Stupid ‘Ph’ Neologisms Considered Harmful

Words: ‘Pharming’. I recently came across this line in a discussion document:

‘Wait, isn’t this exactly the kind of attack pharmers mount?’

I was under the impression that ‘pharming’ was a transgenics term: ‘In pharming, … genetically modified (transgenic) animals are
mostly used to make human proteins that have medicinal value. The protein encoded by the transgene is secreted into the animal’s milk, eggs or blood, and then collected and purified. Livestock such as cattle, sheep, goats, chickens, rabbits and pigs have already been modified in this way to produce several useful proteins and drugs.’

Obviously this wasn’t what was being referred to. So I got googling. It appears the sales and marketing community of various security/filtering/etc. companies, have been getting all het up about various phishing-related dangers.

The earliest article I could find was this — GCN: Is a new ID theft scam in the wings? (2005-01-14):

”Pharming is a next-generation phishing attack,’ said Scott Chasin, CTO of MX Logic. ‘Pharming is a malicious Web redirect,’ in which a person trying to reach a legitimate commercial site is sent to the phony site without his knowledge. ‘We don’t have any hard evidence that pharming is happening yet,’ Chasin said. ‘What we do know is that all the ingredients to make it happen are in place.’

Oooh scary! The article is short on technical detail (but long on scary), but I think he’s talking about DNS cache poisoning, whereby an attacker implants incorrect data in the victim’s DNS cache, to cause them to visit the wrong IP address when they resolve a name. This Wired article (2005-03-14) seems to confirm this.

But wait! Another meaning is offered by Green Armor Solutions, who use the term to talk about the Panix and Hushmail domain hijacks, where an attacker social-engineered domain transfers from their registrars. There’s no date on the page, but it appears to be post-March 2005.

Finally, yet another meaning is offered in this article at CSO Online: How Can We Stop Phishing and Pharming Scams? (May 2005): ‘The Computing Technology Industry Association has reported that pharming occurrences are up for the third straight year.’ What?! Call Scott Chasin!

Steady on — it appears that the ‘pharming’ CSO Online is talking about, has devolved to the stage where it’s simply a pop-up window that attempts to emulate a legit site’s input — no DNS trickery involved. (This trick has, indeed, been used in phish for years.)

So right there we have three different meanings for ‘pharming’, or four if you count the biotech one.

It may be impossible to get the marketeers to stop referring to ‘pharming’. But please, if you’re a techie, don’t use that term, it’s lack of clarity renders it useless. Anyway, the biotech people were there first, by several years…

Tags: , , , , , , , , , ,

Comments

Witty’s 110 seed hosts

Security: good ;login: preprint article on the ‘Witty’ worm. ‘Conclusion: Witty represents a new generation of malcode: written by a motivated, skilled, and malicious individual. Witty’s author is the first to combine both skill and substantial malice. The author had some motive which lead, for him, to desire a destructive effect. Witty was written by an expert and, unless caught, he could do it again.’

However, there’s one point where I think the authors have slipped up:

The use of previously compromised machines (for seeding) requires that the attacker either obtained access on 110 machines using a different tool, already had access to 110 machines, or took control of these machines from a third party. Thus Witty’s author probably possessed some ties to the attacker underground, to gain these machines in the short timeframe.

IMO, that’s not necessarily the case. Given that current estimates are that 80% of spam emanates via open proxies, and that those in turn are generally insecure machines that have been taken over, I would surmise that someone with access to a reasonable amount of spam and an off-the-shelf Windows vulnerability scanner could quickly amass 110 machines to launch the attack with — simply by scanning for the vulnerabilities those machines were r00ted with in the first place.

Good article otherwise, though…

Tags: , , , , , , , , , ,

Comments

for posterity: the FormMail advisory

Myself and Ronald F. Guilmette co-wrote an advisory on vulnerabilities in FormMail. Here it is, archived from RFG’s bugtraq posting:

Anonymous Mail Forwarding Vulnerabilities in FormMail 1.9

By manipulating inputs to the FormMail CGI script, remote users may abuse the functionality provided by FormMail to cause the local mail server on the same (web) server system to send arbi- trary e-mail messages to arbitrary e-mail destination addresses. Such e-mail messages may contain real or forged sender e-mail addresses (in the From: headers) entirely of the attacker’s choosing. In some cases, the envelope sender addresses of such messages may also be set to arbitrary values by the attacker.

I helped with a few cases where FormMail is vulnerable here, namely the injection of newlines attack.

