Josh Mckinley

[kangpw-blog]

H1N1 pulls and works long-rangely safely

[CNW.com.cn special draft ] confirms recently 95 countries and regions in the world have the 44287th example first type H1N1 influenza in all to make a definite diagnosis of the case in World Health Organization, China and China have already found totally that makes a definite diagnosis of the case in 414 cases of first type H1N1 influenza. It causes enterprises to working and unusually paying attention to long-rangely that influenza spreads, and consider in the security carefully.

Security expert points out, spread and correspond to with H1N1, hacker's behavior of the network is very rampant at nearly one stage. Prevent and control H1N1 and expedite the emergence of a large number of long-range official working demands, the network criminal may take this opportunity, forge the identity and enter the network inside enterprises, is engaged in the destructive activity.

It is reported, headed by government, a lot of organizations and large-scale enterprises launched the long-range project bid that worked of the security again and again recently. Reporter find enterprise need, go on, prevent and control to influenza on one hand, hope in can introduce digital certificate, VPN safety measure work, while being long-range on the other hand. The latest situation is, some famous banks in China, increased the scheme construction of the safety certification token at the end of June too, demand, dispose, reach the standard grade as soon as possible, with should need situation that work at home to more staff.

The reporter finds, many kinds of application have high expectations for long-range security that work at present, for example: Backstage business processing of the bank, system maintenance, data analysis and looking over, sale and customer's data of the property firm of the backstage supporter of the Internet firm of the data centre of enterprises,etc., these enterprises will all generally adopt the authenticity and very managerial that methods such as the safety certification of one pair of factors,etc. guarantee to visit. In fact, when SARS broke out in 2003, the situation which users heighten to the long-range safety engineering demand has appeared in these fields too.

By the look of actual conditions, this H1N1 has really spured and worked the popularization in China of technology long-rangely safely, only take the corresponding safety measure after all, enterprises can rest assure of letting the staff visit the Intranet at home, no matter personnel, financial affairs, administration, technology, sale or administrative staff, utilize, work safely while being long-range technology can stay at home affairs of work of treatment.

[kangpw-blog]

The global junk email breaks through 90 passes

[CNW.com.cn special draft ] is for a long time, the junk email overflows and already becomes the global public hazards, and therefore has initiated many safety problems. Assess and test statistics of the organization according to numerous security firms and the third party, before 2008, the proportion that the quantity of the global junk email accounts for the total amount of all mails rises to 80% from 40% progressively, and frequently fluctuate during this period.

But surprisedly, by the beginning of July, the global junk email quantitative proportion topped 90% of the high point for the first time, and initiated the high concern of numerous security experts from this.

According to the report of U.S.A. " Network World ", since June of this year, a prosperous scene appears in the global junk email, this newspaper has also specially carried on the report to this. By the look of overall situation, old corpse's network has returned to area, and new corpse's network has already germinated. The Europe, Middle East and Africa area are still a main source of corpse's computers, and Brazil continue, lie in, enliven the intersection of corpse and the intersection of computer and the intersection of quantity and the intersection of source and the intersection of country and the first place with 16% rate.

The expert shows, in the junk email report of the near future, a large number of junk email manufacturers will be paying close attention to the focus of the global economy situation and moving towards, until the intersection of U.S.A. and the three automaker face financial problem apply, go bankrupt protective news spread even recently, and some economic recovery, the news of improving the people's lives was stimulated, manufacturers have seen new chance for junk email.

Some junk emails claiming to come from one motor corporation appear again and again before this, mention in the mail because the economic recession results in selling and dropping, the company plans to make a reduction and sell off the car, but the condition is that the addressee must fill in the application form in the attachment. The junk email instructs addressees to finish forms and enjoy this favour, and pretend to claim the company representative will visit addressees in five workdays after receiving forms. The trick is all too evident to the man in the street! The final purposes of these junk emails are certainly to defraud, and seek the economic benefits from it.

In addition, the person who disseminates junk email is used to utilizing popularity of consumer's known brand to seek the interests for oneself. Because the increasingly many person likes using social websites, it is not at all surprising for trust and popularity that these websites gain to abuse by person who disseminates junk email. During the past one months, the junk email attacks the activity and utilizes various social network brands, recording, friendship world, Facebook, Twitter,etc., have mobilized numerous junk email offensives such as making friends: " get rich rapidly " With " date information " Become master 'sugarcoated bullet'.

Need to pay close attention to finally, when the junk email breaks through 90 passes, the picture junk email stages a comeback as a whiff of strength. Security firm counts, the picture junk email accounts for 6.5% of all junk emails in last 30 days. During this period, this kind of mail increases to and accounts for 21.9% of all mails within one week. The picture junk email leads to the fact directly the average magnitude of the junk email increases to some extent, 24.14% of the mail magnitude is 2kb-5kb, 14% of the mail magnitude has exceeded 10kb. As a whole, after topping 90 passes, the global junk email will cause the pressure to the infrastructure of mail, and may make the terminal customer unable to receive the normal mail.

[kangpw-blog]

The cloud forces safely it is employed that the hacker becomes

Put out from each safe manufacturer one after another " The cloud is safe " After the system, horse's websites hang and is attacked effectively, force the hacker to have to change their technological thinking, in order to get rid of the blow of the anti-virus software. Now, the new infecting with virus is not only stronger in infecting ability, but also take many kinds of means to confront with each other with the anti-virus software.

Recently, " the cloud is safe " on the auspicious star Catching a plurality of systems are infected with the virus newly, the virus has a plurality of characteristics: The ability of viral infection is strong; Can release a plurality of hobbyhorse procedures; Can escape to consult, abate and control the majority of antivirus software; It is fast to make a variation. When files such as MP3, EXE, flash,etc. download some from network to prevail in users, among them probably there is this viroid, the virus infects the other files in the computer promptly after users operate the file.

