Jeff Rivett has worked with and written about computers since the early 1980s. His first computer was an Apple II+, built by his father and heavily customized. Jeff's writing appeared in Computist Magazine in the 1980s, and he created and sold a game utility (Ultimaker 2, reviewed in the December 1983 Washington Apple Pi Journal) to international markets during the same period. Proceeds from writing, software sales, and contract programming gigs paid his way through university, earning him a Bachelor of Science (Computer Science) degree at UWO. Jeff went on to work as a programmer, sysadmin, and manager in various industries. There's more on the About page, and on the Jeff Rivett Consulting site.

All posts by jrivett


Chrome, Google, Patches and updates, Security

Chrome 56.0.2924.76

1 Comment

Chrome version 56.0.2924.76 includes fixes for fifty-one security vulnerabilities. But wait, that’s not all. If you want to see what happens when your web browser loads a really big web page, navigate to the change log for Chrome 56.0.2924.76. It’s a behemoth, documenting over ten thousand separate changes.

One change in particular deserves mention: starting with this version, Chrome will show ‘Secure’ at the left end of the address bar if a site is encrypted. When Chrome navigates to a web page that isn’t encrypted, but does include a password prompt, it will show ‘Not Secure’ in the address bar.

Chrome seems to update itself reliably, soon after a new version is released. Still, given the number of security fixes in this release, it’s not a bad idea to check.

Opera, Patches and updates

Opera 42.0.2393.351 and 42.0.2393.517

Leave a comment

Opera 42.0.2393.351 fixes a handful of bugs, several related to the 64-bit version of the browser. See the change log for details.

Opera 42.0.2393.517 fixes four more issues, some of which first appeared in 42.0.2393.351. See the change log for details.

None of the changes in either new version seem to be related to security. Opera will usually update itself shortly after a new version becomes available.

Security, Tools

Review: Heimdal Security Software

Leave a comment

I’m always on the lookout for tools that simplify the task of keeping software up to date. I recently installed Heimdal Security Free on my Windows 8.1 PC, and took a close look at its software patching feature.

Note: the paid version of Heimdal Security includes network traffic-based malware detection. That feature appears in the free version, but it’s disabled.

The Good

The software basically does what it says. By default, it automatically checks for out of date software, and silently installs updates where needed. The software it checks includes the vulnerability-prone Flash and Java, as well as all the major browsers. It’s fast, relatively unobtrusive, and has a polished, professional user interface.

The patching system can be customized: you can tell it to only check for updates, but NOT install them automatically, and you can disable checking for anything in its software list, which currently includes forty-one items.

The Bad

  • If you disable the auto-update feature, there’s no obvious way to install new versions.
  • The ‘Recommended Software’ tab has Install buttons, which at first looks useful. But closer inspection reveals that this list only shows software that isn’t currently installed. In fact, it lists some software I’ve never even heard of, much less installed.
  • Heimdal detects software that is available in both 32- and 64-bit versions. But if you have the 32-bit version installed, the ‘Recommended Software’ tab will list the 64-bit version. And vice-versa. This is not useful.
  • There’s no obvious way to tell Heimdal to perform a re-scan. I eventually realized that disabling the feature and re-enabling it does that, but a ‘Scan’ button would be a real improvement.
  • The software list cuts off some important information: the software version number is often truncated, making definite confirmation of version changes difficult. And there’s no way to resize the column, or the dialog. Update: I discovered that the missing information can be revealed by hovering the mouse over a truncated field.
  • Heimdal shows some software as needing an update when in fact that software is up to date. For example, it continues to report an available update for 7-Zip 16.04: to version 16.04.0. It looks like Heimdal fails to match versions when there are extra zeros.
  • There’s no way to shut down Heimdal once it’s installed. There’s an icon in the notification area, but it doesn’t even have a right-click menu. Your only option is to uninstall Heimdal completely.
  • When Heimdal installs something from the ‘Recommended Software’ tab, it configures itself to automatically update that software. An option to override this behaviour would be helpful.

