Virus Information News

[First]  [Previous] |    140     141     142     143     144     145     146     147     148     149    | [Next]  [Last] of 172 page(s)

Tally of November's Vulnerabilities and a Zero-Day

F-Secure Weblog

by Sean

November 8, 2012

It's not yet the second Tuesday of the month - but already there are a good number of important updates that you should apply. And one significant zero-day of which you should be aware.

First up: Flash! Adobe released an important update on November 6th (details here) that corrects seven vulnerabilities. Check your version here. 11.5.502.110 is the latest version depending on the browser. Do remember you don't need to have more plug-ins installed than you actually use. For example, Chrome includes its own version of Flash. And speaking of Chrome, Google also released a security update on the 6th (details). That's a rather easy update, just check About (chrome://chrome/) to see that you're running version 23.0.1271.64.

Hackable Hauwei

F-Secure Weblog

by Sean

October 10, 2012

The U.S. House of Representatives Permanent Select Committee on Intelligence created quite a stir on Monday with its report on Chinese telecom companies Huawei and ZTE.

The report recommends excluding the companies from sensitive systems and for U.S. network providers to seek other vendors, among other things. In response, Huawei claims U.S. protectionism is the real reason behind the charges of Chinese government ties and potentially backdoored equipment.

VB2012 Paper: Flashback OS X Malware

F-Secure Weblog

by Sean

October 5, 2012

F-Secure Labs Analyst, Broderick Aquilino, recently presented at Virus Bulletin 2012 in Dallas. His topic of research was the OS X malware, Flashback, which was spreading back in April.

Scareware and "Scary" Scams Aren't the Same Thing

F-Secure Weblog

by Sean

October 4, 2012

Two big headlines to comment on. First, there's this: FTC Case Results in $163 Million Judgment Against "Scareware" Marketer.

The defendant, Kristy Ross, has been involved in U.S. FTC cases going back to 2008: Court Halts Bogus Computer Scans. Her boyfriend "Sam" Jain is still at large. You can read more about Jain in this June 2011 post. An important judgment to be sure, but remember, Ross is one of yesterday's scareware vendors getting the hammer.

WordPress Premium Theme XSS Vulnerability

F-Secure Weblog

by Sean

October 3, 2012

On Tuesday, we shared a rather silly video which made a serious point about the need to keep websites secure.

Unfortunately, limiting potential website vulnerabilities is not exactly intuitive. There's always additonal stuff one needs to consider. For example, let's take the very popular WordPress(.org) publishing platform. WordPress itself does a pretty good job when it comes to maintaining its security. Unfortunately, the same cannot be said for everybody that runs WordPress websites. Many website admins allow their WordPress installations to fall out of date, and there are numerous compromised WordPress sites online as a result. But even those admins that do keep their platform up to date still have things to worry about, such as themes.

CVE-2012-1535 and Nuclear Warheads

F-Secure Weblog

by Sean

September 28, 2012

Our corporate business team has a new "software updater" feature in our Protection Service they want to market. So they asked our lab analyst Timo to provide them with an example demonstrating the amount of time it takes to go from vulnerability exploit.

Here's the timeline Timo came up regarding CVE-2012-1535: 2012-08-14: Security update available for Adode Flash player, patches vulnerability CVE-2012-1535. 2012-08-15: Microsoft Office Word documents with embedded Flash exploit for CVE-2012-1535 seen in the wild. 2012-08-17: Exploit is added to Metasploit Framework - a public, open-source tool for developing and executing exploits.

Adobe Cert Used to Sign Malware

F-Secure Weblog

by Sean

September 28, 2012

Adobe's head of product security, Brad Arkin, published a very interesting post on Thursday.

As it turns out, one of Adobe's build servers was compromised and was used to create malicious files with Adobe's digital signature. Inappropriate Use of Adobe Code Signing Certificate...

Samsung TouchWiz Devices Vulnerable to Mischief

F-Secure Weblog

by Sean

September 26, 2012

Saw this tweet yesterday on Twitter. The account is a parody... but the "tel:*2767*3855%23" is quite serious.

It's a reference to a "vulnerability" which exists on some versions of Samsung Android phones, those running Samsung's TouchWiz UI. (So, not Nexus.) And by vulnerability, we mean that some "genius" developed a feature to factory hard reset TouchWiz devices using an Unstructured Supplementary Service Data (USSD) code - without requiring a prompt from the user!

Backdoor:OSX/Imuler.B No Likes Wireshark

F-Secure Weblog

by Sean

September 24, 2012

A new variant of Mac malware - Imuler.B - has recently surfaced. It's pretty much the same as Backdoor:OSX/Imuler.A, but with small changes and code optimizations.

It's Out of Cycle Patch Friday

F-Secure Weblog

by Sean

September 21, 2012

As you probably know by now, there's a critical vulnerability in several versions of Microsoft's Internet Explorer.

Microsoft Security Advisory (2757760) Microsoft has previously released a "Fix it". And today (September 21) at 10:00 AM Pacific Time, Microsoft will release a security update. As in an out of cycle patch. So... it's unscheduled patch Friday, folks. (Don't hold your breath this will be deployed by IT before the weekend.)

[First]  [Previous] |    140     141     142     143     144     145     146     147     148     149    | [Next]  [Last] of 172 page(s)