If you're running Windows Vista or Windows 7, there's a fairly nasty exploit running around related to the sidebar. Microsoft isn't even releasing a patch for it. Their fix is to just disable the sidebar completely. That functionality is being discontinued in Windows 8, which most likely factors into Microsoft's approach to this.
Microsoft has released a "Fix It Tool" that will disable the sidebar for you. Simply click on the applicable link to download the "enable" or "disable" installer (MSI file), and then run it. If you are responsible for multiple PCs, you can download the MSI file, put it on a USB drive or CD, and install it from there. It does NOT require an active internet connection to install.
I've already applied this on my work PC, and will be applying it on my home PCs this evening.
I'm not real thrilled about having to disable the sidebar. I've really liked some of the sidebar gadgets, like weather and calendar and Google and the like.
Also, I have no idea if this exploit applies to the Google sidebar, if you have that installed. As best I know, it only applies to the Windows sidebar. I also don't know if disabling the Windows sidebar has any impact on the Google one or not. I'm sure I'll find that out this evening, as I believe I'm running the Google sidebar on at least one machine.
Showing posts with label Computer Security. Show all posts
Showing posts with label Computer Security. Show all posts
Thursday, July 12, 2012
Thursday, December 8, 2011
Another day, another security fail
This time, it's at another Dutch digital certificate issuer, Gement.
According to the story, the hacker gained access to one of the web servers through the PHPMyAdmin module. It does not appear that any certificates were compromised, but it's this type of breach that is completely preventable.
When will companies learn that they have to be proactive about security. Put password policies in place, and enforce them, preferably systematically when possible. AUDIT to make sure they are being followed. Make sure you have someone that follows the bug and defect lists for your major components. Patches and fixes are constantly being released. There is absolutely no reason to be running HTTP, FTP, or SSL services with known vulnerabilities. That's just lazy and inexcusable.
Personally, if a company is running software or a configuration with widely known vulnerabilities, and have not made good faith efforts to mitigate (either by changing the config or patching the software) the problem, and customer information is compromised, they should absolutely be liable at law for the breach.
For the individual, don't just rely on the little lock symbol, or color-coding, or whatever other visual indicators your browser is giving you. You are also responsible for protecting yourself. Make sure that the URL is one you recognize, and where you mean to be. Make sure you have anti-virus software at a bare minimum. You should also strongly consider malware and adware software, and even a phishing filter. Most of these products are available as packages or suites, and there are some excellent free alternatives out there.
Oh, and you're regularly changing your passwords, right?
Oh, and you're not using the same password on multiple different systems, right?
Yeah, I know keeping up with all of your passwords is a pain, but there are password vaults and crypts available to help you manage that.
Trust me, keeping up with 50 passwords is less of a pain than dealing with 50 different compromised accounts all because you shared passwords amongst them.
According to the story, the hacker gained access to one of the web servers through the PHPMyAdmin module. It does not appear that any certificates were compromised, but it's this type of breach that is completely preventable.
When will companies learn that they have to be proactive about security. Put password policies in place, and enforce them, preferably systematically when possible. AUDIT to make sure they are being followed. Make sure you have someone that follows the bug and defect lists for your major components. Patches and fixes are constantly being released. There is absolutely no reason to be running HTTP, FTP, or SSL services with known vulnerabilities. That's just lazy and inexcusable.
Personally, if a company is running software or a configuration with widely known vulnerabilities, and have not made good faith efforts to mitigate (either by changing the config or patching the software) the problem, and customer information is compromised, they should absolutely be liable at law for the breach.
For the individual, don't just rely on the little lock symbol, or color-coding, or whatever other visual indicators your browser is giving you. You are also responsible for protecting yourself. Make sure that the URL is one you recognize, and where you mean to be. Make sure you have anti-virus software at a bare minimum. You should also strongly consider malware and adware software, and even a phishing filter. Most of these products are available as packages or suites, and there are some excellent free alternatives out there.
Oh, and you're regularly changing your passwords, right?
Oh, and you're not using the same password on multiple different systems, right?
Yeah, I know keeping up with all of your passwords is a pain, but there are password vaults and crypts available to help you manage that.
Trust me, keeping up with 50 passwords is less of a pain than dealing with 50 different compromised accounts all because you shared passwords amongst them.
Subscribe to:
Posts (Atom)