Because the released hobbyhorse procedure of new virus runs only in the memory, does not exist with the file entity, so on the market at present " The hobbyhorse killing specially type " Safe product virus difficult to measure to hobbyhorse this, infection very difficult to go on, consult, abate in a manner to measure the hobbyhorse virus this kind of. As to this kind of situation, the safe manufacturer is from catching the virus source to make one, it is out of shape to encrypt in the virus process, infect file, wait for at the link going on, dealing with through API, recombination heuristic to consult abate and the intersection of intelligent behaviour and analytical technique, eliminate the virus completely, and resume being infected with the file.

[kangpw-blog]

How to remove with IIS fire wall " Horses hang " The code?

Websites are repetition " Horses hang " ,What is to be done? Much the intersection of enterprise and network management find " hang horse " in removing the intersection of server and the intersection of hard disk and ASP / the intersection of PHP and file often After the code connection, after a while " invador " Add, these are very troublesome questions.

In fact can solve this difficult problem, use " regular expression " with IIS fire wall Pattern matching " Horses hang " The code, remove " hangs horses " from IIS Code connection. Needn't revise the hard disk ASP / PHP file, is not afraid the mistake revises the customer ASP / PHP file.

As to such encryption URL connect,need only use by one of " the regular expressions " ,Can filter from IIS in the whole server similarly " Horses hang " Code connection. As to

/ iframe>, only need to pass " regular expression " too ,Can remove easily.

In addition, the intersection of IIS and intellectual the intersection of webpage and code, HTML of identified standard, of fire wall, can to HTML/ASP/PHP/ASP.NET crest and " hang Ma solicit " of bottom of webpage The code carries on automatic clear operation.

[kangpw-blog]

The waste information sender comes back Increase sharply by 53% in the second quarter

The valley song releases the statistical report and claims, the waste information sender stages a comeback recently on this Wednesday of U.S.A. time, send waste information in a large amount through controlled computers.

The valley song is released quarterly to come from its subordinate Postini statistical report against the waste information group. Valley song enterprise products marketing manager Adam and Sandler (Adam Swidler)s Show in the first quarter, in the second quarter of this year, the quantity of waste information compared that has risen by 53%.

Compared with the same period last year, the quantity of waste information has risen by 6% too. Have released more detailed information on its blog of enterprise in valley song.

The valley song filters 3 billion to 3,500 million pieces of waste information for his customers about 50,000 persons every day. Sandler shows, waste information is changeable all the time in quantity, because some has offered the convenient ISP trader to waste information sender and has already been rolled off the production line by force.

Last month, American Federal Trade Commission persuaded a federal court to release and limit orders temporarily, close the notorious ISP trader Pricewert. Federal Trade Commission claims, in Pricewert is children's pornographic person who releases picture, hacker and hostile software developer everywhere.

Sandler shows, after Pricewert is closed, the quantity of waste information dropped by 30% immediately. The closing of Pricewert makes a waste information sender unable to send a large amount of waste information by controlling the family computer and making up corpse's network.

But only passed for more than one month, the quantity of waste information rebounded again, because the waste information sender has already made great efforts to obtain more captive computers. Sandler shows, the valley song finds that includes aiming at joining the hostile code quantity to corpse's network of the computer to heighten in June.

On June 18 the valley song shows, sender sent waste information than a lot of waste information of 12 hours of before during two hours. Sandler represents, the might of corpse's network has been increased sharply much at that moment.

The valley song still finds, the quantity of the waste information of the picture presents the upward trend. Went over because the safe manufacturer revised the software to strengthen the filtration of this kind of waste information, its quantity has been a downswing all the time. Sandler shows, this change proves the new waste information sender has already appeared, and revised the tool used for establishing the waste information of the picture again.

[kangpw-blog]

Suit the remedy to the case Remove Trojan Horse in the computer

Trojan Horse is a kind of virus program based on remote control, this procedure has very strong disguise and harmfulness, it can control or monitor users' computer in ignorant state. Place and extermination method to say something about the hobbyhorse and often go into hiding as follows.

Look over whether there are hobbyhorses in one's own computer at first

1,Integrate in the procedure

In fact the hobbyhorse is a server - customer end procedure too, it can delete it easily for not allowing users, often integrate into the procedure, once users activate the hobbyhorse procedure, then hobbyhorse file and a certain utility program are bundled together, then upload to and serve the end to cover with the original file, like this even if the hobbyhorse has been deleted, so long as ranning trusses up the utility program of the hobbyhorse, the hobbyhorse will have been installed. Bind in a certain utility program, such as binding to the system file, then Windows will start the hobbyhorse while starting each time.

2,Hide in the configuration file

The hobbyhorse is really too cunning, it is known that what green hands used at ordinary times is the operating system of the graphic interface, have turned a deaf ear to those most configuration files not very important, this has just provided a hiding-place for hobbyhorse. Utilize special function of configuration file, it is very much easy for hobbyhorse not to run, break out in computer of you, thus peep or monitor everybody. However, this way is not very obscure now, easy to be found, so the one that loaded hobbyhorse procedure in Autoexec.bat and Config.sys is actually rare, but can't adopt a casual attitude because of this either.

3,Hide in Win.ini

If the hobbyhorse wants to achieve the goal of controlling or monitoring the computer, must run, but nobody will be so silly that oneself get. Certainly, the hobbyhorse has psychological preparation early too, it is known that the mankind is the animal of the high IQ, will help whom it work, so it must also can look for place of unattended operation during system start-up one piece safe, then it is the place where the hobbyhorse feel more satisfied to hide in Win.ini. Everybody might as well open Win.ini to have a look, there are start commands " load in the word separator of its [windows ] ="And " run =",In general cases " ="Followed by blank, if there are heel procedures, for example this sample: run =c:\\windows\\file.exeload=c:\\windows\\file.exe

You will be careful at this moment, this file.exe will be probably a hobbyhorse.

4,Disguise in the ordinary file

What this method presents is later, but very popular now, as to not skilled windows operator, very easy to fool. The concrete method disguises the executable file as the picture or text ----Make the icon into the acquiescence picture icon of Windows in the procedure, and then change the file name into *.jpg.exe, because it is \ that acquiescence is set up " Do not reveal the known file suffix is called \ " ,File display *.jpg as, careless the intersection of people and any the icon hit the hobbyhorse.

