Is It Safe & Secure To Use Free Email Service?

If a government wants to peek into your Web-based e-mail account, it is surprisingly easy, most of the time not even requiring a judge’s approval

Ever wonder what Google has planned for all of the information it's collecting on its users? Well, their intentions may be completely irrelevant. As it turns out, Google has been compelled to give over their user data by law enforcement at an increasing and alarming rate.

In the second half of 2012, the tech giant received more than 21,000 requests for information, which represents a 70-percent increase over three years. The majority of the requests came from the federal government, who was hoping for a peek into users' email accounts. In most cases, the Feds didn't need a judge's okay.

Google is fighting back, trying to rally support against government access to personal data. In this professional's opinion, however, that's a bit ironic considering Google's own policies on collecting user information.

Just remember, anytime you are using a webmail site like Gmail for communication, understand your email is absolutely not protected and is not private.

Do not send sensitive information or conduct business using these types of free webmail services.

If you must use these sites, gather the emails through an off-cloud software system, like Microsoft Outlook. Then, configure your Outlook settings to delete the emails from Gmail, Yahoo, Hotmail or whatever cloud email service they are coming from, as soon as Outlook downloads them.

How to crack/reset your Windows account?

Have you lost or forgotten your Windows password?

It's one of the security best practice to enable password on your Windows user account to ensure you have adequate protection from malicious access to your personal files. 

It is a common practice to forget your computer password if you're not using it for a while or perhaps just returned from holidays. Unfortunately, currently Windows operating systems doesn't have an option to reset your password like we commonly see in web applications such as Facebook, Hotmail etc.

In the majority of the cases, I have seen users have to format and reinstall the Windows to access their computer again but unfortunately they have to sacrifice  loss of their personal data if they haven't backed-up.

So what to do? How to crack/reset the password of the Windows operating system?

I recently come across this nice password resetter tool "Password Resetter", which cracks windows password in minutes without affecting your personal data.

As stated on their website that it can recover 99,9% of passwords from nearly any Windows installation in a matter of seconds! You do not need to remember old passwords in order to crack your Windows password.

Password Resetter recovers the lost Windows administrator or user password from any Windows Operation System. It supports Windows Vista, XP, NT, 2000 and the newest Windows 7.

How to use Password Resetter?

1) Download a copy of Password Resetter.

2) Burn the image on CD/DVD. The package comes with the detailed tutorial.

3) Once the bootable CD/DVD is ready, boot the system with this CD/DVD. Select the user account and then click on reset button.

Another cool feature?

It supports USB, which means you can crack/reset your Windows password with USB drives in case you do not have CD/DVD.  

This is not a freeware, you will need to purchase this software for around $35 for personal use.

10 Crazy IT Security Tricks That Actually Work

IT security threats are constantly evolving. It's time for IT security pros to get ingenious


Network and endpoint security may not strike you as the first place to scratch an experimental itch. After all, protecting the company's systems and data should call into question any action that may introduce risk.


But IT security threats constantly evolve, and sometimes you have to think outside the box to keep ahead of the more ingenious evildoers. And sometimes you have to get a little crazy.


10 security ideas that have been -- and in many cases still are -- shunned as too offbeat to work but that function quite effectively in helping secure the company's IT assets.


The companies employing these methods don't care about arguing or placating the naysayers. They see the results and know these methods work, and they work well.


Innovative security technique No. 1: Renaming admins


Renaming privileged accounts to something less obvious than "administrator" is often slammed as a wasteful, "security by obscurity" defense. However, this simple security strategy works. If the attacker hasn't already made it inside your network or host, there's little reason to believe they'll be able to readily discern the new names for your privileged accounts.


If they don't know the names, they can't mount a successful password-guessing campaign against them. Even bigger bonus? Never in the history of automated malware -- the campaigns usually mounted against workstations and servers -- has an attack attempted to use anything but built-in account names. By renaming your privileged accounts, you defeat hackers and malware in one step. Plus, it's easier to monitor and alert on log-on attempts to the original privileged account names when they're no longer in use.


