Wednesday, November 10, 2004

Top ten security urban legends revealed

Most common cyber security myths unveiled as part of Cyber Security Month.
Secure Computing has revealed the 'top ten cyber security urban legends' as part of Cyber Security Month in the US. The list was compiled using data from the company's support calls, customer requests, and from monitoring Internet discussion groups.
The top ten reads as follows:
1. Hackers can legally break into web sites that lack 'warning' notices. This is untrue - breaking into websites is not legal, whether they carry warning notices or not.
2. Some Windows system files are really malicious and should be deleted. This myth is perpetuated by the jdbgmgr.exe and SULFNBK.EXE hoaxes.
3. Hotel card keys secretly record personal information, which could be maliciously taken advantage of without the person knowing.No known hotel room keycard contains personal information. The information encoded on these cards is limited to room number, check out time, and other non-identifying information.
4. Including a fake entry in your email address book will prevent email Trojans. Secure Computing's debunking of this myth lets itself down somewhat, by suggesting that Trojans use the email address book to replicate. Of course, Trojans do not replicate. However, a common myth is that creating a fake entry in the email address book labelled 'AAAAA' or '000000' will prevent email worms from spreading.
5. A digital cell phone can be infected with a virus merely by answering a phone call. Currently there is no evidence that a virus can be spread in this way.
6. Search engine 'crawlers' perform security checks and notify you of vulnerabilities. No known search engine employs this practice.
7. Thieves are using lists of 'out of office' auto-replies to target homes for burglary. Although this is feasible, there have not been any cases reported of burglars using this technique.
8. Free patches emailed to you will protect your PC from the latest worm or viruses. This, of course, is a sneaky social engineering trick employed by some email worms.
9. Signing up with a 'Do Not Spam' registry will stop you from getting spam. There is no official 'Do Not Spam' registry.
10. Elf Bowling and Blue Mountain Greeting Cards contain viruses. Two popular software downloads - Elf Bowling and Blue Mountain Greeting Cards, are sometimes rumoured to contain viruses. VB has seen numerous copies of both programs, and each has been a harmless game with no viral content. However, this is no guarantee of the 'cleanliness' of the files per se. Should one of these be executed on an infected machine prior to being redistributed via email, then it is perfectly feasible for the 'originally harmless' games/jokes to become infected and viral.

In collaboration with government and industry partners, the NCSA (National Cyber Security Alliance) declared October 2004 National Cyber Security Awareness Month. The aim of the initiative is to raise awareness of computer security among users - home users will be targeted in week one, small businesses in week two, education audiences in week three, and child safety is the focus of week four.

Friday, October 29, 2004

Dial a detection

Guidance issued on how to deal with rogue Internet diallers ('porn diallers')
UK telecoms watchdog the Independent Committee for the Supervision of Standards of Telephone Information Services (ICSTIS) has issued a leaflet for consumers which provides guidance on how to deal with rogue Internet diallers ('porn diallers'). The guide explains how to detect the difference between legitimate and rogue diallers and how consumers can make a complaint to ICSTIS if they believe they have been stung by a rogue dialler.
Meanwhile, at the end of September, AV company Sophos was reported to be taking legal advice on its detection of the Coulomb dialler. The AV vendor suspended detection of the dialler following a complaint from its manufacturer, Coulomb Ltd. VB reported in December 2002 on the difficulties AV vendors face in making the decision of whether or not to detect porn diallers as malware with German AV vendor H+BEDV having encountered significant legal problems in 2002 after having included detection of diallers in its product. The chief executive of Coulomb Ltd told The Register that a number of AV scanners detect the firm's dialler, and Sophos had simply been the first AV company it had contacted.

Sunday, October 10, 2004

Microsoft Word Hole Could Allow DoS Attacks

Kimberly Hill, www.enterprise-security-today.com

Computer security firm Secunia has reported what it terms a "highly critical" vulnerability in the popular Microsoft (Nasdaq: MSFT - news) Word desktop computer application. The firm has confirmed the existence of the hole in versions of Word as recent as Word 2000
The problem appears to affect only documents that are opened from or downloaded from Web sites, Secunia CTO Thomas Kristensen told NewsFactor. However, the installation of the Microsoft Office suite has many options, and vulnerabilities related to local documents may exist, he added.
The fix, says the company, is to open only documents from trusted sources.
Deliberate Crash
An input validation error related to the parsing of document files and errors creates the vulnerability by establishing a stack-based buffer overflow, says Secunia. When a user opens a document designed to take advantage of the flaw, the process will crash. At the same time, other code could be executed.
Then, through that hole, hackers may be able to launch a denial-of-service (DoS) attack using the compromised machine. However, this part of the reported security flaw has not been proven, says Secunia.
Set Security High
Users who run Internet Explorer can avoid the problem by opening Word documents on Web sites within their browser software rather than using Word.
To ensure the safety of this process, users should make sure that the security level for the Internet security zone is set to high or that the file-download option has been disabled.
A group of researchers called "HexView" originally brought up the possibility of an issue with Word, Kristensen said. When a security problem has not been verified by the software vendor, he said, his firm is particularly careful to research and verify the details.
So far, Secunia has determined that the buffer-overflow problem does exist. It is working to gather information that, if deemed useful, will be provided to Microsoft.

Saturday, October 09, 2004

Top 20 computer threats unveiled

The yearly hit parade of hackers' favourite security vulnerabilities has been published.
Issued by the respected Sans Institute, the Top 20 list helps organisations find out if they are closing the most commonly exploited loopholes
With more than 2,500 software vulnerabilities found every year many organisations need help to know which ones to tackle first.
The list includes loopholes found in both Windows and Unix/Linux software.
Big hitter
"It's a first things first list," said Alan Paller, head of the Sans Institute, a non-profit group which trains and certifies computer security professionals.
"It can be very helpful for people that are trying to fix their vulnerabilities."
He told BBC News Online that it was the list of the vulnerabilities hackers were attacking now.
TOP 10 WINDOWS
1. Web servers & services
2. Workstation service
3. Windows remote access services
4. Microsoft SQL server
5. Windows authentication
6. Web browsers
7. File-sharing applications
8. LSAS
9. E-mail programs
10. Instant messaging Each entry in the Top 20 mentions a category of software and the accompanying report fleshes out individual vulnerabilities and what organisations can do to close these holes.
Almost 60% of the loopholes listed this year were in the 2003 Top 20 list. Mr Paller said this was because only half of all organisations bother to patch their systems.
"These vulnerabilities are like little diseases that you cannot wipe out if 50% of people do not have the vaccine," he said.
Mr Paller said we will only see significant changes in the Top 20 when organisations get to the point of finding and fixing vulnerabilities automatically.
Shrinking holes
Gerhard Eschelbeck who studies vulnerabilities for online security firm Qualys said: "It gives people a benchmark to measure themselves against."
TOP 10 UNIX/LINUX
1. Bind domain name system
2. Web server
3. Authentication
4. Version control systems
5. Mail transport services
6. Simple Network Management Protocol (SNMP)
7. Open secure sockets layer (SSL)
8. Misconfiguration of enterprise services
9. Databases
10. Kernel He said that better information about vulnerabilities popular with the virus writing and hacking communities can help organisations protect themselves.
"The underground knows this data very well," he said. "We want to level the playing field here between the guys that have the data and the bad intentions and the people that need to know about this so they can do their job effectively."
Mr Eschelbeck's work on vulnerabilities shows that every 21 days, on average, the number of web-facing systems vulnerable to a particular loophole shrinks by 50% as people patch machines.
For internal machines, such as the PCs on workers' desktops, the number shrinks 50% every 62 days.
This difference, said Mr Eschelbeck, comes about because of the sheer number of PCs have on desktops and the time it takes to scan them and see which vulnerabilities they are hosting.

