Technology Blog

Reportedly, Microsoft is warning that cybercriminals are exploiting a new flaw in Excel that affects several versions of its Office software, including one for Macs.

In its security advisory issued last week, Microsoft warns people of a very limited zero-day attack that takes advantage of vulnerabilities in the Excel spreadsheet program. A zero-day attack is one that exposes software bugs before they have been patched.

This latest flaw affects Microsoft Office 2000, Office 2003, Office XP, and Office 2004 for computers running Apple's Mac OS.

According to reports, the vulnerability is caused due to an unspecified error when handling strings, and can be exploited to cause a memory corruption. And that successful exploitation allows execution of arbitrary code, resulting in a compromised user system.

The company further said that attackers are sending e-mails with malicious Excel attachments, and are hosting Web sites that have Office files, which attempt to take advantage of the security flaws. And once an attacker exploits the vulnerabilities, he/she can gain control of a user's system remotely.

In its security advisory, Microsoft explained that as a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources. It has added detection to the Windows Live OneCare safety scanner for up-to-date removal of malicious software that attempts to exploit this vulnerability.

The company also pointed out that the vulnerabilities might extend beyond Excel. It said that while they are currently only aware that Excel is the current attack vector, other Microsoft Office applications are potentially vulnerable.

It is learnt that Microsoft would provide free tech support to customers who believe they are affected by the zero-day attacks, and there is no charge for support calls that are associated with security updates.

Meanwhile, Microsoft is asking users to avoid opening or saving Office files that come from distrusted or unknown sources, or files that are e-mailed unexpectedly from trusted sources. And the company is expected to patch this flaw as soon as its next set of security updates, which is due next Tuesday.

Labels: Excel, Flaws, microsoft, security, windows

Posted by Aadi at 10:45 AM | Permalink | Comments

The world of computer security is a fascinating aspect and 2007 is not going to be any different, but it will be more interesting with the release of Microsoft Vista.

Large companies are looking to tighten the noose around those bad hackers, consumers are demanding more security and more privacy for there home computers, and who wouldn’t, credit card fraud and identity theft has not decreased it has only increased.

Hackers who like to hack into bank accounts are going to have a harder time doing that. Some online banking companies are asking there customers to take a further step in the login process when logging into there bank accounts. For example, some banks are asking there customers to enter their user ID on one page and then enter their password on the next page; this makes it more difficult for hackers. But don’t ever feel like you are safe, keep your guard up and don’t fall for any phony emails that ask you to go to a fake look a like bank website and enter your user name and password. If you do get one of those fake emails call your bank first, and ask them if they sent you the email, and you can also forward the email to the banks technical support team.

Thanks to companies like Webroot there are programs that can help you keep your computer secure and free of spy ware and ad ware, with their Spy Sweeper software which I highly recommend. Webroot also offers a great firewall that your computer should not be without. Go to AME Computers Spyware and Malware page for more information on these great products.

Another good move toward security and spam is that there are some ISP’s that are offering free spam filters, this helps cut down on the amount of junk mail reaching your inbox. The newer version of Outlook has built in junk mail filter, but what’s the point in having a filter if you have to go and filter through the spam filter that Outlook provides.

The flip side to all of this is the cost to consumers. Spyware and viruses can cost companies, and the average consumer thousands of dollars a year. Companies implementing new security hardware pass on those expenses to there customers, so it is not good for the consumer or the business. Microsoft Vista operating system has some built in features to help keep you safe; however there still may be a need for third party software to protect against spyware and viruses.

It’s a never ending battle between the good guys like Webroot and Lava Soft and the bad guys like the hackers and spammers. Do your part and fight the good fight.

Labels: 2006, 2007, Information Technology, security, technology

Posted by Aadi at 12:18 AM | Permalink | Comments

Linux is an amazing operating system considering how it was originally created. It was a modest program written for one person as a hobby – Linus Torvald of Finland. It has grown into a full-fledge 32-bit operating system. It is solid, stable and provides support for an incredible number of applications. It has very powerful capabilities and runs very fast and rarely crashes.

