ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

My bad! ZDNet actually was sending out spam!

By | January 19, 2009, 6:28pm PST

Summary: I must apologize to the bloggers over at Commtouch. It turns out a website hosted at ZDNet, partially retired in 2004, was the culprit. What did I learn from this, you may ask? Two things. I have to communicate more effectively with my IT staff, otherwise I will again claim we are doing something [...]

I must apologize to the bloggers over at Commtouch. It turns out a website hosted at ZDNet, partially retired in 2004, was the culprit.

What did I learn from this, you may ask? Two things.

  • I have to communicate more effectively with my IT staff, otherwise I will again claim we are doing something that we are not and vice-versa.
  • In situations where I am responsible for systems, I will vow to take more effective inventory of all attack surfaces and fully eliminate all those which are no longer needed for system operation, be it website, service, or server.

I am striking through my previous post, and leaving this one for eternity to prove I can and do eat humble pie.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Adam J. O'Donnell, Ph.D. is an R&D engineer who has focused on computer security since 2000.

Disclosure

Adam O'Donnell

Adam J. O’Donnell currently works for Cloudmark, a messaging security company whose clients include the majority of the Tier 1 customer-facing service providers as well as mobile carriers and social networks. He serves on the advisory committee for the SOURCE Security Conference, as well as several conference technical program committees. Many of his close friends work in the security industry, and he will disclose those relationships as he deems it necessary.

Biography

Adam O'Donnell

Adam J. O'Donnell, Ph.D. is an R&D engineer who has focused on computer security since 2000. He currently is the Director of Emerging Technologies at Cloudmark, a messaging security company located in San Francisco.

Adam early on mastered the art of writing in complete sentences, using both hands and one foot. Later, he learned to do so with each individually. After fourteen years of apprenticeship in the mist-covered hills of central Nepal, Dr. O'Donnell emerged an unparalleled digital warrior and in desperate need of a anti-fungal wash.

Approaching both life and enterprise security with the verve of a particular capuchin, he is respected the world over as an observer of all he sees. Adam's dry blade of analysis will sever the hard candy shell surrounding most technical security concepts, and significantly goo-ify the remaining so as to be consumable in small bites with sufficiently large servings of digestive aids. Just what the doctor ordered.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
16
Comments

Join the conversation!

Just In

RE: My bad! ZDNet actually was sending out spam!
birumut Updated - 4th May 2011
Well done! Thank you very much for professional templates and community edition
seslisohbet seslichat
0 Votes
+ -
Well Done
gotamd@... 19th Jan 2009
We all make mistakes. I think you handled this one well happy
0 Votes
+ -
More news, less blogs.
x21x 19th Jan 2009
Is there a news only section to this website anymore?

Why can't we goto myspace or facebook to read blogs like this? Pretty soon this site will be merged with TMZ or something... www.TMZD.net

I don't even think Mike Cox posts near as many messages as he used to... I have not seen one in a couple months.
0 Votes
+ -
Downward Spiral
Ludovit Updated - 20th Jan 2009
I agree totally ... as a whole, society seems to be migrating backwards when it comes to the quality of anything ...

Houses built two hundred years ago will be around a lot longer than the ones we build today ...

Sounds quality is taking huge steps backwards going from LP to CD, and now MP3s (eight track is better than MP3s)

Reliability of information was just that, reliable - because you had to state the book you read it in, and because books cost money, they were generally edited well, and well researched.

Blogs, well here's the greatest example of the downward spiral into the uneducated hell that is becoming our world ...

Now, instead of paying people trained to be unbiased, trained to just report the news, trained to research their facts, self edit their work, and hand it into an editor before it gets published for human consumption ... we get Blogging - rife with facts that can't be proven (and are NEVER cited - except by Roland P.), spelling that would get a failing grade, and opinions out the wazoo (who ever heard of an Opinionpaper) ... If we take the natural progression of all this, fifty years from now, everyone will think they know everything about anything, but in fact only know the opinion of someone else, and if asked to write it down will look something like this "Y I Thinq De Nets Gud" ...

