80% Of Browsers Found To Be At Risk Of Attack

About eight out of every ten internet browsers run by consumers are vulnerable to attack by exploits of already-patched bugs, a security expert said today.

The poor state of browser patching stunned Wolfgang Kandek, CTO of security risk and compliance management provider Qualys, which presented data from the company’s free BrowserCheck service Wednesday at the RSA Conference in San Francisco.

“I really thought it would be lower,” said Kandek of the nearly 80% of browsers that lacked one or more patches.

BrowserCheck scans Windows, Mac and Linux machines for vulnerable browsers, as well as up to 18 browser plug-ins, including Adobe’s Flash and Reader, Oracle’s Java and Microsoft’s Silverlight and Windows Media Player.

When browsers and their plug-ins are tabulated together, between 90% and 65% of all consumer systems scanned with BrowserCheck since June 2010 reported at least one out-of-date component, depending on the month. In January 2011, about 80% of the machines were vulnerable.  Read more….

‘Ransomware’ Malware Threats Increasing

A particularly nasty type of attack named”ransomware” is on the rise, with antivirus vendor Symantec seeing at least three new variants appearing in recent months. Such attacks often use viruses to not only steal a person’s sensitive or financial information, but also to disable hard drives and demand money to restore them.

“Threats that use extortion can be some of the most aggressive and, in some cases, offensive viruses encountered,” said Symantec security researcher Gavin O Gorman in a blog post.

Unfortunately for computer owners, attackers continue increase the sophistication levels of their ransomware. For example, GPCoder.G, which first appeared in November 2010, is a small (only 11 kilobytes ) piece of malware which, if executed, searches a hard drive for files with specific extensions, relating to everything from videos and Microsoft Office files to images and music. It then encrypts the first half of all files found, using a symmetric RSA encryption algorithm and a random key. The random, private key is then encrypted using a public key. “Without the private key from this key pair, it is not possible to obtain the symmetric key in order to decrypt the files,” said O Gorman.

To get the private key, the ransomware victim must forward the encrypted symmetric key to attackers, who decrypt and return it. Unfortunately, aside from restoring the encrypted files from a backup, “there is no way to bypass this technique,” he said.   Read More….

Microsoft Eyeing More Software For The iPad

The current rumor on the street is that Microsoft might be looking beyond the recently released OneNote for iPad. Insiders are saying Microsoft is closely monitoring the number of downloads of OneNote for iPad/iPhone/iPod Touch to perhaps gauge the possible interest in adding more productivity software for Apple iOS suite of products. Read More…..

« Previous Page