After reading a hacker's blog,I feel it's so hard to be safe.

I've been playing with security softwares for about 3 years.Although I have not become an expert,I get some "common sense" at least.
I used to think my security combo were so powerful and it would be hard enough to break in.In (link removed) her blog,she showed several security flaws in RTD、MD、EQSecure etc.
A month ago,I found her blog from her post "Helpless and useless Diskshield" in Comodo's forum.
Well,maybe I'm just too naive to realize the real danger earlier.

 

Caution,on the link your providing my geswall just blocked an attack.

 

really?what kind of attack was it?

 

Hey,seriously!?

 

i click on the link but all is quiet heremy security is sleeping maybe,they work hard all day long

 

yea a big orange warning and blocked checking logs if I can make sense of them

 

Same. The page is full of chinese and some code, perhaps the code there triggers this alert of yours?

Some software react even to posted, non-harmful code.

 

Hmmm

The blog link returns for me this.........The page cannot be displayed


I wouldn't be so put off by any of that. The key is multiple security and with the right combination of certain security apps (including HIPS), it would be a difficult climb to pierce thru them all.

Malware makers, exploit investigators and the like commonly reverse engineer security programs of all sorts to surface limitations they can point to.

EASTER

 

I got an alert from OA about an activeX control to be loaded by this page. Maybe that's why.

 

I can not make sense of geswall logs,the only thing I see is a deny 3 messages to geswall serv.exe at around the time I clicked the link.The deny was imediate clicking the link.anyway I manged a second attempt on the link and captured it.

 

I'm using OA v3 free.It's quiet as usual.
BTW,I don't think it contains any malicious code except some in her post like lordpake said.

 

It appears to be a working proof-of-concept BSOD denial-of-service attack against MD, RTD, and EQS. It crashes my Vista + MD systems. I submitted my minidump to MD (Xiaolin) last week. I gather that the next release will include a fix.

Nick

 

Well my geswall is getting upset about it consistent.Man I love Geswall

 

I bet it is a FP of your GW.

 

better a false postive then a false negative if it was real and if a simulation of real attack then it did its job with out crashing.

 

I get this.

 

catroot dberr, difficult to say, could be windows internals thing
or maybe a attempt to manipulate catalog database.

If you really install a new language could be windows internal pepatch.

 

thanks Aigle somewhat different then what mine say but same results I guess.

 

Thanks systemJunkie,

 

Hi peter,

I searched her blog and links in her blog,found that she is security software
360safe's developer.Maybe the best in the team I think.Hence,I don't think her blog would contain malicious codes.
360safe is a popular security software in China at the moment.

 

easter do you use mvps host file?

 

that is bad,man sorry aout that,so is your malware defender updated already to defeat this kink of attack?

 

No harm done. I always image before I play. According to Xiaolin, the next release of MD (due to be released this month) will include a fix.

Nick

 

I'm a little bit curious. Can someone PM me the removed and probably innofensive link?