Tuesday Fun With Microsoft

The new patches are here, the new patches are here!

Microsoft Patches 17 Bugs in December Patch Tuesday

Microsoft fixed 17 bugs in the Windows operating system, Microsoft Office, Windows Media Player and Internet Explorer. The fixes also cover a zero-day flaw exploited by the Duqu Trojan.

Microsoft released 13 security bulletins to fix 17 different vulnerabilities as part of its December Patch Tuesday update, according to the advisory released Dec. 8. Three bulletins were marked critical and the remaining 10 were rated important.

See also:
Microsoft Security Bulletin Summary for December 2011
Merry Christmas! Microsoft Plans Massive Patch Tuesday to Close 2011
Last Patch Tuesday of 2011 Secures Windows XP, Vista, Windows 7
December 2011 Patch Tuesday sees 13 Microsoft bulletins, Duqu patch
Microsoft fixes 20 bugs in year’s last ‘Patch Tuesday’
Microsoft to patch three critical holes
Microsoft slims final patch Tuesday of 2011 to 13 patches from proposed 14
No BEAST fix from Microsoft in December patch batch
Microsoft fixes Duqu hole, but not BEAST problem
Microsoft scratches BEAST patch at last minute, but fixes Duqu bug
December Patch Tuesday Fixes Duqu Worm
‘Duqu’ zero-day Windows flaw patched this week
Microsoft: Duqu patched, bringing years total to 99 corrections

Well, it’s a good thing that Microsoft finally patched against the Duqu virus, better late than never, as they say. What are you waiting for? Start installing your gifts!

/at least you can’t say Microsoft didn’t get you anything for the Holidays

Tuesday Fun With Microsoft

Windows, the software of perpetual patching. This installment is fairly large.

Microsoft Fixes Internet Explorer, Windows Flaws in October Patch Tuesday

Microsoft fixed 23 vulnerabilities across eight security bulletins as part of its October Patch Tuesday release.

October’s Patch Tuesday release resolved issues in Internet Explorer versions 6 through 9, all versions of Microsoft Windows from XP through 7, .NET and Silverlight, Microsoft Forefront Unified Access Gateway and Host Integration Server, Microsoft said Oct. 11. Two of the patches are rated “critical,” and six are rated “important,” Microsoft said.

See also:
Microsoft Security Bulletin MS11-082 – Important
Microsoft Security Bulletin MS11-081 – Critical
Microsoft Security Bulletin MS11-080 – Important
Microsoft Security Bulletin MS11-079 – Important
Microsoft Security Bulletin MS11-078 – Critical
Microsoft Security Bulletin MS11-077 – Important
Microsoft Security Bulletin MS11-076 – Important
Microsoft Security Bulletin MS11-075 – Important
Microsoft’s October 2011 Patch Tuesday fixes 23 flaws, releases SIRv11
MS wipes out 23 flaws in October’s Patch Tuesday
Patch Internet Explorer Now
23 vulnerabilities squashed by Microsoft’s Patch Tuesday effort
Microsoft Update

So, get busy and happy patching!

/until the next time Microsoft releases patches to make its software suck less . . .

Do The Microsoft Patch Dance

The dance that never ends.

Microsoft Patch

Microsoft released 13 security bulletins, patching 22 vulnerabilities across its product line, including two critical updates affecting Internet Explorer and the Windows DNS Server.

While Microsoft issued fewer updates this month, August was still marked as a busy month for system administrators. Adobe Systems Inc., which issues fixes on a quarterly cycle, issued a critical security update late Tuesday, repairing seven flaws in its Shockwave Player, more than a dozen holes in its Flash Player and an error in its Flash Media Server.

Microsoft addressed seven vulnerabilities in Internet Explorer including two zero-day flaws. According to MS11-057, Microsoft said an attacker who successfully exploited any of the vulnerabilities could gain the same user rights as the local user. Microsoft said the most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer

. . .

Another noteworthy bulletin is MS11-065, which resolves a vulnerability in the Remote Desktop Protocol. Although the security bulletin is rated important for users of Windows Server 2003, Miller said Microsoft has seen attacks targeting the flaw in the wild. The flaw can be targeted if an attacker sends a malicious remote desktop protocol connection request to the victim’s computer which could cause the system to crash.

See also:
Microsoft Security Bulletin Summary for August 2011
Microsoft Fixes IE, Windows DNS Server Flaws In Patch Tuesday Update
Microsoft Patches 22 Security Holes
Microsoft Security Patch Fixes 20-Year-Old Flaw
Microsoft fixes 22 security bugs
Microsoft’s August Patch Tuesday security update to tackle critical flaws in IE and Windows Server
Your Microsoft Patch Tuesday update for August 2011
Microsoft to Fix 22 Software Flaws in Its August Patch Tuesday Update
Hefty Microsoft August Patch Delivers 13 Security Fixes
IE, Windows server bugs likely to be exploited soon
Microsoft expecting exploits for critical IE vulnerabilities
Microsoft Update

Get busy downloading.

