Re: [Ql-Users] Email attachments

[pjwitte]

On 15/01/2017 11:04, Derek Stewart wrote:

<>

If the operating system is in ROM, I donot think this is going to 
work, also there is no or very limited Internet access for the QL 
systems and I do not think hacker will see QDOS/SMSQ/E as a viable 
target. 

May I add this quote to my collection of Famous Last Words, Derek? ;)

Slowly but surely even the "QL" is becoming more connected, and who 
knows what new possibilities might emerge? Networked games over the 
Internet, email, maybe even a browser (using SBASIC as a client-side 
scripting language),.. Then there are all those new digital refugees - 
particularily the "retro-brigade" - swamping our cosy little Forum 
with ideas from the previous millenium, and others too, with 
subversive new ideas like moving pictures, and wotnext.. Terrorists 
could so easily slip through Commisario Vanpeebles' net, masquerading 
as innocent tinkerers! ;)


We live in dangerous times. A little paranoia goes a long way. In my 
estimate of the original question (could some kind of destructive/spy 
code enter the QL world from outside?): Yes, it is theoretically 
possible, and becomes ever more so, but at present it is _highly 
unlikely_. Should ever any such attack occur it would most likely come 
from within the QL community, and that would leave a limited number of 
suspects (one of, who by his own admission, has terrorist tendencies! 
;) However IMHO, anyone considering developing tools or applications 
for the QL environment that use the Internet, should give some thought 
to possible dangers and risks.


Per
___
QL-Users Mailing List

Re: [Ql-Users] Email attachments

[Derek Stewart]

On 15/01/17 09:23, Graeme Gregory wrote:



On Sun, 15 Jan 2017, at 05:47 AM, Daniele Terdina wrote:

Not sure how you come to that conclusion, I used to work on Java and it
goes through a stringent security process.


AFAIK Flash used to be the most vulnerable software (when also taking
user base into account), but since it lost favor Java has been the top or
one of the top for a long time.
See for example:
http://www.csoonline.com/article/2875535/application-security/java-is-the-biggest-vulnerability-for-us-computers.html

[http://core5.staticworld.net/images/article/2014/11/maria-trombly-headshot-closeup-100532712-byline.jpg]

Java is the biggest vulnerability for US computers | CSO
...
www.csoonline.com
Java is the biggest vulnerability for US computers Oracle's Java poses
the single biggest security risk to US desktops, says a new report



If you actually read the article thats because of the huge attack
surface of old unpatched java installations in the world. It is afterall
written by a company selling their auto patching software. Thats like
saying QDOS is really aweful because of a bug you found in the AH ROM
that was subsequently fixed.

If you notice the JAVA NPAPI plugin is pretty much dead now, modern
browsers won't even allow you to load it.

Unfortunately the one thing we have never managed to work out a fix for
in the industry is the wetware that exists between the chair and the
keyboard :-(

But the biggest threat at the end of 2016 was most certainly IoT
devices, at least two massive botnets were formed from them and those
bloody things never get patched.

Graeme
___
QL-Users Mailing List


Hi,

How does the QDOS operating system get a Java Plugin, the only Java 
based system is SMSQmulator, which we have been is secure enough.


If the operating system is in ROM, I donot think this is going to work, 
also there is no or very limited Internet access for the QL systems and 
I do not think hacker will see QDOS/SMSQ/E as a viable target.


Regards,

Derek
___
QL-Users Mailing List

Re: [Ql-Users] Email attachments

[Graeme Gregory]

On Sun, 15 Jan 2017, at 05:47 AM, Daniele Terdina wrote:
> > Not sure how you come to that conclusion, I used to work on Java and it
> > goes through a stringent security process.
> 
> AFAIK Flash used to be the most vulnerable software (when also taking
> user base into account), but since it lost favor Java has been the top or
> one of the top for a long time.
> See for example:
> http://www.csoonline.com/article/2875535/application-security/java-is-the-biggest-vulnerability-for-us-computers.html
> 
> [http://core5.staticworld.net/images/article/2014/11/maria-trombly-headshot-closeup-100532712-byline.jpg]
> 
> Java is the biggest vulnerability for US computers | CSO
> ...
> www.csoonline.com
> Java is the biggest vulnerability for US computers Oracle's Java poses
> the single biggest security risk to US desktops, says a new report
> 

If you actually read the article thats because of the huge attack
surface of old unpatched java installations in the world. It is afterall
written by a company selling their auto patching software. Thats like
saying QDOS is really aweful because of a bug you found in the AH ROM
that was subsequently fixed.

If you notice the JAVA NPAPI plugin is pretty much dead now, modern
browsers won't even allow you to load it.

