Report: Top Ten Vulnerabilities Exclude Microsoft Products

Yes, you read the title correctly.  Kaspersky released their 2012 third quarter report of the top ten vulnerabilities and no Microsoft product is on the list.  The data in the report is based on vulnerable programs and files detected on the computers of KSN users.  There was an average of eight different vulnerabilities on each affected computer.

Topping the list is Oracle Java, followed by Adobe products, particularly Adobe Flash Player.  Also included in the list are two Apple products, Quick Time and iTunes.  The list of vulnerabilities can be found on the Securelist, "IT Threat Evolution: Q3 2012", here.

The takeaway?

• Continue installing Microsoft Security Updates:  Windows Update - Keep your PC up to date
  
• Use a software firewall:  Firewall: frequently asked questions
  
• Keep your antivirus software updated:  Microsoft Security Essentials - Microsoft Windows
  
• Consider uninstalling Oracle Java:  Do You Need Java?
  
• Allow Adobe Flash Player to Autoupdate: Adobe - Flash Player : Help - About Updating Adobe Flash Player.
  -- With Firefox, use NoScript or Flashblock which also blocks Macromedia Shockware.
  -- AdobeBlockIE has not been updated recently but works with Internet Explorer.
  
• Consider an alternative to Adobe Reader, such as Sumatra PDF.  

Don't be a statistic.  Stay safe and keep your computer updated.

If your computer does get infected or you need assistance determining if it is up to date, post the requested logs for review in the Analysis and Malware Removal forum at LandzDown or in the Security Arena at Sysnative.com.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

OSX/Flashback Trojan

Last week security company, Dr.Web, reported findings of a massive bot net infection impacting Macintosh computers. The Dr.Web report met with a fair amount of skepticism until confirmed by Kaspersky researchers.

Estimates are that around 1 percent of all Macs worldwide have been infected with the Flashback trojan, with the largest majority in the U.S. and Canada.

Detection and Removal

If you or a friend has a Mac, there are a couple of simple methods for Mac users to check to see if their computer is infected with Flashback:

1. via Forbes, An Easy Way To Check Your Mac For The Flashback Malware 
2. via DrWeb, Dr.Web C&C Botnet HW-UUID checker

F-Secure provided removal instructions at Threat Description: Trojan-Downloader:OSX/Flashback.K. Because the OSX/Flashback Trojan uses a flaw in Oracle’s Java, F-Secure also provided instructions for Mac users to Update, Disable or Remove Your Java.

So, do Mac or Windows users really need Java? Following are reasons why someone may need Oracle Sun Java installed on their computer:

• Playing on-line games generally requires Java.
• With OpenOffice, Java is needed for the items listed here .
• It used to be that Java was needed for websites to be properly displayed. However, that is generally not the case now with Flash having taken over.
• There may be commercial programs that depend on Java. If Java is needed for a software installed on your computer, there should be a prompt for it.

If the above does not apply to you, consider uninstalling Java. In the event you discover that it is needed, you can always download the most recent version.

Protect Your Mac

With Windows operating systems being the majority, they have long been the the target of malware writers. As a result, it is seldom that I see a Windows OS without an antivirus software installed. The same is not the case for Mac users, although perhaps now they will see the light. Most antivirus vendors now provide licensed software specifically designed for Macs. There are also a few free programs available:

Free A/V for Macintosh:

• Sophos Free Anti-Virus for Mac
• ClamXav
• avast! Mac Security
• iAntivirus

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mac Rogue Remover Tool

The creators of rogue (fake) antivirus programs that have been plaguing Windows users for many years have now migrated to the Mac platform. 

Although Apple is planning a Mac OS X software update that is expected to automatically find and remove Mac Defender malware and its known variants, affected Mac users do not need to wait for the update.  In the meantime, Mac users are advised to consider the following:

1. For Safari users, uncheck the default setting "Open safe files after downloading" on your Mac.
2. In the event you fell for the scam and purchased the fake program, contact your credit card company.
3. Watch for the promised update to be issued by Apple.
4. Install an antivirus software.  (Sophos offers a free antivirus software for Mac home users.)

In the unfortunate event your computer has been infected with one of the rogues, Bleeping Computer to the rescue!  Site owner, Microsoft MVP Lawrence Abrams, has created a tool and removal guides to assist in the removal of many of the known variants of the recently released rogues.  As other variants become available, expect that additional removal guides will be made available. 

