Sterling IT News

Apple releases iTunes 10.5 – SSO-AD2011-030.

12 October 2011

Software and platforms affected

The following software is affected

Apple iTunes prior to version 10.5

for the following operating system platforms:

Windows XP SP2

Windows Vista

Windows 7

What is the problem?

There is a bug in Apple iTunes software which, if not fixed, could result in your computer being attacked by criminals. Your personal and/or business information may be accessed for fraudulent or illegal purposes (eg, identity theft). Apple iTunes might crash and become unusable.

What we recommend you do

The problem can be easily fixed by updating to the latest version of the Apple iTunes software by starting iTunes, and clicking “Check for Update”. Alternatively, the latest version of Apple iTunes can be downloaded from the following location:

http://www.apple.com/itunes/download

Where you can find more information

More information about these security bugs can be found here:

http://support.apple.com/kb/HT4981

Disclaimer

This Advisory has been prepared by AusCERT for the Department of Broadband, Communications and the Digital Economy.

The information is intended for used by home users and small to medium sized businesses and is general information only and not intended as advice and was accurate and up to date at the time of publishing. The material and information in this Advisory is not adapted to any particular person’s circumstances and therefore cannot be relied upon to be of assistance in any particular case. In any important matter, you should seek professional advice relevant to your own circumstances.

The Commonwealth, AusCERT, and all other persons associated with this Advisory accept no responsibility or liability for information either included or referred to in the Advisory. No responsibility or liability is accepted for any damage, loss or expense incurred as a result of the information contained in the Advisory, whether by way of negligence or otherwise.

The listing of a person or organisation in any part of this site or Advisory does not imply any form of endorsement by the Commonwealth of the products or services provided by that person or organisation. Similarly, links to other web sites have been inserted for your convenience and do not constitute endorsement of material at those sites, or any associated organisation, product or service.

Please note that material in this Advisory, as the case may be, includes views or recommendations of third parties, which do not necessarily reflect the views of the Commonwealth, or indicate its commitment to particular course of action. Material on this site or in this Advisory may also include information provided by third parties. The Commonwealth cannot verify the accuracy of information that has been provided by third parties

30 September 2011
Software and platforms affected
The following operating system platforms:
All
What is the problem?
Various spam emails are circulating which are designed to trick users into visiting a website. This site could be used to gather personal information (identity theft) or infect your computer with malicious software.

The subject lines of the email include, but are not limited to (some random number codes have been replaces with 0′s):
Important Information Regarding Your Broadband Account
The from lines of the email include, but are not limited to (some random number codes have been replaces with 0′s):
Department of Broadband <acc-upgrade@dbcde.gov.au>
The emails contain a link which should not be visited.
A sample email is listed below (there may be others):
========== Start Sample Email ==========

Broadband Internet Spam Quarantine Notification
Dear Subscriber,
THIS IS A FINAL NOTICE BEFORE ACCOUNT CLOSURE
You have recieved this email because some of your mails suspected of being spam
have been quarantined.
We are sending you this message directly because,we have been receiving
messages from our registered service providers regarding complaints from their
subscribers on anonymous use of their Email accounts. In this effect,we are
deactivating Email Accounts and your account is among those to be deactivated
because,we believe that your account online user profile may have been
compromised.
A new security have been added to our broadband to avoid unauthorize use of
accounts and to give subscribers a better service.In other to avoid the
deactivation of your account, you will have to verify and upgrade your e-mail
to our new added security.
Click the Release link below and select your service provider
http://dbcde/gov/broadband/index.html/upgrade/?siteAreaIndex=.
If the requisite upgrade is not made by 31.09.2011, we reserves the right to
close your broadband account without further notice in this regard
We apologise for any inconvenience. This message is purely as a result of our
determination to provide you with the best possible service.
Regards,
Department of Broadband,
Communications and the Digital Economy

========== End Sample Email ==========
What we recommend you do
If you receive an email similar to the above emails, do not click on the link in the email. Delete the email straight away.

