Digital Quest - The Technology Digest

PayPal Phishers Use Malaysian Government Portal

2006-11-26T22:43:00.000+05:30

An antispam researcher has uncovered a phishing scam that uses computers belonging to both a medical transcription outsourcing company and the Government of Malaysia.

The scam was discovered by Bill Carton, an engineer based in San Diego who has spent the last ten years as a volunteer antispam activist, shutting down bulk e-mailers in his spare time. Carton received an e-mail Friday morning that purported to be from eBay's PayPal service.

It read like a standard phishing pitch: "It has come to our attention that your account information needs to be updated," the e-mail said. "If you could please take 5-10 minutes out of your online experience and update your personal records you will not run into any future problems with the online service."

What was unusual, however, was the fact that the link in the e-mail was to a fake PayPal site hosted by servers in the Malaysian government's gov.my domain.

"This one was interesting because of the Malaysian angle. A government server usually gets my attention," Carton said.

'Secure' Sites Co-opted
Closer investigation revealed that computers from another trusted source had been used to send out the phishing e-mail.

"The compromised mail server used to relay the spam and scrub off any evidence of where the spammer is, was not the typical home cable customer with a zombie infection, but Rxdocuments.com," Carton said. "They boast of having HIPAA-compliant software for patient privacy, but they were compromised and used as a spam-spewing relay. How trustworthy is that?"

Paul Laudanski, owner of Computer Cops and the leader of the Phishing Incident Reporting and Termination squad project, examined the phishing e-mail and agreed it appeared to have been relayed by Rxdocuments.

Rxdocuments.com provides dictation transcription services for physicians. It bills its products as "cost-effective, secure transcription adhering to the highest professional, ethical, and legal standards," according to the company's Web site.

Neither Rxdocuments.com, nor the Government of Malaysia responded to requests for comment. Rxdocuments.com is headquartered in Miami, but the Web site is registered to RxDocuments, in Bangalore, India, according to the Whois database, which tracks domain registration.

This is not the first time that the gov.my Web site been used by phishers, according to Laudanski. It has been used at least four other times since April of this year to spoof brands such as Chase, Citibank, and eBay, he said.

Aggressive Phishing
Phishers have become increasingly sophisticated as criminals have realized that there is real money to be made in online fraud. Research company Gartner estimates that U.S. consumers will lose $2.8 billion to phishing in 2006, with the average attack netting $1244.

"There's definitely more of it than we've seen ever," said Dave Jevans, chairman of the Anti-Phishing Working Group. "Spam has gone up hugely in the last two months and the volume of phishing has gone up with that," he said.

Jevans agreed said that this latest PayPal scam is unusual.

"It's interesting because it's basically two entities that you would think would have security nailed down," he said.

Police blotter : Child porn in Web cache OK

2006-11-26T22:37:00.000+05:30

"Police blotter" is a weekly News.com report on the intersection of technology and the law.

What: Pennsylvania man appealed his conviction for knowingly possessing downloaded child pornography, saying he didn't know it was in his Web browser's cache.

When: The Pennsylvania Superior Court ruled on November 2.

Outcome: Court threw out conviction, saying state law criminalized only knowingly possessing child pornography, not simply viewing it.

What happened, according to court documents:
Anthony Diodoro was convicted of 30 counts of child pornography possession and one count of criminal use of a communication facility. He was sentenced to 9 months to 23 months in prison.

His conviction arose out of a slightly unusual situation: Prosecutors successfully proved that Diodoro had viewed child pornography sites and pointed to his Web browser's cache as evidence. (A browser cache is a temporary storage location for Web pages, so that if the same page is visited again, it can be quickly reloaded from the hard drive.)

But prosecutors did not prove that Diodoro actually knew the illegal images were saved to the cache, a common situation for novice users.

That's crucial, because section 6312(d) of Pennsylvania's criminal code says: "Any person who knowingly possesses or controls any book, magazine, pamphlet, slide, photograph, film, videotape, computer depiction or other material depicting a child under the age of 18 years engaging in a prohibited sexual act or in the simulation of such acts commits an offense."

The judges agreed that Diodoro viewed child pornography (some 370 images worth, in fact) but ruled that the wording of the law only criminalized knowingly possessing it. They reversed his conviction.

