Smokey's Security Weblog

veritas odium parit

[NEWS] Malwarebytes Acquires Junkware Removal Tool (JRT)

Exciting news, the Junkware Removal Tool (JRT) acquisition by Malwarebytes will make the outstanding malware removal tool Malwarebytes Anti-Malware MBAM (detects and removes e.g. worms, trojans, rootkits, rogues, spyware, and more)  stronger and better.

MBAM Press Announcement:

SAN JOSE, CA – June 22, 2015 – Malwarebytes, the company founded to protect people and businesses from sophisticated malware attacks, today announced the acquisition of Junkware Removal Tool, a security program that searches for and removes potentially unwanted programs (PUPs) such as adware, spyware, and toolbars. The acquisition will integrate its definitions and tactics into the Malwarebytes product line.

Junkware Removal Tool owner and developer, Filipos Mouliatis, will also be joining Malwarebytes Labs out of Houston, Texas. “Malwarebytes is a highly respected anti-malware and anti-exploit company that I’ve known of for years, so I was excited to hear about the possibility of working together,” said Mouliatis. “I look forward to helping further develop software that will destroy potentially unwanted programs such as adware and spyware.”

“Let’s face it, PUPs are a growing problem, and the Junkware Removal Tool is a fantastic addition to strengthen our ability to address them,” said Malwarebytes founder and CEO Marcin Kleczynski. “We’re proud to be integrating this technology. Not only that, Filipos’ creativity and ingenuity are great additions to the Malwarebytes team. With this move and others to come, we’re doubling down on expanding our PUP protections, and our customers will see the benefits very soon.”

Junkware Removal Tool is a popular download on sites such as CNET, MajorGeeks, and BleepingComputer.com. The security utility consistently ranks in the top 10 downloaded Windows apps on all three sites, and has had more than 4 million downloads on BleepingComputer.com alone.

“At BleepingComputer.com, we’ve found that adware and PUPs have increasingly become one of the largest sources of problems for our visitors,” said Lawrence Abrams, owner of BleepingComputer.com. “With Malwarebytes and Junkware Removal Tool being two of the most popular downloads, it’s going to be exciting to see how these two programs will join forces to further protect our visitors against adware and PUPs.”

Malwarebytes has already taken an aggressive stance on targeting and removing PUPs, adware, spyware, and grayware. Acquiring Junkware Removal Tool reinforces its commitment to fighting not only harmful and deceptive PUPs, but also annoying and misleading ones.

The integration of Junkware Removal Tool within Malwarebytes Anti-Malware will take place over the next few months. The stand-alone JRT program will remain intact for those who wish to use it.

Announcement source: Malwarebytes Press Center

Malwarebytes Anti-Malware (MBAM) homepage: here

June 22, 2015 Posted by | Uncategorized | , , , , , , , , , , , | Leave a comment

Review Updated 2015 MateGo MG380G Full HD – SONY CMOS sensor – built-in-GPS Dashcam Car DVR

I bought the MateGo MG380G dashcam because used hardware is similar to the popular and very well reviewed Panorama G (Street Guardian SGZC12SG) cam, body and hardware are identical with eachother so there’s no difference at all between the cams.

MateGo MG380G specifications:

– A+++ build quality
– FULL HD 1920x1080p@30fps, 1280x720P@60fps
– 2.7″ Smart “Capacitive” LCD Touch Screen
– 2015 Sony Exmor IMX322 CMOS Sensor
– 7 Element Glass Lens / 154 degree panorama diagonal viewing angle
– Built-in GPS with Auto Date Time Set
– BOSCH Event G-sensor
– Motion Detect
– Photo / Driving Recording / Parking Recording / Emergency Recording
– 15Mbit/s Bitrate H.264 MP4
– Built-in MIC, Speaker
– High Heat resistant Supercapacitor
– Outstanding Day and Night Vision
– Built-in wide dynamic rage (WDR) image processing
– Wide operating temperature range from -20 to 70˚C
– Support A/V output
– Power supply: direct 12/24V and Micro USB 5V/1A
– Up to 128GB SDXC/SDHC Card (Class 10 Required)

In the box: MG380G, Suction Cup Mount, 12/24v Power Cable, USB Cable, English User Manual.