When this came out, I was in Australia, packing in preparation for a month-long camping trip around Victoria ;) The Lake Catani campsite at Mount Buffalo was amazing. (whoa, compare that page with this e-commerce monstrosity — urgh)

Tags: , , , , , , , , ,

Comments

(Untitled)

Signature FoRK Debate Moves — a list of cut-out-and-keep debating tactics for mailing lists, featuring such tried-and-trusted feints and lunges as the Old Post Resurrection Embarrassment, The Link Slam (my favourite), and the truly beautiful to behold Tom Whore.

Date: Sat, 02 Jun 2001 04:06:49 -0500
From: Jeff Bone (spam-protected)
To: (spam-protected)
Subject: Signature FoRK Debate Moves

(In memory of CobraBoy… Humor Ark Ark?)

So much as I hate to say it, FoRK is pretty analogous to the WWF in many ways. As such, it too has its signature moves. In deconstructing the recent rambles and pondering the Debate-O-Matic ideas that have been tossed about, it occurred to me that it might be worthwhile to document some of those signature moves. Here’s a rough cut. (Before anybody starts yelling, let me acknowledge that I indulge in almost all if not every one of these myself on a regular basis. This isn’t (hypo)criticism, it’s reflection.)

The Character Assassination

The Character Assassination is a classic maneuver with a fairly self-explanatory name. Rather than attacking the point of argument itself, the attacker seeks to undermine the defendant his/herself. This is done in a variety of ways, yielding variations that are each themselves worthy of study. The general character assassination attack can take two modes: direct and indirect. In the direct attack, the attacker draws directly from the surrounding debate context in order to build material — relevant or not — which is positioned to undermine the defendant’s credibility, and therefore weaken their position. In the indirect attack, the attacker uses context outside of the debate itself to executive the move.

The Stereotype Assassination

The Stereotype Assassination is a variation on the Character Assassination. In it, the attacker seeks to draw parallels — real or otherwise — between the defendant’s position and a tendency to unthinkingly buy into stereotypes. Because we all “know” that stereotypes are over generalizations, narrow-minded, and generally “wrong” the attacker is able to undermine the defendant’s credibility and therefore their position without addressing specific issues at all. The stereotype maneuver is ironic in nature; the attacker is usually utilizing unfounded generalization from the defendant’s actual argument in order to paint the defendant as engaging in stereotyped thinking.

The Category Assassination

The Category Assassination is in many respects the ironic complement of the Stereotype Assassination. In this move, the attacker builds the perception in the audience’s mind that the defendant belongs to some particular category, and then makes the assertion that the category in question has some particular stereotyped mindset / behavior / what have you; by having such behavior, the attacker asserts, the defendant cannot possibly have a position of merit -wrt- the current debate.

The Context Stomp

The Context Stomp is a cheap but effective maneuver. In it, the attacker intentionally misrepresents something the defendant asserted, taking a particular point out of context and flaying the hell out of it. Doing so may or may not detract from the defendant’s position, but it certainly distracts. The defendant is put on the defensive, and must clean up the situation before proceeding to prosecute his or her point.

The Level Lunge

The Level Lunge is another distraction maneuver. The attacker seeks to gain points by plummeting down the metalevel ladder; first, the meta-argument is attacked, and then the meta-meta-argument, and so on. This is a good maneuver to engage when the attacker is on the outs, losing the fight, as it can force a stalemate. (A successful Level Lunge resulting in a stalemate is referred to a Stack Overflow Termination.)

The Slight-Of-Hand Strawman

In the Slight-Of-Hand Strawman, the attacker directly engages the defendant’s arguments, but during the process subtly shifts the point. After doing this long enough, the attacker has constructed a weak strawman which is quickly knocked down for the kill. The SOHS is widely regarded as a cheap maneuver not worthy of FoRK. In past lives though not on FoRK, Gojomo has been known to be a skillful master of this maneuver.

The Zecious Zero

In the Zecious Zero, the attacker tediously constructs an apparently logical framework, states that it is formally correct and any disagreement must therefore be merely a definitional / semantic matter, and vigorously defends the formal framework. It should be noted that in most cases the framework constructed is “zecious” in the extreme; while having the appearance of a very detailed formal framework, it is usually internally inconsistent. Only the complexity of the framework hides the inconsistency. (Kudos to Gordon Mohr for coining the term “zecious.”)

The Extrapolation Explosion

The Extrapolation Explosion is a combo Context Stomp / SOHS special. In it, the attacker puts together multiple iterative context stomps and SOHSes in one post, extrapolating from the current debate, until the defendant’s argument is so grossly distorted that it cannot maintain its integrity. This move is extremely hard to defend against; in this regard, it resembles the Level Lunge in that attempting to counter usually results in Stack Overflow Termination.

