Security

It seems that Microsoft is still testing/finalizing the Windows XP SP2 release. Up to today’s check, it is not released here. Interestingly, a Korean edition (Korean is another asian language, which is usually listed with Chinese) has been released much more earlier, even before Japanese and Chinese (both Simplified Chinese and Traditional Chinese) editions.

I have finished a preliminary patchset based on Pawel’s (kern/54604), which will make ps -e usable under FreeBSD’s recent versions, without having procfs mounted.

My patchset has introduced reduced security IMO (due to my merge and rooted from recent removal of ps_argsopen sysctl, I’m not sure why this change has been taken place) so I will have to review the code more carefully. Maybe I need to introduce more sysctl?

Researchers have announced preliminary indications of previously unknown vulnerabilities in popular security algorithms that could permit hackers to easily install undetectable back doors into computer code or to counterfeit electronic signatures. French computer scientist Antoine Joux reported on Aug. 12 his discovery of a flaw in the MD5 algorithm, which is often used with digital signatures. The algorithm is known as a hash function, which extrapolates from all input a unique fingerprint; however, if a hacker could produce the same fingerprint with a different input stream, then the resulting hash collision would authenticate software as safe to download and execute even though it contains a back door. MD5 is employed by the open-source Apache Web server product as well as Sun Microsystems’ Solaris Fingerprint Database, and the flaw Joux uncovered means that a hacker can produce one hash collision in a few hours on a standard PC. Meanwhile, four Chinese researchers issued a paper reporting that the SHA-0 Secure Hash Algorithm could be subverted, while Israel Institute of Technology researchers Eli Biham and Rafi Chen revealed at the Crypto 2000 conference on Aug. 17 that they were investigating possible flaws in the SHA-1 algorithm, the only signing algorithm approved for use in the U.S. Digital Signature Standard. SHA-1, which is incorporated into popular programs such as SSL and PGP, is thought to be secure because knowingly producing hash collisions via existing methods is impossible. SHA-1 depends on a computer executing a routine 80 times as it tries to create a unique fingerprint, and Biham declared that he was able to copy the fingerprint for 36 of those 80 executions. If SHA-1 shares similar vulnerabilities with SHA-0, then attempts to falsify a fingerprint would be sped up about 500-fold.

Now I have security/ MFen’ed on my laptop…

昨天由于笨球咕噜开发的垃圾产品，不得不放松了Internet Explorer的zone设置，今天上着上着网，突然蹦出一个「您已经成功地安装了3721」。

毋庸讳言，3721是最让我反感的软件，我不知道现在它如何，那不重要——这东西的存在让我觉得不舒服，我不需要什么助手，更不需要文件系统驱动，虽然也许新版本根本不安装驱动，但我还是立即想了所有的办法拆掉了它。

3721似乎比以前更容易卸载了，但我明天将立即检查文件系统中所有的文件。如此如临大敌地对付一个软件，在我看来是很荒谬的事情。

以下是转贴：

作者：2f4f587a80c2dbbd870a46481b2b1882日期：2004.7.20

0、版权

本文遵从GPL协议，欢迎转载。

1、现象是什么？

大约从今年年初开始，很多人就发现，在浏览一些网站的时候，地址栏的url后面会被莫名其妙地加上"?curtime=xxxxxxxxxx"（x为数字），并且弹出广告窗口。很多人以为这是网站自己弹出的广告，也就没有在意。

我是属于很在意的那些人之一。

For those who is interested, I have deployed the stuff after 3 months’ test.

The major difference between traditional Frontfree Mail System and this is:

mat@ has dropped maintainership… I was waiting for pam-pgsql to be fixed and now I have to do that by myself :-)

Actually I am not so interested in a GPL’ed PAM module, so maybe I will write one from scratch…

Today, Alex Dupre has updated ZendOptimizer and I have installed it for FreeBSDChina.

http://computer.online.sh.cn/computer/gb/content/2004-07/01/content_888740.htm

你能相信一个连自己老窝都罩不住的操作系统吗？你能相信一群连自己老窝都守不住的人研制的内核吗？

哦，咳，咳，咳，听说了么？那个去年搞得GNU FTP差点彻底玩完，自己的bk服务器被人家添进奇怪代码的操作系统内核，又蹦出来拯救世界了！

Apparantly there is some sort of DDoS attack against www.FreeBSDChina.org. What was that? Some internal information told me that it was an intended test against www.freebsdchina.org. We have found some defects in the original website design and that should be corrected soon.

I have plugged a workaround to defeat the DDoS attack, now the load average fall from 70 to 0.65.