Thursday, September 09, 2004

Microsoft Delays SP2 Delivery--Again

Written by: Joris Evers, IDG News Service

Microsoft is giving users more time to prepare for Windows XP (news - web sites) Service Pack 2 by extending the time a special registry key will prevent PCs from automatically downloading and installing the mammoth update. Faced with concerns from IT professionals, Microsoft last month made available a tool that allows users to set a Windows registry key that instructs the system to skip downloading and installing SP2 for 120 days, but still download other critical updates. Microsoft has now doubled that period to 240 days, Microsoft told select customers in an e-mail message this week. The change was made in response to customer feedback. The blocking mechanism will now prevent Automatic Updates (AU) and Windows Update (WU) from delivering SP2 to Windows computers until April 12, 2005, according to the e-mail.
"Beginning on Tuesday 12 April 2005 AU and WU will deliver SP2 regardless of the presence of the blocking mechanism," Microsoft writes. April 12 is also the day Microsoft has scheduled a monthly security update, according to the note. The extension is Microsoft's latest move to help users deal with SP2. The software maker earlier postponed automatic distribution of the service pack to PCs running Windows XP Professional Edition so users had more time to install the blocking mechanism. Microsoft has also published many documents detailing the changes SP2 makes to Windows XP and potential application compatibility problems.
Users Pleased Thomas Smith, manager of desktop engineering at a large Houston-based company that he asked not to be named, is happy about the extension. "Microsoft is finally listening to its customers. This is a big thing they have done to help us out," he says. Smith manages about 5000 Windows XP desktops. The registry key has been installed on more than half of those, he says. "This extension is going to allow us to do more extensive testing, along with giving us time to change our applications to work with SP2, if needed," Smith says.
SP2 is more than the usual roll-up of bug fixes and updates; it makes significant changes to Windows in the name of increased security. As a result, SP2 can render existing applications inoperable. Because of those changes, many businesses want to hold off on installing the update and are taking time for testing. Automatic Updates initially did not give users that flexibility.
Although Microsoft advises consumers to enable the Automatic Updates feature in Windows, the company recommends businesses use patch management tools such as its Systems Management Server (SMS) and Software Update Services (SUS) or third-party products.
The initial schedule called for Microsoft to begin pushing out the already delayed SP2 via Automatic Updates to all editions of Windows XP on Monday, August 16. Systems running Windows XP Home Edition finally started downloading SP2 on Wednesday, August 18 and distribution to Windows XP Professional Edition started on Wednesday, August 25. As implied by the edition names, Windows XP Home Edition is meant for home users, while the Professional Edition is aimed at businesses and more demanding users.
Microsoft has labeled SP2 a "critical" update and urges all Windows XP users to install it as soon as possible. The software maker expects about 100 million PCs to be updated by October via Automatic Updates alone.

Wednesday, September 08, 2004

German teen indicted over Sasser computer worm

VERDEN, Germany (AFP) - German prosecutors indicted an 18-year-old student on suspicion of creating the Sasser computer worm that paralyzed millions of computers around the world last spring. The suspect, identified only as Sven J., is charged with computer sabotage, data manipulation and disruption of public systems for allegedly hatching the worm, which produced millions of dollars in damages after spreading at lightning speed over the Internet.
Prosecutors in this northern German town said that 143 victims had filed charges and that the suspect could face up to five years in prison if convicted. It was not yet clear when his trial would begin. The teenager was arrested in May after a raid on his parents' house in Rotenburg, a small town in the northern state of Lower Saxony, turned up incriminating evidence.
Acting on a tip from computer giant Microsoft, which offered a 250,000-dollar reward for the conviction of the mastermind behind the worm, investigators seized several items from the house, including the suspect's personal computer. He admitted during questioning to writing the Sasser program and authorities believe he may also be behind another destructive worm named Netsky, which surfaced in February. "The computer worms caused damage worldwide. There is no doubt about that," said chief prosecutor Helmut Trentmann. Trentmann said, however, that major companies had not come forward to file charges against Sven J. which had made the prosecution more difficult. "We have the tip of the iceberg. But we have not received any reports from major listed companies that were surely also affected." The Sasser worm struck on May 1, and in less than a week affected thousands of companies and as many as 18 million computers worldwide, forcing some businesses to shut temporarily in order to debug their systems.


Thursday, August 26, 2004

XP SP2 Gives Reasons to Switch to Linux

Contrary to popular belief, I'm perfectly happy to run Windows as well as Linux (news - web sites) desktops. It's just that, well … the Linux desktops tend to run better and be more secure then their Windows cousins. And that's true both for me and for enterprise desktop users.
Take, if you will, please take it, Windows XP (news - web sites) SP2 (Service Pack 2). I've worked a lot with SP2, and I didn't expect to see great security improvements from it. I know Windows too well to think that anything short of a complete redesign will actually make it approach Linux's levels of security.
But I did expect to see some improvement. Boy, was I wrong. Yes, some things are better, but there are also a slew of new, exciting security concerns.
For example, it's possible in some situations for a worm to spoof the WSC (Windows Security Center) into making it appear that your system is fine and dandy when it's actually been turned into, say, a spam-producing zombie from heck.
Or, worse still, there's the hole that enables would-be attackers to use Internet Explorer's drag-and-drop feature to trick users into allowing various malware programs onto their PCs.
You know what really scares me, though? We're seeing all of these security problems turning up, and SP2 hasn't even been widely distributed yet. What will happen once every would-be cracker has a copy to tinker with?
I also expected to find a host of minor program incompatibilities. There, Microsoft hasn't disappointed me. Microsoft's own applications, VPNs, custom programs, and the list goes on and on.

Is it any wonder that businesses are holding off on "upgrading" to SP2? So it is that once more I have to ask you, why not Linux?
The Linux desktop is far more stable and secure than XP SP2 is today. Linux applications run without fussing, and never has a single, serious Linux virus been seen in the wild.
Don't know Linux? Well, that's where enterprise Linux distributors such as Novell/SuSE and Red Hat and full-service Linux integrators such as IBM Global Services come in. With them, you don't need to have full-time Linux gurus on staff. They can supply the IT knowledge for you.
Yes, you can use Mandrake, Mepis or some other Linux instead of paying enterprise Linux prices. But with the non-enterprise Linux distributions, you're not going to get the 24-7 support big business demands from any enterprise-level program. If you're sure your in-house people can handle the demands of forging your own way, you're welcome to do it. It's just that I know for a fact that most companies don't have the resources, or corporate will, to go it alone.
Unfortunately, the enterprise Linux players haven't been doing a good job of pushing their desktop offerings. First, as I've said before, getting a box with Linux preinstalled on it is still a pain. You pretty much work with a systems integrator or VAR to bring in pallet loads of desktops.

Next, there's a bit of confusion about enterprise-ready Linux desktops. Novell has a great Linux desktop, SuSE Linux Desktop 9.1. About half of my own Linux desktops are running it.
But Novell is working on a bigger, better Linux desktop, which isn't even in beta yet. The last thing most CIOs—or any chief financial officers—want to do is upgrade to a new operating system and then immediately upgrade again.
For a while, people were confused about whether Red Hat even had a desktop anymore. Well, it always did, and the Red Hat Desktop is a good one. For it to shine to its best advantage, though, you'll also need to commit to RHEL (Red Hat Enterprise Linux) on your servers.

Thus, all in all, for enterprise buyers, I think that making a successful Linux desktop today isn't as easy as it could be or should be. Still, with the right integrator or reseller partner, or perhaps even outsourcing your desktops with a Linux thin client approach, it is perfectly doable.
If that doesn't sound very attractive to you, well, you did read what I wrote earlier about Microsoft's latest and greatest desktop, didn't you?
Do you really want to wait for Longhorn? Whenever the heck that shows up? If you want a new, solid and safe desktop for corporate use anytime soon, your best choice is a Linux desktop.

Written by: Steven J. Vaughan-Nichols - eWEEK

Wednesday, August 25, 2004

Microsoft Expands Windows Update Release

By ALLISON LINN, AP Business Writer

SEATTLE - Microsoft Corp. is starting to ramp up distribution of its massive security update for the Windows XP (news - web sites) operating system, but analysts say they still expect the company to move at a relatively slow pace to avoid widespread glitches.
With only a small percentage of users running the product, analysts say they aren't seeing any unexpected problems so far. But some expect confusion to mount as more people begin installing the update.
"Microsoft realized that a lot of people are going to have some level of problems, no matter how good a job they did with it," said Steve Kleynhans, a vice president with META Group, based in Stamford, Conn. "When you start tweaking with security ... you're bound to break applications. It's always been true and it always will be true."
The Redmond, Wash.-based software maker completed work on the update, called Service Pack 2, in early August. But Greg Sullivan, a Microsoft lead product manager, said that a "relatively small percentage" of users have received the update so far, mainly through an automatic download service.
Microsoft is expecting to gradually increase the rate of distribution through automatic updates, with most receiving it within two months.
Beginning Wednesday, Windows XP users also will be able to download the upgrade directly from Microsoft's support Web site, or order a free CD version. Businesses who use Windows XP Professional also will begin receiving the update through an automatic download, if they have agreed to that service.
Many big businesses are expected to take months to install the upgrade, because the changes may cause compatibility problems with customized business applications.
Consumers also may need to update favorite programs, such as security software or other Web-based applications.
Some companies, such as SBC Communications, have sent out e-mails to users who need to download updates. But Kleynhans said it's hard to count on people to actually read those e-mails and make necessary changes.
SBC said it had not heard any reports of customers having problems with Service Pack 2.
Microsoft also has posted a list of products that may experience problems with the security upgrade, prompting some companies to scramble to come up with fixes.
Yahoo Inc. (Nasdaq:YHOO - news) changed the way people download its Yahoo Messenger to prevent problems with Service Pack 2, said spokeswoman Terrell Karlsten.
Fred Felman, a vice president with security software maker Zone Labs said it was working to fix a minor problem. But Felman said the company had already fixed most other compatibility issues and it wasn't seeing an increase in support calls.
Service Pack 2 also may create confusion simply because it asks users to change their behavior. One big change is that users will now be required to give more specific permission for programs to interact with the computer, aiming to prevent unknown attackers.
So far, Sullivan said Microsoft is seeing support calls increase about as much as it had expected.

