[SecurityRatty] tag: grandmother

Malware? We don't need no stinking malware!

Fri, 24 Oct 2008 10:25:00 +0000

Written by Oliver Fisher

"This site may harm your computer"
You may have seen those words in Google search results — but what do they mean? If you click the search result link you get another warning page instead of the website you were expecting. But if the web page was your grandmother's baking blog, you're still confused. Surely your grandmother hasn't been secretly honing her l33t computer hacking skills at night school. Google must have made a mistake and your grandmother's web page is just fine...

I work with the team that helps put the warning in Google's search results, so let me try to explain. The good news is that your grandmother is still kind and loves turtles. She isn't trying to start a botnet or steal credit card numbers. The bad news is that her website or the server that it runs on probably has a security vulnerability, most likely from some out-of-date software. That vulnerability has been exploited and malicious code has been added to your grandmother's website. It's most likely an invisible script or iframe that pulls content from another website that tries to attack any computer that views the page. If the attack succeeds, then viruses, spyware, key loggers, botnets, and other nasty stuff will get installed.

If you see the warning on a site in Google's search results, it's a good idea to pay attention to it. Google has automatic scanners that are constantly looking for these sorts of web pages. I help build the scanners and continue to be surprised by how accurate they are. There is almost certainly something wrong with the website even if it is run by someone you trust. The automatic scanners make unbiased decisions based on the malicious content of the pages, not the reputation of the webmaster.

Servers are just like your home computer and need constant updating. There are lots of tools that make building a website easy, but each one adds some risk of being exploited. Even if you're diligent and keep all your website components updated, your web host may not be. They control your website's server and may not have installed the most recent OS patches. And it's not just innocent grandmothers that this happens to. There have been warnings on the websites of banks, sports teams, and corporate and government websites.

Uh-oh... I need help!
Now that we understand what the malware label means in search results, what do you do if you're a webmaster and Google's scanners have found malware on your site?

There are some resources to help clean things up. The Google Webmaster Central blog has some tips and a quick security checklist for webmasters. Stopbadware.org has great information, and their forums have a number of helpful and knowledgeable volunteers who may be able to help (sometimes I'm one of them). You can also use the Google SafeBrowsing diagnostics page for your site (http://www.google.com/safebrowsing/diagnostic?site=) to see specific information about what Google's automatic scanners have found. If your site has been flagged, Google's Webmaster Tools lists some of the URLs that were scanned and found to be infected.

Once you've cleaned up your website, use Google's Webmaster Tools to request a malware review. The automatic systems will rescan your website and the warning will be removed if the malware is gone.

Advance warning
I often hear webmasters asking Google for advance warning before a malware label is put on their website. When the label is applied, Google usually emails the website owners and then posts a warning in Google's Webmaster Tools. But no warning is given ahead of time - before the label is applied - so a webmaster can't quickly clean up the site before a warning is applied.

But, look at the situation from the user's point of view. As a user, I'd be pretty annoyed if Google sent me to a site it knew was dangerous. Even a short delay would expose some users to that risk, and it doesn't seem justified. I know it's frustrating for a webmaster to see a malware label on their website. But, ultimately, protecting users against malware makes the internet a safer place and everyone benefits, both webmasters and users.

Google's Webmaster Tools has started a test to provide warnings to webmasters that their server software may be vulnerable. Responding to that warning and updating server software can prevent your website from being compromised with malware. The best way to avoid a malware label is to never have any malware on the site!

Reviews
You can request a review via Google's Webmaster Tools and you can see the status of the review there. If you think the review is taking too long, make sure to check the status. Finding all the malware on a site is difficult and the automated scanners are far more accurate than humans. The scanners may have found something you've missed and the review may have failed. If your site has a malware label, Google's Webmaster Tools will also list some sample URLs that have problems. This is not a full list of all of the problem URLs (because that's often very, very long), but it should get you started.

Finally, don't confuse a malware review with a request for reconsideration. If Google's automated scanners find malware on your website, the site will usually not be removed from search results. There is also a different process that removes spammy websites from Google search results. If that's happened and you disagree with Google, you should submit a reconsideration request. But if your site has a malware label, a reconsideration request won't do any good — for malware you need to file a malware review from the Overview page.

