Text 1327, 67 rader
Skriven 2012-07-26 21:16:44 av mark lewis (1:3634/12.0)
   Kommentar till text 1313 av Roy Witt (1:387/22)
Ärende: Too Funny
=================
 ml> i should have asked before... any addons?

 RW> Yeup.

 ml> like noscript or abp?

 RW> Don't follow me (on the internet) and the usual Flash player and
 RW> Adobe reader, some anti-pop up, etc.. They're all up to date. 

the don't follow me shouldn't be needed any more... it is built into FF these
days... since FF12 i beleive... noscript and adblockplus take care of popups as
does the built in popup blocking stuff... i have to specifically allow for some
site to do this... 

 ml> if the css file was from another domain/host, one or both of these
 ml> would have prevented it...

 RW> I would have seen a request to allow a switch to that domain/host.
 RW> That is the first flag I get when a web-site wants to shovel me off
 RW> to something else.

i didn't say switch... i meant "pulled from"... they do this stuff all the
time... you go to foobar.com and they are using scripts pulled from
googleanalytics, for instance... or they have a java based menuing system and
those .js files are pulled from another domain... that kind of thing... this is
where noscript comes in nicely and i'm always looking to see what domains sites
are pulling stuff from to decide if i want to allow it or temp allow it or not
allow it at all... in some cases, the site won't work at all because they are
needing code from 'over there' but in a lot of cases, they are hosting the code
somewhere on a sub-domain of their main one... ie: www.foobar.com displaying
images from images.foobar.com... that's fine but anything coming from
ads.snakeshit.info or such are definitely not allowed ;)

 ml> but i run both and did enable a couple of others in the same jibjab
 ml> domain but never saw similar errors...

 RW> Funny that I could load the first one, but not the second one...oh
 RW> well. 

the first of those two URLs? well, the one was just a photo... the other was an
animated video thing in jibjab and it wanted crap from all over the place...

i'm not going to chance my machines to a possible drive-by infestation by
opening them up like that... i see way too much stuff in the security groups i
participate in and an awful lot that my perimeter firewall captures as a normal
part of its functions... i won't even mention the systems that have dedicated
machines capturing /all/ network traffic packets and saving them off to large
storage for later analysis... and then there are those systems that
automatically take those pcaps (what the network packet captures are called)
and actually carve the binary files out of them for analysis to find stuff that
folk haven't even seen yet...

i've seen way too many java scripts that download PDFs that in turn use java to
download other things trying numerous methods of infesting a machine all at
once and in just a few seconds... i wish i had an easy example to post showing
at least just an example URL that these things call where the parameters
indicate which adobe, java, flash and other versions of known holey software
you are running... they know which ones have certain holes and they take
advantage of them all too fast to think about...

ignorance is bliss but i prefer to know whats going on and be paranoid about
what could be happening so that i can look and find that which is truly out to
get me and my machines ;)

)\/(ark

 * Origin:  (1:3634/12)