Back in August I wrote about a purchase of Aluria by Earthlink. I speculated that might end the relationship with AOL.
Well, the shoe has finally dropped. AOL has announced that AOL Spyware Protection 2.0 will be using Computer Associates Spysweeper product. And AOL just couldn’t resist some potshots at Aluria suggesting they couldn’t be trusted to categorize spyware, the dont have a large antispyware database, they dont update often enough, they dont offer realtime protection and their scans take forever. Funny AOL wasn’t singing that tune when they went with Aluria, previously unheard of company from Maitland Florida.
I’ve only evaluated the enterprise version of the Spysweeper product. It was ok back in June 2004, but now it is not performing well on recent bakeoffs.
Posts tagged ‘AOL’
AOL bundles CA Spysweeper
SPIM Prevention
SPIM (Spam over IM) Prevention techniques from the IMLogic threat center: Set your client to not accept messages from people not on your buddy list.
IM Client How to stop messages from anonymous users
AOL IM (v5.9.3690) Sign in
Click “My AIM” > “Edit Options” > “Edit Preferences”
Click “Privacy” in the left-hand column
Click “Allow only users on my Buddy List” under the “Who can contact me” heading
ICQ Lite (v4.1) Sign in
Click “Main” > “Preferences and Security”
Click “Spam Control” in the left-hand column
Check “Accept messages only from users on my Contact List”
Ensure both options under “Not in List Messages” are checked
Check “Do not accept World Wide Pager Messages”
Check “Do not accept Email Express Messages”
ICQ Pro (v2003b) Sign in
Click “Main” > “Security and Privacy Permissions”
Click “Communication Events”
Select the yellow check mark for each line item (be sure to scroll)
MSN Messenger (6.2.0137) Sign in
Click “Tools” > “Options”
Click on Privacy Tab
Check “Only people on my Allow List can see my status and send me messages”
Ensure the “Alert me when other people add me to their contact lists” is checked
Windows Messenger (v4.7.3000) Sign in
Click “Tools” > “Options”
Click on Privacy Tab
Ensure the “Alert me when other people add me to their contact lists” is checked
Yahoo! Messenger (v6.0.0.750) Sign in
Click “Messenger” > “Preferences”
Click “Ignore List” in the left-hand column
Click “Ignore anyone who is not on my Messenger List.”
Earthlink acquires assets of aluria
Another bit of news from Donna’s security flash. Earthlink has picked up the assets of Aluria software.
Aluria is a small company from Lake Mary Florida. That’s just north of Orlando, so I know the area a bit from my time down there. Although Aluria’s consumere product has been highly rated, I was never high on them. I seem to recall some controversy about them whitelisting whenu.
Doesn’t Aluria currently provide the antispyware functionality in the AOL Security Edition? Also I believe that Webroot had been providing Earthlink’s antispyware capability. Interesting changes, hmmm.
I figured after Pestpatrol got bought by CA that two things would happen: 1) Pestpatrol would no longer be highly rated. 2) There would be more consolidation as the major companies try to buy into the antispyware market.
AOL Thief Sentenced
Remember that AOL “engineer” who sold the entire AOL user list to spammers? Today the hard hammer of justice came swinging down on him.
I use that term sarcastically. He got 15 months in prison. I suspect with good behavior he’ll be back online before Martha Stewart. Heck, he’ll probably get a pay raise and a job teaching people that they cant trust their own employees.
Here is a link to the Yahoo! story.
It seems our friend got a pleabargain even though he doesn’t have enough information to implicate anyone else. Way to send a message to the other would be criminals out there.
ISP apathy causes insecurity
An article over at Slicon.com takes a look at that old concept of requiring a license to use the internet.
Just as corporate and university networks have taken steps to implement access control to keep out infected systems so too should ISPs look at banning machines that don’t meet a defined security regime.
The article goes on to draw parallels to drivers licenses, restaurants known to service food that makes you ill, and bad neighbors. If you can call the cops to do something about that why cant you ban bad Internet neighbors!
