Category Archives: Security

aka infosec

Android, Internet crime, Malware, Mobile, Privacy, Security, Things that are bad

Pegasus spyware

Leave a comment

Pegasus is spyware that can be installed on Apple and Android mobile systems. It’s difficult to detect, and difficult to remove. Pegasus is developed by NSO Group, who deny that the software is being used for anything nefarious, or that if it is, that use has nothing to do with NSO Group.

The methods used to install Pegasus on mobile devices have changed over the years. It can be installed directly, with physical access to the target device, which is presumably how it ends up on devices legitimately. Pegasus can also be installed more surreptitiously. Previously, that involved inviting the user to click a link in an email or SMS message. More recently, it’s being installed using app and O/S exploits that require no interaction from the user, including a very nasty exploit for WhatsApp.

Pegasus is not a virus. It does not spread on its own. Further, it’s important to distinguish between Pegasus and the methods used to install it. Pegasus does not typically arrive on a device at random. Devices are specifically targeted, and those targets are often used by journalists, suspected terrorists, and other people whose activities are tracked by government agencies and criminal organizations.

The main problem here is not Pegasus, but the way security vulnerabilities are discovered and — more importantly — how information about vulnerabilities is disseminated. Unfortunately, some organizations perform this research not for the public good, but for themselves and their partners, legitimate and otherwise. In an ideal world, when a vulnerability is discovered, the vendor is informed privately and then proceeds to develop and release a fix. In reality, vulnerabilities and exploits are often hoarded.

Advice to anyone who operates a mobile device and wants to reduce the likelihood of Pegasus or other unwanted software being installed without their knowledge: stay informed regarding security vulnerabilities in your device’s O/S and any apps you run. When you learn about a zero-click exploit, immediately install a fix if one is available, or uninstall the affected app. If it’s an unpatched O/S vulnerability, all you can do is hope that you’re not being targeted.

Related

Adobe, Edge, Firefox, Microsoft, Patches and updates, Security, Windows

Patch Tuesday for July 2021

Leave a comment

It could be argued that Microsoft has done us all a favour in making Windows 10’s updates unavoidable. Certainly, as long as nothing goes wrong, it’s less work than futzing around with Windows Update on every computer. And forced updates mean that Windows computers used by less tech-savvy folks stay up to date with security fixes, which makes everyone safer.

It’s also true that increasingly, software and firmware updates for all our devices happen whether we want them or not. By default, mobile devices update themselves. Other electronic equipment, like smart televisions, digital video recorders, amplifiers, and even some network equipment are now doing the same.

But I just can’t shake the feeling of discomfort I get when I think about my computer being messed with at the whim of some Microsoft flunky. Perhaps some day I’ll be more comfortable with it. In the meantime, as long as Microsoft continues to screw up updates, sometimes breaking thousands of computers worldwide, I’ll continue to feel this way.

This month’s Microsoft updates

According to my analysis of the data available from Microsoft’s Security Update Guide, we’ve got updates for Edge, Office, Exchange Server, SharePoint, Visual Studio Code, Windows (7, 8.1, and 10), and Windows Server, addressing a whopping one hundred and thirty-three vulnerabilities in all.

As usual, Windows 10 updates will be installed automatically over the next few days, although you may — depending on your version of Windows 10 — be able to delay them for about a month. You can check for available updates and install them right away by heading to Start > Settings > Update & Security > Windows Update.

Windows 8.1 users also have the option of using automatic updates, but if that’s disabled, you’ll need to go to Start > PC Settings > Update & Recovery > Windows Update.

There seem to be one or two updates that are freely available for all Windows 7 computers, so it’s worth checking Windows Update. When Microsoft releases free updates for Windows 7, you know they’re important. Go to Start > Control Panel > Windows Update to check.

Adobe Updates

Adobe joins the fun again this month, with an updated version of the free and still ubiquitous Adobe Acrobat Reader. Version 2021.005.20058 of Reader includes fixes for thirteen security bugs.

Reader normally updates itself, but you can make sure, by navigating its menu to Help > Check for updates...

Firefox 90

Perhaps coincidentally, there’s also a new version of Firefox today. Firefox 90 addresses nine security vulnerabilities in earlier versions.

By default, Firefox will update itself, but you can encourage it by clicking its ‘hamburger’ menu at the top right, and navigating to Help > About Firefox.

