April Security News is Serious

Many of my friends have been asking for my opinion of a couple security issues which have been in the news.

The first is Windows XP which was launched in September of 2001. Microsoft announced last year that after April 8th, 2014 it would no longer provide support for Windows XP and Office 2003.

The second concern is for something known as HeartBleed. This could be dangerous to anyone who visits a website no matter what kind of device you use.

Microsoft Windows XP
I realize that many of you can not or will not upgrade your computer currently running Windows XP.  It may not happen today or even next month but it’s only a matter of time before your computer is infiltrated and is useless.  Start putting aside some money, backup your data regularly and look for alternates to programs you can’t do without.  I’m sorry but it’s only a matter of time.

If someone on your home or business network is using Windows XP, turn off their access. When their machine is attacked it will compromise your entire network.

If they really need Internet access consider getting them a separate connection perhaps through their phone or with a separate hotspot.

Many of you asked about using WinPatrol which is a great idea but doesn’t address the big picture. The security guru’s at Microsoft spend a lot of attention on flaws or vulnerabilities in software.  When they find a hole that lets hackers in, they create a patch. After a great deal of testing they release fixes on what we called “Patch Tuesday."

WinPatrol will continue to notify you of regular changes to your computer but the ability to patch vulnerabilities isn’t its specialty. What I will be doing is paying attention to what I hear from hackers. When possible, we will notify WinPatrol users if a particular file or ActiveX component is found to have a vulnerability. WinPatrol PLUS will allow you to disable ActiveX components by setting their Kill Bit. This is the most we can do and will require quick action.

OpenSSL - Heartbleed
On Monday researchers disclosed a serious flaw in a open source program used by almost half the web servers around the globe. A version of the program called OpenSSL allowed hackers to grab a chuck of recently active protected memory.  This memory could contain anything from names and passwords to someone’s grocery list to decoded government or industrial secrets.  Any kind of data that is communicated could be snatched. After collecting unlimited chucks of data a hacker could make a game out of figuring out what segments could be valuable. Each chunk was 64K like the total addressable memory of the Commodore 64.

Some media outlets like the BBC have repeated the advise to change every password you have. There is no trustworthy list of up-to-date/time safe computers but a list created yesterday claims to have tested 10,000 popular sites. Most have been updated by now but you’ll want to be sure before changing any password or even signing on.  An updated list should be available soon.

A number of tools for consumers have sprang up allowing you to verify in real-time if a website is currently safe. I found the following to run my own tests.

 

Click image to test your favorite site

My web sites have been hosted by the company, Verio and I was pleased to see my information was safe It doesn’t mean it was always safe but if not, at least Verio was quick to apply a fix. I can confirm no personal or financial customer data is stored on our web servers.

I wouldn’t necessarily advise you to change all your passwords. Before you do, you’ll certainly want to be sure the company is aware of Heartbleed and has updated their security.  Over 56.8% of the companies on the list of 10,000 are listed as safe because they don’t even use OpenSSL.  Another 36.9% tested safe yesterday. That leaves only 6.3% were vulnerable when the news was announced.

I have changed some of my more important passwords but I regularly changes passwords anyway. I did change my Yahoo passwords since they were mentioned in many news reports and acknowledged using OpenSSL.  Considering Google was involved in disclosing this bug it’s interesting that Yahoo was used as an example. Many friends of Google were notified so they could update their version of  OpenSSL before the information was made public.

While you may notice my tone is not meant to create panic, I personally consider this failure as devastating. I started developing online services for consumers 30+ years ago and this is the “utmost cock-up”.  I don’t fear the damage caused by this threat as much as I worry about what this general lack of  oversight represents.

You can find more details online from our favorite security investigator, Brian KrebsonSecurity  and official reports sponsored by Homeland Security on the Carnegie Mellon CERT database.   The list of 10,000 is located at
https://github.com/musalbas/heartbleed-masstest/blob/master/top10000.txt

Fake and Deceptive Advertising is Growing

A friend of mine once referred to Ben Edelman as the Ralph Nader of the internet.  That really is an understatement. Ben has a long history of exposing malicious advertising and his research has saved millions from potential adware/spyware infiltration. Ben has been an expert witness and has helped many bring legal action against evil companies.  Yesterday, Ben published a new paper taking aim at Yahoo’s Right Media for their fake and deceptive ad practices.

Unfortunately, many of us have come to accept these deceptive ads as normal. The truth is, many are sucked into costly situations because they believe these ads.  Each time they’re clicked someone makes money.  This not only hurts the consumer but it makes advertising on the internet more costly. Companies like Yahoo really need to take steps to police their advertisers and affiliates but they have no incentive to do so.  It’s up to crusaders like Ben to expose these practices and shame companies into playing fair.

Take a look at the ads below. They’re from Yahoo’s Right Media. I’m sure you’ve seen them or something similar.