It’s possible that some of these issues would not present themselves if I configured Heimdal to install updates automatically, but I prefer to have more control over software installation.

Conclusion

Despite its flaws, Heimdal may prove useful to some users. But I can’t recommend it.

Update 2017JFeb01: Heimdal responded to my review, addressing my concerns:

For the moment, Heimdal does not have the option to install updates manually. We wanted to make software updates fast, secure and hassle-free for Heimdal users and adding a manual option would be the opposite of that.

My response: that’s just silly. Make it an option, but default to automatic. Most users would never even see the option. It wouldn’t make anything slower, or less secure, or increase hassle. And all the necessary functionality is already in place.

We called it “recommended software” because it not installed on the system. These are apps you can install with one click, should you want to do it. If not, they don’t impede you in any way.

My response: Understood, but it’s kind of misleading, especially since in some cases they are recommending 32 bit versions of software already installed in 64 bit form.

Indeed, this is something we will work on improving, so we can match software versions to the type of system they’re recommended for.

The scan button is in Heimdal’s home screen, when you hover over the big white button with the green checkmark. We will try to make this more obvious in future versions.

My response: on the Overview tab, there’s a big white icon that’s either a checkmark (if everything is up to date) or an exclamation mark (if it isn’t). Nothing appears when you hover the mouse over this icon, and there’s no indication that clicking it will do anything. But it does work, so it would be nice to have this properly labeled.

Making windows resizable is not something customary to security applications (it would create an unnecessary burden on the system), but we will try to rearrange the elements so that they provide a clearer view in future updates.

My response: Making windows resizable is in fact standard for all Windows applications, and those that don’t allow this are probably not following Windows development guidelines. Further, the notion that adding this functionality would somehow place a ‘burden on the system’ is simply absurd. But the indicated fixes will be welcome in the absence of resize-ability.

Heimdal shows some software as needing an update when in fact that software is up to date.

I think that our support team can help you with that. If you can, send them an email at support@heimdalsecurity.com and they’ll be right on it!

My response: Done. After some back and forth, Heimdal support reproduced one of the problems on their end (7-Zip version detection), and is working on a fix.

We will add a right-click menu in the coming versions. There is no option to shut down Heimdal, because security software usually does not have this feature. If it had it, malware could easily switch it off and infect the system.

My response: if malware is present on a computer, it can kill a process as easily as it can stop a program from its system menu. I want to be able to run the update feature on-demand, and there’s simply no way to do that sensibly unless the program can be closed.

Firefox, Mozilla, Patches and updates, Security

Firefox 51 fixes 24 security issues

Leave a comment

The latest version of Firefox addresses at least twenty-four security vulnerabilities and changes the way non-encrypted sites appear in the address bar.

As usual, there’s nothing like a proper announcement for Firefox 51. What we get from Mozilla instead is a blog post that discusses some new features in Firefox, and mentions the new version number almost accidentally in the third paragraph. Once again, CERT does a better job of announcing the new version than Mozilla.

Starting with version 51, Firefox will flag sites that are not secured with HTTPS if they prompt for user passwords. Secure sites will show a green lock at the left end of the address bar as before, but sites that are not secure will show a grey lock with a red line through it. Previously, non-encrypted sites showed no lock icon at all. The idea is to draw the user’s attention to the fact that they are browsing without the security of encryption, which is risky when sensitive information (passwords, credit card numbers) is entered by the user.

Internet crime, Malware, Security

Ransomware update

Leave a comment
A typical ransomware alert screen. Not something you ever want to see on your computer.

The scourge of ransomware shows no signs of slowing down. A single careless click on a link in an email is all that’s necessary for one of the many varieties of ransomware to install itself and quietly start encrypting data files on your computer, and on any others it can reach. Warning screens like the one above announce the dreadful news: your files are now effectively garbage. Pay the ransom or you’ll never see those files (intact) again.

