Why Patch Management is a Moving Target

Whether you use a centralized patch management system for your organization or rely on less sophisticated measures such as manual patching, you will often find that patch management is a constantly moving target. Patch management is a fundamental security task, but yet it seems to be one of the hardest in which to achieve a consistently high security “score.” And patching is only part of the issue. Reporting metrics that allow you to see tangible results are not always easy to obtain.

The data required for many measures of Cyber-security health or “scorecards” is often more readily pulled from a centralized system, and often organizations wish to report how many nodes have 100% of their security patches installed. This includes possibly a very large number of devices, depending on the size of your organization, including servers, desktops, routers, and switches. It also makes sense to focus efforts only on patches that are 30 days old and older, and that have not been superseded or replaced. The reason for this is because you are still testing the newest patches, and if you are in a very large organization have not yet had time to fully deploy all the new patches. Additionally, the older the patch, the greater the risk if that hole is still not closed. Plus, it doesn’t make sense to include patches that have been superseded by newer patches, as your scoring metrics would give erroneous results if those patches were included.

The purpose of this article is to address an example of an organizational patch status improvement effort and illustrate findings of an experiment to improve these patch statuses. This project was specifically aimed at the Microsoft specific security patches for the Windows XP Professional operating system, and all references to patches in this article will be geared toward those patches. This report will discuss the findings of that project, and describe ways that other programs can use to improve their own patching statuses. The results and recommendations are geared toward a fairly large organization. Your mileage may vary.

The Project:

I and my team recently performed an analysis of patching statuses to determine how to improve patch statuses for our entire organization. We belong to a fairly large organization with many business units, each business unit having their own IT staffs that manage their computers. One of the goals of this project was to look at ways to improve patching statuses and to document specifics concerning any anomalies that were found. By pushing out specific types of patches, and analyzing the results of those patch deployments, I was able to put together some strategies to help others with their own patching efforts. The analysis of patching efforts was performed as follows:

1) Concentrate on the "low hanging fruit" by focusing on the Microsoft critical security patches that are greater than 30 days old, and with the highest incidences of "Not Patched" statuses. This was done in phases:

Phase 1: Push out the outstanding Microsoft Office Service Packs plus Windows Defender signature files. These were chosen because they represented the largest number of un-patched vulnerabilities in the environment, as seen in the image below:

Phase 2: Push out the new Office patches offered as a result of Phase 1 completion above. This is important because applying a service pack will usually result in the computer needing additional patches that apply only to the new service pack level on the machine.

Phase 3: Push out the top 5 "not patched" patches resulting from phases 1 and 2 above.

Phase 4: Push out any remaining patches as appropriate.

2) Identify patches that are deploying successfully, but are not showing as "Patched" in our patch management system. This will include verifying that the patch is applied by using Microsoft Security Baseline Analyzer (MBSA) and Windows/Microsoft Updates.

3) Compile a list of patches that are having deployment detection signature problems and submit to the patch management system engineering for assistance with detection signatures.

4) Identify computers on the patch management system that are not checking in to get their patches. This will include looking at deployment reports to see which computers have not checked in no more than 24 hours after the deployment has been sent.

Findings:

As shown in the image below, patching statuses tend to fluctuate dramatically from day to day. This can be caused by machines falling in and out of patch status due to new patches being released to replace older versions of the same patch. For example, the Windows Defender DAT files are released approximately every three days. Rather than releasing a new patch each time, our patch management system simply replaces the existing patch with a new revision of the same patch. As the new revision is released, the computers fall out of patch status because they have the older DAT files. As the IT staffs push out the DAT files, the patching statuses go back up.

Some more specific examples of patching issues include:

Patches That Change Frequently:

The Microsoft Windows Defender DAT Files: These definition files are released by Microsoft approximately every three days. Since they are categorized as Critical-01 patches, they cause the patch statuses to fluctuate significantly every time they are released, and then again when they are subsequently deployed. This patch was the single largest reason why patch statuses greatly fluctuated from day to day.