Innovative security technique No. 2: Getting rid of admins


Another recommendation is to get rid of all wholesale privileged accounts: administrator, domain admin, enterprise admin, and every other account and group that has built-in, widespread, privileged permissions by default.


True, Windows still allows you to create an alternate Administrator account, but today's most aggressive computer security defenders recommend getting rid of all built-in privileged accounts, at least full-time. Still, many network admins see this as going a step too far, an overly draconian measure that won't work. Well, at least one Fortune 100 company has eliminated all built-in privileged accounts, and it's working great.


The company presents no evidence of having been compromised by an APT (advanced persistent threat). And nobody is complaining about the lack of privileged access, either on the user side or from IT. Why would they? They aren't getting hacked.


Innovative security technique No. 3: Honeypots


Modern computer honeypots have been around since the days of Clifford Stoll's "The Cuckoo's Egg," and they still don't aren't as respected or as widely adopted as they deserve. A honeypot is any computer asset that is set up solely to be attacked. Honeypots have no production value.


They sit and wait, and they are monitored. When a hacker or malware touches them, they send an alert to an admin so that the touch can be investigated. They provide low noise and high value. The shops that use honeypots get notified quickly of active attacks. In fact, nothing beats a honeypot for early warning -- except for a bunch of honeypots, called a honeynet.


Innovative security technique No. 4: Using nondefault ports


Another technique for minimizing security risk is to install services on nondefault ports. Like renaming privileged accounts, this security-by-obscurity tactic goes gangbusters. When zero-day, remote buffer overflow threats become weaponized by worms, computer viruses, and so on, they always -- and only -- go for the default ports.


This is the case for SQL injection surfers, HTTP worms, SSH discoverers, and any other common remote advertising port. Recently Symantec's pcAnywhere and Microsoft's Remote Desktop Protocol suffered remote exploits. When these exploits became weaponized, it was a race against the clock for defenders to apply patches or block the ports before the worms could arrive. If either service had been running on a nondefault port, the race wouldn't even begin.


That's because in the history of automated malware, malware has only ever tried the default port.


Innovative security technique No. 5: Installing to custom directories


Another security-by-obscurity defense is to install applications to nondefault directories. This one doesn't work as well as it used to, given that most attacks happen at the application file level today, but it still has value.


Like the previous security-by-obscurity recommendations, installing applications to custom directories reduces risk -- automated malware almost never looks anywhere but the default directories. If malware is able to exploit your system or application, it will try to manipulate the system or application by looking for default directories. Install your OS or application to a nonstandard directory and you screw up its coding.


Changing default folders doesn't have as much bang for the buck as the other techniques mentioned here, but it fools a ton of malware, and that means reduced risk.


Innovative security technique No. 6: Tarpits 


Today, many networks (and honeypots) have tarpit functionality, which answers for any nonvalid connection attempt. The only downside: Tarpits can cause problems with legitimate services if the tarpits answer prematurely because the legitimate server responded slowly. Remember to fine-tune the tarpit to avoid these false positives and enjoy the benefits.


Innovative security technique No. 7: Network traffic flow analysis


With foreign hackers abounding, one of the best ways to discover massive data theft is through network traffic flow analysis. Free and commercial software is available to map your network flows and establish baselines for what should be going where. That way, if you see hundreds of gigabytes of data suddenly and unexpectedly heading offshore, you can investigate.


Most of the APT attacks I've investigated would have been recognized months earlier if the victim had an idea of what data should have been going where and when.


Innovative security technique No. 8: Screensavers


Password-protected screensavers are a simple technique for minimizing security risk. If the computing device is idle for too long, a screensaver requiring a password kicks in. Long criticized by users who considered them nuisances to their legitimate work, they're now a staple on every computing device, from laptops to slates to mobile phones.


Innovative security technique No. 9: Disabling Internet browsing on servers


Most computer risk is incurred by users' actions on the Internet. Organizations that disable Internet browsing or all Internet access on servers that don't need the connections significantly reduce that server's risk to maliciousness. You don't want bored admins picking up their email and posting to social networking sites while they're waiting for a patch to download.


