Category: internet explorer

Internet Security Companies Warn about Patch Tuesday and Valentines Day.

Paul

With Tomorrow being released some very highly rated Remote Code Execution to become Zero day in very short time. Some researchers are speculating about more viruses will be released in conjunction to Valentines day. According to this one post it will be likely to be E-cards being sent to try to lure you into downloading Malware.
[ad#ad2-right]

Various security vendors, including CA Inc, MX Logic Inc., Trend Micro Inc., and Panda Security, have issued alerts about new Valentine’s Day-themed spam campaigns that try to dupe users into installing the Waledec bot.

Researchers note that many websites which are affiliated to Waledac e-card scam have been recently updated with content based on the Valentine’s Day theme.

Web sites distribute Trojan files which are commonly named love.exe; onlyyou.exe; you.exe; youandme.exe; and meandyou.exe and the list is not exhaustive.
[Via Express Buzz]

So which ones will likely be the exploits they will use? I have a few theories on that and One of them is the INTERNET EXPLORER vulnerability that will be patched and will try to get you to launch the link and will most likely try to launch it in Internet explorer, That would be my guess.    It seems to be Internet Explorer 7 and Below which will be patched so if you want to try out the IE 8 Beta,  You should be safe on that.  Although the best bet is to prevent users from clicking links in emails and also warning them not to open any attachments they are not expecting.    I’d also have the AutoPatcher ready to install the lastest patches for this Tuesday and schedule a time this week to update all the possible systems involved with the Databases.  Although this isn’t one that tries to steal your data it is however a chance the writers to look at what you have and you know how that can be call a data breach.   So if your the IT for the department I’d suggest sending out warnings so they can keep from being caught with their pants down.   I’d also suggest having Anti-Virus and free Firewall installed on all the major systems and it wouldn’t hurt to have the installed on minor systems if at all possible.

Upcoming Patch Tuesday for February 10, 2009

Paul

Microsoft Today has released the list of patches for February. Here’s the List of things they will patch:

[ad#ad2-right]

The list of affected operating configurations includes Windows 2000, Windows XP (x86 and x64), Windows Server 2003 (x86 and x64), Windows Vista (x86 and x64), and Windows Server 2008 (x86 and x64). Microsoft Exchange Server 2000, 2003, and 2007, Microsoft SQL Server 2000 and 2005, as well as Visio 2002, 2003, and 2007 are also affected.
[Via Arstechnica]

We got several Non-critical updates.  Here’s the List of them, some of these are monthly updates and some are just interesting to look at:

  • Update for Windows Mail Junk E-mail Filter [February 2009] (KB905866)

  • Windows Malicious Software Removal Tool – February 2009 (KB890830)/Windows Malicious Software Removal Tool – February 2009 (KB890830) – Internet Explorer Version

  • Cumulative Update for Media Center for Windows Vista (KB960544)

  • Cumulative Update for Media Center TVPack for Windows Vista (KB958653)

  • Update Rollup for ActiveX Killbits for Windows (KB960715)

We got an Update to Media Center and TVPack for Windows Vista to resolve issues with software.   The ActiveX Killbits issues have been identified in ActiveX controls that could allow an attacker to compromise a system that is running Microsoft Internet Explorer and gain control over it.  So we don’t exactly know what what issues they are talking about.   I hope this helps your system administrators get ready for this update.  If I were you, I’d having Clone of Autopatcher ready for these updates.  Remember to patch as soon as your company will allow, because waiting to long could make you have even more of an headache.   I’ll update the others as soon as I find out the updates.

Reviewing Roboform: Great Password Manager

Paul6 Replies

I’ve had Roboform for the last few months checking it out working with it seeing what is the pro’s and cons of it. Here’s what I’ve found out.

Limited number of passwords for non-license (Limited to 10 passcards – login information and password) — This doesn’t surprise me in fact once I’d started using it I had to buy it. You see I’ve got so many places I like to visit and so many logins it isn’t easy to track them all. This helps me login to each and everyone of them very easily. Although if you only have a limited amount of sites the free version will work well for those people too.

