Adobe Updates

Time to update again. Adobe has a patch available now for Flash Player and Adobe Reader/Acrobat will have an update sometime tomorrow. It is critical that you patch these as attackers are using exploits against Adobe applications to install their malicious software.

Microsoft to Issue Out-of-Band Patch

Next Tuesday, Microsoft has announced that they will be coming out with an out-of-band patch next week(072909). If you don't have updates downloaded automatically, you may want to start checking for update on Tuesday after you get home from work.

This will be only the third time that Microsoft has issued an out-of-band security patch in the past 25 months. This of course is due to the seriousness of the vulnerability that is currently being exploited by the bad guys out there in the Internet world. If you aren't familiar with Microsoft's schedule, they regularly schedule patches to be released on the second Tuesday of each month. This allows business to react, and prepare for their release.

Stay safe out there and have a fabulous weekend!!

Firefox 3.5.1 Has Serious Vulnerability

Well, Friday, the Firefox browser came out with a patch for a vulnerability that was announced last Monday. OK, I thought cool. They patch fast. Well, I mean the next day, it was announced that the newly released version of the Firefox browser has a serious vulnerability.

The Internet Storm Center has a write up on this you can read. Click here to read that post in the ISC Diary.

Hope your weekend was fabulous. Monday is just around the corner. Be on the watch for a patch for the Firefox browser soon. I'll let you know. Stay safe.

Another Reason to use Firefox Browser

Last week and this week, Microsoft has had two pretty serious 0-day vulnerabilities that allowed an attacker to get the ability to run code on the target PC. Now with Patch Tuesday being this week, Microsoft was able to correct the DirectShow fix on Tuesday. However, the new one that I wrote about in the previous post is not. One wonders how long it will be before a patch is in place.

Now, proof there is another reason you really should be using the Firefox browser as your primary browser. Early this week, it was announced that Firefox had a serious 0-day. I have stated in the past, there really isn't a browser out there that doesn't have problems with security vulnerabilities. However, the key is, how quickly do they get patched. The window of opportunity for bad guys to take advantage of 0-day vulnerabilities in Firefox are just smaller. Today, if you are a Firefox user, make sure you get the update 3.5.1 that will correct the current problem.

If you don't use Firefox, try it. It is free and has some great addon's that you can use to protect yourself more. I personally use Noscript which I recommend you do too.

OK, have a fabulous Friday and stay safe out there.

Microsoft Announces ANOTHER 0-Day

OK, the last post was an article on a 0-day vulnerability in the DirectShow ActiveX control. I pointed you to a work-around until they will patch the problem. Sounds like they will be patching it tomorrow (Patch Tuesday). On the heels of that announcement, Microsoft says there is another 0-day in their Office products. It works the same. Bad guys will compromise sites that re-direct you to their malicious site. If they can get you there, your PC will be compromised. Really bad stuff.

The Internet Storm Center has a great write up here on this problem and also gives a link for you to "Fix It" which is similar to the work-around for last week. If you use Internet Explorer you will really want to visit the ISC link and click on the "Fix It" link. Another work-around, is to use an alternative browser like FireFox. I recommend it.

Stay safe, and have a fabulous week. Happy Patch Tuesday for all you Microsoft users!

Microsoft Warning Users of Unpatched Flaw

The folks from Redmond, Washington (MS) are warning folks that cyber criminals are targeting a previously unknown security vulnerability in Windows XP and Server 2003 to compromise PC's. Microsoft has instructions on how to protect yourself from this flaw.

Microsoft said that the vulnerability can be used to install malware on the victim PC if they can get you to browse to a hacked or booby trapped Web site that the criminal controls. The Internet Storm Center is warning folks to take action now due to a report that thousands of newly compromised Web sites have been seeded with the exploit code for this vulnerability. The ISC is also reporting that the exploit code has been posted to numerous Web sites in China. Symantec is reporting that one site that is now seeding this attack is the Russian Embassy in DC.

The flaw is in Internet Explorer versions 6 or 7. Seems that Internet Explorer 8 is not vulnerable to this attack.

Microsoft says that the problem lies in the DirectShow ActiveX Control. They are reportedly working on this to get a patch released soon. The normal Microsoft patch cycle is due to be released on the second Tuesday of July. Not really sure that they will be able to get a patch ready by this date so they are recommending to folks that they should consider disabling the feature because there doesn't seem to be any by-design uses for this ActiveX control in IE (Internet Explorer). Most folks out there use IE as their default browser so this is VERY important. To enable the Microsoft work around, click here, then click on the "Fix This Problem" icon.

Microsoft is also saying that "while Windows Vista and Windows Server 2008 customers are not affected by this vulnerability, we recommend that they also implement the workarounds as a defense-in-depth measure." To read more information on this topic, click here to view the Internet Storm Center post.

Stay safe out there and if you are on the vulnerable systems, take this action now. Have a fabulous rest of the week.