If you have already clicked the link, it is quite possible your computer may now be infected.  It is recommended you seek professional assistance in helping detect and remove the malware.

Make sure you have anti-virus software installed and keep it updated.
Additionally, this factsheet contains instructions to help detect and remove malware:
Factsheet 11, Parts 1-3, You suspect your computer is infected with malicious software – what should I do?
Disclaimer
This Advisory has been prepared by AusCERT for the Department of Broadband, Communications and the Digital Economy.
The information is intended for used by home users and small to medium sized businesses and is general information only and not intended as advice and was accurate and up to date at the time of publishing. The material and information in this Advisory is not adapted to any particular person’s circumstances and therefore cannot be relied upon to be of assistance in any particular case. In any important matter, you should seek professional advice relevant to your own circumstances.
The Commonwealth, AusCERT, and all other persons associated with this Advisory accept no responsibility or liability for information either included or referred to in the Advisory. No responsibility or liability is accepted for any damage, loss or expense incurred as a result of the information contained in the Advisory, whether by way of negligence or otherwise.
The listing of a person or organisation in any part of this site or Advisory does not imply any form of endorsement by the Commonwealth of the products or services provided by that person or organisation. Similarly, links to other web sites have been inserted for your convenience and do not constitute endorsement of material at those sites, or any associated organisation, product or service.
Please note that material in this Advisory, as the case may be, includes views or recommendations of third parties, which do not necessarily reflect the views of the Commonwealth, or indicate its commitment to particular course of action. Material on this site or in this Advisory may also include information provided by third parties. The Commonwealth cannot verify the accuracy of information that has been provided by third parties.

“Erases” files, icons as lead up to pitch for US$80 to buy worthless utility
Gregg Keizer (Computerworld (US))
17 May, 2011 03:07

Scammers are trying to trick Windows users into paying to fix bogus hard drive errors that have apparently erased important files, a researcher said today.

The con is a variant of “scareware,” also called “rogueware,” software that pretends to be legitimate but actually is just a sales pitch based on spooking users into panicking. Most scareware masquerades as antivirus software.

But Symantec researcher Eoin Ward has found a new kind of scareware that impersonates a hard drive cleanup suite that repairs disk errors and speeds up data access.

Dubbed “Trojan.Fakefrag” by Symantec, the fake utility ends up on a Windows PC after its user surfs to a poisoned site — often because the scammers have manipulated search engines to get links near the top of a results list — and falls for a download pitch, typically because it’s presented as something quite different, like video of a hot news topic.

Fake system or disk cleanup programs aren’t new — Symantec has highlighted the scareware subcategory before — but this malware goes above and beyond the call of counterfeit duty.

“[Trojan.Fakefrag's] aim is to increases the likelihood of you purchasing a copy of Windows Recovery by craftily convincing you that your hard drive is failing,” said Ward in a company blog Monday, referring to the name of the fake suite that the Trojan shills.

The malware kicks off the scam by moving all the files in some folders to a temporary location, by hiding others and by making desktop icons disappear. All of that is followed by a message that looks like a valid Windows warning of impending hard drive doom.

“An error occurred while reading system files,” the on-screen message reads. “Run a system diagnostic utility to check your hard disk drive for errors.”

If the user clicks “OK,” the fraudulent “Windows Recovery” application launches, runs a series of sham scans that sound technical and legit, then reports multiple problems, including disk read-write errors.

With the hook set, the scammers try to reel in the victim by trying to get them to pay $79.50 for Windows Recovery, which will supposedly fix the make-believe issues.

Since the user has just seen his files and icons vanish, he or she is much more likely to fall for the scheme.

“It does a really convincing job of making it appear as though something is wrong,” said Ward. “When it ‘deletes’ files from your desktop, it does so in a very prominent way.”

No surprise, but the files aren’t deleted; they can be found with a quick local search, said Ward.

Windows isn’t the only operating system targeted by scammers. Last week, for example, Intego Security reported finding the first-ever Mac OS X rogueware .

