MEEBO, Nuff Said!!!!

April 2009

Meebo is a new communications and media company that's re-writing the way people have conversations and communicate on the Web. We provide instant messaging and group chat to over 40 million people at meebo.com and via partner sites across the Web.

At meebo.com, millions of people every month keep in touch with friends on any IM network (AIM, Yahoo!, MSN, Google Talk and Gmail, MySpace IM, Facebook Chat, and more!) and chat with people in Meebo Rooms. Meebo also enables live communication integrated into any website with Meebo Rooms, Meebo Community IM, and Meebo Me. Meebo is the Web's live communication platform - instant messaging from absolutely anywhere, no downloads or installs required, and free!
Thanks meebo for making our lives a little easier...

MEEBO, Nuff Said!!!!

April 2009

Meebo is a new communications and media company that's re-writing the way people have conversations and communicate on the Web. We provide instant messaging and group chat to over 40 million people at meebo.com and via partner sites across the Web.

At meebo.com, millions of people every month keep in touch with friends on any IM network (AIM, Yahoo!, MSN, Google Talk and Gmail, MySpace IM, Facebook Chat, and more!) and chat with people in Meebo Rooms. Meebo also enables live communication integrated into any website with Meebo Rooms, Meebo Community IM, and Meebo Me. Meebo is the Web's live communication platform - instant messaging from absolutely anywhere, no downloads or installs required, and free!
Thanks meebo for making our lives a little easier...

!! ALERT !! The Cybersecurity Act of 2009... !! ALERT !!

APRIL 2009

Bill would grant President unprecedented cyber-security powers. The Cybersecurity Act of 2009 introduced in the Senate would allow the President to shut down private Internet networks. The legislation also calls for the government to have the authority to demand security data from private networks without regard to any provision of law, regulation, rule, or policy restricting such access. The headlines were all about creating a national cyber-security czar reporting directly to the President, but the Cybersecurity Act of 2009 introduced April 1 in the U.S. Senate would also give the President unprecedented authority over private-sector Internet services, applications, and software. According to the bill’s language, the President would have broad authority to designate various private networks as a “critical infrastructure system or network” and, with no other review, “may declare a cyber-security emergency and order the limitation or shutdown of Internet traffic to and from” the designated the private-sector system or network. The 51-page bill does not define what private sector networks would be considered critical to the nation’s security, but the Center for Democracy and Technology says it could include communications networks in addition to the more traditional security concerns over the financial and transportation networks and the electrical grid. The bill would also impose mandates for designated private networks and systems, including standardized security software, testing, licensing, and certification of cyber-security professionals.
THANKS R. Mark

Skyping on 1st Gen Touch

April 2009

There may be some of you out there that still have a 1st Gen or bought a Second Hand Touch. Well here is what you need to make telephone calls with it...

First Skype of course
and then
Macally iVoice III - For iPod Touch
For iPod Touch™ 1st Generation AND 2nd Generation

http://www.ehow.com/how_4880226_skype-first-generation-ipod-touch.html
Thanks eHow

Handy OS X Keyboard Shortcuts...

April 2009

FOR MAC AND NON MAC USERS!!!!!!!

GUIDE TO KEYBOARD SYMBOLS

KEY WHAT IT DOES
⌘ Command (sometimes referred to as the “Apple key”)
⌥ Option
⇧ Shift
⌃ Control
⎋ Escape

=========================

KEY COMBO

WHAT IT DOES
Command-H
Hides current app window (doesn’t work in all apps, particularly Adobe apps, which often use a different key combo for Hide, but it works in all Apple software and many other popular apps).

Command-Shift-3
Snaps a screenshot of the entire screen.

Command-Shift-4
Brings up crosshairs so you can draw a box around just the part of the screen you want to capture. (If you press Tab or Space after Command-Shift-4, then click on the window, you’ll get a clean shot of just that window, and nothing else.)

Command-Tab
Lets you tab through open applications to choose another app to switch to.

Command-Spacebar
Opens the Spotlight field without having to click its icon in the menubar.

Command-Option-Escape
Lets you force-quit a misbehaving or stalled app.