Physical casing of the MG380G has very good build quality, compared with other dashcams I had before the MG380G has best build quality.

Using the cam the first time in my car was very easy and uncomplicated, connected the cam to car’s 12/24V power supply and the cam was recording straight away, without any prob. You can also connect the cam with the micro usb port to provide the cam with power, this worked flawlessly too. Only thing you have to adjust the very first time you power-up the cam is date/time and timezone, however future date/time adjustments aren’t demanded anymore because integrated GPS module will adjust such automatically.

The GPS module is working extremely well, after power up the cam there is a GPS fix within just a few seconds. During recording there is also no lost of GPS signal/fix so the module is like the cam itself of high build quality.

The cam has a top quality 2.7″ Smart “Capacitive” LCD Touch Screen, this is the reason settings adjustment is very easy. Touch screen is reacting very well.

The cam has exFAT formatting firmware so no need to format a high capacity SD card in your PC before use, just stick your (SDXC/SDHC) SD Card in the cam and the cam will format high capacity SD cards >64Gb in exFAT. FWIW I tested the cam with 4, 8, 16,32, 64 and 128GB cards and all cards were working without any glitch. I also tested the cam with Micro SD Cards with adapter, that worked fine too. Important: don’t format a (new) SD Card in your PC, let the dashcam do that job.

Cam has an 2015 updated Sony Exmor IMX322 sensor with excellent quality “WDR” function integrated, it provides superb quality night time recording, the best I have seen till yet. Day time recording quality is also very good.

Lens is capable of taking in 1080p footage at 30fps with a real viewing angle of 154 degrees, this is the reason this cam will miss absolutely nothing.

Noteworthy is the fact this cam use a capacitor instead of a battery, this means that the cam has no problems at all with high temperatures in your car.

Cam firmware is working very well, OTOH no possibility to fine-tune recording settings like e.g. White Balance and EV.To be honest this cam don’t need fine-tuning at all because the cam is adjusting all settings demanded for best recording quality automatically. But: many people want to have the possibility to make some adjustments by themselves.

Summarizing: the MG380G is probably best bang for the buck, it’s a top-notch dashcam with very good build quality. Used hardware is recent and up-to-date, all hardware components are of high quality. Daytime time recording quality as well recording quality during night is superb. Firmware needs improvements. Included USB cable is too short however included 12/24V power cable is long enough.

I know you can buy much cheaper dashcams, same is valid for more expensive cams. But please consider that this cam is very reliable and therefore will provide you with that what really counts: useful proof at the moment you need such, e.g after a car accident. I can recommend this cam without any hesitation.

Important issue: where to purchase an action/dashcam? You can buy them on many places like e.g. Amazon, eBay, AliExpress, Dx.com, local vendors and online dealers/vendors. It’s hard to find a reputable vendor not only selling quality cams but also providing good support and service during and after the purchase. And keep in mind, a good feedback score on sites like e.g. Amazon, eBay or Dx.com isn’t a guarantee that seller is reliable. Personally I had very bad experiences with a well-known eBay dashcam seller located in China (as I described in a previous blogpost) so many times it’s a matter of having good luck to find a decent seller. I bought my MG380G in the JooVuu online shop, seller is located in England and I’m really satisfied with JooVuu. From own experience I know JooVuu is very serious, provides quality cams and service and support is top-notch. Additional advantage of JooVuu: they have own staff in China too. So don’t only look at dashcam price when you have the intention to buy a cam, service and support is equal (and probably even more) important.

May 31, 2015 Posted by | Action & Dash Cam Talk: News, Reviews, Tests, Comparisons | , , , , , , , , , | Leave a comment

Most recent firmware download for Seezeus Shadow Recorder GT550WS

For security reasons on the road I use a dashcam (dashboard camera) in my car, like many others also do. My dashcam choice to use was a Seezeus Shadow Recorder GT550WS GPS 2.7″ LCD HD 1080p WDR GPS Logger Dash Cam Car DVR + GPS module, this for reason of the fair price, many useful features/options and very good clear picture quality by daylight as well at night.