Unfortunately the one thing we have never managed to work out a fix for
in the industry is the wetware that exists between the chair and the
keyboard :-(

But the biggest threat at the end of 2016 was most certainly IoT
devices, at least two massive botnets were formed from them and those
bloody things never get patched.

Graeme
___
QL-Users Mailing List

Re: [Ql-Users] Email attachments

[Daniele Terdina]

There's no 100% security, but unzipping on a QL or emulated QL (Java-based or 
not) sounds like _extremely_ low risk, provided the uncompressed file is not 
used directly on the PC.






> Not sure how you come to that conclusion, I used to work on Java and it
> goes through a stringent security process.

AFAIK Flash used to be the most vulnerable software (when also taking user base 
into account), but since it lost favor Java has been the top or one of the top 
for a long time.
See for example: 
http://www.csoonline.com/article/2875535/application-security/java-is-the-biggest-vulnerability-for-us-computers.html

[http://core5.staticworld.net/images/article/2014/11/maria-trombly-headshot-closeup-100532712-byline.jpg]

Java is the biggest vulnerability for US computers | CSO 
...
www.csoonline.com
Java is the biggest vulnerability for US computers Oracle's Java poses the 
single biggest security risk to US desktops, says a new report




___
QL-Users Mailing List

Re: [Ql-Users] Email attachments

[Derek Stewart]

Is that part of the Psion suite...

Regards,

Derek

On 14/01/17 13:34, Dilwyn Jones wrote:

Geoff Wicks wrote:

This is off topic, but whenever I am phoned by "Microsoft tech
support" I put on my most sanctimonious voice:

"My dear boy, if the Good Lord had meant us to use computers he would
never have given us the abacus.",

I wouldn't have thought they would even dare ring you, Geoff! ;-)

Dilwyn
___
QL-Users Mailing List


___
QL-Users Mailing List

Re: [Ql-Users] Email attachments

[Dilwyn Jones]

Geoff Wicks wrote:
This is off topic, but whenever I am phoned by "Microsoft tech support" 
I put on my most sanctimonious voice:


"My dear boy, if the Good Lord had meant us to use computers he would 
never have given us the abacus.",

I wouldn't have thought they would even dare ring you, Geoff! ;-)

Dilwyn
___
QL-Users Mailing List

Re: [Ql-Users] Email attachments

[Geoff Wicks]

On 13/01/2017 22:40, Norman Dunbar wrote:


And I have been known to keep the "Microsoft tech support" people on the phone 
for hours! At least when they are talking to me, they are not ripping off some 
unsuspecting person.

Mind you,  I wouldn't do any of the above with windows,  even in a vm!


Cheers,
Norm.


This is off topic, but whenever I am phoned by "Microsoft tech support" 
I put on my most sanctimonious voice:


"My dear boy, if the Good Lord had meant us to use computers he would 
never have given us the abacus.",



Best Wishes,


Geoff


___
QL-Users Mailing List

Re: [Ql-Users] Email attachments

[Norman Dunbar]

Evening Christopher, 

On a Windows pc? Never open anything attached that you are suspicious of etc. 
In a QL, just have fun. I wrote a QL virus many many years ago when all viruses 
spread by floppy disc. I never released it into the wild. 

Many viruses, trojans or whatever they are called this week, are "invoices" or 
"bank payments" or "parcel delivery notes" in Word doc format. I always open 
those! In Libre Office, on a Linux host, running a Linux Virtual Machine as 
guest!

Usually there is a macro, set to run on opening the doc, and it's usually 
encoded. I have been known to take a few apart.

So far they are all pretty much the same, an http request is sent to a 
compromised server and an exe file is downloaded and executed.  Normally I send 
an email to the web site owner and the isp with details. They usually shut down 
the payload pretty damned quickly. 

Your Russian Web site could be another compromised one, the script kiddies 
don't usually host these things on their own web sites.

And you should see what details I leave for my passwords and usernames on those 
phishing Web sites. It seems that many of my private details have to do with 
their mothers sexual dalliances with camels

We had one at work the other day. At least 5 people clicked the suspicious 
link. It was a set up. The email had been sent to everyone by our security 
team. The link took the victims to a Web site  where a message advised that 
their details had been collected, they have made a huge mistake, and there 
would be words had with their bosses!

No, I wasn't a victim. :-)

And I have been known to keep the "Microsoft tech support" people on the phone 
for hours! At least when they are talking to me, they are not ripping off some 
unsuspecting person.

Mind you,  I wouldn't do any of the above with windows,  even in a vm!


