September, 2011:

The Mozilla foundation has released the latest version of Firefox 

http://isc.sans.org/diary/Firefox+v+7+0+1+Is+Live/11698

http://www.mozilla.org/en-US/firefox/new/

Trend Micro shares some excellent user safety tips and administrative design standards to help mitigate attacks.  One key practice is to close secure websites by logging out to keep sessions as short as possible.

BEAST and TLS/SSL Security: What It Means For Users and Web Admins
http://blog.trendmicro.com/beast-and-tlsssl-security-what-it-means-for-users-and-web-admins/
What can users do?

• Keep time spent on sensitive SSL sessions as short as possible. The attacker needs time to decode the encrypted message. If the session cookie is invalid before the attacker has finished, this attack fails.

• When leaving an SSL protected site, be sure to actually log out, not just move to a new site. In many cases, actively logging out will invalidate any cookie/session data that the attacker may have successfully decoded.

• Standard security best practices still work. For this attack to be successful, the attacker must have access to either your network or your computer. At the very least, up-to-date security software will make life harder for an attacker.
What can website administrators do?

• Make sure your logout button performs the expected action. You are leaving users at risk if your site does not actually invalidate session cookies when they click “log out”.

• Ensure that session cookies are tied to an IP address where the session was established. If that IP address changes, consider validating that the source of the requests is still your user. This will not prevent this attack, but it will make it harder to exploit your users.

• Resist the temptation to change SSL ciphers without carefully considering the risks first. While it is true that RC4 is not subject to this attack, it presents more risk than AES. Also, it isn’t a bad idea to keep an eye on the IETF TLS working group.  New versions of the TLS standard exist that eliminate the weaknesses used in this attack. Unfortunately HTTP server and browser coverage of these new standards is spotty at the moment at the moment. So you have to carefully consider both your environment and your user base before such a change.

TLS (Transport Layer Security) Working Group
http://datatracker.ietf.org/wg/tls/charter/

TLD4 is one of the most advanced Windows malware agents circulating.  It is highly stealth and hides in the master boot record of the Windows O/S.  Trend Micro shares developments related to a new version:

TDL4 Worm Component Employs Bitcoin Mining
http://blog.trendmicro.com/the-worm-tdl4-and-botcoin-miners/

QUOTE: TDL4 is a well known variant of the TDSS malware family known for evading detection by antivirus products by infecting affected systems’ boot sector. We’ve been monitoring developments related to TDSS, and earlier this year we saw TDL4 exhibit propagation routines through a worm component that Trend Micro detects as WORM_OTORUN.ASH.

This is an interesting development as a low-cost high technology tablet:

Amazon Unveils $199 Kindle Fire Tablet
http://www.bloomberg.com/news/2011-09-28/amazon-unveils-199-kindle-fire-tablet.html

QUOTE: The Kindle Fire will have a 7-inch display and sell for $199, compared with $499 for Apple’s cheapest iPad, Amazon executives said in interviews with Bloomberg Businessweek. The device, a souped-up version of the Kindle electronic-book reader, will run on Google Inc.’s Android software, the Seattle-based company said. Amazon also introduced a touch-screen version of its e-reader, to be called Kindle Touch.

F-Secure has developed a security product designed to integrate with Facebook and check for malicious links.

F-Secure ShareSafe Beta – Security Application for Facebook
http://www.f-secure.com/weblog/archives/00002243.html

QUOTE: Security applications and Facebook tend to mix together like oil and water.  Therefore, when attempting to develop a security application for Facebook… it had better not be boring. And that brings us to our new beta: F-Secure ShareSafe. The development team behind ShareSafe aims to build an entertaining Facebook app, with security benefits tagging along for the ride.

A total of 15 screenshots illustrate some of the initial features for this new operating system.

eWeek Microsoft’s Windows 8 Developer Preview: First Look
http://www.eweek.com/c/a/Enterprise-Applications/Microsofts-Windows-8-Developer-Preview-First-Look-432584/

QUOTE: Microsoft has offered its Developer Preview of its upcoming Windows 8 to the world. This early glimpse of the operating system, while nowhere near finished, offers a one-of-a-kind perspective into Microsoft’s thinking when it comes to the next generation of Windows. For one thing, the company also intends Windows 8 to make substantial inroads into the tablet category, currently dominated by Apple’s iPad—and it plans to do so by offering a touch-centric “Metro” interface that consists of colorful tiles linked to applications.