Microsoft Makes XP Service Pack 2 Available Via Update

Microsoft on Wednesday made Windows XP Service Pack 2 available via Windows Update and free CD. It also began distributing the update to its flagship operating system to Windows XP Professional customers via Automatic Updates.
The CD Request Page had been live for several weeks; however, the option to make the request was not turned on until now. The installation, which requires 1.6 Gbytes of available hard disk space, was previously only available in a 75-Mbyte download (for individual PCs; the full "Network Install" version is 266 Mbytes). This could be time-consuming for most XP users--and nearly impossible for those consumers still using dial-up connections to access the Internet.
According to the site, the CD, which is available free of charge, will take four to six weeks to reach those users who request it. As of Aug. 25, it was available in English and German; versions in 25 different languages will be available within two months.
Microsoft also has released a kit to help IT professionals spot compatibility problems between Service Pack 2 and other applications, and how to roll out fixes.
The kit, which includes several Visual Basic scripts and a Word document in excess of 100 pages, "describes the security technologies implemented by [SP2] and provides guidance for mitigating application compatibility issues that were identified by extensive testing of Microsoft and third party applications." The Word-formatted guide targets IT staff and administrators working in support, application testing, security, and network administration, said Microsoft.
"The guide does not assume a particular size or complexity of network, and covers peer-to-peer, domain and Active Directory environments. The security information is relevant even for networks that do not have Internet access," the kit says.
The guide also offers up deployment road maps that businesses can use to roll out Service Pack 2.
Tucked into the guide are some straightforward warnings to IT pros about the possible scope of compatibility issues with Service Pack 2.
"The need to secure the operating environment has become paramount," the guide says. "The security features in Windows XP Service Pack 2 can make Windows XP a more secure environment. However, applications that were not designed to meet these higher security requirements may experience some compatibility issues."
And although some developers would disagree-- and have--Microsoft's line is that it's the applications, not the operating system, that need to be tweaked. While Service Pack 2 can be configured to make incompatible applications run--essentially by dumping or downgrading some of its security provisions--such changes should be made "only to the extent necessary to ensure correct operation of the application" with the warning that "this procedure is not recommended but may be necessary in the short term."
The guide isn't the first noise Microsoft's had to make about Service Pack 2 and application compatibility. Earlier this month, it published a list of nearly 50 programs, including several of its own, such as Small Business Server 2003 and Visual Studio .Net, that don't work well with Service Pack 2. Some third-party vendors have also begun notifying users of compatibility issues.
The do-it-yourself "Application Compatibility Testing and Mitigation Guide for Windows XP Service Pack 2" can be downloaded from the Microsoft Web site.

Tuesday, August 17, 2004

MS Windows SP2 clashes with more than 40 programs

The update for Windows XP makes a long list of programs appear to stop working, including Microsoft's own SQL and Visual Studio .Net
Microsoft has published the details of more than 40 programs that have conflicts with the newly released Windows XP SP2.
The list includes several widely used Microsoft products including SQL, Visual Studio .Net, and SMS 2003 Server.
The list can be found under the heading "Some programs that seem to stop working when you install Windows XP Service Pack 2" on Microsoft's website. XP SP2 has also created problems with Symantec's Antivirus Corporate Edition 8.0, MacAfee's NetShield 4.5 and CA's eTrust 7.0.
Some games that run on XP also come to grief following the installation of the service pack, including Scrabble 3.0 and two versions of Unreal Tournament. Microsoft doesn't give hints on how to resolve the conflict with the games but points users in the direction of the original vendor, with instructions to "see the documentation".
Some Microsoft programs "appear" to stop working but can be coaxed back into life if you follow the instructions given for each individual program on the Microsoft website. The conflicts mainly stem from the SP2 tendency to shut certain ports or block 'unsolicited connections' - often a sign of malware, spyware or other unwanted visitors.
There is one notable exception, however. Microsoft's CRM product won't work with a SP2-equipped machine, full stop. Microsoft has already issued a fix for the incompatibility.
It's such incompatibilities that have prompted IBM to advise its staff to not install the service pack for fear it might conflict with business-critical applications.
A complete list of the programs that conflict with XP SP2 and how to resolve the problems can be found on Microsoft's website, here.

Monday, August 16, 2004

Microsoft Lists XP SP2 Problems

With automatic download of Microsoft's (Nasdaq: MSFT - news) enormous SP2 security patch to the Windows XP (news - web sites) operating system set to begin, the industry still waits to understand its ramifications. Home users that have their preferences set to receive operating-system updates as they are made available by Microsoft may be surprised to learn that some of the software they already run on their systems could be disabled by SP2 or may run very differently.
Microsoft has released a long list of programs that are affected, including many of its own products. Even administrators of sophisticated networks are having a hard time making their way through the update, security firm Secunia's CTO Thomas Kristensen told NewsFactor. "People really should be very careful" about this mega-patch, he stressed.
Home-User Conflicts
Many of the programs on Microsoft's list of problems will affect enterprise users for the most part. However, a big group of computer games, including a range of those made by Atari, are affected. In addition, the update can interfere with the operation of several popular antivirus programs -- including those made by McAfee and Symantec (Nasdaq: SYMC - news).
Quicken (news - web sites) 2003 products are among those that may "experience issues," according to Microsoft's notice. WordPerfect Office appears on the list, as do three versions of Microsoft's own Outlook.
Enterprise Headaches
Technical-support personnel responsible for hundreds or thousands of corporate users have a rough road ahead of them, said Kristensen. His firm is advising clients to test SP2 very thoroughly to make sure that it is compliant with all other applications running on the enterprise network.
"Don't apply it until you know that it's working," he stressed. He added that Secunia's business customers are not rushing to apply this particular security enhancement due to the plethora of compatibility issues.
Yahoo's (Nasdaq: YHOO - news) instant-messenger tool appears on the list of applications with potential SP2 conflicts. So does ICQ. The corporate editions of several popular security products appear on the list. Ubiquitous plug-in and helper applications used with Web browsers are involved, such as Real Networks' Real Player.
Perhaps most frustrating for the system administrator in Microsoft-based shops, however, is the fact that the update could affect so many of Microsoft's other products running on the same network. Several Visual Studio products already have known conflicts with SP2, as do a range of Office editions and BizTalk 2004.

Windows update causes headaches

Games, security software and popular business programs are clashing with Microsoft's long-awaited security update for Windows XP.
Since SP2 was released to business users, reports have circulated about programs behaving differently once the upgrade is in place.
Microsoft has drawn up a long list of programs that do not sit well with SP2.
Included in the list are games such as Unreal Tournament, Photoshop Elements and most file-sharing programs.
Long list
Service Pack 2 for Windows XP is intended to make the operating system much less susceptible to the viruses, hack attacks and worms that have made the headlines over the last few years.
As well as giving users a single place to manage their anti-virus software, firewall and updates to Windows, the SP2 update also makes changes under the hood in an attempt to stop viruses and malicious hack attacks taking hold.
CHANGES DUE IN SP2
Pop-up ads blocked
Revamped firewall on by default
Outlook Express, Internet Explorer and Windows Messenger warn about attachments
Origins of downloaded files logged
Web graphics in e-mail no longer loaded by default
Some spyware blocked
Users regularly reminded about Windows Updates
Security Centre brings together information about anti-virus, updates and firewall
Protection against buffer over-runs
Windows Messenger Service turned off by default Early reports suggested that some of the changes SP2 introduced caused problems with programs that needed remote access across networks.
Now, about a week after SP2 was released to business customers, Microsoft has compiled a long list of programs that the update is known to cause problems with.
Microsoft has put together two articles detailing the problems. One deals with programs that behave differently after installing SP2 and a second that details the programs that seem to stop working after the upgrade is in place.
Many games, such as Unreal Tournament 2003 and Sim City 4, will behave differently because the firewall in XP is automatically turned on when SP2 is installed.
Paul Randle, head of all things XP at Microsoft in the UK, said most of the problems were caused by older programs that expected to have net access that the update shut off.
"They are also ones that are trying to communicate across a network between a client and a server," he told BBC News Online.
Microsoft has produced guidelines for what to do if programs stop working after SP2 is downloaded and installed.
Many anti-virus programs from security firms such as Symantec feature on this list.
Mr Randle said updating anti-virus software with the latest versions should iron out the conflicts.
For some programs the list of instructions involves finding and opening ports used by programs to make sure they can communicate via the web.
For average users, these instructions could prove formidably complicated.
A version of the SP2 update for consumer PCs is expected to be released soon.

