February 2007 - Posts

RSA again - are we sure these people are security experts?

First there was the public terminals logged in with admin privileges:
http://msmvps.com/blogs/spywaresucks/archive/2007/02/08/552673.aspx

Now we find out that attendees' wireless security protocols left a lot to be desired:

Report February 7:
http://www.airdefense.net/newsandpress/02_07_07.php

Report February 8:
http://www.airdefense.net/newsandpress/02_08_07_1.php

According to AirDefence, more than half of the computers being used by so called security experts at RSA were running with unsafe wireless configurations.  Even more worrying is the reported discovery of two rogue access points masquerading as the official conference network, one with a forged certificate, and another five rogue networks mimicking common hotspot names.

The lesson to be learned from this story is that you must *never* set your computers to automatically connect to public hotspots.  Hell, do not allow it to connect automatically to *any* network except for your own, trusted, WPA/WEP protected networks and ALWAYS change the name of your network's SSID to something unique to you.

I am writing this while sitting in my loungeroom at home, and I can see *three* wireless networks - one is a secured wireless access point that is inside my network with its unique SSID, the second is a secured wireless access point that is in the DMZ - that is, it is *outside* my network and is used by guests and when I am working with infected systems - systems hooked into that access point are isolated from my home network.  The third is an UNSECURED network with a default SSID and no password protection at all - it has a strong signal as well, so must be quite nearby.  Anybody could rock up and use that network to download kiddy p0rn and warez, and could use the bandwidth to attack other computers, and send spam, and be pretty sure that it will be well nigh impossible to track them down unless somebody catches them actually using the network.

Windows Vista's Network and Sharing Centre makes it easier to be secure when using wireless networks.  Whenever you connect to a new network you must choose whether the network is public or private - if you choose public, then things such as file and printer sharing and network discovery are turned off by default, making your system far more secure.  Also, you are prompted to decide whether or not to connect automatically to a wireless network.  Once again, I strongly recommend that you choose to *not* connect automatically to public network.

Posted by sandi with no comments
Filed under:

IE7 Knowledge Base article: Personalized settings for IE windows remains indefinitely on SBS2003

The "Personalizing settings for Internet Explorer" window remains indefinitely when you try to log on to Windows Small Business Server 2003
http://support.microsoft.com/kb/930802

I disagree strongly with the statement in the Knowledge Base article that says: "Note Internet Explorer 7 may be installed automatically if Automatic Updates is enabled on your computer."

No no no no no!!!  IE7 will *not* install automatically, even if Automatic Updates is enabled and set to download and install automatically.  You *will* see the IE7 installation splash screen, the one that gives you the option to "install now", "install later" or "do not install".

Here is my earlier blog entry about IE7 and AU:
http://msmvps.com/blogs/spywaresucks/archive/2006/11/02/236985.aspx

Hopefully the wrong statement about AU and IE7 will be removed - I've sent some pretty strong feedback about the error.

Posted by sandi with no comments
Filed under:

New IE7 Knowledge Base article: problem with website security certificates

Warning message when a user tries to connect to a secure Web site by using Internet Explorer 7: "There is a problem with this website's security certificate"
http://support.microsoft.com/kb/931850

To be honest, I find this article to be unhelpful.  It does not mention, for example, that Windows Small Business Server 2003 uses unsigned certificates by default, and that every organisation that uses OWA, and SBS's self signed certificate, is going to have this problem.

I blogged about the problem back in January 2006, have screenshots, and show you how to resolve the issue:
http://msmvps.com/blogs/spywaresucks/archive/2006/01/31/82198.aspx

It is important to note that Windows Vista users will need to run IE7 as administrator to see the "install certificate" button.

