• Skip to main content
  • Skip to primary sidebar

the blog of a bear

this is where a bear will post stuff.

Archives for October 2009

continuing to test

October 26, 2009 by stickbear Leave a Comment

just continuing to test to see what comes out of these posts if they actually start properly appearing on twitter.

Filed Under: Uncategorized

continuing to test

October 26, 2009 by stickbear

just continuing to test to see what comes out of these posts if they actually start properly appearing on twitter.

Mirrored from shane's rants!.

Filed Under: Uncategorized Tagged With: uncategorized

playing with plugins

October 26, 2009 by stickbear Leave a Comment

Just writing as I play with plugins to see if this thing actually shows up on twitter with title and link.
I’ll write more later.

Filed Under: Uncategorized

playing with plugins

October 26, 2009 by stickbear

Just writing as I play with plugins to see if this thing actually shows up on twitter with title and link.
I’ll write more later.

Mirrored from shane's rants!.

Filed Under: Uncategorized Tagged With: uncategorized

follow up to: is freedom scientific losing their touch?

October 21, 2009 by stickbear 2 Comments

This will be a short post
I received the following e-mail from grant hardy, of freedom scientific technical support

Dear Shane:
Thank you for contacting Freedom Scientific Support.
Thanks for letting us know, product management is aware of it, and we are working on it.
Thank you for choosing Freedom Scientific!
If replying to this message, Be sure to include all previous correspondence pertaining to this issue so that we might more quickly assist you.
Regards,
Grant Downey
Technical Support Specialist
Freedom Scientific
Phone support: 727 803 8600, option #2
E-mail Support: [email protected]
Visit our website at:
http://www.freedomscientific.com
Our Mission
To develop, manufacture and market innovative technology-based products
and services that those with vision impairments and learning
disabilities use to change their world.

Is this really a response to the threat these security wholes present?
The comment boards await you.

Filed Under: Uncategorized

Is freedom scientific finally losing their touch?

October 20, 2009 by stickbear 2 Comments

Hello fellow blog readers
It’s been awhile since I posted something of major substance to the blind community here.
On
this blog
We have some very interesting posts to reference.
I’m going to post each of them below, exactly as posted, and I’ll follow each one of them up with my comments.
The first one is entitled

Critical security flaw in JAWS

and was posted on october 16, 2009.

Critical security flaw in JAWS
October 16, 2009 by Tyler Spivey
I have found a critical security flaw in the JAWS Screen reader that allows an attacker to gain full system-level access to
the machine. I have tested this on 32-bit Windows Vista
with JAWS 10.0.1154 and 32-bit Windows 7 with JAWS 11.0.611 Beta.
Instructions:
1. From the Windows logon screen with JAWS running, press insert+f2. Run JAWS Manager will appear.
2. Select Settings Packager, and press ok. Settings Packager will open.
3. From Settings Packager, go to File menu > Open, or press ctrl+o.
4. In the open dialog, type “%windir%\system32\*.exe” into the file name field (without the quotes) and press enter.
5. In the list of files, find cmd. Right click on it, or press the applications key and select Run as Administrator.
A system-level command prompt should open. To get out of it, type exit and press enter, then close the Settings Packager.

my comments on this one
Note that this was during the last public beta build of jaws 11, build 611. I was able to varrify this issue with this build of jaws on all machines I have access to. After build 729 the final release to the public on DVD version of jaws came out on october 19 2009, tyler reported in his next post, see below, had been fixed. but as this next will show, this problem still exists using a different set of varrifiable instructions.
The next post entitled

JAWS security flaw, round 2

has this to say.

JAWS security flaw, round 2
October 19, 2009 by Tyler Spivey
In my First Post, I described a security vulnerability that allowed local users to gain system-level access to a machine. A quick test with JAWS 11.0.729, the release build of JAWS 11, reveals that it is fixed. Here is a slightly different set of instructions that will do the same thing.
1. From the login screen, press insert+j, and navigate to utilities/configuration manager.
2. When configuration manager opens, press control+o.
3. press the Import button. The open dialog will appear.
4. On my Windows 7 test machine, I got an error box that can safely be dismissed. Once done, type %windir%\system32\*.exe into the open dialog.
5. find cmd in the list, and press the applications key on it. Select Run as administrator if it appears. If not, keep following these steps.
6. From cmd’s context menu, pick select. answer no to the question asking you to overwrite settings files, if it comes up.
7. press import, and pick cmd from the list again. Activate the context menu, and select Run as administrator.
If done correctly, you should have an administrative command prompt

I took that set of instructions and again tested them on as many systems as possible, and low and behold, I received an administrative command prompt.
But the ensanity doesn’t end there.
On the same day, this post

Gathering passwords with the JAWS builtin keylogger

hit his blog.
The text is below.