5,Built-in to get in the registration table

The method above lets the hobbyhorse be really comfortable for a period of time, nobody already can find it, can unattended operation,it is real it is fast! But a good time never lasts long, the mankind has seized its something that gives the game away out soon, and carried on the severe punishment to it! But it is unreconciled, after summarizing the lesson of failing, thinks the hiding-place above is very easy to look for, must hide in the place difficult to be found now, then it thinks of the registration table! Really because the registration table is more complicated, the hobbyhorse often likes hiding here happily, check what procedure under their does it have, open eyes wide, think carefully quickly, don't miss the hobbyhorse: HKEY_LOCAL_MACHINE \\Software \\Microsoft \\Windows \\All is with " run " under CurrentVersion Key value of the beginning; HKEY_CURRENT_USER \\Software \\Microsoft \\Windows \\All is with " run " under CurrentVersion Key value of the beginning; HKEY-USERS \\. Default \\Software \\Microsoft \\Windows \\All is with " run " under CurrentVersion Key value of the beginning.

6,Go into hiding in System.ini

The hobbyhorse is really ubiquitous! There is gap everywhere, where does it bores! Look, it is that the hobbyhorse likes the concealed place too that Windows installs System.ini under the catalogue. A bit more careful, open this file and read, it and normal file is nothing different, one that is in file this, in the word separator, has such a content, that is shell =Explorer.exefile.exe, if there are such contents really, unfortunate then, because file.exe here is that hobbyhorse serves the end procedure! In addition, the intersection of [386Enh ] and word separator in System.ini, should pay attention to, check in this inner " driver =Route \\The program name " ,Here is probably utilized by the hobbyhorse too. Moreover, [mic ], [drivers ], the intersection of [drivers32 ] and three word separator these in System.ini, these piece play a role in loading the driver program too, but is a good place to add the hobbyhorse procedure, now this knows that should pay attention to here.

[kangpw-blog]

Secure information about social Web

With Web 2.0 applied popularization, new evil intention threatens to increase gradually too, enterprises should protect one's own information and exempt from threatening, will pay attention to the following 4 points soon.

1,It is junk email and hostile software that the invitation on blog and forum has great majority

As the increasingly many person associates on the websites allowing users to produce the content each other (such as the blog, forum and chatroom) ,This has brought manufacturer's and computer criminal's of junk email attention, they abuse this kind of ability and propagate the junk email, the interlinkage that they released will be connected to the hostile software, or lead users to hostile websites. Websense research of Company reveal active the intersection of Weblog and each release 8000 to 10000 interlinkage month generally, but in all Web blogs and forum invitations, 85% are the surplus content - -Junk email and hostile software, 5% swindle information and fish to attack. So, users must click the interlinkage on these websites prudently.

In addition, famous websites do not mean it is always safe. All include the hostile junk email in the blog that Sony Pictures, Digg, Google, YouTube and Washington set up the university, BBS nearest comment, My.BarackObama.com is infected by the hostile software too.

2,The search result that ranks the first place from Google is safe, right?

Putting in poison in the search engine and prevailing day by day, criminal's position of the computer in searching for and ranking of website for promoting and including the hostile code or junk email. A lot of users think the search result of ranking the first place is " The safe one " ,But they have the websites infected led to in fact. For example, in March of this year, " March Madness " Input into the basketball fans that Google searched for the column and clicked a lot of interlinkage ranking the first place, in fact is led to receiving " Pretend to kill virus " The websites that the software infected.

3,You are not infected in fact, should be careful before downloading

Last year, computer criminal multi-place used what is called " pretended to kill virus " more and more The software comes to obtain card number of credit and other personal secrets information from Web user. The false antivirus software author usually utilizes the search engine to put in poison to lead transport stream to the websites that they had or infected. It is connected with the interlinking of the hostile websites that they controlled that they announce at blog and forum often. When users visit these websites, will spring their window of a warning, claim their computer has been infected by hostile software one. These websites pointed out users and paid and downloaded clean their system " Kill virus " Software program.

In fact, the assailant cheats users and reveals the information of the credit card to buy the false software and succeed in installing the hostile software on the machines of users. Infecting the famous Conficker worm of millions of computer in the world is such an example. Some is seen one is downloaded to the file on their machine by the users of Conficker invermination. When operating this file, users are demanded to pay 49.95 dollars to delete " detected threat " .

Have prevented the network fishing work group from announcing some interesting statistic recently. These count digital display: From July of 2008 to December of 2008, the quantity of the false antivirus applet increases by 225%, it is more than 3 times of the detected false procedure quantity in July.

The false antivirus software attacks the fear of utilizing Web users, it is the acrobatics of swindling money, and calculate in fact users have not been infected, do not need to install the antivirus applet either.

4,Social network of friend or you which you can't believe in you

Said just as the miniature blog from Websense safe test chamber recently: "Web 2.0 social networks of travelling Web threats through you are a kind of new threat, should not believe in the suspicious news from friend easily. " The social net great explosion has opened up the new route to threaten of spreading. Web users are getting used to receiving the miniature blog with short URL, publish video interlinkage and E-mail letter from social website allegedly on Facebook webpage, so that the majority hit interlinkage in the place without hesitation because of believing in the sender.

The unfortunate fact is, the criminal makes use of this kind of trust to propagate the hostile software and connect and is infected with the interlinking of websites. Websense safe test chamber found the example of this kind of E-mail recently, released from Facebook websites on surface of these E-mails, but come from the criminal in fact. These criminals instigate users and click to connect the segment " The video " Interlinkage. This section of " videos " Have actually infected the webpage of the hostile software.

[kangpw-blog]

The hacker rushes to register " Beautiful number " attacks the number plate and makes up the first case of the system by oneself to crack

Wang utilizes computer software development technology that oneself knows, the numbering system of automotive number of the malicious attack, rush to register the number plate " Beautiful number " ," beautiful number " The number plate is sold at high price for the car owner to earn expensively " The service charge " ,Still frame the police of administrative institute of vehicle and have " The trick " . Municipal public security bureau in Quanzhou learns from Fujian Province today the reporter, " beautiful number king " Wang has been monitored a place policeman by the public information online security of municipal public security bureau of Quanzhou and escorted and goes back from Shanghai recently, this get up, have the intersection of China and the first that 3 people participate in utilize hacker attack flexible the intersection of number plate and number, traffic police of public security men, make up the systematic case by oneself and succeed in cracking finally.