How long will a review take?
Webmasters are eager to have a Google malware label removed from their site and often ask how long a review of the site will take. Both the original scanning and the review process are fully automated. The systems analyze large portions of the internet, which is big place, so the review may not happen immediately. Ideally, the label will be removed within a few hours. At its longest, the process should take a day or so.

Malware? We don't need no stinking malware!

Fri, 24 Oct 2008 10:25:00 +0000

Another fantasy fulfilled

Sat, 02 Aug 2008 19:25:01 +0000

My Grandmother always told me that a lucky person can count the really good friends they have on one hand, but a small amount of good friends far outweigh having many acquaintances. That was proven to me once again this weekend. Ever since before I had my 2 sons, I had dreams of taking my children to both a Pittsburgh Steeler game and a NY Yankee game. Last year I had a chance to take Landon and Bradley to Pittsburgh and see a Steeler game. With this being the last year for the old Yankee Stadium, I wanted to take the boys to see the Yankees at home and in the old stadium.

Getting tickets to a game at Yankee Stadium is not cheap. In looking around StubHub, for a hundred bucks a ticket (which is all I was willing to pay), the best I was going to do was out in the bleachers somewhere. But I figured it was better than nothing and was going to go for it. That was when I called my best buddy from college Tyler to see if he wanted to go with us. Tyler still lives in NY, actually he has an apt in Trump Palace and works in advertising for a large company, handling one of the very biggest accounts. When I told him what I was looking at buying he said to hold on and let him see what he could do.

Well Tyler came through big time. Not sure which vendor he got them from, but we had 6th row box seats behind third base, tickets to the Stadium Club, free parking (didn???t use it as we took the subway) and to top it off, Tyler was staying at his friends place and insisted we stay in his place at Trump.

The boys and I had a blast hanging out in the city, going to Dylan???s candy store, the Empire State Building and then heading up to the Stadium. I am sure it will be a time both they and I will never forget. Like the commercial says:

1. 3 round trip airline tickets from Florida to NY ??? $750.00

2. 1 night in a hotel in NYC - $400.00

3. 3 field box seats to a Yankee game - $1000.00

4. A fried like Tyler to make it all happen for free (I used miles for the airfare) and give the kids this kind of memory??? PRICELESS!

Thanks Tyler!

Another fantasy fulfilled

Sat, 02 Aug 2008 18:44:26 +0000

Getting tickets to a game at Yankee Stadium is not cheap. In looking around StubHub, for a hundred bucks a ticket (which is all I was willing to pay), the best I was going to do was out in the bleachers somewhere. But I figured it was better than nothing and was going to go for it. That was when I called my best buddy from college Tyler to see if he wanted to go with us. Tyler still lives in NY, actually he has an apt in Trump Palace and works in advertising for a large company, handling a one of the very biggest accounts. When I told him what I was looking at buying he said to hold on and let him see what he can could do.

Well Tyler came through big time. Not sure which vendor he got them from, but we had 6th row box seats behind third base, tickets to the Stadium Club, free parking (didn’t use it as we took the subway) and to top it off, Tyler was staying at his friends place and insisted we stay in his place at Trump.

The boys and I had a blast hanging out in the city, going to Dylan’s candy store, the Empire State Building and then heading up to the Stadium. I am sure it will be a time both they and I will never forget. Like the commercial says:

1. 3 round trip airline tickets from Florida to NY – $750.00

2. 1 night in a hotel in NYC - $400.00

3. 3 field box seats to a Yankee game - $1000.00

4. A fried like Tyler to make it all happen for free (I used miles for the airfare) and give the kids this kind of memory– PRICELESS!

Thanks Tyler!