This is different from other cases that have appeared on Police Blotter in the past. In July, the 9th Circuit upheld a defendant's child porn conviction, in part because the evidence showed he looked at the cached images. In a case involving a Naval officer, he allegedly had saved images in addition to cached images.

In another case, called U.S. v. Tucker, the 10th Circuit upheld a defendant's conviction because he cleared his Web browser's cache to avoid being caught with saved child porn. The logic: Because he knew about the existence of the cache, he had knowingly possessed the images at least temporarily.

This is another odd result of laws written during a time when contraband existed only in physical form. It implies, for instance, that it would be perfectly legal to watch (though not distribute) child porn videos streamed through a site like YouTube, and that it would be legal to browse child porn Web pages if a browser's cache was disabled.

Excerpts from the Pennsylvania court's opinion
This is an issue of first impression in Pennsylvania. We have found no case exactly on point in which a conviction for "possession" of child pornography for simply viewing it on a Web site without any evidence that the defendant knew the image was being saved on the computer's hard drive. In cases from other jurisdictions affirming such convictions, there was evidence that the defendant knew the images were being stored, and usually distinguished those cases from the situation where the defendant merely viewed the images without knowing they were being stored. Those cases point out that to establish possession, a defendant must know that the image is being stored, so he or she knows he or she has the ability to save, print, or e-mail the images to others.

We note that it is well within the power of the legislature to criminalize the act of viewing child pornography on a Web site without saving the image. The language used in section 6712(d), however, is simply "possession." Because this is a penal statute with an ambiguous term when it comes to computer technology, it must be construed strictly and in favor of the defendant. A defendant must have fair notice that his conduct is criminal. Because of the ambiguity, sufficient notice was not provided here. For this reason, we are constrained to reverse and leave it to the legislature to clarify the language if it intends to make the mere "viewing" of child pornography a crime.

At trial, the commonwealth's computer forensics expert testified that when a Web site is viewed, the image is automatically saved to an Internet cache file. The purpose is to save time, so that if the site is viewed again, the old file can be quickly uploaded rather than requiring the time to reload the file...

We hold that absent specific statutory language prohibiting the mere viewing of pornographic images or evidence that the defendant knowingly downloaded or saved pornographic images to his hard drive or knew that the Web browser cached the images, he cannot be not criminally liable for viewing images on his computer screen. Therefore, we conclude that the evidence was insufficient to sustain Diodoro's conviction for knowing possession of child pornography under section 6312(d).

When Off-the-Rack Software Doesn't Fit

2006-11-26T19:32:00.000+05:30

Does packaged small-business accounting software fall short of your needs? Consider software for which source code is available.

"One size fits all" is one of the biggest lies in clothing. Similarly, the notion that one accounting application can be suitable for all small businesses is one of the biggest myths in computing.

Small-business accounting applications such as Intuit Quickbooks, Microsoft Office Accounting (formerly Small Business Accounting), and Peachtree and Simply Accounting from Sage Software are popular tools to help you manage business operations and keep track of finances. But while they are capable and cost-effective, they are not necessarily best for every business.

If you run an off-the-rack type of small business, you can be quite satisfied with the capabilities of these packaged business management applications. Some are available in several editions; typically, the more expensive versions permit additional users and add specialized capabilities such as time billing and project tracking. However, if your business has special requirements, using a packaged application can be like wearing a jacket with sleeves that are uncomfortably short.

Recognizing these limitations, vendors of accounting packages have added some customization capabilities in recent versions that may help out. For example, you can remove unneeded features from program menus, and also create custom reports. You can add new fields to displays and reports. One of my clients even added a birth date field to his accounting application's customer database, so he could track birthdays and send a congratulatory card to each buyer.

When Shrink-Wrapped Isn't Enough
But sometimes such customization features are just not enough. Perhaps you deal with your customers in a unique way or offer more options for your products than does the competition. In that case you have two choices: Adapt your business operations to the software available, or adapt software to meet your business requirements. If changing your business operations feels like shortening your arms to fit a jacket, how should you handle changing the software?

While you can start programming an accounting application from scratch (or, more probably, hire someone to do so), that's much like re-inventing the wheel. If you require a custom solution, it's usually more cost-effective to start with something that comes close to what you need, then modify the source code to deliver a precise fit.