Instead, block what isn't needed. For companies using Windows servers, consider disabling UAC (User Account Control) because the risk to the desktop that UAC minimizes isn't there. UAC can cause some security issues, so disabling it while maintaining strong security is a boon for many organizations.


Innovative security technique No. 10: Security-minded development


Any organization producing custom code should integrate security practices into its development process -- ensuring that code security will be reviewed and built in from day one in any coding project. Doing so absolutely will reduce the risk of exploitation in your environment.


This practice, sometimes known as SDL (Security Development Lifecycle), differs from educator to educator, but often includes the following tenets: use of secure programming languages; avoidance of knowingly insecure programming functions; code review; penetration testing; and a laundry list of other best practices aimed at reducing the likelihood of producing security bug-ridden code.


Microsoft, for one, has been able to significantly reduce the number of security bugs in every shipping product since instituting SDL. It offers lessons learned, free tools, and guidance at its SDL website.


This story, "10 crazy IT security tricks that actually work," was originally published at InfoWorld.com.

Password-Strength Checker

Check your password—is it strong?


Learn how to use the Password Strength Calculator to test the strength of your password security. Online password strength checker for secure passwords from Microsoft.


What is a strong password?


The strength of a password depends on the different types of characters that you use, the overall length of the password, and whether the password can be found in a dictionary. It should be 8 or more characters long.


For tips about how to create passwords that are easy for you to remember but difficult for others to guess, read Create strong passwords.


Refer here.

Top 15 Paying IT Certifications According to Global Knowledge Training

Certifications are good for marketing and a necessary evil, but certainly not the be all/end all!


Global Knowledge Training LLC published a white paper outlining the top 15 paying IT certifications for 2012 based upon a survey they conduct annually. In the white paper, they don’t specify how they selected their sample for the survey; however they do maintain that the certifications and associated salaries were included only if there were at least 200 responses for that particular certification in the survey.


As such (and as the author points out), some certifications that do not have a large population in the work force (or that are more exclusive) may be inadvertently – and obviously – missing from this list (e.g., CCIE, VCDX, or OCSP).


Here are the results from the survey:


PMP - Project Management Professional $111,209
CISSP – Certified Information System Security Professional $110,342
CCDA – Cisco Certified Design Associate $101,915
ITIL v3 Foundation $97,691
MCSE – Microsoft Certified Systems Engineer $91,650
VCP – Vmware Certified Professional $91,648
CCNP – Cisco Certified Network Professional $90,457
CompTIA Server+ $84,997
MCITP – Microsoft Certified IT Professional $84,330
CCNA – Cisco Certified Network Associate $82,923
MCSA – Microsoft Certified Systems Administrator $82,923
CompTIA Security+ $80,066
MCP – Microsoft Certified Professional $79,363
CCENT – Cisco Certified Entry Network Technician $74,764
CompTIA Network+ $71,207


These results are based on US job market but you can use these figures as a benchmark or if you already have above certification, you can campre your salary with the US market.


MyCPEs.com is a free online tool built to help certified professionals manage and track their continuing education. Sign up for a free account now.

Researchers Unveil Flaws in Skype

Pilfering Personal Identifiable Information (PII) via Skype

It's so easy that a child could uncover personally identifiable information of millions upon millions of Internet phone users, if the child is a sophisticated, high-school-age hacker.

That's how researchers from the Polytechnic Institute of New York University describe an easily exploitable flaw in Skype and other IP-based phone systems that could potentially disclose the identifies, locations and digital files of hundreds of millions of users, according to a new paper, "I Know Where You are and What You are Sharing."

A hacker anywhere in the world could easily track the whereabouts and file-sharing habits of a Skype user and use the information for purposes of stalking, blackmail or fraud.

"A hacker anywhere in the world could easily track the whereabouts and file-sharing habits of a Skype user - from private citizens to celebrities and politicians - and use the information for purposes of stalking, blackmail or fraud," Keith Ross, an NYU-Poly computer science professor who headed the research team, says in a statement issued by the school.

