Thursday, August 29, 2013

Windows 8 Update: Microsoft Windows 8 is not Ballmer's biggest regret

Also: Is Windows 8 TPM security an NSA back door?

Even though Windows 8 incited hordes to call for Microsoft CEO Steve Ballmer's ouster, the operating system is not what he regrets most about his 33-year tenure at the company.

That distinction falls to one of Microsoft’s other operating systems, Vista, according an interview with Ballmer by Mary Jo Foley on her All About Microsoft blog.

It could be argued that Windows 8 is as big a debacle as Vista. Windows 8’s underwhelming sales numbers in its first few months were compared unfavorably to those of Vista, which is generally considered to be Microsoft’s biggest OS flop. Ballmer perhaps hints in the interview that it’s the fact that Windows 8 is still within its first year that he’s giving it a pass so far, but it’s difficult to tell from the transcript.
Oh, you know, I've actually had a chance to make a lot of mistakes, and probably because, you know, people all want to focus in on period A, period B, but I would say probably the thing I regret most is the, what shall I call it, the loopedy-loo that we did that was sort of Longhorn to Vista.
— Steve Ballmer

Here’s his somewhat vague and rambling answer:

“Oh, you know, I've actually had a chance to make a lot of mistakes, and probably because, you know, people all want to focus in on period A, period B, but I would say probably the thing I regret most is the, what shall I call it, the loopedy-loo that we did that was sort of Longhorn to Vista. I would say that's probably the thing I regret most. And, you know, there are side effects of that when you tie up a big team to do something that doesn't prove out to be as valuable.”

TPM: Windows 8 security boon or boondoggle?

Microsoft has been boasting that its use of Trusted Platform Module (TPM) chips in certified Windows 8 devices is a security asset, but leaked German government documents warn it could be a security liability.

Even more dire, TPM could actually be a backdoor that would allow attackers – the leaked documents include the U.S. National Security Agency among them – to undermine the security of the devices entirely, the documents say.

Microsoft says this is nonsense, according to Die Zeit, the German publication that got hold of the documents and wrote about them.

According to Microsoft, using TPM makes it nearly impossible for root kits to infect machines successfully, thereby preventing a devastating type of attack. That’s why Windows 8 enables TPM security by default and links it to certificates signed by Microsoft itself.

It also gives users the option to use substitute certificates and bootloaders or to turn off TPM altogether.

The risk, according to the documents Die Zeit obtained from the German federal Office for Security Information, is that manufacturers place a master encryption key on TPM chips when they’re made. So if that key is somehow compromised, the security that flows from it is also compromised.


That possibility is remote, experts say, and would affect not only Windows 8 machines but any computers using TPM.

Since the initial Die Zeit story, the German security agency has backed off its recommendation that government and businesses avoid using Windows 8’s TPM capabilities.

Prices down, usage up for Surface RT

Since Microsoft has offered bargain deals on Surface RT tablets that run an ARM-specific version of Windows 8 use of the machines has blossomed, according to a blog on the Web site of AdDuplex.

The site gathered a day’s worth of data from 393 Windows 8 applications that run AdDuplex SDK and then figured out as best they could what device they were running on. “It is also worth noting that, since our stats are based on Windows Store apps, their definitely skewed in favor of Windows RT, tablets and other touch devices,” the blog says.

Here’s a chart of what they found out.

The blog compares the results to those gathered in April and finds that Surface RT represented 6.2% of Windows 8 devices in use then and represented 9.5% in August. Over that period Microsoft has offered special deals that deeply discount the Surface RT price.

New devices

The same blog drops in mention of what may be a new Surface model called Surface 2.

AdDuplex says that in reviewing its log information it comes up with thousands of model names for the devices it tracks.

“We don’t have any deep details but we regularly see devices named Microsoft Corporation Surface 2 and Microsoft Corporation Surface with Windows 8.1 Pro,” the blog says. “The first one definitely looks like a new device, but the second one theoretically could be just a change in what Surface Pro with Windows 8.1 installed reports.”

Windows 8.1 is RTM

The first major overhaul of Windows 8 is released to manufacturers, according to the Windows ITPro blog written by Paul Thurrott.

That means device makers have the code in hand so they can start making Windows 8.1 machines, which are due out in October.

Lenovo installs Start button app

Microsoft is restoring a start button to Windows 8 when it releases Windows 8.1, but that’s not good enough for Lenovo.