Applications for which source code is available should not be confused with open-source software. Open-source business accounting programs such as TurboCash and SQL Ledger do have source code available. However, not all applications for which source code is available are open source. Some, such as Open Systems' OSAS and Sage Software's Sage Pro, are licensed under more traditional terms and require payment to use the software.

Bringing in a Pro

Modifying the source code for an accounting application requires more technical knowledge than installing a packaged application. You may need support from a contract programmer or experienced consultant. You can often get good leads to qualified professionals from the application developer or a product support bulletin board.

Once you've got your modified software, be sure to test it thoroughly to ensure that it works as you expect. I recommend running it in parallel with your existing system for a minimum of three months. Compare the results each month to see if the overall totals agree. If they don't, stay with your original program until you get concurrence for at least two months running. Yes, this means extra work, but it's one of the costs that must be factored into your decision to go the custom route.

Examine the capabilities of packaged applications and their customization options carefully before rejecting them. Sometimes a business assumes its needs are unique when, in fact, thousands of other companies have similar requirements and software to deal with them is already available. But if your business operations are truly different, there's nothing better than the fit you can get from accounting software based on customized source code.

A Safe, Easy Way to Encrypt Files

2006-11-24T09:28:00.000+05:30

How do I encrypt files, and which ones should I encrypt?

Any system that encrypts your entire hard drive is overkill for most PC users. I prefer encrypted safes, which are files that contain encrypted folders and files. To the outside world, a safe looks like a big file filled with gobbledygook. Open a safe with its password, and you reveal a virtual drive holding your sensitive data. When you're done and you close the safe, the data reverts to gobbledygook.

Safes are easy to use, transportable from one PC to another, and a breeze to back up. I recommend the free open-source safe program TrueCrypt, which supports AES-256, Blowfish, Triple DES, and other heavy-duty encryption algorithms. TrueCrypt hides your safe well--if you're in the belt-and-suspenders crowd, it can even place your safe inside another safe.

Remember: No encryption is secure with an easy-to-guess password. Safest is a string of 20 or more apparently random letters and numbers. But how do you remember such a password?

Make up an easy-to-remember but impossible-to-figure-out formula of family names, birthdays, and memorable words. For instance, use your kids' names spelled backward, with every third letter capitalized, followed by your birthday squared.

Write the password or the formula on a business card and carry it in your wallet. It's unlikely that someone will steal your wallet and your PC, and even less likely that they'll figure the card out.

What files should you put in the safe? Any that you don't want crooks, competitors, coworkers, or even your own children to see. One top priority is financial information, especially if it involves credit card, bank, or Social Security numbers. Passwords to retail Web sites should also be stored in the safe. You might put some sensitive work-related files there as well (although your IS department likely has an encryption policy). Your résumé , family photos, private e-mail, and other files that you want to keep secure and confidential are candidates for the safe, too.

Speed up Firefox up to 500% !!

2006-11-24T08:18:00.000+05:30

1. Type "about:config" into the address bar and hit return. Scroll
down and look for the following entries:

network.http.pipelining
network.http.proxy.pipelining
network.http.pipelining.maxrequests

Normally the browser will make one request to a web page at a time.
When you enable pipelining it will make several at once, which really
speeds up page loading.

2. Alter the entries as follows:

Set "network.http.pipelining" to "true"
Set "network.http.proxy.pipelining" to "true"
Set "network.http.pipelining.maxrequests" to some number like 30. This
means it will make 30 requests at once.

3. Lastly right-click anywhere and select New-> Integer.
Name it "nglayout.initialpaint.delay" and set its value to "0".
This value is the amount of time the browser waits before it acts on
information it receives.

If you're using a broadband connection you'll load pages 2-30 times faster
now.

DVD Burning Tips: How to Avoid the Top Five Disc-Burning Mistakes

2006-11-24T07:39:00.000+05:30

CD/DVD recorders and media are pretty mature and stable products at this point. But if you aren't careful, a bad burn could still happen--and leave you with only a bicycle reflector for your effort. Here are the five most common disc-burning errors, and how to avoid them.

1. You didn't verify: If there's a golden rule for burning discs, it's "Thou shalt verify." Using your burning software's verify (or validate) function to compare what has been written with what was read is your best hedge against nasty surprises down the road . The verify function won't increase your chances of burning a disc successfully, but it will let you know of a problem in time to burn another disc. Many a seemingly successful burn will bug out when you play it--not because the disc has gone bad, but because the burn was bad to begin with.