Wednesday, August 11, 2004

'Game virus' bites mobile phones

A mobile phone "virus" inside a pirated copy of a game called Mosquitos is roaming file-sharing and software download sites, say security experts.
The game only works on certain phones running on Symbian OS Series 60.
Once the illegally cracked game is installed a hidden program, called a Trojan, sends unauthorised SMS texts.
It only affects pirated copies of the game; early reports said it texted premium rate numbers, but this is not the case, security experts have said.
This comes months after the first mobile virus, Cabir, was created as a proof-of-concept. It was spread via Bluetooth and was harmless.
The Mosquito Trojan is malicious because it fires off text messages without the user's consent while the unlicensed game is being played.
Confusion caused
But, confusingly, it has emerged that the Trojan was in fact not added by the group that pirated the game.
"When we first saw this we were confused ourselves," Mikko Hypponen head of anti-virus research at F-Secure told BBC News Online.
"We initially thought it was a game which had been hacked with a secret program that sent out text messages. But after analysing it, it seems to be an integral part of the game."
The company that made the original legitimate Mosquito game, Ojom, said it had installed the program itself in earlier versions of the title after concerns over piracy.
Once we are in the 3G world, we basically have a broadband connection, so phones will be closer to PCs in terms of functionality. Having that connectivity historically leads to the spread of viruses
Sal Viveros, McAfee It was intended that the program secretly send a SMS message to alert them if an unlicensed copy was being used, according to Mr Hypponen.
"It did not work the way it was supposed to; they had complaints and removed it from the game, " said Mr Hypponen.
But the pirated versions of the game which are on file-sharing and free software sites are older ones.
This means they still have that SMS functionality, said Mr Hypponen, which means text messages will still be sent, although not at premium rates. It is still classed as a "Trojan", he added.
Mosquito's Trojan does not do any other damage and it is not widespread; it can be deleted easily, just like a normal game.
The game will only be installed if users ignore two warnings that flash up on the screen.
Look out
Sal Viveros, director of wireless security at McAfee told BBC News Online mobile users should make sure they download games from legitimate sites to avoid malware.
He also urged mobile companies generally to provide more security for people to prevent malicious code getting onto phones.
"These devices are getting more powerful memory and functions, and operating vendors are having more third party software applications with them," said Mr Viveros.
"Once we are in the 3G world, we basically have a broadband connection, so phones will be closer to PCs in terms of functionality.
"Having that connectivity historically leads to the spread of viruses."
Japanese mobile giant NTT DoCoMo recently announced it was planning to provide protection for its customers. The mobile network has 46.6m subscribers.

Friday, August 06, 2004

Microsoft Releases Windows Security Update SP2

REDMOND, Wash. - Microsoft Corp. released a long-awaited security update for Windows XP (news - web sites) computers on Friday, a response to the growing number of security shortcomings in the market-dominant operating system.
The free upgrade won't be available to everyone right away, however. Microsoft said the timing will depend on several factors, including customers' Internet usage, location and language as well as the overall demand for the package, dubbed Service Pack 2.
Customizing the fixes in 25 languages will take two months, the company said.
English-language users will get the update earlier as Microsoft distributes it to computer manufacturers, companies and home users through downloads, free CDs and other means.
The upgrade, which Chairman Bill Gates (news - web sites) said modifies less than 5 percent of the nearly 3-year-old operating system, is designed to make users safer from cyberattacks by sealing entries to viruses, better protecting personal data and fending off spyware.
For regular users, the most noticeable change will be a series of new prompts users will see. Users will be asked to actively give permission for programs to interact with their computers, so there is less chance they will be hit by a virus or inadvertently allow malicious software that can monitor computer activities.

Saturday, July 31, 2004

Microsoft patches three critical browser flaws

Microsoft on Friday released a patch for Internet Explorer designed to close three critical holes in the browser, including one that paved the way for the Download.Ject Trojan horse.
The software maker offered a work-around earlier this month and had promised in recent days that a comprehensive fix would be coming soon. Microsoft has also worked with law enforcement to shut down the Russian server that had been the source of malicious code.
The new patch, which is available from Microsoft's security Web site, closes the hole, and Microsoft encouraged all IE users to update their browsers. Technically, the flaw is what's known as a cross-domain vulnerability, through which an attacker is able to cross a security boundary within the browser to deliver and execute malicious code.
Microsoft security program manager Stephen Toulouse said that the company was already working on an Internet Explorer update when it became aware in late June that the vulnerability was being exploited. "Once we became aware of the specific attack on our customers, that's when we began to mobilize," Toulouse said, pointing to the company's work with law enforcement and Internet service providers.
The patch also addresses two other publicly known flaws in IE, both related to image processing and both rated as critical because they could allow malicious code to be run on a vulnerable system.
Toulouse said the company does not know of any attacks related to these two flaws, but he added, "We want to make sure that customers have this update so they are protected."
Security company Symantec encouraged Web surfers to apply the patch.
"With the widespread use of Microsoft Internet Explorer in both the enterprise and consumer environments, it is critical that security patches be applied immediately," Alfred Huger, senior director of Symantec Security Response, said in a statement.
Some have said that IE vulnerabilities have become so common that Web surfers should consider other browsers.
Toulouse noted that the company has improved IE in the forthcoming Windows XP Service Pack 2, adding that those running that version of the operating system were not vulnerable to the attack because of changes the company made to the internal structure of the browser.

Friday, July 30, 2004

Microsoft Issues Patch for Browser Security Flaw

SEATTLE (Reuters) - Microsoft Corp. (Nasdaq:MSFT - news) on Friday issued a widely expected patch for its Internet Explorer browser, which was known to have a flaw that would let hackers take control of computers and distribute malicious software code.
The security warning, which Microsoft rated as "critical," was issued as an extra bulletin ahead of the company's regular monthly security bulletin because of the serious risk to computers, the world's largest software maker.
Redmond, Washington-based Microsoft launched a campaign in early 2002 to boost the security and reliability of its software, and is due to release a major update to Windows XP (news - web sites) next month aimed at improving the security of the company's flagship operating system.
Friday's patch will be included in the update for Windows, called Service Pack 2, and will fix three previously known flaws that existed in Internet Explorer.
Hackers, reportedly from Russia, exploited the flaw last month when computers running Internet Explorer viewed pages on a server designed to exploit the flaw and steal information.
Craig Schmugar, a virus research manager at McAfee Inc. (NYSE:MFE - news), recommended that users download the patch and also avoid clicking on any links in spam e-mail, which could direct users to Web pages that exploit the flaw.
"Those users are going to be at a greater risk," Schmugar said
Microsoft also urged customers to download the patch at www.microsoft.com/security.

Wednesday, July 28, 2004

Faster Updates, More Security To Arrive In XP SP2

A streamlined software update process and a more protective Internet Explorer browser will be some of the key features of Windows XP (news - web sites) Service Pack 2 when it arrives in August, Microsoft executives said Wednesday. 
XP SP2 will streamline Windows software updates using a new version of Automatic Update (AU) client, said Mike Nash, senior executive in charge of security at Microsoft, Redmond, Wash., during a monthly security briefing.
With the new AU, bandwidth-throttling features will slow the update process when the system detects that it is monopolizing bandwidth used by other applications, such as Web browsing or messaging, said Nash. The new AU will also delay any reboot required by an update until the next system shutdown, he added.
In addition, Windows Update version 5-"which will ship along with XP SP2 in August"-will add efficiency to the update process by not recommending already-installed updates, said Nash.
XP SP2 will also prevent a system from over-installing related updates, or "encompassing fixes," during an update process, Nash said. "You'll only get that security fix that's necessary," he said.
XP SP2 will also enable the Internet Explorer browser to "eliminate an entire class of vulnerabilities," said Dean Hachamovitch, product unit manager for Internet Explorer.
"We've done a lot of work in the user experience to keep users in control of the experience," Hachamovitch said, citing as an example Internet Explorer's improved ability to decline and prevent unwanted Internet downloads.
Overall, Microsoft's development path for its client and server operating systems should "reduce the number of reboots by 10 percent," said Nash. "We are also committed by the end of the year to reduce the number of installers from about eight now to two. One for kernel, one for application level."
Name changes are also planned for the company's update services, Nash said. "Next year we will replace Windows Update with Microsoft Update. We will also replace Software Updating Services with Windows Updating Services."

