Make sure it's really Microsoft Update

The innovation on the part of the bad guys continues to amaze. Per SC Magazine, these folks are using some URL obfuscation to get you to a Microsoft Update imposter site. F-Secure is credited with finding the bad site, and there are lots of details on their blog site.

Finnish anti-virus firm F-Secure warned Friday that a new malware-laced Microsoft Update page has appeared in the wild and is hosted on a URL that incorporates the actual Microsoft Update address – microsoft.com/cfm48 – with a period substituted for a forward slash.

The slightly modified URL takes the victim to a fake Microsoft Update “welcome” page that prominently features an urgent notice telling the visitor to install a “critical Windows XP/2000/2003/Vista update!” Install is mispelled on the bogus update page (“intall”), F-Secure reported.

An “Urgent Install” button appears in the fake notice, next to a prompt reading “Get critical update (obligatory).” Users who click on the button receive a file labeled WindowsUpdateAgent30-x86-x64.exe, which installs a trojan-dropper on the victim's PC. F-Secure said the bogus update page is a “fast flux” site and uses a wide range of IP addresses attached to the “cfm48.com" portion of the URL.

If you are a consumer, what to do? Basically, make sure you launch Microsoft (or Windows) Update yourself. DO NOT click on a link that you get via email. Launch Microsoft Update and then it will take you to the correct update site. Scrutinize the address in the bar and make sure it's really a Microsoft site.

And just be aware. That's usually the best defense.

February Patch Tuesday - Making up for Lost Time

I sure hope we weren't lulled into a false sense of security by the very light January Patch events (only two fixes shipped). This month, we make up for lost time with 11 new patches to install. 6 critical, but all the same - just install them all. Better safe than pwned.

You can get the specifics of the patches from NetworkWorld or directly from the Microsoft Security Response Center.

Later today, updates (with screenshots of all the updates you should have installed) for Vista, XP, and two flavors of Mac (Leopard and Tiger) will be up on Security Mike's Portal. Log in to get the latest and greatest.

It's Exploit Wednesday - Are you patched?

As described on Monday, Microsoft issued their monthly set of patches yesterday. There were 6 in all (as opposed to the 7 that they previewed). 4 are critical and have to do with Windows, Office and SharePoint.

Regardless of how Microsoft grades their patches, you should install them as quickly as possible. Once the patch is out there, the bad guys can reverse engineer the attack. That's why I have proclaimed the day after Patch Tuesday to be "Exploit Wednesday" as well start to see these attacks in the wild - as early as today.

So run Microsoft Update on your machine and install the patches. Here is the list of patches you should be applying. If there are no patches listed, then click the link to "check for updates" to make sure you've got the latest patches.



Once it is done, you can check the history to ensure the patches happened successfully.

October Patch Tuesday is coming!

That's right, it's that time of the month. For Patch Tuesday that is. Microsoft's monthly ritual of updating their software to fix bugs and close security holes. As part of Security Mike's Update Service, you'll get an analysis of each month's updates and also a few screen shots to help you ensure the patches were installed correctly.

Since Security Mike's Portal doesn't launch until October 15, I'll post this month's analysis on the Blog and then on Tuesday post the screen shots to confirm your successful update.

This month Microsoft is issuing 7 updates - 4 of them critical. But regardless of how Microsoft grades their updates, you need to get in the habit of making sure the patches are applied as soon as possible.

So look for a more detailed analysis on Tuesday.