Category Archives: Security

aka infosec

New service from Microsoft: myBulletins

On Wednesday, Microsoft announced myBulletins: a new web-based service that allows users to keep track of updates.

The service provides a centralized view of all Microsoft bulletins that can be customized to show only products in which you are interested. The resulting list can be further searched, filtered, and sorted. Once you customize myBulletins, it’s a handy way to see all Microsoft bulletins in one place without a lot of clutter.

To use myBulletins, you need a free Microsoft account.

Stop using TrueCrypt

Before Microsoft started including whole-disk encryption in Windows (with Bitlocker in Vista), the best solution was TrueCrypt.

Now, according to its developers, TrueCrypt is no longer secure and should not be used. Development has been shut down and users are being instructed to use something else.

There is a lot of speculation about what’s going on. Recent revelations about security solutions being compromised by the NSA led one group to undertake a complete audit of TrueCrypt. It’s not much of a stretch to imagine that this audit prompted TrueCrypt’s shutdown. If the NSA inserted a back door into TrueCrypt, the software’s developers might want to keep that a secret. On the other hand, the audit continues, regardless of TrueCrypt’s status.

Anyone using TrueCrypt is strongly encouraged to switch to something else, like Bitlocker.

Stop Firefox from showing embedded media automatically

My browser of choice these days is Firefox, despite its recent problems with bloat, performance and the user interface.

I recently made a change to the way Firefox handles embedded content like Java, Flash, Shockwave and Silverlight. By default, Firefox displays embedded media automatically; when you visit a web page that contains embedded media, it plays immediately after loading.

To change this behaviour, do the following:

  1. Go to the Firefox Add-ons page. How you do this depends on the version of Firefox, but one method that always works is to enter ‘about:addons’ in the address bar.
  2. In the menu on the left, click ‘Plugins’.
  3. To the right of each listed plugin, there’s a button. Clicking that button drops down a list with these options: ‘Ask to Activate’, ‘Always Activate’ and ‘Never Activate’.
  4. Change the activation setting for each plugin. ‘Never Activate’ disables a plugin completely. ‘Always Activate’ means that the associated media will run without any user intervention (the default behaviour). ‘Ask to Activate’ will prompt the user before playing the associated media. I set the following plugins to ‘Ask to Activate’: all Java plugins, all Flash plugins, all Shockwave plugins, and all Silverlight plugins.

Once you’ve made these changes, visiting a web page that includes embedded media shows grey blocks where the media would normally appear. A link appears in the middle of each block: ‘Activate Adobe Flash’, ‘Activate Java’, etc. Clicking the ‘Activate’ link pops up a small dialog that allows you to activate the media this time only, or permanently for that particular web site.

This has several benefits:

  • Malicious code in Java, Flash and other media files no longer runs automatically when I visit sites that use them. This makes web surfing much safer.
  • Pages that contain embedded media load faster. If I decide that I want to actually watch some embedded media on a site, I only have to click the ‘Activate’ link.
  • I can now see exactly what kind of media is embedded on a web page, which is especially useful for determining the relative popularity of different kinds of media.

Internet Explorer vulnerability reported

Zero Day Initiative, a security vulnerability reporting initiative funded by HP, recently announced a vulnerability affecting Internet Explorer 8 (and possibly other versions).

The vulnerability was originally discovered and reported to Microsoft in October 2013, and confirmed by Microsoft in February 2014. Since Microsoft has not yet issued a patch, ZDI announced the vulnerability in keeping with their disclosure policy.

Anyone using Internet Explorer is strongly encouraged to install and use Microsoft EMET, which will help to mitigate this vulnerability.

Update 2014May25: Despite some reports to the contrary, Microsoft is planning to fix this vulnerability. The problem only seems to affect IE8, and no exploits have yet been seen in the wild.

Blackshades users being investigated

Krebs on Security reports that anyone who purchased the hacking toolkit known as ‘Blackshades’ should be prepared for the authorities to kick in their door and confiscate their computers.

Blackshades is “a password-stealing Trojan horse program designed to infect computers throughout the world to spy on victims through their web cameras, steal files and account information, and log victims’ key strokes.”

Adobe Shockwave is also a target

Another increasingly popular target for malicious hackers is Adobe Shockwave. But what is Shockwave, and how does it related to Adobe Flash?

Like Flash, Shockwave is a media platform, and Shockwave media is most commonly found on the web. The two platforms do many of the same things, but the software for creating Shockwave media is both more powerful and more expensive. Flash media is much more common.

In any case, since Shockwave is a target, and since the Shockwave player is commonly installed on the computers of regular users (usually in the form of a browser plugin), I’m adding it to the Software Versions page on this web site.

Update 2014May22: Now comes word that Shockwave contains a version of the Flash player that is over a year out of date. None of the security updates and features added to Flash in the past fifteen months are present in Shockwave’s bundled Flash. Because of this, we recommend disabling Shockwave in your web browser immediately.

Microsoft Silverlight an increasingly popular target

As the popularity of software and platforms ebbs and flows, so do the targets of malicious hackers. In the past few years, Java and Flash were the most notable targets.

More recently, Microsoft’s Silverlight media platform is increasingly being targeted. This is almost certainly due to the fact that Netflix uses that particular technology. Attackers are always drawn to platforms that are widely used by ordinary folks.

Because of this, I’m adding Silverlight to the list of software products that I track on this site’s Current Versions page.

Adobe Patch Tuesday for May 2014

Adobe has settled into a routine of publishing updates for its software on the second Tuesday on each month, in line with Microsoft’s practices. Today Adobe announced updates for Flash and Reader/Acrobat.

Both the Flash bulletin and the Reader/Acrobat bulletin are a bit light on details, saying only that the updates address critical vulnerabilities in the software.

The release notes for the new version (13.0.0.214) of Flash go into more details, although most of the information is about new features.

As usual, Google Chrome and Internet Explorer on Windows 8.x will be updated automatically and via Windows Update, respectively.