Security Smorgasbord, vol 1 no 8

Microsoft's last "Patch Tuesday" update of 2009 (and the entire decade) is out. The most important news is a fix for a Day Zero vulnerability in Internet Explorer that is currently being exploited by the Bad Guys. Windows users, head on over to Microsoft for security goodness. Microsoft rates this as "Critical", and SANS ups that to "PATCH NOW", so don't dawdle.

And this applies to Internet Explorer 8 users - there are security fixes for problems that only effect IE8. I've said some good things about IE8, and it's not fair to complain about security bugs in a browser. All browsers have security bugs. I still don't like Microsoft's "wait until Patch Tuesday" for browser fixes, though. This is the main reason that you'll be better off with Firefox.

---------------------------------------------------

Another month, another heinous security hole in Adobe's Flash Player. You know, the thing that makes the movies on Saturday Redneck play. This is also rated "Critical", so make sure you click on over. It'll be painless. Since Flash is pretty much everywhere on Al Gore's Intarwebz, it's a Hacker Mecca.

---------------------------------------------------

Remember the guy who hacked into Sarah Palin's email? Well, his lawyers say it wasn't his fault - his computer was infested with Malware:

The contention may be used at trial to support arguments that the 21-year-old student son of a Tennessee Democrat politician was not personally responsible for the hack on a Yahoo! account maintained by the former Alaskan governor, which was traced back to an IP address used by Kernell.

...

The so-called Trojan defence was successfully used by accused hacker Aaron Caffrey, an Asperger's sufferer charged with using systems run by the Port of Houston to run a DDoS attack, crashing servers in Texas in the process. Caffery was cleared after a jury found him not guilty of hacking offences at the end of a week-long trial back in 2003, despite the fact that expert witnesses found no evidence of Trojan infection on his PC.

I guess they like their chances better with this than their old "if the defendant's a twit, you must acquit" gambit.

I'm unimpressed. Malware targeting Sarah Palin's email account? That would be something to see.

----------------------------------------------------

Hackers get slap on wrist for breaking into Los Angeles traffic control computers:

Two men who broke into the computer system that controls Los Angeles, California's traffic signals have been sentenced to two years probation. Gabriel Murillo and Kartik Patel accessed the computers in 2006 during a labor strike and reprogrammed certain signals to create significant traffic backups at intersections. The men must also pay US $6,250 in restitution and perform 240 hours of community service.

Sigh. We'll see more of this until someone dies, whereupon the courts will start taking it seriously.

-----------------------------------------------

Holiday greeting scam flogs malware:

Festive miscreants have begun using Xmas-themed lures to push the Koobface worm.

The attack starts off with post from fake or pwned Facebook profiles that point to supposed video clips. Following these links takes users to a fake YouTube site that claims users need to install a Flash Player update to watch these "movie clips".

In reality this supposed codec is the download component of the Koobface worm, an approach seen several times over recent months with previous versions of the worm.

Remember, you never need a new codec or an update to Flash to view something.