Phishing email examples

‘Phishing’ is the term used to describe email sent with the intention of tricking the recipient into divulging personal (often financial) information to the perpetrator.

A recent ISC Diary post provides some examples of recent phishing email received by ISC handler Johannes Ullrich. The associated analysis is helpful for learning how to distinguish legitimate from phishing email.

ISC is the Internet Storm Center, which “provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers.” The site and associated services provide a wealth of information regarding Internet security.

That was fast… vulnerability found in latest Java

Researchers have already found a vulnerability in Java 7 Update 7, which was only released yesterday. So far all we know is that a report, along with code demonstrating the security hole, have been submitted to Oracle, Java’s developer.

Details on the new Java hole show that it could be used to take over a vulnerable computer. So, once again, users are being urged to disable Java, especially in web browser software.

Your move, Oracle.

UPDATE 2012Sep01: SANS reports that a new email phishing attack exploiting this new Java hole is showing up in the wild. The email appears to be from Microsoft, and is patterned on a recent, legitimate Microsoft email message. The mail contains an URL that – once clicked – sends web browsers to a site that has been infected with the published Java exploit code. Advice to users is the same as usual: be very careful about clicking on any link you don’t know for sure is safe, and consider disabling Java in your web browser.

New patch for Java plugs recently-discovered security hole

Much to their credit, Oracle has released a patch for Java that fixes a recently-discovered security hole in Java.

CERT confirms that the new patch does indeed resolve the problem. All Java users – and that’s you, unless you’re absolutely certain Java is disabled – should apply this update as soon as possible. This affects Windows, Linux and MacOS users.

This is a welcome reaction from Oracle. Until this patch was released, it was assumed that the hole would not be fixed until the next regular patch cycle in October 2012.

Opera 12.02 released

A new version of the Opera web browser was announced today. Version 12.02 includes some security fixes, as well as some other minor changes.

The Opera blog post announcing version 12.02 also describes a way to avoid potential problems with the recently-announced Java security hole. It involves changing an Opera setting that forces the user to ‘click to play’ for any content provided by a plugin (including Java). With this setting enabled, if you visit a site infected with a Java exploit, the exploit code won’t run unless you specifically allow it. While possibly overkill, this is as good a workaround as we can expect, at least until Oracle issues a fix for the Java hole.

Firefox 15 released

Another new version of Firefox was announced today. Version 15 includes some new features, like silent updates (which I will immediately disable), and some fixes for long-standing plugin memory use issues.

The Firefox release notes for version 15 have all the changes.

Interestingly, there doesn’t seem to be a list of previous Firefox versions or the corresponding release notes anywhere on the site. But you can find the release notes for a version by replacing ‘15.0’ with any other version number in this URL:
http://www.mozilla.org/en-US/firefox/15.0/releasenotes/.

Why I use a really long passcode for my wireless network

Visitors to my home who want to use our wireless network are often stupefied by the 63-character, hexadecimal WPA2 passcode. In spite of the legitimate security concerns that went into my choice of such a long code, this always embarrasses me. Of course, being embarrassed easily is all part of growing up and being British. (That’s a Monty Python reference in case you didn’t get it.)

So I’m happy to report yet another analysis of wireless passcode security and the relative ease of cracking them.

The upshot is that no passcode is uncrackable. Your only hope is to make your passcode so long and complex that it can’t be cracked in a reasonable timeframe. Using all of the maximum 63 characters is strongly recommended.

So, laugh all you want, and groan as you struggle to enter that monstrosity, but I’m not going to simplify it just for convenience.

New Java vulnerability likely to remain unpatched until October 2012

UPDATE: Oracle releases a fix ahead of schedule.

A recently-discovered security flaw in Java is going to make web browsing more dangerous than usual over the coming weeks.

The new vulnerability has already been exploited to develop a working attack that can affect Windows, Linux and MacOS computers to varying degrees. The exploit code is available as part of the controversial Metasploit and Blackhole hacking toolkits. That means we can expect real, web-based attacks to start appearing almost immediately.

Anyone wanting to compromise vulnerable systems need only place the attack code on a web site and wait for those systems to visit the site. In this case, vulnerable systems include just about any Windows or Linux system running a web browser with Java enabled.

Java is typically installed both as a stand-alone runtime environment and as a plugin for web browsers. Both environments are vulnerable to this attack. Java is widely used for a variety of applications, including open source tools like Freemind and Eclipse. Some web sites use Java to provide functionality beyond what’s normally possible with web browsers.

Unfortunately, unless Java’s developer decides to issue an out-of-cycle patch for this vulnerability, it won’t be fixed until the next update cycle, which is scheduled for October 2012.

Recommendations

Standalone, locally-hosted Java applications you’re already using should be safe. Until the vulnerability is patched, we don’t recommend new installations of any Java-based software.

If you don’t use Java, or can live without it until a fix is made available, you can disable it completely in your operating system. However, this is overkill.

Attacks exploiting this vulnerability are much more likely to appear on compromised and nefarious web sites. Navigating your web browser to such a site will almost certainly infect your computer with some kind of malware. Savvy web users already know that care should be exercised when web browsing at any time, but until this security hole is fixed, blindly clicking on web links and browsing to unknown web sites is going to be like playing Russian Roulette. Because of this, many security experts are recommending disabling Java in web browsers, until the flaw is patched.

Here are some more technical details from CERT.

Additional related articles

Windows 8 annoyance lists start appearing

Since I’ve yet to bite the bullet and download an evaluation copy of Windows 8, I’m relegated to passing along reviews from elsewhere. Luckily, there’s no shortage of those.

First up is an article from laptopmag.com, entitled ‘8 Worst Windows 8 Annoyances and How to Fix Them‘. Here are the highlights:

  • No more Start menu. Why, Microsoft? Why not make it optional? Then, if I’m using a tablet, I’ll turn on the new UI; and otherwise leave it off.
  • Desktop apps (basically, all the software you currently run on Windows) are harder to find, since they are all jammed behind one pane of the new UI.
  • Shutting down the computer involves more steps and it’s not immediately obvious what those steps are.
  • The new Windows Mail app only supports IMAP, not POP. Why, Microsoft? IMAP certainly has its uses, but for most users, POP more closely matches what they really want, and how they conceptualize email. IMAP can be very confusing for users.
  • Even Windows 8 itself reverts to ‘desktop mode’ for many activities. So what’s the point of the new UI? Is it just there to confuse people and make everything take longer? The constant transitions between the new UI and the desktop are jarring for users.

Next, a PCGamesN contributor has an entertaining rant on why he’s uninstalling Windows 8. Just as I plan to do soon, this poor sod forced himself to install Windows 8 in order to evaluate it. Highlights:

  • The new UI, and the way it’s forced on the user only to revert to the desktop for many operations, is a disaster.
  • The core apps – the ones Microsoft expects you to use every day – are awful. This includes the the email client, the messaging client, the calendar, the media player and the Metro version of Internet Explorer (there’s a desktop IE as well).

Fun stuff! Thanks Microsoft, for giving bloggers such a rich source of disgust.

News for me, stuff that matters… to me. Windows, Linux, security, tools & miscellany.