate and staple, so you can imagine the fun that people have, once they figure out how to hook them up to their computer over the network. I don’t have that figured out just yet, but probably I’ll get around to it in the next year. Today, if there’s something that I really need in hard copy, I just send off an e-mail to one of my office mates (remember, the powerful “forward” feature?) and ask them to print it out.


 


Days are usually filled with meetings. But sometimes I’ll just sit there in my office and stare out into space. So it’s great to finally take a break and head home, to get the kids to bed, and then be able to just sit at home and play Halo 2 over Xbox Live. If the entire week is very busy, it’s the weekend when I’ll write long, thoughtful blog entries like this one. When people come in Monday morning, they’ll see that I’ve been quite busy – and forwarded them a lot of e-mail.


 


Tags: Microsoft, M3 Sweatt, M3, work, humour, DST.