Drop Everything and Patch Symantec Mail Security for SMTP

Running Symantec Mail Security for SMTP? Stop what you're doing and download the patch (patch 176 at the time or writing).

Seems like a craftily-crafted incoming message can cause a buffer overrun. This may lead to code execution. [Update: Symantec now confirms that they see no chance of arbitrary code execution, merely denial of service.]

Currently being exploited. The code in question tries to infiltrate a Microsoft SQL Server, presumably in order to steal passwords. Another good reason to segment your servers so that they each have a single role; perhaps using virtualization.

Of course, a patch for this bug has been available for eight months, but that doesn't seem to have stopped exploits causing some trouble over at Turner Broadcasting System.

So run: don't walk. More at US-CERT.

Why You Shouldn't Buy from Spammers

Aside from the obvious ("because it only encourages them"), the U.S. Food And Drug Administration offers another, more worrying reason:

A number of Americans who placed orders for specific drug products over the Internet (Ambien, Xanax, Lexapro, and Ativan), instead received a product that ... can cause muscle stiffness and spasms, agitation, and sedation ... Preliminary analysis indicates they contain haloperidol, the active ingredient in a prescription drug used primarily to treat schizophrenia.

Ouch. No surprise here: spammers are Bad People. Lest we forget, spam isn't merely an productivity-sucking irritant.

I'm indebted to the FDA for providing the following photos and captions. More at the FDA site.

Back photo of yellow Haloperidol with “H 2” imprinted on the tablet.

Front photo of yellow Haloperidol with “Janssen” imprinted on the tablet

Plastic bag containing yellow Haloperidol tablets as received by consumers

Mailing envelope in which tablets were shipped to consumers

Mailing envelope in which tablets were shipped; yellow tablets, and the clear plastic bag in which they were contained. The ruler was placed for size comparison purposes

Mailing envelope in which the tablets were shipped to consumers. The ruler was placed for size comparison purposes.

White Haloperidol in blister pack

Yellow Haloperidol in blister pack

Normal Service Will Be Resumed ASAP

So a big sarcastic thanks to my now-ex-hosting company, who decided I was about to run out of bandwidth, but didn't bother to, you know, tell me or anything. If you noticed an odd "free host" banner recently, that's why.

Anyway, panic over. I've now moved to Surpass Hosting. If you're quick, you can get the same deal I did: $1 hosting for a year. There's also deals on reseller plans and dedicated plans.

The RSA Show Floor is Awful

I was going to rant about how boring/racist/sexist/infuriating the RSA expo floor is, but Ross Brown already did it for me. So... what he said:

'Dancing baloney' marketing ... demeaning use of booth babes, vaguely jingoistic references to fictional eastern European countries like Hackistan ... the vast majority of messages were identical. Differentiation is hard in security ... but wow, some of these booths were phoning it in from a content standpoint.

Update to the Dark Reading Spam Saga

Dark Reading/Light Reading/TechWeb responded publicly in its forum about my accusation that it's sending spam:

hi folks,
chris williams here (i'm the web development manager for Dark Reading). i disagree about whether or not requiring "opt-out" should be considered spam. i think that if an entity makes clear in its policies that it will be contacting folks, but makes it very clear how to opt-out of that contact in each email, then that's not spam. it's just a reality of web-based business that email is still the best way to promote online events and products. i agree totally that there are lots of companies trying hard to trick you into getting on a list, then multiplying that list, and making it really hard for you to remove yourself from any of those lists.

however, we aren't doing that. we've tried since day one to be very responsive and to make it easy for folks to remove themselves from all of our lists. i'm being totally honest when i say that we didn't intend to omit lists from the preferences page to make it hard for folks to remove themselves... we just thought we'd made it easier for folks to get off those lists by including a link in every email to a page that removes a person from the specific list they referenced and tells them if they are subscribed to any other lists that we manage (and gives them a chance to unsubscribe from all of those lists right then).

i think you guys have made a great point about the lack of clarity on our preferences page about how to get off our promotional lists. so i've updated the preferences page to include those lists and allow users to remove themselves from those lists via the form just like regular newsletter subscriptions.

thanks for reading and posting,
chris

To which I replied:

Chris, bravo for fixing the problem.

However, the admission that you intended people who unchecked every box to still receive promotional email leaves a nasty taste. As does the incorrect privacy policy. As does the sneaky positioning of the final default-opt-in checkbox.

Let me be very clear, direct marketers such as LR/DR/TechWeb are not the enemy -- "real" spammers who steal millions of addresses and misuse others' computing resources are the enemy. The problem comes when well-meaning people act like spammers.