Remote Assistance service of Windows OS vulnerable to attack

Tuesday, July 19, 2005

Until a patch is issued, Microsoft recommends that users close or block TCP port 3389, the port opened when the Remote Assistance service of its Microsoft Windows operating system (OS) is enabled. The Remote Assistance feature is a service of the OS that allows Internet Technology administrators of corporate workgroups remote access to other desktops to perform maintenance and other configuration tasks from their own computer. It can also be used by on-line tech support sites. A support assistant can go into a user’s machine, if the service is enabled, and themself make changes directly to another person’s computer to resolve an issue.

To initialize the remote assistance feature, the user of the helper computer must first make a request of the user of the target computer. Compliance must be granted by the user of the target machine, which then fully opens the communication port of the target machine to the helper computer. The operator of the helper computer then has control of target computer to make changes at will. The user of the target machine can watch in a separate window the actions of the helper, and either party to the session can end it at any time.

In a telephone conversation with a Microsoft representative Tuesday, it was learned that work to develop a security patch is underway, but when it will be available is unclear. It was cited that a patch must work consistently across multiple platform versions of the OS.

The vulnerability, thought at first to affect only Windows XP SP2, is now believed to affect all current Windows editions, including Windows 2000, Windows XP SP1, Windows XP Professional x64, Windows Server 2003, Windows Server 2003 SP1, and Windows Server x64.

The Remote Desktop Protocol (RDP) is not enabled by default, however if the service is enabled, a Denial of Service attack could cause the OS to restart unexpectedly according to Microsoft, or experience buffer overflows according to Symantec. The RDP is enabled by default on Windows XP Media Center Edition.

Microsoft suggests users block TCP port 3389 (the port used by RDP) on their firewall, or disable Terminal Services or Remote Desktop if not required by the user. The remote desktop connections could also be secured using either Internet Protocol Security or a virtual private network connection until a patch is ready.

To disable Remote Assistance on a Windows XP Edition, the steps are:

1. click ‘Start’, right-click ‘My Computer’, select ‘Properties’
2. select ‘Remote’ tab on top of the ‘Systems Properties’ window, clear checkbox that says “Allow Remote Assistance invitations to be sent from this computer.”
3. click ‘Apply’ button

The group, Internet Storm Center, detected spikes in scanning for port 3389 beginning July 6. Larger numbers of systems scanned were reported on July 13. Crackers may be scanning for vulnerable machines, the group said.

“It’s a kernel vulnerability,” said VP of engineering for Symantec Alfred Huger, “so it will be difficult to exploit reliably. But he [the original discoverer] found the vulnerability with a commonly-used tool, so if he can find it, so can others. I don’t think it will turn it into a large-scale worm, but then, some kernel vulnerabilities have ended up as just that, like the Witty worm.”

[edit]

Sunday, March 27, 2005

After almost a decade off the air, the science fiction television series Doctor Who returned with new episodes to BBC airwaves on Saturday night, drawing a large audience.

Starring movie actor Christopher Eccleston, the ninth actor cast to play the Doctor, as the newly reincarnated Time Lord, the new series showed off a bigger budget with expensive special effects and a much darker — and sexier — tone. The new star and series got a blessing from actor Sylvester McCoy, who played the Doctor in the 1980s.

“I am very envious about not being in it. The writing is terrific and the toys they play with are much more sophisticated than they were in my day,” McCoy wrote in a column for BBC News. “My only criticism was about the TARDIS. It was far too clean. It needs to look a bit more battered and bruised as if it’s been through the odd asteroid or two,” he said.

The Doctor’s new sidekick is played by Billie Piper, whose marriage to Chris Evans ended during filming.

“We’re pleased so many people sat down as a family to watch the return of the Doctor,” a spokesperson said. Families apparently sat down in droves. Preliminary ratings figures show Who wooing 10.5 million viewers at its peak, or more than 44 percent of all television households in the United Kingdom, for the debut episode.

This made it the most-watched show of the evening, easily outpacing second-place Ant and Dec’s Saturday Night Takeaway on ITV, which attracted an average of 7.2 million households.

The series will run for another twelve episodes.

One of the longest-running dramas in British history, Doctor Who has been airing sporadically since its debut in 1963. Ironically, the series cancellation in 1989 was due to low ratings.

