The Security Skeptic

How to keep ALL your software patched and secure

If you pay any attention to computer security, you know that you should run scheduled checks for Windows or Apple Updates to keep your operating system software up to date, be it Windows XP/Vista/7 or MacOS 10.x. This is a necessary step to protect your computer from attacks that exploit vulnerabilities in software.

Necessary, but not sufficient.

Attackers experiment with software of all types, from browsers and email clients to graphics, business and office software. They  find programming flaws and exploit what they find to gain control of your computer. Attackers don't discriminate between free-, share-, or commercial applications: if the application is popular enough, some bad actor is searching for an exploit.

Windows and Apple Updates only keep operating system software "patch current". You need to keep all your software patched to protect yourself as much as possible against known vulnerabilities and exploits.

At first glance, this sounds like an impossible or full-time task. It's not uncommon for a user to install and use several dozen applications over time (my office MacBook has over 100). Not all of these applications offer automatic updates. Searching and finding patches for all your software manually is more than the average user will ever consider. Surely there's an easy way to manage this? Yes.

I've had some success using Appfresh for my Mac, and Secunia Personal Software Inspector (PSI) for my Windows XP/Vista/7 PCs. Let's have a look.

Appfresh

Appfresh scans your Mac to enumerate all installed applications, widgets, and plugins and will check for Apple Updates. Appfresh informs you whether your installed software is up to date or whether an update is available for installed software that is not patch current. Appfresh also tells you when you last used the software: use this to decide whether it's best to simply remove the program.

A right-mouse click on an application provides options to check for and download updates.

Appfresh has native support for commonly used software and supplements this support with information from a reputation-based software tracking community, iusethis. Appfresh lets you register with iusethis so you can obtain comments, notices, and reviews of software you've installed. Appfresh can be scheduled to run automatically at startup or on a day and time that's convenient for you.

Appfresh is still under development but I've found the current version to be stable and useful. Try it.

Secunia PSI

Like Appfresh, Secunia PSI scans Windows-based PCs for vulnerable or out-of-date programs and plug-ins. Secunia PSI has a simple and advanced interface mode. The simple mode enumerates insecure software and provides a threat rating; a Category 5 threat, for example, is an indication that the insecure software is currently being exploited by attackers on the Internet to gain control of PCs. Simple mode  provides a convenient one-click "solution" that connects you to a vendor patch link.

Advanced mode provides more detail for power users. Separate tabs provide details about insecure programs, end-of-life programs, and security issues associated with browser settings and plug-ins. You still have a one-click "solution" that connects you to a vendor patch link.

Secunia supports an extensive database of security advisories for users who want to understand the nature of threats in some detail. This is available from simple or advanced mode. Secunia PSI can run as a service, accessible from the System Tray, to continuously monitor and report on the patch status of your installed software. I've use PSI for several years now and highly recommend that you try it.

Last Word

Unpatched software leaves you just as exposed to attack as unpatched Operating Systems. Appfresh and Secunia PSI won't automatically update your installed applications but they do warn you when your applications are vulnerable and they make the update process simple. Invest a small amount of your time to regularly scan your software and keep your installed software up to date.

419 scams: the more you know

419 scams all pose a common proposition. Someone you don't know promises you a large sum of money. All you need to do is temporarily handle a small processing or facilitation fee in advance to release to assist the scammer in gaining access to a very large pile of money. In return,  the scammer promises to compensate you with a large sum to you upon completion of his transaction. But there is no large sum of money waiting for you, no matter what you may be told; moreover, your small advanced fee or more is lost.

Some colleagues commented on my recent column about 419 scams delivered by postal mail.  We collaborate on a number of mail lists where the Chatham House Rule applies. I won't disclose the source of these comments but they are not my original work. I'm grateful for the opportunity to share them.

In particular, my colleagues suggest that the following points are noteworthy

1. Investigation and prosecution of the 419 scams is hindered by official corruption at very senior levels in some west African countries.
2. 419 scams may include substantial props, including ocumentation with letterheads, seals and other eye candy. These all fail under careful scrutiny. As I illustrated in my earlier column, 419 scam letters make clever use of journalistically reported events to substantiate the scam or make their please credible.
3. Replying to or baiting 419 scammers is generally not a good idea. Some 419 scammers have been known to be violent. At the very least, if you contact them they will very likely persist in contacting you.
4. Certain 419 scams may invite you to travel overseas. In certain cases, the fraud can escalate into a kidnapping. (This adds a new dimension to the axiom, "Don't go there".)
5. While it doesn't hurt to report 419 scames, set expectations low. Unless you can provide a documented loss, it is unlikely individual complaints will result in an investigation or arrest.

Lastly, my colleagues offered some interesting 419-related Youtube selections:

Nkem Owoh, "I Go Chop Your Dollar"
http://www.youtube.com/watch?v=Ktz7vc70hZ8

M.I.A., "Paper Planes (All I Want to Do Is Take Your Money),"
http://www.youtube.com/watch?v=7sei-eEjy4g

Banky W, "Maga No Need Pay"
http://www.youtube.com/watch?v=EGCnl6O6bnE