Posted by sandi with no comments
Filed under:

Alert for McAfee users - manual update problems on Windows Vista

This article came to my attention via Harry Waldron's blog:
http://msmvps.com/blogs/harrywaldron/archive/2007/02/10/mcafee-virus-scan-8-5i-fails-vista-vb100-certification-due-to-update-problems.aspx 

"...when McAfee's manual update procedure was run it failed to apply the update to the product, despite both on-screen messages and logs stating that the product had been updated successfully. This behaviour was reproducible throughout the review period and has continued to be the case in several subsequent retests."

The article goes on to say that " 'Users with more standard update methods would apparently not have had the same issue we did,' continued Hawes. 'The problem we had can be put down not to an inability by McAfee to keep up with the latest malware, but rather to a failure to properly integrate all aspects of the product into the new Vista operating system, and most importantly the new security controls. Vista caused trouble for a lot of products and this, though seemingly a minor issue, had a major effect on the protection provided by McAfee's product.' " 

Source:  http://www.virusbtn.com/news/vb_news/2007/02_06.xml

I didn't think it was possible for my opinion of McAfee to get worse but it has.  Being able to trust our protective software to give us an accurate report of our update status is a trust that cannot, and must not, be betrayed.  What little faith I had in McAfee has now fallen to an all-time low.

My previous commentary on McAfee problems can be found here:
http://msmvps.com/blogs/spywaresucks/search.aspx?q=McAfee&p=1

Posted by sandi with no comments
Filed under:

Alert for users of TrendMicro antivirus products

Trend Micro has become aware of a vulnerability in its Scan Engine, wherein a corrupted UPX file can cause a buffer overflow and lead to either of the following:

• Blue screen of death (BSOD)

• Execution of arbitrary code that allows an attacker to take control of the system

It affects all Trend Micro products and versions using the Scan Engine and Pattern File technology. A complete list of products is found in:

http://www.trendmicro.com/download/engine.asp

http://www.trendmicro.com/download/pattern.asp

Please make sure your virus patterns are updated to at least version 4.245.

The full official advisory is here:
http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034289

Posted by sandi with 4 comment(s)
Filed under:

Anna Nicole Smith is dead? Aged 39

You know, they say that money (and fame, and looks) can't buy you happiness - Anna Nicole Smith sure proved that point true:
http://www.news.com.au/entertainment/story/0,23663,21197044-10388,00.html

And, within hours of the death being reported, those pathetic excuses for human beings, spammers, were already sending Viagra spam with subjectlines taking advantage of the woman's death, like this example:

x-sender: Badenhorst@internoggin.net x-receiver: **** X-SCL: 8 85.55% Received: from ***([***]) by *** with Microsoft SMTPSVC(6.0.3790.1830); Fri, 9 Feb 2007 11:41:12 +0900 Received: from sistema.epm.net.co (cable201-232-152-60.epm.net.co [201.232.152.60]) by ***(Postfix) with SMTP id 7EB03B5E4A for ; Fri, 9 Feb 2007 11:41:07 +0900 (WST) Message-ID: From: "Urman Lior" To: "Celik Husnu" Subject: Anna Nicole Smith dies after collapsing Date: Fri, 09 Feb 2007 02:38:37 +0000 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="Windows-1252"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1441 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Return-Path: Badenhorst@internoggin.net X-OriginalArrivalTime: 09 Feb 2007 02:41:12.0821 (UTC) FILETIME=[C33F9A50:01C74BF3] We are glad to offer you F.D.A approved Genuine Viagra. You can order it here: <<> Fast shipping and tax free prices guaranteed. -- qitkukujtttktrrptltnutthtttmquuguruoqqumth
Posted by sandi with 1 comment(s)
Filed under:

Terry Zinks: Interview with a spampire

I spotted an interesting insight into the world of spammers today, courtesy of Terry Zinks.  This snippet, in particular, was revealing:

"Finally, and I think we all knew this, but now we know how much: spammers make money when people click the sponsor links (gee, that sounds familiar).  For example, if a spammer sends out 10 million messages, $300 per day would be a pretty good day.  Seriously people, stop clicking on the spam links and making this stuff worth spammers' time."