Patches That Cause Other Patches to be Applicable:

Service Packs: Once installed, these patches tend to make the computer detect as needing additional patches. Some patches may only apply to a newer service pack level, and were thus not applicable to the machine until the latest service pack was installed.

Patches With Deployment Issues:

Microsoft Office Patches: These patches in particular were found to have a number of difficulties when deployed. In some cases, the patch is deployed, and completes successfully according to the patch management server’s deployment status. Even though the patch deployed successfully, the patch did not apply because it produced an error message that it could not find the Office installation files. In other cases the patch fails, for the same reason as stated above. Ensuring that the installation files have not been removed manually, or through the Disk Cleanup procedure typically resolves this issue. In some cases, it was necessary to uninstall and reinstall Microsoft Office, again ensuring that the Office Installation files are not removed.

Microsoft .NET Framework 1.1 SP1: This specific patch typically fails when being deployed. The reason for failure was found to have been on computers that also have the .NET Framework 1.1 Hotfix (kb928366) installed. The resolution is to go to Add/Remove Programs and remove this hotfix, deploy the .NET Framework 1.1 SP1 patch. The computer will then likely show up as needing the MS07-040 patch. Deploy MS07-040 if needed.

Patches With Detection Issues:

MS08-018 for Microsoft Project: This patch is not supposed to apply to versions of Project 2003 that have service pack 3 applied, but our patch management system incorrectly identifies the computers with Office 2003, SP3 as needing it. This is still an open issue with engineering and will hopefully be resolved soon.

Patch Management System Housekeeping Issues:

If you are using a centralized patch management system, and you are using the various reporting features to obtain your patch statuses, then it is important to take a look at housekeeping. One important thing I found in my testing was that simply deleting stale accounts out of the patch management system increased patch statuses.
The below image is an example of how much difference in patching status can be achieved just by doing housekeeping and nothing else. The patch status for the month of April was taken at the end of the month, and the patch status being shown for May was taken at the beginning of the month after clearing out all the dead computer accounts:

The result was that patching statuses for every business unit (BU) except one improved, with an overall improvement going from 42% to 58% just by clearing out dead computer accounts.

Recommendations for Improving Patch Statuses:

If you are a large organization, use a centralized patch management system. The ability to gather data on the whole organization is vital to enabling you to keep track of gaps in patching efforts.

Make sure that your centralized patch management system is being properly maintained, in terms of housekeeping. Get those stale computer accounts out of there.
Start small. Break your patching efforts into pieces, and go for the “low hanging fruit’ first. Look for the patches where the most computers need them, and start there. If you have a lot of these in your environment, break them up into groups and deploy them over several deployments if needed.

Test, test, test! If you are trying to bring an entire organization up from a dismal patching status, don’t try to push them all at once, and be sure to perform testing to make sure to discover if any patches break anything.

When pushing out service packs or roll-ups, be aware that installation of a patch of this type will often result in additional patches being applicable that were not applicable previously because of the new configuration.

Monitor patch deployments and subsequent detection results. In cases where patches deploy successfully but detect as still not patched, check to see what error messages are occurring during the deployment. In the case of Microsoft Office patches erring out, for example, ensure that the Office installation files have not been inadvertently removed from the computer.
Develop a patching routine and communicate this with your end users. Get them used to the fact that you will usually be pushing out patches the same night of the month (if they are in your central offices) and to leave their computers on that night. For remote users that receive their patches through your centralized patching system, make sure they are aware that patches will be coming to them on a certain day and give them instructions for how to properly receive the patch:

Example:

When coming in through the corporate VPN to replicate email or other databases, ensure they leave the computer on long enough to receive patches on the day you deploy them.

Other Follow-up Action:

Remember: Patch management is not something that you do once to get caught up then forget about. You have to treat patching as a constantly moving target, and always follow-up on patching efforts. Get into the habit of always keeping an eye on patch statuses and results of patch deployments.