/so, until the next Patch Tuesday . . .

Tuesday Is The Time At Microsoft When We Patch

It’s a relatively small one this time, but critical.

Microsoft Fixes 22 Bugs in July Patch Tuesday

Microsoft addressed 22 security vulnerabilities across four security bulletins in July’s Patch Tuesday update. Three of the patches fix issues in the Windows operating system.

The four bulletins patched issues in all versions of the Windows operating system and in Microsoft Visio 2003 Service Pack 3, Microsoft said in its Patch Tuesday advisory, released July 12. Of the patches, only one has been rated “critical.” The remaining three are rated “important,” according to Microsoft.

“Today’s Patch Tuesday, though light, should not be ignored, as these patches address vulnerabilities that allow attackers to remotely execute arbitrary code on systems and use privilege escalation exploits,” said Dave Marcus, director of security research and communications at McAfee Labs.

Security experts ranked Microsoft bulletin MS11-053, which addressed a critical vulnerability in the Windows Bluetooth stack on Windows Vista and Windows 7, as the highest priority. Attackers could exploit the vulnerability by crafting and sending specially crafted Bluetooth packets to the target system to remotely take control, Microsoft said in its bulletin advisory.

See also:
Microsoft Security Bulletin Summary for July 2011
Microsoft fixes 22 security holes
Microsoft issues critical patch for Windows 7, Vista users
Microsoft Releases 4 Updates for Windows and Office
Microsoft warns of critical security hole in Bluetooth stack
Security Experts Warn of Microsoft Bluetooth Vulnerability
Patch Tuesday Fixes Critical Bluetooth Flaw in Windows 7
‘Bluetooth sniper’ Windows vuln fix in light Patch Tuesday
Microsoft Squashes Bluetooth Bug
Microsoft patches ‘sexy’ Bluetooth bug in Vista, Windows 7
Microsoft Fixes 22 Bugs in July Patch Tuesday
Businesses should not ignore critical Microsoft Patch Tuesday update, say experts
Microsoft Patch Tuesday: four security bulletins
Microsoft Patch Tuesday – 12th July 2011
Windows Update

This isn’t the first time you’ve had to update Windows, you know what to do, so get busy.

/until next time, same patch time, same patch channel

Aid And Comfort To The Enemy

Let’s see, China launches cyberattacks and conducts internet espionage against the United States 24/7/365 and our U.S. Department of Homeland Security is warning China about their vulnerabilities? WTF?

China’s Infrastructure Vulnerable to Cyber Attack

Software widely used in China to help run weapons systems, utilities and chemical plants has bugs that hackers could exploit to damage public infrastructure, according to the Department of Homeland Security.

The department issued an advisory on Thursday warning of vulnerabilities in software applications from Beijing-based Sunway ForceControl Technology Co that hackers could exploit to launch attacks on critical infrastructure.

See also:
SCADA Vulnerabilities Patched in Two Industrial Control Software from China
Chinese Weapon Systems Vulnerable To SCADA Hack
US warns China software risk to public infrastructure
US Warns of Problems in Chinese SCADA Software
Software bugs discovered in Chinese-made applications
China’s weapons systems have exploitable software bugs
Department Of Homeland Security Cites China Vulnerability
Exclusive: China software bug makes infrastructure vulnerable
US reveals Stuxnet-style vuln in Chinese SCADA ‘ware
Critical vulnerability in industrial control software

China is not our friend, why are we feeding the hand that bites us? Why aren’t we keeping these discovered Chinese vulnerabilities to ourselves in case we might actually need to use them in the event of escalated hostilities with China?

/and just when did the DHS become the CDHS, Chinese Department of Homeland Security, protecting the homeland of a hostile country?

Hackers With A Death Wish

It’s probably not a good idea to taunt the folks who tracked down Osama bin Laden and specialize in covert, extrajudicial killings.

CIA Web site hacked; group LulzSec takes credit

The hacker group LulzSec claimed credit Wednesday for taking down the CIA’s Web site for a couple of hours, the latest in a string of embarrassing Web site disruptions the group has pulled off — apparently more to poke fun and highlight vulnerabilities than to cause real damage.

At 5:48 p.m., LulzSec, which dubs itself “the world’s leaders in high-quality entertainment at your expense,” posted an alert on Twitter: “Tango down — cia.gov — for the lulz.”

The site was back up by 8 p.m.