The major PC vendor plans to install Pokki software on its Windows 8 machines, a Bloomberg story says, attributing the news to the co-founder of SweekLabs, which makes Pokki.

Individual Windows 8 users who have bought Pokki on their own use it an average of 10 times per day, the company says.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com


Tuesday, August 20, 2013

"Jekyll" test attack sneaks through Apple App Store, wreaks havoc on iOS

Like a Transformer robot, Apple iOS app re-assembles itself into attacker

Acting like a software version of a Transformer robot, a malware test app sneaked through Apple’s review process disguised as a harmless app, and then re-assembled itself into an aggressive attacker even while running inside the iOS “sandbox” designed to isolate apps and data from each other.

The app, dubbed Jekyll, was helped by Apple’s review process. The malware designers, a research team from Georgia Institute of Technology’s Information Security Center (GTISC), were able to monitor their app during the review: they discovered Apple ran the app for only a few seconds, before ultimately approving it. That wasn’t anywhere near long enough to discover Jekyll’s deceitful nature.

RELATED: Malicious power-charger can infect Apple iOS devices

The name is a reference to the 1886 novella by Robert Louis Stevenson, called “The Strange Case of Dr Jekyll and Mr Hyde.” The story is about the two personalities within Dr. Henry Jekyll: one good, but the other, which manifests as Edward Hyde, deeply evil.

Jekyll’s design involves more than simply hiding the offending code under legitimate behaviors. Jekyll was designed to later re-arrange its components to create new functions that couldn’t have been detected by the app review. It also directed Apple’s default Safari browser to reach out for new malware from specific Websites created for that purpose.

“Our research shows that despite running inside the iOS sandbox, a Jekyll-based app can successfully perform many malicious tasks, such as posting tweets, taking photos, sending email and SMS, and even attacking other apps – all without the user’s knowledge,” says Tielei Wang, in a July 31 press release by Georgia Tech. http://www.gatech.edu/newsroom/release.html?nid=225501 Wang led the Jekyll development team at GTISC; also part of the team was Long Lu, a Stony Brook University security researcher.

Some blogs and technology sites picked up on the press release in early August. But wider awareness of Jekyll, and its implications, seems to have been sparked by an August 15 online story in the MIT Technology Review, by Dave Talbot, who interviewed Long Lu for a more detailed account.

Jekyll “even provided a way to magnify its effects, because it could direct Safari, Apple’s default browser, to a website with more malware,” Talbot wrote.

A form of Trojan Horse malware, the recreated Jekyll, once downloaded, reaches out to the attack designers for instructions. “The app did a phone-home when it was installed, asking for commands,” Lu explained. “This gave us the ability to generate new behavior of the logic of that app which was nonexistent when it was installed.”

Sandboxing is a fundamental tenet of secure operating systems, intended to insulate apps and their associated data from each other, and avoid the very attacks and activities that Jekyll was able to carry off. It’s also explicitly used as a technique for detecting malware by running code in a protected space where it can be automatically analyzed for traits indicative of a malicious activity. The problem is that attackers are well aware of sandboxing and are working to exploit existing blind spots. [See “Malware-detecting 'sandboxing' technology no silver bullet”]

“The Jekyll app was live for only a few minutes in March, and no innocent victims installed it, Lu says,” according to Talbot’s account. “During that brief time, the researchers installed it on their own Apple devices and attacked themselves, then withdrew the app before it could do real harm.”

“The message we want to deliver is that right now, the Apple review process is mostly doing a static analysis of the app, which we say is not sufficient because dynamically generated logic cannot be very easily seen,” Lu says.

The results of the new attack, in a paper titles “Jekyll on iOS: when benign apps become evil,” was scheduled to be presented in a talk last Friday at the 22nd Usenix Security Symposium, in Washington, D.C. The full paper is available online. In addition to Wang and Lu, the other co-authors are Kangjie Lu, Simon Chung, and Wenke Lee, all with Georgia Tech.

Apple spokesman Tom Neumayr said that Apple “some changes to its iOS mobile operating system in response to issues identified in the paper,” according to Talbot. “Neumayr would not comment on the app-review process.”

