Month: April 2013

Here’s what they say:

“VideoLAN and the VLC development team present VLC 2.0.6 ‘Twoflower’.

VLC media player 2.0.6 is an update for security and bug fixing. It notably improves support for MKV, Ogg, ASF and srt support, fixes GPU decoding on Windows on Intel GPU, fixes ALAC and FLAC decoding, and introduces a new compiler for Windows.”

VLC Player for Windows

I was surfing and checking on security issues, and ran across this. It looks very cool! It can scan from a virtual appliance and check your network for security vulnerabilities. Very neat! Here’s what they say about features:

Open Vulnerability Assessment System (OpenVAS)

“The Open Vulnerability Assessment System (OpenVAS) is a framework of several services and tools offering a comprehensive and powerful vulnerability scanning and vulnerability management solution.

The actual security scanner is accompanied with a daily updated feed of Network Vulnerability Tests (NVTs), over 30,000 in total (as of April 2013).

All OpenVAS products are Free Software. Most components are licensed under the GNU General Public License (GNU GPL).”

An update on Google Affiliate Network (from the Google Blog)

Our goal with Google Affiliate Network has been to help advertisers and publishers improve their performance across the affiliate ecosystem. Cost-per-action (CPA) marketing has rapidly evolved in the last few years, and we’ve invested significantly in CPA tools like Product Listing Ads, remarketing and Conversion Optimizer. We’re constantly evaluating our products to ensure that we’re focused on the services that will have the biggest impact for our advertisers and publishers.

To that end, we’ve made the difficult decision to retire Google Affiliate Network and focus on other products that are driving great results for clients.

We’ll continue to support our customers as we wind down the product over the next few months. And there are other products that can help you achieve your goals. Affiliate publishers can continue to earn AdSense revenue through the AdSense network. And marketers can take advantage of other CPA-oriented Google tools like Product Listing Ads, remarketing and Conversion Optimizer to drive valuable online sales and conversions. These areas are growing rapidly and we’re continuing to invest heavily in them.

Thanks for your support of our affiliate product, and we look forward to helping you grow your business in the future.

Posted by: J.J. Hirschle, Head of Google Affiliate Network

Check your usernames and passwords and harden them if you have a WordPress blog. You have been warned!

WordPress under Heavy Attack

“Attackers are aiming at blogs running poorly-secured WordPress configurations in an attempt to create a powerful botnet that, according to independent security researcher Brian Krebs, already counts some 90,000 IPs.

The attack appears to use ‘brute force’ password–guessing, as revealed by security and networking companies in separate investigations and incident forensics.

It appears campaigners focus on websites running the popular WordPress content management system. They meticulously scan the Internet for WordPress and try to get into the admin panel via repeated login attempts, trying the 1,000 most common username and password combinations on a custom list, according to website security company Incapsula.

All vulnerable sites are planted a backdoor to allow attackers to access these sites from afar. In the meantime, the compromised sites are incorporated into the attack botnet to go after other websites running WordPress.

‘It’s hurting the service providers the most, not just with incoming traffic,’ Marc Gaffan of Incapsula told KrebsOnSecurity. ‘But as soon as those servers get hacked, they are now bombarding other servers with attack traffic. We’re talking about Web servers, not home PCs. PCs maybe connected to the Internet with a 10 megabit or 20 megabit line, but the best hosting providers have essentially unlimited Internet bandwidth. We think they’re building an army of zombies, big servers to bombard other targets for a bigger cause down the road.’

‘These larger machines can cause much more damage in DDoS attacks because the servers have large network connections and are capable of generating significant amounts of traffic,’ wrote CloudFlare CEO Matthew Prince in a blog post expressing concerns of a possible link between this outbreak and the 2012 Brobot botnet attacks against some American banks.

All readers with WordPress blogs need to enforce the security of their servers immediately: keep just the admin users that you trust. Change old passwords with secure log-in credentials for all admin accounts. Make sure the WordPress version you run is safe, and update the secret WordPress key.”

Man! Microsoft is having problems evening getting their “fixes” right!

Microsoft pulls Patch Tuesday security fix

“Tech giant Microsoft has recommended that an update released in the latest Patch Tuesday be removed, after users reported incidents of the ‘blue screen of death’ after installation.

Microsoft released two critical security updates and others rated as ‘important’ for Windows and Internet Explorer as part of its latest round of Patch Tuesday updates.

However, a number of Windows 7 users have reported issues with security update 2823324, which is part of security bulletin MS13-036.

MS13-036 was meant to fix three privately disclosed flaws and one publicly disclosed flaw in an NTFS kernel-mode driver related to the elevation of privileges when a user is logged in. However, once installed, security update 2823324 — part of the bulletin — may produce a ‘STOP: c000021a {Fatal System Error}’ problem for users. The error occurs early in the startup process, and no Memory.dmp file is created.

As a result, Microsoft has temporarily pulled the patch from its security bulletin while the issue is being investigated.”