• Mac Security:  Mac Security Removal Guide
• Mac Defender:  Mac Defender Removal Guide
• Mac Protector:  Mac Protector Removal Guide
• Mac Guard:  Mac Guard Removal Guide

For background information on the Mac Removal Tool, see Introducing the BleepingComputer Mac Rogue Remover Tool.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pwn2Own Trifecta: Safari/MacBook, IE8 and Firefox

CanSecWest is underway in Vancouver, British Columbia. A part of CanSec is the Pwn2Own contest. In order to be owned, the competitor must demonstrate both loss of information (user data) and that financial cost would be incurred.

As described by Sarah Blankinship, Microsoft Senior Security Strategist, she said that it is

"a contest that pits researchers against technologies to see whether technology or human wins. It’s also a contest that presents interesting challenges to Microsoft and a contest which you might think Microsoft opposes. Like many other issues in the security ecosystem – it’s not that simple. The contest exemplifies two basic tenets behind the TwC Security teams’ efforts. You can’t hide from the truth (wishing doesn’t make it so) and every issue is an opportunity to learn and improve."

Interestingly, it took seconds for a fully patched MacBook with the Safari browser to be hacked. As described by Ryan Naraine at Pwn2Own 2009: Safari/MacBook falls in seconds:

"Charlie Miller has done it again. For the second consecutive year, the security researcher hacked into a fully patched MacBook computer by exploiting a security vulnerability in Apple’s Safari browser.

“It took a couple of seconds. They clicked on the link and I took control of the machine,” Miller said moments after his accomplishment."

It took longer to perform a clean drive-by download attack against Internet Explorer in what was described as a “brilliant IE8 bug!”, that in the wake of the release of IE8 today at the Mix Conference today. Ryan Naraine's report can be found at Pwn2Own trifecta: Hacker exploits IE8, Firefox, Safari.

In accordance with the contest rules, Tipping Point will be the owners of the vulnerabilities and will not release the details until a patch is ready. Tipping Point will also work with security vendors on expediting patches.





Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Major Apple Security Updates - Includes Safari

I often jump around when reading new blog posts and tonight was no exception. However, I think that the order that I happened to jump tonight is interesting. To begin, I always enjoy reading Ed Bott's posts, whether they are at Ed Bott's Windows Expertise or Ed Bott's Microsoft Report so will frequently start read any new posts by Ed.

After reading Another predictable round of Vista-bashing, I just happened to click on Ryan Naraine's writeup at ZD Net, Apple Patch Day: Gaping Mac OS X, Safari holes in which he reported:

"Apple has released four different bulletins to cover 48 documented vulnerabilities in the Mac OS X ecosystem, a solitary code execution flaw affecting Safari for Windows and four different security problems in Java for Mac OS X.

Security Update 2009-001 is quite a whopper, providing patches for holes in a wide range of components, including several open-source implementations like ClamAV and fetchmail."

Well now, 48 Apple software updates! On my Windows Vista machine I quickly counted about 1/4 the number of updates to date and that included Windows Media Center, the Junk Email Filters and the Malicious Software Removal Tool. Is it no wonder I went back to Ed's post and chuckled about this quote and the reference to "consumers":

"Of the most famous computer makers, only two, Apple and Sony, primarily aim their products at consumers."

I have a security-minded "consumer" friend who thought she was going to have a better quality of life with an Apple computer. She has commented many times about the pain of trying to get all of the Apple updates on her dial-up connection. So much for the consumer.

The list of Apple product updates is available at About the security content of Security Update 2009-001.


References:

• About the security content of Security Update 2009-001
• Another predictable round of Vista-bashing
• Apple Patch Day: Gaping Mac OS X, Safari holes
• Sony’s Vaio P Has Sportscar Looks Without the Power

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

I'm a PC

A company displays a lot about its management and corporate values when it resorts to degrading the competition. See the difference for yourself between the Microsoft "I'm a PC" commercial and the response by Apple in "I'm a Mac". Then read what Ed Bot has to say about Adding up the Apple tax.

First the Microsoft "I'm a PC" commercial:




Then the Apple "I'm a Mac" commercial:



Class job Microsoft!

