Subscribe in a readerWindows Steady State
If you use Window XP or Windows Vista, Microsoft has a tool that could be useful to some people. It’s meant more for shared computers, or for any PC that’s at greater risk of infection.
What it does is fairly simple. Every time you reboot the PC, Steady State will restore it to how it was before. So no matter how many viruses, spyware and adware you end up accidentally installing. it becomes fresh and anew.
You need to install it and set it up correctly, and for most people it might be a good idea to get some advice from someone who’s IT savvy, just to make sure you take full advantage of this great tool.
Best of all is that it’s free, as long as you have a genuine Windows XP or Vista license.
While you should still be responsible with how you use a computer, what you download and which web sites you visit, this tool is great tool for certain people.
More info and a download link here.
Bluetooth Patching
Microsoft has just released June’s lot of Windows patches for XP and Vista. Among the latest patches is one to fix a vulnerability in the Bluetooth stack.
If your computer uses Windows XP or Vista and it has Bluetooth then you need this patch. If your computer doesn’t automatically download and install patches you’ll need to go to Internet Explorer, go to the Tools menu and select Windows Update. Until then you should turn off Bluetooth, otherwise someone could take control of your computer.
Bluetooth has always had security problems from the start. There have been a few fixes along the way but overall it’s an insecure technology.
Technical details about this patch here.
Malware in Resumes
Recruitment companies receive a lot of resumes in Word format, as you’d expect. But it seems that there’s a growing trend of these Word files being infected with some type of malware. Often there is automated software at recruitment companies to forward the resumes to their clients without scanning them for malware.
Hackers have caught onto this and are targeting these companies. They’ve been sending resumes (probably not their own) with backdoor trojans embedded in the document. This gives them a chance to gain access to these networks.
If your work involves receiving many Word documents from the general public put in place a plan to screen these for known malware, and to limit the damage they can do if a new (unknown) trojan gets through. Most security specialists can help with this.
Adobe Flash Flaw
This week everyone’s been talking about a new flaw in Flash that can be exploited to run malicious code on your computer. After a few days of media frenzy Adobe has released a fix for it.
If you use Windows then download the update (this includes users of FireFox, Opera and Internet Explorer). Link here.
The fixed version is 9.0.124.0. If you’re keen you can read more about the vulnerability here.
Orphaned Accounts
An interesting study on orphaned accounts has found some serious security holes.
An orphaned account is when someone leaves an organisation and their network account remains active, instead of being disabled (locked). In a lot of cases those people who have left could still log onto their previous employer’s network and access files and services.
The study found that 27 percent of people reported that they had more than 20 orphaned accounts on their system. If everyone did their job well ideally it would be 0.
38 percent of people said they had no way of knowing if a terminated employee had logged into their system. Security auditing is very important and not very difficult, without it IT managers won’t know who’s doing what on their network.
In other words, in about 27% of companies if someone left they could still log in from home, copy files, send emails, and otherwise use the system the same as when they were officially employed. And in 38% of cases nobody would ever find out.
So how long should it take to terminate an account? Accounts should be disabled at the end of the employee’s last day and not a moment later. In some companies there’s so much bureaucratic admin that, according to the above article, it ends up taking 3 days to a month to do this. Shocking.
It’ an organisation it should be everybody’s responsibility to protect the network and all private data. If your organisation is slacking in this area say something about it.
SSH Brute Force Attacks
SSH is used to establish secure connections across the internet. For example a lot of people use SSH to connect to their servers because of the good security it provides. Lots of people trust it and rely on it.
In the past week there has been a large increase in the number of brute force attacks against SSH. What’s a brute force attack? It’s when someone writes a program that starts guessing passwords. It’ll keep trying to guess passwords all day and all night without rest until it finds something that works. The smarter brute force attacks do this slowly so that servers don’t lock the account in defense.
To increase a hacker’s chances of finding the right password these brute force programs use a dictionary and try to guess common words first. Then they try combinations such as replacing o’s with zeros, or putting a 1 at the end (have you ever done this with passwords?). So if your password is based on a word found in the dictionary it’ll be amongst the first ones tried.
The best defence against brute force attacks is to use a complicated password. Complicated passwords can take years to guess, simple passwords can take seconds to guess. Read here about how to evaluate the complexity of a password. And if remembering complicated passwords is a challenge then you might need a password safe.