$300.00 doesn't sound like much, but when you think that spammers have extremely low expenses, sending the vast majority of spam via hijacked computers so that they don't have to pay for the bandwidth absorbed by sending spam, then it starts to look like pretty good pay.

Its scary how much bandwidth can be sucked up by spam, especially image spam. I pity those on pay-per-byte internet access plans, or limited download accounts.

I can only repeat Terry's request: please don't click on spam links.

Source: http://blogs.msdn.com/tzink/default.aspx "Interview with a spampire"

Posted by sandi with no comments

Somebody forgot to drink their kool-aid: big security boo-boo at the RSA Security Conference

Brian Krebs of the Washington Post noticed that public computers provided for use by attendees at the RSA Security Conference were logged in to accounts with full Administrator privileges - no wimpy limited user accounts for those bad boys Smile

This quote pretty much says it all:

"I spent about 20 minutes watching the activity at these booths, as executives checked their e-mail messages there or logged on to their PCs remotely. Had I spent a bit more than 10 seconds at the terminals, I could have downloaded software that would let me steal user names and passwords from some of the more important companies in the information security community." 

Gentlemen, may I suggest that all of you immediately your user names and passwords, then return to your offices and write 100 times (neatly please - no scribbling) "I will not use public terminals".  Frankly, I wouldn't use public terminals for anything more than casual Web surfing, even when currently locked down via a limited user account, because you have no idea who has had control of that computer at any time in the past and what they may have done.

It is dangerous to assume that just because a public computer is *currently* logged in as a limited user, that it is is somehow safe to use.  *Never* assume that a publicly accessible computer is safe.

Source: http://blog.washingtonpost.com/securityfix/2007/02/when_security_companies_fail.html

Posted by sandi with 3 comment(s)

Washington Attorney General Rob McKenna Announces Fifth Computer Spyware Case; Washington Sues Three Internet Affiliate Advertisers

Copy of complaint here:
Secure Links, NJC and FixWinReg Complaint 

Washington State Attorney General Rob McKenna today announced a lawsuit against three California-based Internet affiliate advertisers and their respective business entities. The defendants are accused of sending anonymous “Net Send” messages to consumers’ computers that simulate Windows operating system warnings, transmitting bundled software that changes Internet browser home pages, and marketing registry-cleaner programs through the use of deceptive free scans.

The lawsuit filed today in King County Superior Court is Washington’s fifth case under the state’s Computer Spyware Act passed in 2005. The suit brings charges against three companies and their officers:

        Secure Links Networks LLC and CEO Manual Corona, Jr., of Brea;

        NJC Softwares LCC and company officer Rudy O. Corella, of Lake Elsinore; and

        FixWinReg and president HoanVinh V. Nguyenphuoc, of Redondo Beach.

Washington’s suit lays out seven causes of action that include sending Net Send messages that:

        Feign the discovery of critical errors on a computer;

        Prevent a computer user from declining the installation of software;

        Modify computer settings;

        Intentionally misrepresent the necessity of new software for security purposes; and

        Mislead consumers into believing that registry-cleaner software has performed indicated repairs.

The state is seeking injunctive provisions. If found liable, each defendant could be fined up to $100,000 per violation of the Computer Spyware Act and $2,000 per violation under the Consumer Protection Act. They may also be required to pay compensation to affected consumers.

Note that the defendants acted as affiliates for each other.  They are alleged to have worked together to market each other’s products. Corona owns programs called Registry Sweeper Pro and Registry Rinse. Corella owns Registry Doc, Registry Cleaner 32 and Registry Cleaner Pro. FixWinReg marketed and sold several of the products.

The defendants did not use Web page based pop-up advertisements to encourage purchase.  Instead, the products were advertised by sending Net Send messages (otherwise known as Messenger Service, and turned off by default in later operating systems) to users’ computers. Net Send is a Windows operating system command traditionally used by network administrators to broadcast pop-up messages to computer users about service outages.