Guess What...A New Microsoft Vulnerability

April 2009

MULTI-STATE INFORMATION SHARING AND ANALYSIS CENTER CYBER SECURITY ADVISORY

DATE ISSUED:
4/2009

SUBJECT:
Vulnerability in Microsoft PowerPoint Could Allow for Remote Code Execution

OVERVIEW:
A new vulnerability has been discovered in Microsoft PowerPoint, a slide presentation program. This vulnerability can be exploited by opening a malicious PowerPoint presentation (.PPT or .PPS file) received as an email attachment, or by visiting a web site that is hosting a malicious PowerPoint file. Successful exploitation could allow an attacker to gain the same user privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

There are confirmed reports that this vulnerability is being used for specific targeted attacks although more widespread exploitation may occur when additional details regarding this vulnerability become available.

There is no patch for this vulnerability available at this time.

SYSTEMS AFFECTED:

o Microsoft Office 2000 Service Pack 3
o Microsoft Office 2002 Service Pack 3
o Microsoft Office 2003 Service Pack 3
o Microsoft Office 2004 for Mac

RISK:

Government:

o Large and medium government entities: High
o Small government entities: High

DESCRIPTION:
A new vulnerability has been identified in Microsoft PowerPoint that could allow remote code execution. This vulnerability is caused by an invalid object reference that can be exploited by opening a malicious PowerPoint presentation (.PPT or .PPS) via email attachment, or by visiting a web site that is hosting a malicious PowerPoint file. If Microsoft Office 2000 is being used, it will automatically open any Office documents, unless the Office Document Open Confirmation Tool for Office 2000 is installed. Microsoft Office 2003 or higher, by default will prompt the user to Open, Save, or Cancel when accessing Office files. Successful exploitation could allow an attacker to gain the same user privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

There are confirmed reports that this vulnerability is being used for specific targeted attacks although more widespread exploitation may occur when additional details regarding this vulnerability become available. Microsoft is reporting that the malicious PowerPoint presentations are being detected as Exploit:Win32/Apptom.gen.

There is no patch for this vulnerability available at this time.

RECOMMENDATIONS:
We recommend the following actions be taken:

o Consider follow Microsoft's suggested actions in their security advisory: http://www.microsoft.com/technet/security/advisory/969136.mspx
o Consider using the Microsoft Office Isolated Conversion Environment (MOICE - http://support.microsoft.com/kb/935865).
o Install the Office Document Open Confirmation Tool for Microsoft Office 2000

(http://www.microsoft.com/downloads/details.aspx?familyid=8B5762D2-077F-4031-9EE6-C9538E9F2A2F&displaylang=en).

o Do not visit un-trusted websites or follow links provided by unknown or un-trusted sources.
o Do not open email attachments from un-trusted sources.
o Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
o Ensure that all anti-virus software is up to date with the latest signatures.
o Install the appropriate vendor patch as soon as it becomes available after appropriate testing.

REFERENCES:

Microsoft:
http://www.microsoft.com/technet/security/advisory/969136.mspx
http://blogs.technet.com/msrc/default.aspx
http://blogs.technet.com/mmpc/
http://www.microsoft.com/security/portal/Entry.aspx?Name=Exploit%3aWin32%2fApptom.gen

Security Focus:
http://www.securityfocus.com/bid/34351

CVE:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0556

Cyber dudes sell fake software...Nahhhh

April 1, 2009

Cybercriminals manipulate search engines to sell fake software. According to research cited by BBC News, some cybercriminals could be earning as much as $10,000 a day by deceiving users into downloading their fake security software. Finjan, a computer security firm, reported new research that shows many cyber criminals continue to use so-called “scareware” to trick Web surfers into believing their computer is infected with a virus. Fraudsters use deceptive pop-up advertisements to convince users to buy their fake anti-virus software. “They are misleading people with evidence that their machine is infected with viruses and they are encouraging them to download and buy software that basically does nothing,” said the chief technology officer at Finjan. In order to reach susceptible Web users, the cybercriminals manipulate Web searches to direct them to the site where they are informed of a fake computer infection. In March 2009, the Anti-Phishing Working Group counted 9,287 fake anti-malware programs being sold on the Web in December 2008. That number accounted for a 225 percent increase since January 2008.

