Computer Viruses Evolve
New malware morphs into different shapes unattended by humans
Now this is quite a fascinating story, it seems the latest development is the accidental development of new super-malware strains created by viruses infecting executable files of worms. Worms are generally executable files and well, viruses infect executables – so you can imagine what happens.
Ten years ago, there was a clear-cut distinction between Trojans, viruses and worms. They all had their own features specific to one family of malware only. As more people connected to the internet, cyber-criminals started mixing ingredients to maximize impact. And here I’m thinking Trojans with worm capabilities or viruses with Trojan features, and so on. (more…)
No Recovery For You!
When consumers purchase personal computers, they should be given the means to restore/repair their operating system via an included LIVE CD/DVD, in NOT doing so by the OEM is just plain stupid. Bear in mind that as a Microsoft Windows licensee, meaning YOU, the thing with a Windows license is that you DO NOT OWN the software, you DO NOT OWN the product, that you are paying for and by receiving a license to use that software under the terms given, you must abide by them, whether you like it or not. That doesn’t sound to user friendly does it?
What you typically have included with you computer, is a recovery CD (best case), perhaps a recovery partition that just re-images your partition setting everything back to the way it was originally or nothing at all (worst case), none of these truly do fix anything. Normally the best way to accomplish this feat is to boot from a Linux LiveCD to recover your files. (more…)
Windows Patch Tuesday – January 2012
For the swiss cheese of operating systems, Microsoft plans to start 2012 with a surprisingly large Patch Tuesday that covers seven security bulletins which collectively address eight separate vulnerabilities. Previous January releases have normally featured only one or two bulletins. The solitary critical bulletin in the batch fixes a remote code execution issue in Media Player. The remaining six “important” bulletins due next Tuesday handle the BEAST SSL issue, which is short for Browser Exploit Against SSL/TLS. The stealthy piece of JavaScript works with a network sniffer to decrypt encrypted cookies a targeted website uses to grant access to restricted user accounts.
In the patch are other various information disclosure bugs, escalation of privilege issues and an update to Microsoft’s SEHOP (Structured Exception Handler Overwrite Protection) technology to enhance the defence-in-depth capability that it can offers to legacy applications. The first six bulletins affect various versions of the Windows Operating System, from XP SP3 up to the newest versions Windows 7 and Windows 2008 R2. The seventh bulletin covers Microsoft Developer Tools.
The “important” rather than critical status for the Beast SSL issue is at least debatable. The BEAST attack affects web servers that support SSLv3/TLSv1 encryption. Microsoft has already published a workaround, which involves using the non-affected RC4 cipher in SSL installations. A patch was originally promised in December but delayed until this month due to problems uncovered during testing. “Despite all of the hype over ‘The Beast’, attacks have simply never materialised and the issue has retained its ‘important’ classification from Microsoft,” notes Paul Henry, a security and forensic analyst at Lumension. Adobe and Oracle have both timetabled quarterly updates, on 10 January and 17 January, respectively in what promises to be a busy month for patching
Exercise your Computer
It’s always kind of surprising to me how many people don’t really bother to maintain their PC. A lot of folks seem to think that they can simply let their computer run without any sort of user intervention at all. The trouble is, it doesn’t work that way. As with one’s vehicle, which needs timely maintenance, so does your computer. Your computer’s is a complex, intricate machine, and it needs to be well-cared for in order to properly function, if not you will suffer problems down the road.
What’s more, it’s not just the hardware of a system that has a tendency to degrade over time. Modern computers are complex, intricate pieces of technology- fifty years ago, people wouldn’t have even dreamed this sort of stuff existed. As with any complex system, sometimes things tend to go wrong. A glitch in the software here, a misplaced line of code there, and boom. What’s shocking isn’t the fact that there’s literally thousands of ways a computer could break down and simply stop working. No, what’s shocking is that most of these issues, most of these errors, are preventable. Windows users suffer through lot’s of problems, this is why I openly advocate Linux.
Here’s a few exercises (primarily meant for Windows users) that you should do, to ensure that your computer is in top working condition.
$35 Personal Computer
Some people may dismiss this idea, but I see the real genius behind it. Using one of these devices, you would be able to browse the web, shop and do your online banking securely without worrying about picking up computer viruses or malware.