Saturday, February 5, 2005

On Saturday NATO and Afghan troops located the wreckage of the Kam Air Boeing 737 missing since Thursday.

Afghan interior ministry spokesman Latfullah Mashal announced the discovery. “The debris of the plane was found around 25 kilometers east of Kabul in a mountainous area called Band-e Ghazi.”

The jet had been enroute to Kabul from Herat when it was diverted due to heavy snow. The crew then sought clearance to land across the border in Peshawar, Pakistan before it lost contact with air control. 104 persons are reported to have been aboard, including 8 crew members; there are no signs of survivors reported.

The weather conditions have hampered search and rescue efforts. NATO-operated helicopters located the crash site. Afghan police and units from Afghanistan’s foreign peacekeeping force are investigating the scene of the crash, according to Mr. Mashal.

Friday, May 4, 2007

The Royal Canadian Mint (RCM) introduced two new products Thursday, one of which is claimed to be the world’s largest gold coin. The Gold Maple Leaf coin, made of 99.999% pure gold, weighs 100 kg and has a face value of CA$1 million. The other offering is a smaller one ounce (28 g) version.

The 100 kg coin is approximately 50 cm in diameter and about 3 cm thick. At 99.999% purity, the gold coins are amongst the purest in the bullion market.

Commenting on its impractical size, RCM President and CEO Ian E. Bennett indicated that the 100 kg coin was designed to draw attention to the mint. “The Royal Canadian Mint operates in a very competitive environment, which is especially true of the international gold bullion market,” said Bennett. “Our 100-kg and one ounce 99.999% pure gold bullion coins are an achievement which separates the RCM from a large field of competitors.”

Until RCM’s announcement on Thursday, the Austrian Mint held the record for the world’s largest gold coin when, in 2004, it unveiled a €100,000 denomination coin weighing 31 kg.

In the RCM news release, Canada’s government minister responsible for the Royal Canadian Mint, Lawrence Cannon, highlighted RCM’s history of producing minted products. “The Royal Canadian Mint has long been recognized as one of the most innovative in the world, with a tradition of technical perfection and superior craftsmanship,” said Cannon. “These new…coins now take Canada’s reputation in the gold bullion industry to an unprecedented level.”

The reverse, or tail side of the new Canadian coin features a maple leaf design, while the obverse, or head side bears the effigy of Her Majesty Queen Elizabeth II. Although the 100 kg coin has a face value of $1 million, it would cost approximately CA$2.6 million (or US$2.4 million) to purchase, based on the market value of gold. A limited quantity of the 100 kg coins will be available as a special order through the RCM.

Saturday, August 25, 2007

The Honourable Peter McGauran, Federal Minister for Agriculture, has issued a 72 hour Australia wide travel ban on all Equine horse species. The ban followed confirmation that 16 horses from two separate Sydney locations have been infected with Equine Influenza. This follows earlier restrictions placed on horses in New South Wales (NSW).

Mr McGauran said “There will be a 72-hour ban on all race meetings for both thoroughbreds and harness…”

“In addition there will be an order for standstill for all horses under licensed persons. Also, an appeal to all those with ponies, recreational horses or work horses not to leave their properties…”

Equine flu was first detected in a stallion at Eastern Creek Quarantine station after arriving from the northern hemisphere. There are 80 horses currently in quarantine at either Eastern Creek in New South Wales or at the Spotswood quarantine station in Victoria. These horses are thoroughbreds brought into Australia for the spring breeding season. Horses currently in quarantine are expected to be held for another 30 days.

The movement ban caused the cancellation of race meeting across the country, resulting in losses of tens of millions of dollars.

Equine flu is highly contagious though it is not infectious to humans, though skin, clothing and equipment can transmit the disease. Additional restrictions have been place on people and equipment in NSW with exclusion zones around the quarantine stations. Breaches of these restriction could result in fines of up to A$44,000 and/or imprisonment for up to 12 months.

The normally unrestricted travel of horses between Australia and New Zealand has been suspended and New Zealand authorities are checking all horses that have entered the country since the beginning of August.

Thursday, March 15, 2012

A third call for boycott and second boycott hit the German online travel agency Hotel Reservation Service (HRS) this week. After a recent boycott against HRS in Münsterland, a boycott in Bremerhaven was next and is soon to be followed by the next round in Bremerhaven starting in the middle of March.