The Insinuendo

The Insinuendo is not an attack per se, rather a feint. It is a mild and subtle CA move which is not intended to score but rather to disorient the defendant and plant the seeds of doubt in the minds of the audience. When executed correctly, it can be very effective; however, FoRK isn’t a particularly subtle place, so we don’t even see this one attempted very often.

The Jane-You-Ignorant-Slut

The JYIS is an Insinuendo without the subtlety. It is almost entirely ineffective in either disorienting the defendant or in seeding doubt among the audience, but it does have one beneficial effect. When executed well, it demonstrates the attacker’s superb sense of humor and comedic timing, and therefore scores points *for* the attacker without actually taking them away from the defendant. FoRK tends to see JYIS at the tail end of threads collapsing into rhetorical holes, which is unfortunate; it’s a beautiful maneuver, but worthless in such a situation.

The Mortar Lob

The Mortar Lob is the Hail Mary of our moves. It involves drastically changing the topic mid-thread, making an extreme shift towards some position entirely unrelated, and firing away. It is usually a last ditch effort employed as a defensive conversion maneuver when one is on the way out. The Mortar Lob almost never works, but if you don’t try it, you’re a pussy.

The Loaded Word Gambit

In this move, the attacker loads the argument up with words which carry significant emotional baggage and implication. By appealing to the knee-jerk interpretations of these words, the attacker seeks to gain the advantage. The Loaded Word Gambit is almost never effective, and often results in the Semantic-Spiral-Of-Death.

The Semantic Death Spiral

This maneuver is often used in either of two contexts. It is often engaged when both positions are rhetorically strong, or when the rhetorical frameworks employed cannot be meshed at all. It’s an endless recursion of definitional arguments, with each combatant seeking to co-opt the other’s argument by defining away any disagreement. The Faith Thread is a good recent example of a tag team SDS bout.

The Curse and Recurse

The Curse and Recurse is a disorienting attack in which the attacker gets all wiggy to throw the defendant off, pops the stack, then circles back around to resume the same attack sequence that didn’t work the first time around. This can go on forever unless it falls into some terminal sequence.

The Old Post Resurrection Embarrassment

In this attack, the attacker diligently — perhaps through a significant act of e-mail archaeology — seeks to undermine the opponent’s position. This attack can take a variety of forms. It is often used to illustrate some (potentially irrelevant) inconsistency between the defendant’s current position and some position adopted in a previous bout. It can also be used, as by Greg Bolcer recently, to illustrate the fundamental incorrectness of the defendant’s position by referring to a previous post made by somebody else. When deployed as the latter, this move is also known as The FoRK Historical Stupidity Attack. There is no effective defense against the Old Post Resurrection Nightmare, though the defendant may sometimes attempt the Teflon Don in retaliation.

The Drunken Master

The Drunken Master is a move intended to completely imbalance the attacker. It is often employed after a brief hiatus during which the attacker engages in some late night substance abuse; the attacker then blathers at top volume until the defendant is totally unbalanced, at which point the attacker attempts to close in for the kill. (And usually falls on his/her face in the process.) The Drunken Master always feels good at the time, but is usually regretted the next day.

The Pedantic Nightmare

The Pedantic Nightmare is the complement of the Semantic Death Spiral. In it, the argument is focused on its formal structure, without regard to semantics. The attacker seeks to use endlessly tedious formal reasoning in order to illustrate the inconsistency of the defendant. It is usually ineffective both through the attacker’s failure to prosecute it properly and the defendant’s unwillingness to let it happen.

The Dennis Miller

Also known as The Reference Roundhouse. In this move, the attacker attempts to co-opt credibility by dazzling the defendant and the audience with a barrage of not particularly relevant references, preferably obscure, usually nonauthoritative. The theory is that if the attacker has such a vast array of trivial knowledge at their disposal, surely they are therefore correct in their assertions. (I know, it doesn’t make sense, but that doesn’t stop us from trying it from time to time.) The Dennis Miller is often coupled with the Teflon Don when things go awry, which is pretty funny when you think about it. The Dennis Miller can be effective in the right context, and is almost always fun to watch.

The Vocab Blitz

The Vocab Blitz is another credibility co-opt maneuver intended to add punch to a particular attack. The Vocab Blitz involves maximizing the syllabic length of any and every possible word in a particular parry in order to demonstrate the attacker’s intelligence. Clearly, such a genius much be infallible. (Or so the thinking goes.) The Vocab Blitz is cheap and meaningless.