Oddly the same July 31 Georgia Tech press release that revealed Jekyll also revealed a second attack vector against iOS devices, via a custom built hardware device masquerading as a USB charger. Malware in the charger was injected into an iOS device. This exploit, presented at the recent Black Hat Conference, was widely covered (including by Network World’s Layer8 blog) while Jekyll was largely overlooked.


Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com


Wednesday, August 14, 2013

Microsoft to ship Windows 8.1 in mid-October

The OS update will show up on the Windows Store on Oct. 17 and in retail stores the next day

The much-anticipated update for Windows 8 will begin shipping on Oct. 17, delivering a set of changes that Microsoft hopes will calm critics and improve sales of the tablet-optimized OS.

Windows 8.1, previously known as Windows Blue, will be available as a free update for Windows 8 users via the Windows Store that day starting at 4 a.m. U.S. Pacific time. On Oct. 18, it will surface on retail stores and on new devices.

"It's very exciting to be delivering Windows 8.1 to consumers just before Windows 8 celebrates its 1-year anniversary. You can expect to read more from us on Windows 8.1 leading up to availability on October 18th," wrote Microsoft official Brandon LeBlanc in a blog post.

Microsoft did not mention when Windows 8.1 will ship to hardware manufacturers, the so-called RTM date.

Windows 8 shipped in late October of last year and was billed by Microsoft executives as one of the most important product launches in the company's history.

With its radically redesigned user interface optimized for tablets and other touchscreen devices, Windows 8 is Microsoft's attempt to improve the OS' dismal share in the tablet OS market currently dominated by Apple's iPad and Android devices.

But the Modern tile-based interface, modeled after the Windows Phone interface, has met with mixed reviews both among consumers and enterprises.

In fact, one of the main changes in Windows 8.1 is the addition of something very close to the Windows 7 Start button, whose removal in Windows 8 led to an outcry among users.

With Windows 8.1, Microsoft will also attempt to smooth the interaction between the new Modern interface and the more traditional Windows 7-like desktop which lets users run legacy applications. For example, it will be possible for users to boot directly to the traditional desktop interface.

Windows 8.1 will also let users view all the applications installed on their device and sort them by name, date installed, most used or category. Other enhancements include an improved search engine powered by Bing that will return results from a variety of sources, including the Web, applications, local files and the SkyDrive cloud storage service.

Windows 8.1 also adds options for seeing multiple applications on the screen simultaneously, including the ability to resize apps, for improved multitasking. Internet Explorer 11, a new version of Microsoft's browser, will also ship with Windows 8.1, featuring faster page loading and better performance in touchscreen mode, according to the company.

Windows 8.1 users will also be able to make a Skype call and take photos with the Windows 8.1 device while the screen is in Lock mode without having to log in. Users will also be able to select multiple applications at once and do bulk actions on them, like resizing, uninstalling and rearranging them.

"Certainly, this release is critical for Microsoft. But getting people to move to Windows 8 and thinking of the devices as tablets requires apps, and the lack of Office for 'Metro' is still a real problem," said Gartner analyst Michael Silver, referring to the Modern interface by its earlier Metro code name.

According to Silver, IE 11 will be the biggest inhibitor to migration to Windows 8.1 among businesses. "Organizations are having trouble getting past IE8; not as much trouble as they had getting past IE6, but enough to make them think twice about moving beyond Windows 7," Silver said.

Companies will also think twice about switching to Windows 8.1 because of the possibility that another major update with a new version of IE may be released next year, and then the equivalent of Windows 9 coming possibly a year after that, he said.

"Microsoft wants to move to this continuous cycle, but organizations don't trust Microsoft for application compatibility yet and aren't ready to embrace that cadence," Silver said.


Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com


Sunday, August 11, 2013

Dangerous Linux Trojan could be sign of things to come

RSA expert details "Hand of Thief" banking Trojan
Desktop Linux users accustomed to a relatively malware-free lifestyle should get more vigilant in the near future – a researcher at RSA has detailed the existence of the "Hand of Thief" Trojan, which specifically targets Linux.

According to cyber intelligence expert Limor Kessem, Hand of Thief operates a lot like similar malware that targets Windows machines – once installed, it steals information from web forms, even if they're using HTTPS, creates a backdoor access point into the infected machine, and attempts to block off access to anti-virus update servers, VMs, and other potential methods of detection.

Hand of Thief is currently being sold in “closed cybercrime communities” for $2,000, which includes free updates, writes Kessem. However, she adds, the upcoming addition of new web injection attack technology will push the price to $3,000, and introduce a $550 fee for major version updates.