Microsoft, Patches and updates, Security, Windows

Microsoft issues special fix for Windows print spooler vulnerability

Leave a comment

On Tuesday, Microsoft once again broke with its normal update cycle, publishing a series of updates to address a bad security flaw in the Windows print spooler service.

The print spooler exists in all versions of Windows, including Windows 7, and the vulnerability is serious enough that Microsoft issued an update for that O/S, which is technically no longer supported.

The print spooler vulnerability, which is often referred to as PrintNightmare, is documented in CVE-2021-34527.

Although technically the vulnerability could be exploited on any Windows computer, an attacker would need direct or remote access to that computer, and be able to log in as a regular user. Although that scenario is somewhat unlikely for most home users, the risk increases for computers with Remote Desktop enabled, public or shared computers, and computers on business and educational networks that connect to domain controllers.

Because Microsoft now bundles updates together, it can be difficult to identify which downloads apply to any particular update. In almost all cases, the best approach is to check Windows Update.

On Windows 10, navigate to Settings > Update & Security > Windows Update. Check for updates. If you see the update KB5004945 pending, install it. If you don’t see that update, click the link to ‘View update history’ and make sure KB5004945 has been installed.

The process is the same for older versions of Windows, except that Windows Update is accessed via the Windows Control Panel. The update number will also vary, depending on the Windows version. On Windows 8.1, it’s KB5004954.

Update: Windows print spooler problems persist.

Adobe, Patches and updates, Security

New version of Reader fixes two security bugs

Leave a comment

Adobe logoAnother new version of Adobe Reader (aka Adobe Acrobat Reader DC) was released last week. Reader version 2021.005.20048 includes fixes for two security vulnerabilities, both of which were apparently discovered by independent security researchers.

Unless you’ve disabled the function, Reader will update itself shortly after a new version becomes available. I usually find that by the time I become aware of a new version, Reader has already updated itself on my main PC.

You can check Reader’s version by navigating its menu to Help > About Adobe Acrobat Reader DC. You can check for and install any pending updates by navigating its menu to Help > Check for Updates...

Microsoft, Patches and updates, Security, Windows

Patch Tuesday for June 2021

Leave a comment

According to my count, which is based on the official Security Update Guide, Microsoft’s patch pile for June addresses forty-nine security vulnerabilities.

There are approximately thirty-two updates, affecting .NET, Office, Windows (7, 8.1, and 10), SharePoint, and Visual Studio.

Only people paying through the nose for them will get the Windows 7 updates; the rest of us are out of luck. Windows 8.1 updates can be installed via the Windows Update control panel. Windows 10 systems will receive the updates when Microsoft feels like rebooting your computer, usally at the most inopportune time.

Adobe, Patches and updates, Security

New versions of Acrobat and Reader

Leave a comment

Adobe logoEarlier this week, timed to coincide with Microsoft Patch Tuesday, Adobe released new versions of its PDF authoring tool Acrobat, as well as its free PDF viewer, Reader.

The new versions address ten security vulnerabilities in earlier versions. The new version of Acrobat Reader (DC) is 2021.001.20155.

If you have Adobe Reader installed on any of your computers, you should check whether it’s up to date, and install the new version if it’s not. You can do that by running Reader, and navigating its menu to Help > About Adobe Acrobat Reader DC.

You can install the latest version of Reader by navigating its menu to Help > Check for Updates.

Edge, Internet Explorer, Microsoft, Patches and updates, Security, Windows

Patch Tuesday for May 2021

Leave a comment

Still waiting for the vaccine? Trying to avoid going outside? Well, luckily for you, there are plenty of indoor tasks you can work on, like Netflix binge-watching, exercise, and installing software updates on your Windows computers.

For May 2021, Microsoft is handing us yet another pile of updates, addressing eighty-eight vulnerabilities (by my count) in .NET, Internet Explorer, Office, Edge, Exchange Server, SharePoint, Visual Studio, Skype, and Windows. My analysis is based on data exported from Microsoft’s Security Update Guide.

As usual, Windows 10 users can delay updates but not indefinitely. Windows 8.1 users who don’t have automatic updates enabled need to go to Windows Update to get the updates. Windows 7 users are mostly out of luck, but should check Windows Update anyway, because Microsoft sometimes makes critical update available for all users, not just business and educational users with deep pockets. If you’re still using Windows XP, there are no more updates, and I hope you know what you’re doing.