The flaw, for instance, could allow marketers to link effortlessly information such as name, age, address, profession and employer from social media sites such as Facebook and Linkedin in order to build inexpensive profiles, costing them pennies for each individual profile, a bargain.

Though researchers studied only Skype, they say their findings also apply to other IP-based phone systems. Their findings will be presented next month at the Internet Measurement Conference 2011 in Berlin.

Using commercial geo-location mapping services, researchers found they could construct a detailed account of a user's daily activities even if the user had not turned on Skype for 72 hours. Skype and its new owner Microsoft were informed of the researchers' findings. Skype's response wasn't clear on specific steps it has taken to address the vulnerabilities the researchers discovered.

The researchers, however, contend there's a fairly straightforward and inexpensive fix to prevent hackers from taking the critical first step in this security breach, that of obtaining users' IP addresses through inconspicuous calling. By redesigning the Skype protocol, a user's IP address would never be revealed unless the call is accepted. That, researchers say, would offer substantially greater privacy.

Hospital Networks are the next big target for hackers?

Medical Device Security in a Hospital Network

Medical devices are everywhere today. In your doctors office measuring your blood pressure, at your cosmetician (for hip reductio) and in the hospital for everything from patient monitoring to robot-assisted surgery.

The people that develop embedded medical devices based on Intel platforms know that Windows is vulnerable.

Lacking embedded Linux know-how, medical device developers often end up adopting Windows and Visual Studio as a default. Using Windows is a security-blanked for developers who grew up the Microsoft monoculture and are scared of the Linux command line.

But – make no mistake using Windows in networked embedded medical devices is a mistake.

This is big mistake #1.

The top 2 threats to a medical device are software defects and software updates. Consider the implications of updating patient monitoring devices in a hospital with an infected USB stick or an infected Windows notebook.

In product development (and medical device are no exception), the support and version update process is often something left for the end of the project. At that point, when the product manager asks how are we going to update the software in the field – the hands raise in favor of USB memory stick updates as an “interim” solution.

It is crucial to use threat analysis on systems of networked medical devices in order to arrive at the right, cost-effective countermeasures (apropos the management challenge of large number of VLANS…). Threat analysis must be an integral part of the SDLC (software development life cycle) – done early in the process and validated from time to time whenever there are significant design, configuration or environmental changes.

Threat analysis enables a medical device vendor and the hospital security team to have an objective discussion on balancing the need to protect the hospital network asset with protecting the availability of the medical device itself and concomitantly – the safety of patients that are dependent on the device – patient monitoring is the first example that comes to mind.

Unfortunately many device vendors and their hospital customers use a system management model based on Microsoft Windows and business IT management practices. This is big mistake #2.

Medical device vendors need to assess their software security and not assume that an embedded medical device running Windows XP is no different from any other Windows PC on the network running Office 2007.

To use an analogy from the world of real time embedded systems – consider avionics as key to safety of the pilot and success of the mission. Avionics are not managed like a network of Windows PCs and neither should medical devices on the hospital network.

A medical device in a hospital network – whether it monitors patients, assists in surgery or analyzes EEGs – is an embedded device in a extremely heterogeneous and hostile environment that should simply not be vulnerable to Microsoft Windows malware.

Embedded medical devices should be based in embedded Linux – and not a stock version of Red Hat – but rather built ground up from the latest Linux kernel, with the minimum set of services and software (Qtk etc…) needed to run the application. The software update process should be part of the design – not something bolted on after the implementation.

Developing for embedded Linux is not copy and paste from Windows. It requires expertise to setup the basic infrastructure. But – once that infrastructure is up, the medical device developer and it’s hospital customer can be confident that they are standing on a secure platform and not a house of glass built on a foundation of sand.

Microsoft just want to say Happy Birthday!

Microsoft and Linux?

Microsoft has sent a Happy Birthday message to the Linux Foundation, congratulating them on turning 20 years old. The video, created by the Microsoft Germany team and shared on the Linux video site, documents the past twenty years of sniping and rivalry between the two platforms, though suggests that the end for such arguments might be in sight.