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Clickjacking - Multi-Browser Exploit

Further to and more serious than the reports in August regarding hijacked clipboards by Flash banner ads and used in rogue security software attacks, clickjacking effects Microsoft Internet Explorer (including IE8 Beta), Mozilla Firefox, Apple Safari, Opera as well as Adobe Flash. As quoted in an article at ZDNet by Ryan Naraine explaining clickjacking:

"In a nutshell, it’s when you visit a malicious website and the attacker is able to take control of the links that your browser visits. The problem affects all of the different browsers except something like lynx. The issue has nothing to do with JavaScript so turning JavaScript off in your browser will not help you. It’s a fundamental flaw with the way your browser works and cannot be fixed with a simple patch. With this exploit, once you’re on the malicious web page, the bad guy can make you click on any link, any button, or anything on the page without you even seeing it happening."

Users of Firefox do have a safety net with the NoScript add-on. With NoScript, you allow active content to run only from sites you trust.

Users of WinPatrol can help mitigate the effects of the clipboard hijacks by disabling Adobe Shockwave Flash with the ActiveX control in WinPatrol. (See WinPatrol 2008 introduced in its 10th year). To see how simple it is, just follow the illustrations I provided here, use the settings listed below and select disable for Shockwave Flash:

• Only view ActiveX controls used by Internet Explorer
• Toggle non-Microsoft ActiveX controls on/off.

References:

• Adobe Flash ads launching clipboard hijack attack
• Announcing WinPatrol 2008 With ActiveX Control
• Clickjacking: Researchers raise alert for scary new cross-browser exploit
• NoScript Add-On
• NoScript Home Page

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Apple Issues

Apple issued Safari 3.1.2 for Windows which addresses Microsoft Security Advisory 953818 and is recommended for all Safari Windows users. However, it does not appear that is the end of the problem. It has been reported that when Safari is used on a system that also has Firefox 2 or 3, it could lead to providing an attacker the opportunity to steal arbitrary files from the file system. Fortunately, Firefox 3 has some protections that somewhat mitigate the issue.

For a complete roundup, see Nathan McFeters, Researcher keeps ‘carpet bomb’ attack alive, despite patch and the original report by Billy Rios at BK on Safari, hunting Firefox….


References:

• BK on Safari, hunting Firefox…
• Microsoft Security Advisory 953818
• Microsoft Security Advisory 953818 Combined Attack With Apple’s Safari on Windows Platform
• MSRC Blog, Security Advisory 953818
• Researcher keeps ‘carpet bomb’ attack alive, despite patch
• Safari 3.1.2 for Windows released to address vulnerabilities

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft Security Advisory 953818 Combined Attack With Apple’s Safari on Windows Platform

This alert is to notify you that on 30 May 2008 Microsoft released Security Advisory 953818, "Blended Threat from Combined Attack Using Apple’s Safari on the Windows Platform".

From the advisory:

Summary:

Microsoft is investigating new public reports of a blended threat that allows remote code execution on all supported versions of Windows XP and Windows Vista when Apple’s Safari for Windows has been installed. Safari is not installed with Windows XP or Windows Vista by default: it must be installed independently or through the Apple Software Update application. Customers running Safari on the affected platforms should review this advisory.

At the present time, Microsoft is unaware of any attacks attempting to exploit this blended threat. Upon completion of this investigation, Microsoft will take the appropriate measures to protect our customers. This may include providing a solution through a service pack, the monthly update process, or an out-of-cycle security update, depending on customers’ needs.

Mitigating Factors:

Customers who have changed the default location where Safari downloads content to the local drive are not affected by this blended threat.

Recommendations:

Review Microsoft Security Advisory 953818 for an overview of the issue, details on affected components, mitigating factors, suggested actions, frequently asked questions (FAQ) and links to additional resources.

References:

• Microsoft Security Advisory 953818
• MSRC Blog, Security Advisory 953818

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Apple Improves Update Notifications

With thanks to stopBADware.org and others who complained, Apple has made an improvement in their update practices. Last month, I questioned whether Apple was Turning to Foistware Methods. Based on the example provided by stopBADware.org, at least the updates are separated from the "new software". This isn't a perfect solution, however, it is much better than the way it had been handled.

See Apple Responds to Community Concerns at stopBADware.org for an illustration of the changes made by Apple.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Is Apple Turning to Foistware Methods?

For the time being, I am stuck with Apple QuickTime on my laptop because it is needed for the Kodak EasyShare software. However, that doesn't mean that I like QuickTime's persistence in being in Start Up. (Thank goodness for WinPatrol to control that!)