Hotels in the city of Bremerhaven already have to pay a new “bed tax” to the state of Bremen of 2.14 euro per person per night, whilst HRS is trying to increase their commission payments for its service from thirteen to fifteen percent. Further criticism of HRS focused on a preferential treatment clause that denied hotels the right to offer better prices through any other booking channel. The European umbrella organization of the catering facilities HOTREC had already criticized this type of clause and similar contract clauses in May 2011 in a position paper.

Piet Rothe, hotel owner and second chairman of the German Hotel and Restaurant Association (DEHOGA) Bremerhaven, explained that in his hotels the boycott hat not decreased bookings, merely shifted their volume to other channels such as, for instance, booking.com, who would only ask for twelve percent commission.

Rüdiger Magowsky, manager of the boarding house in Jaich, confirmed the observation that the volume of bookings had not decreased.Martin Seiffert, manager of the hotel Haverkamp, explained HRS had denied his hotel access to the system because he participated in the boycott. The access has been restored but he is considering participation in the next round of the boycott anyway.

On February 15 the higher regional court of Düsseldorf had ordered HRS in a preliminary injunction not to enforce its preferential treatment clause. Already on February 10 the German Federal Cartel Office had admonished the company for violating §§ 1 and 20 of the German Act against Restraints of Competition.

Meanwhile Markus Luthe, the CEO of the German International Hotel Association (IHA), recommended establishing a “Hotelwiki” as a yellow pages directory of the hotel industry.

Tuesday, August 26, 2008

Large herd animals may have the ability to detect earth’s magnetic field, concluded scientists in Germany in a report published in this week’s Proceedings of the National Academy of Sciences after performing studies of cattle and deer grazing and sleeping patterns. The animals tended to face north-south oriented toward the earth’s magnetic poles. Hynek Burda of the University of Duisburg-Essen in Germany led the team that announced the unconfirmed study. Burda and his team gathered cattle data via analysis of Google Earth images.

The team originally intended to test for possible human magnetic field detection by studying the orientation of sleeping bags in outdoor campers, but it proved difficult to obtain data because humans usually slept under tents. Cattle were easier to observe, and 8,510 head of cattle at 308 locations demonstrated a strong tendency to align body orientation in accordance with the earth’s magnetic field. Other possible factors such as wind or sunlight direction did not supply a better explanation for the behavior.

To compare against a second large species, Burda and his team analyzed data on 2,974 deer studied through photography, direct observation, and snow imprints. The deer demonstrated a similar pattern. “I think the really amazing thing is that hunters and herdsmen and farmers didn’t notice it,” said Burda according to a National Public Radio report.

Other scientists found the results of the study intriguing. Peter August of the University of Rhode Island in Kingston, commented: “I was really amazed at the consistency with which they found north-facing cows and deer. It was really intriguing.” No independent study has yet confirmed the Duisburg-Essen team’s findings.

This is the first study that indicates magnetic field detection in large mammals. Burda’s previous research involves naked mole rats, a small blind mammal species whose behavior indicates an internal magnetic compass. According to a report by Jeremy Hsu at MSNBC, “Previous research has shown that animals such as birds, turtles and salmon migrate using a sense of magnetic direction, and small mammals such as rodents and one bat species also have a magnetic compass.”

Wednesday, November 8, 2006

As of 10:00 p.m EST November 8, 2006, the Democratic Party is projected to have gained control of both the United States House of Representatives and the United States Senate in the 2006 United States general elections. MSNBC projects that the Democrats now control 234 seats in the House of Representatives, 16 more seats than the 218 needed to control the House of Representatives as all 435 seats were up for election. In the Senate, where the balance of power is closer, one-third of all seats were up for grab. As of 10:00 p.m. EST, AP and Reuters were projecting that the Democrats had picked up all six seats they needed to retake the Senate, including the seats of incumbents Rick Santorum (Penn.), Lincoln Chafee (R.I.), Jim Talent (Missouri), Mike DeWine (Ohio), John Tester (Montana), and Jim Webb (VA). The Tester victory by less than 3,000 votes was projected at approximately 2 p.m. EST after the State of Montana announced the results of overnight recounts. Democrat Jim Webb has prevailed in that race by slightly more than 7,000 votes, though his opponent has not conceded and a recount may still occur.