Titled “Microsoft vs. Linux” the video shows a cartoon penguin and a geeky looking guy who may well be Bill Gates as they struggle to understand each other. Linux ideas “seemed too childish to Microsoft” the video suggests, as Tux rows across the internet seas and Microsoft watches in blissful ignorance from the shore.

Microsoft BitLocker Administration and Monitoring (MBAM)

Enterprise solution which streamlines management

According to Microsoft, organizations around the world rely on BitLocker Drive Encryption and BitLocker To Go to protect data on Windows 7 PCs and portable storage devices. To make large-scale BitLocker implementations easier to manage, enterprises turn to Microsoft® BitLocker® Administration and Monitoring (MBAM).

Microsoft BitLocker Administration and Monitoring, enhances BitLocker by simplifying deployment and key recovery, centralizing provisioning, monitoring and reporting of encryption status for fixed and removable drives, and minimizing support costs.

Simplify BitLocker provisioning and deployment

Microsoft BitLocker Administration and Monitoring can provision BitLocker as part of your Windows 7 upgrade or configure BitLocker deployment to take place after the operating system is installed. Using the additional Group Policy controls in MBAM, it is easier for IT to provision BitLocker specific to their business needs. The controls are checked regularly at intervals set by an IT administrator and any changes are immediately infused.

Additionally, the hardware-blocking feature can be used to identify BitLocker-capable computers and exclude specific hardware that you don’t want encrypted.

Improve compliance

With out-of-box reports that detail compliance with corporate-defined BitLocker policies can get a better view of your compliance status for the organization or individual devices, and easily determine if lost or stolen devices were encrypted. IT staff can also create custom compliance reports using built-in SQL Server Reporting Services tools to show them just the information that they need to see.

MBAM also provides the ability to store BitLocker recovery keys in an encrypted database with granular access controls and creates an audit trail of who has accessed recovery key information, keeping this information protected and only accessible to the right people in the organization.

Reduce support costs
By reducing the burden on IT staff and making it easier for them to support end users, MBAM helps to reduce the support costs and gets the end users up and running quickly if a problem arises.

With a secure, web-based key recovery portal, it is easy for authorized help-desk staff to support end users if they need to recover their BitLocker enabled machine. By automating pre-BitLocker setup steps and making it easy for end users to perform basic tasks such as starting the encryption process and managing their BitLocker PIN—without providing users with administrator rights.

MBAM will be available in Q3 2011 and a beta version of Microsoft BitLocker Administration and Monitoring is now available for download here (Windows Live ID required).

Top free Firewalls for Windows

Looking for a top free firewall for Windows 7?

Here you find top free firewalls for Windows 7 including, but not limited to, the Windows 7 built-in firewall. There used to be much more free firewalls software for Windows until Microsoft built in a firewall in its Windows XP operating system. That Windows integrated firewall has been beefed up in Windows Vista and further improved in Windows 7.

Free firewall for Windows 7

• Ashampoo FireWall
• Comodo Firewall
• Online Armor Firewall
• Outpost Firewall
• PC Tools Firewall Plus
• Sunbelt Personal Firewall Version
• VirusBuster Internet Security Suite
• Windows 7 Firewall Control
• ZoneAlarm Basic Firewall

References

Comodo Internet Security - http://personalfirewall.comodo.com/

Online Armor Free - http://www.online-armor.com/products-online-armor-free.php

Outpost Security Suite - http://free.agnitum.com/

PC Tools Firewall Plus Free Edition - http://www.pctools.com/firewall/

VirusBuster Internet Security Suite - http://www.virusbuster.hu/en/products/home-users/vb-internet-security-suite#rendszerkovetelmeny

ZoneAlarm Free Firewall - http://www.zonealarm.com/security/en-us/zonealarm-pc-security-free-firewall.htm

Microsoft Security Essentials

Doesn’t get in the way of PC performance

As a Information Security professional, I often get this question: Which is the good anti-virus? Which one i should use?

Here is my pick out of the bunch of anti-viruses software available in the market.