So back to SSH. If you manage a server and use SSH to connect to it, have a look at the logs. Other people have reported a 5-10 times increase in the number of SSH attempts on their servers. Make sure your passwords are complicated enough to resist brute force attacks. Consider editing firewall rules to limit the entry points into your network. And make sure everything is patched including routers and firewalls. See this article for further information on these attacks.
And for everything that’s still wondering what SSH is, don’t worry about the jargon. Just realise that people can and do try to guess passwords.
Phishing Audits
Some companies have started testing their employees on how they respond to phishing attacks.
A company called Intrepidus Group has a system whereby they basically send your company’s staff spam, testing them on how they respond to it. The system can even concentrate spam on people who are ore susceptible to clicking on links.
The system sends results back to the tester on who clicked on the emails, what data they entered in (e.g., their name, credit card numbers, etc).
So the next time you see an email that doesn’t look quite right, and has links to external sites, think hard whether it’s real, spam, or this new kind of "ethical" spam.
The company’s web site explains it better, http://phishme.com/
Password Safes
Password safes are programs that store your passwords. In general they’re a good idea because:
- You have less reason to reuse passwords (having a unique password for every site is much safer)
- You can use more complicated passwords without risk of forgetting them
- If you forget a password you rarely use you can easily retrieve it
- In a business it’s easier to share passwords and control who has access to what (especially in IT departments)
Below are some examples of good password safes:
And this is an example of something that looks good but still isn’t a good idea:
If you use a hosted service like this you’d be giving your passwords away to another organisation. They promise not to look at them. How comfortable would you be trusting someone you haven’t met to hold the password to your online banking?
This comes from their own web site and it should give you an idea (it’s in their FAQ page):
While we take every security precaution, we do not recomnmend storing sensitive information such as bank account passwords.
In summary:
- It’s ok to store your passwords on your own PC
- It’s not ok to let some other person or company store them for you
- Ideally if you store the passwords on your PC you should:
- Use a good password safe that encrypts them, like the ones above
- Use a good anti virus package to ensure you don’t have spyware on your PC
- Keep your PC in a safe place, like in your home or in a locked office
- Keep backups (in case your PC dies) and store the backups in a safe place
- Don’t do this on a shared computer, including some office computers
Side Note: The 3rd of May was the 30th anniversary of spam.
Update: HP Software Update Tool
Back in January I mentioned that HP’s Software Update Tool was vulnerable to attacks. That was limited to a support program installed on HP laptops. Now the problem appears to be worse than first thought.
A large number of HP’s printers (both laser and inkjet), scanners, cameras and PCs also include this tool. Version 4.0.9.2 or earlier is vulnerable. The problem has been resolved in the latest update, version 4.0.10.8.
So if you have an HP product on your computer check if HP’s Software Update Tool is installed, and the version number. You might need to upgrade it.
The risk is that a malicious web page can be created that activates some code in HP’s Software Update Tool and it can execute code on your computer. This is OK if you’re allowing HP to update your drivers, but it’s a bad thing if random strangers can do this.
Note that this only affects Windows users.
AVG 8.0 Released
AVG has released a new version of their anti virus program. It comes in three versions:
- Free
- US$35
- US$55
8.0 was just released, the main new features are:
- link scanning
- anti spyware
- Email and instant messaging protection
The difference between the three prices are the features included. See this chart for details.
BT Home Hub Wireless Networks
Wireless networks can be made safe but it’s so common to find networks that haven’t been secured properly. It’s even worse to see ISPs giving their customers routers that have been configured with weak security.
BT Broadband in the UK has been supplying wireless routers to their customers, called BT Home Hub, setup to use a very weak security system called WEP.
In fact it’s so weak that anyone sitting within wireless range (which can include a few of your neighbours) can just guess the wireless password in 80 attempts. And you wouldn’t even know someone’s trying to guess your password.
WEP is an old security system made for wireless routers, it’s been cracked before and it’s really no safer than an old rusty padlock with the key hidden in a pot plant. As the old saying goes, it keeps out honest people. WEP is practically useless. And BT Home Hub leaves it setup this way for their customers.
What everyone with a wireless network should do is change WEP to WPA. WPA is considered safe at the moment. And it’s best used with a long password (20 characters long).
To learn more about securing a wireless network read here. And to understand why it’s important to secure a wireless network read our article here.
Just remember, WEP = useless, WPA = secure.
FireFox and Safari Updates
The FireFox and Safari browsers have been updated. If you use either of these then you should upgrade today. The new version numbers are:
- FireFox: 2.0.0.14
- Safari: 3.1.1
This applies to Windows, Mac and Linux users. The updates fix vulnerabilities and hence are important security updates.
