Security

Articles about Security on omid.dev — guides, topics, and notes from the field.

Spam

Published: January 13, 2009 Reading time: 1 min

Spam is any kind of unwanted online communication. Common types of spam The most common form is unwanted e-mail. You can also get: Text message spam — sometimes called smishing Instant message spam — sometimes known as spim Social networking spam Harmless vs. dangerous spam Some spam is annoying but harmless. However, some spam is part of an identity theft scam or another kind of fraud. Identity theft spam is often called a phishing scam. ...

Continue Reading

What to do if you've responded to a phishing scam

Published: January 13, 2009 Reading time: 2 min

If you suspect that you’ve responded to a phishing scam with personal or financial information, take these steps to minimize any damage. Step 1: Report the incident Contact the following authorities: Your credit card company, if you have given your credit card information. The sooner an organization knows your account may have been compromised, the easier it will be for them to help protect you. The company that you believe was forged. Remember to contact the organization directly, not through the e-mail message you received. In the United States, report identity theft at IdentityTheft.gov and file a fraud report at ReportFraud.ftc.gov. You can also report the phishing scam to the Anti-Phishing Working Group by forwarding the phishing e-mail message as an attachment to [email protected]. ...

Continue Reading

OllyDbg and Learning Reverse Engineering Safely

Published: October 17, 2008 Reading time: 3 min

If Sysinternals shows you what is running, OllyDbg shows you what a program is thinking — one x86 instruction at a time. In 2008 it is the standard debugger for 32-bit Windows binaries: unpack a crackme, trace a malware sample in a lab, or understand why an installer behaves oddly when the vendor will not answer support calls. OllyDbg 1.10 is the version most people use. It is freeware, debugger-only (no disassembler license debates), and extensible with plugins. ...

Continue Reading

Google Chrome — A Fresh Browser Engine

Published: September 3, 2008 Reading time: 3 min

Google Chrome arrived yesterday as a Windows beta with a comic explaining multi-process tabs and a reputation for speed. Another browser is the last thing some people wanted. For web developers and security folks, it is a big signal: the rendering engine wars are back. Mac and Linux versions do not exist yet. This is a Windows-only beta — but the design choices are worth studying regardless of platform. What Is Different Separate processes per tab — one crash does not take down everything Sandboxing ambitions — harder for web content to touch the system V8 JavaScript engine — fast enough to change how web apps feel in the browser Minimal UI — the address bar doubles as search, fitting Google’s habits Incognito mode — private browsing without digging through menus Silent auto-update — patches ship without a user-facing version bump Chrome uses WebKit for rendering — the same engine family as Safari — with Google’s own V8 replacing JavaScriptCore for script execution. ...

Continue Reading

Windows Vista Launch, UAC, and the First Month

Published: February 14, 2007 Reading time: 3 min

Windows Vista launched to retail on January 30, and the usual mix of excitement and complaint followed immediately. Retail boxes promise security, search, and Aero glass. Forums fill with UAC prompt screenshots, driver complaints, and games that stutter on borderline hardware. Two weeks in, both sides look partly right. What Vista Gets Right User Account Control pushes installers toward proper permissions — even if users click Yes too often Windows Defender bundles baseline anti-spyware awareness BitLocker matters on business laptops with TPM chips (less on home PCs without it) Improved networking UI helps non-experts join Wi-Fi without breaking DNS Windows Search indexes documents faster than XP’s slow companion ReadyBoost offers a flash-drive speed boost on RAM-starved machines — modest, but noticeable What Frustrates People Prompt fatigue — UAC trains some users to click through everything without reading Performance on 512 MB–1 GB RAM systems feels sluggish compared to XP Driver hunting for printers, scanners, and older peripherals Games needing patches before they match XP smoothness Edition confusion — Home Basic, Home Premium, Business, Ultimate — each with different feature sets The “Vista Capable” vs “Vista Premium Ready” sticker mess does not help. Machines that can run Vista often cannot run Aero, and buyers feel misled. ...

Continue Reading

Sysinternals Suite for Windows Troubleshooting

Published: November 8, 2006 Reading time: 3 min

When a Windows PC feels slow, popup-heavy, or “haunted,” Task Manager is not enough. The Sysinternals Suite from Mark Russinovich answers the question power users actually have: what is running, why, and who started it? Microsoft acquired Sysinternals in July 2006, but the tools remain free, still updated, and still the first thing I reach for on a troubled machine. Process Explorer: Task Manager with X-Ray Vision Process Explorer shows: ...

Continue Reading

WMF Exploit and the Zero-Day Patch Rush

Published: February 2, 2006 Reading time: 3 min

Early 2006 delivered a rude reminder: a picture was not always safe. A flaw in how Windows handles WMF (Windows Metafile) images allows attackers to run code through crafted files — sometimes simply by viewing them in a browser, image viewer, or Explorer preview pane. It is a classic zero-day moment: exploit code is circulating while users wait for an official fix. Why This Feels Different Previous worms often needed obvious .exe attachments. The WMF issue blurs the line: ...

Continue Reading

Internet Explorer 7 — Tabs, Finally

Published: January 24, 2006 Reading time: 3 min

Internet Explorer 6 has dominated Windows desktops for years — and for years, users have asked for tabbed browsing. Firefox and Opera shipped tabs long ago. Microsoft showed IE7 briefly in beta form last July, and the public Beta 2 Preview is expected within days. If you maintain websites or support family PCs, this is the moment to pay attention. What Microsoft Is Promising Based on beta builds and public statements, IE7 is shaping up as a real course correction: ...

Continue Reading

Sony BMG Rootkit and Why Trust Matters

Published: August 3, 2005 Reading time: 3 min

Music labels are fighting piracy with software, not just lawyers. Sony BMG and other majors now ship copy-protected CDs that install player software, limit ripping, and sometimes phone home to verify licenses. The packaging rarely explains what happens when you insert the disc into a Windows PC. That should worry anyone who manages desktops — including your own. Autorun Is the Real Entry Point Most of the friction starts with Autorun. Insert a CD, and Windows offers to launch an installer — often a custom media player with DRM components. Users click OK because the dialog looks official and the CD came from a retail shelf, not a download site. ...

Continue Reading

Sandboxie for Testing Software You Do Not Trust

Published: May 18, 2005 Reading time: 3 min

Every power user eventually downloads something questionable: a codec pack from a forum signature, a “speed up your PC” utility, an installer from a mirror you do not fully trust, or shareware from an old CD-ROM whose publisher disappeared years ago. In 2005, full virtual machines are possible — Microsoft Virtual PC and VMware both exist — but they are heavy on typical hardware. A Pentium 4 with 512 MB RAM struggles to run a guest OS smoothly while you also browse and download. Sandboxie offers a lighter idea: run the program in a disposable sandbox and throw the changes away if things go wrong. ...

Continue Reading