Microsoft Security Essentials doesn’t carry the weight of suite products and has a much smaller download size. Scans and updates are scheduled to run when the PC is idle and use a low-priority thread. CPU throttling ensures that no more than 50 percent of the CPU is utilized by Microsoft Security Essentials activity, so that your system continues to perform those tasks you are likely to be performing, such as opening files or browser windows, saving files, and using cut, copy, and paste.

Microsoft Security Essentials uses smart caching and active memory swapping so signatures that are not in use are not taking up space, thus limiting the amount of memory used even as the volume of known malware continues to increase. This makes Microsoft Security Essentials friendlier toward older PCs, as well as today’s smaller, less powerful form factors such as netbooks.

Please refer here for further details.

Anti-Virus Software - To buy or not to buy?

Free anti-virus software does the job!

To buy or not to buy? That is the question. When it comes to anti-virus software for your computer, most experts agree you need it if you have the Windows operating system and often go online, where dangers lurk.

But name-brand software could set you back $40 to $70 or more a year. Alternatively, some excellent products are available for free. What's a prudent consumer to do?

The short answer is that if you refuse to pay for computer protection software, at least use a free product in lieu of nothing. On that, experts agree. Beyond that, it's difficult to generalize with so many products available. But the difference basically comes down to this: Free software will help you discover a problem, such as a virus, and deal with it.

Paid software has more features that might help keep you from getting a problem in the first place, especially if you're inexperienced online or visit risky websites. Here are some considerations.

Free software

Popular free products include Avira AntiVir Personal, AVG Anti-virus Free Edition, Avast! Free Antivirus and Microsoft's own Security Essentials. Be aware that the many free products, while good at what they do, are essentially a marketing tool to persuade you to buy the same brand's paid version. Microsoft is an exception. It has no upsell.

Some reviewers claim the free anti-virus software might be all you need. Consumer Reports, for example, says that free products are "fine for most people."

Paid software

Experts are quick to point out that you are likely to get broader protection and functionality using security software that you pay for. The free-versus-paid discussion is "an artificial wall," said Dan Nadir, senior director of product management for Norton security software, a paid product. "There is this perception you can get an apples-to-apples free version with a free product; it's not true," he said. "I think the way users should think about this is that if you're going online, you should get a paid product - even the free guys have paid products."

On their websites, many of the free products have charts showing how their paid products have more features that keep you safe online, while banking and shopping, for example.
Nadir conceded that free products do an excellent job of detecting viruses and removing them. "Everyone can do well on these static virus-scanning tests," he said. The value of a paid product is the "real world" protection offered by smarter software that can sniff out a threat even if it's never been told specifically about the threat - all without falsely alarming users, Nadir said.

Examples of features you might get with a paid product that you don't get with a free one are a firewall, parental controls, spam controls and browser toolbars to prevent phishing, scams meant to lure people into releasing sensitive information. Individual free products do many of those things, but a paid software suite gives you a common program to control everything.

Paid software also gives you technical support by phone, which free products generally won't offer. And some paid suites offer a backup function for your files. "Those are extras that are not critical, but are minor to moderate pluses," Reynolds said.

PCWorld magazine, using a recognized security testing company, recently rated highly Symantec Norton Internet Security 2011, which got top billing in many other reviews too. Kaspersky Internet Security 2011 and BitDefender Internet Security 2011 also rated highly.

For technical comparisons, check online at av-test.org and av-comparatives.org.

So, paid or free? PCWorld puts it this way: "With some exceptions, you get better customer support and more comprehensive security features with a paid product, but if you're willing to forgo these, it's definitely worth considering going free."

Windows UAC Malware Threat

The exploit allows an attacker to impersonate the system account

A new zero-day attack against Windows, capable of bypassing the User Access Control (UAC) protections introduced in Windows Vista and designed to prevent malware from gaining administrative access without user authorisation, has been discovered in the wild.

The proof-of-concept implementation of the infection technique, known as Troj/EUDPoC-A, was posted to a Chinese educational forum before being discovered by anti-virus researchers from various security firms.

Chester Weisniewski, of anti-virus vendor Sophos, warns that the technique used by the Trojan enables an attacker to impersonate the system account, which has nearly unlimited access to all components of the Windows system, and does so without triggering the User Access Control protections introduced by Microsoft to prevent exactly that occurring. The flaw currently exists in all versions of Windows.