Why to use a dashcam? The answer is simple: to be able to provide video evidence in an event of an accident, there are many idiots on the road and it can become very handy in case such an idiot will cause an accident. But not only pure idiots on the road, also many careless people aren’t watching the road in the way it should be, they use their cellphone, laptop, navigation and other equipment during driving and lose demanded attention for what’s really going on.

I noticed there’s a real need for dashcam firmware updates, many people are looking for it but can’t find a download source. That’s the reason I offer you the most recent firmware v2.6G for the Seezeus Shadow Recorder GT550WS. Keep in mind this firmware is only suitable for mentioned dashcam, don’t try to flash it on a different dashcam. And when you brick your dashcam during a firmware flash you will lose dashcam vendor/seller warranty.

On Google Drive you can download the GT550WS most recent firmware v2.6G here YouTube instructions how to flash the firmware here It’s an instruction movie for a different dashcam however firmware flash procedure for the GT550WS is similar.

Drive safely!

Update May 31, 2015: I bought the cam first week of December 2014 from a eBay seller named estore009, located in China, and received the item more than 1 month later, in the middle of Jan. 2015. Starting with the first day I used the cam there were problems: with the firmware, with a faulty GPS module, cam also stopped regularly with recording, and finally the cam freezes on the start screen during boot-up and therefore is the cam useless now forever. Mind you this all happened within 4 months after I used the cam for the first time, and long delivery time also didn’t make me happy at all. You will understand atm I’m really pissed, and asked seller estore009 for a refund. Seller isn’t willing to do so, and even don’t want to talk about a partial refund. IMO after all the problems I had with the cam seller should provide decent service hence a refund could be the only acceptable solution but as told before seller refused such. Therefore my advice: stay far away from estore009, items sold by him are or could be faulty, service is a non existing word for him.

March 1, 2015 Posted by | Action & Dash Cam Talk: News, Comparisons, Reviews, Tests | , , , , , , | Leave a comment

[How-to] Vulnerability test Superfish, Komodia, PrivDog & similar

Probably you have heard about the Lenovo debacle, many of their laptop series are preloaded adware/spyware Superfish (you can also call Superfish a dirty piece of malware) that will intercept all your secure connections and this will allow criminals to do it too. Superfish uses an “SSL hijacker” (Komodia Redirector with SSL Digestor) and an untrustworthy Komodia root certificate. Komodia Redirector with SSL Digestor installs non-unique root CA certificates and private keys, making systems broadly vulnerable to HTTPS spoofing. In this way an attacker can spoof HTTPS sites and intercept HTTPS traffic without triggering browser certificate warnings in affected systems.

Many other softwares do similar because Komodia sold its malicious kit to other companies as well, some of these companies/vendors are e.g. Atom Security, Inc, Infoweise, KeepMyFamilySecure, Kurupira, Lavasoft, Qustodio and Websecure Ltd. There will be others as well.

Superfish removal can be done via Windows standard add/remove programs utility, find Superfish Inc VisualDiscovery, tick it, and click uninstall. Uninstalling Superfish and other Komodia-type programs does not remove the root certificates, so you need to do this: type certmgr.msc into the Windows search box, right click on the programs name, and select “run as administrator” from the pop-up menu. Subsequent click the action menu item and select “find certificates”. Type Superfish etc into the search box and click the “find now” button. If you find an unwanted certificate, right-click and select delete.

Fwiw never download from unsafe places such as CNet’s Download.com or from Google search ads, downloading software from such places can be really dangerous, in many cases the downloaded software can and will be contaminated with adware, spyware and/or malware.

There’s a simple way to check your machine on the existence of Superfish, Komodia, PrivDog & Co, we advise you to visit the filippo vulnerability test page and perform the vulnerability test: https://filippo.io/Badfish/ Important: do the test with all browsers installed.

Instructions for identifying and removing a root certificate from Windows here: http://windows.microsoft.com/en-us/windows-vista/view-or-manage-your-certificates

Finally we know that many AV (antivirus) products will find and remove the Superfish, Komodia, PrivDog and similar crap, despite we still strongly advise to perform the filippo vulnerability test and to check your machine also on the existence of untrustworthy certificates.