2. It's the wrong media: In a perfect world, choosing the right media wouldn't be an issue. But nothing is more frustrating or embarrassing than sitting down in front of Grandma's TV at the family reunion only to watch her DVD player choke miserably on the photo album you labored over so dutifully. The moral of the story? Select media that you know your player (or Grandma's) will support. In the case of DVDs, that means choosing from DVD±/RW or DVD-RAM.

If you buy bare, no-name blank media (CD or DVD), follow the golden rule above (verify!)--and prepare to run into the occasional bad disc. In my experience, DVD media tends to be a lot more reliable than CD media; but generally speaking, the lower a disc's cost, the better its chances of heading straight to the scrap heap.

3. You're going too fast: Nobody likes waiting around for a disc to burn. Unfortunately, going as fast as you can isn't always the best strategy. While I've rarely had problems burning rewritable CDs and DVDs, their recordable counterparts are a different story. Some CD-R and DVD-R discs burn at top speed correctly, but I've experienced blowouts with many others. Once you factor in the time you spend trying to determine what the problem is, you might be better off stepping your burn speed down a notch. And unless you're using a stopwatch, you'll never notice the difference between, say, 18X and 16X anyway.

4. The firmware's gone soft: With the intense pressure to get products out the door in a competitive market, your burner's firmware or software bundle may not have been exactly perfect when you bought it. Shocking, I know, but the point is that the firmware or software has almost certainly been updated (or soon will be), and if you're not happy with your burner's performance, you should avail yourself of those updates, which you'll find on the vendor's Web site. Still, there's a heap of truth to the old saying "If it ain't broke, don't fix it." Updates all too often cause problems of their own. If your discs are burning fine, let your burner be. (Even drive vendors will tell you that.) But if your drive habitually stutters when you switch to a new brand of disc, for example, a firmware or software update will likely help.

5. You're cruisin' for a bruisin': Today's PCs are more than fast enough to juggle other tasks while burning discs. But as I hinted above, programmers sometimes have bad days, and software does crash--taking your nearly completed burn with it. You'll increase your chances for success if you minimize the number of apps running while you burn your discs. I'm not saying that you should avoid multitasking or burning in the background altogether, but I am saying that you ought to be careful. If you're down to your last disc and you have time for only one go, shut down all your other apps, set the disc to burning, get a cup of your favorite beverage, contemplate the universe for a few minutes--and don't mess with your computer until the job is finished.

7 Effective Ways to Get Free Traffic

2006-11-14T09:40:00.001+05:30

1. Free Classifieds - This system works more effectively, especially if you have ‘Make Money Online’ related websites. There are some popular Free Classifieds Websites around there to post your ads for free, just make a search ‘Free Classifieds’ ‘Post Ads’ etc in Google and you can find some good classifieds sites list. The title of your ad must be attention grabbing to make it stand out from the rest. The description should be short but informative. Don’t forget to add your website url in the ad form.

2. Link Exchange - Make relevant link exchange with other sites and preferably on homepage. If not, try to add your link on their directory. It will help to get traffic both from their sites visitors and also it boosts Search Engines Rankings. Don’t try exchange with Link Farms, also don’t exchange links with more than 100 links in that page.

3. Blog Traffic - Create a Blog in Blogspot.com and make some posts with good content and make a link on your main website, it helps start getting traffic from Search Engines quickly, especially from Google. Update your blog regularly, so that the Search Engines spiders crawl your blog at regular intervals. Ping your blog whenever you update. Generate RSS feeds to your blog, so that visitors can read in a RSS reader right on their desktop.

4. Opt-in Email Lists - Its very important on getting repeated visitors to your website and this can be done by capturing visitors email address. You can send emails whenever you update the website. Use autoresponders like aweber or freeautobot for follow-up emails. Don’t bombard with emails daily with offers. It is a surefire way to make your visitors click the unsubscribe link. Give an interval of minimum 2-3 days for each mail.

5. Forum Traffic - Its another important factor getting free traffic from discussion forums, make a search ‘keyword+forum’ on Google to find your website related forums and add your url in the signature. Make some useful conversations with others and don’t try to promote your products or offers directly in the posts. It also helps on SEO aspects.