Defeats Key loggers — This is good for those who have family members who use the same computer just in case someone installs a virus that tries to steal your sensitive information. Can be put on a portable thumb drive with use to a library or open platforms. This also will prevent key loggers from getting your login information.

Generates strong passwords — This is a must in my field, I’m so tired of having to come up with a password. Now this is generated on the fly. Click a button and you have a password generated. Tried this out on several sites that would tell you how strong it is and all of the said excellent.

Works with Firefox, Internet explorer, and MSN/AOL — Now being that I don’t have a MSN or Aol I do not know this I have however tried this on Internet explorer and Firefox very easily. It works well with Vista no major problems. I have tried it with Google Chrome and it seems not work at all with it. I do not know if they will start supporting it and only time will tell!!

Backing up your passwords — it is really easy to back up your passwords database on Roboform. Just copy and paste and your done. No needing to find a hidden Directory, Roboform Database for Vista is in the My Documents folder under “My Roboform Data” Folder. All you need to do is copy that to a USB key and no worries Roboform automatically encrypts the passwords so without the Master password you can’t use them.

No need to remember Passwords — Yes that is right you no longer have to worry about remembering your passwords all you have to do is click a button and Roboform fills the required input forms. It can be annoying if you use the free version because you only can save 10 passwords then the rest you will have to remember.

Easily speed through login screens — This is the best part of Roboform because no more having to type in the site you need to go to login. Roboform does that for you without any problems. You just pick where you want to go and Roboform takes you through and fills the information in before you know it. I absolutely love this feature because You don’t have to type in the place you want to go it will automatically take you there.

Roboform has several version — Roboform can be made portable and also be put on PDA’s (Personal Digital Assistant) or a Mobile Phone(Windows Mobile, Palm, Symbian, or Blackberry). This is great for those who need to have your passwords on more than one type of device. Keeps it safe like big brother still need a master password to get to it. It also makes it just as easy to surf to the important websites with ease.

Download Roboform:

To Buy Roboform:

I strongly recommend this to anyone who has problems remembering passwords or want to upgrade there passwords to the next level.  This will ultimately protect you far better than trying to remember all your passwords.   This however is a personal and this will not protect you 100% but will get far closer to the 100% than just doing it alone.  Remember only you can protect your sensitive data and nothing else can stop password stealing 100% of a time.

Microsoft to Release KB961051 on the Dec 17, 2008

Paul

According to McAfee and I will quote:

December 16, 2008: Microsoft has announced an out-of-cycle patch release for a critical, remote-code-execution, vulnerability in Microsoft Internet Explorer (CVE-2008-4844). The patch, to be released on December 17, will address the vulnerability across multiple versions on Internet Explorer running on supported Windows platforms.

[via McAfee Threat Center]

[ad#ad2-right]From what I am understanding it will be KB961051 and will be a critical update on all Windows platforms.  Microsoft issued a security advisory for this on there Technet support website.   This will probably be put online sometime tomorrow and will be available to download after 10am PST although this is just a rumor because when I go to that article they talk about the work around and how to fix it temporary until they release the patch.  This is releated to the IE Vulnerability that is in the wild and has been causing havok on the internet.

IE vulnerability in the Wild

Paul

Well this was bound to happen, hackers found this vulnerability and is using it for their own purposes.  [ad#ad2-right]It seems they put a virus on your system.  Microsoft has issued an Recommendation and to check out Microsoft Security Bulletin MS06-055.

“What we’ve seen from the exploit so far is it stealing game passwords, but it’s inevitable that it will be adapted by criminals,” he said. “It’s just a question of modifying the payload the trojan installs.”

Said Mr Ferguson: “If users can find an alternative browser, then that’s good mitigation against the threat.”

[Via BBC News]

[ad#ad2-left]I personally like to recommend a program that will do a better job at security and that is Firefox,  I also suggest people use the Thunderbird and not Microsoft mail program.  This will greatly reduce your likely hood of getting a virus or Trojan.   Most of the time hackers like to find new ways to infection to get into your system.  If you want to preven having a virus in the future, I’d recommend going to my Malware Resource and check out a good firewall and anti-virus.   This will prevent you from getting some of the viruses and other types of malware.