The messages resembled system alerts with alarmist wording such as “WARNING! WINDOWS REQUIRES IMMEDIATE ATTENTION. Windows has detected CRITICAL SYSTEM ERRORS. … FAILURE TO REPAIR AN INVALID OR CORRUPT SYSTEM REGISTRY MAY LEAD TO DATA LOSS OR SYSTEM FAILURE!”

Another version labeled as an “Important Security Bulletin” included an error string and a recommendation that the user immediately scan the system registry.

The messages instructed computer users to download software to fix the errors. By visiting the URL addresses included in the messages, users were redirected to other Web sites owned by the defendants where they were encouraged to download a free trial version of the software that will scan their computer for registry errors.

Attorney General Katherine Tassi, of the Consumer Protection High-Tech Unit said  “The state’s investigation showed that the free scan always identified ‘critical errors,’ but in many cases these so-called errors were harmless files,” Tassi continued: “In order to remove the errors, consumers were told they must purchase the full version of the software priced at $29.95 and up. The full version of Registry Doc claimed to remove some files that actually remained on the user’s computer.”

She said users were also given an option to decline installation of an unrelated search toolbar called Twikibar that is bundled with the trial version of Registry Doc.

Tassi also said: “We found that even when a user didn’t want to install Twikibar, the program installed itself and automatically changed the computer’s Internet browser home page,”   She continued: “There’s no obvious way to uninstall the toolbar. This is a violation of Washington’s Computer Spyware Act, which prohibits transmitting software without a user’s consent and modifying computer settings.”

Washington consumers who have purchased or downloaded products from the defendants can file a complaint with the Attorney General’s Office online at www.atg.wa.gov or call 1-800-551-4636 (number available in-state only) to request a complaint form. Consumers outside Washington should file a complaint with the Attorney General’s Office in the state where they live.

Source: Press Release - Office of the Washington State Attorney General

Edited to change "Computer Protection High-Tech Unit" to "Consumer Protection High-Tech Unit" - error in original press release.

Posted by sandi with no comments

Yahoo India was hacked at least 4 days ago and nothing has been done

What's a girl to do when even a really big names like Yahoo are hacked?  Yes, I am talking about Yahoo India, but it is still Yahoo.

If you come across a Web site that wants to install a Remote Data Services Data Control you can be pretty damned sure that it is not a good thing.  Don't let the site do what it wants.

Mike Burgess of MVP Hosts file fame had a look at the Yahoo site this morning after I pinged a security list about the problem, and has supplied the following screenshot of what the pages try to do - you will see that the page is trying to download something from 39814547.ee28.cn, which in turn translates to IP 222.208.183.175, which in turns translates into Chinanet SC, China Telecom.  I checked the Yahoo site again this evening, and it is still compromised 5 days after news of the hacking appeared in the blogosphere.  Even more amazing, the Yahoo India site is brand new - it went live on or about 31 January 2007 (I'm not sure exactly when), and on 1 February 2007 somebody had already blogged about the hacking:
http://fulltosh.spaces.live.com/blog/cns!5BE8C2D33352197D!358.entry

It is simply not good enough for Yahoo (even Yahoo India) to send a site live which is then hacked within a very short period of time, and which is still a danger 4 days later.  In the ultimate irony, news.yahoo.com reported just today about "an increasing number of Web sites hosting malicious javascript code".  Yahoo, you need to clean up your own backyard - NOW!!!

Yahoo India has roughly 25.5 MILLION USERS - that is 25.5 million potential victims of this hacking.  I'm going to try and find a contact at Yahoo who can get that damned site shut down until it is cleaned up and security improved.

Here is what we see when we visit the hacked Web site (the first graphic is Mike's screenshot, followed by three screen captures of some infected pages) - PLEASE DO NOT VISIT THE URLS!!

I checked the URLs once more immediately before sending this blog entry live - the pages are still dangerous.  The screenshots may fall to bottom of screen on smaller monitors in which case you will need to scroll down to see them - sorry about that.

