Privacy, Security Archive

Sun Microsystems has fixed five security bugs in Java that expose computers running Windows, Linux and Solaris to hacker attack. In the meantime Apple also released a Mac OS X security update for apache_mod_ssl, CoreFoundation, CoreTypes, curl, iodbcadmin, OpenSSL, Safari, sudo, syslog. Elsewhere, computer code posted can crash vulnerable Windows machines by exploiting a "critical" Windows flaw disclosed and patched by Microsoft in October.

How are users supposed to learn if they never fall down? For many users, being faced with "safety" features just creates more workaround. Confirming, clarifying, and checking every operation, as most applications these days do, is intended to protect users from accidents. The result is similar to what many people find after putting training wheels on a child's bicycle: the vehicle is more cumbersome and the child never learns to ride it properly.

Black-hat hackers often use a bundle of tools called a rootkit to secure access to your machine and cover their tracks. When working on your computer, they need to store files and be sure that you will not stumble across them and get suspicious. Peter Hickman explains how this works.

"Whether you're a buyer or a seller of a product, the essential goal of standardization is to make interoperability possible, allowing communication with anyone else using the same protocol and media. In some cases though, vendors have specific reasons for not being compatible - and those vendors have developed a standard for incompatibility, digital rights management. The goal of DRM is to limit compatibility because things which are compatible can be copied and distributed freely. In this article, Peter Seebach looks at a potential oxymoron - standards designed to subvert and prevent interoperability."

It appears that Sony has been putting nasty payloads onto its copy-protected CDs in the form of a rootkit. "Not only had Sony put software on my system that uses techniques commonly used by malware to mask its presence, the software is poorly written and provides no means for uninstall. Worse, most users that stumble across the cloaked files with a RKR scan will cripple their computer if they attempt the obvious step of deleting the cloaked files. This is a clear case of Sony taking DRM too far."

"When choosing an operating system for use in your enterprise, you need to look beyond the security capabilities 'on the box' and think about how the OS really affects you over the long haul. You need to be prepared for the patching, upgrading, and maintenance issues each OS has and understand how these activities affect your security and availability."

The Measurement Factory and Infoblox today announced results of a survey of more than 1.3 million Internet-connected, authoritative domain name system servers around the globe. The results of the survey indicate that as many as 84 percent of Internet name servers could be vulnerable to pharming attacks, and that many exhibit other security and deployment-related vulnerabilities.

A Microsoft patch meant to fix critical security flaws in Windows 2000, Windows XP and Windows Server 2003 is causing trouble for some users, the company said Friday.

The Common Malware Enumeration Initiative was just announced. Headed by the United States Computer Emergency Readiness Team (US-CERT) and supported by an editorial board of anti-virus vendors and related organizations it should provide a neutral method for malware outbreaks.

Senior Microsoft executives on Thursday plan to provide an update on the software maker's security strategy and products plans, including its upcoming enterprise anti-spyware offering, sources said.

RSBAC is a flexible, powerful and fast open source access control framework for current Linux kernels. From a practical standpoint, it allows possibilities such as full fine grained control over objects, memory execution prevention, real time integrated virus detection and more.

To respond to the somewhat alarmingly real threat of spyware, malware, and to a lesser extent viruses on the Windows platform, Microsoft used its recently-acquired security technology combined with its own in-house work to build Windows OneCare Live (codenamed Atlanta). Read here for a preview. Please note that the 'next' button is placed underneath the Google ads, almost invisible.

Next week's 'Patch Tuesday' was already going to be quiet, with an update only for Windows. On Friday, Microsoft pulled that update, saying more testing is needed. In related news, officials at the Mozilla Foundation on Friday acknowledged that a potentially dangerous code execution hole exists in fully patched versions of its flagship Firefox web browser. Update: Seems like there already is a (temporary) fix available.

Confusion, fear, procrastination; these are words often associated with making decisions about IT security and as threats become more sophisticated it is easy to see why. The increasing popularity for workforce mobility have made detecting and eliminating threats purely from within the corporate network alone an inadequate approach to network security.