« October 2010 | Main | December 2010 »

November 2010

Thursday, 11 November 2010

How to keep ALL your software patched and secure

If you pay any attention to computer security, you know that you should run scheduled checks for Windows or Apple Updates to keep your operating system software up to date, be it Windows XP/Vista/7 or MacOS 10.x. This is a necessary step to protect your computer from attacks that exploit vulnerabilities in software.

Necessary, but not sufficient.

Attackers experiment with software of all types, from browsers and email clients to graphics, business and office software. They  find programming flaws and exploit what they find to gain control of your computer. Attackers don't discriminate between free-, share-, or commercial applications: if the application is popular enough, some bad actor is searching for an exploit.

Windows and Apple Updates only keep operating system software "patch current". You need to keep all your software patched to protect yourself as much as possible against known vulnerabilities and exploits.

At first glance, this sounds like an impossible or full-time task. It's not uncommon for a user to install and use several dozen applications over time (my office MacBook has over 100). Not all of these applications offer automatic updates. Searching and finding patches for all your software manually is more than the average user will ever consider. Surely there's an easy way to manage this? Yes.

I've had some success using Appfresh for my Mac, and Secunia Personal Software Inspector (PSI) for my Windows XP/Vista/7 PCs. Let's have a look.

Appfresh

Appfresh scans your Mac to enumerate all installed applications, widgets, and plugins and will check for Apple Updates. Appfresh informs you whether your installed software is up to date or whether an update is available for installed software that is not patch current. Appfresh also tells you when you last used the software: use this to decide whether it's best to simply remove the program.

A right-mouse click on an application provides options to check for and download updates.

Appfresh Appfresh has native support for commonly used software and supplements this support with information from a reputation-based software tracking community, iusethis. Appfresh lets you register with iusethis so you can obtain comments, notices, and reviews of software you've installed. Appfresh can be scheduled to run automatically at startup or on a day and time that's convenient for you.

Appfresh is still under development but I've found the current version to be stable and useful. Try it.

Secunia PSI

Like Appfresh, Secunia PSI scans Windows-based PCs for vulnerable or out-of-date programs and plug-ins. Secunia PSI has a simple and advanced interface mode. The simple mode enumerates insecure software and provides a threat rating; a Category 5 threat, for example, is an indication that the insecure software is currently being exploited by attackers on the Internet to gain control of PCs. Simple mode  provides a convenient one-click "solution" that connects you to a vendor patch link.

SecuniaPSI_simple

Advanced mode provides more detail for power users. Separate tabs provide details about insecure programs, end-of-life programs, and security issues associated with browser settings and plug-ins. You still have a one-click "solution" that connects you to a vendor patch link.

SecuniaPSI_advanced
Secunia supports an extensive database of security advisories for users who want to understand the nature of threats in some detail. This is available from simple or advanced mode. Secunia PSI can run as a service, accessible from the System Tray, to continuously monitor and report on the patch status of your installed software. I've use PSI for several years now and highly recommend that you try it.

Last Word

Unpatched software leaves you just as exposed to attack as unpatched Operating Systems. Appfresh and Secunia PSI won't automatically update your installed applications but they do warn you when your applications are vulnerable and they make the update process simple. Invest a small amount of your time to regularly scan your software and keep your installed software up to date.

Posted at 11:25 AM in MacOS, Malware | | Comments (0)

Tags: Apple Update, exploit, piscitello, security skeptic, vulnerability, Windows Update

Monday, 01 November 2010

419 scams: the more you know

419 scams all pose a common proposition. Someone you don't know promises you a large sum of money. All you need to do is temporarily handle a small processing or facilitation fee in advance to release to assist the scammer in gaining access to a very large pile of money. In return,  the scammer promises to compensate you with a large sum to you upon completion of his transaction. But there is no large sum of money waiting for you, no matter what you may be told; moreover, your small advanced fee or more is lost.

Some colleagues commented on my recent column about 419 scams delivered by postal mail.  We collaborate on a number of mail lists where the Chatham House Rule applies. I won't disclose the source of these comments but they are not my original work. I'm grateful for the opportunity to share them.