“These prices coincide with those quoted by developers who released similar malware for the Windows OS, which would make Hand of Thief relatively priced way above market value considering the relatively small user base of Linux,” she notes.

Getting Linux computers infected in the first place, however, could be more problematic for would-be thieves – Kessem says the lack of exploits targeting Linux means that social engineering and email are the most likely attack vectors, citing a conversation with Hand of Thief's sales agent.

Kessem also says that growth in the number of desktop Linux users – prompted, in part, by the perceived insecurity of Windows – could potentially herald the arrival of more malware like Hand of Thief, as the number of possible targets grows.

Historically, desktop Linux users have been more or less isolated from the constant malware scares that plague Windows, which is at least partially a function of the fact that their numbers represent a tiny fraction of the Windows install base.

Users of Linux-based Android smartphones, however, have become increasingly tempting targets for computer crime – and with the aforementioned growth in desktop users, the number of threats may increase even further.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Wednesday, August 7, 2013

000-012: IBM Tivoli Usage and Accounting Manager V7.1 Implementation

QUESTION 1
A customer wants to collect usage information for various types of databases in their environment.
What are two database types for which a collector is provided with in the IBM Tivoli Usage and
Accounting Manager V7.1 Enterprise Collector Pack? (Choose two.)

A. DB2
B. mySQL
C. Informix
D. Oracle
E. Sybase

Answer: A,D


QUESTION 2
What must be downloaded and installed in the Integrated Solutions Console in order to create and
connect to the IBM Tivoli Usage and Accounting Manager V7.1 database?

A. WebSphere
B. database driver
C. Enterprise Edition Pack
D. Enterprise Collector Pack

Answer: B


QUESTION 3
When selecting a specific report per customer requirements, the Detail by Identifier report is
located in which report category?

A. Invoices
B. Resource Detail
C. Top Usage Reports
D. Variance Reports Code

Answer: B


QUESTION 4
On the Create a Report panel, how many rate codes may be selected for a Resource report?

A. six
B. five
C. four
D. eight

Answer: D


QUESTION 5
Which report provides the total charges by each level of the account code structure for the
paramenters selected?

A. Cost Trend
B. Top 10 by Rate Code
C. Detail by Multiple Identifiers
D. Account Total Invoice Report

Answer: D


QUESTION 6
To verify the installation and check sample collector data loads in Load Tracking, each load will be
composed of which files?

A. only Summary, Detail,Ident
B. only Summary, Detail,Ident, Rates
C. only Summary, Detail,Ident, Resource
D. Summary, Detail,Ident, Resource, Rates

Answer: A


LinuxMint 15 delivers smooth alternative to Ubuntu

Mint offers three versions, including a rolling update option targeted at developers

The crafters of the LinuxMint distro are in a ticklish position. Mint is based on Ubuntu, which in turn, is based on Debian, which in turn, has the moveable feast of the Linux kernel as its underpinning. All three have changed underneath LinuxMint, but LinuxMint 15 pulls off a new cut without missing a step (save a missing KDE version).

We found LinuxMint 15 to be smoother than the previous version, a bit heftier, yet more adept. What really intrigued us is a Debian version that's a rolling version, and although it's called LinuxMint 15, it's more like LinuxMintForever. It's also not a good choice for civilians for a number of reasons. There's also a skinny version, LinuxMint Xfce.

Gone in the primary edition are a few clunky apps, and we found waning support for older hardware, although few are likely to complain. We still need to download replacement apps, because some of the ones that are included continue to do weird tricks.

One example is the media app, brasero, which can't seem to burn standard CDs from ISOs the second time around on our test machines (Lenovo T520s and T530s), and sometimes can't burn the first ISO correctly. We replaced it with K3B, which is vastly better in our experience. But now we can burn USB flash drives without error or drama right from the initial startup as a “pendrive” USB device burner is included.

The sheer number of post-installation updates dropped dramatically, also to our liking, as a result of an update-sources change, as they now pull from the correct repositories consistently and the system of getting updates has been nicely revamped.

Linux Mint

As the downloadable LinuxMint 15 ISO files were more complete than before, update times went down.

There are three base versions, a primary download, Xfce, and LMDE.

