We help organizations improve and grow by more effectively using technology.
Here is a review of this weeks Cert Advisory. This update contains issues with Apple iTunes, Safari and Mozilla Firefox. Be sure to update these products if you haven’t recently. This is a weekly feature here at Managed Solutions. If you have questions about this video post a comment here or ask on our Facebook Fan Page.
Popularity: 4% [?]
I seem to write a post on this once a month minimum. When I opened this weeks Cert advisory there were 14 9.3 vulnerabilities for Adobe Reader and Acrobat. This plague of vulnerabilities and the related exploits that have popped up remind me of Internet Explorer 5 years ago. So here at Managed Solutions we are once again advising our clients to apply any updates to Adobe products when prompted or to exercise extra caution with .pdf files. Here is the menacing list of vulnerabilities announced on 6/30/2010:
14 Adobe Acrobat Vulnerabilities
Popularity: 6% [?]
While reviewing this weeks CERT summary I noticed three vulnerabilities with a risk rating of 10 which is the highest. With the wide distribution of the iTunes software, these vulnerabilities have potentially serious ramifications. Since they involve remote code execution it is prudent that any and all users of iTunes upgrade to version 9.2 or newer. You can check the version you are running via help/about in the program menu. Here is a partial screen-shot of this portion of the Cert advisory followed by a link to the advisories:
iTunes Vulnerable - Cert Advisories
Resources:
Popularity: 5% [?]
I encountered a great opportunity this evening, the opportunity to share an inside look of a Phishing Email. What is Phishing?
“In the field of computer security, phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.” – Wikipedia
What I noticed was an Email purportedly from Bank of America telling me that there was an “Account Resolution Required”:
Message in Outlook Allegedly from Bank of America
I scanned over to the preview pane and noticed that it had a link that appeared to be correct, so I hovered over the link to see if the link was spoofed and to no big surprise, it was. Here is how the message looked in my preview pane, I did not download pictures because that is a popular way for spammers/crooks to confirm Email addresses of their targets/victims:
Full Phishing Email Screenshot
Let me further clarify in lay terms, the link that reads:
https://www.bankofamerica.com/home/1244618/ddjdfdkfi126.aspx?screenid=Update_Acct
is actually:
http://prostyle-esports.nl/index.php
and this is evident when I hover over, or place my mouse cursor on the “alleged” link. This is a tactic you can use to check links you are unsure of. However I should clarify that it doesn’t always work. There have been occasions where this has been spoofed effectively typically it has to do with the Email client or Browser and security patches on your computer.
Testing the Link
Using a test environment I pasted the link to see what the target site looked like:
Blocked - Forgery
I was pleased to see it had been blocked, this saved me the time of researching and Emailing the Internet Provider involved. After confirming this I used “properties” on Outlook to get the header information, there is a lot of information but plenty of clues to let me know that this message was not authentic (had everything else appeared right, which most certainly the SSL certificate warning would have popped up unless it was an unprecedented forgery!). Here are a few of the more obvious lines I parsed from the headers:
Output of Arin.net Whois - RIPE
There are a lot of ways to spot fraudulent/Phishing Emails. Our advice to our clients is if they are not 100% certain we recommend they forward the messages to us for analysis. Most of these kinds of messages are blocked and we don’t see them, but if something doesn’t look quite right it probably isn’t.
Popularity: 8% [?]
A very common complaint by end users involves “automatic updates” and some people go to great lengths to avoid them. We published this quick tip about when and how to run them to minimize the impact. There are several programs that you should think twice before bypassing or ignoring the update:
The last item on this list is the primary purpose for this post, check out this bulletin from March 2009 related to Oracle Java. There were a total of 27 new security fixes:
“Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible. This Critical Patch Update contains 27 new security fixes across all products.”
So please, when you get the notices for these updates – run them. Another great way to avoid many of these problems is to operate your computer with an account that has lower permissions. We will write a follow up describing how to do that and why.
If you’d like to see a chronological history of the Java updates or see if there are new ones go here. You can also add them to your RSS reader here.
![Reblog this post [with Zemanta]](http://img.zemanta.com/reblog_e.png?x-id=515d61fe-9366-44d4-8a24-69c915746ff2)
Popularity: 7% [?]
Here is a review of this weeks Cert Advisory. This update contains the infamous Arucer.dll that came with the charging software on the Energizer Duo USB. Also definitely recommend updating your Microsoft Office products if you haven’t recently. This is a weekly feature here at Managed Solutions. If you have questions about this video post a comment here or ask on our Facebook Fan Page.
![Reblog this post [with Zemanta]](http://img.zemanta.com/reblog_e.png?x-id=9a711caa-977d-4b42-838c-8e6733164d42)
Popularity: 5% [?]
Here is a review of this weeks Cert Advisory. Surprising number of Google Chrome issues this week, luckily Chrome is updated constantly and quietly without prompting. This is a weekly feature here at Managed Solutions.
Popularity: 2% [?]
Here is a review of this weeks Cert Advisory. This week is Microsoft triage week, there are a ton of 9.3 severity and above (out of 10) vulnerabilities. This is a weekly feature here at Managed Solutions. What can you do to protect yourself:
Popularity: 2% [?]
Here is a review of this weeks Cert Advisory. The main highlight are the vulnerabilities in Internet Explorer version 5, which is not broadly used. This is a weekly feature here at Managed Solutions.
Popularity: 2% [?]
Recent Comments