Java, Patches and updates, Security

Java 8 Update 291

Leave a comment

Oracle’s quarterly bulletin for Q1 of 2021 as usual includes some Java security alerts, and a new version of Java was released to fix the associated vulnerabilities.

Java 8 Update 291 addresses two security vulnerabilities in earlier versions.

As usual, the easiest way to update Java is through its own built-in update mechanism. Head to the Windows Control Panel, open the Java applet, go to the Update tab, and click Update Now.

Edge, Microsoft, Patches and updates, Security, Windows

Patch Tuesday for April 2021

Leave a comment

While installing software updates may not be the most fun you can have, at least you can do it indoors and remotely, safe from the pandemic still raging outside.

As usual, the main source of update information from Microsoft is the Security Update Guide (SUG). The SUG is a huge database, and it’s easy to get overwhelmed by the amount of information there. I begin my analysis by downloading this month’s information as a spreadsheet, which when loaded into Excel is much easier to handle.

Estimates of the number of vulnerabilities addressed by this month’s updates vary: by my count, it’s one hundred and eighteen. Other people show the total as ‘over 110’ and 114. Microsoft seems to have embraced a ‘keep them guessing’ strategy, perhaps so that we’ll eventually give up and stop counting, and learn to simply accept what we get without trying to get a handle on it. In psychology, that’s known as learned helplessness, which sounds about right.

This month’s updates include fixes for still-supported versions of Windows, Office, Edge, SharePoint, Visual Studio, and VS Code.

Also this month there are fixes for the rather horrible Microsoft Exchange vulnerabilities that have led to even worse compromises of business, government, and education systems worldwide in recent weeks. That’s great news, but unless you work in one of those environments, you are likely not affected.

Windows 10 users are once again faced with limited options: a) give in to Microsoft and allow updates to be installed on their schedule, risking bad updates; or b) delay updates as long as possible, risking being exposed to security vulnerabilities.

Windows 8.1 users still have an actual choice, since automatic updates can be disabled entirely. In which case you’ll need to run Windows Update manually to get the latest updates.

Windows 7 still occasionally gets updates. Microsoft creates them for enterprise clients, who pay a premium for that service. Non-paying folks don’t usually have access to those updates, although sometimes Microsoft makes individual updates available to all if they are particularly dangerous. Note that Windows 7 still works just fine: you can minimize the security risk of running it by being extremely careful when using email, browsing the web, clicking links, and downloading software.

Windows XP is still being used, but it’s long past receiving any updates, and it’s increasingly unable to run new software. It’s perfectly safe to use if it’s not connected to the Internet, or if it’s only used for specific, limited tasks.

Malware, Security, Things that are bad

Flagging software as dangerous for the wrong reasons is idiotic

Leave a comment

There’s a disturbing trend in the world of malware detection: falsely labeling software as malware.

For example, there’s an entire category of software that’s being mislabeled as malware by an increasing number of anti-malware providers: torrent software.

Torrent software is widely used by people trying to get access to cultural material that is otherwise locked away by the gatekeepers of big media (by way of prohibitive pricing, overlapping services, poor or unavailable service, geo-locking, release windows, and other big media fuckery).

Torrent software is used all over the world to legally share media in an extremely efficient, and Internet-friendly way.

But big media doesn’t care about any of that, because torrent software is also used for piracy.

Currently, there are efforts underway by media organizations to discredit and cripple torrent software in any way possible. Apparently they are now leaning on anti-malware software and service providers.

Why would an otherwise reputable anti-malware organization erroneously flag software as malicious? There are a number of possibilities:

  • They are being fed false information
  • Industry/corporate threats
  • Financial incentives

Why is this a problem?

  • It’s an extremely annoying inconvenience for users. Unable to install the falsely-labeled software, or exclude it from malware scans, some users will resort to uninstalling their anti-malware software.
  • It’s increasingly difficult for users to distinguish between actual threats and bullshit.
  • If an actually malicious version of one of these programs comes along, there’s no way to distinguish it from other versions that are erroneously flagged as malicious.
  • A general loss of trust in anti-malware providers and their services.

Big media will keep playing this idiotic game of whac-a-mole in any way their lawyers dream up. Media piracy continues, despite these efforts, and the only people affected are innocent users.

Advice to anti-malware purveryors: stop doing this. It’s short-sighted, dangerous, and stupid.