" beautiful number king " Resell the number plate at a profit without restraint

At 8 o'clock a.m. on June 8, the municipal public security bureau traffic police's detachment of Quanzhou opens number of a section of number plate of E number and supports citizens to surf the Net to number independently, the car owner can log on the online independent numbering system of number of flexible number plate of traffic polices of public security men of Fujian and make up the free vehicle nameplate by oneself. Shortly after but after this system opens, traffic police's department puts the masses through to consult and complain successively, claim the branch card make up system websites by oneself and can not open from 8 o'clock to 20 past 8, it is unable to log on and pay numbering independently.

At this moment, traffic police's detachment receives the masses to report too, claim the police of vehicle administration office collude with external personnel, resell the number plate at a profit " Beautiful number " . Meanwhile, the police of vehicle administration office reflect, someone was go to the hall of vehicle administration office to released and called " Wang " recently Business card,call oneself "beautiful number king " ,Claim to help the car owner to choose the preferably number plate number. Xie YongQiang, detachment leader of detachment of municipal public security bureau Deputy Bureau Director and concurrently traffic police of Quanzhou, will arrange for the related departments to survey this situation at once.

The police investigation finds: From 2 past 8 a.m. on June 8 to short two minutes 4 past 8, 15 pieces of number plate " beautiful number " such as Fujian C8888E, Fujian C9999E Registered. The further investigation finds, log on the system and register these " beautiful number " IP address 61.154. *. *And 59.57. *. *,And these two IP addresses come from one liang of Internet caves of home of Jinjiang separately. Meanwhile, make up the systematic visit daily record by oneself through transferring the nameplate, the police find, these two IP addresses visit the nameplate back and forth and make up the system by oneself and reach several tens of thousands of to take second place manily in will it be a.m. 8 hour June 8.

These 15 pieces of " beautiful number " Must have " The trick " . Xie YongQiang requires place suspend and release the number plate, sends the public information security of municipal public security bureau to monitor the investigation of getting involved of place the car at the same time.

" evil person " Filing a suit first is penetrated by police

June 10, " beautiful number king " Wang waits for someone and takes " Complain the book " Come to the office of detachment leader of detachment of traffic police of the city violently, claim it has registered Fujian C8888E, Fujian C9999E equal sign card, the vehicle administration office of traffic police's detachment is but not as stated to release the number plate. They still complain to the local media, say the police of vehicle administration office have " tricks " .

"If the vehicle nameplate was got through the legal means, we not merely will release the number plate in time, will also make an apology for you. If got through the illegal means, we should not merely retract these nameplates, and should investigate the legal liability of the illegal one! " One thank strong this forever, puffed up with pride some Wang stunned.

While Xie YongQiang and Wang wait for someone to socialize, Quanzhou municipal the intersection of public security men and station network fit place, make up system by oneself, log on situation with two Internet caves of the wading case, launch the investigation to nameplate. As what has been investigated is deepened constantly, the lawless person utilizes attacking the procedure to interfere with making up systematic normal operation by oneself and rushing to register the number plate " beautiful number " with nameplate The details of the case of making profit illegally floats above the surface of water gradually.

On June 11, the network fits the place according to article 286 of criminal law, with " crime of undermining computer information system " Put this case on file for investigation and prosecution.

[kangpw-blog]

Enterprises " patch up " Movement remain unchanged slowly

The finding from safe manufacturer Qualys, the movements in patching up of the company are little faster than 5 years.

Qualys Company carried on a research project 5 years ago. In this project, it gathers the data about software security loophole from the customer's computer. Qualys offers service, Web application based on Web that can measure security loophole existing in the software, and can also carry on complying with audit.

Qualys Company CTO Wolfgang Kandek shows, the newest data are gathered in 2008. Qualys utilizes the scanning device to scan 200 and connect PC of Internet, the scanning device scanned 80 million IP addresses inside the ones that utilized 5000 to be installed behind Intranet fire wall in the company at the same time.

Kandek says: "Scanning finds 680 million safe loopholes, 72 million among them are serious loopholes, that is to say software issue might enable the intersection of hacker and the intersection of remote control and computer and install the hostile software. "

Qualys has developed the naming of the speed of used in measuring the company to patch uping " Half a life " One's own measurement index. The media of this index is: The company in a certain trade mends for 50% of the used days in the security loophole already announced.

This kind of figure has no change compared with result of study that Qualys Company released in 2004. At that time, it took 30 days on average to reach half and mend high point. Kandek says, in 2008, this figure has been only reduced to 29.5 days.

Kandek says at InfoSecurity conference that was hold in London a few days ago: "Have not mended cycle in fact to shorten. "

This figure of different trades is different: The service field needs 21 days, the financial trade needs 23 days, it needs 24 days to sell retail trade in batches. The backward trade is a health care trade (38 days) And manufacturing industry (51 days) .

The question of postponing patching up and bringing is that the hacker robs before the company mends the loophole and develops and utilizes the procedure. He says: "The assailant's action is faster than before. " In 21 patches that Microsoft release recently, utilize the procedure of 10 loopholes among them to already spread.

"The computer controller spends too long time mending the application of high priority like Web browser too. " Kandek says. In addition, including Microsoft Office, loophole that Windows Server 2003 SP2 of Acrobat and Microsoft' of Adobe System has already known in the inner software, can still find in the system after the patch is released.

Adobe Acrobat position in the patch list seems very low. This is very dangerous, because hackers have developed and can utilize PDF loophole to infect the hostile PDF file of the computer. Acrobat may be " a main source infected of evil intention. "

Kandek says: "We must mend these loopholes as soon as possible. "

[kangpw-blog]

The medical trade can not audit the system

Perplex safely

Go through the development of more than 20 years, China's medical information construction has already begun to take shape, and made considerable progress. However, it is still a minor plate of medical information construction that information is safe and secret, have influenced or restricted the information-based process seriously.

