Leo and I carefully examine the operation of the recently patched Windows MetaFile vulnerability. I describe exactly how it works in an effort to explain why it doesn't have the feeling of another Microsoft "coding error." It has the feeling of something that Microsoft deliberately designed into Windows. Given the nature of what it is, this would make it a remote code execution "backdoor." We will likely never know if this was the case, but the forensic evidence appears to be quite compelling.

Recent podcast from GRC's Steve Gibson. If this is correct (And I'm not saying that it is - just thinking that is too scary), then it means that the WMF exploit was actually a deliberatly coded backdoor in the windows operating system. Surely this is the ultimate proof of why a closed source operating system can not be a safe one.

The Windows MetaFile Backdoor?

Unofficial patch and vulnerability checker for the recent WMF exploit on Windows. (No official patch from Microsoft yet as of Jan 4th 2006)

The patch is being mirrored at:
http://www.grc.com/miscfiles/wmffix_hexblog14.exe
http://handlers.sans.org/tliston/wmffix_hexblog14.exe
http://castlecops.com/modules.php?name=Downloads&d_op=getit&lid=496
http://csc.sunbelt-software.com/wmf/wmffix_hexblog14.exe
http://www.antisource.com/download/wmffix_hexblog14.exe
The MD5 checksum of the file is 15f0a36ea33f39c1bcf5a98e51d4f4f6.

And the vulnerability checker at:
http://csc.sunbelt-software.com/wmf/wmf_checker_hexblog.exe
http://castlecops.com/modules.php?name=Downloads&d_op=getit&lid=495
http://www.antisource.com/download/wmf_checker_hexblog.exe
The MD5 checksum of the file is ba65e1954070074ea634308f2bab0f6a.

Download WMF vulnerability hotfix

The proposed settlement would enable consumers who bought, received, or used a Sony CD loaded with XCP to exchange the disc for a replacement CD, an MP3 download of the same album, and either a cash payment of $7.50 and one free album download or three free album downloads. Consumers who have a CD containing MediaMax 5.0 will receive a free MP3 download of the same album and one additional free album download, while those with CDs containing MediaMax 3.0 software will receive a free MP3 download of that same album.

PCWorld.com - Sony May Settle CD Lawsuit

Britain is to become the first country in the world where the movements of all vehicles on the roads are recorded. A new national surveillance system will hold the records for at least two years.

Using a network of cameras that can automatically read every passing number plate, the plan is to build a huge database of vehicle movements so that the police and security services can analyse any journey a driver has made over several years.

Britain will be first country to monitor every car journey

Illegal downloads are still beating legal online music in Europe, analysts have found.

A report from analyst house JupiterResearch discovered that consumers are three times more likely to get their digital music from illegal file-sharing networks than pay to download the tracks from online song shops such as iTunes and Napster, with 15 per cent of consumers using P2P sites and five per cent using the legitimate online shops.

I've seen this article in a few places - including my morning paper on the bus to work. None of the articles have gone into possible reasons why people aren't buying though.
I for one haven't bought any music in over a year - because there's not been anything I think is worth buying, not because I download it illegally - and after recent events I refuse to go and buy any music that is DRM protected or from Sony, and I know a lot of people who are the same. That's a very large chunk of the market that people are refusing to buy. It's very possible that the increasing gap between legal and illegal downloads can be attributed to this, and that the record labels just need to do more to stop putting people off buying music from them.

Young 'prefer illegal song swaps'

NEW YORK - Fingering consumers who play the same CD repeatedly as the latest threat to profits, Sony BMG music corporation is introducing new digital rights management (DRM) software that will limit the number of times CDs can be played by purchasers.

Beginning next Tuesday all new CDs released on the Sony BMG label—which is home to artists such as Fiona Apple, Bruce Springsteen, and Shakira—will contain DRM software that prevents them from being played more than one hundred times. The software, an offspring of the popular extended copy protection (XCP), also prevents owners from copying a CD more than once. Furthermore, a copy must be made within the first five plays of a CD's "shelf life," and said copying will render the original CD unusable.

Quoted from www.pugbus.net. The editorial content of this site is fictional.

Thankfully it's only fiction - for now...

Newest Sony Software Will Limit CD Plays

In late October Sony was found to be using stealth techniques to hide software that stopped some of its CDs being illegally copied.

Now three virus variants have been found that use the Sony software to evade detection by anti-virus programs.

I think it's actually one virus that goes by three different names, rather than three different viruses.

In the same article is this from Sony.

In response to the concerns, Sony has released a statement "deeply regretting any disruption that this may have caused." It added that it would work with anti-virus firms to ensure its anti-piracy system stayed safe.

Which makes me wonder what exactly they mean about keeping the anti-piracy system safe - For the end user, or from the anti-virus programs...

Viruses use Sony anti-piracy CDs

Microsoft have released Visual Studio 2005 at long last, and have gone the extra step of giving the Express version of the tools away for free download. From my understanding of it, the free versions will only work for 1 year, and then you've probably got to pay for it.

Visual Studio 2005 for free

Sony BMG said today it will offer a patch for one of its own exploits - one that comes bundled with its music CDs.
[...]
However, the patch that Sony will offer doesn't remove the 'rootkit' DRM: it only makes the hidden files visible.

A step in the right direction, albiet a very small one... At least with this patch the security risk from the cloaked files will hopefully be gone.

Sony to offer patch for 'rootkit' DRM

How DomainKeys Works

How it Works - Sending Servers
There are two steps to signing an email with DomainKeys:

Set up: The domain owner (typically the team running the email systems within a company or service provider) generates a public/private key pair to use for signing all outgoing messages (multiple key pairs are allowed). The public key is published in DNS, and the private key is made available to their DomainKey-enabled outbound email servers. This is step "A" in the diagram to the right.
Signing: When each email is sent by an authorized end-user within the domain, the DomainKey-enabled email system automatically uses the stored private key to generate a digital signature of the message. This signature is then pre-pended as a header to the email, and the email is sent on to the target recipient's mail server. This is step "B" in the diagram to the right.

How it Works - Receiving Servers
There are three steps to verifying a signed email:

Preparing: The DomainKeys-enabled receiving email system extracts the signature and claimed From: domain from the email headers and fetches the public key from DNS for the claimed From: domain. This is step "C" in the diagram to the right.
Verifying: The public key from DNS is then used by the receiving mail system to verify that the signature was generated by the matching private key. This proves that the email was truly sent by, and with the permission of, the claimed sending From: domain and that its headers and content weren't altered during transfer.
Delivering: The receiving email system applies local policies based on the results of the signature test. If the domain is verified and other anti-spam tests don't catch it, the email can be delivered to the user's inbox. If the signature fails to verify, or there isn't one, the email can be dropped, flagged, or quarantined. This is step "D" in the diagram on the right.
In general, Yahoo! expects that DomainKeys will be verified by the receiving email servers. However, end-user mail clients could also be modified to verify signatures and take action on the results.

Just found out about this from a Thunderbird update. If it works then this sounds like a very good way to help cut down on phishing specifically, and possibly to help cut back spam in general.

DomainKeys: Proving and Protecting Email Sender Identity