Early this morning, Windows Automatic Update notified me of a second MSRT update and below are the details.  Wishing them success in eradicating this malicious threat.

Microsoft MSRT – 2nd Release for September 2011
http://blogs.technet.com/b/mmpc/archive/2011/09/26/operation-b79-kelihos-and-additional-msrt-september-release.aspx

QUOTE: For the month of September, Microsoft is adding the Win32/Kelihos family to a second release of the Malicious Software Removal Tool. This additional release is to support the most recent action in Project MARS- Operation b79 which targets the Kelihos botnet. The Win32/Kelihos malware family distributes spam email messages that may contain links to web sites serving installers of Kelihos itself. It may also communicate with remote computers to exchange information that it uses to execute various tasks such as bootstrapping to the botnet, sending spam emails promoting bogus products or services, stealing sensitive information, or downloading and executing arbitrary files.

Microsoft killed Kelihos botnet
http://isc.sans.org/diary/Microsoft+killed+Kelihos+botnet/11644

QUOTE: Great news for Internet security. Microsoft has effectively killed off the Kelihos botnet which has about 42-45K nodes. The signature to remove the botnet agent from infected machine is added to the Malicious Software Removal Tool which will be rolled out to users taking automatic updates. Microsoft also took a proactive approach on the legal front, filing for court order to get Verisign (the domain registrar for the malicious domains) to take down the malicious domains related to the botnet operations.

Users with modern systems should be able to upgrade without needing more RAM or processor power, as noted below:

Windows 8 – No increased hardware requirements from version 7
http://www.pcmag.com/article2/0,2817,2386339,00.asp

QUOTE:  Microsoft says Windows 7 users won’t need bigger and better hardware to run the freshly unveiled Windows 8. The PC system requirements will be the same if not less than what’s needed to run Windows 7, although the new operating system definitely appears tailored for the touch-screen interfaces of tablets.  Speaking at a press event at Computex in Taiwan yesterday, Microsoft’s Michael Angiulo said, “Windows 8 will be able to run on a wide range of machines because it will have the same system requirements or lower” as Windows 7. Microsoft Windows President Steven Sinofsky reiterated the approach at the All Things D conference in California.

Users should avoid clicking on suspicious news alert links offered to them via Facebook:

Facebook – Fake BBC Video scams continue to surface
http://sunbeltblog.blogspot.com/2011/09/fake-bbc-video-facebook-scam-returns.html

QUOTE: It seems scammers have a bit of thing for spoofing BBC websites at the moment. Yesterday it was work from home scams, and last month it was a Facebook wheeze which (in a nutshell) went like this: “Lady Gaga is dead and here’s a BBC video to prove it, also click here.”  Maybe the (unrelated) work from home fakeout has inspired scammers into a fresh round of BBC shenanigans, because the phony BBC video rides again on Facebook. As usual, it’s surveytacular and is geared around fake Facebook messages promoting the completely fake BBC page

Please update systems as prompted for better protection from malicious attacks currently circulating:

Adobe Flash out-of-band security update for September 2011
http://blogs.adobe.com/psirt/2011/09/prenotification-security-update-for-flash-player.html
http://blog.trendmicro.com/adobe-releases-out-of-band-patch/

QUOTE:  Adobe released an out-of-band security update to address six critical vulnerabilities, all affecting Adobe Flash Player.  One of the six, a cross-site scripting vulnerability identified as CVE-2011-2444, is reportedly being exploited in the wild. The bug is reportedly being used in targeted attacks that involve malicious links sent out to targets through email messages.  Users are strongly advised to apply the patches as soon as possible, especially since exploiting any the addressed vulnerabilities can lead to either remote code execution, or information disclosure.

Note that users who utilize multiple browsers may need to update their other browsers separately. Users can visit this page through all their browsers to check if they have the latest version of Adobe Flash Player installed, and this page to update.