Peewitsol I.T. Pro Services: November 2005

What is a Virus, Worm or Bot(net) - here's an excellent security awareness video

There's an excellent security awareness video that was produced on behalf of the Dutch Government for their highly successful National Security Awareness day - it's good IMHO as the content is highly visual, colourful and thought provoking. If you want to get your family, friends and business colleagues to take security seriously then this is an excellent resource.
The video can be downloaded from here - it's 12Mb and runs for just over five minutes.
For more security awareness material I recommend browsing to the GetSafeOnline website
Thanks & acknowledgement to Steve Lamb
peewitsol

T'is the season

peewitsol
It's that time of year again for forwarding on silly emails etc
So just to remind everyone to stay safe
The Hazards of Improperly Forwarding Email
When you forward a message, try to remove all the previous email addresses and if sending to multiple email recipients, use the blind carbon (BCC) feature.

After clicking on the forward button, simply delete the addresses from the message.

If you want to forward to multiple people and not have them see who else you forwarded it to, rather than putting them in the To or Cc address, put them in the BCC (Blind Carbon Copy) section instead.
Remember, when you forward things and you leave your friends' names and email addresses out in plain view like that, you are putting them and you in what could be grave danger.

So, be safe, be careful and use Blind Carbon Copy (BCC) and remove all personal email addresses from the body of the email when forwarding emails.

Update your MS Beta Antispyware

peewitsol

The link for the newest Beta to Antispyware can be found here
http://www.microsoft.com/athome/security/spyware/software/default.mspx
Microsoft AntiSpyware Version: 1.0.701
This version expires on: 31/07/2006
Spyware Definition Version: 5779 (20/11/2005 16:24:38)

IE Security

peewitsol

Security Alert, November 22, 2005
IE Vulnerable to Remote Command Execution
Microsoft Internet Explorer (IE) is vulnerable to a memory corruption error when processing malformed HTML pages containing specially crafted calls to JavaScript "window()" objects and "onload"
events. The vulnerability could allow remote intruders to execute arbitrary commands in the security context of the currently logged-on user. Microsoft said that the vulnerability affects IE 5.x and 6.0 running on Windows Server 2003 Service Pack 1 (SP1), Windows XP SP2, Windows 2000 Server SP4, Windows Me, and Windows 98. For more information, read Microsoft Security Advisory 911302, "Vulnerability in the way Internet Explorer Handles onLoad Events Could Allow Remote Code Execution,"

RealNetworks patched due to vulnerabilities

Security Alert, November 16, 2005
RealOne Player and RealPlayer Might Run Arbitrary Code
A vulnerability in RealOne Player and RealPlayer can allow a remote intruder to run arbitrary code in the context of the currently logged on user. The vulnerability is due to incorrect parsing of images that are part of skins designed for the multimedia players. Critical vulnerabilities were also discovered in RealPlayer Enterprise.
RealNetworks released patches and updates to correct all the reported problems. You can download these at the URL below:
http://service.real.com/help/faq/security/051110_player/EN/

DoS vulnerable via ISAKMP

Security Alert, November 16, 2005
ISAKMP Vulnerable to DoS and Execution of Arbitrary Code
Internet Security Association and Key Management Protocol (ISAKMP) contains a vulnerability that might lead to Denial of Service (DoS) attacks or the execution of arbitrary code. The vulnerability can be exploited by sending malformed Internet Key Exchange (IKE) packets. IKE is commonly used in IPsec solutions. Affected products include
software- and hardware-based solutions produced by Juniper Networks, Cisco Systems, SecGo Solutions, Stonesoft, Nortel, Sun Microsystems, and possibly other vendors. Microsoft reported that none if its products are vulnerable to this problem. If your network uses IKE or IPsec, check with your vendor to determine your vulnerability status.

Child Internet Safety resources available here

peewitsol
Please make children aware of the following resources to help them learn more about being safe on the Internet:

http://www.getsafeonline.org
http://www.chatdanger.com
http://www.websafecrackerz.com
http://www.virtualglobaltaskforce.com

My thanks to Steve Lamb for the links

http request overload from

Are you being bombarded with multiple http requests from this server IP address http://220.233.23.195/ which is actually http://bathurst-tafe.nsw.edu.au/ an I.T. college campus then go to http://securityresponse.symantec.com/avcenter/venc/data/linux.plupii.html for a fix and block this IP from your browser too.
This hacker is using Linux and the virus attacks mainly Linux machines but it's very invasive & persistant even trying windows machines. The webmasters etc have been contacted.
Hope they find the culprit soon