Cheers,
Norm.
-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.
___
QL-Users Mailing List

Re: [Ql-Users] Email attachments

[Marcel Kilgus]

jms1 wrote:
> I would have thought not a SQmulator as it runs in java and java is not
> particularly safe.
> Can Marcel answer for QPC1 or 2?

Security is not a design goal for a QL emulator. There is no security
in SMSQDOS anyway. But unless you're personally wanted by the NSA I'm
pretty sure you're safe.

> It is suggested any virtual machine is safe and is the method used for
> testing new versions of an OS on its own operating system.

Nothing is safe if the attacker is determined and the stakes are high
enough. I'm pretty sure nobody on this list qualifies ;-)

At the conference I've been to there was a talk from somebody who has
hacked a pay TV service. I was in awe at what lengths he went to to
achieve his goal (for example he read the contents of the ROM by
dissolving the package of the security chip and read the bits using a
microscope!). This is the talk: https://www.youtube.com/watch?v=lO4TNnkN64A
You stand no chance against people like him, no matter what.

> As Spies are hacking into machines can we produce a safe OS?

No. Unless you consider "it's so obscure that nobody bothers" as safe.

Marcel

___
QL-Users Mailing List

Re: [Ql-Users] Email attachments

[Wolf]

Hi,

On 13/01/2017 18:32, Christopher Cave wrote:

It is my normal practice to delete any email coming from an unknown or
suspect origin WITHOUT looking at any attachment. Today I took such an
attachment, a zip-file, and opened it with ACP in a QL-environment. There
was a .ru (Russian ?) email address embedded in  the file. My usual
approach seems justified but was the procedure I adopted safe?



You were perfectly safe.

Wolfgang
___
QL-Users Mailing List

Re: [Ql-Users] Email attachments

[Graeme Gregory]

On Fri, 13 Jan 2017, at 06:08 PM, jms1 wrote:
> Well that is an interesting point.
> 
> How safe is the virtual QL machine?
> .
> I would have thought not a SQmulator as it runs in java and java is not
> particularly safe.

Not sure how you come to that conclusion, I used to work on Java and it
goes through a stringent security process.

> Can Marcel answer for QPC1 or 2?
> 
> How about  Virtual Box running another OS.
> 
> It is suggested any virtual machine is safe and is the method used for
> testing new versions of an OS on its own operating system.
> 
> As Spies are hacking into machines can we produce a safe OS?
> George Gwilt says it was proved no a long time ago.
> 
> It would be nice to know more.
> 
So the main thing is the attacker would have to know you were using a QL
emulator to even start the attack. I know security by obscurity is not a
good thing. But the QL was pretty obscure even back in the day.

Graeme
___
QL-Users Mailing List

Re: [Ql-Users] Email attachments

[jms1]

Well that is an interesting point.

How safe is the virtual QL machine?
.
I would have thought not a SQmulator as it runs in java and java is not
particularly safe.
Can Marcel answer for QPC1 or 2?

How about  Virtual Box running another OS.

It is suggested any virtual machine is safe and is the method used for
testing new versions of an OS on its own operating system.

As Spies are hacking into machines can we produce a safe OS?
George Gwilt says it was proved no a long time ago.

It would be nice to know more.


On 2017-01-13 17:32, Christopher Cave wrote:
It is my normal practice to delete any email coming from an unknown 
or
suspect origin WITHOUT looking at any attachment. Today I took such 
an
attachment, a zip-file, and opened it with ACP in a QL-environment. 
There

was a .ru (Russian ?) email address embedded in  the file. My usual
approach seems justified but was the procedure I adopted safe?

Christopher Cave

mailto:cc...@cix.co.uk

___
QL-Users Mailing List


___
QL-Users Mailing List

[Ql-Users] Email attachments

[Christopher Cave]

It is my normal practice to delete any email coming from an unknown or
suspect origin WITHOUT looking at any attachment. Today I took such an
attachment, a zip-file, and opened it with ACP in a QL-environment. There
was a .ru (Russian ?) email address embedded in  the file. My usual
approach seems justified but was the procedure I adopted safe? 

Christopher Cave

mailto:cc...@cix.co.uk

___
QL-Users Mailing List

Re: [ql-users] email attachments

[Dilwyn Jones]

I also get these, as they usually have an empty subject line I tried 
to block them via OE's filters by rejecting an empty string in the 
subject line, wouldn't work though, same thing in Thunderbird you 
can mark them as junk but it wont work with the next one to arrive, 
it a dodgy strategy anyway as sometimes genuine sender forget to 
fill the subject line.