Determine if an application is the mandated or authorized solution to be used. Sometimes you find that you are chasing patches for products that are no longer in use or maybe even not even authorized on your systems. Why patch a product that isn’t even needed? Removing it is more secure and less time consuming than patching it.

Continue to monitor patching efforts and publish lists of those patches which remain as the most likely to be causing degraded patch status.

Assist IT staffs with troubleshooting computer detection, discovery, and patch assessment issues that may exist. It could be that the patch assessments on a certain machine are out of date and not even accurate.

Monitor patch management and security discussion forums such as the patchmanagement.org listserv. If a particular patch is causing breakages or deployment issues, this is where you will find out about it the quickest.

Wrapping It All Up:

Getting a handle on patching statuses can be a real challenge for a large and geographically dispersed organization. A centralized patch management can greatly assist your efforts, particularly if you are in a large organization. Break your patching effort up into phases, and go for the “low hanging fruit” to get caught up. Be sure to continuously monitor deployments and patching statuses, and address issues where the deployments are not starting as they should, or the patch is not detecting as it should.

Types of Vulnerabilities and Their Impacts:

With all of the different types of vulnerabilities and security warnings these days, one of the most often asked questions is in regards to what it is that all of the various types of attacks actually do. If we take a step back in time and look at what some of the early attacks did, it puts into perspective just how sophisticated and damaging the latest attacks have come. Attacks on computers and the data they contain have come a long way in a very short time. With most of our computers now networked and attached to the Internet, our data can be attacked from far, far away, and the results can be devastating. The attackers have also found that stealing data, finding weaknesses, and disrupting services are all lucrative endeavors that other thieves are willing to pay for. And if you haven't already, see my review of TechEd 2007 for more information on security and attacks.

A Look Back at Some Early Computer Attacks:

Let’s go way back to the day of the early PC when they were not yet networked to any great extent. The networking architecture back in the day was known as “sneaker-net” where the method of sharing files was literally by manually sharing floppy disks and physically handing them from person to person. “Sneaker-net” got its name because of the idea that you had to put on your sneakers to make the long journey to get the disk to the person who you wanted to share with. The most common type of attack at that time was the virus. WORMS and backdoors typically weren’t useful because of the lack of remote connectivity. Trojan horses were usually not in the form of remote access programs, but they did exist in the type that looked like usable programs, and they would perform some other hidden function such as corrupting files or erasing the hard drive.

In those days, viruses typically got onto a computer by someone putting an infected floppy disk into the machine. This was often by way of an infected game program, or someone using the same disks they used at school in their computers at home. There were a lot of viruses on college campus computers in those days, making it fairly common to catch a virus by using a computer at school. I remember when I took a computer hardware repair course at a local junior college back in the early 90’s: I built a completely separate computer at home to do all my labs and class homework, aside from the computer I used to do all my word processing and other work to prevent getting a virus on my main machine. There was also a lot of software swapping (today we call it piracy), and it wouldn’t be uncommon at all for people to pass infected disks to many people. I remember being called to check out one of the office PCs where I worked and found a computer screen displaying the message: “Your computer has just been Stoned.” The Stoned virus was a very common early virus and would format the hard drive, then display that or a similar message. I asked the person what they had been running, or particularly had installed on the computer lately, and the reply was (of course) “Nothing!” I looked beside the computer to see a floppy diskette containing a golf game. I scanned the floppy, and sure enough, there was the Stoned virus.

