Happy New malware Year
A turbulent beginning of 2013
We can determine threats on two major fronts: Ruby on Rails, Java and Microsoft’s Internet Explorer form the first one – all web-related. And then there are flaws in Foxit Reader and Microsoft’s Windows RT, which also got in the line of fire.
Make updates! Restart your computer!
Pornography alarm or reboot?
But there is another pitfall: Most computer users do not realize that many software updates do not only need to be installed, but the computer needs to be restarted for the updates and patches to take effect. The combination of ignorance, impatience and laziness is fatal in this sense.
The safety of the PC stands and falls with the combination of your security software, the updates of the OS and other software and especially of your own behavior. Very often, the Achilles heel of PC security is human ‘procrastination’.
Users often don’t want to turn the PC or laptop off completely, because the startup takes too long. The endlessly used method to simply closing the laptop or choosing hibernation state of the PC is a phenomenon that most readers will be familiar with. The use of tablet computers even made it worse: those devices are ready to be used in an instant and therefore have made us even more impatient.
(more…)
Could the DLL-hijacking problem be underestimated?
This is a small copy of the official G Data Blog
Find the full and official version at www.gdatasoftware.com
Last week, HD Moore released details about a serious DLL problem under Windows. HD Moore is known as developer of the Metasploit application.
After a week, Microsoft released more information, discussing bad practices in DLL loading that could lead to remote exploitation, which is the main source of this problem. They have recently released tools which can help mitigating the risk. But the real and possibly best solution is for developers to patch their applications to follow best practices.
There is little that can be done by those of us in the security community, or Microsoft for that matter, as many applications are designed to take advantage of this flaw and it could take many weeks or months for application developers to release better designed programs and encourage users to update to these new versions. Some of the programs will be updated automatically, some of them won’t. The patches Microsoft is offering do work, but it could make several programs unusable and prevent them from backward compatibility.