Written by: Dan Neel, CRN


Tuesday, July 27, 2004

McAfee: June Hack Tops So Far For 2004

While mass mailers continue to plague corporations and spyware is the big evil for consumers, the most serious threat in the first half of the year was the Download.Ject/Scob attack, which exploited still-unpatched vulnerabilities in Microsoft's Internet Explorer, said McAfee Monday.
McAfee's virus research and response team -- dubbed AVERT -- ranked the Top 10 threats for the first six months of 2004, and put Download.Ject/Scob, a Trojan horse that infected IE users' machines in a brief attack in late June in the Number 1 spot.
"At the time, [Download.Ject/Scob] seemed kind of minor, but once it got into networks, the impact was huge," said Brian Mann, the outbreak manager for AVERT in defending the ranking.
AVERT also rated it top beast, said Mann, as a kind of placeholder for the high number of attacks that use HTML code to move malicious code onto users' machines, as well as a way to spotlight the increasingly dangerous trend of behind-the-scenes attacks.
In the case of the Download.Ject/Scob Trojan, users were infected when they visited compromised servers running Microsoft's Internet Information Services (IIS) software; vulnerabilities in their IE browsers allowed the Trojan to open a backdoor and steal confidential information, all without the users' knowing anything was afoot.
Number 2 on the hot list was VBS/Psyme, another Trojan that exploited a vulnerability in Internet Explorer.
"The amount of different malware that uses these tactics is phenomenal," said Mann.
To come up with its Top 10 list, McAfee tallied the usual virus submissions by its clients, but also integrated factors such as customer impact -- based on conversations with enterprises that use its anti-virus and security software -- and whether the attacks exploits an unpatched vulnerability.
Three of the Top 10 are variations of the Netsky worm, which leaped to prominence early this year as it engaged in a tit-for-tat exchange with rival Bagle. "The war between the Bagle and Netsky authors caused a tremendous increase in the number of virus attacks seen this year," said Mann. Of the four worms on the list were Netsky.d, Netsky.p, and Netsky.q; the other was the original MyDoom.
Four of the Top 10 spots in McAfee's list were occupied by various adware/spyware threats, proof that this security risk category is serious, and not just a danger to consumers.
"Spyware is most definitely a problem for enterprises," said Mann. There the biggest concern is over possible loss of critical and confidential data, Mann continued. "They're worried about what spyware is delivering, what it's doing to their systems."
The rise in spyware's seriousness -- 60 percent of the malicious threats McAfee tracked during the first half of the year were what it dubbed "Potentially Unwanted Programs (PUPs), which includes spyware -- is due to a number of factors, including better hacker technology, more virulent spyware, and devious tactics such as programs that automatically replace one uninstalled piece of spyware with another.
Overall, McAfee saw a continued increase in the number of security threats, and a dramatic climb in those it found worthy of watching. It counted a 20 percent increase in threats during the first half of 2004 compared to 2003, and had tagged more threats as "Medium" or higher during 2004's first quarter than it did in all of 2003.
"I've seen it from both the support side and the research side," said Mann, "and the increase of high-risk threats is just incredible."

Written by: Gregg Keizer, TechWeb News

Clean-up begins from MyDoom virus

Computer technicians worked Tuesday to disinfect thousands of computers worldwide struck by the MyDoom virus a day earlier, the Washington Post said.
A new variation of the malicious code appeared early Monday, and soon after, the Google, Yahoo, Lycos and AltaVista search engines were overwhelmed for as long as five hours.
The virus circulates the Web disguised as an e-mail with various subject lines, such as "Mail System Error," or "Undeliverable Mail."
Many messages purported to come from the user's corporate e-mail or Internet service provider: "Your e-mail account was used to send a large amount of junk mail messages during this week," read one message bearing the malicious software. "We suspect that your computer was compromised and now contains a trojan proxy server."
The computer would only be infected if the recipient clicked to open the attachment.
The original version of MyDoom in January attacked the Web site of a Utah technology company called SCO Group Inc., which has angered many programmers by filing lawsuits claiming it owns intellectual property related to the free, open-source operating system Linux.

Monday, July 26, 2004

Web Worm Spreads, Slowing Online Search Sites

SAN FRANCISCO (Reuters) - A fast-spreading computer worm disrupted the world's most popular online search sites on Monday, scanning the vast databases of Google Inc. and other search engines to find the e-mail addresses of new victims.
The worm's assault came on the same day that Google disclosed it was seeking as much as $3.3 billion in its highly anticipated initial public offering, although there was no indication that the two events were related.
In a filing with stock regulators, Google made the prescient acknowledgment that "outages and delays" from viruses and worms could harm its business.
The online attack marked an evolution of a worm called MyDoom that infected hundreds of thousands of computers earlier this year. In the current variant, MyDoom not only scans the hard drives of victims for e-mail addresses, but also turns to online search sites to find additional leads.
The worm then sends a copy of itself as an e-mail attachment to those addresses. Users who open those attachments, and who are not protected by security software, infect their own computers.
"Those search requests have been overloading the search engines," said Lloyd Taylor, vice president of technology for Keynote Systems Inc., which measures Web site performance.
A Yahoo spokesman said the effect of the slowdown was limited solely to its search engine and said that by Monday afternoon that impact had been mitigated.
Google, in a statement, said that some of its users had experienced a slowdown but added that it expected full service would be "restored shortly" as of Monday afternoon.
Symantec Corp., a maker of security software, said it received 250 reports about the new worm in two hours, on pace with the original MyDoom attack in January.
"This is certainly equivalent to what we saw back then," said Oliver Friedrichs, a senior manager with Symantec's security response group.
INITIAL SIGNS OF TROUBLE
Initial signs of problems popped up on Monday morning, with reports from around the world that users were having problems searching on Google.com.
Keynote said the attack appeared to have started around 6:30 a.m. PDT (9:30 a.m. EDT), when East Coast office workers arrive and check their e-mail.
As of 2:30 p.m. PDT, the spread of the infection had not yet waned, though Web search sites had apparently found a way to block the automated search requests, Keynote's Taylor said. Antivirus vendors also had updates ready to protect against the latest strain of MyDoom, he said.
Monday's outbreak underscored the more widespread threat of Internet viruses, analysts said.
McAfee Inc. said on Monday it expected 2004 to be a record year in terms of the total number of "successful" viruses and worms, due to smarter malicious code writers and the still-common practice of computer users opening virus-laden messages.
Brian Mann, a virus outbreak manager at McAfee, said that at current rates up to 100 successful viruses and worms could run across the Internet by the end of this year compared with a total of 20 for all of 2003.

"We're already in record territory now" in terms of the number of successful viruses, which are assessed by McAfee as a "medium-risk" to "high-risk" threat, Mann said.
Several thousand computer security threats appear every year but most never cause widespread disruption due to protections, such as firewalls, that prevent malicious code from entering computer systems. (Additional reporting by Spencer Swartz in San Francisco, Ben Berkowitz in Los Angeles)

Friday, July 23, 2004

Virus purports to show bin Laden suicide

SEATTLE - A virus purporting to show images of Osama Bin Laden's suicide popped up on the Internet on Friday, designed to entice recipients to open a file that unleashes malicious software code, security experts said.
advertisementThe virus was attached to a message that was posted on over 30,000 Usenet newsgroups and is not being spread via e-mail, said Web security vendor Sophos.
The U.S. government has been hunting for Bin Laden since 2001, holding him responsible for masterminding the attacks on the World Trade Center and Pentagon on Sept. 11, 2001, but he has not yet been found.
Chris Kraft, senior security analyst at Sophos, said the message and virus was designed to lure unsuspecting readers into opening a file, similar to the Anna Kournikova virus that enticed readers to open a file that unleashed malicious software code.
"If you don't know the person or the origin of a message, you shouldn't be opening it," Kraft said.
The fake Bin Laden suicide file, when opened, unleashes a program called a Trojan horse that makes it possible for attackers to take over infected personal computers running Microsoft Corp.'s Windows operating system.
Kraft said the virus itself had already appeared on the Internet before, but the virus writer had apparently repackaged it by saying it contained Bin Laden's suicide photos.

© Reuters 2004. All rights reserved.