Back then the main damage caused by viruses ranged from an annoying pop-up message of some sort, to a complete format of the hard drive. Some viruses would go off randomly, some would go off on a particular day and time. The “Joshi” virus, for example, always went off on the day of the year of Joshi’s birthday - the virus writer had dedicated a virus to their dead son. Remember Michelangelo? Same type of virus – went off on a particular day. Since computers weren’t typically networked, and the Internet was not used by us common folk, the concept of the WORM did not yet really exist. Neither did the idea exist of people stealing data or damaging systems over a network or the Internet itself. But now, with networks and the Internet being such ubiquitous parts of our lives, “sniffing” network packets to steal passwords, intercepting and altering data before sending it on to the correct recipient, and even using tactics to deny access to certain web sites or databases are some of the very common attack methods.
Today, we have networks, the Internet, email, and a variety of other ways for computers to be attacked by others who may even be on an entirely different continent. I remember in 1990, there were fewer than 1,000 viruses. Last I checked there were over 50,000 viruses, including their variant forms. When I attended the recent Microsoft TechEd conference (see my review here), it was revealed that 82% of all email today is SPAM. Much of the SPAM out there these days contains phishing attacks and links to malicious sites.

Another startling fact that was mentioned was that there were currently 3,700 distinctly different malicious types of one particular type of image file that exploits the WMF vulnerability found in early 2006. There are also 38 million plus pieces of other potentially unwanted (PUP) software circulating on the Internet. We also have WORMS, Trojan Horses, backdoors, remote exploits, and a variety of other ways for our computers to be vulnerable.

So I wanted to take a look at some of the more common types of attacks and what kinds of impacts they can have. I am discussing the attack impacts in this article – but the attack itself can come in the form of any of the methods I just mentioned, as well as by attackers luring users to malicious web sites or convincing them to open an infected email attachment, in an attack method known as social engineering. The various attack vectors are too many to mention here, but I thought it important to at least discuss the impacts that attacks commonly present. The bad news is that this article only scratches the surface of what is out there.
Keep in mind that the objective of any of these attacks is to violate security. The three basic tenets of computer security are the three basic parts of the C – I – A triad as defined below:

• confidentiality: not exposing personal or sensitive information to unauthorized people;
• integrity: Not having data altered so that it is inaccurate, incorrect, or unusable;
• availability: Being able to get to your data or information services when you need to.

An attack can be focused on one or more of those three aspects of data security, and can come in a variety of ways. So let’s take a look at some of the various impacts on malicious attacks:

The Methodologies and Impacts:

File transfer location tampering: This mainly exists of capturing data in transit and re-routing it to a location other than that which was intended. If someone is transferring financial or other sensitive data, the attacker can get a hold of data for identity theft, corporate espionage, or other reasons. It is obvious that the data falling into the wrong hands is often a devastating problem and can result in serious damage to an individual or corporation. The attacker may make their attack less noticeable by capturing the data then forwarding the data on to the correct recipient. The intent is not to prevent data from being correctly transmitted. The intent in this case is to simply steal the data and use the information for financial gain. The criminal can get more mileage out of this attack by making it less noticeable that it is happening. A variety of methods can be used for this, including ARP poisoning, and various other methods used for “Man in The Middle” attacks.

Elevation of privileges: This is a very common result of an attack, and can lead to other types of attacks or more serious outcomes. If an attacker can get administrator level privileges to a computer, then they can basically do anything they want. This includes taking control of the computer, installing other malicious software, deleting files, changing configuration settings, and doing many other high-level tasks that only an administrator can do. This is why it is so important to use your computer (especially while on the Internet) as a limited user. If you are on the computer as a user with no administrative privileges, it makes it much more difficult for malicious code to run and do damage. Windows Vista addresses this very serious concern by implementing a feature called User Access Control (UAC) and having Internet Explorer operate in a limited user capacity.

Remote code execution: You are probably starting to already see that many of these attack outcomes do many of the same things. That is true. Remote code execution allows an attacker to remotely take control of a machine, run code, execute programs, and many other things that can lead to damage, data loss, data theft, or other things to damage your system. But additionally, if someone can remotely use your machine to execute code, they can also turn your computer into a “Zombie” and use it to attack other systems. This often results in what is known as a “Distributed Denial of Service (DDoS) attack. See “Denial of service” below for more information. The Windows Vista UAC feature mentioned above also helps to address this type of impact.

Denial of service (DoS): Remember the three parts of the information security triad are “Confidentiality,” “Integrity,” and “Availability.” This particular attack outcome is that of taking away the availability of your system, or other systems’ ability to access other system resources. There are a variety of ways to do this: crashing a system, tying up a system’s resources so that they can’t process data properly, or creating huge amounts of network traffic so that others trying to access a system cannot get to the system because of the sheer volume of traffic. If a process can drive your CPU’s usage up to 100%, then your computer is almost useless and you have a hard time getting work done because it is so slow. If a web server is flooded with bogus SYN packets (part of the process that is used to request a connection with a web server), then the web server cannot provide the requested web pages or other data.

Distributed Denial of Service (DDos): This is simply a case of all of the above attack attributes, mentioned in “Denial of Service,” being performed by many computers simultaneously. In fact, this may be a combination of the above attacks where some code has been planted on and executed from a compromised computer. These many “zombie” computers simply take commands from a central attacker to flood the network with attack packets and cause the target (web server as in the case above) to be literally flooded with connection requests, and no longer respond to anything. This means that the target is then unavailable, and thus “denying service” to all legitimate computers that try to connect.

Modifying information: This impact is specifically aimed at changing the integrity (the “I” in C-I-A). As in the case of file transfer location tampering mentioned above, the goal here is to intercept information before sending it on. However, the intent is to not just steal the information to use it for financial gain later. The intent of this type of attack may be for a few different reasons. In one example, the data may be modified so as to actually cause damage to an organization by making their data incorrect and therefore useless. The purposely injected errors may be extremely difficult to locate, causing extensive staff-hours of research to correct. Another example of the usefulness of this type of attack is to divert financial transaction amounts for financial gain. The easiest way to illustrate this is the case of someone billing you $100 dollars for goods or services that only cost $90 dollars. They input into the system that the services cost $90 dollars, that they billed you for $90 dollars, and that $90 was received from you. They then pocket the 0ther $10 dollars for themselves. You may have seen the movie Office Space” where the guys injected a so-called “virus” into the system that took the rounded interest (fractions of a penny) and diverted it to an off-shore account for themselves. To make a good plot, the plan backfired, and they ended up with way too much money and were in a position of being easily discovered. This is another aspect of this type of attack: To make the interception modification, and theft of data to be difficult to detect.

Spoofing: Simply doing any of the above, but making the attacker’s identity to appear as the identity of someone else is known as spoofing. This can manifest itself in a few different ways. One way is for an attacker to get your log in credentials, log in as (or appear to log in as) you, and perform tasks under your name. If Bob (the attacker) logs in as Gary, and deletes a bunch of files, the audit logs will show that Gary did it. Gary gets blamed and has a hard time proving it wasn’t him. Another type of spoofing comes in the case of DoS and DDos mentioned above, where requests for a web site, for example, are requested, but the return network address of the computer is purposely changed. The acknowledgement then gets sent to an address that either doesn’t exist, or is that of a computer that did not make the request. In the mean time, the web server is waiting for the remote computer’s acknowledgement to its acknowledgement (the SYN, SYN-ACK, ACK process in the TCP three-way handshake). This is one way in which DoS works – the target machine is tied up waiting for acknowledgements from a computer that doesn’t exist, and is then too busy to service legitimate requests.

Theft of sensitive information: As in the case of modifying file transfer locations, the primary purpose of this type of attack is as its name implies - to steal data. Remember, this is the “confidentiality” part of the C – I – A triad; exposing data to unauthorized people. Modifying file transfer locations involves intercepting data, stealing it, possibly modifying its contents, then possibly (or not) sending it on to its intended recipient. This is just outright theft. Many of the other previously mentioned impacts can contribute to a criminal’s ability to steal information. If an attacker can elevate their privileges on your machine, for example, they can browse all of the folders on your computer, not just the folders available under a limited user’s logon context. There may be a variety of reasons for stealing data from a computer, including using the data for identity theft purposes, stealing proprietary information, or stealing password files so as to crack them and use them to gain further system access.

