Tips to protect yourself from phishing schemes:

1. Never provide your personal information when responding to an unsolicited email request, no matter how legitimate the communication may look. Whether by phone, email or internet site, data created by phishers may look like the real thing. If you didn’t initiate the communication, you shouldn’t provide any information.
2. Never provide a password over the telephone in response to an unsolicited request. Financial institutions should never ask you to verify your account information online.
3. Contact the financial institution yourself, if you believe the contact may be legitimate. Phone number and websites can be found on your monthly statements from your financial institutions. You can also look up companies on the internet or in phone books.
4. Regularly review your account statements to confirm there are no fraudulent charges. If your account statement is ever late, immediately contact the financial institution to determine why.
5. Visit the anti-phishing working group website to obtain a list of the most recent incidents of phishing and find the latest news in the fight against phishing, www.antiphishing.orgBecoming Proactive

When you encounter a potential fraud, especially if you believe you’ve lost money, act immediately:

• If you receive phishing emails, you can report the fraud to the FBI’s Internet Fraud Complaint Center at www.ic3.gov, and forward the email to enforcement@sec.gov, to pass the tip to the SEC’s Enforcement Division.
• If you think your personal information has been compromised, visit the Identity Theft Resource Center of the Federal Trade Commission for more information on how to proceed with protecting yourself and minimizing the damage.

• http://streaming.live.com/
• https://silverlight.live.com/

I have been using WordPress as my blogging platform for a few years now. Before that was a hybrid of PHPBB and custom PHP application I wrote. WordPress works great and has robust features that make blogging a snap for the more technical (such as myself, ehem) and also for the less technical netizens out there. Now, one of these great features is the ability to upload pictures and files (content) through a web interface. What a great concept (this is where the epiphany came in) except if you weren’t planning on listing up the contents of your entire uploads folder to the world. which happens to be the case with some (okay a lot of) default installations of WordPress.

Lets say you “Google” the “Index of” any WordPress uploads folders (/wp-content/uploads). You don’t have to be a rock scientist (yes, that was a joke) to realize the possible implications. Let me give you an idea of the figure as of tonight: 4,143,000 indexes. That’s 4,143,000 WordPress installations that have directory indexes enabled and are completely wide open to crawlers and spiders that can pilfer (argh) their content.

Try it yourself: http://www.google.com/search?q=Index+of+%2Fwp-content

There are plenty of other “Index of” combinations out there:

1. “Index of /admin”
2. “Index of /password”
3. “Index of /mail”
4. “Index of /” +passwd
5. “Index of /” password.txt

Now obviously if someone is using WordPress and uploading content, it’s more than likely related to their blog, and perfectly okay for the world to sneak a peak. However, for those sites that are using WordPress as a corporate platform, with confidential information (don’t ask me why you would want to do this with WordPress…), this is a huge security issue.

Moral of the story, unplug your computer, no one is safe.

Here are a bunch I found in a forum while actually doing a search on _vti (Front Page extensions).

filetype:htpasswd htpasswd
intitle:"Index of" “.htpasswd" -intitle:"dist"
           -apache -htpasswd.c
index.of.private (algo privado)
intitle:index.of master.passwd
inurl:passlist.txt (para encontrar listas de passwords)
intitle:"Index of..etc" passwd
intitle:admin intitle:login
“Incorrect syntax near" (SQL script error)
intitle:"the page cannot be found" inetmgr
intitle:index.of ws_ftp.ini
“Supplied arguments is not a valid PostgreSQL result"
_vti_pvt password intitle:index.of
inurl:backup intitle:index.of inurl:admin
“Index of /backup"
index.of.password
index.of.winnt
inurl:"auth_user_file.txt"
“Index of /admin"
“Index of /password"
“Index of /mail"
“Index of /" +passwd
Index of /" +.htaccess
Index of ftp +.mdb allinurl:/cgi-bin/ +mailto
allintitle: “index of/admin"
allintitle: “index of/root"
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
administrator.pwd.index
authors.pwd.index
service.pwd.index
filetype:config web
gobal.asax index
inurl:passwd filetype:txt
inurl:admin filetype:db
inurl:iisadmin
inurl:"auth_user_file.txt"
inurl:"wwwroot/*."
allinurl: winnt/system32/ (get cmd.exe)
allinurl:/bash_history
intitle:"Index of" .sh_history
intitle:"Index of" .bash_history
intitle:"Index of" passwd
intitle:"Index of" people.1st
intitle:"Index of" pwd.db
intitle:"Index of" etc/shadow
intitle:"Index of" spwd
intitle:"Index of" master.passwd
intitle:"Index of" htpasswd
intitle:"Index of" members OR accounts
intitle:"Index of" user_carts OR user _cart

1. Create a blank Flash movie (somewhere near the dimensions of the source video)
2. File | Import | Import to library…
3. Select Windows | Library OR CTRL + L for those key-jockeys out there
4. Select the imported movie from the library
5. Right-click | Properties
6. In the Embedded Video Properties dialog box, click Export.
7. Save the movie for later use

Now, what if we want to be able to download an FLV movie from somewhere on the web. Lately I have been researching ways to leverage various online social media provider’s technologies (and uhm, assets.) In doing so, I rely heavily on Fiddler, an HTTP debugging proxy which logs all HTTP traffic between your computer and the Internet (that is all IE traffic.) By listening to the HTTP requests being sent from any embedded Flash application from your local computer, FLV assets from YouTube, Brightcove and others are easily retrievable. Although there are freely available plug-ins for Firefox and Internet Explorer that occasionally work, oftentimes it becomes necessary to dig in and get your hands dirty. Let’s dirty up…

1. Download, install and run Fiddler 2 (you’ll need the latest version of .NET 2.0)
2. Disable capture (F12)
3. Launch IE (any recent flavor will due)
4. Open up YouTube.com, Brightcove.tv or any media outlet that offers streaming video via Flash
5. Return to Fiddler and click F12 to begin capture (this is important or you will miss the capture part of this mini-tutorial)
6. Now, browse to a page that has the video you wish to “archive” and allow it to load and begin playing (I have found that sometimes Fiddler or the site will hang, you may need to start capture a few times to get the page to load up.)
7. Return to Fiddler and click F12 again (we have captured all we need)

You should have a list of links that Fiddler has so graciously tracked for us. Now time to locate the actual session that contains the source movie.

1. Click CTRL + F (find) and type video/flv in the text box
2. Search | Requests and Headers
3. Examine | Headers and Body
4. Click Find Sessions