Pls ensure your system is up to date with latest patches and your anti-virus with latest virus definitions.

Problems associated with elevated privileges

Least Privilege Security for Windows 7, Vista, and XP - Security

Russell Smith, renowned Windows security expert, discussed how adhering to the principle of least privilege can benefit the security of your environment, including reducing support incidents and improving user productivity. To attend the webinar, register for one of the following dates:

Least Privilege Security for Windows 7, Vista, and XP: Tuesday, November 2, 2010, 9:00 a.m. - 10:00 a.m. PDT

Least Privilege Security for Windows 7, Vista, and XP: Wednesday, December 1, 2010, 8:00 a.m. - 9:00 a.m. PST

In the webinar, Russell notes that running administrator-level privileges on desktop PCs increases total cost of ownership (TCO) by 36.3%. He also discusses the fact that although users tend to view security as restrictive, enforcing proper security measures actually benefits users because it helps meet their expectations for speed, reliability, and productivity.

Problems associated with elevated privileges include the following:

• Malware—The more users running with elevated privileges, the greater the risk of infection.
• Data leakage—Having more users with elevated privileges increases the chance of data loss.
• Help desk costs—Giving users the right to change system configuration can lead to problems.
• Unlicensed software—Users with admin privileges can install personal software, as well as unwittingly infect their systems by running fake antivirus software.
• System/network slowdowns—Problems that users create on their own systems affect not only those systems but also the network.
• Elevated privileges allow users to circumvent the management controls that are designed to protect systems and networks.

Microsoft Security Intelligence Report - Volume 9

Most attackers use social engineering techniques to trick you into installing malware

US leads the world in numbers of Windows PC’s that are part of botnet. More than 2.2 million US PCs were found to be part of botnet. Brazil had the second highest level of infections at 550,000.

Infections were highest in South Korea where 14.6 out of every 1000 machines were found to be enrolled in botnets

Key Findings Current Threat Overview

The Microsoft Security Intelligence Report (SIR) is a comprehensive evaluation of the evolving threat landscape and trends. The information can help you make sound risk-management decisions and identify potential adjustments to your security posture. Data is received from more than 600 million systems worldwide and internet services.

Volume 9 of the Security Intelligence Report covers the first half of 2010 (January 1 - June 30)
and is divided into five sections:

• Featured Intelligence for Volume 9 focuses on botnets and how to combat the threat.
• Key Findings reveals data and trends analysis captured by Microsoft security analysts.
• Reference Guide provides definitions for discussion points covered in the Key Findings.
• Managing Risk recommends techniques to protect your organization, software, and people.
• Global Threat Assessment looks at botnet and malware infection rates worldwide.

TOP FINDINGS

• Infection rates for Windows 7 are lower than its desktop predecessors.
• Most attackers use social engineering techniques to trick you into installing malware.
• Stolen equipment remains the most frequent type of security breach incident.

Please refer here to download the report.

Internet Explorer 9 to launch to public on 15 September

IE9 will run on Windows XP


Microsoft yesterday updated its bare-bones preview of Microsoft Internet Explorer 9 (IE9) for the last time, saying that the next release would be a beta build.

Although Microsoft hasn't named a release date for IE9's beta, the six-to-eight week stretch between each Platform Preview may provide a clue: If the company sticks to the same gap between the fourth preview and the beta, the latter should show on or after September 15 - confirming previous messages from Microsoft.


In IE9 Platform Preview 4, Microsoft has integrated its new JavaScript engine into the browser, finished its work on hardware acceleration and boosted performance in several areas, including the Acid3 test, said the IE team's leader.

"The IE9 platform is nearly complete," said Dean Hachamovitch, general manager of IE, in a detailed post on the browser's blog Wednesday.


Unlike production versions, the IE9 preview can run alongside other editions, such as IE7 on Vista or IE8 on Windows 7. However, neither the Platform Preview nor the final version of IE9 will run on Windows XP, a sticking point with some users of that nine-year-old operating system.


Refer here for details.