All the best - Bill
OE's filters are a bit hit and miss anyway. I've never really 
understood the mechanism, because I have certain phrases and keywords 
set up to delete spam, sometimes it works, sometimes it doesn't. 
Example: if the subject line is free porn it should delete it off 
the server and not even bother sending it to me. Sometimes it does, 
sometimes emails with exactly that line appear. Weird.

Should invest in a decent anti spam, but even the Symantec one at work 
doesn't do very well, so I doubt anything I can afford will be of much 
use. The majority of spam has the same or similar subject lines with 
the only real changes being the occasional deliberate misspelling or 
insertion of an accented character or something.

I could probably do better by taking Geoff's idea of rejecting 
anything that hasn't got QL or Quanta in the subject line.

Blank ones get deleted without a second glance here. AVG7 does a 
decent job of catching the viruses as they arrive, between AVG7 and 
having the preview pane disabled, M$ security patches and a bit of 
common sense with emails from people I don't know and not getting too 
hot under the collar about general spam (as opposed to drugs and porn 
ones which do annoy me) I seem to be doing OK at the moment.

My mobile has been getting some silly texts from some under-18s disco 
club or something called KAOS lately. As they seem to be bona-fide (I 
know someone who knows of them), I asked via their website for them to 
remove me from their lists as I am not under 18, am not in the area of 
the gigs they advertise, have never so much as shown an interest in 
them, the texts are pointless to me and so on. I still don't know if 
O2 gave them my number, or if they simply bombard all possible numbers 
with their junk or if I now have a mobile number which used to belong 
to someone who was a customer of theirs. Or maybe one of the 
disgruntled former colleagues whom I gave evidence against when they 
were sacked for theft have done this in revenge. The texts do seem to 
have stopped, but whether that's just because it's the quiet christmas 
period I don't know.

Amazes me that people are prepared to waste their time pestering 
people like me who have never and never will knowingly respond to junk 
mail/email/texts. Always amazes me how people take the attitude that 
they'll do something just because it can be done, and no though 
whatsoever to right, wrong or morality! Mind you, many people have 
been gullible enough to fall for Nigerian email scams, ebay I'll send 
you cheque for 10 times the price, you send me 9 times the price back 
and sure enough the cheque bounces and gets charged against the 
customer's account even though it appeared in the customer's account 4 
days after being banked as though it had been cleared.

With junk mail and email I take the attitude that if they have to 
reach out to me in this way, their product is obviously such a lot of 
crap that nobody in their right mind would buy it of their own free 
will.

--
Dilwyn Jones

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.298 / Virus Database: 265.6.5 - Release Date: 26/12/2004
___
QL-Users Mailing List
http://www.q-v-d.demon.co.uk/smsqe.htm

Re: [ql-users] email attachments

[Tony Firshman]

On  Fri, 31 Dec 2004 at 03:10:15, Dilwyn Jones wrote:
(ref: [EMAIL PROTECTED])

 snip

Amazes me that people are prepared to waste their time pestering people
like me who have never and never will knowingly respond to junk
mail/email/texts. Always amazes me how people take the attitude that
they'll do something just because it can be done, and no though
whatsoever to right, wrong or morality! Mind you, many people have been
gullible enough to fall for Nigerian email scams, ebay I'll send you
cheque for 10 times the price, you send me 9 times the price back and
sure enough the cheque bounces and gets charged against the customer's
account even though it appeared in the customer's account 4 days after
being banked as though it had been cleared.
The banks have finally admitted there is no such thing as a cleared
cheque.
There are well documented cases of them debiting people's accounts up to
2 years after a cheque has been 'cleared'.  This was reported on R4 'You
and Yours and Money Programme. A interviewee from the banks admitted
this.  They reserve the right to claim money back on bad cheques without
time limit.  They say in some circumstances, with complicated fraud, it
can take years to come to light.

The only way I would accept a large amount of money by 'cheque' is a
banker's draft or building society cheque.  However there are plenty of
examples of people using stolen building society cheques and banker's
drafts, so they need clearing too.  At least once they have cleared,
they are sure to be OK.

With junk mail and email I take the attitude that if they have to reach
out to me in this way, their product is obviously such a lot of crap
that nobody in their right mind would buy it of their own free will.
Even worse are junk phone calls.
I am sure you are pestered by these, including recorded voices
announcing me as a 'winner'.