Scammers have upped their “scareware” game by convincing Windows users that their hard drive is ready to croak.

Sterling IT is currently looking for 3 motivated staff. 1x junior and 2x senior technicians

Contact our office on 02 97566866 for more information.

Live serves up its lessons in funny ways sometimes.
In the master bedroom there is a ceiling fan. It has a rotating fan switch that allows you to select multiple speed for the fan from the wall switch, High, Medium, and Low. There is no need to pull the chain.
It worked when we moved in and worked for years afterwards. Shortly after having our kitchen and bathroom remodeled it started acting a little funny. The ceiling fan would turn on by using the wall switch, but it would only work on one speed, Low speed. Turning the knob to High or Medium did nothing.
Because it occurred within a few months of the remodel and because our house’s wiring has always been a little bit flakey anyway, I figured that there must be some sort of electrical problem.

I checked the wiring in the switch box. All good.
I checked the wiring in the ceiling fan box. All good.
I checked the fuse box (which is actually a circuit breaker box, who knew?). Good as far as I could tell.
I boned up on electricity and how home electrical systems work. I did Internet research. I read books. I checked out more books from the library. I read How To websites. I read forums for electricians, homeowners, contractors, and do it yourselfers.

I bought a Voltmeter to test with. All good.
I bought an electrical outlet tester to make sure no outlets were miswired, or missing their ground connection, or whatever.

Finally, for whatever reason, I bought a new ceiling fan switch. I knew it wouldn’t work, but it was cheap and I figured what the heck.

I changed the ceiling fan switch out, and rewired it exactly like it was before.
Guess what?
IT WORKED!

I fixed the ceiling fan by doing the most obvious thing there was. I would have started there in our last house which was a new construction house in the suburbs, but because our house was older, with some quirks and because we had recently remodeled, I assumed it was something to do with the house, not something obvious.

Today’s Life Lesson
Don’t make things harder than they are.

The simplest answer is usually the right one.

Everyone already knows this. Don’t let the circumstances or current situation distract you from this truth. Whether it’s a problem at work, at home, with your car, or with your house, always start at the easiest possible thing to try and then work your way up to the harder stuff. It will save you a lot of trouble.

Talk to your boss or your spouse. Fill up your car’s gas tank and check the oil and other fluids. Do these things before moving on to elaborate schemes, carefully crafted letters or emails, or changing things like the serpentine belt.
Start easy. It will work most of the time, and that means that more of your problems will be easier to solve instead of more of your problems being harder to solve.

Symptoms
You install several Updates. After the successful installation, you notice you cannot add or remove features/roles in the Server Manager.

Error: Unexpected error refreshing Server Manager: Exception from HRESULT:0x800F0818

Alternatively you can also get:
Server Manager: Unexpected error refreshing Server Manager: No signature was present in the subject. (Exception from HRESULT: 0x800B0100)

Resolution

First you run the Microsoft Update Readiness Tool located here: http://support.microsoft.com/kb/947821
After the scan has completed check: C:\Windows\logs\CBS\Checksur.log. You should see the following errors:

Checking Package Manifests and Catalogs
(f) CBS MUM Corrupt 0×00000000 servicing\Packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum Expected file name Package_for_KB978601_server~31bf3856ad364e35~amd64~~6.0.1.0.mum does not match the actual file name
(f) CBS MUM Corrupt 0×00000000 servicing\Packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.mum Expected file name Package_for_KB979309_server~31bf3856ad364e35~amd64~~6.0.1.0.mum does not match the actual file name

Or

(f) CBS MUM Corrupt 0x800B0100 servicing\Packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum servicing\Packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.cat Package manifest cannot be validated by the corresponding catalog
(f) CBS MUM Corrupt 0x800B0100 servicing\Packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.mum servicing\Packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.cat Package manifest cannot be validated by the corresponding catalog

