security

Update Flash now

Dave Farquhar security ,

Adobe updated Flash today, to fix a couple of 0-day vulnerabilities. Here’s how to force a manual update on Windows and Mac OS X. I put on my sysadmin hat and looked over the update scripts on the page; they’re a little complex but don’t do anything nefarious.

Grab the appropriate update script for the type of computer you’re running, close your browser, run it, and stay safe. And remember, you’re doing me and the rest of the world a favor; if your computer is up to date, then it isn’t attacking my network, and if mine’s up to date and secure, mine isn’t attacking yours.

Advice on dealing with ransomware

Dave Farquhar security , , , , , ,

PC Mag has some advice about ransomware. The most important bit of advice is to have a secondary machine that you can use to go get help.
Read more

Beware of unexpected links in e-mail messages

Dave Farquhar security , ,

Hackers are stealing Yahoo accounts by sending messages containing malicious web page links.

The message looks like a link to a web page on MSNBC. But if an unsuspecting user clicks on it, it redirects to another page that steals the e-mail account, allowing the hacker to use the account to send spam, or grab the account’s contact list.

The gory details are here.
Read more

Wi-fi wants to be free… except it’s not 1994 anymore

Dave Farquhar security , , ,

The Open Wi-Fi movement was on the front page of Slashdot yesterday afternoon. Predictably, comment #2 was, “give me immunity from the MPAA and RIAA and I’ll open my Wi-Fi.” Valid point. Very valid point.

Though there are other problems, too.

Read more

Windows Medkit cleans up the damage after removing malware infestations

Dave Farquhar security , ,

I’ve written before about cleaning up Windows boxes using a Bitdefender Live CD, but the live CDs often don’t clean up all of the collateral damage that the malware does to try to keep you from uninstalling them.

That’s where Windows Medkit can come in.

Read more

The lines between white hat/gray hat/black hat hacking and moral laws

Dave Farquhar security , , , , , ,

Longtime reader/commenter Joseph asked two questions yesterday: What’s the boundary between gray and black-hat hacking, and is it moral to pick and choose between moral and immoral laws?

The first question is easier than the second. So I’ll tackle that one first. Read more

University computer science programs need to teach security, not demonize it

Dave Farquhar security , , , ,

I saw this on Slashdot today: A computer science student was expelled from a Canadian university for practicing what most people would call white-hat hacking.

Their reasoning: “Schools are supposed to teach best practice, which includes ethics and adherence to reasonable laws.” But there is such thing as ethical hacking. Read more

What I did since I (temporarily) need Java

Dave Farquhar security ,

I’ve been seeing the same question over and over in my search logs lately: Is Java safe to run in 2013?

Generally speaking, the answer is no.

I have little choice but to run Java right now, though. I’m studying for a certification exam, and the best quiz program that I know of is written in Java. Its user interface is in Polish, a language I don’t speak, but that bothers me less than it being written in Java. Google Translate can help me with the Polish, but it can’t make Java safe. That’s up to me.

So here’s what I did.
Read more

Long passwords aren’t necessarily good passwords

Dave Farquhar security ,

Well, crud. Not all long passwords are good passwords.

I’ve suspected for a long time that street addresses aren’t good to use–the formula is too simple–but now it seems that even mashing together a sentence into a long password doesn’t work. (That isn’t something I do often, but I’ve done it at least once or twice.) Read more

Java is patched now, but still not very safe

Dave Farquhar security , , ,

Rapid7’s Chief Security Officer, HD Moore, estimated it will take two years for Oracle to fix all of the current issues with Java, not counting anything new that happens in that timeframe.

Futhermore, Kaspersky states that 50% of cyberattacks in 2012 utilized a Java exploit. Among those is the newly discovered Red October.

Think for a minute. Antivirus software is anywhere from 75 to 90% effective. Assuming the worst, that means the simple process of removing Java from your computer does 2/3 as much good as running antivirus software. Of course, you shouldn’t do one or the other; you should do both.

If you have a legitimate need for Java in your web browser, such as commercial intranet applications built with Java, enable Java in one and only one browser, then use that browser solely for accessing those Java-powered web sites.

But the best thing to do is just get rid of Java. And if you have something that uses Java, find something else to use.

It took Microsoft about two weeks to fix a critical vulnerability in Internet Explorer. It took Oracle five months. I never thought I’d say this, but Oracle needs to be more like Microsoft.

Yeah, you can quote me on that if you want.

But until Oracle gets religion on security like Microsoft did around 2002, we really have two choices: Avoid Oracle products whenever practical, or keep getting hacked. I’d rather you not choose the latter option.