Patch Tuesday Features USB / Shortcut Bug Fix

When I logged into my pc this morning I received the typical Windows update message and thought little of it. This update however addresses a critical issue publicized in mid July that has been dubbed the USB or Shortcut Bug. The bug was initially being exploited through the use of USB thumb drives and was thought to be limited in scope but, according to this BBC report, has been gathering steam since details of the exploit were published on July 17th. More disturbingly the target of the attacks appears to have been "aimed at the software control systems for critical infrastructure such as power stations."

If you do not have automatic updates turned on it is advisable to visit Microsoft and download this update. While I'm pretty sure you are not running a power station, the flaw in Windows would allow unauthorized access and control of your pc should you acquire the bug. Aaron Heibert at Tom's Hardware offers some friendly advice regarding how to protect yourself from this and other such attacks.

Let's be careful out there...

Conficker Getting Tougher To Detect And Eradicate

According to the New York Times, groups that track and defend us from malicious software are saying that the Conficker Virus is being updated and "... the most recent version, which began to appear Tuesday, appeared to be targeted at improving a peer-to-peer communications system between computers that are infected and hardening the system by making infected machines more resistant to anti-virus software." Additionally, "the Conficker authors have switched strategies and are using the program’s peer-to-peer mechanism to update the system. Originally, they had appeared to plan to download instructions to Conficker by generating new Internet addresses that infected machines could download instructions from."

No one has figured out entirely what the plot / purpose of Conficker is but it is being watched closely as it has infected millions of Windows machines world wide. According to Wikipedia "BKIS, a Vietnamese security firm, has announced that they found clues that the virus may be originated from China"

Windows Worm Spreads To 3.5 Million PCs

A Windows worm known as Conficker, Downadup, or Kido which was first discovered in October has a new viral variant that is causing concern amongst security firms. Even though Microsoft's MS08-067 patch protects users from the worm it has propegated to some 3.5 million machines worldwide.

According to Microsoft, the worm works by searching for the "services.exe" file and then becomes part of that code. It copies itself into the Windows system folder as a random dll fileand gives itself a 5-8 character name, such as piftoc.dll. The worm then modifies the Windows Registry to run the infected dll file as a service. Once up and running, it creates an HTTP (web) server, resets your machine's System Restore point (making it harder to recover from) and proceeds to download files from a malicious web site.

"There was a new variant released less than two weeks ago and that's the one causing most of the problems," Kaspersky Lab's security analyst, Eddy Willems told the BBC.

"The replication methods are quite good. It's using multiple mechanisms, including USB sticks, so if someone got an infection from one company and then takes his USB stick to another firm, it could infect that network too. It also downloads lots of content and creating new variants though this mechanism."

"Of course, the real problem is that people haven't patched their software. If people do patch their software, they should have little to worry about," he added.

Flaw found in Adobe PDF file format that could be exploited, hacker says

Security researcher, Petko Petkov, says he's discovered a flaw in the Adobe PDF file format that could allow a Windows PC to be "Completely!!! Invisibly and unwillingly!!!," compromised. Petkov, who also recently discovered a vulnerability in QuickTime that affected the Firefox browser says " All it takes is to open a PDF document or stumble across a page which embeds one." He has stated that he would not release code that shows how this attack works until Adobe addresses the problem. InfoWorld has the story here.

Patch Tuesday a quiet one for Microsoft

With one "Critical" patch and three "Important" ones, this months updates from Microsoft is the quietest of the year, and no reported Skype outages to my knowledge! The critical patch affects users of Windows 2000 operating system, with the vulnerability triggered by a visit to a website and the install of software that could then infect the computer with a malicious virus. Perhaps things are tightening up for Vista and XP? Or are the hackers just not back from vacation yet... Time will tell.

Microsoft issues critical patches

If you are like me, you will have noticed the little yellow security center shield when you logged onto your Windows PC today and perhaps that there were a lot of updates from Microsoft. The updates affect different versions of Windows, Server and Office software, including Windows XP and Windows Vista, which Microsoft has tauted as the most secure operating system ever. There were patches aimed at gadgets, Windows Media Player, and Excel, among the nine security related fixes. The Globe and Mail has more.