Turn off Autorun - yet another reminder

Tony Bradley makes a great point on the Hack Report site about Autorun. Sure it seems convenient that when you load in a CD, DVD, or USB stick to take some automatic actions. Isn't is great to have the new Springsteen disc start to play once you put it in?

Actually, not so much. If any of that media is malicious, you've got no defense. If you remember back to the original Sony Rootkit issue from a few years back, most folks ended up installing the rootkit because they had Autorun engaged and the software automatically launched when the disc was loaded.

It was my Velvet Revolver disc that infected me. But I'm reasonably technical, so I was able to remove it pretty quickly.

I've already posted about this back in September in Autorun can be hazardous to your health. But I think it's important enough to mention it again.

So do yourself a favor and turn off Autorun. Detailed instructions are in Step 2 of Security Mike's Guide.

Security Mike Update: QuickTime 0day attack

The QuickTime 0day is out there and has gotten a lot of press this week. I've published an Update notification for Security Mike Members. Check out the Portal for instructions on how to deal with the issue. For the most part, the configurations shown in Security Mike's Guide protects against the QT attack, but there are exceptions.

Once again, thinking before you click is a good thing to do.

I'm back

My little flirtation with blogging using the capabilities built into Security Mike's Portal didn't last too long. It turns out Blogger is really a great blogging platform and the stuff built into the Portal sucks. Sucks really bad.

Sorry for the little diversion. If you have subscribed to the Feedburner feed (either through RSS or email) you don't have to do anything. If you do check out the web page, once again set your phaser to stun and point it at Security Mike's Blog.

Firefox 2.0.0.10 Update Posted

Another day, another Security Mike Update. This time Mozilla has updated the Firefox browser to 2.0.0.10 to address a pretty serious URI handling issue.

Step by step instructions are available on the Portal. Once you log in, hit PAGES, then SECURITY MIKE'S UPDATES, then PATCHES and you'll see the Update.

TinyURL could be hazardous to your health

As mentioned in this post by PR aficionado Steve Rubel, the TinyURL service went down briefly, which potentially leaves lots of other services in the lurch.

Personally, I felt no pain because TinyURL was down. That's because I don't use it and I don't think you should either.

Why? Because it allows potential attackers to hide bad URLs. Indulge me for a second, if an attacker wanted to get you to click on a link and browse to a web page with malicious cargo, all they would have to do is send you a spam email with a TinyURL link.

Most people would just click on it and their machine would be compromised. But since you are reading Security Mike's Blog, you aren't most people. Thus, you'll get into the habit of not clicking on any obscured links - like TinyURL provides.

I know the TinyURLs are much prettier. Beauty is only skin deep - remember that.

Apple Mac OS X 10.4.11 Update Posted

As part of Security Mike's update service, subscribers get step-by-step instructions on how to apply the most recent patches from the major OS vendors.

Last week, Apple released a MASSIVE patch which updates the OS X operating system to version 10.4.11.

If you are a Security Mike member and have registered for the Portal, you can get detailed instructions at this link:
https://www.securitymike.com/site.php/spgs/read/apple-osx-update-nov-2007/

If not, you can subscribe at this link:
http://buy.securitymike.com

I've moved to Security Mike's Portal

I'll no longer be posting to this blog. I've moved over to Security Mike's Portal.

If you get the feed via RSS or email, you don't have to change anything.

If you come to the Website, then you'll need to head over to:
https://www.securitymike.com/site.php/blog/read/security_mikes_blog/

See you there!