ActiveX Flaw in Symantec Products
Symantec is well known for making security products (they also use the Norton brand for home products). A serious flaw has been found in some of their products including Norton AntiVirus, Norton Internet Security, Norton SystemWorks and Norton 360.
The flaw is in an ActiveX control that gets installed on the PC (the control is called SymAData.dll). This control is normally used for their AutoFix tool, however it was discovered that it can be exploited by adding some malicious code to a website. The exploit allows someone to take over the computer (generally a bad thing).
Two ways to fix this problem are:
- Engage in an online chat session with Symantec’s technical support team
- Download the patch from Symantec’s website, https://www-secure.symantec.com/techsupp/asa/install.jsp
Earlier we wrote about problems with ActiveX and suggested you disable it.
2Wire Modems
2Wire is a DSL modem manufacturer. Earlier we reported that a Mexican ISP offers 2Wire modems to their customers and that there was a vulnerability in them affecting their customers. The vulnerability is called DNS poisoning.
Many other ISPs also offer this modem to their customers including AT&T. AT&T has taken some positive action to fix the issue, so if you’re an AT&T customer using a 2Wire modem then have a talk to them and see if your modem needs patching.
An AT&T spokesman, Seth Bloom, responded to a Slashdot article and had the following to say:
“The majority of our customers did not have gateways affected by this vulnerability. For those that did, as soon as we became aware of the issue, we expeditiously implemented a permanent solution to close the vulnerability. In fact, we’ve already updated the majority of affected 2Wire gateways, and we’re nearing completion of the process. We’ve received no reports of any significant threats targeting our customers.”
Malware Statistics
Symantec, a large security company, have reported that there are now more malware writers than legitimate software writers.
They state that 65% of the 54,609 Windows applications released to the public in the past 6 months were malicious.
Another interesting statistic from this report is the percentage of browser plug-in vulnerabilities:
- 79% ActiveX
- 8% QuickTime
- 5% Java
- 5% Flash
- 2% Windows MediaPlayer
What this means is that by disabling ActiveX from your web browser (Internet Explorer) you can avoid 79% of web browser plug-in attacks. Here’s an article on how to disable ActiveX.
As for the other types of plug-ins, keep them patched and up to date to reduce the risk of infecting your computer.
Here is Symantec’s internet security report.
HP Flash Drives Ship With Malware
Hp flash drives were found to contain malware. These devices were sent as promotional items with new Proliant Servers.
Both 256MB and 1GB USB drives were infected with worms (W32.Fakerecy and W32.SillyFDC), and the worm can copy itself to all other mapped drives on your network.
This is particularly bad because IT technicians generally install these servers and generally have access to quite a few network drives.
HP’s software security response team admitted to the fault and has issued the following list of servers that shipped with the infected USB drive:
ProLiant BL20pG4; ProLiant BL25pG2
ProLiant BL45pG2
ProLiant BL260c
ProLiant BL460c; ProLiant BL465c; ProLiant BL465cG5; ProLiant BL480c
ProLiant BL680cG5; ProLiant BL685c; ProLiant BL685cG5
ProLiant DL120G5; ProLiant DL140G3; ProLiant DL145G3; ProLiant DL160G5;
ProLiant DL165G5; ProLiant DL180; ProLiant DL180G5; ProLiant DL185G5
ProLiant DL320G5; ProLiant DL320G5p; ProLiant DL320s; ProLiant DL360G5;
ProLiant DL365; ProLiant DL365G5; ProLiant DL380G5; ProLiant DL385G2;
ProLiant DL385G5
ProLiant DL580G4; ProLiant DL580G5; ProLiant DL585G2; ProLiant DL585G5
ProLiant ML110G4; ProLiant ML110G5; ProLiant ML115; ProLiant ML115G5;
ProLiant ML150G3; ProLiant Ml150G5
ProLiant ML310G4; ProLiant ML310G5; ProLiant ML350G5; ProLiant ML370G5
ProLiant ML570G4
IP Console Switch with virtual media
Server Console switch
Server Console Switch with virtual media
TFT7600 (USB Pass-through)
1U Rackmount Keyboard with USB
This kind of threat isn’t limited to HP customers. Any device you plug into a USB port can potentially carry malware. Therefore you should always have a good antivirus program running on your computers.
A while back we reported on similar incidents: Digital Picture Frames with malware, MP3 players sold with malware
-
-
Ads
-
-
Stats