Recent popularity of interactive AJAX-based Web 2.0 applications has given rise to a new breed of security threats: JavaScript worms. We propose Spectator, the first automatic detection and containment solution for JavaScript worms. Spectator is a proxy that performs distributed data tainting by observing and tagging the traffic between the browser and the Web application. When a piece of data propagates "too far", a potential worm is reported. To prevent worm propagation, subsequent upload attempts performed by the same worm are blocked. Spectator is able to detect fast and slow moving, monomorphic and polymorphic worms with a low rate of false positives. In addition to our detection and containment solution, we propose a range of deployment models for Spectator, ranging from simple intranet-wide deployments to a scalable load-balancing scheme appropriate for large Web sites.

Ben Livshits, a researcher at MSFT is up to some pretty cool code analysis work.

Here is a sneak peak at some of their other up coming work.

Spectator: Detection and Containment of JavaScript Worms

Too long have we suffered in silence under the tyranny of idiocy. In the beginning, the internet was a place where one could communicate intelligently with similarly erudite people. Then, Eternal September hit and we were lost in the noise. The advent of user-driven web content has compounded the matter yet further, straining our tolerance to the breaking point.

It's time to fight back.

The solution we're creating is simple: an open-source filter software that can detect rampant stupidity in written English. This will be accomplished with weighted Bayesian analysis and some rules-based processing, similar to spam detection engines. The primary challenge inherent in our task is that stupidity is not a binary distinction, but rather a matter of degree. To this end, we're collecting a ranked corpus of stupid text, gleaned from user comments on public websites and ranked on a five-point scale.

Eventually, once the research is completed, we plan to release core engine source code for incorporation into content management systems, blogs, wikis and the like. Additionally, we plan to develop a fully implemented Firefox plugin and a Wordpress plugin.

This is awesome! Good call on using Youtube for sample data. Check out some random samples http://stupidfilter.org/random.php

Stupid Filter

What Is Chlamydia?

Snow White: Chlamydia is a lot like swallowing a poisoned apple transformed through magic by a witch. Except, instead of a poisoned apple, it’s more like bacteria living on dirty dwarf cock.

Cinderella: The Chlamydia bacteria can grow in the throat, vagina, penis, or absolutely anywhere on that whore “Sleeps-Around Beauty.” Oh, I’m sorry. I mean, Aurora.

Pocahontas: Chlamydia is the only thing I still have from John Smith.

How Do You Get It?

Snow White: I’m not a scientist so I can only guess, but I think the smart money is on doing the rusty trombone with Happy.

Jasmine: Chlamydia was invented by Jews.

Ariel: I got it playing a game I like to call “Finding Nemo.”

The Disney Princesses Talk About Chlamydia

I wonder how many other things in life go better with a BAC of .129 and .139. I guess It is time to get out the party breath-a-lizer and do some experiments.

XKCD: Balmer Peak

Decius wrote:

She's extremely lucky she followed the instructions or deadly force would have been used," Pare told The Associated Press. "And she's lucky to be in a cell as opposed to the morgue."

The quote above is a Massachusetts State Police Officer publicly threatening to murder an MIT student who accidentally showed up at the airport wearing an electronic art project. She has, yet again, been charged with carrying out a hoax. Remember kids, anytime a Massachusetts police officer is confused, its your fault for confusing them, and not theirs for being fucking stupid and paranoid, and you are likely to go to prison or worse if it happens.

Why does Boston hate LEDs?

RE: MIT student arrested for entering Boston airport with art project

This is right after they got in on in the middle of the lobby. But seriously Summercon was and absolute blast. Best con about man on man action I have ever attended :)

Summercon: The shame will never go away.

Summercon 2007

Bing bang bing bong bing!

YouTube - Korki Buchek - Bing Bang Song

I know this is a bullshit post, but do you think cases like this could be used as legal precedent for others to escape conviction of DUI, drug possession, etc?

LINDSAY WILL NOT BE CHARGED - What Would Tyler Durden Do

It looks like the world's highest production cost car show, Top Gear, is coming to America. BBC America that is. That's right -- Jeremy Clarkson, Richard Hammond, and James May won't just be stopping by to hoon around a bit like they did last time, instead it looks as though they'll be coming stateside to a local cable operator near you -- at least according to the BBC America site. They're showing off air times starting on August 20th with "Episode 1."

I can't wait!

Top Gear: Top Gear UK Is Coming To BBC America!

A Minnesota man accused of drunk driving has sued to see the source code of the Intoxilyzer 5000EN machine that busted him, and the state Supreme Court is allowing the request to go forward.

His attorney told the paper, "The problem is, the manufacturer of the thing thinks they can hold it back and not tell anybody how it works. For all we know, it's a random number generator."

If they’re going to be accused based on what some machine says, then they ought to be allowed to challenge the accuracy of the machine. And they can't do that unless they’re allowed to know how the machine works.

Who is doing the QA work for these state certification programs?

What if the machine was off by a 100th of a BAC measurement? I applaud this effort, even if it is just a slick way to get out of a DUI.

Demanding the source code for the Intoxilyzer 5000EN