Update: Yahoo is slowly cleaning things up, but they're missing pages - this one, for example, is still infected:
http://in.hindi.yahoo.com/Religion/PhotoGallery/0610/19/1061019009_1.htm

Posted by sandi with no comments

Verisign needs to sort out their site so that it works with their Extended Validation (High Assurance) Certificate

Let this be a lesson to those companies out there that are going to purchase an Extended Validation (EV) certificate - please make sure that your site is coded so that the EV will display.  Extended validation certificates are not cheap, and you do not want to be forking out money for an EV, only to have it fail to display.

Take the following example - I did not realise that Verisign was using an Extended Validation Certificate, and will explain why.

Verisign issued the EV certificates used by Paypal and Ebay.  Let's have a look at some further information about these new certificates by clicking on the View Certificates option if we click next to the lock icon:

 

When we view the certificate details we see this:

Let's have a look at the Issuer Statement.  Clicking that button opens an Internet Explorer window, and a Verisign page.   The Address Bar is green when the Verisign page first opens, but it does not stay that way. Several of the screenshots in this article are taken using XP, but the problem also exists in Windows Vista.

This is the window that opens when we click on the Issuer Statement button:

When the Verisign page opens, we see a dialogue box asking for permission to display nonsecure items, and therein lies the problem.  That dialogue box appears when Internet Explorer is set to "prompt" before displaying what is called mixed content, which is the default setting for IE7.  In this case, Verisign has a secure (https) page that is displaying content (graphics) that is not a part of the secure page, instead being pulled from another area (sometimes called hot linking, or inline linking), thereby triggering the dialogue box.  If we select "yes" and allow IE to display the non-secure content, the green Address Bar disappears.  If we select "no", the green Address Bar stays, as you can see from the shots below.  The only fix from the user's point of view is to set Internet Explorer 7 to never display mixed content, which some will say is a good idea for security reasons, but the fact of the matter is that Web sites need to make sure that their expensive Extended Validation certificates work when Internet Explorer 7 is being used with its default settings.

A Knowledge Base article that explains one of the ways that a Web page with frames may trigger the dialogue box can be found here:
http://support.microsoft.com/kb/184960

The equivalent SecureTrust "Issuer Statement" page that is reached in the same way when we visit a site that is using a certificate issued by SecureTrust, does NOT have this problem.  Well done SecureTrust.  I wonder if it was luck, or if SecureTrust knew there would be a problem if their page had mixed content.

I'll be reporting what I have found to the Internet Explorer team to see what they say; I suspect the behaviour will be "by design" because it pretty much guarantees that all content on an EV protected site is actually hosted by that site.

Here are screenshots of what happened on the Verisign page.

We say yes to displaying mixed content - the green bar disappears:

We say no to displaying mixed content - the green bar stays:

Posted by sandi with 1 comment(s)

Have you seen the green bar yet? Hooray for High Assurance!

High Assurance (now known as Extended Validation aka EV) Certificates are up and running for IE7 (the green address bar).  To test if it is working for you, go to www.paypal.com and see if the bar turns green (see screenshot below).  If the bar doesn't turn green for you install the Windows Root Certificate update available here:
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/rootsupd.exe

Information about the root certificate program can be found here:
http://support.microsoft.com/kb/931125

Paypal is already displaying the green bar - so is Ebay - so is SecureTrust - bye bye phishers!!!  MySpace, despite being such a high risk (and oft targeted) environment and its ongoing problems with fake log-in pages, is not using a High Assurance Certificate {{boo hiss}}

The combination of High Assurance Certificates and Internet Explorer's Phishing Filter is going to make it harder and harder for phishers to succeed in fooling people.

Please share the URLs of any other sites that have started using High Assurance - let's get the word out there and really p*ss off the phishers - I am *so* very pleased and excited that this is finally up and running.

