Asylum Feedback/Support

Posted by Ted Smith (B) on October 23, 2007 at 16:14:02

In Reply to: RE: AA attempting to access credit card info... posted by Neil49 on October 23, 2007 at 15:51:09

Howdy

My experience with programs like those (but not with Trend Micro AV in particular) is that they look for subsets of the digits in your CC info being in the HTML stream. Unfortunately if a sequence in the CC number looks a lot like, say, a date or time, etc. you'll get false positives. If you have the option of configuring which part of your CC data to use, you might try changing it.

-Ted

• Thank you, Ted... - Neil49 16:51:53 10/23/07 (3)
  In Reply to: RE: I'm not Rod but posted by Ted Smith on October 23, 2007 at 16:14:02

  That makes sense, but...
  
  I just disabled my AV, and re-ran a post that triggered the alert, and it turns out that the blocked area of the post was the line at the bottom, where it says "Alert Moderator", followed by the Views and Thread counts, neither of which had a combination of digits remotely resembling any portion of the cc number. Of course, that doesn't necessarily disqualify your theory, and I've been considering marking AA as a Trusted Web Site for the purposes of the AV program.
  
  What's most puzzling is the "googleanalytics" address that is shown as one of the requesters, which appears at least as often as AA when clicking onto an AA post. A check of "googleanalytics", referenced below, doesn't reveal anything PARTICULARLY sinister, but I'd still like to know how it's able to insinuate itself into certain Web pages such as the Asylum's.
  
  
  

  • http://en.wikipedia.org/wiki/Google_Analytics   (Open in New Window)

  
  

  ---

  • RE: Thank you, Ted... - Rod M 17:52:59 10/23/07 (1)
    In Reply to: RE: Thank you, Ted... posted by Neil49 on October 23, 2007 at 16:51:53

    I actually haven't a clue. It strikes me as a typical bug in an AV program. The Alert Moderator line is dynamically generated and uses an iframe to fill in the data. Everything is processed on the server side, so there is no personal data at all. All of that is evaluated on the server side and you'd get an Edit link if the cookie matches your user id and it's it's your post.
    
    Google Analytics uses it's own cookie, so I'm guessing that it triggers Trend to a foreign cookie on the site. Now you're got me thinking that it's tracking cookie requests and the moderator line in the iframe does have to do it's own cookie request to serve the line, so that's likely what Trend is tracking.
    
    And yeah, it's all a false positive. Set AA as trusted and forget it.
    
    -Rod
    
    

    ---

    • Thanks to both of you, Rod and Ted... - Neil49 18:09:09 10/23/07 (0)
      In Reply to: RE: Thank you, Ted... posted by Rod M on October 23, 2007 at 17:52:59

      I'll go ahead and mark AA as a trusted site.
      
      If a week from now I have to declare bankruptcy, I'm comin' after your server with a ball-peen hammer.
      
      

      ---
  • RE: Thank you, Ted... - Ted Smith 16:58:28 10/23/07 (0)
    In Reply to: RE: Thank you, Ted... posted by Neil49 on October 23, 2007 at 16:51:53

    Howdy
    
    I'm just speculating here till Rod finds the time to answer, but the Alert...Views section is dynamically generated and its generation depends on your asylum cookies.
    
    You might check the content of your cookie cache for asylum related cookies contents.
    
    Also I'm sure the Google stuff used cookies which once again might look like your CC number.
    
    -Ted
    
    

    ---

---

[ Follow Ups ] [ Post Followup ] Thread: [ Display  All  Email ] [ Asylum Feedback/Support ]
[ Comment ] [ Edit ] [ Delete ] [ Copyright Warning! Click for Details ]

---

[ Top of Page ] [ Contact Us ] [ Support/Wish List ] [ Copyright © 2007, Audio Asylum, all rights reserved ]

---

[ General ] [ Speakers ] [ Tubes ] [ Vinyl ] [ Digital ] [ Hi-Rez ] [ Video Asylum ] [ Cables ] [ Tweaks/DIY ] [ Music ] [ Films ]

---