Tony

-- 
 QBBS (QL fido BBS 2:252/67) +44(0)1442-828255
 tony@surname.co.uk  http://www.firshman.co.uk
   Voice: +44(0)1442-828254   Fax: +44(0)1442-828255
TF Services, 29 Longfield Road, TRING, Herts, HP23 4DG
___
QL-Users Mailing List
http://www.q-v-d.demon.co.uk/smsqe.htm

Re: [ql-users] email attachments

[Dilwyn Jones]

With junk mail and email I take the attitude that if they have to 
reach
out to me in this way, their product is obviously such a lot of crap
that nobody in their right mind would buy it of their own free will.
Even worse are junk phone calls.
I am sure you are pestered by these, including recorded voices
announcing me as a 'winner'.
Tony
I did get one which announced me as winner - prize dinner with Tony 
Firshman after a Quanta Workshop. Sadly, that was a joke by another 
QLer!

I'm registered with Telephone Preference Service so don't get many at 
home, but we do get them quite a lot at work. The most annoying part 
is the silence at the start of a call while the computer generating 
the call desperately tries to find a free call centre operative who 
barely speaks English or plays the recorded voice. Always amazes me 
that these companies think you'll buy from them if you don't even 
understand the caller speaking

Stuff them, put them on hold to run up their bills, their computer 
flags it as a long call, so successful so they keep trying you and 
you do the same to them over and over again to waste their time and 
money, with them on hold there's plenty of lines to allow other calls 
to continue being received. Alternatively, just route them direct to 
my boss's mobile to annoy him and run up their costs even more ;-))

--
Dilwyn Jones

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.298 / Virus Database: 265.6.5 - Release Date: 26/12/2004
___
QL-Users Mailing List
http://www.q-v-d.demon.co.uk/smsqe.htm

Re: [ql-users] email attachments

[gwicks]

- Original Message - 
From: Dilwyn Jones
To: QL Users List [EMAIL PROTECTED]
Sent: Wednesday, December 29, 2004 11:42 AM
Subject: [ql-users] email attachments


OK, I know I'm asking for it with Lookout Excess, but anyone know why the 
attachment indicator paperclip shows on emails with no attachment. I go 
into properties and it says no attachment.

I generally delete such emails without reading them, so may well have 
deleted some QLers emails needlessly.

I have also been getting these occasionally. They are always spam and I 
assume it is one of the spammers new tricks.

Thus I don't think you have deleted QL related emails accidentally. 
Occasionally I do do that or even structurally block a genuine QL emailer, 
but I always do a double check by looking in my delete box.

It is a good practice when emailing another QL-er privately to always 
include a keyword such as QL or Quanta in the subject title.

Best Wishes,
Geoff 

___
QL-Users Mailing List
http://www.q-v-d.demon.co.uk/smsqe.htm

Re: [ql-users] email attachments

[Bill Waugh]

gwicks wrote:
- Original Message - From: Dilwyn Jones
To: QL Users List [EMAIL PROTECTED]
Sent: Wednesday, December 29, 2004 11:42 AM
Subject: [ql-users] email attachments

OK, I know I'm asking for it with Lookout Excess, but anyone know why 
the attachment indicator paperclip shows on emails with no attachment. 
I go into properties and it says no attachment.

I generally delete such emails without reading them, so may well have 
deleted some QLers emails needlessly.

I have also been getting these occasionally. They are always spam and I 
assume it is one of the spammers new tricks.

Thus I don't think you have deleted QL related emails accidentally. 
Occasionally I do do that or even structurally block a genuine QL 
emailer, but I always do a double check by looking in my delete box.

It is a good practice when emailing another QL-er privately to always 
include a keyword such as QL or Quanta in the subject title.

Best Wishes,
Geoff
I also get these, as they usually have an empty subject line I tried to 
block them via OE's filters by rejecting an empty string in the subject 
line, wouldn't work though, same thing in Thunderbird you can mark them 
as junk but it wont work with the next one to arrive, it a dodgy 
strategy anyway as sometimes genuine sender forget to fill the subject line.

All the best - Bill
___
QL-Users Mailing List
http://www.q-v-d.demon.co.uk/smsqe.htm

[ql-users] email attachments

[Dilwyn Jones]

OK, I know I'm asking for it with Lookout Excess, but anyone know why 
the attachment indicator paperclip shows on emails with no attachment. 
I go into properties and it says no attachment.

I generally delete such emails without reading them, so may well have 
deleted some QLers emails needlessly.

They are usually html emails and at least some of them must have links 
in them as XP/SP2 report they've blocked a potentially unsafe URL, 
though that's par for the course with SP2.

AVG 7 antivirus never detects a virus in these emails, so I wonder if 
I'm deleting QLers emails needlessly?

--
Dilwyn Jones

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.298 / Virus Database: 265.6.5 - Release Date: 26/12/2004
___
QL-Users Mailing List
http://www.q-v-d.demon.co.uk/smsqe.htm