What if ... ?

-


Imagine your computer gets a new type of malware that makes it download certain URLs every now and then. Imagine that software creates a special HTTP request with a fake "Referer:" header. Imagine that the purpose of that is to pretend that you are clicking on an advertising link. Imagine that the mentioned links are ads of porno sites. Imagine the software includes an engine to spread itself on your local network. Imagine your boss starts monitoring the employees network activities so you are caught red handed, at least apparently. Imagine that you are fired because of your alleged browsing activities.

Now stop imagining.

It might already happened to one of my clients and his colleague, both fired for the same reason (porn surfing at work) they claim it is wrong because they did not do that. I cannot tell you for sure because their former company is not interested in researching this matter any further.

However, neither the cookies nor the temporal internet files nor the URL patterns they allegedly browsed seemed to make any sense (even if you are a pr0n fanatic). This and the fact they claim they have never used the company laptop for such an activity suggests that the company might have rushed to a conclusion that could be wrong.

For the moment, the ball is on the judge's hands for my client. (But his laptop is not in my hands to further research this possibility). I'll be glad to hear from you in case you may have a clue about the existence of such a software (even if you authored it yourself).

Comments

Hiroshi Ikeda said…
In a quick search i get this from Google (I guess you are more steps from me, of course)
http://www.elmundo.es/navegante/2004/07/26/seguridad/1090835194.html

But the fact is, I've heard zombie software through Windows before. Maybe installing a system monitor (CPU activity, LAN activity,...) could provide a clue.

Despite the article mentioned above, the fact is so dificult to find a zombie example. It seems you need to have access to the laptop to make a more examination. Good luck to you and your friends.
9:56 am
misan said…
Thanks Hiroshi,

I've just thought other people on the Internet might have heard of a similar pattern before.

A few days ago a botnet targeted to commit fraud on Google's AdSense was reavealed on the news. However, as you point out you need to grab the offending computer to conduct a detailed study of the causes of such a behaviour.

Cheers,

Miguel
10:23 am
Post a Comment

Popular posts from this blog

VFD control with Arduino using RS485 link

-
Image
Variable Frequency Drives ( VFD ) allow the control of spindles so speed can accurately be controlled and a detailed acceleration profile for the spindle and reverse rotation can all be handled. In essence a VFD is an three phase inverter for three-phase AC motor. I am using a popular (I mean cheap) Chinese VFD and though the reference manual is not great, I could see there is a built-in RS-485 port. I usually control the start, stop and speed selection using the keyboard on the unit but I thought it will be more useful if I could control everything from the same Arduino is doing our CNC table control. Some cheap RS-485 off eBay and some lines of code later, I can start, stop and change the speed from an Arduino. What a cool thing to have! Some configuration of your VFD are needed before you can use it like that.  You need to set PD163=1 (I am using address 1 in the code). PD=164=1 (for setting serial to 9600bps) and PD165=0 (for using ASCII and 8N1 character format)
Read more

How to get sinusoidal s-curve for a stepper motor

-
Image
After some experimentation, and delving a bit into the math of motion, I realized there can be a significant difference on the motion of a machine by just making small changes. A common and popular approach to smooth one axis of motion is to use a trapezoidal speed pattern, where acceleration and deceleration are uniformly accelerated movements (aka constant acceleration motion) separated by a portion happening at cruising speed. The problem comes with the fact that, while that approach is simple to understand and to code, it does contain sudden changes in the acceleration, that show as spikes on the acceleration derivative, called jerk. These sudden changes in the acceleration translate into undesired vibration in our machines. Most of that can be eliminated by selecting a motion pattern that does not contain sudden changes of acceleration. If we chose a mathematical function for our speed whose second derivative is continuous, then we reduce system vibration quite a lot. One ma
Read more

Importing OpenSCAD designs into Onshape

-
Image
After using Onshape CAD software for a while I am really fond of it. So one natural thing to do, specially once they have released the Instructor's kit is to start using it in the classroom too. But one thing I was not so sure how to do was to use old designs I made using OpenSCAD. It does not mean I am completely quitting using OpenSCAD but suddenly I can see I can do assemblies in Onshape that will look quite nice for showing and documentation purposes if only I could easily import from OpenSCAD. I am glad to report that the route OpenSCAD --> FreeCAD --> Onshape worked brilliantly. Even more when a few tricks were applied. While some people suggest to import CSG files from OpenSCAD to FreeCAD, I have had more success by directly importing SCAD files into FreeCAD. One trick that worked well for me was to get rid of $fn references, so now circles become real circles (or cylinders) in FreeCAD. If a part keeps some $fn references then your cylinders or circles wi
Read more