6. Writing Articles - If you have enough time and having writing skills, write articles on topics that interests you and submit to article sites. Content will always be the king and most of the websites look for content to add on regular basis. If your articles are informative enough, they are more likely to get published on other websites. Don’t forget to add your website link in resource box of the article.

7. Ebook Traffic - Compile some useful information about your niche and make it an ebook and give it away for free to others. Add your website link in the ebook and allow the permissions to give it away for free to others. You can also entice your visitors to sign up for your list by offering the ebook in return.

LEDs could start replacing lightbulbs soon

2006-11-14T00:50:00.000+05:30

Light-emitting diodes will become economically attractive as replacements for conventional lightbulbs in about two years, a shift that could pave the way for massive electricity conservation, according to a researcher.

Right now, consumers and businesses can buy a light-emitting diode, or LED, that provides about the same level of illumination as an energy-hogging conventional 60-watt lightbulb, Steven DenBaars, a professor of material science at the University of California Santa Barbara, said at the SEMI NanoForum, taking place here this week. A principal advantage of the LED: It lasts about 100,000 hours, far longer than the conventional filament bulb

Unfortunately, the LEDs that can perform this task cost about $60, he said. (Prices vary on the Internet.) But prices have been declining by 50 percent a year, so two years from now the same LED should cost around $20.

To make matters worse, traditional lightbulbs are incredibly inefficient. Only about 5 percent of the energy that goes into them turns into light. The majority gets dissipated as heat.

If 25 percent of the lightbulbs in the U.S. were converted to LEDs putting out 150 lumens per watt (higher than the commercial standard now), the U.S. as a whole could save $115 billion in utility costs, cumulatively, by 2025, and it would alleviate the need to build 133 new coal-burning power stations.

In turn, carbon emissions in the atmosphere would go down by 258 million metric tons.

"Multiply that by three and you get the worldwide savings," he stated. DenBaars then showed a picture of the globe at night. The landmass of the U.S. could easily be picked out by nighttime lights.

"We shoot a lot of light into space that doesn't need to be there," he noted.

Rising prices of electricity, combined with the antiquated nature of lightbulb technology, has prompted several start-ups and large industrial concerns to get into lighting.

Fiberstars, for instance, has come up with a way to replace hot fluorescent tube lights with light-emitting optical fiber in freezer cases in grocery stores. Hewlett-Packard spinoff Lumileds is also producing LEDs for a variety of applications.

LED technology is improving as well. UCSB has created an experimental LED that can put out 117 lumens per watt, while a Japanese company has developed one that can put out 130 lumens per watt.

Getting LEDs to produce white light that is tolerable to humans has also greatly improved. Manufacturers can do it two ways. One is to package red, green and blue LEDs in a way that the combined light shines white to the human eye. The other way is to make blue LEDs and coat them with a phosphor--a luminescent substance commonly used on fluorescent lamps

Google launches new mobile Gmail

2006-11-03T08:12:00.001+05:30

Gmail for Mobile Devices is a free, downloadable Java application. It will work on the nearly 300 types of Java mobile phones in the United States, said Tony Hsieh, product manager for Google Mobile.

The software improves on a version of Gmail released nearly a year ago that lets people access their e-mail through a mobile Web browser. Once the new Java application is installed on a phone, a person can quickly launch Gmail instead of having to open a mobile browser and wait for it to load before signing in, Hsieh said.

In addition to being faster, Gmail for Mobile Devices maintains Gmail functions like threading and search, and adds mobile-specific functionality such as the ability to press a button to make a call to someone who sent an e-mail. People can also view attachments, such as photos, in an optimized full-screen format.

"If it takes someone a minute or two or even longer to check e-mail on their phone, people probably won't do it," Hsieh said. With wireless application protocol browsers, it can take 11 clicks to delete or archive a message, but with the new application it will take just two, he said.

There is no cost to download the application, but people will have to pay data charges to their mobile carriers. People can download the application by sending themselves a text message from the Google Web site, going to Gmail.com/app from their mobile browser or downloading it from the Sprint Nextel home page, according to Hsieh.

Microsoft backtracks on Vista transfer limits

2006-11-03T08:09:00.000+05:30

On Oct. 16, Microsoft issued the new user license for Vista, including terms that would have limited the ability of those who buy a boxed copy of the operating system to transfer that license. Under the proposed terms, users could have made such a switch only one time.