In the U.S. the vast majority of Internet service providers are trying to make a buck. Why would they refuse service to these cyberslackers who quickly become spam-bots because of their inability to patch. Banks do it all the time. They refuse to open accounts for people known to bounce checks. A few bucks up front for the account isn’t worth the trouble that will come down the pipe. Unfortunately this analogy has been largely lost on ISPs.
Many ISPs have pink-list contracts. Contracts where spammers pay a PREMIUM and may hang around until the anti-spammers complain too much. Historically many ISPs have not been good caretakers of their portion of the network. They are in for the fast buck. They are more than willing to let Ma and Pa Kettle onto the Internet without a personal firewall, without adequate patching and without adequate antivirus. AOL and Earthlink run commercials saying they are different. They are able to sell security to the user by selling usability brought by security devices blocking spam and spyware. But how many of AOLs customers actually have the AOL Security Edition?
Protecting Backup Tapes
Security Focus has an article on the danger of backup tapes which has been a hot button issue for me over the past few months.
The author points out that you take the lowest paid guy in the I.T department (commonly known as a tape jockey) and place a backup tape with the entirety of the corporate data in his hands. If your company name is AOL or Ameritrade, or Bank of America you know what kind of trouble that can cause.
Updated AIM Terms of Service
AOL quietly updated their AIM terms of service on February 5th according to eweek.
Users who download AIM software after 2/5/2005 are under this policy.
According to the article, the new policy states:
“You waive any right to privacy. You waive any right to inspect or approve uses of the content or to be compensated for any such uses,” according to the AIM terms-of-service.
Although the user will retain ownership of the content passed through the AIM network, the terms give AOL ownership of “all right, title and interest in any compilation, collective work or other derivative work created by AOL using or incorporating this [user] content.
“In addition, by posting content on an AIM Product, you grant AOL, its parent, affiliates, subsidiaries, assigns, agents and licensees the irrevocable, perpetual, worldwide right to reproduce, display, perform, distribute, adapt and promote this content in any medium,”
Looks like the bottom line is:
1. Use the encryption to prevent them from reading your message.
2. Refrain from posting anything to IM you wouldn’t want to see published in a IM compilation, a court of law, or given to your competitor.
Sounds like good advice in general.
Security Attitudes and Firewall Traversal
An employee writes to a company helpdesk complaining that he cannot access a site. The URL was sent to him by the vendor to be used to register software. When he attempts to go to the URL he gets blocked by Websense. (Websense is an industry leading web filtering/ web security company. Corporations use their block list to prevent employees from accessing disallowed sites). He writes to the helpdesk “No biggie, I will just login to my AOL account and bypass company policy. That will make it easier.”
I’d forgotten that the AOL client basically acts as a VPN and allows users to bypass corporate policy. 
The kicker is that the url actually produces a 404. I suspect that the user has spyware loaded locally that redirects 404s to a specific webpage, and it is that page that is on the block list.
AOL’s Security Ads, Another View
I recently posted about my love for the new series of AOL ads. They highlight the fact that users don’t set out to have security disasters and lose their term papers and family photos to a virus. They don’t set out have their online experience be horrible because of porno spam and spyware. They just want to email grandma the pictures they took at christmas. Is that so wrong?
Tom Liston takes a different view over in today’s SANS Diary. I’m so glad I got my post in first (a month ago actually). This way I know I’m not just having a knee-jerk reaction against what the “experts” have to say.
Liston, claims the ads calls AOL customers idiots. Further that computers are tools that must be used skillfully. Basically he’s playing the old blame the user game. Don’t we yell at Microsoft for not making patching easier, and for not making stopping viruses and spyware easier? Here is AOL stepping up and helping keep the home users system secure. In the past they’ve done things like turn off the Messenger service. Now they are including anti-virus and antispyware. If the updates for this are as easy as the updates to AOLs own software they have the potential to make people much much more secure.
AOL IS FILLING IN THE SECURITY GAP. THEY SHOULD BE COMMENDED.
I would highly recommend, reading the following entry from the Microsoft Monitor Blog. It tells of the writers grandma, Windows XP and AOL Security Edition.
The sole problem I might have with the ad campaign is it implies, Get AOL Get Secure. When it reality the AOL Security Edition is necessary.