In particular, my colleagues suggest that the following points are noteworthy

  1. Investigation and prosecution of the 419 scams is hindered by official corruption at very senior levels in some west African countries.
  2. 419 scams may include substantial props, including ocumentation with letterheads, seals and other eye candy. These all fail under careful scrutiny. As I illustrated in my earlier column, 419 scam letters make clever use of journalistically reported events to substantiate the scam or make their please credible.
  3. Replying to or baiting 419 scammers is generally not a good idea. Some 419 scammers have been known to be violent. At the very least, if you contact them they will very likely persist in contacting you.
  4. Certain 419 scams may invite you to travel overseas. In certain cases, the fraud can escalate into a kidnapping. (This adds a new dimension to the axiom, "Don't go there".)
  5. While it doesn't hurt to report 419 scames, set expectations low. Unless you can provide a documented loss, it is unlikely individual complaints will result in an investigation or arrest.

Lastly, my colleagues offered some interesting 419-related Youtube selections:

Nkem Owoh, "I Go Chop Your Dollar"
http://www.youtube.com/watch?v=Ktz7vc70hZ8

M.I.A., "Paper Planes (All I Want to Do Is Take Your Money),"
http://www.youtube.com/watch?v=7sei-eEjy4g

Banky W, "Maga No Need Pay"
http://www.youtube.com/watch?v=EGCnl6O6bnE

Posted at 02:53 PM in Anti-Malware and Anti-phishing, Stop Think Connect | | Comments (0)

Tags: 419 scam, nigerian scam, piscitello

« Previous
Find me on Mastodon and Facebook

Spotlight Posts

  • Cybercrime Reported in April 2025
    In today's Interisle Insights, Colin Strutt looks at cybercrime activity collected at the Cybercrime Information Center for the month of April 2025.We point out anything that strikes us as particularly interesting in overall numbers as well as significant changes in ranking for Top Level Domains (TLDs), Registrars, and Hosting Networks. Read Cybercrime Reported in April 2025. Interisle Insights is a reader-supported publication. To receive new posts and support our work, consider becoming a free or paid subscriber. Join now!
  • Malware Trends: January - March 2025
    Malware activity reports for the quarter are now posted at the Cybercrime Information Center. Our key statistics show small quarter-over-quarter increases in malicious IP address malware records (Traffic Injectors and Attackware) and unique IPv4 addresses reported as serving or distributing malware, and but meaningful decreases in both endpoint and IoT malware reported. Read Malware Trends: January - March 2025
  • The World's Phishiest Neighborhoods
    In this Interisle Insights article, we take a closer look at our data to better understand what’s hosted at three autonomous systems which have appeared at or near the top in recent quarters. We’ll also review who’s being targeted by these attacks and what corresponding name and address resources are most frequently exploited. Autonomous systems are blocks of Internet addresses, which you can compare to "neighborhoods" in a city. And like any city, some neighborhoods are safe and some are not. The full article, The World's Phishiest Neighborhoods, is hosted here.
  • Interisle Study Reveals Alarming Rise in Online Abuse and Identifies Exploitable Links in Cybercriminal Supply Chains
    My Interisle colleagues and I today published our 2024 Cybercrime Suppy Chain study. We analyzed 16 million cybercrime events to expose a dramatic rise in criminal exploitation of name, address, hosting, and financial supply chains. Our year-over-year findings show that cybercriminals exploit lax policies to easily and cheaply obtain resources for phishing, malware, and spam campaigns. In our report, we provide actionable insights for those aiming to curb cybercrime. Among the major findings in the study, Interisle reports that: The total number of malware, phishing, and spam attacks grew year-over-year by nearly 54%, to nearly 16.3 million attacks. Spam doubled,...
  • Malware quarterly reports for July-September
    Malware quarterly reports for July-September 2024 is now posted at the Cybercrime Information Center. For the period... Malware identified as targeting endpoint devices increased 277% over the prior period. WordPress blog sites used for malware accounted for nearly all the malicious documents reported for this period. We continue to see an uptick in malicious scripts. IPv4 addresses reported for exhibiting characteristics of attackware and traffic injectors increased 38% to just under 1 million. ASNs in China and India again have the most IPv4 addresses reported for hosting malware. More malware trends for the period at https://www.cybercrimeinfocenter.org/malware-trends-july-september-2024. For historical reporting of...

Search

My Photo

Categories