However, the new restriction prompted an outcry among hardware enthusiasts and others. Microsoft is returning the licensing terms to basically what they were in Windows XP--users can transfer their license to a new PC an unlimited number of times, provided they uninstall and stop using it on the prior machine.

The software maker said it paid attention to the response both directly to the company and on blogs and decided to reverse course. Microsoft had hoped to use the change to aid its ongoing efforts to thwart piracy.

"We're trying to be really clear about our intention to prevent piracy," said Microsoft product manager Mike Burk. "At the same time, after listening to the feedback that came in, (we) felt that we needed to make this change."

By reversing course, Burk said, Microsoft hoped to assuage users' concerns, particularly those of hobbyists who frequently upgrade the components of their PC, in some cases triggering Windows to consider the machine a new PC.

The plan to limit transfers was part of a series of changes to the terms that apply to boxed copies of Vista, not to the license that comes on a new, Vista-equipped PC. Separate rules apply for the versions of Windows installed on new PCs, which is how the majority of buyers get their copy of Windows. Typically, copies of Windows purchased on a new PC cannot legally be transferred to another PC.

Burk said that Microsoft isn't planning to back off any of its other planned licensing changes, including a move related to virtualization, in which a computer runs multiple operating systems, or multiple copies of the same operating system, at the same time.

Under those new license terms, any Windows version can serve as the primary, or host, operating system. However, only the Business and Ultimate editions of Vista can run as guest operating systems in virtualization.

"We're not planning on making any other changes," Burk said. "We'll keep listening to people's feedback."

Sony to sell world's lightest notebook

2006-11-01T21:20:00.000+05:30

Sony said on Wednesday it plans to start selling the world's lightest notebook computer in December in Japan, in a bid to boost its presence among business users.

Weighing 898 grams, Sony's "type G" Vaio computer will be the lightest laptop PC, and comes with a 12.1-inch liquid crystal display (LCD) screen, the electronics and entertainment conglomerate said.

Sony said it expects a basic model of its new "type G" computer, which runs for about 12.5 hours on a battery and is not equipped with an optical drive, to sell for about 220,000 yen ($1,881).

It has no plan at the moment to offer the "type G" models overseas.

Copernic Desktop Search

2006-11-01T20:41:00.000+05:30

Plumb the depths of your computer with this powerful search tool.

License Type: Free
Price: Free
Date Added: Oct 2006
Operating Systems: Windows NT, Windows 98, Windows 2000, Windows Me, Windows XP
File Size: 4380KB
Author: Copernic Technologies

Copernic Desktop Search--my favorite (and free) searching tool--has been upgraded. I like it even better than before for a number of reasons. The redesigned interface is cleaner and easier to follow. For example, the different search file categories--e-mail, files, music, images, contacts, Internet Favorites, and History--are better in the new version. I can immediately see exactly how many hits were found in each category. And creating and saving custom searches is blessedly easy. The "as you type" search function is cool, too.

If you're not familiar with CDS, here's a brief rundown.

CDS looks into files--Microsoft Word, Excel, and PowerPoint docs, PDFs, and other files, such as e-mail messages (including Eudora), as well as videos and pictures. I can search on specific file types, say Word docs, or for exact words within files. The program uses an index of files on the PC in order to make searches nearly instantaneous; it updates itself while the system is idle.

The last version automatically installed itself to the taskbar at the bottom of my desktop as a new toolbar. I wasn't pleased that it did so without asking, and I promptly removed it. The new version, however, gives you an option. If you inadvertently install the features, right-click any empty portion of the taskbar, highlight Toolbars, and click Copernic Desktop Search.

Instant Messaging Without the Hassle

2006-11-01T08:40:00.000+05:30

Here is a quick tip.

Do you need to occasionally send and receive instant messages? There's no need to hassle with downloading and installing an IM program. Instead, do it all from Meebo, a Web-based service that gives you access to AIM, ICQ, Yahoo Messenger, Jabber, GTalk, and MSN.

Tricky New Malware Challenges Security Vendor

2006-11-01T08:02:00.000+05:30

A tricky malicious program has become more prevalent in spam, but experts don't know what its creators plan to do with it.