Well Well HP has a new tool...

April 1, 2009

Free tool from HP scans for Flash vulnerabilities. Hewlett-Packard has released a free development tool that finds vulnerabilities in Flash, Adobe System’s widely used but occasionally buggy interactive Web technology. The tool, SWFScan, is designed for developers without security backgrounds, the company said on one of its blogs. It was built by HP’s Web Security Research Group. HP said SWFScan joins other tools that can spot problems with Flash, such as Flare and SWFIntruder. But HP said SWFScan is the only one that can be used with Flash versions 9 and 10; ActionScript 3, Flash’s scripting language; and Flex, an open-source Web application framework used by Adobe. SWFScan will decompile ActionScript 2 and 3 into original source code and perform static analysis, looking for more than 60 vulnerabilities including data leakage, cross-site scripting vulnerabilities, and cross-domain privilege escalation, HP said. The tool highlights troublesome lines in source code and will also provide remediation advice. It will format a vulnerability report, as well as allow the export of source code for work in other tools, HP said. HP said it tested SWFScan on some 4,000 Flash applications and found that 35 percent violated Adobe’s best security practices. Sixteen percent of applications for Flash player 8 and earlier contained cross-site scripting vulnerabilities. Fifteen percent of those applications with login forms had user names or passwords hard coded into the application, HP said. HP cautioned that the tool only looks at the part of a Flash application that runs in a browser and not those parts running on a server.

Conflicker's Orgins...No Wolverwine (spoiler alert)

April 1, 2009

A search is launched for Conficker’s first victim. Where did the Conficker worm come from? Researchers at the University of Michigan are trying to find out, using a vast network of Internet sensors to track down the so-called “patient zero” of an outbreak that has infected more than 10 million computers to date. The university uses so-called Darknet sensors that were set up about six years ago to keep track of malicious activity. With funding from the U.S. Department of Homeland Security, computer scientists have banded together to share data collected from sensors around the world. ”The goal is to get close enough so you can actually start mapping out how the spread started,” said a University of Michigan graduate student who is working on the project. But that is not an easy job. To find the minuscule clues that will identify the victim, researchers must sift through more than 50 terabytes of data to find the telltale signatures of a Conficker scan. One of the ways that Conficker moves about is by scanning the network for other vulnerable computers, but it can be very difficult to spot it for certain, the graduate student said. “The hard thing is to find the exact Conficker scanning activity, because there is a lot of other scanning going on,” he said.

Hackers Penetrate Systems...

April 1, 2009

Expert: Hackers penetrating industrial control systems. The networks powering industrial control systems have been breached more than 125 times in the past decade, with one resulting in U.S. deaths, a control systems expert said on March 19. The managing partner of control systems security consultancy Applied Control Solutions, did not detail the breach that caused deaths during his testimony before a U.S. Senate committee, but he said he has been able to find evidence of more than 125 control systems breaches involving systems in nuclear power plants, hydroelectric plants, water utilities, the oil industry, and agribusiness. “The impacts have ranged from trivial to significant environmental damage to significant equipment damage to deaths,” he told the Senate Commerce, Science and Transportation Committee. “We have already had a cyber incident in the United States that has killed people.” At other times, the managing partner has talked about a June 1999 gasoline pipeline rupture near Bellingham, Washington. That rupture spilled more than 200,000 gallons of gasoline into two creeks, which ignited and killed three people. Investigators found several problems that contributed to the rupture, but the managing partner has identified a computer failure in the pipeline’s central control room as part of the problem. It could take the United States a long time to dig out from coordinated attacks on infrastructure using control systems, the managing partner told the Senators. Damaged equipment could take several weeks to replace, he said. A coordinated attack “could be devastating to the U.S. economy and security,” he said. “We are talking months to recover. We are not talking days.” The industrial control system industry is years behind the IT industry in protecting cybersecurity, and some of the techniques used in IT security would damage control systems, the managing partner added. “If you penetration-test a legacy industrial control system, you will shut it down or kill it,” he said. “You will be your own hacker.”

Password Virus Hacker...