Not even five years ago, ZDNet was a bunch of reporters, reporting truths and facts - no opinions wanted, or given (without stating it was an opinion). Now ... it takes me more time to verify what I've read in a blog than it does to read the blog ...

Basically, you take News for News, and Blogs with a grain of salt.

NOTE: I am not talking about all bloggers, some are actually reporters who moved into blogging as a means of survival .. and others just do a good job, but as a whole ...

Having said all this, kudos to Adam for fessing up and eating that mammoth portion of Humble Pie ...

Ludo
0 Votes
+ -
8 track better then mp3??? Ha.
Cayble 20th Jan 2009
I lived through the 8 track era. Completely. Nice try but get real.
0 Votes
+ -
I too owned an 8 Track ...
Ludovit 21st Jan 2009
While I do agree that 8 track sucked, digital sound has only one thing going for it quality wise - the quality of the sound will be the same on the first play as it will be on the millionth ... analog formats deteriorate, as do the devices that play them ...

However, from a pure sound quality viewpoint, analog sound sources will always be better than digital sound sources - why? Sampling.

When you are listening to analog audio on analog equipment, you are listening to 100% of the sound wave.

When you are listening to digital sound (mp3s and others - especially at 128bit - which is what most people listen at because of file size), you are only getting the number of spots that are being sampled of the sound wave - i.e. if you have a CD player that is 32x Sampling, that means that out of the over 1,000,000 spots capable of being sampled on the sound wave, you are only getting 32 - what's happening to the sound on the other 999,968 spots?

I do agree that I would much rather listen to a high quality MP3 than an 8-track, but from a purely technical view of the sounds capable of being reproduced, 8-track is better ... now if only they could have fixed the technical issues with the hardware ...:)

Ludo
0 Votes
+ -
mp3 quality
midenginedrift 21st Jan 2009
the MP3 compression algorithm is based on the human ear. Like frequencies we cannot hear. So it's not really that significant in terms of loss. Maybe the sound will sound less rich, but it's nothing you will be able to notice without really trying. I use 192+ Kbps anyway though...

But, 6000 mp3's (from 192 - 320) is much easier to store than 500 CD's (let's say 12 tracks per cd), which is easier to store than however many LP's will hold 6000 songs.

The benefits outweigh the drawbacks.
0 Votes
+ -
I agree ...
Ludovit Updated - 22nd Jan 2009
... with everything you said, but unfortunately there are other things in that extra sound we're missing ... like 3 dimensionality (if that's a word), and the "softness" of a song.

A good quality LP pressed on virgin vinyl played on a half decent stereo (and I don't mean Bang & Olufson) will give you more softness, more subtleties, and better Stereo breakdown than a CD or MP3 ever will - its inherent in the format.

I'm not poo-poo'ng mp3's, I just like to make sure people understand what it is they're listening to, and are fully aware of the sacrifices they are paying for the benefits they are getting.

I own about 150 LPs, 300 CDs, and over 25,000 MP3s ... I put on MP3s while I'm working, or having a party where Sounds Quality is not an issue, I listen to CD's for dinner parties or other gatherings that aren't so loud, and I listen to albums when I'm just sitting down to actually listen to music.

My Apologies to everyone for getting WAY off topic ...

Ludo
0 Votes
+ -
Netcraft....
JoeMama_z 19th Jan 2009
According to Netcraft ZDnet runs on Linux and Apache, that can't be, Linux is secure no matter what! zdnet and their FUD.
0 Votes
+ -
Commtouch Thanks you
rherson Updated - 20th Jan 2009
Adam,

Thanks for posting this correction, and for going to the trouble of striking through your previous post. I'm glad to see that you're reading the Commtouch blog, even if it annoys you sometimes. We'll try to temper our use of the word "exploit" in the future happy

Rebecca Herson
VP Marketing, Commtouch
0 Votes
+ -
Adam,

After 20 years of working in the computer industry, I now support Avionics systems directly related to overall 'Safety of Flight'. Although our system is quad-redundant, our constant focus is to ensure that our troubleshooting results have correlation to the observed malfunction, that mistakes don't occur during subsequent repair activity, and finally that the Operational Checks that we perform to re-certify the jet as Airworthy are followed to the letter.