Many vendors are rating the malware--called "Warezov," "Stration," and "Stratio"--as a low risk. But they also say that it is tricky to deal with.

New Code Every 30 Minutes

The malware is a mass-mailing worm that affects machines running Microsoft Windows. When the malware infects a computer--usually after the user has opened an attachment containing the worm in a spam e-mail--it sends itself out again to other e-mail addresses found on the computer. The code is then capable of downloading new versions of itself as frequently as every 30 minutes from a batch of Web sites, said Mikko Hypponen, chief research officer at F-Secure, a security company in Helsinki.

Those new versions are created by a program on a server controlled by the hacker, Hypponen said.

In the past, malware has been known to create variations of itself, but the code to create those variations was contained inside the malware. So when a sample was obtained, security analysts could study it and identify potential new versions, he said.

Now, the hacker's program is compiling the code and rapidly churning out new versions, but analysts don't know how the new code is generated.

Security Firms Struggle to Keep Up

That characteristic is a headache for security software firms that issue special updates to their software to detect the malware. F-Secure alone has issued at least 150 signatures for the malware.

"It gets very complex to detect an attack like that because the code keeps changing," Hypponen said.

Security firm Sophos has detected some 300 versions of the malware. For October, the malware was one of the most common pieces of malicious code found in spam messages, said Carole Theriault, senior security consultant with Sophos.

Since infected computers look to other domains to receive updated code, F-Secure has worked with ISPs to shut down domains hosting the new variants. So far, nine of ten domains have been shut down, Hypponen said.

Hacker Setting Up Network

Oddly, the malware doesn't appear to do anything yet on the victim's computers. It's estimated up to a few hundred thousand computers are infected, a sizable number but not quite on the scale of large malware problems from a few years ago, Hypponen said.

A hacker could be waiting to harness enough infected computers to start a denial-of-service attack or send spam or rent out the network to a spammer, Hypponen said.

"We hope to one day find out why they are doing this," Hypponen said. "We hope it's nothing too bad."

Google Buys JotSpot, Offers Free Wiki Pages

2006-11-01T07:48:00.000+05:30

In a bid to grow beyond its roots as a search engine, Google has acquired JotSpot, a developer of wiki technology for collaborative Web sites.

Earlier this month, Google announced that it would offer online word processing and spreadsheet applications to its millions of Web searchers. The company also has a blogging service, but hasn't yet introduced a tool for Web-based collaboration.

Now Google has filled that gap by acquiring JotSpot , according to a Tuesday post on JotSpot's blog by its cofounder and CEO, Joe Kraus. He did not disclose the terms of the deal, and Google did not answer requests for comment.

Joining Google allows us "to plug into the resources that only a company of Google's scale can offer," like a huge audience, access to world-class data centers, and a team of incredibly smart people, Kraus said in his blog.

JotSpot's Background

Kraus and his partner, Graham Spencer, founded JotSpot in Palo Alto, California, just three years ago, but they can already boast of customers with big names like eBay, Intel, and Symantec. The term "wiki" is typically used to describe software that allows users to share and edit documents on the Web.

JotSpot has stopped accepting new registrations while it ports its application to Google's software architecture, but it will continue to support those existing users. Visitors and customers of eBay use JotSpot technology to share articles on topics such as the Web site's policies, selling tools, and specialty sites.

Kraus was coy about his plans for future changes. But the companies have already made one change--customers can now use JotSpot for free. That move could help Google retain current customers and quickly attract new ones.

In another change, Google has discontinued the downloadable Wiki Server (beta), a version of the service used by large companies that want to host the wiki on computers inside their own firewalls to ensure better security. Individuals and small businesses have usually relied on JotSpot to host the pages for them.

Free Small Business Suite From Microsoft

2006-10-31T07:14:00.001+05:30

Microsoft has turned its accounting suite for small businesses into two separate offerings, one of which users can download for free.

Office Accounting Express 2007, an updated version of Office Small Business Accounting 2006, is now available as a free download at Microsoft's IdeaWins site.Microsoft also expects to begin offering a slightly higher-end version of the software, Office Accounting Professional 2007, from retailers early in 2007.

The professional edition of the software has more robust features than the free version for handling inventory management, budgeting, cash flow and other tasks mature small businesses require, Office Accounting Express 2007 is aimed more at small businesses that are just getting off the ground and need help starting up.