Adobe Flash

Adobe has released a Security Advisory for Adobe Flash Player to address

multiple vulnerabilities affecting the following software versions:

 

* Adobe Flash Player 11.1.102.63 and earlier versions for Windows,

Macintosh, Linux, and Solaris operating systems * Adobe Flash Player

11.1.111.7 and earlier versions for Android 3.x and 2.x * Adobe Air

3.1.0.4880 and earlier versions for Windows, Macintosh, and Android

 

Exploitation of these vulnerabilities may allow an attacker to cause a

denial-of-service condition or take control of the affected system.

 

Review Adobe Security Bulletin APSB12-07 and apply any necessary updates to mitigate the risk.

 

In addition, Adobe Flash Player 11.2 for Windows contains a background

updater that will allow future updates to be downloaded and installed

automatically. For more information please see the Adobe security

software engineering team blog post.

Posted on March 28, 2012 .

American Airlines Ticket Email

This one seems to still be doing the rounds.

Basically, and email pretending to be from American Airlines arrives telling you about either a refund, or a new ticket you have purchased.

If you click on the link, your PC will immediately be infected by a Trojan that is very difficult to remove.

So the best bet is to not be suckered in by curiosity!

There's a link here that we've not tested, but may help. Failing that, honestly, the best course of action after an infection is to wipe clean your hard drive, re-formatting, and do a fresh re-install of Windows.

However, you will lose ALL your data, so you must have had a good backup before doing this.

THREE RULES TO ALWAYS FOLLOW:

Backup all the data you wouldn't want to lose (documents, photos, music, videos etc)

Run a good anti-virus

NEVER click links in emails or social network sites

Good luck!

Posted on January 16, 2012 .

Linkedin Emails

We have received a growing number of emails pretending to be from Linkedin.

These look like Inbox messages, if you're a Linkedin user, but if you click on the link, it re-directs you to a suspicious site. It is not yet clear whether there are nasties downloaded to your computer, but the rule as ever: DO NOT CLICK LINKS IN EMAILS

Best of luck for your safety and security in 2012

Posted on January 16, 2012 .

Lulzsec email harvests

There's a cool little website that can check if your email address has been compromised.

It seems to be legitimate, so possibly worth checking out in light of all the recent security breaches by hackers.

Enter your password into the text box and click to see if it has been collected by hackers. If you're unliky enough to have had your email address hacked or harvested, change your password immediately.

https://shouldichangemypassword.com/

Posted on July 12, 2011 .

Dropbox Hack

If you're a Dropbox user, there was a bug on their servers a few weeks back, whereby for 4 hours on Sunday June 19th, anybody could log into anybody elses account with any password.

This was fixed very quickly, but worth going to dropbox.com/events and checking through your event log for that day to see if there's anything suspicious going on.

If there is, change your Dropbox password immediately for safety.

Posted on July 12, 2011 .

Facebook Goods Spam

There's a new email doing the rounds that appears to come from Facebook.

It's a very convincing email that asks the recipient to 'Get Started' using 'Facebook Goods'

Clicking any of the links within the email will take the recipient to an online Pharmacy page, and potentially download malware to your computer.

DON"T CLICK LINKS IN EMAILS

Posted on April 4, 2011 .

Dislike Facebook?

There's been plenty of media coverage about the fake Facebook 'Dislike' button.

It's a scam and is not from Facebook.

Do not use it. It will allow a rogue application access to your Facebook account and then send out spam.

"If you do give the app permission to run, it silently updates your Facebook status to promote the link that tricked you in the first place, thus spreading the message virally to your Facebook friends and online contacts," according to a blog post from Sophos' Graham Cluley. "But you still haven't at this point been given a "dislike" Facebook button, and the rogue application requires you to complete an online survey (which makes money for the scammers) before ultimately pointing you to a Firefox browser add-on for a Facebook dislike button developed by FaceMod."

Posted on August 17, 2010 .

Microsoft Security Update

Microsoft has just released an out of band update that addresses a vulnerability relating to icon files.

This vulnerability is fairly serious and thus users should update Windows as soon as possible.

Please go to Windows Update from the start menu, if your PC is not set to update automatically or click here for more information: (safe link)

http://www.microsoft.com/technet/security/bulletin/MS10-046.mspx

 

Posted on August 3, 2010 .

New Alliance & Leicester Phishing Email

We just received a new phishing email today allegedly from the Alliance & Leicester. The worrying thing about this email is that it mentions Trusteer rapport which is a legitimate browser security plug-in designed to work with online banking.

The scammers are clearly across this idea and have included what appears to be a link to download the security plug-in to make your browsing safer.