Inside Mozilla's Firefox 4 Security

Content Security Policy (CSP) system will help to mitigate clickjacking

Open source browser vendor Mozilla is readying an ambitious new release of its Firefox Web browser. The third beta of Firefox 4, set to debut sometime this month, is expected to include more stability, features and performance improvements over earlier versions.

Among the areas that Mozilla is focusing on with Firefox 4 are a number of new security features that it says will make the browser even more secure than earlier versions. The new Firefox 4 browser development comes as rival Microsoft pushes its Internet Explorer 9 platform forward and Google continues to accelerate its Chrome browser development.

One of the new security features in Firefox 4 is the Content Security Policy (CSP) effort.

"Content security policy is focused on Cross Site Scripting (XSS) mitigation so it prevents injected scripts from actually running," Brandon Sterne, security program manager at Mozilla, toldInternetNews.com. "The site gets to declare a policy that the Firefox browser will then apply to the page and then any content that hasn't been blessed by the site won't be loaded or executed."

Refer here to read more details.

Unpatched kernel-level vuln affects all Windows versions

No reports of the vulnerability being exploited in the wild

Researchers have identified a kernel-level vulnerability in Windows that allows attackers to gain escalated privileges and may also allow them to remotely execute malicious code. All versions of the Microsoft OS are affected, including the heavily fortified Windows 7.

The buffer overflow, which was originally reported here, can be exploited to escalate privileges or crash vulnerable machines, IT research company Vupen said. The flaw may also allow attackers to execute arbitrary code with kernel privileges.

The bug resides in the “CreateDIBPalette()” function of a device driver known as “Win32k.sys.” It is exploited by pasting a large number of color values into an improperly allocated buffer, potentially allowing attackers to sneak in malicious payloads, vulnerability tracking service Secunia warned.


Refer here to read more details.

Vulnerability Discovered in Patched Windows 2000, XP

PowerZip version 7.2 Build 4010 has been identified as an attack medium for the vulnerability's exploitation

Secunia, an Internet security company, reports that another critical flaw has been found in Microsoft Windows. This time the flaw discovered in wholly patched Windows XP and Windows 2000, which hackers could exploit to execute harmful assaults.

Marking the flaw with a "moderately critical" label, Secunia says that it is due to a boundary error within the CFrameWnd class's "UpdateFrameTitleForDocument()" feature inside mfc42.dll. Moreover, the flaw helped in the creation of a heap overflow by passing of a very lengthy string of title to the attack prone feature.

If exploited, the flaw is capable of letting attackers execute malware assaults. The assaults helped in compromising end-users' PCs and grabbing sensitive data via social engineering tactics. Secunia disclosed that the flaw surely existed within wholly patched Windows XP SP2/SP3 and Windows 2000 Professional SP4 versions.

Since a patch isn't yet available to plug the hole, Secunia advises not to access software that allow the passage of user-regulated input onto the attack prone feature.

Notably, Microsoft states that it knows about the security flaw and is working to fix it.

Microsoft Security Bulletin MS10-042 - Critical

25,000 PCs Affected By Microsoft Zero-Day Vulnerability

Hackers have attacked 25,000 PCs affected by the Windows Help and Support Center zero-day vulnerability, patched yesterday. According to a post on the Microsoft Malware Protection Centre (MMPC) blog, the attacks on infected systems accelerated significantly after the company announced that it would be patching the vulnerability in this month's MS10-042 bulletin.

Writing on the MMPC blog, Holly Stewart wrote: “Early on, we saw attackers incorporate code to single out Windows XP targets, but more recently the attackers have been less discriminant, attempting this attack on a variety of operating systems.”

She said that the hackers had primarily targeted computers in Portugal and Russia, but that the UK had seen the most number of increased attacks on computer systems running Windows XP.

"Although Portugal has remained one of the most targeted areas, attacks on Russian systems have surpassed it over the past few weeks.  Russia has now seen more than ten times the number of attack attempts per computer in comparison to the global average." she wrote

"The UK, in particular, was one of the regions in which we witnessed a surge in attack attempts over this past weekend."