March 1, 2015 Posted by | Uncategorized | , , , , , , , , , , , , , , , , , , , , , | Leave a comment

Ad Muncher ad- and poupup blocker will become completely free for everyone shortly

Today Murray Hurps, the Ad Muncher developer, announced that with upcoming Ad Muncher v5 the software will be free for everyone.

Murray Hurps: “Ad Muncher is normally available for $29.95, plus $19.95 per year after that, but will soon be available in exactly the same form as a completely free product. All users will receive the daily premium filter list updates, including users who were previously using Ad Muncher Basic”.

This is of course fantastic news, Ad Muncher is one of  (probably even the best) of the ad- and popup blockers and advertising removers there is so we all can be very pleased about Murray’s announcement. Nevertheless we all should keep in mind that Murray’s decision to make Ad Muncher a free product wasn’t easy, it’s very generous: besides his own need for earnings he have to pay salaries for three people and it’s going along with usual expenses.

We can expect that Ad Muncher will become free at the moment version 5 will be released, according to Murray version 5 release will happen shortly.

Finally, Murray also explained that those who have recently purchased Ad Muncher can ask for a refund if they’re still covered by the 30-day refund policy, but he explains too that every refund will reduce the chances of Ad Muncher surviving as a fee product. So please people, those who purchased recently Ad Muncher please support Murray and his Team and don’t ask for a refund.

From me a well-meant Thank You Murray, you are a great guy!

June 26, 2014 Posted by | Downloads, News | , , , , , | Leave a comment

Microsoft released emergency out-of-band update fixing IE zero day vulnerability

Today Microsoft have released an emergency out-of-band update (2965111) to fix a zero day publicly disclosed vulnerability in Internet Explorer (Microsoft Security Advisory 2963983). The vulnerability could allow remote code execution if a user views a specially crafted webpage using an affected version of Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user.

This security update is rated Critical for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers.

More info about the fix here: MS14-021 :Security update for Internet Explorer: May 1, 2014 The advance notification of the update lists Windows XP as among the affected platforms, indicating that it will be among the platforms patched, in spite of its support period ending weeks ago.

Users with Automatic Updates enabled do not have to do anything, although running Windows Update will apply the fix immediately.

May 1, 2014 Posted by | Alerts, News, Vulnerabilities | , , , , , , , , , | Leave a comment

How to enable LTE/4G on Samsung Galaxy Note 3 (SM-N9005)

Like me you have a fancy and expensive International Samsung Galaxy Note 3 SM-N9005 that conform specifications should be LTE/4G capable and nevertheless no LTE/4G ? It’s probably making you angry and mad, I assume you damn Sammy (again) for delivering a mobile phone that doesn’t do what it should do. Of course you have installed Android KitKat 4.4.2 but still no LTE option available via Start Screen > Apps > Settings > More Networks > Mobile Networks > Network Mode.

Normally in that Network Mode menu should be following options visible/available:

– LTE/WCDMA/GSM  (auto connect)
– WCDMA/GSM (auto connect)
– WCDMA Only
– GSM only

At the moment the mentioned  LTE/WCDMA/GSM  (auto connect)” option is missing you have a problem, you aren’t able to use LTE/4G. Don’t worry. there are several solutions/fixes to solve the lack of LTE/4G. Keep in mind that the solutions will only work with a rooted phone (up to you to take the risk of rooting, you will lose probably phone-guarantee because Knox counter will be tripped and security-wise there are also reservations).

The solutions (again, keep in mind my reservations about rooting your phone):

1. Change with a root explorer of your choice (e.g. Root Explorer, Solid Explorer or EF File Explorer) the value “false” in file persist.radio.lteon into “true” by way of build-in text editor of the root explorer. The file is located in root/data/property. Be sure permissions of  persist.radio.lteon are set to rw, after altering the file save the file and make it read-only. Reboot your phone, now you will see and be able to pick the option  “LTE/WCDMA/GSM  (auto connect)” in Network Mode menu. Important: before altering ANY file on your phone be sure you have a copy of the original, unaltered file!!! Advantage of this solution: even after a phone reboot the option  “LTE/WCDMA/GSM  (auto connect)” will remain visible/activated.