Or

(f) CBS MUM Missing 0×00000002 servicing\packages\Package_114_for_KB955839~31bf3856ad364e35~amd64~~6.0.1.0.mum
(f) CBS MUM Missing 0×00000002 servicing\packages\Package_83_for_KB955839~31bf3856ad364e35~amd64~~6.0.1.0.mum

Further down you will see:

Unavailable repair files:
servicing\packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum
servicing\packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.mum
servicing\packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.cat
servicing\packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.cat

These files need to be copied into: %systemroot\Windows\Servicing\Packages

1. You first need to gain control over that folder. In order to do this use the following commands:

This makes the current logged on user (needs to have Administrative privileges) owner of that folder:
takeown /F c:\Windows\Servicing\Packages /D y /R

Then assign full control using:
cacls c:\Windows\Servicing\Packages /E /T /C /G “UserName”:F

This will grant you full control over the directory.

Optionally you can download this ZIP. Inside you have 2 REG Files. If you install TakeOwnership.reg you will have a handy Take Ownership entry in the right click menu every time you use it on a Folder.

clip_image001

2. Now you need to gather the missing or corrupted files from the checksur log:

- Download the KB Files for the missing files:
servicing\packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum

- Unpack them using the following command:
Expand -F:* UpdateKBXXXX.msu x:\DestinationDirectory

After you expand you will see a UpdateKBXXXX.cab File. Expand it as well:
Expand -F:* UpdateKBXXXX.CAB x:\DestinationDirectoryCAB

Inside of this cab you will need to grab 2 files: update.mum and update.cat

3. Rename the gathered update.mum and update.cab files exactly as they are specified in the checksur.log:
Ex.: update.mum for KB978601 will be:

Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum

Do the same for all the other missing/corrupt files and place them into the directory specified in checksur.log (/servicing/packages)
After these steps the problem should be fixed. No reboot required.

If the Server Manager is not working even after doing these steps, run the Update Readiness Tool again and double-check the steps described above.

Tudor Dimboianu
- Support Engineer / Enterprise Platforms Support (Core)

If you experience this issue when opening Outlook 2010 on a 2008R2 Remote Desktop Server, please disable the Outlook Social Connector (instructions to complete on this site: http://www.groovypost.com/howto/geek-stuff/disable-the-people-pane-in-outlook-2010/)

5.11.10 – 09:50am

Firefox updates and patches are now complete. Just opening Firefox will update these vulnerabilities and update for you automatically.

26.10.10 – 02:30pm

Issue:
Mozilla is aware of a critical vulnerability affecting Firefox 3.5 and Firefox 3.6 users. We have received reports from several security research firms that exploit code leveraging this vulnerability has been detected in the wild.

Impact to users:
Users who visited an infected site could have been affected by the malware through the vulnerability. The trojan was initially reported as live on the Nobel Peace Prize site, and that specific site is now being blocked by Firefox’s built-in malware protection. However, the exploit code could still be live on other websites.

Status:
We have diagnosed the issue and are currently developing a fix, which will be pushed out to Firefox users as soon as the fix has been properly tested.

In the meantime, users can protect themselves by doing either of the following:

• Disabling JavaScript in Firefox
• Using the NoScript Add-on

Credit:
Morten Kråkvik of Telenor SOC

Microsoft has planned its biggest ever Patch Tuesday for October, with a total of 49 vulnerabilities set to be fixed.

This is over three times the number of security holes fixed in last month’s Patch Tuesday.

Of the 16 bulletins, four have been rated critical, where the flaws could lead to remote code execution. These four affected all versions of Windows.

One of the critical vulnerabilities affects Internet Explorer versions 6, 7 and 8, whilst two of the flaws, classed as “important,” affected Microsoft Office – one for Word and one for Excel on all platforms.

This Patch Tuesday announcement also marked the first time Microsoft Word 2010 had been included in an advisory.

The vulnerabilities are due to be patched on 12 October.

