Sans has the tip that information on the critical Windows updates expected tomorrow from Microsoft has started to be released.
MS 05-54: Cumulative Security Update for Internet Explorer
This will hopefully patch the javascript issues…
MS 05-55: Vulnerability in Windows Kernel Could Allow Elevation of Privilege.
This is another “wolf in sheeps clothing” alert. The Sunbelt blog has information and tips on a number of other sites that are posing as either the Windows security center page, or a page not found error. The windows security center spoof once again claims the following “Attention! Your system is under control of remote computer with IP address >>>>>>> The remote computer has access to the following folders on your PC: \windows\system32 \program files\internet explorer \my documents drive C;\ files, click here to download official anti-spyware software. Your private info is collected by w32.sinnaka.a@mm”
This would be a good thing for clamantivirus. eEye is considering “adopting” clamav for inclusion in their Blink product. The idea is that they would improve clamantivirus and then start integrating it as antivirus scanning functionality in their product. This would be really promising for the prospects of having clamav (clamwin) do real-time, on-access scanning on the windows platform.
Computers can communicate over networks. (Surprise!) That’s how you’re reading this post. The machine that this site is hosted on is listening for requests for connection. When it receives a request it answers back with a web page. In fact, computers can listen for a great many different kinds of connection at the same time. In networking we talk about a computer listening on a given “port”. The web server for this site (and most web sites) listens on what’s called port 80. There are 65535 possible network ports that a computer can listen for incoming connections on.
OK, this is an ambitious idea, but the two articles on Titan Rain and the lack of IT security training has planted a bug under the saddle so to speak…. I don’t know how many parts will be in this series. In fact, I may add to it from time to time even after an initial series. This is intended as a “crash course” in the essentials of network security. It’s aimed at the home users and managers of small networks (small business owners?) that haven’t thought about network security before and maybe will be a reference of some value even to those that are more intermediate. The essentials of network security will be covered in the first few posts.
Earlier this year there was an article or two about a rumored “hack attack” that was ongoing against US Government (and contractor) computer systems. The stories claimed that the attacks seemed to be coming from China. Today I’m seeing a couple of articles on the topic. First up is an AFP story on the problem it sounds as though little attention has been paid to hardening systems. There is speculation that the Chinese military is involved in the breakins. One incident was very neatly and methodically done, planting a backdoor in 30 minutes.
There is a trojan making the rounds that is acquired by clicking on links in an email. That’s not necessarily new, however…. this email represents itself as an authentic-looking Microsoft security bulletin and the links are supposedly to updates (sorted by Windows version.) It’s important to point out that Microsoft does not send registered users security notices in this manner and if you are concerned about security updates you should either enable automatic updates or visit http://windowsupdate.microsoft.com
Now it appears that the Illionois Attorney General is also investigating Sony in relation to the recent DRM software debacle related to their XCP Digital Rights Management software.
her office has requested information from the company regarding anti-piracy software it included on music CDs that experts have shown exposes Microsoft Windows users to security holes and computer viruses.
The Hindustan times has an article on the latest round of India vs. Pakistani hacker/IT online skirmishes. It sounds as though there has been a recent rash of back and forth with Pakistani cracker groups trying to break into and deface Indian web sites and India trying to get word out to help secure the sites against the attacks. This is not a new thing….
Incidents.org has a note on a recently noted trojan.spaxe.exe, that when on a system will mimic the windows notification dialogue “bubble” near the system tray with the following text.
“Your computer is infected!
Windows has detected spyware infection.It is recommended to use special antispyware tools to prevent data loss.
Windows will now download and install the most up-to-date antispyware for you.Click here to protect your computer from spyware.”