Sunday, July 18, 2004

Companies brace for Windows upgrade SP2

SEATTLE - As a vice president at security software leader Symantec Corp., Matthew Moynahan applauds Microsoft Corp.’s effort to make its Windows operating system safer from attack.
advertisementBut Moynahan is not so excited about the flood of help-desk calls almost certain to come when Microsoft releases a comprehensive security overhaul of Windows XP next month. His company’s Norton antivirus software runs on about 100 million desktop computers.
To make the new Microsoft system work smoothly with Norton, customers will need to download a Norton update. The company is already bracing for the change, working with its customer support staff and making plans to increase phone support.
“We don’t want consumers to panic,” Moynahan said.
He’s not alone. As Microsoft prepares to launch its biggest security upgrade ever to Windows, dubbed Service Pack 2, the company is trying to strike a difficult balance between making things safe and making things work. (MSNBC is a Microsoft - NBC joint venture.)
Security experts embrace 'wake-up call'It’s a tough job that is eliciting grumbling from companies whose applications could require major changes — and glee from security experts who say any software product that doesn’t work wasn’t secure enough in the first place and needs to be fixed.
“I hope it breaks more things than it’s already broken,” said Russ Cooper, senior scientist at TruSecure Corp.
That’s because Cooper believes the free SP2 update is badly needed in the ever-rowdier world of Internet-connected computing — and a good wake-up call for other companies that also need to improve security functions.
“The applications that will break with SP2 were essentially doing things wrong from a security perspective,” said John Pescatore, vice president of Internet security at Gartner Research.
SP2 comes in response to a series of attacks that have plagued the software giant’s products, taking advantage of vulnerabilities to spread viruses, steal personal information and otherwise wreak havoc.
Some companies rushing to make their applications compatible — or trying to negotiate last-minute Microsoft changes — complain that SP2 is creating headaches.
“The changes Microsoft is proposing for SP2 will have serious negative consequences on the consumer experience of many applications and Web sites,” RealNetworks spokeswoman Erika Shaffer said. The Microsoft rival makes a digital music and video player and sells subscription download services.
What's changingThe new system bolsters security on Windows, its built-in Internet Explorer browser and Outlook Express e-mail. Among the changes, a Windows Firewall will automatically be turned on, helping to guard against attack. The browser has been fortified, and a new attachment manager will offer tougher policing against e-mail-borne attacks.
The changes in the way Windows polices itself — particularly the newly strengthened firewall — could cause troubles for applications that are used to working with Windows’ old ways.
Some say that’s particularly true of applications that regularly interact online, such as gaming programs or music services.
Security experts say it’s tough to know how many companies may have to change their products to be compatible.
The company has delayed SP2’s release, originally scheduled for June, amid efforts to improve compatibility. Microsoft group product manager Barry Goffe says the “vast majority of applications” should function properly when SP2 comes out.
In the end, analysts believe most consumers will avoid major problems because most companies that have problems will fix them by the time SP2 is released. Gartner Research estimates that a mere 3 percent of applications that run on Windows won’t work once SP2 is out.
But Microsoft’s Goffe says corporations running customized applications could have more complex problems, requiring them to specially configure SP2. Many legitimate corporate programs depend on just the type of interactions that would also alarm the security system.
It could take months for businesses to adopt the upgrade.
Perhaps the biggest change will be a host of new alerts that offer more detailed information about what programs are trying to contact the computer and give the user more chances to accept or decline.
In the end, Cooper expects most corporations will run a very scaled-down version of SP2, both because they want to avoid compatibility problems and because it could be a nightmare to manage things like personal firewalls on thousands of desktops.
Still, many big businesses are likely running separate security applications as well.
Perhaps the biggest change with SP2 will be a host of new alerts the user will suddenly get, offering more detailed information about what programs are trying to contact the computer and giving the user more chances to accept or decline.
Macromedia Inc.’s Flash technology required only minor technical changes to make it compatible with SP2. But the company was more concerned about early language in these warnings that could make even legitimate interactions seem scary and unwise.
David Mendels, Macromedia’s senior vice president in charge of developer products, said Microsoft was very responsive to its concerns. Now, he said the prompts are less dire and more specific.
Microsoft’s own products are not immune. Joe Wilcox, a senior Jupiter Research analyst who is testing an early version of SP2, recently was blocked from using Microsoft’s Office Live Meeting conferencing product. Although he could have overrode that, Wilcox instead skipped the online option and called on a regular phone.
Wilcox sees this as a victory for Microsoft, because it changed his behavior and kept him from exposing his computer to potential risk.
To Pescatore, such inconveniences are worth it.
“From a security perspective, the problems we’ve been having — these worms and such — we can often blame on thing that need to be fixed in Windows,” Pescatore said. “So when Microsoft finally gets around to fixing them, it’s going to take some pain to get past that point.”

© 2004 The Associated Press. All rights reserved

Sunday, July 11, 2004

Alleged Hacker Now Works for Microsoft

SEATTLE - A man accused of hacking into search engine company AltaVista's computer systems about two years ago is now employed by Microsoft Corp., reportedly working on search technology.
Laurent Chavet, 29, was arrested by FBI agents a week ago in Redmond, Wash., acting on a warrant issued in San Francisco.
Federal prosecutors allege that Chavet hacked into AltaVista's computer system to obtain software blueprints called source code and recklessly caused damage to AltaVista's computers.
Microsoft spokeswoman Tami Begasse said Friday that Chavet, who lives in suburban Kirkland, is an employee of Microsoft. She declined further comment on the nature of Chavet's employment or when he started at the company, citing Microsoft policy on not discussing personnel matters.
Generally speaking, Begasse said: "We're confident in our policies and procedures we have in place to protect our code and to ensure that employees do not bring third party code into the work place."
A woman who answered the phone at Chavet's house Friday said he would have no comment.
The Seattle Post-Intelligencer, citing anonymous sources, reported that Chavet had been working on Microsoft's MSN Search effort.
In a research paper on search technology published in IBM Systems Journal, Chavet is listed as a search expert who works at Microsoft and was previously with AltaVista.
In 2003, AltaVista, based in Sunnyvale, Calif., was acquired by search company Overture Services, Inc., which in turn was acquired by Yahoo Inc. (Nasdaq:YHOO - news) later that year. Microsoft's MSN Web site currently uses both Overture's and Yahoo's search technology.
But the Redmond company has begun an aggressive effort to develop its own search technology as it tries to compete with search engine leaders Google Inc. and Yahoo. Microsoft, which has acknowledged it lags in search, hopes to play catch-up with a broad-based search tool that allows users to also scour through e-mails, documents and even big databases.
Court documents say Chavet worked at AltaVista from approximately June 1999 to February 2002. Beginning in late March 2002, the U.S. attorney's office alleges in court documents, Chavet began accessing AltaVista's computers without permission, causing about $5,000 in damage over a one-year period.
A spokeswoman for Overture declined to comment on Chavet's case. Assistant U.S. Attorney Chris Sonderby, who is in charge of the California unit that is prosecuting the case, told The Associated Press that the allegations against Chavet "do not pertain to Microsoft."
Chavet was released on a $10,000 bond and is expected to make a court appearance July 20 in San Francisco. Both charges carry a maximum penalty of five years in prison and a $250,000 fine.

Written by: ALLISON LINN, AP Business Writer

Friday, July 09, 2004

Lovgate Worm Comes Back to Life

A new variant of the Lovgate worm has been discovered infecting PCs globally, according to security bulletins by major security firms including Symantec and McAfee.
First discovered in February 2003, the Lovgate worm spreads by e-mailing itself to addresses found on infected PCs. Once inside a machine, the worm opens a "back door" to allow an attacker inside. In addition, Lovgate scans PCs for executables and replaces them with further copies of itself.
Considered a medium risk by both Symantec and McAfee, the new Lovgate variants--Lovgate.AE and Lovgate.AH--target Microsoft's Windows applications and will disable antivirus software and security applications on an infected system.
"What this worm does... is it responds automatically to e-mail sent and attaches itself in the reply," explains Jeffrey Posluns, chief innovation officer at Toronto-based IT security provider WhiteHat. "It is a much more likely mechanism to have the recipient of the e-mail open the attachment. The inherent paranoia usually related to attachments is diminished because it is a reply to an e-mail sent."

Making a Comeback

Despite being dormant for nearly a year, Posluns says it isn't surprising to see viruses like Lovgate rear their ugly heads again. In fact, he says there are several ways and incentives for virus writers to re-infect systems with the same viruses. In the case of Lovgate, the source code is already written.
"That is the hard part," he says. "Virus writers can make modifications but the code is already done so they save on time."
He also notes that while no firm or user should be without antivirus software, it's not the be all and end all of a secure system. Posluns likens the newest strain of Lovgate to the Hepatitis disease and vaccine: a "shot" for Hepatitis A won't protect against Hepatitis B or C.
"Most virus writers will modify the virus just enough so that antivirus definitions will not be able to pick them up," he says.
As a rule of thumb, Posluns says e-mail administrators should configure systems to delete executables as soon as they pass through the e-mail server. WhiteHat, for example, has developed Insight Antispam and Antivirus, an offering that does just that.
Insight works in tandem with antivirus definitions like Symantec's Norton and McAfee to decrease the amount of real threats that make it through to the employee desktop. During trials in the month of June, Posluns says that out of 101 million e-mails received, the Insight product was able to determine and delete 70 million messages as spam and 21 million as harboring viruses. He says that while no viruses made it through to end users, 32 were picked up by antivirus definition software.

Written by: Carly Suppa, ITWorldCanada.com

Websites Still Infected???

More than 100 Web servers running Microsoft's Internet Information Services software are still infected with malicious code that was part of a widespread Internet attack, known as Scob, or Download.ject, that began two weeks ago, a security researcher says.
Dan Hubbard director of security and technology research at Websense Inc., a maker of employee Internet management and content protection software, says he spotted the 100-plus sites when the firm conducted its routine study of roughly 24 million Web sites for malicious code and possible Web-based attacks.
The Scob attack first surfaced the week of June 21 when security researchers began warning that thousands of hacked Web sites were infected with malicious software and that those servers placed Web surfers at risk to attack.
It's widely thought that Russian hackers were behind the attack, which took advantage of unpatched Web servers running Microsoft IIS software version 5.0 as well as several vulnerabilities within Internet Explorer. One of the Internet Explorer vulnerabilities the hackers exploited didn't have a patch, or a fix, at the time of the attack.
Web surfers who visited infected Web sites where themselves infected with hacker tools designed to steal personal information and send it to a computer Internet address located in Russia, which was quickly shut down by Internet service providers.
Web surfers didn't need to click on a link or an attachment to get infected in this attack; simply visiting a compromised Web site was enough.
While the attack targeted sites running IIS 5.0, Hubbard says the majority of the remaining infected systems are now running version 6.0.
It's not a new attack on version 6.0, says Hubbard, but rather Web site operators are upgrading to IIS version 6.0 on top of their infected IIS 5.0 systems.
While Hubbard won't name the infected Web sites, the reaction he got from the 25 or so sites he managed to contact was unsettling. "The majority were not even aware of the Scob attack," he says. "They had no idea any of this was going on. Only one person was up on what is happening in the security world," he says.
While this attack was thwarted by shutting down the hacker system that collected end-user information, more copycat attacks are likely, experts warn.
Microsoft on July 2 issued a "configuration change" designed to plug the unpatched Internet Explorer security hole targeted in the Scob attack. However, security researchers this week say they've found ways to bypass the workaround and successfully attack fully patched versions of Internet Explorer.
Microsoft said last Friday that the configuration change was a temporary solution and that the software company would be releasing more thorough Internet Explorer fixes in coming weeks.
Microsoft is scheduled to release this month's batch of security updates on July 13.
The software maker has published a page dedicated to keeping consumers and corporate customers up to date about the download.ject attacks. It can be found here.




Mozilla Security Nightmare Begins

Just when Windows users thought it was safe to move away from Internet Explorer and its litany of security issues, a flaw has been detected in Mozilla, the open-source alternative to Microsoft's widely used browser.
The Mozilla Foundation has announced a "shell" protocol security vulnerability, affecting its browsers running on the Windows operating system.
The Mozilla security team reported that the flaw impacts the company's Mozilla application suite, and Firefox and Thunderbird products. The problem does not affect Linux or Macintosh users.


Phishing Hole

By exploiting the Mozilla flaw, an attacker can click on a URL displayed on the browser, open a new frame and run unathorized applications on that frame, Vincent Weafer, senior director for Symantec security response, told NewsFactor.
"It's the type of client-side vulnerability found on other browsers, including Internet Explorer, that is used with spyware phishing attacks," he said. Weafer recommends disabling the shell, in addition to applying the appropriate patch or patches, so that attackers cannot gain local access to the affected PC. Users should also make sure that security features on their browsers and applications are activated.
"People are increasingly nervous about IE and phishing attacks, but this shows that other browsers are vulnerable as well," said Weafer.


Vulnerability Epidemic


Mozilla has released a configuration change which resolves this problem by disabling the use of the shell. A patch is available as a download that makes this configuration adjustment for the user, or users can install the latest releases of Mozilla, Firefox or Thunderbird.
Future versions of Mozilla Firefox will include automatic update notifications, the foundation said, providing users with prompt information on security issues.
The announcement follows a succession of alerts on vulnerabilities recently detected in the Explorer browser. Microsoft's problems have gotten so bad that the U.S. Computer Emergency Response Team (CERT) has recommended that users seriously

Written by: Jay Wrolstad, www.enterprise-security-today.com

Tuesday, July 06, 2004

this is an audio post - click to play

Microsoft Office 2003 Tips

I've been using Microsoft applications such as Word and Excel since before the massive Office suite was a gleam in some marketer's eye. And I can tell you that I am constantly learning something new about this package of applications. The fact is, Microsoft Office 2003 is so huge and comprehensive, it may actually be worth the $250 that Microsoft charges to upgrade to this latest version.
While certain high-end versions of Office pack in database and graphics software, most of us spend the majority of our time in three main programs: Outlook, Word, and Excel. So here are a few tips to help you get your money's worth from Office's trio of main components.

Outlook 2003

Crunch Outlook Files: Are you running out of disk space? Outlook's data files can balloon to hundreds of megabytes, thanks in part to bulky attachments. Put Outlook on a diet by deleting attachments that you don't need or that you've already saved to disk. In the Navigation pane, double-click the Search Folders item and click the Large Messages folder. The message list window now shows all messages larger than 100KB in size, starting with the largest items.
To strip out attachments, double-click a message header, then right-click the attachment in the message window and choose Remove in the resulting window. Press Esc and click Yes at the prompt. Rinse, lather, and repeat for all the attachments you want to lose.
One final step: The Outlook PST file (with the ".pst" file extension), which contains all your e-mail, contacts, appointments, and so on, won't shrink on its own. You have to compact it first, much the way you have to squeeze air out of a half-full garbage bag before tying it up. Click Tools, Options and click the Mail Setup tab. Click the Data Files button. In the Outlook Data Files dialog box, select the PST file to compact. Then click the Settings button and in the dialog box that appears, click the Compact Now button.
Outlook Quick Draw: Outlook is really five or six programs in one. Fortunately, Office 2003 makes it easier than ever to jump among the Mail, Calendar, Contacts, and other modules, using lightning-quick key combinations. Press Ctrl-1 to jump to the Mail screen, Ctrl-2 for Calendar, and Ctrl-3 for Contacts. Ctrl-4 opens up the Tasks module, while Ctrl-5 takes you to Notes. Ctrl-6 opens the Folder List view in the navigation pane, no matter what module you are working in.
Get Attachments Fast: Outlook lets you open attached files in a flash. Just right-click any message header with a paper clip icon and click View Attachments from the context menu. All the attached files in the message appear in a fly-out menu. Click one, and it will open in its application.
Move Your Data: By default, Outlook buries the PST file that contains all your data deep in the Documents and Settings folder. You can move it to a more convenient place so it's easier to back up. Navigate to your outlook.pst file (you might need to use the Explorer Search function to hunt it down), then right-click the PST file. If you find more than one, you probably want the file with the most recent Last Modified date. Copy this file to the place you want (for instance, in a folder you name Outlook Files in My Documents), then delete the original PST file. Of course, it's a good idea to make a backup of your original file before doing all this.
Next, launch Outlook. When you get an error message, click OK. The Create/Open Personal Folders File dialog box will pop up; in it, navigate to the new folder containing the outlook.pst file you just copied. Select the file and click the Open button. Outlook now launches and will henceforth look for its data in the new location that you specified.
Dude, Where's My Work? It happens to me all the time. I double-click an attachment in Outlook, spend two hours editing it, click the Save icon, and then close the file and the Outlook application without remembering to save the attachment to a folder in My Documents. A day later I can't find the updated file anywhere, no matter how much I search my hard drive and in-box. If this has happened to you, it's likely that Outlook is hiding your work in some cryptic folder. Here's how to recover your work.
Go to the original message and double-click the attachment you had opened earlier. Now select File, Open in the application you're using. Check to see if the "Look in:" drop-down menu shows something like "OLK4." This is a hidden directory used to house Outlook attachments. If you blithely saved a file opened from Outlook and didn't prompt the program to save changes to the message containing the file, your work almost certainly landed in this directory. You can open any of the files you see here by right-clicking them and choosing Open from the context menu. From there you can examine the file to see if it is the version you want. Once you find the lost file, select File, Save As from within Outlook to save a copy of the edited file to the appropriate folder.

Word 2003

Banish Reading Pain: Call me ornery, but I think the Reading Layout feature in Word 2003 is the pits. Problem is, every time I double-click a Word attachment in Outlook, Word insists on dropping me into this screen-hogging interface. Stop the madness by choosing Tools, Options and clicking the General tab. Then uncheck the "Allow Starting In Reading Layout" check box. Now those Word attachments will open in the standard Normal or Print view, which makes for easy editing and space-saving reading.
Research Savvy: Office 2003 adds to all its applications the ubiquitous Task Pane, which appears along the right edge of the application window to provide access to everything from application help to clip art. One useful Task Pane function is the Research Pane, which I use quite a bit in Word 2003. Hold the Alt key and click on a word in any document, and the Task Pane displays a dictionary definition of the word you clicked, as well as links to thesaurus entries and other useful information. Note that the Research pane requires you to be online to access information.
Compare Documents: Who hasn't had to produce an updated document from multiple revisions? Word 2003 makes this a little easier with its Compare Side by Side feature. Open the two document versions you want to compare and select Window, Compare Side by Side. Word makes each document fit in one half of the screen. Scroll through one document and the other scrolls with it, making it possible to browse through two documents at the same time.
Tracking With Versions: Speaking of working with versions, here's a way to keep track of a document as you work on it. Next time you save a document, don't just use File, Save. Instead select File, Versions. In the Versions dialog box, click the Save Now button. In the dialog box that appears next, enter any comments that help identify the document in progress. Click OK, type in the document name, and click Save.
Next time you reach an important milestone--say, just before sending the document out for review--click File, Versions, enter any comments you wish, and click OK. A new version will be stored inside the document file and listed in the Versions dialog box. To review an earlier saved version, open the document file, click File, Versions, select the version you want in the Versions window, and click Open.
Frequently Used Files: Everyone knows that Office displays the most recently accessed files under the File menu for quick access. But did you know that you can assign files to be permanently accessed directly from the menu? Select Tools, Customize and click the Commands tab in the Customize dialog box. Scroll through the Categories list, select the Built-in Menus item, then scroll down to the bottom of the Commands window and select the Work item. Drag the Work item into the toolbar area. A new Work menu item will appear. Click OK in the dialog box.
Now add a file to your new Work menu. First go to File, Open to open the file you want. Once it is open, choose Work, Add To Work Menu. The open file's name now appears in the drop-down list when you click Work. The next time you need the file, just open the Work menu and click on the file name.