Buffer overflow: A buffer is simply memory space used to temporarily store data. For example, your computer has buffers for receiving incoming communications until it has a chance to process it and put it into the appropriate place in memory for the working application to access and use to do work. This space is not infinite. If the buffer can purposely be filled up, in some cases the excess data will simply overflow (thus the term buffer overflow) out of the buffer and have unpredictable results. This type of attack simply involves sending a computer more data than it can handle so that excess data spills over into areas of memory used to execute code. One thing that attackers have found is that certain vulnerabilities exist that are susceptible to these buffer overflow attacks. They will craft a special package that contains a large amount of data, send it to your computer, the buffers will fill up, and the excess data will be overflowed to parts of memory where it can be executed. This code execution may result in things used to crash a computer, elevate privileges so that other attacks will work, or a variety of other undesirable things.

Wrapping It All Up:

Attacks come in many forms, and have many different purposes and impacts. These attacks are meant to do everything from being a minor annoyance, to disrupting service, to theft of data, and to outright destruction of computer information systems. As I mentioned in my review of the TechEd 2007 conference (see my article here), data thieves have found that personally identifiable information is worth money. Whereas the hackers of old just wanted attention, the bad guys doing the computer attacking these days are just criminals, plain and simple. They want to make a living either by stealing your data, stealing the data of a competing company, or interrupting service. When they find vulnerability and a way to exploit it, they can also sell the exploit methods for money as well. And they have found a variety of ways to conceal their attacks and make their consequences undetectable for a long time.

There is good news; many of the attack impacts mentioned here are preventable. Good antivirus software, malware protection, firewalls, and above all keeping patches up to date will help prevent many of the exploits. I have told people over and over abut the dangers of clicking on every single link they get in an email, especially when that email is from someone unknown to them. Even the emails from people whom you trust is susceptible these days, because attack methods can use your own address book and email client to send out mass emails without your knowledge, and the recipients will think it came from you. But that too is preventable; use diligence and awareness when browsing emails, and especially on the web.

Additional Resources:

• ARP Poisoning (ARP Spoofing) Defined
• Distributed Denial of Service Explained
• Example DoS Attack Explained
• The C-I-A Triad of computer security
• Man-in-the-middle Attack Defined
• TCP Connection Three-way Handshake (Tutorial)
• Another TCP Tutorial

The First 90 Days of an Operating System

People who know me know that I often complain about Microsoft systems because of the constant vulnerabilities they seem to have. "patch Tuesday" is always an interesting time for me, as it typically provides a lot of work. But I read a recent article that outlined the vulnerabilities that occurred within the first 90 days of the life of various operating systems. It was funny to see that of all the operating systems discussed in the article that Red Hat Enterprise Linux 4 Workstation Reduced actually led the way with the most vulnerabilities in the first 90 days. Also mentioned were Ubuntu Linux, Novell SLED 10, and MAC OSX 10.4, all of which had more vulnerabilities than both Windows XP and Windows Vista combined.

It appears that 1) Windows Vista has made great strides in plugging security weaknesses, and that 2) The Linux folks need to reassess their stance on just how much more secure Linux is than Windows. A thought from someone who tests and deploys patches on Windows systems from month to month: I still see a lot of work to be done, but this article really makes us security professionals step back and realize that security vigilance is important, no matter what OS you are working with.

I guess what I am trying to say here is that there is a lot of stereotypical information about where the problems are. As I mentioned in a previous article: Microsoft is really not the problem. The problem is in that people get so wrapped around the axle on making assumptions about that which they are familiar with. For example, the Linux people will swear that Linux is flawless, and the Novell people will feel likewise. Much vigilance gets lost regarding educating users, and just keeping up on the day to day maintenance of the systems you do have. Educate your users, keep your systems patched, and at the end of the day, you Windows users will have an environment that is every bit as safe as that which the Linux folks claim to enjoy.