To guard against human error, we employ a 2-man concept - one person/team performs the repair, and a second individual will come in, inspect the work, and then, when everyone agrees that the real fix is in, *both* individuals sign off the grounding writeup.

Given the above, as a senior team member who often provides this cross-checking inspection function (thereby taking ultimate responsibility for the repair) it is of critical important to me that I can trust not only what I can inspect directly, but also what I am told by the person who performed the repair, possibly covering many man-hours of troubleshooting & repair. ("Were you able to duplicate the failure at will prior to removing any parts? How many times did you run the Self-Test? Did the computer that you removed from the aircraft fail on the bench? Did the bench failure correlate to the malfunction observed by the pilot? Etc., etc)

What does all this have to do with you?

A: Here's how I tend to trust the person who I am inspecting, ordered from LOWEST to HIGHEST:

I) I've never worked with the person before, but they insist that they do perfect work and never make a mistake. (Unaware self-promoter)

II) I've never worked with the person before, but they demonstrate due diligence, and if they are uncertain about a step they don't try to hide the fact. (Ego-free Self-aware Craftsman)

III) Have worked with the person before, and they have demonstrated a perfect track record to date. (ie: Due-diligence, but they are still in the beginning phase of their career.)

IV) Have worked with the person before, and when they made a mistake, without hesitation they brought it fully out into the open, (even if they could have successfully hidden it) dissected it so that everyone else could fully understand how the mistake could be made, and even made sure that when new people joined the shop that they were brought up to speed on the mistake so that they would be less likely to repeat it. (Experienced, Seasoned, Avionics technician with requisite Personal Integrity.)

In all instances if I have to inspect/sign off someone else's repair, I prefer that it be a member of category IV. Even though I trust this individual, I will still ask all the same questions, with the same degree of focus, but that is what they want me to do, for under the 2-man concept, we win as a team, or lose as a team.

I cannot tell you how many times this approach has allowed us to catch a mistake before the aircraft was returned to service, including my own. I sleep well at night, but only because everyone I work with inspects my work just as carefully as I inspect theirs - every team member is expected to voice their concerns, irrespective of rank or seniority.

****

Congratulations, by your public admission of your mistake in such a way that others can learn from it you have proven yourself to be a Category IV individual in my book. You are a member of an exclusive group of people.

Great example for others -- Well done!

dbm
0 Votes
+ -
You category is incorrect.
jsargent 21st Jan 2009
Since you have never worked with this person before and he admitted his mistake. (He could also not cover it up.) I would put this in Categ II using your owm definition.
Personally I think that it's nice to know that he is honest and that ZDNet work hard to avoid such problems.
0 Votes
+ -
Good that you are honest, but if you want to be a "journalist"
give us news. What went wrong? How were you exploited?
How was your system sending spam? What can we do to
make sure the same thing doesn't happen to us?
Thanks
0 Votes
+ -
Congrats on being man enough to do the right thing. That is a rare quality these days. Keep up the good work.
0 Votes
+ -
I got a dozen or so
jred 21st Jan 2009
I thought you were just being spoofed happy
0 Votes
+ -
Nice! More detail would be good too
jgwinner 22nd Jan 2009
I like the way this was handled. Leaving the original Blog up but modified is a nice touch.

I would like to see more detail on exactly what the hole was, as long as it's not giving away a vulnerability (and it shouldn't!). We all make mistakes.

I got the 'Hacked by Chinese' red worm quite a while ago. Why? I knew the vulnerabilty affected the MS Indexing service. I wasn't using it. Well, it turns out that I *was* using it as I had installed Exchange, and it installed it as part of it's setup. Whoops!

Now I just apply every update I get, even if I don't think they apply. Sometimes this means patching production servers without really testing, as you can't always test everything, depending on hardware (and we are getting more for this exact reason!)

== John ==
0 Votes
+ -
RE: My bad! ZDNet actually was sending out spam!
birumut Updated - 4th May 2011
Well done! Thank you very much for professional templates and community edition
seslisohbet seslichat

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix