Better Safe Than Sorry

Critical Microsoft Fixit

Bill has announced that an unpatched critical security hole in Windows XP operating systems is a genuine threat. A temporary patch using Microsoft Fix it is available here - after the .msi file downloads double-click it and the install is self-explanatory. Users who apply this patch will not need to uninstall it before applying the official patch when it becomes available towards the middle of July.

Critical Opera flaw - patch NOW!

If you use Opera and do not automagically update your installation you a) should ;) and b) need to manually update NOW to fix a gigantic security hole. After the update you better be running version 10.53 to be safe.

 

 

 

 

WiFi network finder - now with password cracker!

If you use a router and are still using WEP encryption then please read this.

I'll wait.

Ok.

Connect to your router and ensure you are using WPA or better yet, WPA2.

Palm Pre Security Hole

The recent Palm Pre OS has been found to have a major, glaring security gap because, since the browser is embedded into the OS, it's naturally vulnerable to various exploits (Javascript being the obvious one) making it a large target for evil-doers. A fix better come sooner rather than later to save the brand for the forseeable future. What were they thinking?

Adobe is the Winner!

Microsoft Word has been dethroned as the most likely point-of-entry for rogue software.

Files based on Reader were exploited in almost 49 per cent of the targeted attacks of 2009, compared with about 39 per cent that took aim at Microsoft Word. By comparison, in 2008, Acrobat was targeted in almost 29 per cent of attacks and Word was exploited by almost 35 per cent.

So, either use an alternative such as Foxit Reader or for a quick 'n dirty fix: Open Adobe Reader, click onEdit, Preferences, JavaScript, and uncheck the enable JavaScript box.

Internet Explorer F1 Key Flaw

If you use any of the last several versions of Internet Explorer you are advised to not press the F1 key if prompted by any web site. A flaw has been discovered that could open up your Windows machine (except Vista, way to go Bill!) to evil-doers. The Microsoft Security Advisory (981169) is here: http://www.microsoft.com/technet/security/advisory/981169.mspx

The quote from Microsoft below:

Successful exploitation of this vulnerability requires that users assist the exploit by pressing the F1 key on their keyboard. Our analysis shows that if users do not press the F1 key on their keyboard, the vulnerability cannot be exploited.

Consequently, malicious Web sites may attempt to persuade users into pressing the F1 key. Such a Web site could invoke an endless loop of dialog boxes that tell the user to press the F1 key to end the loop, or offer information such as pricing information or help to be revealed through the F1 key.

Users are advised to avoid pressing F1 presented by Web pages or other Internet content. If a dialog box appears repeatedly in an attempt to convince the user to press F1, users may log off the system or use Task Manager to terminate the Internet Explorer process.

Adobe .PDF Reader Critical Fix

Adobe has announced a patch for its Reader that is a must have as always.

It appears Adobe's software is highly unsafe and worse, breaks quickly giving the evil-doers more time to exploit the openings. Oops.

Details at Krebs on Security. And, Aviv Raff On .NET has apparently found the horrible Adobe Download Manager will re-install the evil

bits so make sure you un-install it as well. Firefox users should disable or un-install the Adobe Download Manager Extension/Add-on.

Adobe Flash Security Upgrade

Adobe has released an out-of-sequence update of its Flash Player that fixes two critical security holes in its Web browser plugin.

The latest version is now version 10.0.45.2. Visit here to check your version.

Also, remember that you will have to install the upgrade seperately for each browser you use so if you're like me well, Internet Explorer, Firefox, Opera and Chrome all need patching!

Firefox Update

Y'all better check yer Firefox to see that you are running version 3.5.5 - if you aren't then run a manual upgrade (Help - Check for Upgrades). You might also set Firefox to automagically download and install upgrades:

Shockwave Player Update

Your Adobe Shockwave Player should be upgraded to version to 11.5.2.602 which is available here. Don't know if you actually have this POS installed? Go here - if you see an empty box at the top that says "Click here to download plugin," then you don't have Shockwave installed. If you use Firefox you should see a yellow box at the top of the page saying, "Additional plugins are required to display all the media on this page". The security inplications of NOT upgrading can be mitigated by using the Firefox Add-on Adblock Plus.

Michael Duarf

Read this fine description of what bad guys are doing with your not-quite locked down Facebook account. If this sillyness keeps up I predict a large exodus from Facebook (starting with me). The fear of security breaches may be overblown but it is real. Don't be a victim. Remember, security is a process, not a product.

Facebook Hacking

A new applications on Facebook, "City Fire Department," has been compromised by hackers. The application had been modified to deliver an iframe which can bring content from one Web site to another. This iframe tries to exploit vulnerabilities to download a fake antivirus program called Antivirus Pro 2010.

A few of the other hacked or bogus applications are:

• MyGirlySpace
• Ferrarifone
• Mashpro
• Mynameis
• Pass-it-on
• Fillinthe
• Aquariumlif

Ok, here is the deal - When you find a wonderful new application on Facebook do a quick search on Google or bing to determine if anyone has had any problem with it. You can also wait, yes wait, for a day or two until enough newbies have started using it to provoke any disasters - if all is well after this then you might . . . might try it. Just make sure your Facebook preferences are locked down for maximum security. Or just don't use any of these silly applications until Facebook gets a grip and uses some mechanism to confirm these applications aren't a giant security hole!

Firefox Plugs Microsoft Security Hole

If you use Firefox (and you should, imho) you have probably already seen a pop-up alert informing you that it is blocking Microsoft`s .NET Framework Assistant and Windows Presentation Foundation add-ons that were stealthily installed by Microsoft earlier this year.

This hole was supposed to have been fixed earlier by having users edit the Windows registry - but this idea stunk because editing the registry is potentially dangerous. Microsoft later released a simple point and click removal tool - except this left behind the Windows Presentation Foundation plug-in which is what was just killed by Mozilla.

So, the confusion up to now has been addressed by both Mozilla and Microsoft to remove both nasty bits. Whew!

Adobe Reader Critical Vulnerability

It appears the ever popular Adobe Reader (version 9.1.3 and earlier) has a gaping hole that could allow bad people to take over Windows installs. This problem as popped up before. One way to mitigate (but not eliminate) the threat is to disable Javascript in Adobe reader and/or change your browsers behavior to download .pdf files as opposed to view them. You also might want to try the free alternative called Foxit Reader which has a better record when it comes to security issues. Just sayin' . . .

Third-party apps create insecure Facebook

Popular social networking site Facebook has exposed users to phishing attacks that use already hacked accounts to contact friends. Links presented to users lead to look-alike pages not associated with Facebook that may hold any one of 11 rogue scripts (and counting) that do bad things. Trendmicro has details here.

Until facebook tightens up the ship now heading for the shoals be very careful about using third-party apps. Yes, that means a large chunk of facebook, sorry. Do this . . . no, seriously . . . and facebook will adapt or die. Now if Leafs fans would just do the same.

Critical Firefox 3.5 Security Flaw

The newest Firefox, version 3.5, includes Tracemonkey, a new feature designed to speed up Javascript scripts. A flaw within Tracemonkey could allow attackers to remotely install evil software when users visit compromised Web sites.

A simple fix is available until the next patch fixes the vulnerability:

1. Open up a new Firefox window and type ‘’about:config‘’ (without the quotes) in your browser's address bar
2. In the ‘’filter‘’ box, type ‘’jit‘’ and a setting called ‘’javascript.options.jit.content‘’ will appear.
3. If the setting is set to ‘‘true’’ it means the option is enabled.
4. If it is, double-click on the setting. This should change the option to ‘’false‘’ disabling it.

Another Insecure ActiveX? You Betcha!

ActiveX flaws pop up on a regular basis so forget the explanation. Go to Microsoft and click the ‘’Fix It‘’ icon under ‘’Enable Workaround‘’ and following the instructions.

Security Update available for Shockwave Player

The bulletin and patch is here: http://www.adobe.com/support/security/bulletins/apsb09-08.html

Thanks, Security Fix

Twitter Awareness

The recent cross-scripting attack on the newest buzzword universe called Twitter is merely another bump on the rocky road through Interpipe 2.0

These XSS attacks are the bane of Web 2.0 and will cause disasters for individuals who refuse to become aware of their online surroundings. Compound this with users who remain clueless about what is running on their PC's and you have a large impediment in the push through to Web 3.0 applications.

Now add smartphones and netbooks to the mix ;(

For a fine write up on the Twitter XSS attack see: http://twittercism.com/protect-yourself-on-twitter/

Be sure to check out the fine tip from Twittercism about XSS busting using Firefox browser with the Add-on NoScript with screencaps from Better Safe Than Sorry here.

.pdf Fixes Released

Adobe has released a newer fixed version of its Reader application that addresses previously documented problems. Those wishing to upgrade a previous release will have to wait until March 18th.

Those using the popular alternative, Foxit Reader, should upgrade their installed version by using the upgrade link under the help menu:

FoxitReader doing its thing:

Success!

Adobe Reader Vulnerability

Evil-doers are actively exploiting a security hole in Adobe Reader. Users need only open a rogue .pdf file to have their system taken over.

Since Adobe doesn't plan to patch the problem until March 11th, 2009 users should either disable Javascript within Adobe Reader (Choose "Edit", "Preferences", "Javascript", and uncheck the box beside "Enable Acrobat Javascript") or use an alternative to Adobe Reader called Foxit Reader which is available here: http://www.foxitsoftware.com

Downadup Worm Awareness

The nasty worm dubbed Downadup.AL is reaching out and touching many people. F-Secure has a (beta) application to check your Windows system for infection - it's here: ftp://ftp.f-secure.com/anti-virus/tools/beta/f-downadup.zip. If you use Firefox browser (and why wouldn't you?) using the Add-on No-Script is a wise move to prevent this and other nasties from gaining a foothold into your system. Of course, running a software firewall, hardware router and and Anti-virus application is your best bet to remaining free of doom.

Phishing Targets Tweeter

The popular mobile service Tweeter has been hit with phishing messages. Nothing new about this. It is a good time to remind folks about the devious nature of these evil doers. Any method will be used to induce the unwary or stupid to visit sites that will attempt to upload all kinds of malware, spyware, trojans, etc. to your PC, smartphone or other device. The vector for this specific attack is the very popular 'TinyURL' online application that turns large, unwieldy URLs such as “http://www.somewhere.orf/really/long/directory/” into something such as “http://tinyurl.com/4d4a2” which can be remembered long enough to key into a browser. The problem is that the TinyURL could lead one to evil sites. Very bad. TinyURL's solution, which folks either don't know about or don't use or understand is to use the Preview TinyURL. In our previous example one should append the TinyURL with preview: “http://preview.tinyurl.com/4d4a2”. This will allow for the best practice of safely viewing a rendering of the intended target before actually visiting it.

IE Patched in Record Time

Microsoft has patched the critical flaw in its Internet Explorer browser in mere days. Good job! If you have Windows Automatic Update turned on you should already be patched depending on when you have set your PC to download and install the fix.

With more and more people aware of the problem it was incumbent upon Bill to fix the problem before even more folks ditched IE for more secure browsers such as Opera or Firefox. Either you're part of the problem or part of the solution and although Microsoft was late in embracing the Internet it seems they are moving towards being less of a vector for malware, spyware, viruses, etc. Let's hope the upcoming IE 8 is an even better experience for the vast number of users who, for some reason, never get the itch to try other browsers.

Severe IE Vulnerability

An unpatched vulnerability in Internet Explorer 7 (which also affects older versions of the browser as well) is on the loose. Microsoft has stated that IE 5.01 with SP 4, IE 6 with or without SP 1 and IE 8 (Beta 2) on all versions of the Window OS are affected. To complete the horror IE 7 on Windows XP SP 2 and 3 and Windows Vista with or without SP 1 are also vulnerable. Web sites are now actively exploiting the vulnerability. One has to merely view a Web site in order to have a Trojan horse program automatically downloaded to their machine. Once downloaded the evil doers can manipulate the rogue program to download other software which could perform actions such as sending spam emails or steal data. Since Microsoft's next patch is not due until January 13, 2009 one would be wise to use an alternative browser such as Firefox or Opera. Just sayin' . . .

WPA Cracked

If you use WiFi to connect to your Internet provider via a wireless router be aware that recently a crack has been found that could allow eavedroppers to detect your passphrase. The simple solution (for now) is to use WPA2 rather than the now vulnerable WPA. If by some chance you missed the memo about the much older WEP protocol you should have stopped using that years ago! If your router does not use WPA2 then ensure it is using AES encryption and not TKIP. Also be damned sure your passphrase is long (12+ characters minimum) and contains a mixture of lower case, upper case, numerals and characters. So, password IS NOT up to scratch. k*uh7%vg4Sk9jNVfdxq)( is just about right ;-)

Critical Patches Released for Adobe Applications

Adobe has released patches that fix at least eight security holes in both its Acrobat and Adobe Reader programs. These flaws could be used by evil doers to take control of vulnerable systems. Versions 8.1.2 and earlier are affected. Adobe has rated these updates as “critical” indicating that the flaws could allow attackers to comptomise an unpatched system without the users knowledge. The Windows update may be found here.

Critical Microsoft patch available

Microsoft has issued an out-of-band update. This is unusual as Microsoft rarely releases patches ahead of the usual once monthly Patch Tuesday. In this case the severity of the security hole has prompted them to wisely hurry the process along. This update is for XP and Vista although for Vista users it is not deemed critical. What the heck, do it anyway. If you have Windows Update all organized (as you should) you should be safe. If you are unsure if you already have the patch installed then go to Add/Remove Programs in the Control Panel, make sure the check box for show updates is checked:

and, when the list is finally displayed look for:

If it's not installed go back to the Control Panel and click on Security Center. Make sure all the settings for Windows Updates, your firewall and whatever anti-virus you use are all functioning as they should.

Facebook .zip attachment is Bad

People have been getting these fake Facebook 'Add Friends' emails.

The evil-doers attached .zip file contains, wait for it you plugs, a Trojan Horse. C'mon, steady, don't fall for that old trick.

Unless you are expecting an attachment don't accept it. Anti-virus blah blah updated frequently blah blah backup daily blah blah idiot, don't be an ;)

Facebook - MySpace Trojans

Both popular social networking sites, MySpace and FaceBook have both been attacked by an emailed virus that, should you download the plug-in as it suggests, sends large quantities of bogus emails. They contain trojans that Symantec has identified as gampass. This trojan is loooking for data on your system regarding gaming. Since this data may well include credit card numbers this is a problem. So, always be suspicious of any requirement for plugins above and beyond what you normally have installed. Keep your anti-virus software loaded and updated. Just because they are your friend on any social networking site does not mean they won't do something foolish that might well ensnare you. Remember, security is an ongoing process not a product.