Article Link: http://www.csoonline.com/pdf/Vista_Vuln_Report.pdf

Why are Some Software Vendors So Security Unaware?

It seems odd to me that software vendors are releasing products that have vulnerabilities, and that they do not do anything to patch them. In fact in some cases, patching the host operating system breaks certain of these errant applications, and the remedy from the software vendor is to put the original, vulnerable file right back in its place. For example, a security patch is released from the operating system vendor. The minute it is applied, another third party application that relies on these files breaks. Instead of the software vendor releasing a patch for its own product, it relies on a “self repair” method that just restores previous, vulnerable versions of the files that need to be fixed.

Clearly, the software vendors are not talking to each other. Or they just don’t care that they aren’t fixing their applications to keep up with the threats. Either way, these companies are causing more work for IT department security people, and they are putting systems at risk. In Part 2 of my series on investigating false positives and other security anomalies, I discussed just such an instance - where a manual, self researched, and self developed fix had to be applied because the software vendor had no intention of fixing their product. This was clearly a case where the vendor did not care that they were injecting vulnerabilities into my environment. Good thing I'm not mentioning who it is here, eh?

Related Links:

• See the Software Hall of Shame – Vendors who do not support patching or other security efforts - http://www.threatcode.com/
• Investigating False Positives and Other Security Anomalies Part 1
• Investigating False Positives and Other Security Anomalies Part 2
  

Another Firefox Vulnerability - Already?!

Firefox’s latest browser, version 1.5.0.6, already has a new vulnerability.

National Vulnerability Database Article

Look to the left of this article – below my profile, and you will see that I am a big Firefox fan. I still use Internet Explorer, and Opera, and Netscape, yada yada yada, however, because I do a lot of testing. I just want to say that I am not writing this post to slam any particular browser or boost one over the other. But I have to wonder – and this is for all the little computer nerds who work in Best Buy, constantly parroting the virtues of Firefox to every customer they see – why is it that all these new vulnerabilities in Firefox practically go unnoticed while the Internet Explorer vulnerabilities get all the press?

In the last three weeks or so, Firefox has released two new versions, presumably to cover security holes and add features. The only reason I found out about the latest Firefox vulnerability is some micro-font text on a Dark Reading Weekly page – not a front page press item to be sure. I’m sure this will be published on Secunia and SANS very soon. But because the kids at Best Buy tell you matter-of-factly that Firefox is the only way to go, and just because Firefox doesn’t get the big press, doesn’t mean you are always safe and never need to pay attention to staying up to date.

Anyway, my point in all this is that people fall into a false sense of security because they hear so-called “experts” blather on about how Firefox is far superior to Internet Explorer from a security standpoint. People blindly follow this advice, thinking that they will never, ever, ever, ever have to worry about anything from now on. This notion is putting a patently false idea into your heads. Regardless of what products you use, you always need to stay vigilant for security flaws and apply updates when they are available.

The bad guys are getting bored with Microsoft – due diligence and proper risk analysis means that you are evaluating all of your software and keeping them up to date. Stay safe with all parts of your system!

UltraVNC Updated Due to Vulnerability

For those of you that use UltraVNC for remote computer control, you should know that you need to update now. There is a critical security vulnerability in UltraVNC 1.0.1. A new version, UltraVNC 1.0.2 is now available for download.

The upgrade is painless and installs right over the top of version 1.0.1. I also tested my current version of UltraVNC SC (Single Click), which is a simple utility that you can configure and send to your family, friends, and customers to make remote connection easy. The old SC works just fine with the new version of UltraVNC.

For more information and to download the new version, see the Sourceforge UltraVNC web site.

For information on the vulnerability, see this Neohapsis article.