Social Networking Sites - Be Careful

Have you signed up on a social networking site? If you have, you've joined literally millions of others who are on FaceBook, MySpace, LinkedIn, and Twitter just to name a few. If you've signed up for any of these networks, you have probably wondered if there are security risks involved in participating in them. There risks associated with them and they are all related in one way or another.

First, the one common thread in all social networking sites is that you can associate (network) with friends and family, or work associates and share information with them. There is an inherent trust built in that if I allow you to be in my network, I trust you that it is really you and if you post anything, I'm assuming that it is you. Criminal hackers take advantage of this trust that is built in and if they can steal your login credentials to your account, they can pose as you and send all the friends in your network a message with a link that leads to a malicious web site. If successful, your friend's PC will have malicious code installed on their PC and this allows the criminal hacker to continue to take advantage of others as this process is repeated over and over with each friend who clicks on the malicious link.

Another risk of these social networking sites is what you actually post on these sites. One of the things you can do is share pictures with family and friends. You need to think twice before publishing certain pictures. One rule of thumb you should remember before you post anything on any web site is not to post anything that you don't want everyone to see. Even if you have posted a picture as "private", there have been instances in the past where the actual site you post pictures to has vulnerability in their systems which allowed "private" pictures to be stolen.

When you sign up for these sites, you can fill out a profile of personal information that you should limit what is available. For instance, you can add your birthday and you may choose to only put the month and day and drop the year of your birthday. Your birth date is one personally identifiable piece of information used in many things and you may want to exclude sharing the year of your birth. It is also a good idea not to post your phone number or your full address.

This one is specific to Twitter. First, what is Twitter? Twitter is a micro blogging system that allows you to share your status with anyone who follows you. These are called "tweets". These tweets are limited to 140 characters. Some folks who use Twitter like to share links to web sites that give you more information on a topic. Since links to web sites can be long, they use services that take a long web address, and shorten it. There are services like Tiny URL that do this. Criminal attackers have hacked high profile accounts that include CNN, the Obama campaign, and celebrities such as Brittney Spears. With control of these accounts, they can then abuse the trust issue mentioned earlier in this article and send out malicious links.

What can you do to protect yourself? Here are a few things.

• Keep your home PC patched which includes Microsoft updates as well as Adobe, QuickTime, and iTunes, just to mention a few.

• Think twice before posting any picture. A good rule of thumb is not to post anything that you wouldn't want everyone to see.
  

• Limit what information you share in the profile section of social networking sites.
  

• Trust no one. If a friend sends you a link, treat it like you have been trained with phishing e-mails. Don't click on unsolicited links.

Criminal Attacker Blamed for Topeka Health Clinic Loss

I live in northeast Kansas. You read stories all the time of companies being the victims from some criminal attacker who is able to place a piece of malware on PC's and stealing money. Well, the headlines read that a Topeka health clinic, Sisters of Charity Marian Clinic, filed charges of a loss of $100,000 from their bank account. It is sad to read things like these, but in my line of work, it doesn't surprise me. Click here to read the Topeka newspaper story.

I'm sure that computer security awareness was not a part of the clinic's budget. They probably didn't have much of a budget at all for that matter for computer security. This could have happened a couple of different ways. It could have been an e-mail that came in that had either malicious links or attachments that someone from the clinic clicked on. This would be my guess as to how this happened. Or, it could have been just casual browsing on a legitimate website that had been hacked and malicious code injected that redirected them to a site which attacked the computer.

This computer was probably not patched. Probably Adobe Reader was an older version, or Microsoft patches that were not up to date. It doesn't matter what the vulnerable application was, it happened and it sucks that an organization that does what the Sisters of Charity Marian Clinic does, has to suffer such a loss.

Hopefully they can find out who was behind this, but the chances are, the responsible parties are located in a country that we have no way of getting to them. Possibly and eastern European country like Romania, or possibly Russia, or China will be where they were located. Hopefully the clinic will take computer security much more serious now. Knowing Topeka, there aren't a whole lot of options for the clinic to get the education they need so they will probably turn to the Geek Squad (I really hope not).

I guess the lesson learned is if you are doing financial transactions on a PC, you really need to make sure that patches are up to date, the machine is scanned often, and don't rely on just anti-virus alone. There are other options for you that will help protect these assets so things like this won't happen again also.

Stay safe out there, and have a great rest of the weekend.

June's Patch Tuesday

It's patch Tuesday for all you Microsoft users. That accounts for most computer users. If you don't have your computer set to download your patches automatically, you ought to go do that right now. This month is a busy Patch Tuesday. Also today is the start of Adobe pushing out regular updates to their software. We'll see how this goes. Adobe has a horrible reputation at this point when it comes to having vulnerable software (Adobe Reader, Acrobat, etc.) that the bad guys are using regularly. Hopefully this is a start to making a bad situation better.

Have a great week!