Budding computer hackers/scientists are about to get a welcome gift, albeit a bit late. The non-profit Raspberry Pi Foundation (RPF) is nearing the release date of its surprisingly powerful and remarkably affordable Raspberry Pi line of bare-bones machines that have been developed in an effort to broaden kids’ access to computers in the UK and abroad. How affordable? The figure above was no typo. Read on to learn just what US$35 will get you when these nifty, fully-assembled, credit-card sized computers go on sale next month (sorry, case, monitor, keyboard and mouse not included … we did say bare bones).
Early models of the Pi will be offered in two versions. The first, Model A (US$25), will sport 128M of RAM but no Ethernet port. Presumably, most of these will end up in educational use. The second, Model B (US$35), will have a larger production run and offer 256M of RAM along with 10/100MBit networking capability. Both are powered by 700MHz ARM11 CPUs and include hardware support for OpenGL ES 2.0 and Blu-Ray caliber (1080p30 H.264) playback. (more…)
Free Java Exploit
An exploit for a recently disclosed Java vulnerability that was previously only available for purchase in the criminal underground has now been rolled into the open source Metasploit exploit framework. Metasploit researchers say the Java attack tool has been tested to successfully deliver payloads on a variety of platforms, including the latest Windows and Mac systems.
The Java exploit is being sold on cybercrime forums and incorporated into automated crimeware kits like BlackHole. Since then, security researchers @_sinn3r and Juan Vasquez have developed a module for Metasploit that makes the attack tool available to penetration testers and malicious hackers alike. According to a post on the Metasploit blog, the Java vulnerability “is particularly pernicious, as it is cross-platform, unpatched on some systems, and is an easy-to-exploit client-side that does little to make the user aware they’re being exploited.”
Metasploit also posted the results of testing the exploit against a variety of browsers and platforms, and found that it worked almost seamlessly to compromise systems across the board, from the latest 64-bit Windows 7 machines to Mac OS X systems. (more…)
Windows Patch Tuesday – December 2011
Patch up warmly this winter if you’re running Java, as Oracle’s software platform is the single biggest target for hackers. Java proved the single most popular target in the 12-month period to the end of June, according to Microsoft’s latest Security Intelligence Report has found here. Running Java as a Web-browser Plugin is much more dangerous than Flash, and you should disable the Java Applet Plugin.
Microsoft today issued software updates to patch at least 19 security holes in Windows XP, Vista, 2003 and 7 (no surprise there), including three flaws that earned the company’s most serious “critical” rating. Separately, Oracle released a security update that fixes several issues in its Java software. (more…)
Automatic Computer Malware
According to a Security Intelligence Report from Microsoft, AutoRun—the feature in Windows that automatically executes files when you plug in a USB or connect to a network—accounts for almost half of all malware infections. These are infections that don’t require any user-input from you, so it’s kind of not your fault that your computer gets infected. By turning off AutoRun, you’ll add an extra step to certain tasks, but it’s worth it to cut down on malware 50%.
This report states that Windows XP SP3 systems get infected about ten times as much as Windows 7 SP1 64-bit systems, and six times as much vs. 32-bit Windows 7 systems. That alone is one reason why you might want to upgrade your parents’ machines to Linux. bear in mind that Windows XP should have been mostly fixed back in February of 2011. See Microsoft Security Advisory 967940. The update does not disable auto-play for CD nor DVD media, but only USB drives, external hard drives and network shares. (more…)
Save on Software
In this day and age of technology, computer applications are a dime a dozen. There are apps available for the various different desktop operating systems and even more for the varying mobile platforms. This makes it important for the user to get one that suits his or her needs perfectly. One may only know about which commercial apps are popular amongst organizations, while remaining ignorant to the numerous apps produced by niche communities. One may spend money on a program when he or she could have gotten a better one for cheaper, if not free. That said, there is a strong need for parties to consider all of their options before deciding on which software to use for what purpose. (more…)
Android Steals Market
New data on mobile usage shows the number of smart phones continues to grow rapidly, increasing 12% from June of 2011 to 87.4 million in Sept. of 2011, and that the Android platforms continues to grain market share, hitting 44.8%. The data, which shows a three month average for the period ending Sept. 2011 and is based on a survey of over 30,000 U.S. mobile subscribers by the comScore MobiLens service, is notable because it once again highlights the growing importance of the Android platform for the mobile strategies of media and entertainment companies. (more…)