You never know whose tomorrow it will be

Mon, 07 Apr 2008 14:52:27 +0000

Beware -Another non-security story. Last week I wrote a story about my son Landon and how proud I was about his experience in baseball. I used a Yiddish word that I learned from my Grandmother - naches. As I have gotten older I have developed a deeper admiration and respect for the inherent wisdom that my Grandmother brought to life and the many things I learned from her. I remember being younger and thinking she was a little bit meshuguna as she would say. But as I now realize she was crazy as a fox and I hope I can be only half as intuitively smart as she was. She had an intuitive grasp of people and life that cannot be learned in books. People who think I am outgoing and loud would think me quiet and shy in comparison to her. But enough about my grandma, let me get on with the story.

One of the phrases she used to use that I would laugh at was, "my grandson, you never know whose tomorrow it will be". I was never quite sure what that meant, but had enough of the general gist that I didn't question her. Today again I heard my Grandmother talking to me and saying that very phrase. I had contacted an old business partner of mine who I had not spoken to in 3 or 4 years. I knew he had season tickets to the Yankees and wanted to buy a couple of tickets to take my sons to the Stadium in this its last year. My old partner "Bob" called me back this morning, very early not realizing I was out in California. Of course I asked how he was and he replied that he had been diagnosed with pancreatic cancer a while ago. He has undergone surgery and is receiving chemo at Sloan-Kettering Memorial, but the prognosis is not good. Bob is just a few years older than me and his youngest child is just 10 years old. I have known Bob for 20 years. He was always the kind of guy who did the right thing. A good family guy, he grew up like I did on the Long Island-Queens border in NY from working class parents. He worked hard and bought a house in Westchester County for his wife, children and he. He lived the American dream, working hard and passing on to his children the best of what he knew. What are you supposed to say to someone who tells you this? Are there any words that provide comfort? Is going to a frigging Yankee game relevant here? Of course you try to be brave for their sake. You say things like "they are doing so much with that disease now. Keep your head up, attitude is important." Maybe most of all, I will pray for you. How cruel is fate that this good, decent human being has been chosen to suffer from this death sentence of a disease at such a young age? Of course Bob is not alone. Unfortunately I know too many good people who have been stricken with terminal illnesses well before their time here should be done.

I was speaking to a friend/family member the other day about the breakup of his marriage and I told him life is rarely what we think it is going to be. Making lemonade out of lemons seems to be the ultimate and eternal human condition. It also drives home my grandmother's inherent intelligence. You never know whose tomorrow it will be. I get it now, you never know for whom the bell tolls. All we can do is enjoy the good moments that God, fate or whatever grants us, because in an instant that can all be taken away and our lives changed forever. Bob is in my prayers and I hope for a miracle for him and others who have to face similar challenges. Lesson to you all enjoy the moment, cause you never do know whose tomorrow it will be.

This weeks Yiddish word of the week - Naches

Sun, 30 Mar 2008 17:32:20 +0000

Non-Security post to follow, stop reading now if not interested. According to Wikepedia the Yiddish or Jewish word naches means: feeling of pride in the achievements of one's children. Growing up, my grandmother used to use this word all the time to describe the joy she felt whenever my siblings or I would do anything noteworthy. As I grew up I tended to put this word into the pile of other obscure Yiddish words that my grandmother used. When she passed away I didn't really know anyone else who spoke the language and I began to forget them. My mother-in-law used Yiddish words like that as well and I learned some more from her, but when she passed away too, that was pretty much the end of my learning the language. Today I got an up close and personal lesson on the the meaning of naches.

As I have written about before my oldest son Landon's (8) baseball team is having a tough season. We have not won one game all season. In fact in many of the games we are not even competitive. I had moved Landon up to this level of play even though he is a year or more younger than most of the other kids in the league. The level below though was one he was in for two years and made the all star team last year. So we moved up to kid pitch and took our chances. Landon started off slow with the rest of the kids on the team. However, he kept working and has been pitching and playing 2b and SS most of the year. He has also been working on his hitting.

While most of the kids on our team have shown steady improvement, Landon has really come in to his own. Not only in raw baseball skills but in situational awareness of the finer points of baseball (knowing when to throw and where). In today's game our other two pitchers were not at the game. I had Landon pitch the whole game. He did great, making a bunch of great plays in the field. He also had three hits, each time picking up an RBI. He hit the ball hard each time. We lost again, but it was a close game.