In the network safety engineering solution provided for medical trade at present, still wall with flues, choose for mainstream while being anti-virus, traditional the intersection of safety engineering and means these can only stop some from external to internal attack, and it is totally powerless to steal to coming from internal information, this causes " compromise door " The incident happens again and again, initiate important machine format losing, destruction, not merely influence the normal operation of the hospital network seriously, still threaten the patient's personal secrets and life security directly.

The audit system shows the might

How to stop the emergence of this kind of incident from the safe angle? The network resists the leaf of senior products manager in the Divine Land to fluffy and introduce to the reporter, if liken the internal network of the hospital into a room, then the fire wall, anti-virus software,etc. prevent the external invading doors and windows, there are databases of all kinds of information like a lockable book case in the room, but because of the need of the business, the person (medical worker) in this room Quite a lot will go in the book case to deposit and withdraw some materials, so they all have keys to the book case, so the one that even if add two locks or change the book case into a safe case and can not act. Then how could strengthen the safety of the book case?

We can add by one in the book case height " The lens " ,When who does it note accurately, make something in front of the book case. If is a bit more advanced, this " lens " Should also possess " The automatic recognition of picture " ,Find illegally and operate, automatic " call the police " Function.

In the network, this " lens " It is one that audits the system, it should possess two following essential features:

1) The protective target of the system is information and machine format carrier, generally speaking it is the database and server host computer loading database, either call it the information system or operation system wholly. Anyone (IP) ,Any operation to carrying on in this operation system of any time, such as landing, revise, delete, add etc., can write down accurately; Can also certainly set up it and carry on the record with pertinence under according with some specified conditions depending upon need. The system needs to have behavioral analytical technique based on conversation, the network security official can carry on the examination based on time to all visitors in present network, understand what operation was paid successively in the arbitrary period of each visitor, and support to visit the course to return. Be able to keep the long time enough in information recorded, so that ex post analysis, investigating and collecting evidence.

2) Systematic to possess the disguise, should use ing itself. While installing, will not cause any influence on the network, while using, will not arrive the perception easily. So require it is a integrated apparatus, use simultaneously, adopt the way of intercepting in the bypass to gathering, analyzing and discerning through the data flow connected to important operation system of the network.

The traditional database audits the products and only pays close attention to the audit of the database, hope that so as to protect important information, prevent distorting and letting out. Indeed, the database is the important place where the data are preserved, it is very necessary to audit. However, it is not enough to only audit databases. Because there are a lot of routes of data manipulation in violation of rules and regulations of internal personnel, some violate legal provisions and visit the database directly, some log on on the host computer server that the database locates, some download the important data file of the host computer of the database through FTP. Others visit the database through other procedures or middleware systems. So, must all carry on audit to database, host computer, HTTP agreement, Telnet, FTP agreement, network traffic, middleware system, could find violation, prevent the leakage of information all more sidedly.

The network resists the Divine Land SecFox-NBA network behavior and audits the system (the auditing type of business) Can carry on all azimuthal security audit to various databases, Windows and Unix host computers, WEB application systems in customer's business network. Resist the unique business -oriented audit tactics (Business-oriented Audit Policy, is abbreviated as BAP) in the Divine Land through the network Technology, user can host computer, database included toward some business go on, set for synthetically in one strategy, realize the accurate audit of this business, thus find the potential safety hazard of this business in time.

The meaning of business -oriented audit lies in: If Oracle database of one enterprise is installed under AIX system, the database administrator adopts Telnet and logs on on the host computer that the database locates, utilize here to visit and log on in the database, has derived the data of a large number of customers, then it is relevant to delete and operate in the daily record and record, download the data file through FTP. It is unable to obtain to any information only auditing the database, but can obtain to much useful information through auditing synthetically, auditing the daily record of the host computer at first can find this staff log on the host computer in non-working time, can record and log on and visit the order line of the database while auditing Telnet, auditing FTP can find that download the mass data, the information link bunch stands up to audit these, the behavior of this staff has no place to hide.

[kangpw-blog]

A method keeps all virus hobbyhorses outside of the door

If you are a user of Windows2k or xp, then you look at one carefully, teach everybody that a method gold cicada takes off the key here - -And only need gram of this trick and die all virus! ! If you are a system of the new clothes (or that you can confirm your system is nonpoisonous at present) ,The best, open immediately now:

"At the beginning Procedure Management tool Computer management Local users and the group Users " (indicating a suggestion, a request or a mild command)!

Make the super controller's password into more than ten figures even more at first, then set up another user, and promote as the super controller above setting up its password into the ten's place too. The purpose to do it in this way is for the dual fail-safe: If you have forgotten a password among them, still use the leeway that another ultra tube password is landed and retrieved, so as to not make you refused outside the system; A hacker on net is unable to destroy through guessing the ultra tube password way of your system obtains control power of your system long-rangely. Then add two more users such as user names are: User1, user2; And appoint them to be groups user, all right, the preparation gets here on the finish all over, please don't use super controller and user2 to land besides essential maintenance computer afterwards. It is all right to only use user1 to land.

Find ie while surfing the Net after landing, and set up a swift way for it and get on the tabletop, the right key clicks the swift way, choose to " run by way of other users " Click and fix! Want, surf the Net, on the swift way a bit, it will take user name and the intersection of password and the intersection of you and the intersection of input and user name and password of user2 at this time with you! ! ! All right, you can use this open window to surf the Net now, ones that can go to rest assured about you browse through any vicious, hostile, website with the webpage, have employed in needn't be more anxious! The intersection of you and user1 at the present systematic user of activity. And user2 is the users of inaction, when the users that we used this inaction surf the Net, no matter clever website, let it think the user2 the intersection of you and present user of activity through information that ie get much, if it should be impractical when working out the disruptive words to your system with the hostile code when you have a look around, at all, can work, revise into a configuration file of use2 shed only, then, and a lot of hostile codes and virus attempt to fail through the destructive activity that user2 carry on, because user2 has not run at all, how could obtain systematic operation right? ? Since can't obtain, has just had no way out to you.