 The primary default download contains Cinnamon 1.8 and Mate 1.6. We currently favor this version over the LMDE release for civilian use.
 LinuxMint 15 LMDE, based on comparatively raw Debian sources and older versions of Cinnamon and Mate, is a DebianForever version - a rolling update version. You can also choose the KDE version, which sits at LinuxMint (release level) 14, and not Olivia. There is no LinuxMint 15 server, smartphone, or tablet ports to ARM that we could find. Ubuntu and Debian both cover these alternate turfs.
 Xfce runs in under 500Mb of RAM and less than 5Gb of space, a lean-and-mean version. We have nothing that small anymore, but it's a cute VM.

The basic LinuxMint 15 download installed flawlessly in both our limited notebook test beds, but also as virtual machines under both Oracle VirtualBox, as well as VMware ESXi and Citrix XenServer.

It worked on EFI boot, handily replacing or sitting as a dualboot with a Windows 8 installation. It could also squeeze Windows 7 or 8 into a smaller size, and make then use its own partition, meaning dualboot through the famous Grub2 bootloader.

We were offered five partitions in this way, primary boots for LinuxMint 15 and Windows, recovery partitions for each, and also the Lenovo supplied wipe-it-all-back-to-factory partition, as well as two boot-time memtests. If you ignore it, it simply boots the first OS, in this case, LinuxMint.

We warn here that our Lenovo notebooks did all of the partitioning and installation using BIOS, rather than UEFI, as the Lenovo notebooks were supplied this way. If Windows 7 or 8 is supplied under UEFI settings, these must be turned off, currently. Hacks are available for some machines that have Windows UEFI boots that can allow altered system boots, but these seem to be on a machine-specific, BIOS-by-BIOS alteration.

While we applaud UEFI's master boot record/MBR isolation, we decry its implementation and difficulty for non-Windows systems integration.

LinuxMint still follows Ubuntu's underpinnings, which logs users as non-root sessions, with the initial user's password as the root password. We could envision an exploit coming one day that will pop through user-space this way; root and user need different passwords.

Linux Mint Debian Edition (LMDE)

The Debian community has traditionally not been poised towards civilian support, but LinuxMint 15 LMDE puts both adequate “clothing” and shoes onto Debian in a way that bridges the easy GUI, apps, and components of LinuxMint with Debian's more teutonic underpinnings.

This edition gets new code once a week, or more frequently, but is also of the testing rather than stable branch of code. It might be more stable more quickly, or perhaps not, but a Debian strength is (traditionally) very good QA.

What won't happen currently for LMDE users is support for EFI, or some modern BIOS. This means that installing LMDE might require older hardware, disabled BIOS settings, and might cause certain SSD schemes and combinations to not work -- but not be damaged in the attempt. GPT partitioned drives can be used -- if wiped first.

Unlike the mainstream version of Olivia, LMDE has older versions of Cinnamon and Mint. Although LinuxMint is underpinned by Ubuntu apps, libraries, and configurations, LMDE is not, and so app sources aren't as easily obtainable. It looks like LinuxMint. It quacks like LinuxMint. It is Debian like Olivia, but it lacks the Ubuntu guts.

Why would one use such a thing? Because it's clean and bereft of the add-ons Ubuntu uses as manifested by Olivia and other prior LinuxMint editions. It's in a way, like Xfde -- a distro that now wears LinuxMint apparel. Developers have a new baseline. Debian distribution fans have a distribution with unified pre-built apparel.

As the LinuxMint blog puts it, “The live installer is developed from scratch with Debian in mind. It’s configurable and it can be re-used by other Debian-based distributions. We noticed a lack in live technologies and in live Debian installers, so we’re happy to take the lead on this.” To these ends, developers and Debian fans will enjoy the changes.

We also acknowledge that this might allow LinuxMint to hedge its bet against the rapidly evolving changes that Canonical has made in Ubuntu's flavoring.

In Use

The mainstream Olivia version worked well, and allowed us to choose from optional drivers in a pick list that was easier than before, although none of the optional drivers (mostly poised towards graphic chipsets) were germane to our Lenovo notebooks and VM instances.

While installation was faster, we also had the benefit of easier GUI customization, as most components are now pre-loaded, such as themes, etc. Applets are available that can also be manifested as desktop “desklets”, the equivalent of widgets and the active squares found in the Windows 8 GUI.