Gathering passwords with the JAWS builtin keylogger
October 19, 2009 by Tyler Spivey
JAWS so helpfully contains a built-in script that logs all keys pressed on the keyboard. This method has a better chance of working on XP than the others. You must have a user account on the machine to make this work.
1. Open Keyboard manager, and open the default file. Add a key to the “ToggleKeyboardLogging” script.
2. Once done, log out of the machine. Your profile will still be loaded. Press that key. The only thing JAWS will say is “enabled”. Log into the machine, then open keystrokes.log in your jaws program directory. all keys pressed will be there, from the last time the script was enabled

At the time of writing, do to my keyboard manager acting up, I have not been able to test this particular vulnerability relating to the keylogger.
At the time this went to press, Freedom scientific LLC,
http://www.freedomscientific.com
was closed.
But the following e-mail was dispatched to both the support and info addresses.

subject: freedom scientific’s response to the security wholes found in jaws 11?
To whom this may concern,
I am writing this message in reference to three blog posts available at:
http://tspivey.wordpress.com/
and who’s text and my comments were placed on my own blog at
http://stickbear.me/blog
To summarize these posts, it was discovered that not only can system level access to the computer be gained using your software, but your program includes a hidden keylogger that isn’t even documented that logs all keystrokes entered and can gain sensative information from a users computer?
These keys hense are logged to keystrokes.log.
I would like to ask, what is freedom scientifics stand on these issues, and is freedom scientific willing to comment publicly for airing on ACBRadio’s main menu and in other public venues regarding these security wholes?
I Thank you for your time.
Sincerely,
Shane Davidson

We shall see what comes of this.
until then.
piece yall.

Filed Under: accessibility, articles, computers, e-mail, Freedom Scientific, general ranting, interesting blogs, internet, opinion, security, technology, Uncategorized

Is freedom scientific finally losing their touch?

October 20, 2009 by stickbear

Hello fellow blog readers
It’s been awhile since I posted something of major substance to the blind community here.
On
this blog
We have some very interesting posts to reference.
I’m going to post each of them below, exactly as posted, and I’ll follow each one of them up with my comments.
The first one is entitled

Critical security flaw in JAWS

and was posted on october 16, 2009.

Critical security flaw in JAWS
October 16, 2009 by Tyler Spivey
I have found a critical security flaw in the JAWS Screen reader that allows an attacker to gain full system-level access to

the machine. I have tested this on 32-bit Windows Vista
with JAWS 10.0.1154 and 32-bit Windows 7 with JAWS 11.0.611 Beta.

Instructions:

1. From the Windows logon screen with JAWS running, press insert+f2. Run JAWS Manager will appear.
2. Select Settings Packager, and press ok. Settings Packager will open.
3. From Settings Packager, go to File menu > Open, or press ctrl+o.
4. In the open dialog, type “%windir%\system32\*.exe” into the file name field (without the quotes) and press enter.
5. In the list of files, find cmd. Right click on it, or press the applications key and select Run as Administrator.
A system-level command prompt should open. To get out of it, type exit and press enter, then close the Settings Packager.

my comments on this one
Note that this was during the last public beta build of jaws 11, build 611. I was able to varrify this issue with this build of jaws on all machines I have access to. After build 729 the final release to the public on DVD version of jaws came out on october 19 2009, tyler reported in his next post, see below, had been fixed. but as this next will show, this problem still exists using a different set of varrifiable instructions.
The next post entitled

JAWS security flaw, round 2

has this to say.

JAWS security flaw, round 2
October 19, 2009 by Tyler Spivey
In my First Post, I described a security vulnerability that allowed local users to gain system-level access to a machine. A quick test with JAWS 11.0.729, the release build of JAWS 11, reveals that it is fixed. Here is a slightly different set of instructions that will do the same thing.
1. From the login screen, press insert+j, and navigate to utilities/configuration manager.
2. When configuration manager opens, press control+o.
3. press the Import button. The open dialog will appear.
4. On my Windows 7 test machine, I got an error box that can safely be dismissed. Once done, type %windir%\system32\*.exe into the open dialog.
5. find cmd in the list, and press the applications key on it. Select Run as administrator if it appears. If not, keep following these steps.
6. From cmd’s context menu, pick select. answer no to the question asking you to overwrite settings files, if it comes up.
7. press import, and pick cmd from the list again. Activate the context menu, and select Run as administrator.
If done correctly, you should have an administrative command prompt

I took that set of instructions and again tested them on as many systems as possible, and low and behold, I received an administrative command prompt.
But the ensanity doesn’t end there.
On the same day, this post

Gathering passwords with the JAWS builtin keylogger

hit his blog.
The text is below.

Gathering passwords with the JAWS builtin keylogger
October 19, 2009 by Tyler Spivey
JAWS so helpfully contains a built-in script that logs all keys pressed on the keyboard. This method has a better chance of working on XP than the others. You must have a user account on the machine to make this work.

1. Open Keyboard manager, and open the default file. Add a key to the “ToggleKeyboardLogging” script.

2. Once done, log out of the machine. Your profile will still be loaded. Press that key. The only thing JAWS will say is “enabled”. Log into the machine, then open keystrokes.log in your jaws program directory. all keys pressed will be there, from the last time the script was enabled

At the time of writing, do to my keyboard manager acting up, I have not been able to test this particular vulnerability relating to the keylogger.
At the time this went to press, Freedom scientific LLC,
http://www.freedomscientific.com
was closed.
But the following e-mail was dispatched to both the support and info addresses.

subject: freedom scientific’s response to the security wholes found in jaws 11?