They can not cross over users to operate still more, is actually independent between every user because Microsoft must dispose, just as it is impossible for others to go to the bed that my home occupy me, they can't occupy the position of user1! So so long as you can guarantee to always act as agent to surf the Net with this user2 user (but don't land the system with user2, because is such, if user2 some webpage virus in the past, then while user2 landed, they are extremely activated probably!) ,How much virus of webpage no matter in you, it will be all unable to operated or would be loaded by your present user1 user, so your present system will be nonpoisonous forever!

But always have it while neglecting, what if a carelessness has been poisoned? ?

Needn't worry, the technology that the performance heartily shelled that we can come now!

Begin to escape unnoticed:

Restart the computer, use the super controller to land - -Any procedure don't run after the login

Discovery on you are will surprised in system getting more nonpoisonous totally unexpectedly! ,The best, open immediately now:

"At the beginning Procedure Management tool Computer management Local users and the group Users " (indicating a suggestion, a request or a mild command)!

[kangpw-blog]

What security of system of assurance to plug a hole

It is that the biggest Patch Tuesday which Microsoft has released since October of 2003 upgrades safely that the newest Patch Tuesday released on June 9 upgrades safely, also contain loophole range the widest one. Upgrade including six accumulation patches altogether this time, cover 31 loopholes, and influence Windows 2000, Windows XP, Windows Vista and Windows 7 operating system that will emerge soon.

However, still some loopholes have not been mended yet at present. One of these is a security loophole CVE-2009-1537 in Direct Show, it can be through carrying out the long-range code by QuickTime media file that is especially designed.

Since this month, Adobe participate in patch to reach Microsoft release cycle for the first time, set about releasing one's own software patch. The patch released this time has contained a large number of anticipated Acrobat loopholes.

The security released this week may become a hacker's use tool to upgrade a lot of related loopholes, in order to develop attacking the procedure in a large amount, threaten the security of users' system. The assailant can dispose the password to steal hobbyhorse and other hostile software to the machine that is not mended.

The north subregion online security products director Jason Yuan of Michael Fay Company shows, though the patch has already been released, but the unfavorable factor is that it is an extremely time consuming job to mend all systems. In fact, because the enterprise layer must test, this will consume much time before applying to and patching up, make a lot of machines all mended within several weeks or several months, it is very easy to be attacked that this causes them. The system attacked may lose important database user name and password, and these systems will also become controlled by the assailant " The meat chicken " .

In order to discern the important loophole and propose the safeguard procedures in more time, Michael Fay's security researchers have been cooperating with Microsoft, Adobe and security service. Yuan says: "Anti-virus, network of us IPS, host computer IPS, loophole scanner and other product integration cover above-mentioned safe signature of loophole already. In addition, we still can defend the loophole not releasing the patch yet at present. The customer who uses Michael Fay's network IPS products can get abundant protection, even if the system has not mended and can still intercept and attack. "

Michael Fay analyzes the loophole in employing by way in which the agreement decodes, and guarantee the loophole will not be utilized. Yuan show Michael Fay these kind " plugs a hole " Way with some IPS manufacturer" Block and attack " Way have greatly distinguish. So long as attack mutation, " block and attack " Way be lasted the ones corresponding countermeasure, and " plug a hole " Way can once and for all.

Yuan advises enterprise's users to do the following several points well:

1.Segment to the network in the area of important juncture, and dispose the network IPS solution.

2.Dispose the outstanding terminal station safe protection products.

3.Install patches for important desktop and server regularly.

4.Delete the empty service, go on and strengthen to operating system and utility program at the key server of DMZ district safely.

[kangpw-blog]

Realize ARP ultimate defence with Look ' n ' Stop fire wall

ARP has attack the question and already been discussed for a lot times, a lot of friends have proposed a lot of solutions too, not wordy here. But my individual proposes, the stronger network engineer to manipulative ability, preferably defending the method that ARP attacks, through setting up the fire wall, make this machine only respond to MAC that the gateway came, this's a basic method solved

Seldom there is this function at present in the domestic fire wall, it is Look ' n ' Stop to be for my personal use, cooperate with the use of patch, very safe carefree

" Look ' n ' Stop fire wall " Powerful, set up and complicated, if the installation of person not familiar with Look ' n ' Stop fire wall has produced various network problems after finishing, had better surf the Net, consult materials, oneself solve some problem, problem solving learn till knowledge also not merely so. Can not really manage to have the forum and ask.

Give to I one-off Look ' n ' Stop as an addition and take precautions against arp gains:

Prevent the network sheriff from waiting for arp to control

Network sheriff whether whom ARp that utilize cheat come, achieve the goal of controlling. ARP agreement is used for analyzing the corresponding relation of IP and MAC, so can realize that the control of the network sheriff is resisted by following methods.

If machine of you does not plan machine communication in the LANs, can then use the following methods:

A.In " Internet filters " There is a " ARP inside: Authorize all ARP packets" The rule, forbid the sign on making in front of this rule;

B.But these regular acquiescence can forbid the information of the gateway, the method dealt with is MAC address (usually the gateway is stationary) of a gateway The ones that place on this rule " The goal " The district, in " Ethernet: The address " Li are chosen " Not equal to " ,And MAC address of a gateway was filled in at that time; Place one's own MAC address on " The source " The district, in " Ethernet: The address " Li are chosen " Not equal to " .

C.In the last " All other packet " In, revise " goal " of this rule The district, in " Ethernet: The address " Li are chosen " Not equal to " ,Fill out FF in MAC address: FF: FF: FF: FF: FF; Place one's own MAC address on " The source " The district, in " Ethernet: The address " Li are chosen " Not equal to " . The others are not changed.

In this way the network sheriff is powerless. This method is not suitable for with other machine communication in the LAN, and the gateway address is under the stationary situation.