Desktop backgrounds can now be active and display things like moving clouds, or the view from an airplane as desired, but for some, this amounts to CPU-chewing eye candy. Those with low eye candy sugar levels will enjoy the variety, however, and many of the themes arrive pre-packaged. Overall window management control has increased in small ways, as well.

Our HP printers worked the first time and without the need for further drama or configuration. The packaged drivers didn't give us an indication of the semi-permanent ink-low state of our printers, and did not out/bother us for using “counterfeit” cartridges, which pleased us. The Windows 7 drivers will complain about both.

Overall


This edition marks more polish for LinuxMint, as well as the edition of a likely developer favorite, LMDE. We found it more complete, and ready to do work than ever before, if with a few apps that we seem to habitually replace. The updates are smoothed, and it keeps up with competitive features like active desktop GUI elements.

It's Ubuntu underneath, but the resemblance on the surface is all but gone. The nice part: most of the apps that don't depend specifically on Ubuntu Unity will work, and the list of these apps seems to grow almost exponentially.

This is the Linux version we can hand to civilian friends/family with the fewest potential phone calls -- subject to the mysteries of UEFI boots and the lunacy of diffuse BIOS variations that make installation of non-Windows operating systems on modern notebooks a travesty.

MCTS Certification, MCITP Certification

Microsoft MCTS Certification, MCITP Certification and over 3000+
Exams with Life Time Access Membership at http://www.actualkey.com

Friday, August 2, 2013

Black Hat: How to create a massive DDoS botnet using cheap online ads

Black Hat: How to create a massive DDoS botnet using cheap online ads
JavaScript in online ads can zombify browsers to carry out denial of service attacks

Las Vegas -- The bad news is if you click on the wrong online ad, your browser can be immediately enlisted in a botnet carrying out a denial of service attack to take down Web sites.

The good news is that as soon as you move on to another Web site, the browser is released with no harm done, according to researchers who revealed the hack at the Black Hat security conference.

“Who’s problem is this?” says Jeremiah Grossman, CEO of White Hat Labs and one of the researchers. “Browsers? Ad networks? Who fixes this?”

GROWING THREAT: Shorter, higher-speed DDoS attacks on the rise, Arbor Networks says

MORE BLACK HAT: Top 20 hack-attack tools

QUIZ: Black Hat's most notorious incidents

The bot-herding scheme relies on the fact that when a browser connects to a Web site, the site has near-complete control of the browser for as long as it’s on that page. It can run code from HTML to JavaScript in the browser that can set off a whole string of possible attacks, he says.

In the case of creating an on-the-fly botnet, Grossman and his associate Matt Johansen placed JavaScript within ads that they placed on Web pages via an advertising network. They paid to have the ad garner a certain number of clicks. The cost of a million-browser botnet is about $150, he says.

The JavaScript made the hijacked browser make repeated requests to a target Web server in an effort to overwhelm it. For the test it was the researchers’ own Apache server hosted in the Amazon cloud.

Each browser could generate six HTML requests at a time due to a connection limit set in the browser in order to maintain performance and stability. If the JavaScript instructed that the browsers make FTP requests instead, the number jumps to 100 requests or more, Grossman says.

“To scale [the botnet] up you need to get a lot of browsers running it,” he says.

Adding arbitrary JavaScript to ads is easy to do and in the experience of the researchers wasn’t checked very closely by the ad network. To make it more convenient to change the malicious script, rather than placing the script itself in the ad, they put in the script source. That way they could alter the script on their own servers and have the changes picked up by the ad without having to deal with the ad network again, Johansen says.

The researchers paid the ad network to distribute their ad and within 18 hours it was generating 8.1 million requests to the server coming in fast enough to take it down. That was using HTTP requests six at a time without using the FTP bypass, Grossman says. Since the users whose browsers were enlisted to the botnet were unwitting, they didn’t want to make any changes to the browsers, he says.

The upside for attackers is that the botnet is random with no command-and-control server that defenders could take down. Grossman says he is uncertain whether it would be possible forensically to track down the ad at the center of such a botnet and ultimately track it to the individuals who bought the ad. “You could be tracked by who paid for the guilty ad,” he says.

Ad blockers that are used to speed up the loading of Web pages and make them less annoying to users could become a security tool if this technique catches on, Grossman says, but he didn’t have a way to stop such attacks. “We used the way the Web works and took down our own server,” he says.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com