To whom this may concern,
I am writing this message in reference to three blog posts available at:

http://tspivey.wordpress.com/

and who’s text and my comments were placed on my own blog at

http://stickbear.me/blog

To summarize these posts, it was discovered that not only can system level access to the computer be gained using your software, but your program includes a hidden keylogger that isn’t even documented that logs all keystrokes entered and can gain sensative information from a users computer?
These keys hense are logged to keystrokes.log.
I would like to ask, what is freedom scientifics stand on these issues, and is freedom scientific willing to comment publicly for airing on ACBRadio’s main menu and in other public venues regarding these security wholes?
I Thank you for your time.
Sincerely,
Shane Davidson

We shall see what comes of this.
until then.
piece yall.

Mirrored from shane's rants!.

Filed Under: Uncategorized Tagged With: accessibility, articles, computers, e-mail, freedom scientific, general ranting, interesting blogs, internet, opinion, security, technology, uncategorized

Primary Sidebar

Subscribe to Podcast

Apple PodcastsGoogle PodcastsAndroidby EmailRSS

my goodreads challenge!

2020 Reading Challenge

2020 Reading Challenge
Shane has read 2 books toward his goal of 40 books.
hide
2 of 40 (5%)
view books

my currently reading shelf

Shane's currently-reading book montage



Shane's favorite books »

Recent Posts

  • the Shane O Train archive for January 14, 2021.
  • the Shane O Train for January 7, 2021.
  • The Shane O Train from December 10, 2020.
  • this is what happens when bears break stuff.
  • did I break it?

Recent Comments

  • Steve on people seriously had the balls to whine about this app going free?
  • DM on they actually certified it.
  • stickbear on More on the lawsuit, a letter being sent around, and inaccessible forms, for serious?
  • Steve on More on the lawsuit, a letter being sent around, and inaccessible forms, for serious?
  • Tay on More on the lawsuit, a letter being sent around, and inaccessible forms, for serious?

Archives

  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • August 2014
  • June 2014
  • May 2014
  • March 2014
  • January 2014
  • October 2013
  • September 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • December 2012
  • November 2012
  • October 2012
  • September 2012
  • August 2012
  • July 2012
  • June 2012
  • May 2012
  • April 2012
  • March 2012
  • February 2012
  • January 2012
  • December 2011
  • November 2011
  • October 2011
  • September 2011
  • August 2011
  • July 2011
  • June 2011
  • May 2011
  • April 2011
  • March 2011
  • February 2011
  • January 2011
  • December 2010
  • November 2010
  • October 2010
  • July 2010
  • June 2010
  • May 2010
  • March 2010
  • February 2010
  • January 2010
  • December 2009
  • October 2009
  • September 2009
  • August 2009
  • July 2009
  • June 2009
  • May 2009
  • April 2009
  • March 2009
  • February 2009
  • January 2009
  • December 2008
  • November 2008
  • October 2008
  • September 2008
  • February 2007
  • December 2006
  • October 2006
  • September 2006
  • August 2006
  • July 2006
  • January 2006
  • August 2005
  • July 2005
  • June 2005
  • May 2005
  • April 2005
  • March 2005
  • January 2005
  • December 2004
  • November 2004
  • October 2004
  • September 2004
  • August 2004
  • July 2004
  • June 2004
  • May 2004
  • January 2004

Categories

  • accessibility
  • ADBC
  • adult humor
  • amber
  • amusement
  • articles
  • audio posts
  • blog announcements
  • book reviews.
  • brain-vomit
  • Bryan Carver
  • cell phones
  • children
  • christianity
  • computers
  • court
  • crappily designed software
  • e-mail
  • facebook
  • feelings
  • Freedom Scientific
  • FSU stupid
  • general
  • general ranting
  • GPS
  • guideDogAdventures
  • hockey
  • humanware
  • humor
  • humour
  • interesting blogs
  • internet
  • iphone
  • josh
  • kerri
  • Leukemia
  • life
  • lists ftw
  • maple leafs
  • mojo radio
  • motherzilla
  • music
  • my braille note
  • my child
  • news
  • news articles
  • ODSP
  • open communication
  • open source software
  • opinion
  • other stuff
  • people needing a clue
  • personal
  • personal life
  • podcast
  • psycho-x-girlfriends
  • quiz's
  • radio show
  • raille note
  • random posts from random locations
  • random posts of random things
  • random shows
  • rantings
  • rants
  • relationship
  • relationships
  • response
  • reviewing my life
  • rose
  • school
  • security
  • selfish people
  • shane
  • skype
  • skype church service
  • special events
  • stuff that fails
  • stupid people
  • technology
  • tek savvy
  • testing
  • thought
  • threats
  • toronto
  • travel
  • trekker.
  • tv
  • Uncategorized
  • updates
  • useless stats
  • weird and slightly deranged
  • writings
  • WRMS fire
  • WRMS lawsuit
  • wtf

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

Copyright © 2021 · News Pro on Genesis Framework · WordPress · Log in