Unfortunately Linux machines are broken almost every day. This happens not because it is an insecure operating system. It contains all the necessary tools to make it very secure. But the truth is. It hasn’t become significantly more secure with the increase in popularity. On the other hand, our understanding of the hackers methods and the wide variety of tools and techniques available contributed to help system administrators to secure their Linux computers.

This article list's the most critical situations, and how to prevent an invasion with simple measures.

1- Weak passwords

By far the first and most used method used by hackers to try penetrating a Linux system is cracking a password, preferently of the user root. Usually they will target a common user first, and then, using his/her access to the operating system, try to get a privileged access cracking the root password. Good password policy, and good passwords are absolutely critical to the security on any computer. Some common mistakes when selecting a password:

A- use “password” as password.
B- use the name of the computer.
C- a well-know name from science, sports or politics.
D- reference to movies.
E- anything that is part of the user web site.
F– references associated with the account.

The latest version of Linux offer shadowed passwords. If a cracker can see an encrypted password, crack it would a simple task. So, instead of storing the password in the passwd file, they are now stored in the shadow file which is readable only for root. Before a hacker can crack a password he needs to figure out an account name. So, simple accounts names must be avoided as well. Another security measure is to apply a “no login” to the account in the passwd file. This must be done to all the accounts that don’t need to log in to the system. Examples are: apache, mysql, ftp and other.

Limit which terminals root may log in from. If the root account is allowed to log in only in certain terminals that are considered secure, it will be almost impossible for a hacker to penetrate the system. This can be done listing the allowed terminals on /etc/security. The login program will consider insecure any terminal that is not listed on this file, which is readable, only by root.

2- Open Network Ports

Any Linux default installation will provide the Operating System with tons of software and services. Several of them are not necessary or even wanted by the administrator. Removing these software and services will close the path to several attacks and improve security. The /sbin/chkconfig program can be used to stop services from automatically starting at run levels 3, 4 and 5. Log in as root and type /sbin/chkconfig --list to view all the services set to start automatically. Select the ones you don’t need and type /sbin/chkconfig 345 name_of_service off. You must do that to all services you don’t want to keep running. Also, the xinetd server can be used to disable other services as well.

3- Old Software Versions

Everyday vulnerabilities are found in programs, and most of them are fixed constantly. It is important, and sometimes critical, to keep up with the changes. There are mailing lists for every Linux distribution where one can have security related information’s, and the latest vulnerabilities found.

Some place to watch for security holes are:

· http://www.redhat.com/mailman/listinfo/redhat-announce-list
· http://www.debian.org/MailingLists/
· http://www.mandrakesecure.net/en/mlist.php
· http://www.suse.com/us/private/support/security/index.html
· http://www.freebsd.org/security/index.html
· http://www.linuxtoday.com/
· http://www.lwn.net/

It is crucial to insure that the security released patches are applied to the programs as soon as they area available. The hacker community will be aware of the discovered holes and will try to explore them before the fixes are applied.

4- Insecure and Badly Configured Programs

There are some programs that have a history of security problems. To name a few IMAP, POP, FTP, port map and NFS, are the most known. The good thing is that most of these programs can be replaced by a secure version like spop, sftp or scp.

It is important that, before deploying any service, the administrator investigate its security history. Sometimes simple configuration measures can prevent serious headaches in the future.

Some advices regarding a web server configuration are well worth to mention:

- Never run the web server as a privileged user;
- Do not keep clients’ confidential data on the web server – Credit card numbers, phone numbers, mailing addresses, must be recorded on a different machine.
- Make sure the privileged data that a user supplies on a form does not show up as a default for the next person to use the form;
- Establish acceptable values for data that is supplied by web clients.
- Check vulnerabilities on CGI programs.

5- Stale and Unnecessary Accounts

When a user no longer uses his /her account, make sure it is removed from the system. This stale account won’t have this password changed periodically leaving a hole. Publicly readable or writable files owned by that account must be removed. When you remove an unnecessary service make sure you remove or disable the correspondent account.

Labels: Linux, security

Posted by Aadi at 10:51 PM | Permalink | Comments