April 1, 2009

New password-manipulating virus spreading. A new computer virus that attacks the computer password, manipulates and eventually blocks the user to log in to the computer is spreading, Yonhap reported on March 21. The virus, an advanced form of “Win32.HLLW.Shadow.based” that showed up last month, locks up the computer, resulting in log in error. It also paralyzes the network by overloading the traffic on the 445 port. A free vaccine is available on the Web site of the anti-virus company, New Technology Wave. The vaccine provider also advises computer users to regularly change their computer passwords and update Windows security patches. Once infected, the virus detours the radar of the previously installed vaccine program on the computer and makes it undeletable, the company said.

Screen Capture for Mac OSX

April 1, 2009

For all of you that need to capture screen shots for tutorials
on a Mac, this program is free and it gets the job done.
Check it out!!!

Don't type it, iShowU it
Need to show something to someone? iShowU is your answer! iShowU is designed to record anything on your screen, instantly — both audio, and video!

If a picture is worth a thousand words, then a movie is worth a million. Imagine the time you'll save writing Grandma an email about how to magnify her dock when you can just shoot a movie in seconds.

DHS Warns....(snicker)

April 1 2009



Press Office
U.S. Department of Homeland Security


Press Release

March 30, 2009
Contact: DHS Press Office, 202-282-8010

DHS RELEASES CONFICKER/DOWNADUP COMPUTER WORM DETECTION TOOL
Tool Allows Critical Partners to Assess Risks to Their Systems

WASHINGTON – The U.S. Department of Homeland Security (DHS) announced today the release of a
DHS-developed detection tool that can be used by the federal government, commercial vendors, state
and local governments, and critical infrastructure owners and operators to scan their networks for the
Conficker/Downadup computer worm.

The department’s United States Computer Emergency Readiness Team (US-CERT) developed the tool
that assists mission-critical partners in detecting if their networks are infected. The tool has been made
available to federal and state partners via the Government Forum of Incident Response and Security
Teams (GFIRST) Portal, and to private sector partners through the IT and Communications sector
Information Sharing and Analysis Centers (ISACs). Additional outreach to partners will continue in the
coming days.

Department cyber experts briefed federal Chief Information Officers and Chief Information Security
Officers today, as well as their equivalents in the private sector and state/local government via the ISACs
and the National Infrastructure Protection Plan framework.

“While tools have existed for individual users, this is the only free tool – and the most comprehensive
one – available for enterprises like federal and state government and private sector networks to
determine the extent to which their systems are infected by this worm,” said US-CERT Director Mischel
Kwon. “Our experts at US-CERT are working around the clock to increase our capabilities to address
the cyber risk to our nation’s critical networks and systems, both from this threat and all others.”

In addition to the development of this tool, DHS is working closely with private sector and government
partners to minimize any impact from the Conficker/Downadup computer worm. This worm can infect
Microsoft Windows systems from thumb drives, network share drives, or directly across a corporate
network if network servers are not protected by Microsoft’s MS08-067 patch.

US-CERT recommends that Windows Operating Systems users apply Microsoft security patch MS08-
067 (http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx) as quickly as possible to help
protect themselves from the worm. This security patch, released in October 2008, is designed to protect
against a vulnerability that, if exploited, could enable an attacker to remotely take control of an infected
system and install additional malicious software.



Home users can apply a simple test for the presence of a Conficker/Downadup infection on their home
computers. The presence of an infection may be detected if users are unable to connect to their security
solution Web site or if they are unable to download free detection/removal tools.

If an infection is suspected, the system or computer should be removed from the network. In the case of
home users, the computer should be unplugged from the Internet.

Instructions, support and more information on how to manually remove a Conficker/Downadup infection
from a system have been published by major security vendors. Each of these vendors offers free tools
that can verify the presence of a Conficker/Downadup infection and remove the worm:

Symantec:
http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-011316-0247-99

Microsoft:
http://support.microsoft.com/kb/962007
http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx
Home users may also call Microsoft PC Safety hotline at 1-866-PCSAFETY, for assistance.