 

If you look at the tool tip for the link the mouse over generates, you can clearly see it's not legitimate. Chances are this would download some malware that would allow access to your computer without your knowledge.

Please always exercise caution when receiving emails. The best rule is NEVER trust an email from a bank until you have thoroughly checked it out.

NEVER CLICK LINKS IN EMAILS

 

Posted on July 31, 2010 .

New Windows Update

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Office, and Visual Basic for Applications as part of the Microsoft Security Bulletin Summary for May 2010. These vulnerabilities may allow an attacker to execute arbitrary code.

 

Posted on May 11, 2010 .

Apple Safari Vulnerability

A vulnerability affecting Apple Safari has just been discovered.

By tricking the user into opening a malicious web page, an attacker may be able to execute arbitrary code. Exploit code for this vulnerability is publicly available.

The only fix available as of now, until Apple offers a patch, is to disable Javascript under 'Preferences', 'Security'

The other option is to use Firefox 3.6 with the NoScript add-on, or Google Chrome. It is likely that Google Chrome is not affected by this vulnerability.

Posted on May 10, 2010 .

Alliance & Leicester Phishing Email

Here's another example of a phishing scam received via email.

First and foremost, the biggest clue is the 'Dear Valued Customer' bit.

The next clue, as is the case on almost all of these scams is the mass cc mailing list in the clear.

Finally, the give-away tooltip of the real URL. It looks ok at first glance, but notice the 139689.net bit at the end. That's the actual domain (which is clearly not A&L). Anything before that, i.e the A&L bit with dot whatever can be made up by anybody. It's the ending domain in the URL that is the actual domain it points to.

Hopefully this all helps to keep you alert and easily spot the scams.

Posted on May 7, 2010 .

1.5 Million Facebook ID's for sale

Researchers at VeriSign's iDefense group have discovered a hacker offering the login details of over 1.5 million Facebook accounts.

If they are all legitimate, that's equivalent to one in every 300 Facebook users. There's therefore a very good chance that one of those belongs to you.

This highlights how enormously important it is to regularly change your Facebook login password. It can be annoying to have to do that, and trying to remember a difficult password is after all, difficult.

But think of the consequences of not changing your password.

Also think about the ways in which your password might get stolen. The easiest way for a login thief is to target public computers or public wi-fi hotspots.

Don't ever login in to ANYTHING on a public computer in an internet cafe for example. That should be an absolute given, especially if it's logging in to a bank. Don't ever do that in public.

Next, if you can bear it, don't log into anything from a public wi-fi like a Starbucks or an airport, or anywhere where you have no idea who controls the network. If you have a 3G data plan, it's far safer to surf with that when logging in to sites, or if you want to use a free wi-fi, get yourself a VPN. That way all of your data is encrypted and nobody can intercept your data and capture your password. You can use these on a laptop or a mobile phone.

It's quite simple to use a password manager, which can not only generate very robust random passwords, but will remember them for you. The weak link in the chain being that the password you use to get into the password manager must be strong because it's the key to all your saved passwords. We like 1Password on the Mac which also syncs with the iPhone, but there are a number of solutions available. Pick a 'try before you buy' and give it a test drive to see if you like the way it works.

Net security is mostly about common sense. If you know the dangers, you'll be more aware.

 

Go ahead....change your password now

Posted on May 3, 2010 .

New Facebook Virus

There has been a lot of activity involving a Facebook hack whereby a user posts a link to a video.

The post looks like this:

"(Persons name) this is the hottest video ever! :P :P :P "

If the user clicks the link, it opens a video which will install a player in Windows and send out the same message to all your friends.

To remove it, change your Facebook password, and delete the app by going to go to Account > Application Settings and delete the HD Video Player. Also delete all the posts it made so that others don't click on it.

It seems as though this may be a vulnerability in the Facebook mobile app, which might allow a malicious interception of data.

If you click the link, you will be asked to download the “FLVDirect.exe“ file. If you do, your computer will become infected and post the message to your Facebook page.

We would also recommend that you download and install Microsoft's Windows Security Essentials, and run a scan.

As ever, we remind you to never click on links that people send in emails or post on social networking websites, especially if the language used doesn't fit the profile of the user that allegedly posted it.

 

Posted on May 2, 2010 .

Google Chrome Update

Google has released Chrome 4.1.249.1059 for Windows to address
multiple vulnerabilities. These vulnerabilities may allow an attacker
to execute arbitrary code, conduct cross-site scripting attacks, or
conduct cross-site request forgery attacks.

Please review the Google
Chrome Releases blog entry and update to Chrome 4.1.249.1059 for
Windows to help mitigate the risks.

Relevant Url(s):
http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html

Posted on April 21, 2010 .