If your machine needs only needs to get rid of the control of the network sheriff with the machine communication in the LAN, the following methods are simpler and practicaller (this method has nothing to do with the fire wall) : Enter the order line state, operate " ARP - s gateway IP gateway MAC " Getting all right, want, get MAC of gateway, only Ping gateway, then look over with Arp - a command, the ones that can get IP and MAC of the gateway are corresponding. This method should have commonability even more, and as the net closes the address but well operated when being variable, repeat " ARP - s gateway IP gateway MAC " once Come on. The function of the this command sets up static ARP and analyzes tables.

[kangpw-blog]

And then the information security of country's network of SG186 era

In 2008 one municipal power office will find accidentally, unexpectedly the account number of former electric worker who had retired in OA system and already passed away exists, and this worker's account number has still effective authority. The controller tries to delete the account number, but find because every municipal office OA account number information is both as the backup, this worker's account number authority revives self-recovery one day later

SG186 project carry on three year, from 2006 the intersection of country and one " the 11 5 " of network Plan, to nowadays, every the intersection of province and the intersection of network and system confirm in succession, say to be snap of the fingers wave one, it is multifarious to change by ten thousand. Though the whole project has not been completed finally yet, has passed the information acquisition ability of ruggedization, accelerate the transfer rate of information, raise the treatment effeciency of information, we can see, the great-leap-forward development is appearing in country's network information construction. " a platform, eight major application, six are ensured big " Goal but also step by step realization.

Undeniable, SG186 project, to the network company in the country, and even an incident of stepping the times to the whole power industry. Set up " well versed in longitudinally, integrated horizontally " Integrated enterprise layer information integration platform, upper and lower information transmit while being unblocked and idea of data sharing make the next fundamental key for the intersection of Chinese and information-based process and future thrust of power industry.

Switch back, we have, realize SG186 engineering construction, reflect some questions too, have brought many questions to safe operation after the whole informationization of a network of the country.

The construction on SG186 is conceived looks, it is " safe protection system " that stand in the breach in six major security systems ,It means, in the intersection of SG186 and the intersection of project and planning stage, consider safe importance in the intersection of electric wire netting and information-based course already right away, but so far as construction at present, every province network consider reach the standard grade the system quickly, and wait to confirm, in order to finish the task. As to originally looking on as the safe precaution with information-based synchronized construction is managed, but obviously lag behind. The reason to cause such situation on one hand the units at all levels have insufficient understanding of safety management of information, on the other hand even because the security risk that SG186 project brings and threatening to make people really quite unexpected and having no way of doing it.

Let's see a case:

In 2008 one municipal power office will find accidentally, unexpectedly the account number of former electric worker who had retired in OA system and already passed away exists, and this worker's account number has still effective authority. The controller tries to delete the account number, but find because every municipal office OA account number information is both as the backup, this worker's account number authority revives self-recovery one day later

The above-mentioned cases are the true incident that one province utility happens after confirming through country's network SG186, can do for a representative of SG186 information security current situations at the present stage. From in,find out we at least two piece respect threat:

1. The management of access permission is lacked

SG186 project, has made the building policy that the systematic elasticity couples, melting joining to flow of urgent coupled system, the first line of loose coupled system is well versed in, it will cause the account number setting up and authority of the system to distribute the unprecedented one heavily and complicatedly to build in any case, what a valid supervising system access permission, the use preventing the account number from not being authorized? How guarantee province and city, county those at all levels unit leave office and worker that transfer have no longer, should belong to account number and authority of them yet? This question will be in some time of future, the maximum risk of the information security of the electric wire netting.

2. Systematic loophole risk

Any system is leaky, Microsoft released the newest patch of windows recently, mend the systematic loophole. Then, country network set up, reach the standard grade systematic the intersection of loophole and detection, the intersection of loophole and report, the intersection of issue and handle, the intersection of patch and detection, control that patch upgrades by every? Though SG186, in the project, it is already mature system software to be main and incoming, if loophole scarce to manage to system, will cause the serious threat to the information security of the electric wire netting. The account number can't delete this systematic loophole completely in the case, in terms of a gleam of through-going OA system, it influences the surface to be very big, if there is no sufficient understanding on its risk, utilized, will cause the great consequence.

The intersection of three countries and Chibi, Cao Cao lift a million bold warriors command an army, go down south, confidence full, is defeated and returns one a loud to burn one finally. This is a story of our very familiar competition of Chibi, we say Cao Cao the reason why fail, do not lie in he connects man-of-war with the horizontal tactics, it is not the cunning of lying in Wu's trick, and because he has insufficient understanding of current situation and threats existed, and not taken the isometric method to dissolve risk. He may consider attending the meeting to be attacked with fire, but the emergency preplan method without making and receives the fire attack ahead of time, or considered protecting the method, but not verified the significance of protecting method. Caused one's own one to be defeated finally.

[kangpw-blog]

" eternal source of infection of tower " Steal number secretly The expert introduces the extermination method

On July 1, the virus epidemic situation monitoring net of the auspicious star Gives the alarm to the netizen, " the cloud is safe " on the auspicious star A catching one system steals the network and swims " The eternal tower " Infection type virus --Eternal source of infection " Win32.Loader.w " of tower . This virus will infect the system file and load the virus, thus steal the account number password of the game, at present it is auspicious star can check it whether kill completely edition 21.45.14 antivirus software later,eternal tower player should staging as soon as possible.

The anti-virus engineer of the auspicious star introduces, " eternal source of infection of tower " found this time Different from past stealing the number hobbyhorse, this virus does not have virus file that entity ran, after the virus runs, will release one and steal " eternal tower " at first The file Vch13.tmp of the account number password function of the game, infect d3d9.dll and mshtml.dll file under system32, dllcache catalogue subsequently, make it load and steal the file Vch13.tmp of number.

Mshtml.dll and d3d9.dll are loaded by the game after the game runs, because these two files are infected by the virus, having file which steals the number function is loaded in the game process, in order to achieve the goal of stealing the game account number password.

