TechBlog

Don’t run your PC with admin privileges Sometimes in life you know something is a risk, but you don’t know how BIG a risk it is until somebody actually checks it out. There was a German scientist in Russia who repeated Ben Franklin’s kite-in-the-thunder-storm experiment but didn’t live to write up his results. Los Angeles security firm BeyondTrust has released an analysis of Microsoft’s 75 security bulletins last year. They came to the startling conclusion that if users had operated their computers without administrative rights they would have eliminated 64 percent of their risk from Microsoft vulnerabilities! ...

The most popular social bookmarking site ‘StumbleUpon’ has just released its free app for Apple iPad. iPad is ready to be officially launched tomorrow i.e. April 3, 2010. A collection of few good apps for iPad can now be seen on iTunes App store. StumbleUpon iPad app helps you discover and share great websites. As you click Stumble!, we deliver high-quality pages matched to your personal preferences. These pages have been explicitly recommended by your friends or one of 8 million+ other web surfers with interests similar to you. ...

Games are big on the iPhone — the majority of apps on the App Store are games, and games are regularly among the top-selling paid and free apps. With the iPad, Apple’s new, and larger, touch-screen device, gaming on Apple’s mobile devices is poised to get even bigger (pardon the pun). But even with the touch screen and accelerometer inputs, some games just need more traditional controls, like those offered by joysticks or D-pads, those four-direction paddles on many video game controllers. ...

Mozilla.org has made public a report that says its Firefox browser has 30 percent market share worldwide. Assuming it’s true, that is a six percent increase since a news story last November. The Mozilla Metrics report 1Q2010 says the browser has 39.2 percent penetration in Europe (152.7 million users) and 29 percent in the U.S. (100 million users.) Mozilla claims 350 million users worldwide. Adoption is quickest in Russia (20 percent increase in the first quarter) the report said. ...

Whole Foods, a popular health and organic grocery chain, is the subject of a new Facebook scam that phishes for users’ credit and other personal information. A deluge of fraudulent Facebook Pages are popping up that promise a limited number of users Whole Foods gift cards. These Pages are accruing thousands of fans and siphoning off sensitive and lucrative data. The groups offering Whole Foods gift cards are in no way affiliated with the supermarket; rather, con artists are using the Pages to uncover important personal and financial information from users via a bogus credit assessment. After giving the requested information, users watch their computers crash as their identities are completely exposed. ...

Good God! A 419 scam email from someone in grade school! From: FBI AGENT [mailto:hal-eduserv@att.net] Sent: Wednesday, March 31, 2010 7:34 AM Subject: FBI AGENT Hello honest people……… We got your contact from our Microsoft data-base system. This is to inform you all that have lost money to Scammers in Africa, Europe and USA. We hear by inform you there is quick opportunity for you mostly on lottery. My name is FBI brad Martins I assure you am doing all I can to get your lost money back in 2 days . I know what scam means. I work with the global scam Fither in CA 93535.we have all the global scam computer to trace all Scammers Name and location. Reply back to us. We just caught a scammer now, and we found some money with him, we are returning it back to those involves. This mean your money will be refund back to you.Get back to the FBI through this email for immediate response scamtrack2010@gmail.com

Spyware/DDoS malware combo Google’s security team member Neel Mehta has blogged about yet one more spyware attack on Google users from Asia. This time forces in Vietnam apparently are trying to spy on and stifle dissent from those opposed to the expansion of bauxite mining in the country’s central highlands. The dissenters are opposed to the environmental impact, the involvement of Chinese in the venture and the displacement of people who live in the mining area. Bauxite is the ore that aluminum is extracted from. ...

Apple has issued Security Update 2010-002 (Mac OS X v10.6.3) that fixes 100 enumerated vulnerabilities in: — Mac OS X 10.5 — Mac OS X 10.6 — Mac OS X Server 10.5 — Mac OS X Server 10.6 The 400 MB+ download takes a while, so, be prepared. Info here: http://support.apple.com/kb/HT4077

It seems I prompted an exploration of infection related search terms in Google Trends over on the Forbes.com Firewall blog. “Malware” is becoming a sort of catch-all term for end-users, slowly replacing the various types of Ad/Mal/Spyware classifications. Article here – worth checking out the comment by Andy Hayter, Anti-Malcode Program Manager of ICSA Labs, too. Of course, I like to think I might have contributed in some small way to certain search terms going the way of the Dinosaur…

Didier Stevens, security professional and blogger, has found a “feature” in the PDF file format that makes it possible to package an executable in a PDF file which will run in Foxit PDF reader or run in Adobe Reader with a bit of social engineering. “With Adobe Reader, the only thing preventing execution is a warning. Disabling JavaScript will not prevent this (I don’t use JavaScript in my PoC PDF), and patching Adobe Reader isn’t possible (I’m not exploiting a vulnerability, just being creative with the PDF language specs).” ...