The loose-knit confederation of internet activists who organise under the banner “Anonymous” appeared to hit Australia again this morning, with Operation Payback targeting a distributed denial of service (DDoS) attack against the Australian Federation Against Copyright Theft (AFACT).

AFACT represents a number of content producers such as movie and television studios and aims to reduce the impact of copyright infringement in Australia. The group has been involved in a high-profile lawsuit against national broadband provider iiNet. DDoS attacks attempt to cripple internet infrastructure through delivering a flood of data to servers and network infrastructure.

“Realise, you are forcing our hand by ignoring us. You forced us to DDoS when you ignored the people, ATTACKED the people, LIED TO THE PEOPLE! You are forcing us to take more drastic action as you ignore us, THE PEOPLE, now,” an individual claiming to represent Anonymous stated in a letter released before the attacks.

Anonymous is well known in Australia’s technology sector for what appeared to be several similar DDoS attacks earlier this year against Federal Government websites and other communications systems in protest against Labor’s mandatory internet filtering policy.

Three and half hours after the attacks were timed to begin on the AFACT site, AFACT and hosting partner Netregistry experienced the effects – with the copyright group’s site going down at 8AM this morning. This story was broken, to our knowledge, by iTNews.

“The attack consisted of 60,000 active HTTP connections and an approximate 100 megabits per second of additional bandwidth being transferred from this particular cluster where the site was located,” a Netregistry spokesperson said, adding that the attacks mainly originated from Chile and Columbia.

“The AFACT website was offline due to Netregistry engineers suspending it as the target of the attack. All other sites on the shared infrastructure remained operational, albeit with some service degradation,” they added. Anonymous had planned to attack AFACT for at least 12 hours.

“We’re delighted to say our infrastructure proved to be highly resilient in the face of a particularly heavy and determined DDoS attack. All affected websites remained online and were back to full performance reasonably quickly, only experiencing intermittent connection problems throughout the day,” said Netregistry chief executive Larry Bloch.

“Of course, the very nature of a DDoS attack means prevention is impossible. However, a combination of our cloud hosting infrastructure and active management dramatically reduced the potential impact for thousands of affected businesses.”

“This incident vindicates our multi-million dollar ten year investment in our shared cloud hosting infrastructure. It is remarkable that a shared cloud hosting service costing our clients around $10 per month withstood one of the hacker community’s most determined, coordinated DDoS attacks without failing.”

The AFACT attacks also affected other Netregistry sites – although an exact figure on how many sites was affected hasn’t been released. Sites affected ranged from small businesses to government sites. The hosting company posted a statement on its website for customers to make them aware that the organisation knew what was going on and what measures were been taken.

“Impact to the cluster during the peak of the attack resulted in performance degradation to websites. However, the unique cloud hosting infrastructure pioneered by Netregistry was able to scale up and carry the additional load without failing,” said a Netregistry spokesperson.

“There were some minor ancillary issues discovered during the attack that affected our infrastructure, but these were promptly resolved as they were identified with minimal customer impact.”

“No loss of data occured, the services resumed operation once the attackers IP ranges were blocked. Email was delayed in delivery, however no bounces were caused by the issue,” the site added. The Netregistry site stated that “Zeus cluster (PHP clients not utilising Apache)” had issues.

AFACT executive director Neil Gane said that this was the first attack of its kind experienced by AFCT. The executive was unable to comment on the estimated damage the attacks caused or what measures AFACT would take to identify the attackers and if they would be referring to authorities. The organisation’s site is back up at time of publication.

The attacks on AFACT follow an onslaught of attacks on Stichting Bescherming Rechten Entertainment Industrie Nederland, the Motion Picture Association of Australia, the Recording Industry Association of America (RIAA), the British Phonographic Industry (BPI) and Aiplex Software an Indian software firm that was hired to launch a DDoS attack on peer to peer hub the Pirate Bay.

Read more: http://www.news.com.au/technology/anonymous-targets-afact-with-operation-payback/story-e6frfrnr-1225931688025?area=technology#ixzz10t1dijMi