McAfee:
http://www.mcafee.com/us/threat_center/default.asp

US-CERT encourages users to prevent a Conficker/Downadup infection by ensuring all systems have the
MS08-067 patch, disabling AutoRun functionality (see http://www.us-cert.gov/cas/techalerts/TA09-
020A.html), and maintaining up-to-date anti-virus software.

In addition, US-CERT recommends that computer users and administrators implement the following
preparedness measures to protect themselves against this vulnerability, and also from future
vulnerabilities:

• Keep up-to-date on security patches and fixes for your operating system. The easiest way to do
this is to set your system to receive automatic updates, which will ensure you automatically
receive security updates issued by Microsoft. If your system does not allow automatic updates,
we recommend that you manually install the Microsoft security patch today through Microsoft
Update at http://update.microsoft.com/microsoftupdate
• Install anti-virus and anti-spyware software and keep them up-to-date
• Enable a firewall which will help block attacks before they can get into your computer

To access the alerts for this vulnerability and for additional information on cyber security tips and
practices, please visit www.us-cert.gov.

###

More Conflicker Scare Tactics!!!

April 1 2009

The US-CERT has a provided a tool to assist with the identification of computers infected with Conficker. The tool is available for download at the following URLs. The last link is the installation instructions.



ftp://disftp.state.ar.us/pub/NT/AntiVirus/ConfickerSnitcher/domains.conf

ftp://disftp.state.ar.us/pub/NT/AntiVirus/ConfickerSnitcher/install.vbs

ftp://disftp.state.ar.us/pub/NT/AntiVirus/ConfickerSnitcher/setup.conf

ftp://disftp.state.ar.us/pub/NT/AntiVirus/ConfickerSnitcher/ConfickerSnitcherv29.doc



The SANS Institute has also released a list of vendors which have publicly available tools and instructions for Conficker removal. You can access this list by using the following link:


http://isc.sans.org/diary.html?storyid=5860



The Conficker worm is set to do something on April 1, so please take advantage of the identification and removal information before the Wednesday. The extent of the impact of the Conficker worm is unknown, but there are information and tools to help you learn more about it and be prepared now.

More Conflicker Scare Tactics!!!

April 1 2009

The US-CERT has a provided a tool to assist with the identification of computers infected with Conficker. The tool is available for download at the following URLs. The last link is the installation instructions.



ftp://disftp.state.ar.us/pub/NT/AntiVirus/ConfickerSnitcher/domains.conf

ftp://disftp.state.ar.us/pub/NT/AntiVirus/ConfickerSnitcher/install.vbs

ftp://disftp.state.ar.us/pub/NT/AntiVirus/ConfickerSnitcher/setup.conf

ftp://disftp.state.ar.us/pub/NT/AntiVirus/ConfickerSnitcher/ConfickerSnitcherv29.doc



The SANS Institute has also released a list of vendors which have publicly available tools and instructions for Conficker removal. You can access this list by using the following link:


http://isc.sans.org/diary.html?storyid=5860



The Conficker worm is set to do something on April 1, so please take advantage of the identification and removal information before the Wednesday. The extent of the impact of the Conficker worm is unknown, but there are information and tools to help you learn more about it and be prepared now.

Happy Fools Conflicker Day!!!

April 1 2009

As you may be aware, several variants of a worm called Conficker have been circulating around the Internet. The latest variant, Conficker C is programmed to do “something” on April 1, but security experts do not know what that “something” is. What is known about Conficker C is that it disables some security measures, disables Windows automatic updates and is very hard to detect. The variants of the Conficker worm have spread through network shares and through portable media devices such as USB drives.



There are some preventative measures that you can take on your organization’s networks to be prepared:

· Update patches on the machines on your network

· Make sure your anti-virus software is updated and scan your machines

· Disable autorun on removable media devices

· Monitor local network traffic for high peer to peer traffic

· Use host-based firewalls

· Disable network shares when possible



For more information about the Conficker C worm, you can refer to the following websites:

· http://mtc.sri.com/Conficker/addendumC/

· http://arstechnica.com/security/news/2009/03/confickerc-primed-for-april-fools-activation.ars



The Security Office will continue to monitor the state network for activity related to this worm. The impact of the April 1 date is unknown, but I recommend you take preventative measures now.
Thanks K Patterson