Reports of ransomware hitting schools and hospitals are depressingly common. There’s evidence that attacks on sensitive targets like hospitals are intentional. Ransomware is now being installed by trojan malware that previously only stole your banking information. Newer televisions and other ‘smart’ devices that are connected to the Internet are being hit with ransomware that limits their functionality. Phony ICANN blacklist removal email is being used to trick people into installing ransomware.

If you’re wondering just how deep this ugliness goes, consider this: at least one strain of ransomware offers to decrypt your files for free if you pass the malware along to at least two other computers.

Assuming you’ve managed to avoid this nightmare, you’re either using strong anti-malware software, or you’ve trained yourself not to indiscriminately click links on the web and in email (hopefully both). Otherwise, you’re probably just lucky. So far, my only encounter with ransomware was a partial infestation of a client PC; the malware was prevented from doing any real damage by antivirus software (Trend Micro’s Worry-Free Business Security for anyone wondering).

Okay, so what’s the good news? Companies like No More Ransom offer services that can (sometimes) reverse the damage caused by ransomware. Of course, the success of this kind of service depends on the type of ransomware; some strains are easier to work around than others. But at least there’s hope for those ransomed files.

Internet crime, IoT, Malware

Brian Krebs investigation reveals author of Mirai worm

Leave a comment

The Mirai worm has compromised thousands of IoT devices that were subsequently used in several recent, massive DDoS attacks, including one against the web site of Brian Krebs, well-known security researcher and blogger.

In an appropriately-lengthy post, Krebs describes the process by which he tracked down the identity of the author of the Mirai worm. It’s a fascinating read.

Krebs has published the results of similar investigations in the past, which is why he’s become a target for DDoS attacks, Swatting, and other despicable acts. It remains to be seen whether he will be the target of any new attacks in the wake of his Mirai investigation.

I applaud Krebs’ persistence and dedication in the face of these attacks. Here’s hoping he keeps fighting the good fight, for the benefit of Internet users everywhere.

Java, Patches and updates, Security

Java 8 Update 121 released, and a mystery solved

Leave a comment

On January 17, Oracle published a Critical Patch Update Advisory for January 2017. The advisory lists Java 8 Update 111 as an ‘affected product’ but says nothing at all about a new version or what has changed. For that information, you have to dig around on the Oracle site: a good starting point is the main page for Java SE. There you’ll find links to news, release notes, and downloads for new Java versions.

The new version — Java 8 Update 121 — includes fixes for seventeen security vulnerabilities and eleven other bugs in previous versions. If you use a web browser with an enabled Java add-on, you should install the new version as soon as possible.

Mystery solved

On a related note: I missed the previous Java update (October 18, 2016) because the Oracle Security Advisory RSS feed stopped working in my RSS reader, Feedly. In Feedly, the last post shown from that feed is from July 2016.

To rule out a problem with the feed itself, I checked it in another RSS reader, The Old Reader, where it worked perfectly.

Feedly provides support via Uservoice, so I headed over there and looked for anyone reporting similar issues. And found someone with the exact same problem, which he reported in the form of a suggestion. Rather than create my own report, I added a comment with my observations, and applied as many upvotes as I could to the existing suggestion.

Hopefully the Feedly folks will see this and do something about it. I depend on RSS feeds to stay on top of technology news, and if my RSS reader is unreliable, I can’t use it.

Meanwhile, I’ll continue to rely on other sources for Java update news, including the CERT feed, which is how I learned of the January 2017 Oracle advisory.

Update 2017Jan20: I reported the feed problem to Feedly, and they immediately responded, saying that Oracle appears to be blocking Feedly for some reason. They are working on the problem.

Microsoft, Privacy, Tools, Windows 10

Windows 10 privacy improvements, sort of

Leave a comment

The good news is that Microsoft is improving the state of privacy in Windows 10, albeit slowly, and grudgingly. The bad news is that the improvements are unlikely to satisfy anyone genuinely concerned about what Windows 10 is really doing.