See also:
Hacker Group Goes After CIA SiteLulzSec’s CIA hack just one of many high-profile hackings
LulzSec Speeds Up Cyber Attacks, Now Claims CIA Website Hack
Hackers say they hit CIA website
Hackers Claim CIA Website Breach
Hackers breach into CIA website
LulzSec claims responsibility for CIA.gov outage
Hackers claim hit on CIA website
Group claims to have hacked CIA website
Senate website, CIA.gov reportedly hacked. LulzSec claims responsibility. [Updated]
Lulzsec Claims Responsibility For Hacking CIA And Senate Websites
CIA website hacked; group claims ‘credit’
Central Intelligence Agency

Apparently, LulzSec stages these attacks for giggles, laughs, and bragging rights, which is all fun and games until they bite off more than they can chew by hitting an entity with unlimited resources and more hacking talent than they have, and then suddenly it won’t be so funny anymore. Maybe LulzSec already has and they just don’t know it yet.

/as Jim Croce warned, you don’t tug on Superman’s cape, you don’t spit into the wind . . .

Tuesday Fun With Microsoft

It’s another big one and the flaws are serious.

Microsoft Fixes 24 Bugs in June Patch Tuesday

Microsoft addressed 24 security vulnerabilities across 16 security bulletins in June’s Patch Tuesday update. This will be Microsoft’s second-largest Patch Tuesday in 2011 after April’s gargantuan release.

Microsoft patched the Windows operating system, all supported versions of Internet Explorer, Microsoft Office, SQL Server, Forefront, .NET/Silverlight, Active Directory and Hyper-V, the company said in its Patch Tuesday advisory released June 14. Of the patches, nine have been rated as “critical,” and seven have been ranked as important, according to Microsoft.

Microsoft called out four critical updates as top priorities on the Microsoft Security Response Center blog. They include a fix for all versions of the SMB Client on Windows (MS11-043), 11 bugs in all versions of Internet Explorer (MS11-050), another Windows flaw (MS11-052) and two issues in the DFS client for all versions of Windows (MS11-042), according to Trustworthy Computing’s Angela Gunn.

See also:
Microsoft Security Bulletin Summary for June 2011
Microsoft ‘Patch Tuesday’ Fixes 24 Flaws In 16 Updates
MS Patch Tuesday: Gaping holes haunt Internet Explorer browser
Patch Tuesday Fixes Dangerous Flaws with Exploits Imminent
Microsoft plugs 34 holes; Adobe fixes Flash Player bug
Microsoft patches critical IE9, Windows bugs
Patch Tuesday heralds a busy spell for admins
Microsoft Puts Out 16 Patches, 9 Critical, for June
Microsoft issues 16 bulletins, 9 critical including SMB, IE fixes
June Gloom: Microsoft Releases 16 Bulletins for Patch Tuesday
Windows Update

Damn, if Windows was a car that had been “repaired” this many times, it wouldn’t have any original parts left.

/anyway, get busy with the updating, don’t let the bad guys in, at least until they find new holes in Widows that Microsoft will have to patch next month

It’s Tuesday, Time To Download Microsoft Patches

And this Tuesday, there’s an extra big heapin’ helpin’ of downloadin’ fun!

Microsoft Issues Huge Patch Tuesday Fix for Windows, IE

Microsoft today released a batch of 17 security updates for a Patch Tuesday that cover 64 vulnerabilities in Microsoft Windows, Office, Internet Explorer, Visual Studio, .NET Framework and GDI+.

Nine of the bugs are rated critical, while eight are important. One of the “important” bulletins includes 30 vulnerabilities in one bug, MS11-034, and they all share the same couple of root causes, Microsoft said.

Microsoft identified three vulnerabilities as its top priority bulletins for the month: MS11-020, which resolves a problem with Windows that could allow remote code execution if an attacker created a specially crafted SMB packet and sent the packet to an affected system; MS11-019, another Windows bug that could allow remote code execution if an attacker sent a specially crafted SMB response to a client-initiated SMB request; and MS11-018, which could allow remote code execution if a user views a specially crafted Web page using Internet Explorer.

See also:
Microsoft Security Bulletin Summary for April 2011
Tackling the Massive Microsoft Patch Tuesday
Microsoft fixes IE, SMB bugs in big Patch Tuesday
Researcher confirms kernel bugs will dominate Patch Tuesday
Microsoft Smashes Patch Tuesday Record With Massive Update
Another Microsoft Patch Tuesday, 64 New Flaws To Fix
Microsoft Pushes Giant Security Patch
Microsoft delivers monster security update for Windows, IE
Microsoft Releases Torrent of Security Updates
Windows Update

It’s another record! Will Windows software ever be fully patched?

