Source In early October, Microsoft will be making the Microsoft Security Essentials suite free for small businesses (i.e., fewer than 10 computers) in addition to home users. This is a good thing – MSSE is a good suite of security tools, and the price tag is just right for individual and small business users. However, has anyone ever read the language in the EULA for the tool? The installer itself only checks that you have a genuine copy of Microsoft Windows before allowing the installation to proceed; there are no license keys or anything to deal with. The source article indicates that the types of business that will now be allowed to use MSSE for free already were using it[…]
Author: Walt Turnes
According to an article published last week, it is apparently possible to construct a signed PDF that can have its underlying data changed such that the signature is still valid, but the presentation of the data is changed. It’s a neat trick, but there are a few things that mitigate the risk inherent in the vulnerability: The signature has to be applied to a carefully crafted PDF file. A PDF file that you create and sign is unaffected by this attack; if you examine the data within the file, the presentation data for both the “recommendation” and “order” documents is present in both. Obviously, you will not be adding rogue data into your own PDFs before signing them. As stated[…]
Every year during the Black Hat conference, something crazy happens that makes me paranoid about things I use during my everyday life without really thinking too much about it. Last year, it was the MD5 Collision Attack that allowed the attackers to create a rogue Certification Authority. This year, it’s ATMs. A researcher by the name of Barnaby Jack developed his own custom rootkit for ATM machines that could be installed by dialing into the devices and exploiting the remote management software. This rootkit allowed him to make the machines dispense money on command, which, I’m reasonably sure, is not how they are intended to function. Lest you think this only allows the attacker to steal from the device and[…]
Details of this month’s Patch Tuesday updates here: http://www.microsoft.com/technet/security/bulletin/ms10-jul.mspx This month, we get a fairly light load of patches for Windows and Office, but there are a few remote code execution vulnerabilities that are addressed. So, if you run Windows and/or Office, apply these patches as soon as possible. If you’re running Windows XP or Windows Server 2003, you should address these patches post haste, as there is a code execution vulnerability affecting the Microsoft Help and Support Center that is currently being exploited in the wild. (http://www.microsoft.com/technet/security/bulletin/ms10-jul.mspx) Also, don’t forget to restart your system when the updates are finished installing – don’t be lazy like me and hit “postpone” too much!
Applications, specifically web applications, often rely on e-mail to send out error reports to administrators and developers. While e-mail can be somewhat unreliable in terms of delivering messages in a timely fashion, it is also insecure. If your application’s error reports contain identifying information about users or sensitive details about your code and what made it break, you should be delivering these messages using encrypted S/MIME e-mail. This tutorial will show how to send an encrypted message from a .NET application.
For a while now, CAPICOM has been declared deprecated by Microsoft, as it is only implemented in 32-bit, with no plans to roll out a 64-bit version. Microsoft’s Official Recommendation for replacing CAPICOM is to “use the .NET Framework to implement security features”. This is a fine solution for desktop applications, server-side code, web services, and a whole host of other applications. However, there doesn’t seem to be any equivalent support for the functionality the CAPICOM ActiveX control enables within a browser. The client platform Microsoft wants you to use to run client code in the Browser is Silverlight, a browser add-on similar to Flash or ActiveX. Silverlight uses many of the .NET APIs; however, the support for the System.Security.Cryptography.X509Certificates[…]