The Link Slam

The Link Slam is an attempt to shore up an attack by over reference. The theory is that clearly the attacker has researched the issue much more thoroughly than the defendant. Whether this is believed or not, this can be effective; it often sends the defendant on a fact chase, therefore distracting them enough for the attacker to make a finishing move.

The Psuedofact Slam

The Psuedofact Slam is like the Link Slam, but without the links. In this move, the attacker shores up their position with a seemingly limitless array of very specific sounding and potentially believable supporting “facts.” These “facts” need not and often do not have any factual basis whatsoever; the attacker need not even do a Google beforehand, as no attribution or support is provided. Only a diligent defender can effectively parry a Psuedofact Slam.

The SYGIGH

Also known as The Cartman, the Screw-You-Guys-Im-Going-Home is a defensive measure of last resort, effectively ending the bout without a victory condition. Pretty clear from its name what it consists of, the SYGIGH was most recently effectively employed by our own Strata in a debate with Yours Truly. The SYGIGH almost always results in a rematch, once the party who employs it decides a rematch is needed.

The False-Falling-On-Ones-Sword

This maneuver consists of the attacker feigning a conciliatory or self deprecating position, in an attempt to draw the attacker in and put them off guard. It is usually immediately followed up by some combo of the Slams, or even — particularly effectively — an Old Post Resurrection Embarrassment.

The Overpost Armageddon

The Overpost Armageddon is a massive blitz of sequential follow-up e-mails, each of which typically tears a single previous post apart line by line, employing various attacks. The goal of the Overpost Armageddon is to completely overwhelm the defendant, making it literally impossible for them to counter each attack. The author is periodically the reigning master of this particular maneuver, though in his case this is believed to be the result of some neuropsychological disorder such as TLE- or OCD-induced hypergraphia. The problem with this maneuver is that it usually leaves everyone involved — including the attacker — exhausted for days.

The Teflon Don

This is a particularly obnoxious defensive maneuver in which one eliminates all possibility of further damage simply by claiming that the positions taken, rhetorical style employed, formal structure, definitional correctness, or behavior in any way represent one’s own character, beliefs, etc. The Teflon Don is a terminal move, which cannot be countered, though it should be recognized for what it is: the king of all cop-outs.

The Consistency Spasm

The Consistency Spasm is a disorienting attack in which the attacker alternates between two obviously inconsistent positions in order to find maximum advantage from which to press further attacks. It’s not a pretty sight. Only the most steadfast defendant will hang in there instead of simply leaving the ring in disgust.

The Circular Thrash

The Circular Thrash employs single level circular “logic” in order to support the attacker’s position. It’s impossible to counter if undetected, but is a risky proposition: upon discovering a Circular Thrash, the defendant needs to merely cry out “Shenanigans!” in order to call the match and declare victory. If this is done, the attacker who attempted the Circular Thrash is usually surprised to find themselves standing alone in the center of the ring, calling out “Hey! I wasn’t done yet!”

The Running-To-The-Edges

The Running-To-The-Edges is a particularly sophisticated attack derived from both the Extrapolation Explosion and the Level Lunge. In it, the attacker immediately level jumps not with respect to the meta-argument level but rather to the maturity-of-argument level. In doing so, the attacker takes the defendant’s nascent and ill-defined condition and fires a barrage of edge cases at it which appear to contradict it. The conceit is that this invalidates the defendant’s admittedly general argument, by implying that the edge cases cannot be reconciled with the defendant’s position. Russell recently introduced this maneuver to FoRK, where it has enjoyed immediate popularity.

The TrapperKeeper

Named for the South Park terminator spoof episode, The TrapperKeeper is the most beautiful, elegant, and sought after of moves. In it, the attacker baits the defendant with arguments or assertions that the defendant should conditionally agree with. If the bait is successful, if the defendant “touches” the attacker’s TrapperKeeper, sharp spikes shoot out to impale the defendant. Unfortunately, the TrapperKeeper has to this author’s knowledge never been effectively executed on FoRK.

The Tom Whore

The only eponymous move in our repertoire, The Tom Whore is a joy to behold when executed properly. In it, the attacker becomes simultaneously so artfully obscure / obtuse that no retaliation is possible. The immediate effect is that the defendant is left looking rather dazed while picking the Speedo wedgie out of their ass crack.

Whew. Anyone have any additions or edits?

Your faithful servant,

Lucifr

http://xent.com/mailman/listinfo/fork

Tags: , , , , , , , , ,

Comments