LATEST: NEWS

Test your internet connection speed

NEWS::NEWS::NEWS

LATEST: SECURITY ISSUES (Click on headline to expand story)

CLICK HERE FOR THE MAIN SECURITY ISSUES PAGE

• If you find a USB stick on the pavement...

  DO NOT PICK IT UP! It is highly likely to contain a nasty virus. Read on...

• JPEG exploit goes wild

  Barely a fortnight following Microsoft's monthly security bulletin highlighting a vulnerability in the way its software handles images using the JPEG format, code to take advantage of the vulnerability has been found on images circulated in the EasyNews Usenet group.
  The company says it has found two images containing the code, which - if viewed - would result in software being downloaded that would give a remote attacker access to files on the machine storing the images, as well as free reign to run code on it.  In a posting on the company's site, John Bissell writes: 'Through my limited testing I have found on a unpatched XP SP1 system that if you click the exploit jpeg file in Windows Explorer then you will be hacked.'  The messages state that at one point 93 users were logged on to the IP address from which the exploit was downloading nearly 2MB Trojan and other malicious software. However, a 'quick and nasty' PERL script has been put in place to make sure no such images infiltrate the network again.  The company has also not been able to find any code within the images that would allow it to self-propagate, so in this instance, it isn't classed as a worm.  Code that was able to take advantage of the JPEG bug began circulating on the Internet about a week ago.  As is common with much of the malicious software written to attack Microsoft vulnerabilities, this particular exploit appeared after Microsoft had issued a patch. Hackers often reverse engineer Microsoft's patches in order to create code to exploit the hole that the patch fixed. However, the time between releasing a patch and the appearance of malicious code to exploit the identified vulnerability grows ever shorter. Security experts greatest fear is a 'zero-day' exploit, where hackers launch exploit code less than a day after Microsoft issues a patch, so that no-one has time to update their systems.

• Disabling the Messenger Service to prevent Pop Up Spam (Not to be confused with the Windows Instant Messaging communications application)

  • This is the Windows service which controls UPS's (Uninterruptible Power Supplies) and alerts workstations of an imminent power shutdown which has been exploited by hackers-spammers. To remove the ability for anyone to pop up messages on your computer, you can disable the Messenger service. Its easy to reverse at a later time if you wish to do so.  Keep in mind that you are advised to check with your computer support staff before disabling any service so that you do not inadvertently disable a service that your department uses.
    Windows XP
    Click Start->Control Panel
    Click Performance and Maintenance
    Click Administrative Tools
    Double click Services
    Scroll down and highlight "Messenger"
    Right-click the highlighted line and choose Properties.
    Click the STOP button.
    Select Disable or Manual in the Startup Type scroll bar
    Click OK
    Windows 2000
    Click Start-> Programs-> Administrative Tools->Services
    Scroll down and highlight "Messenger"
    Right-click the highlighted line and choose Properties.
    Click the STOP button.
    Select Disable or Manual in the Startup Type scroll bar
    Click OK
    Windows NT
    Click Start ->Control Panel
    Double click Administrative Tools
    Select Services -> Double-click on Messenger
    In the Messenger Properties window, select Stop,
    Then choose Disable as the Startup Type
    Click OK
    Windows 95/98/ME
    Click Start ->Settings ->Control Panel
    Double click on Network.
    Click on the File & Print Sharing button.
    Turn off file sharing and print sharing by clicking each box to remove the check marks.
    Click OK
    Select the TCP/IP protocol that is pointing to your Ethernet card or USB cable modem.
    Click Properties ->Bindings tab.
    Click to uncheck the boxes next to "Client for Microsoft Networks" and "File and printer sharing for Microsoft Networks".
    Click the OK button twice and restart your computer.
    NOTE:
    Automatic: Service is started every time the computer boots This is the default setting for any services that the system wants. But, there are many unnecessary services that do this by default.
    Manual: Service does NOT start at boot, but can be started manually by the user or by another service that depends on it. This is often used for services that you don't always want running but use on occasion like telnet or terminal services.
    Disabled: The service cannot be started by the system or the user. There are no services that are set to this by default. If a service is set to this it is because someone put it there. This is useful for things you DO NOT want to run.
    
    If an Automatic/Manual service is not running, and someone attempts to connect to that service they will not get a reply and the service will remain stopped.
    
    Disabled services cannot start even when the user attempts to manually start it.

• Critical vulnerability revealed in Real Players

  • A highly critical security vulnerability has been discovered in Real Players and other Real Networks' software. A boundary error in the processing of WAV and SMIL could allow the execution of malicious code.
    The vulnerability can be exploited by a specially written WAV or SMIL file to cause a buffer overflow and enable arbitrary code to be run. Products affected include Real Player 8 and 10.x and RealOne Player 1 and 2 as well as Helix Player 1 and RealPlayer Enterprise 1.x.
    
    Mac and Windows users should upgrade their players via the Check for Update menu; Linux users should go to www.real.com/linux.
    
    Further details and information on Helix and Enterprise updates can be found at the Real Security Update page.
    
    Real notes that it has received no reports of machines compromised as a result of vulnerabilities.
    
     

1&1 Internet Hosting and Domains

 Find us in...
UK Business Directory

Find us in

Yellow Pages