/probably not, so see ya next time, and have a good time downloading, this one takes quite a while!

Who Wants To Fly The Space Shuttle?

Apparently, all you need are some computer hacking skills. Unreal, how many years now has computer network cybersecurity been a known issue?

NASA Computer Servers Insecure, Open to ‘Catastrophic’ Attack

Computer servers on NASA’s mission network are at high risk for Internet-based attacks that could have “catastrophic” effects on the space agency, according to a Monday report.

Specifically, NASA’s Office of Inspector General (OIG) found that six computer servers associated with IT assets that control spacecraft and contain critical data have vulnerabilities that would allow a cybercriminal to remotely attack and take control of them.

Once inside, meanwhile, the attacker could then use those compromised computers to exploit other weaknesses, which could “severely degrade or cripple NASA’s operations,” the OIG found. Network servers also contained encryption keys, encrypted passwords, and user account information that were accessible to attackers.

What’s the problem? The OIG said NASA has been slow to act on a recommendation it made in May 2010 that NASA secure its networks. At that point, the OIG told NASA to immediately establish an IT security oversight program for its mission network, but as of February 2011, NASA had done nothing.

Read the report:

INADEQUATE SECURITY PRACTICES EXPOSE
KEY NASA NETWORK TO CYBER ATTACK

See also:
NASA spaceship control network vulnerable to hackers
Nasa computers that control spacecraft ‘vulnerable to crippling hacker attacks’
NASA audit warns of “catastrophic” consequences from lax information security
Critical NASA network was open to Internet attack
Report: NASA Vulnerable To Crippling Cyber Attacks
Serious security gaps found in NASA’s computer network
Report: Despite Earlier Warning, Nasa Still Vulnerable To Cyber Attack
NASA at “high risk” of data security breach
NASA computer servers vulnerable to attack: audit
According to an audit, the American Space Agency’s computer systems are highly vulnerable to computer attacks

With astronauts’ lives at stake, as well as our national prestige, you’d think NASA would be a lot more concerned and up to date with their computer security efforts and policies. And remember, these people are supposed to be America’s best and brightest in the technical and scientific arena. Thank God nothing disastrous has come about because of this glaring gap in common sense computer network operation security.

/kind of makes you wonder, if NASA is this lax and inattentive, how wide open and vulnerable are other critical government computer systems?

Hitting Us Where It Really Hurts

Whether or not “outside forces” were a factor in our 2008 economic meltdown, in the age of cyber warfare, the possibility of such an attack on the U.S. financial infrastructure is a scenario worth paying extremely close attention to. It’s a huge target, it’s far from invulnerable, and the potential for crippling economic damage and chaos cuts to the core of our very way of life.

Financial terrorism suspected in 2008 economic crash

Evidence outlined in a Pentagon contractor report suggests that financial subversion carried out by unknown parties, such as terrorists or hostile nations, contributed to the 2008 economic crash by covertly using vulnerabilities in the U.S. financial system.

The unclassified 2009 report “Economic Warfare: Risks and Responses” by financial analyst Kevin D. Freeman, a copy of which was obtained by The Washington Times, states that “a three-phased attack was planned and is in the process against the United States economy.”

While economic analysts and a final report from the federal government’s Financial Crisis Inquiry Commission blame the crash on such economic factors as high-risk mortgage lending practices and poor federal regulation and supervision, the Pentagon contractor adds a new element: “outside forces,” a factor the commission did not examine.

“There is sufficient justification to question whether outside forces triggered, capitalized upon or magnified the economic difficulties of 2008,” the report says, explaining that those domestic economic factors would have caused a “normal downturn” but not the “near collapse” of the global economic system that took place.

Suspects include financial enemies in Middle Eastern states, Islamic terrorists, hostile members of the Chinese military, or government and organized crime groups in Russia, Venezuela or Iran. Chinese military officials publicly have suggested using economic warfare against the U.S.

Read the report:

Economic Warfare: Risks and Responses

See also:
Financial Terrorism Suspected in 2008 Economic Crash
Did ‘financial terrorism’ cause the economic crash?
Did China or Jihadists try to bankrupt America? Pentagon report reveals financial terrorists may have triggered economic crash
Report: Economic 9/11 May Have Taken Place
Financial terrorism suspected in 2008 economic crash
Was the U.S. a victim of an economic 9/11 in 2008?
Blame Terrorists, Not Wall Street, for the Recession?

If you think about it, there’s very little that could be called a paper trail regarding today’s financial records and transactions world wide, it’s all manipulated and stored electronically at a speed and complexity that defies human oversight.

/definitely a fertile battlespace for a sophisticated enemy looking to bring the United States down on her knees in financial pain