2. When you are afraid or not tech-savvy enough to alter phone files you can download “Advanced Signal Status” on Google Play. Start the app, go into Advanced Info located on bottom of the app and subsequent choose  LTE/GSM/CDMA auto (PRL) in the first sub-menu of Advanced Info. In phone Network Mode menu option  “LTE/WCDMA/GSM  (auto connect)” will still not be visible but nevertheless you will be able to use LTE/4G. Disadvantage of this solution will be that after every phone reboot you have to start “Advanced Signal Status app” and reactivate LTE/GSM/CDMA option.

Please remember that LTE/4G will only work in area’s with LTE and your phone data-plan includes the use of LTE. Good luck and have fun!

April 6, 2014 Posted by | Advisories, News | , , , , , , , , , , , , | 43 Comments

Windows XP data transfer tools: Laplink PCmover Express for Windows XP and PCmover Professional

After April 8, 2014, technical assistance for Windows XP will no longer be available, including automatic updates that help protect your PC. Microsoft will also stop providing Microsoft Security Essentials for download on Windows XP on this date. (If you already have Microsoft Security Essentials installed, you will continue to receive antimalware signature updates for a limited time, but this does not mean that your PC will be secure because Microsoft will no longer be providing security updates to help protect your PC.)

If you continue to use Windows XP after support ends, your computer will still work but it might become more vulnerable to security risks and viruses. Also, as more software and hardware manufacturers continue to optimize for more recent versions of Windows, you can expect to encounter greater numbers of apps and devices that do not work with Windows XP.

To help customers on Windows XP prepare to move to a new PC, Microsoft announced a free transfer tool. They partnered with Laplink to provide Windows XP users with a free data migration tool called PCmover Express for Windows XP which copies your files and settings from your Windows XP PC to a new device running Windows 7, Windows 8 or Windows 8.1. This tool will copy your files, music, videos, email and user profiles and settings from your old PC to your new device, transferring across your home or work network, and even enables Windows XP users to customize exactly what they want to bring over to their new device. The free data transfer will NOT migrate your apps. Learn more and download the free version of Laplink PCmover Express for Windows XP here.

For Windows XP users wanting to transfer applications from their old computer, Laplink is also making available its software that migrates apps, files and settings called PCmover Professional at a special price – see here for details.

Sources: Microsft and Laplink

March 22, 2014 Posted by | Advisories, Alerts, Downloads, News | , , , , , | Leave a comment

RIP ASAP – Alliance of Security Analysis Professionals: 2004-2013

Regrettably I have to tell you that Smokey’s Security Forums isn’t ‘Site Member ASAP – Alliance of Security Analysis Professionals’ anymore, reason is simple: ASAP died.

I want to express my thanks to all the people dedicated to ASAP, this includes common and VIP-members as well ASAP Counsel and Site Owners.

A special Thank You to Corrine, (former) ASAP Secretary, she was the one keeping ASAP alive till the unavoidable happened.

August 9, 2013 Posted by | News | , , , , | Leave a comment

How to Get MSN (Live) Messenger Back and beating Microsoft’s Skype

It’s obvious that countless people are very disappointed that Microsoft has substitute MSN (Live) Messenger by Skype, most people just want to chat and don’t need all the whistles and bells of Skype at all.

Past days Messenger users received one of following messages:

A newer version is available. You must install the newer version in order to continue. Would you like to do this now?

or

A newer version has been downloaded and is available. You must install this newer version in order to continue. Would you like to do this now?

This is just an ordinary Microsoft attempt to force MSN Messenger users to what Microsoft is calling an ´upgrade´ to Skype, majority of the MSN Messenger users see it entirely different and are pissed they are not able anymore to use Messenger, the ´upgrade´ is a nightmare to them.

Don´t worry and be happy again, there´s a nice little piece of software that will allow you to use Messenger again: Messenger Reviver 2 by Jonathan Kay. I have tested the software on multiple PC’s and it will do what it promise: getting MSN (Live) Messenger back. To reach the aim of getting Messenger back, Messenger Reviver 2 will make some changes to your computer. These changes are harmless and can’t hurt your PC so use it without any risk.