(virus analyze the sectional drawing)

According to the auspicious star" The cloud is safe " The catching virus of the system is analyzed, the recently catching malignant infection type virus shows a tendency to obviously rise. The infection of this viroid is very capable, and it is fast to make a variation, will release various hobbyhorses and destroy and steal number, until its have file that entity run, so some technology deficient security software very difficult according to deal with traditional way of hobbyhorse, go on, consult, abate.

The expert reminds users to upgrade the antivirus software in time to the latest edition, can take precautions against this infecting type steals the virus of number ahead of time, if has already been infected with this virus and can be dealt with according to the following methods:

1,Deletion \Windows\system\Vch13.tmp file

2nd, use the auspicious star antivirus software Remove the following files sequentially

system32\dllcache\d3d9.dll

system32\d3d9.dll

system32\dllcache\mshtml.dll

system32\ mshtml.dll

[kangpw-blog]

UTM deals with the happy network by intelligence Let the staff work contentedly even more

As to the school, enterprise what network is the most popular at present for this kind of public institution? I'm afraid many readers will all think of as soon as possible " The happy network " Existence,it is a lot of for staff will have passed by " the networks happy " when not in a hurry at ordinary times Rob the parking stall, buy and sell to slaves, what is more to prevent staring at one's own vegetable garden and pet from and is stolen by others everyday. In a sense " The happy network " There is very big influence on that enterprises run, the lighter causes staff's operating efficiency to be low, because the game causes the contradiction between a plurality of staff of the heavy one. This is not one small " The happy network " Make a noise greatly and lead extraordinarily " Unhappy " ,Call origination lets me here within three days " The happy network " Shield completely, let the staff get back to the work position more steady and surely and more efficiently.

First, the initial battle URL filters letting in " happy net " It is unable to reveal

What our unit used is U200-CA of H3C Company, this is a very good UTM safe gateway products, built-in and anti-virus this product, take precautions against IPS invades and attacks, defends safe functions such as the junk email,etc.. Certainly this is too most UTM safe gateways possess.

I decide to pass this sincere UTM products right " The happy network " Start, that adopted is that URL filter the law of closing type at first, utilize UTM products URL attached to filter the function to " happy network " Filter, operate it as follows specifically.

First step: Enter the management interface of U200-CA UTM apparatus, then choose " strategic management " -> " deep security policy " ,Later clicked " Employ the security policy " Interlinkage enters UTM mode. (such as Fig. 1)

Fig. 1

Two-step: The interface in UTM, through " URL filters " -> " regular management " Look over the present rule. (such as Fig. 2)

Fig. 2

[kangpw-blog]

Terminator of fire wall - -UTM takes on the boundry of key link safely

Safe gateway the intersection of safety hardware and one of maximum under market, account for than exceed 70%, the capacity is close to RMB 2 billion; And is accompanied by the main safe gateway products - -Fire wall and materialzation, threatening the complicated trend, UTM products taking stereoscopic defence as goal increase " well blowout " ,Every major manufacturer put out UTM products in succession, the pattern of market of safe gateway of China is changing unprecedentedly.

Recently, Cisco announces its PIX fire wall for many years of situation of selling well will be stopped selling on July 28, 2008, the substitute is the ASA series UTM products. PIX sold several million during its life cycle, stops selling and having epoch-making meanings, this means end of times of fire wall, UTM the beginnings of times.

UTM enters " Well blowout "

IDC put forward UTM concept since 2004, went through the fast development in three years, UTM presented the well blowout phenomenon in 2007 that just passed. The space of market of U.S.A. UTM has already surmounted the fire wall, has become the mainstream of the market of safe gateway; On the Chinese market, this prominent trend of the data from authoritative advisory organization CCID and IDC, merit attention:

"The safe demand trend of product design compliance of UTM, respond to the request that to threatening management diversifiedly, it is 2007 security products with fastest-rising in year. " --CCID " products market survey annual report of China's information security of 2007-2008 year "

"It is very swift and violent, complete to threaten to manage the market of hardware in the growth in 2007 and increase by 87.6% on an annual basis in unison, leave, increase 105.4% on an annual basis by half among them, will it be the second half 2007 the intersection of growth rate and most quick the intersection of security and sub market. " --IDC " market analysis and prediction of China's IT security, 2007 "

From every manufacturer data reveal UTM products faster than to increase in every mainstream safe product mix of manufacturer too, translate time increasing up toing specific manufacturer.

The demand is satisfied degree and promoted constantly

Regarded as the security gateway of the stereoscopic defence, UTM attracts numerous concerns from emerging, certainly, among them not lack the concern of holding the doubt. This kind of suspicion mainly comes from three respects: Specialization intensity and overall performance of the ease of use, function. To the doubt, each producer has adopted many kinds of means and ways to solve, promoting constantly as to satisfaction degree of the user's needs.

It is " simple and apt to use " UTM could scale applied key, especially to user, user of small and medium-sized enterprises and trade of government, how to realize that disposes briefly, implements briefly, manages briefly, it is the important challenge to the network management person. The leading manufacturer outside China pays close attention to the ease of use very much, Fortinet, Checkpoint, Venus time,etc. all place the ease of use on the focal point of product development clearly, Checkpoint has proposed " The Security you need, The simplicity you want " Slogan,Venus time Israel " getting more simple to be more become safely " As the requirement and demand guide of UTM products. Through the constant improvement and upgrading, users' ease of use to UTM products has reached acceptability.

To that " whether each function can compare with gateway device of the single function " Doubt,solve every producer hard self-made, combination among the strong ones,etc. through strengthening, no matter anti-virus AV, or IPS invades the defence, may be said the result is prominent. Compared with single security gateway products, the result of use of each function module is not inferior at all in UTM, have already got users' general approval.

The performance reduction question caused that the function increases, every manufacturer usually adopts " upgrades and chooses the products " Way solve,that is let's adopt is it higher hardware platform, make sure whether apparatus overall performance in conformity with actual demand. Although this method is a makeshift, solve the demand in trades such as government, finance, small and medium-sized enterprises,etc., having improved covering with and operating range of UTM products to a great extent, this makes small and medium-sized enterprises and user of government trade become important pushers who UTM markets grew up fast.