Apparently, my irritations with QuickTime are not the only issues with Apple software. The other day my friend Tashi reported highly critical new vulnerabilities in Apple Safari 3.1 for Windows, the browser she quoted Apple as indicating:

"Engineers designed Safari to be secure from day one"

It rather sounds as though the Apple Engineers have a bit of a problem. However, there is more to this story than vulnerabilities. As Tashi reported in What’s Up Apple, I don’t want Safari, Apple is using their Software Update program to push the not so "secure from day one" Safari browser on people. Is the Apple market share doing so poorly that they are resorting to foisting their software on their customers? Is Apple taking advantage of the years the security community has spent telling people to keep their software up-to-date, hoping unsuspecting customers will click Next > Next > Next?

Ed Bott said it best in What Microsoft can teach Apple about software updates:

"Companies that deliver network-connected software that contains potential security vulnerabilities have a responsibility to offer regular updates to repair those issues. The right way to do it involves these four principles

• Opt-in is the only way. The update process should be completely opt-in. The option to deliver software should never be preselected for the user.
• Offer full disclosure. The software company has a responsibility to fully disclose what its software does, and the customer should make the opt-in decision only after being given complete details about how the update process works.
• Offer updates only. Updates should be just that. They should apply only to software that the customer has already chosen to install.
• Don’t mix updates. Updates that are not critical should be delivered through a separate mechanism.

References:

Certified Bug:

• Apple Safari 3.1 for Windows, new vulnerabilities
• Say what?
• What’s Up Apple, I don’t want Safari

Ed Bott:

• What Microsoft can teach Apple about software updates

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash and Quick Time Updates

Critical vulnerabilities have been identified in both Adobe Flash Player and Apple Quick Time. Please follow the links below to update your computer. Not sure if affected versions are on your computer? Use the Secunia Software Inspector to check if your system is missing security updates or have insecure applications installed. The Software Inspector:

• Detects insecure versions of applications installed
• Verifies that all Microsoft patches are applied
• Assists you in updating your system and applications
• Runs through your browser. No installation or download is required.

Adobe Flash Player

Critical vulnerabilities have been identified in Adobe Flash Player that could allow an attacker who successfully exploits these potential vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities. Users are recommended to update to the most current version of Flash Player available for their platform.

Adobe Flash Player 9.0.45.0 and earlier, 8.0.34.0 and earlier, and 7.0.69.0 and earlier.

Reference: Adobe Security Bulletin

Apple Quick Time

Secunia describes the updates as vulnerabilities reported in Apple QuickTime, which can be exploited by malicious people to compromise a user's system. QuickTime 7.2 addresses critical security issues and includes support for full screen viewing in QuickTime Player, updates to the H.264 codec and fixes numerous bugs.

The release is recommended for all QuickTime 7 users.

References:

• Apple Quicktime

• Secunia

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Fake iPhone Sale Through Malware

Sunbelt researcher Adam Thomas discovered a custom trojan attempting to take advantage of the iPhone hype to sell a fake iPhone. Considering the interest in the iPhone, we shouldn't be surprised. The instigator of this trojan is bound to sucker a few folks in and will likely walk away with a full pocket.

See the full details at SunbeltBLOG.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Apple iPod Compatibility Update for Windows Vista

Nick White announced at the Windows Vista Team Blog that the final compatibility update is available for Windows Vista users of the Apple iPod.

The update is available at the Microsoft Download Center now and will be available via Windows Update on Tuesday 22 May 2007.

"The release is for users worldwide and works with the latest version of Apple iTunes to correct an issue that caused some iPods to become corrupted when ejecting them using Windows Explorer or the "Safely Remove Hardware" function in the System Tray.

The long and short of it is this: Apple and Windows have partnered together to ensure a great experience in using Windows Vista with iTunes and the iPod, and both companies recommend you download this update."

References:

• Microsoft Download Center
• Microsoft KB Article 936824
• MSRC Blog

Apple Updates for Mac OS X

Brian Krebs reported that 31 flaws were patched in by Apple in the update released yesterday. Included in the updates was a patch for a vulnerability in eMac, iBook, iMac, PowerBook G3, PowerBook G4, and Power Mac G4 systems equipped with an original AirPort card. The vulnerability is with built-in wireless cards that cana be exploited by attackers to install malicious software.

"Other fixes released today mend easily exploitable conditions, such as bugs that attackers could use to install malicious code just by convincing the user to visit a specially crafted site or font files. Among the many other updates included in this bundle are fixes for ClamAV (an antivirus program) for Mac OS X Server, as well as those to mend a slew of problems with the OS X utility used to unzip compressed files."

Anyone with OX X is encouraged to install the updates.