Some info about Messenger Reviver 2 (grabbed from author’s weblog)

Messenger Reviver 2 automatically installs, repairs and/or modifies Windows Live Messenger 2012, 2011, 2009, and 2008 as well as Windows Messenger to continue signing in despite being blocked by Microsoft.

Reviver 2 supports modifying all language versions and can automatically install either 2009 or 2012 versions in 47 different languages.

Reviver will automatically attempt to detect if Messenger is still installed, which versions are eligible for modification and if you need to run a repair or new installation to bring Messenger back (if Skype has removed it).

System Requirements

Windows XP, Windows Vista, Windows 7 or Windows 8.
.NET Framework 2.0 or higher (included with Windows Vista or newer), .NET 3.5 or 4.0 recommended

How-To

To revive Messenger, click Start in the Messenger Reviver 2 Screen and the process will automatically modify Messenger and restart it.

If Windows Live Essentials is not installed, you will presented with options to either install Messenger 2009 or 2012 in the language of your choosing. Reviver will attempt to guess which language you prefer based on your prior Windows and Essentials language settings.

Additionally if Essentials is still installed, but Skype has removed it, you will be offered to just repair your Essentials install.

Advanced

If you wish to do a manual re-install or repair, you can select these options by clicking the Advanced button and choosing the function you would like.

I want to make clear again that the use of Messenger Reviver 2 will not damage your PC. Also that you have to say ‘Thank You’ to the author of the application, Jonathan Kay. His weblog and Reviver Support can be found here.

Downloadlinks Messenger Reviver 2 (0,5 MB, zipped)

Link 1

Link 2

Link 3

Please report broken links, thanks in advance!

May 1, 2013 Posted by | Downloads, News | , , , , , , , , , , , , , | Leave a comment

[UPDATED / SOLVED] Be aware: malware removal program ComboFix probably infected with Sality virus

According to Marcos, employee of security solutions vendor ESET, the well-known malware cleaning/removal program ComboFix created by sUBs is infected with the Sality virus. It seems that the current installer ComboFix contains an infected file, namely iexplore.exe

I haven’t checked the issue, however have to assume that ComboFix is indeed infected with the Sality virus, especially because other security vendors have confirmed the infection.

Please don’t download and use ComboFix until the author, sUBs, remedies the issue.

UPDATE 1: Infection is confirmed by a reliable source.

UPDATE 2: To be 100% sure I checked the issue by myself, ComboFix is indeed infected by Sality.

UPDATE 3: Added a temporary Google Drive downloadlink to obtain most recent CLEAN ComboFix.exe

Data of this clean version:

Combofix.exe
Version 13.1.28.1
Copyright sUBs
5.028.179 bytes

MD5 CHECKSUM: 0F6D28A70471051C4C7785335ACBA626

SHA256 CHECKSUM:

hex: 361548f74415a41f00d5345b3e3c489b3282b302c0c51266880eda586db01a12
HEX: 361548F74415A41F00D5345B3E3C489B3282B302C0C51266880EDA586DB01A12
h:e:x: 36:15:48:f7:44:15:a4:1f:00:d5:34:5b:3e:3c:48:9b:32:82:b3:02:c0:c5:12:66:88:0e:da:58:6d:b0:1a:12
base64: NhVI90QVpB8A1TRbPjxImzKCswLAxRJmiA7aWG2wGhI=

Download: removed

UPDATE  4 / FINAL UPDATE / 2013-01-30 22:00: problem infected ComboFix solved, clean ComboFix.exe is now live again, and available to download from its normal Bleeping Computer downloadlink here.

Because the problem is now solved I have removed the temporary downloadlink clean ComboFix.exe

January 29, 2013 Posted by | Advisories, Alerts, Anti-Virus, Malware, Vulnerabilities | , , , , , , | 4 Comments

Windows 8 Acronis True Image 2013 customers misguided by Acronis GmbH: software is unusable

It’s just ‘great’, you are relying on a well-known company selling Backup & Recovery software, Acronis GmbH. On their website they are promising potential customers that their Acronis True Image 2013 software is fully compatible with Windows 8, so you are buying or upgrading a previous version of the software in full faith and trust, assuming that Acronis will save you in case an disaster will happen with your PC and you will be able to boot from a recovery image in case of an disaster.

