March 2006 - Posts

Users guide for email safety

I am often asked by family and business associates, what they can do to protect themselves from malicious emails. There are many email best practices on the internet, but I find that many are specific to home users or buisiness users. I also find that some are outdated as the times and methods have changed. I wanted to put together a general email best practices guideline that would apply to all computer users and hopefully stand the test of time. I have read many best practices guidelines and over time identified methods that I thought were the best. I created this document with those methods in mind.

 

Users guide for email safety

 

Readiness. Are you ready to receive e-mail? Does your computer have the latest patches for your particular operating system? Do you have anti virus software, and is up to date? Do you have a folder designated as “Infected” for detaching files and scanning them with the anti virus software? Is your email client configured to use “Plain Text Mode”? Do you have the “Preview pane” turned off?  Do you have your email client configured so that attachments are not automatically launched so that you manually have to detach files?

Education. Are all of your team or family members educated on safe email practices and how to avoid malicious software? Do you recognize that threats change and that continuous education on safe practices will help you reduce your risk from malicious threats?

Assume that any email is malicious, even if you know the sender. Often, email addresses are harvested from infected computers and malicious emails are sent to the harvested email addresses. This increases the chance that a malicious email may come from family, friends, or business associates. By assuming every email is malicious until you take the steps necessary to determine that the email is reasonably safe, you will greatly reduce your risk of infection.

Do you know who is sending the email? Is the email from someone that you know? Has this sender sent you an email before? Is the sender known to participate in risky email practices, such as the forwarding of jokes or chain mails?

Expect. Are you expecting email from the sender? A malicious email may often arrive from someone you know. If you were not expecting an email, confirmation is key. A quick telephone call is one way to help you determine if a suspicious email is legitimate. You may want to delete or quarantine any emails that you did not expect to receive.

Make Sense. Does the email make sense? Is the subject line spelled correctly? Does the subject correspond with the attachments or the body of the email? Does the body of the email contain misspellings? If the email is from your grandma, would you expect an email that said “This girl is da Bomb ;) check out the pics”.

Avoid hoax messages that use social engineering tactics to get you to do something, even if it is from an authoritative figure such as “administrator” or “Microsoft”. Avoid going to any URLs or web links in emails. It is best to only go to mainstream websites, and to manually type the address into the browser. Avoid emails that suggest that you should alter your computer; the “fix” is often the malicious activity that the sender was hoping to manipulate you into doing.

Inspect emails carefully. Delete or quarantine any emails that look suspicious or do not pass the aforementioned checks. Check attachments for misspellings and look for double or long extensions such as “cool.txt.exe” or test____________.exe. “Fun” emails that have animations or free games are often malicious. Detach attachments manually to the “Infected” folder you created. Scan the folder with your virus scanner before opening them.

 

Learn from your actions. There is no silver bullet in security. There is always a risk involved in computing, even if you follow the rules. Learn from your mistakes, as well as, from the things you do right. It is important to stay up to date on new threats and to continuously monitor your actions to reduce the risk of infection or data theft.

Anti-Virus for Cats

I read an article about a school that developed a self-replicating RFID virus. My first thought was that my dog could get infected with a virus while out for a walk. I didn’t get a chance to post to my blog after reading the article, so it looks like F-Secure beat me to the punch. Therefore, I concede and the title of this post reflects that. They posted some great links, an this is a very interesting read.

http://www.f-secure.com/weblog/#00000835

Posted by Anonymous | with no comments

Microsoft Security Updates 14MAR06

Mar 14, 2006 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (905413): MS06-012

Affected Software: Word 2000, Office 2000, Outlook 2000, PowerPoint 2000, Word 2002, Excel 2002, Outlook 2002, PowerPoint 2002, Office XP, Excel 2003, Works 2000, Works 2001, Works 2002, Works 2003, Works 2004, Works 2005, Works 2006, Excel v. X for Macintosh, Excel 2004 for Macintosh
Word 2000 SP3, Office 2000 Service Pack 3, PowerPoint 2000 SP3, Word 2002 SP3, Excel 2002 SP3, Outlook 2002 SP3, PowerPoint 2002 SP3, Office XP SP3 , Excel 2003 SP1, Excel 2003 SP2, Works 2000 Gold, Works 2001 Gold, Works 2002 Gold, Works 2003 Gold, Works 2004 Gold, Works 2005 Gold, Works 2006 Gold, Excel v. X for Macintosh Gold, Excel 2004 for Macintosh Gold Critical
Mar 14, 2006 Permissive Windows Services DACLs Could Allow Elevation of Privilege (914798): MS06-011

Affected Software: Windows XP Home Edition, Windows XP Professional, Windows Server 2003 for Small Business Server, Windows Server 2003, Datacenter Edition, Windows Server 2003, Enterprise Edition, Windows Server 2003, Standard Edition, Windows Server 2003, Web Edition, Windows Server 2003 Datacenter Edition for Itanium-based Systems, Windows Server 2003 Enterprise Edition for Itanium-based Systems
Windows XP Service Pack 1, Windows Server 2003 Gold, Windows Server 2003 for Itanium-based Systems Gold Important
Posted by Anonymous | with no comments

POC Virus infects Microsoft InfoPath 2003 files

F-Secure is reporting that a proof of concept virus will infect InfoPath's .xsn files. A description of the virus named Icabdi.A  can be found here.

Posted by Anonymous | with no comments

No Backdoor for Vista

I previously posted a link to a story that the UK Gov wants a backdoor in Windows Vista . Microsoft told the Register that Microsoft has not and will not put backdoor's into windows.

http://www.theregister.co.uk/2006/03/06/nada_vista_backdoor/

"A Microsoft spokeswoman told The Register: "Windows Vista is engineered to be the most secure version of Windows yet. It is our goal to ensure enterprise users have full control over information on their PCs Microsoft has not and will not put 'backdoors' into Windows, its BitLocker feature, or any other Microsoft Products."

Just to make assurance twice sure, a Microsoft developer has waded into the debate. The idea that Microsoft is working with governments to create a back door into BitLocker-encrypted data would only happen "over my dead body", Niels Ferguson writes on the Microsoft System Integrity Team Blog titled Back-door nonsense."

Posted by Anonymous | with no comments