Excel 2003
Conditional Formatting: It's easy to overlook important data in a sprawling spreadsheet. That's why I use the nifty Conditional Formatting feature to make critical data jump off the screen. Say you're tracking household expenses and want to keep an eye out for anything that cost more than $1000. Select the column in your spreadsheet with the dollar amount and select Format, Conditional Formatting. In the resulting dialog box, make sure the Condition 1 drop-down list control is set to "Cell Value Is." Then set the second drop-down list box to "greater than or equal to." Finally, enter the number 1000 in the text box on the right. Click the Format button to open a dialog box where you can set the Font, Border, and Patterns. Click OK twice. You can even apply multiple conditions--very slick.
Filter Magic: Another highly useful tool for sniffing out data is the terrific AutoFilter command. Open the table you want to work with and select the entire row containing the table headers. Now select Data, Filter, AutoFilter. You'll see a little drop-down button appear in each cell in the row. Click one of those buttons and a list of entries contained in the column appears in a scrolling list box. Click one of the entries, and only those rows containing data matching that entry will appear on the screen. You can even use the Custom entry to make the AutoFilter look for all entries above or below a certain value.
Formula Fix-It: You just put the final touches on a nifty spreadsheet. There's one problem: You can't puzzle out why the averages you're trying to calculate seem wrong. Excel can point you to the problem. Right-click the Excel toolbar and select Formula Auditing to bring up some useful tools for seeing how your formulas interact. Then select a cell with the misfiring calculation and click the Trace Dependents and Trace Precedents icons to see the flow of data across your sheet. In many cases, you'll see that the cell you selected is reading data from the wrong source.
Digital Grid Paper: We recently built a new house, and I needed to show the builder our plans. Rather than buy a home design package, I turned to Excel to create a digital grid paper that made it easy for me to build and update our home layouts. Start by selecting an entire blank sheet (click the gray square in the upper-left corner), then select Format, Row, Height and enter 11.25 in the dialog box. Click OK. Then select Format, Column, Width and enter 1.43 in the box and click OK.
The individual cells in the sheet are now perfectly square. From there, it's a simple matter to use Excel's slick Border tools to create a grid. Just right-click the Excel toolbar and select Borders from the context menu to bring up the border drawing tools.

Improving Office
As great as Microsoft Office is, there are things you can do to make it better. For example, Microsoft offers a host of updates, fixes, downloads, and templates at its Office Online site.
Third-party add-ons, like the Woody's Office Power Pack for Office 2003, can also help. WOPR improves on Office features that still have a rough edge, like the maddening envelope printing interface, and provides functions like a Windows system tray icon for accessing features without having to open an Office application first. The $30 application can be found at Woody's Office Portal.
That's it for now. I hope you've found something useful in this small sampling of the tricks I use every day. Of course, there are about as many tips for using Office as there are arcane features in the software. If you've got a great tip, let others know about it. We could all use a little help taming Microsoft's behemoth of a software suite.

(Tips provided by Michael Desmond www.pcworld.com)

Monday, July 05, 2004

Microsoft IE Security Storm Builds

It has not been a good week for Microsoft's Internet Explorer browser. After last week's Download.JECT virus, which used IE as a vehicle for installing a worm, and a vulnerability report from the U.S. Computer Emergency Readiness Team, some industry experts have called for a switch to other browsers, such as Mozilla or Opera.
Ironically, during the same week Microsoft finally put to rest its long-running court battle with the U.S. government over the company's business practices -- specifically, weaving Internet Explorer into the fabric of the Windows operating system. A District of Columbia appeals court affirmed a lower court ruling that Microsoft would not have to make IE a separate software program.


Own Worst Enemy
But the fact that IE is bundled into Windows rather than being marketed on its own has allowed the browser to languish without material security updates for almost four years. "There hasn't been any competition, so there hasn't been a reason to improve it," said Gartner analyst John Pescatore.
But there is a deeper reason that Microsoft has not beefed up the security of its browser: It is woven into Windows. "To change the browser, you have to change the operating system," Pescatore told NewsFactor. "It's a bad idea to integrate applications into an operating system."
Linux in the Wings?
Microsoft was caught off guard with the Download.JECT virus, because the worm was written independent of Microsoft's announcement of a vulnerability in IE -- many worms are written after the company identifies weaknesses in its products and offers patches. Microsoft has yet to offer a patch for the IE problem -- hence, the calls by some industry experts for a switch to an alternate technology.
But experts say the enterprise has few alternatives.
"Mozilla has been shaky in the past, although the new versions have been pretty good," noted Pescatore. "But you don't have any grand assurance that a company like IBM or Red Hat is behind the browser," he said.
Security problems in Windows, such as the Explorer vulnerability, are causing more enterprises to look at the Linux desktop, says Pescatore. "But I don't think it's making any businesses just drop Windows at this point."

Friday, July 02, 2004

Microsoft Releases Security Update July 2004

NEW YORK - Microsoft Corp. issued an interim security update Friday to protect users of its nearly ubiquitous Internet Explorer browsers from a new technique for spreading viruses.
The update does not entirely fix the flaw that makes the spread possible, but it changes settings in Windows operating systems to disable hackers' ability to deliver malicious code with it.
The security measure came in response to last week's discovery of a computer virus designed to steal valuable information like passwords. Though its outbreak was mild, security experts said the technique for spreading it was novel and could be used to send spam or launch broad attacks to cripple the Internet.
Hackers had converted hundreds and possibly thousands of Web sites into virus transmitters by first hiding malicious code using a vulnerability with Microsoft's software for operating Web sites. A fix for it had been issued in April but was not universally applied.
Two other flaws in Microsoft products allowed hackers to direct Internet Explorer browsers to automatically run the virus when visiting an infected site.
Though one of those flaws remains unfixed, Friday's setting changes thwart any attack by prohibiting a Web application from writing files — such as the virus code — onto users' computers.
The U.S. Computer Emergency Readiness Team urged computer users to install the update, saying it would greatly increase protection. But the advisory warned other types of attack remain possible.
Stephen Toulouse, a security program manager at Microsoft, said the company still was working on a comprehensive patch to fix vulnerabilities with Internet Explorer, but the settings change should protect users from the immediate threat.
The software update covers Windows XP (news - web sites), Windows Server 2003 and Windows 2000 (news - web sites), and Microsoft was working on ones for older systems.
The update will also be included with a major Windows XP upgrade, called Service Pack 2, later this summer. Toulouse said the Service Pack will include additional protections.
After installing Friday's update, users should be able to lower their security settings from the "high" one initially recommended as a stopgap, he said.
Russ Cooper, a senior researcher at TruSecure Corp., welcomed Friday's update, but said it should have come sooner than a week.
"It would have taken a couple of hours to put it together as a package, and (the testing) process can take a day or two," Cooper said.
But Toulouse said that given the broad user base for Windows and Internet Explorer, even a problem affecting less than 1 percent of users potentially hurts millions of customers.
He said the settings could potentially affect legitimate applications used internally by Web developers and corporate networks, and special instructions were available to address those cases.
The update will be automatically installed if computers are set to receive it. It is also available at http://windowsupdate.microsoft.com.

Tuesday, June 29, 2004

Russian website spreading 'malicious' program shut down: Microsoft

WASHINGTON (AFP) - A Russian website that spread a "malicious" Internet (news - web sites) program has been shut down, software giant Microsoft said, adding that users of Internet Explorer are no longer at risk.
"Internet service providers and law enforcement, working together with Microsoft, identified the origination point of the attack in Russia and shut it down on Thursday," Microsoft said in a statement released late Saturday.
The Download.Ject program was not a virus or computer worm, Microsoft said, describing it as a "targeted manual attack by individuals or entities towards a specific server."
Unlike viruses that spread by e-mail, this infection was propagated simply by visiting an infected website, which can install a so-called trojan or keystroke logger that allows hackers access to the PCs, security experts said Friday.
Security (news - web sites) experts warned that the program could be used to steal financial information and e-mail passwords.
The company, owned by billionaire founder Bill Gates (news - web sites), said the program "exploited a vulnerability in Internet Explorer to deliver malicious code to visitors of an affected Web site."


"Working (news - web sites) with customers and partners worldwide, Microsoft is unaware of any widespread customer impact based on Download.Ject," said the company based in the northwestern state of Washington.
"The originating Web site of attack has been taken offline," Microsoft said.
"Internet Explorer customers are no longer at risk from that particular attack source as of Thursday evening."
Users of Microsoft's "IIS 5.0 Servers (news - web sites) that have not been updated with security update MS04-011 are susceptible to this attack," the company said.
Microsoft recommended that customers go to www.microsoft.com/protect to shield their personal computers from infection.
Microsoft said it is working with authorities and other companies to "bring those responsible for this criminal act to justice."