New: Privacy Dashboard

A few days ago, Terry Myerson, Microsoft’s Executive Vice President of the Windows and Devices Group, announced a new web-based Privacy Dashboard, accessible via your Microsoft account. If you don’t have a Microsoft account, you’re out of luck. I’m still using my Microsoft account to log into my test system, because otherwise I’d have to buy a Windows 10 license. You probably already have a Microsoft account even if you don’t use Windows 10, as they are used for XBox Live, Skype, and other Microsoft services as well.

Poking around in the Privacy Dashboard, the Browsing History section is empty for me, presumably because I don’t use Cortana or Edge. The Search History section is also empty for me, because I don’t use Bing search. But if you use Cortana, Edge and Bing, you’d be able to see all that history here, and be able to remove it as well.

The Location section shows where you’ve been when you logged in on Windows 8.1 and 10 computers. Again, you can clear any or all of this. The section for Cortana’s database shows everything Cortana knows about you, based on your interactions. This is where things get interesting for me, because I only used Cortana for a couple of days when I first installed Windows 10. Cortana knows how often I eat at restaurants, and how far I go to get there. It knows my main mode of transportation. It knows what kind of news interests me. It’s not much, but it’s enough to be kind of creepy.

The Privacy Dashboard is a step in the right direction, and it’s very useful for anyone interested in seeing exactly what information Microsoft has collected. It also allows you to clear much of that information. But what if you want to prevent Microsoft from gathering this information in the first place?

Privacy improvements in Windows 10

Also revealed in Myerson’s post are upcoming changes to the privacy settings in Windows 10. The initial privacy setup has changed, and now provides a bit more information about the various privacy levels and settings. Microsoft is “simplifying Diagnostic data levels and further reducing the data collected at the Basic level.” But in fact there will be fewer privacy levels to choose from, and there’s still no real explanation of exactly what data is sent. And of course the most useful ‘Security’ level (which disables almost all telemetry) is only available to Enterprise users. Us regular folks can only throttle data collection down to the ‘Basic’ level.

According to Microsoft, the Basic level “includes data that is vital to the operation of Windows. We use this data to help keep Windows and apps secure, up-to-date, and running properly when you let Microsoft know the capabilities of your device, what is installed, and whether Windows is operating correctly. This option also includes basic error reporting back to Microsoft.” This sounds reasonable, but it’s lacking in detail and — for many users — still sounds like an intrusion.

Luckily, there are alternatives. I recently discovered a Powershell script called Reclaim Windows 10 that can disable all of the telemetry settings in Windows 10. I’ve yet to test the script, but it looks promising.

Advertisements in Windows 10?

Microsoft still insists this isn’t about advertising: “We want you to be informed about and in control of your data, which is why we’re working hard on these settings and controls. And regardless of your data collection choices, we will not use the contents of your email, chat, files, or pictures to target ads to you.” I’d like to believe that, but it seems unlikely. Microsoft is clearly taking aim at Google’s huge lead in online advertising, and the idea of having a captive audience for advertising (in the form of millions of Windows users) is obviously just too tempting to resist.

Microsoft continues to push Windows 10, now at the expense of Windows 7, which it now says “does not meet the requirements of modern systems, nor the security requirements of IT departments.”

Update 2017Jan18: Techdirt weighs in.

Java, Patches and updates, Security

Java 8 Update 111

Leave a comment

Well, this is embarrassing. Way back in October, Oracle released another version of Java. Somehow I contrived to miss the announcement, if there was one.

Oracle’s quarterly Critical Patch Update for October 2016 includes information about Java, but doesn’t mention the new version. It only lists affected versions. The release notes for Java 8 Update 111 make it clear that the new version includes fixes for several security issues.

Anyone who still runs a web browser in which Java is enabled should make sure they’re running version 8 Update 111 (or 112, which is basically the same thing but with some new features). Default Java runtime installations are configured to update themselves automatically, but it’s a good idea to check.

I’ve noticed that the pace of Java security fixes seems to have slowed somewhat, which is a relief. There’s also slightly less urgency about Java updates because many popular Java-based software packages (e.g. Minecraft) now include their own embedded version instead of using any available system-wide version.