Is this an ad?  Aren’t advertisements suppose to say so?

Is this a fair way to get a users attention?

This just wrong but someone makes money anytime it’s clicked.

Just click and get a free dinner.  Yea, right!

If you go to a web page where you see deceptive ads, let the owner of the web site know.  Many web sites just accept plug-in code and don’t know what ads are being served. We all need to stand up and let our voices be heard.  We’re mad as hell and we’re not going to take it anymore!

See more examples and learn more about this topic at http://www.benedelman.org/rightmedia-deception/

Thanks to Ben for allowing me to use the images above.

 

IAC may say Good-Bye Ask.com Toolbar

Late last year I attracted a lot of attention by blogging about an offer by Ask.com to include their toolbar with my WinPatrol program. It looks like my choice not to include the toolbar may have been a good business decision after all.

According to Silicon Alley Insider, IAC may be ready to scrap Ask.com, powered by Teoma, and move their business to Google. IAC already signed a 5 year sponsorship deal with Google last November. Given IAC has an advertising relationship with Microsoft they could also to cut a bigger deal with MSN. Either way, it’s nothing I want to celebrate. Other sources report a large number of Ask.com employees have been told to look for new employment by April.

I would really be happy if IAC considered separating their “FunWebProducts” line into separate applications. That way users who ask for one application won’t get a dozen along with their toolbar. Unfortunately, I’m guessing they’ll just replace their MyWebSearch toolbar with a Google or MSN toolbar.

Everyone is making so much money distributing toolbars that consumers have to be careful installing any application these days. I saw yesterday that AVG Anti-Virus is now installing a Yahoo based toolbar calling it a security toolbar.

Some folks chatting on the Calendar of Updates forums report the toolbar is installed even if you uncheck the option.

Anyone who reads this blog knows I’m not a fan of toolbars but my fear goes beyond the obvious. Anytime you install a new peice of software you run “some” risk of a system conflict. By installing multiple programs at the same time, the risk increases exponentially and chances of fnding and fixing the problem becomes more difficult.

How Do We Stop Spyware?

A number of folks who have been on the forefront of battling spyware and adware met last week in Washington D.C. I’ve been to a number of AntiSpyware conferences over the years and they seem to get better all the time.

CSI Spyware: Can Investigators Stay Ahead of the Bad Guys?

From left to right

• Chris Boyd aka Paperghost, Facetime Security Labs


• Lance James with Secure Science Corporations


• Alex Eckelberry, Sunbelt Software


• Cindy Southworth, National Network to End Domestic Violence


• Luke Erickson, Federal Trade Commission

Seated up front is longtime supporter of the MyWay searchbar, Kirk Lawrence, IAC Search & Media.

It’s hard quantify what kind of difference these meetings make. In a way it’s like a pep rally that gets many of us excited and motivated to continue our efforts. It’s also excellent to share stories and methodology. While many participants are essentially competitors the cooperation is unlike other industries.

Chris Boyd has posted some photos from the conference as well as some fun tourist travels on Flickr. There’s even proof that I sometimes wear a suit and tie. It’s interesting to view our country through new eyes. Click the photos below for more.

NYC as viewed by a visitor from across the pond.

Yahoo! Surprises Me with Improved Search

Three months ago I spent some time researching the major search engines and concluded that Google remained the best search engine available. (More Info). Recent ratings have also showed that Google leads business of Internet searches. Yahoo! Inc has announced new search enhancements including something called “Search Assistant”.

Press Release…

"The new Yahoo! Search is focused on getting consumers the most relevant information as well as providing the best user experience. We know that consumers want a complete answer, not a bunch of links, and the changes we've made are focused on getting people to the best answer -- whether it be a Web link, photo, video or music clip -- in one search," said Vish Makhijani, general manager and senior vice president of Yahoo! Search.

Unlike Ask.com who tried to lure new users with an expensive ad campaign about its algorithm, Yahoo! actually improved their search engine. Using my traditional “Pytlovany” search test the results from Yahoo! improved since early summer and now exceed the results from Google. For now, my testing is preliminary and I have found at least one invalid result but this appears to be a big step for Yahoo!

I’m not sure if Yahoo! has raised the bar on search technology but they appear to have grabbed onto it. This should cause the folks at Google to focus a little more on enhancing their search advantage. While both companies have diverse offerings, search is still the entry point to their business. I expect we’ll be hearing more about the “Search Wars” in the future.

Update: A little more research shows that Yahoo! may have put the cart before the horse on their new search technology. I found that while they may have increased their search results, Yahoo! fails to properly screen out some potentially dangerous sites. While my Safe Search options were set to “Filter out adult Web, video, and image search results” it didn’t work. I was sent to a couple sites with porngraphic videos asking me to download ActiveX files to view the video.

While some make argue this is not their responsibility safe searching is one enhancement even Google could improve on.