Larry Seltzer

Its SOP when you buy a new OEM PC: First, you install all the updates to Windows and Office since your system was built (not as big a problem as it used to be), then you delete all the garbage your OEM preloaded with Windows on your computer. This software, often called “crapware” or “crapplets” […]

If you havent been under a rock for the last couple of years, then you know that a major problem has developed with numerous exploits of subtle vulnerabilities in the old, pre-2007 Microsoft Office file formats. The usual scenario is that we find out about them after a “targeted attack,” probably an attempt to compromise […]

There has been a lot of action on the ICANN site and blog in the last couple of days. First, it was announced that a deal has been struck with Registerfly that will make all domains, even those protected by their anonymous registration service, available to registrants. Click here for some background on the problems […]

I was excited when I began reading a recent research paper by a group of people at Google on Web-based malware. As the paper says, Google has an interesting position with respect to the problem. But it doesnt seem to me that their research adds much thats helpful. Of course, they need to get up […]

Hows NAC working for you? Are you even implementing or planning for it? Depending on whom you talk to, youll hear that network access control is either dead or its being widely studied and implemented. The good news story says that compliance, SOX in particular, is the main force driving implementations. This makes sense to […]

Symantec is reporting on a Trojan horse that mimics the Windows activation interface. What they are calling Trojan.Kardphisher doesnt do most of the technical things that Trojan horses usually do; its a pure social engineering attack, aimed at stealing credit card information. In a sense, its a standalone phishing program. Once you reboot your PC […]

People like me, who write about security, are flooded with reports on the state of malware. Theyre often valuable enough and say interesting things, but on certain points they are invariably, and infuriatingly, vague. Symantecs blog May 9 on bots in corporate networks illustrates this point with a sort of innuendo. You might be surprised […]

When a company gets as big and important as Microsoft, everyone has legitimate gripes against it. To some degree its like dealing with the phone company; theyre big and impenetrable and, unless you seek a path off of the mainstream, you have to deal with them. Deb Shinder (a Microsoft MVP, at least for now) […]

It seems that everyone involved in online commerce and other online businesses that require authenticating the consumer are making money in spite of fraud, phishing and the like, but it would certainly be better if they could do it with less fraud. This is why I was excited by the announcement by VeriSign and Innovative […]

Ive said it before and Ill say it again: You just cant do enough testing of software systems. And as complexity of software systems rises, more testing is necessary. Do you think, for example, that a Boeing 747 is a complicated piece of machinery? I suspect it pales in comparison to Windows Vista for complexity. […]

They were heady days back in 2004 when the industry tried to reach consensus on a standard for SMTP authentication. The MARID (MTA Authentication Records In DNS) standards effort went down, partly in the flames of a political fight over patents with Microsoft, but the larger truth of the matter was that changes to heavily […]

Malware evolves. Like real software markets, if the opportunity declines then the purveyors will go elsewhere. Its well known, for example, that there are very few actual viruses anymore. And it looks like adware is headed in the same direction. Roger Thompson noted it in his blog. After making several other interesting observations about developments […]