Well better forget efforts to restore the Acronis image, Acronis will let you down without mercy, your Windows 8 system will tell you: “Selected boot image did not authenticate. Press ‘Enter’ to continue”. So now you have a serious problem…

Cause of the failure message is Secure Boot, a Windows 8 Anti-Rootkit feature that will prevent the PC from booting an unrecognised operating system. Unpleasant side effect: it will also blocking Linux-based recovery environments, such as Acronis Start Up manager.

Despite the fact that Acronis is informed about the issue, they still sell Acronis True Image 2013 as being Windows 8 Compatible. I call this product sale scam. My advise to Windows 8 users: don’t buy the Acronis crap, on your Windows 8 PC it’s a useless piece of emergency software.

January 17, 2013 Posted by | Advisories, Alerts | , , , , , , , , , | 1 Comment

Microsoft Security Bulletin MS13-008 – Out-Of-Band Critical Security Update for Internet Explorer (2799329)

Published: Monday, January 14, 2013 by Microsoft

Version: 1.0
General Information
Executive Summary

This security update resolves one publicly disclosed vulnerability in Internet Explorer. The vulnerability could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 on Windows clients and Moderate for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 on Windows servers. Internet Explorer 9 and Internet Explorer 10 are not affected. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerability by modifying the way that Internet Explorer handles objects in memory. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

This security update also addresses the vulnerability first described in Microsoft Security Advisory 2794220.

Recommendation. Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.

For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service.

Known Issues. None

Affected and Non-Affected Software: see the Security Bulletin.

Some Frequently Asked Questions (FAQ) Related to This Security Update, for all FAQ’s see the Security Bulletin.

Is this update, MS13-008, a cumulative security update for Internet Explorer?
No. This security update, MS13-008, only addresses the vulnerability described in this bulletin.

Do I need to install the last cumulative security update for Internet Explorer, MS12-077?
Yes. In all cases MS13-008 protects customers from the vulnerability discussed in this bulletin. However, customers who have not installed the latest cumulative security update for Internet Explorer may experience compatibility issues after installing the MS13-008 update.

Customers need to ensure that the latest cumulative security update for Internet Explorer, MS12-077, is installed to avoid compatibility issues.

If I applied the automated Microsoft Fix it solution for Internet Explorer in Microsoft Security Advisory 2794220, do I need to undo the workaround before applying this update?
Customers who implemented the Microsoft Fix it solution, “MSHTML Shim Workaround,” in Microsoft Security Advisory 2794220, do not need to undo the Microsoft Fix it solution before applying this update.

However, since the workaround is no longer needed, customers may wish to undo the workaround after installing this update. See the vulnerability workarounds in this bulletin for more information on how to undo this workaround.

Where are the file information details?
Refer to the reference tables in the Security Update Deployment section for the location of the file information details.

Where are the hashes of the security updates?
The SHA1 and SHA2 hashes of the security updates can be used to verify the authenticity of downloaded security update packages. For the hash information pertaining to this update, see Microsoft Knowledge Base Article 2799329.

How are Server Core installations affected by the vulnerability addressed in this bulletin?
The vulnerability addressed by this update does not affect supported editions of Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012 as indicated in the Non-Affected Software table, when installed using the Server Core installation option.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided “as is” without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

January 14, 2013 Posted by | Advisories, Alerts, Downloads, Vulnerabilities | , , , , , , , , , | Leave a comment

Microsoft Advance Notification for Out-Of-Band Security Update to Address Security Advisory 2794220

Microsoft Security Response Center – MSRCTeam | 13 Jan 2013 3:00 PM

Today, we are providing Advance Notification to customers that at approximately 10 a.m. PST on Monday, January 14, 2013, we will release an out-of-band security update to fully address the issue described in Security Advisory 2794220. While we have still seen only a limited number of customers affected by the issue, the potential exists that more customers could be affected in the future. The bulletin has a severity rating of Critical, and it addresses CVE-2012-4792. Internet Explorer 9-10 are not affected by this issue and as always, we encourage customers to upgrade to the latest browser version.