Patch Tuesday Happens - Make Sure You Patch

Well this past Tuesday, Microsoft pushed out 8 security patches that corrected at least 23 security vulnerabilities in Access, Word, Internet Explorer just to name a few. With all the talk in the national media about the April 1, Conficker Worm, this should make people check and verify that your updates have worked.

It is very important that patches happen, and the Conficker Worm should be your example. Microsoft came out late in October of 2008 with a patch (MS08-067). Many folks didn't update with this patch. Actually, millions of PC's didn't have the patch. So this allowed the criminal element behind Conficker to spread itself so fast and so successful.

So this is your reminder that patching is extremely important. Make sure your PC is set to download your Microsoft updates automatically. You can either select to install them automatically or notify you when updates are needing to be applied.

Another weekend is drawing to an end so lets get ready for the new week. Stay safe and be careful out there.

A Conficker Update

I wrote on March 31 about my thoughts on what would happen on April 1 when the Conficker Worm was supposed to come to life and melt the Internet as we know it. All the major media outlets running stories on this major outbreak of malware on the Internet...like it just started. I say to this, welcome major media outlets. The Internet has been infected for a long time. Taking steps to protect yourself should be done in order to not have personal information about you stolen by cyber criminals.

Why all the hype? Probably the main responsibility for spreading the hype was all the security vendors such as AV vendors, and other companies dealing in computer security. Nothing really happened April 1. Now on Thursday of this past week, the Conficker Worm started to push payloads to the infected hosts out there on the Internet. Things that were seen included keyloggers, rootkit functionality, and rogue anti-virus or fake AV which has been common in the past 6 to 9 months.

If you patched your Windows OS when they came out with updates in October of 2008, and use strong passwords, and disable autorun, you are probably just fine. You must always be on the lookout for new attack vectors. The bad guys are out there and they want to gain financially at your expense. Learn to protect yourself. I have many posts in the past that should help you in taking the steps to stay safe.

Stay safe, hope your weekend was fabulous and bring on the new week!

Media Hype about Conficker

The major media outlets are shouting from the mountain top about this horrible virus that will ruin the Internet as we know it. In my opinion, not much will happen April 1. Actually the USA only accounts for 5.8 % of all machines that are compromised. I don't normally watch CBS's 60 Minutes but I stopped when I heard the story about Conficker. If you saw the examples they showed, it is all true. You can get malware on your PC even if you have a firewall and AV.

What people should worry about is what happens after April 1. The criminals behind Conficker don't want the Internet to meltdown. This is how they make their money. And where are these attackers from? Most likely China, Russia, or some other Eastern European country.

Microsoft issued an out of band patch back on 10/23/08 that closed this vulnerability. Do you patch? If not, I preach it. Look up prior posts that I've written about on ways to make you more up to date with security patches. I recommend that you go to Secunia and download their client that helps you keep up to date on Microsoft, Adobe, and many other vendor software.

So when you wake up tomorrow, I'm sure that the Internet will still be there. You will be able to check your FaceBook, Twitter, etc. Not much will change. Just realize that the Internet is full of malware. They really know how to evade security software by morphing so that security vendors can't get a good signature of the virus. The Internet is already full of malware today. It will be full of it tomorrow. Learn to be more secure. Realize that it is a risk to be on the Internet. Learn to accept the risk and have fun.

Stay safe and have a fabulous April Fool's Day.

Holding Your Documents for Ransom

Well we've talked several times over the recent past of the evolution of the rogue anti-virus malware that has been working like a charm. It basically is malware that says your PC has malware and you need to buy their product to clean them. Well those behind these types of attacks have now started a nasty twist. It isn't the first time. This has been done in the past.

They take all your documents in the "My Documents" folder (default doc folder for Windows) and encrypts the files. And for a fee, say $50 they will let you have your documents back. Pretty nasty trick I'd say.

Some of the things we've talked about in the past to combat these is to keep your applications such as your Windows updates current as well as RealPlayer, WinZip, WinAmp, QuickTime, Adobe Reader and Flash, as well as iTunes. Keeping these up to date will not allow the criminal attacker the ability to run code remotely on your PC. Check back on some of my previous posts that help you keep you PC humming along.

Posting this on Sunday and my KU Jayhawks rolled into the Sweet 16 in this year's March Madness tourney. Good luck next weekend guys and lets keep it rolling! ROCK CHALK JAYHAWK!!!

Huge Botnet Being Built by Downadup

A huge number of PC's are being compromised because they lack the patch for MS08-067. This was one of those out of band patches Microsoft came out with in the 4th quarter of 2008. Patching your Windows PC is so very important. F-Secure, a security research firm has been tracking this over the past week. I'm linking you to a story out of ComputerWorld.com. Click here to read how this botnet is growing super fast.

Might want to check out the patches that are installed on your PC. Make sure that you have MS08-067 installed. Run your Microsoft update to see if you are up to date.

Hope you all are having a great weekend. Stay safe.