At the end of the game, both the umpire and the coach of the other team came over and not knowing Landon was my son told me that he was a great player and the best player on the field. Last game the coach of the first place team came over to tell me when he picks the all star team to play travel ball, he wants to pick Landon on his team. After all these years (like the title of my blog), I finally have learned what my Grandmother meant by the word naches! I am really proud of Landon and all that he is accomplishing in baseball.

This weeks Yiddish word of the week - Naches

Sun, 30 Mar 2008 16:32:20 +0000

Non-Security post to follow, stop reading now if not interested. According to Wikepedia the Yiddish or Jewish word naches means: feeling of pride in the achievements of one's children. Growing up, my grandmother used to use this word all the time to describe the joy she felt whenever my siblings or I would do anything noteworthy. As I grew up I tended to put this word into the pile of other obscure Yiddish words that my grandmother used. When she passed away I didn't really know anyone else who spoke the language and I began to forget them. My mother-in-law used Yiddish words like that as well and I learned some more from her, but when she passed away too, that was pretty much the end of my learning the language. Today I got an up close and personal lesson on the the meaning of naches.

As I have written about before my oldest son Landon's (8) baseball team is having a tough season. We have not won one game all season. In fact in many of the games we are not even competitive. I had moved Landon up to this level of play even though he is a year or more younger than most of the other kids in the league. The level below though was one he was in for two years and made the all star team last year. So we moved up to kid pitch and took our chances. Landon started off slow with the rest of the kids on the team. However, he kept working and has been pitching and playing 2b and SS most of the year. He has also been working on his hitting.

While most of the kids on our team have shown steady improvement, Landon has really come in to his own. Not only in raw baseball skills but in situational awareness of the finer points of baseball (knowing when to throw and where). In today's game our other two pitchers were not at the game. I had Landon pitch the whole game. He did great, making a bunch of great plays in the field. He also had three hits, each time picking up an RBI. He hit the ball hard each time. We lost again, but it was a close game.

At the end of the game, both the umpire and the coach of the other team came over and not knowing Landon was my son told me that he was a great player and the best player on the field. Last game the coach of the first place team came over to tell me when he picks the all star team to play travel ball, he wants to pick Landon on his team. After all these years (like the title of my blog), I finally have learned what my Grandmother meant by the word naches! I am really proud of Landon and all that he is accomplishing in baseball.

Facebook Privacy Issues

Sun, 06 Jan 2008 23:05:44 +0000

This actually comes a few months late, but I’ve read enough about it that I think it’s worth talking about. There’s an article on the Silicon Insider talking about the newest integration between Facebook and Blockbuster, Fandago and others. Had I not already heard all the details and fallout I probably would have said, “Sounds like a complicated threat model. I hope someone did their homework.” Alas, they did not.

What’s fallen out from this is a privacy issue that’s complex and fascinating. Firstly, the title of the Silicon Insider article is pretty telling, “Do You Want Your Grandmother to Know You Bought Porn? Well Learn to Opt Out” Facebook has taken an interesting stance towards your privacy. You can opt out of them giving it to people you are friends with. The opt out process is in question as is the concept in general. One of the best examples of why this was a problem I’ve heard is that it ruined people’s x-mas presents, because it was displayed on their friend’s Facebook profile.

It’s clear that this is just another way to monetize their users, and not a use feature that consumers typically feel comfortable with. Of course, if you aren’t buying anything bad, you have nothing to worry about. But even still, do you really feel comfortable with your friends knowing everything you’re buying? Do we have any privacy anymore? This is getting to be a pretty voyeuristic society - because it’s easy to monetize people’s privacy by taking it away from them.

I’m not particularly upset with Facebook, in particular - they are hardly the first company to forsake people’s private information for monetary gain. But I think this sort of behavior is only making people distrust social networking. It should be noted that some of the people who built some of the largest social networking sites in the world are also data mining experts - it’s not a leap to figure out why those two are a dangerous combination for privacy. So while I’m not upset with Facebook - you won’t find me building a profile there anytime soon.