We recommend that you install this update as soon as it is available. This update for Internet Explorer 6-8 will be made available through Windows Update and our other standard distribution channels. If you have automatic updates enabled on your PC, you won’t need to take any action. If you applied the Fix it released in Security Advisory 2794220, you won’t need to uninstall it before applying the security update.

January 14, 2013 Posted by | Advisories, Alerts, Vulnerabilities | , , , , , , , | Leave a comment

Extremely critical vulnerability Samsung Android Exynos4 based devices [CONFIRMED]

ExynosAbuse Exploit: obtaining root on Exynos4 based Samsung Android devices without ODIN flashing, malicious apps will be able to gain total control over the device by gaining root without asking and without any permissions on a vulnerable device.

Source: XDA Developers (alephzain, Chainfire)

– alephzain: http://forum.xda-developers.com/showthread.php?t=2048511
– Chainfire: http://forum.xda-developers.com/showthread.php?t=2050297

Samsung solution status: unfixed

Vulnerable devices:

– Samsung Galaxy S2 GT-I9100

– Samsung Galaxy S3 GT-I9300
– Samsung Galaxy S3 LTE GT-I9305

– Samsung Galaxy Note GT-N7000

– Samsung Galaxy Note 2 GT-N7100
– Samsung Galaxy Note 2 LTE GT-N7105
– AT&T Galaxy Note 2 SGH-I317
– Verizon Galaxy Note 2 SCH-I605

– Samsung Galaxy Tab Plus GT-P6210

– Samsung Galaxy Note 10.1 GT-N8000, GT-N8010, GT-N8013, GT-N8020

Note: Google Nexus 10 not vulnerable, Exynos5.

Temporary patch (provided by Chainfire): http://forum.xda-developers.com/showthread.php?t=2050297

Note: Chainfire requested not to redistribute the patch, instead please link to http://forum.xda-developers.com/showthread.php?t=2050297

Update Dec 20 2012

Android Central | Dec 19 2012

Official Samsung Statement Exynos kernel vulnerability issue (in full)

“Samsung is aware of the potential security issue related to the Exynos processor and plans to provide a software update to address it as quickly as possible.

The issue may arise only when a malicious application is operated on the affected devices; however, this does not affect most devices operating credible and authenticated applications.

Samsung will continue to closely monitor the situation until the software fix has been made available to all affected mobile devices”

Third-party fixes

I will only mention Chainfire’s fix. It’s the only one that is secure. Both Supercurio’s and RyanZA’s method leave you with easily exploitable holes any serious malware author will abuse.

About Chainfire’s fix

Chainfire: “This is an APK that uses the ExynosAbuse exploit (by alephzain) to be able to do various things on your Exynos4 based device.

Features for non-rooters:
– Securely patch the exploit

Features for rooters:
– Root the device (SuperSU v0.99)
– Enable/disable the exploit at will
– Enable/disable patching the exploit at boot
– Unroot and cleanup (optionally leaving the exploit patch at boot in place)

Please note that patching the exploit may break camera functionality, depending on device and firmware. Also note that if use the patch method without rooting, or keep patching the exploit at boot enabled when unrooting, you need an alternate method to re-root the device to disable this feature (like CF-Auto-Root) – you cannot use ExynosAbuse to do this since it patched the exploit. Unlike other patch authors, I do not believe in keeping an invisible rooted process running in the background while pretending you aren’t rooted, to be able to unpatch this way.

While the exploit patches work (aside from possibly disabling your camera), these are more work-around than actual fixes. A proper patch would be a kernel fix, either from a third party or Samsung themselves”

Download the fix here: http://forum.xda-developers.com/showthread.php?t=2050297

Note: please do not redistribute the fix!

December 17, 2012 Posted by | Advisories, Alerts, Anti-Virus, Malware, News, Vulnerabilities | , , , , , , , , , , , , , , , , , , , , , , , , , , | Leave a comment

Follow

Get every new post delivered to your Inbox.