If the green bar does not appear for you, and you are using IE7: 

Phishing filter - must be set to automatic
Automatic server certificate revocation checking - must be enabled: Tools -> Internet Options -> Advanced -> Security -> Check for Server Certificate revocation.

 

Posted by sandi with 6 comment(s)
Filed under:

Ummm, thanks for sharing

Yay for System applets that tell us the bleedin' obvious!

Posted by sandi with 1 comment(s)

Bye Jim - we'll miss you

As we all know, Jim Allchin retired from MS on 30 January 2007, the day that Vista was released to the world, and only a few weeks after he joined I and several other Hive Featured Community owners for lunch in Las Vegas.

I am going to miss Jim. He was a great supporter of the MVP Program, and of Microsoft's users.  One event that stands out in my mind was how Jim took Outlook Express under his wing years ago, and how much good he did. 

OE had been sadly neglected for years, with serious problems and bugs that we (MVPs) had been fighting to get fixed for years.  Anyway, years ago Jim was taking questions at an MVP Summit when Tom Koch of insideoe fame took the opportunity to speak up.  The end result was that Jim was appraised of the basic problems faced by OE users, and he took action to get things fixed.

Jim took OE under his wing, kicked some butt and the Mondo Patch was eventually born.  Yes, the Mondo Patch article states that "many of the fixes and enhancements in the Cumulative Update for Outlook Express 6.0 SP1 were a result of direct feedback from our Most Valuable Professionals (MVPs)" but reality is that without Jim's support the patch would not have come to be when it did, and I sometimes wonder if OE's replacement, Windows Mail, would have come to be Jim had not focused on OE's problems.

So now we fast forward to 2007.  Jim has retired, Tom Koch is no longer an MVP and has moved on to other things, Outlook Express is no longer in development (having been replaced by Windows Mail), Bill Gates is soon to retire and we are facing a brave new Microsoft world.  What will happen going forward? I honestly don't know, and I admit to feeling some trepidation. I can only hope that Jim's replacement(s) will have the same heart for the user that Jim does.

Anyway, Jim posted his goodbye on the Windows Vista Team Blog, his last official act as a full-time Microsoft employee (hey, there's a glimmer of hope, right there - he *did* say "full-time employee) Smile

You can find Jim's goodbye here - I love his "typical day" post retirement:
http://windowsvistablog.com/blogs/windowsvista/archive/2007/01/31/what-comes-next.aspx

Be happy Jim, and thanks for everything.

Sandi &c.

Posted by sandi with no comments
Filed under:

Exchange System Manager and IE7 and ESM's version of PSAPI.DLL don't mix

I'm sure I've written about this before - yep, I've got info up on www.ie-vista.com on the Knowledge Base page:
http://www.ie-vista.com/known_issues.html#tpa

The official SBS Blog have posted an entry about a problem with Exchange System Manager and IE7 here, complete with screenshots:
http://blogs.technet.com/sbs/archive/2007/02/02/esm-with-ie7-unable-to-open-the-help-file.aspx

Note that ESM is not the only product that has caused problems by installing its own copy of PSAPI.DLL.  The fix is always the same - remove the copy that was installed by the software.

Other products causing problems by installing a second copy of PSAPI.DLL include McAfee software, BT Broadband Help (BT Yahoo Help), Motive SmartBridge, Hal Screen Reader and Supernova Reader Magnifier by Dolphin.

What I want to know is, why do those products install a second copy of PSAPI.DLL when the pre-existing copy in ..\windows\system32 works just fine.

Posted by sandi with no comments

I installed IE7 and crashed the Internet!

File this one under "It is not always IE's fault"  Big Smile
http://sharkbait.computerworld.com/?q=node/228

Posted by sandi with 1 comment(s)
Filed under:

New IE7 Hotfix article

HOTFIX: Error message when you enumerate the cache in IE7: "ERROR_INVALID_PARAMETER"
http://support.microsoft.com/kb/929726
Posted by sandi with no comments
Filed under:
More Posts « Previous page