Vulnerability in WinRAR Actively Being Exploited by Attackers

If you have WinRAR installed, stop what you're doing right now and go update it to the latest version. There is a vulnerability in all previous versions of WinRAR that is being actively exploited by attackers. Seriously, do it now.

Is That Software Download Safe?

These tips can help you to reduce your risk of accidentally downloading malware:

• Always download software from its official website. There are very few exceptions to this rule.

• Never download software using a link in an email, on a blog, or even an ad in search engine (e.g.: Google) results.

• Never download anything that is offered to you. If you didn't go looking for it, don't download it.

Enable Two-Factor Authentication Now!

With all of the online data breaches these days, it's more important than ever that you take measures to protect your online accounts. A powerful way to do that is to enable two-factor authentication (2FA) on any sites that support it. Here is a link to a Lifehacker article with a list of sites that provide 2FA:

http://lifehacker.com/5938565/heres-everywhere-you-should-enable-two-factor-authentication-right-now

Windows Server Running IIS Fails PCI Compliance Scan

If your web server is failing a PCI compliance scan because a specially crafted HTTP/1.0 GET request without a host header is causing it to divulge an internal private IP address, then read on.

Problem

In IIS 7 on Windows Server 2008 and higher, there is a vulnerability that will cause it to accept such a GET request and respond with the internal IP address as the realm for basic authentication. This does not happen with an HTTP/1.1 request.

More Information

In this example, the GET request was for /autodiscover/autodiscover.xml, which is in the Autodiscover application under the "SBS Web Applications" site in IIS 7 on a Windows Small Business Server 2008 computer.

You can test for the issue with openssl on Linux by running the following command:

$ openssl s_client -host hostname.domain.tld -port 443

Substitute the actual hostname for hostname.domain.tld. The server will respond with a bunch of SSL information ending in "---" followed by a blank line. On that line, type or paste the following:

GET /autodiscover/autodiscover.xml HTTP/1.0
Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
Accept-Language: en
Connection: Keep- Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
Pragma: no-cache
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */* 

Send a blank line at the end; the server will not respond until you do. An example of a response from a server affected by the vulnerability follows:

HTTP/1.1 401 Unauthorized
Content-Type: text/html
Server: Microsoft-IIS/7.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="192.168.1.201"
X-Powered-By: ASP.NET
Date: Fri, 05 Sep 2014 16:25:59 GMT
Connection: close
Content-Length: 58

You do not have permission to view this directory or page.read:errno=0

Resolution

To resolve the issue in this example, do the following:

1. Open the IIS 7 console, expand SBS Web Applications and click on Autodiscover.
2. Double-click Authentication.
3. Right-click Basic Authentication and select Edit...
4. In the Realm field, type the server's public hostname in the format hostname.domain.tld and then click OK.
5. If applicable (e.g.: on Windows SBS 2008), repeat the above process for the Microsoft-Server-ActiveSync and EWS websites in addition to Autodiscover.

Performing the same test in this example should now yield the following response:

HTTP/1.1 401 Unauthorized
Content-Type: text/html
Server: Microsoft-IIS/7.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="hostname.domain.tld"
X-Powered-By: ASP.NET
Date: Fri, 05 Sep 2014 16:30:41 GMT
Connection: close
Content-Length: 58

You do not have permission to view this directory or page.read:errno=0

Dropbox glitch exposed user files; how to protect yourself against future breaches

On Saturday, Dropbox had a major security breach for four hours, effectively allowing anyone to log into any Dropbox account without knowing the password. The glitch was fixed moments after it was discovered and less than 1% of users were potentially affected. Nevertheless, the incident raises security concerns.


An article in Lifehacker details how to add a second layer of security to your Dropbox account using programs such as TrueCrypt.

How to protect your Facebook sessions from being hijacked

Users of Facebook beware! There is a new Android app called FaceNiff that can hijack Facebook sessions in one tap.


To protect yourself, enable HTTPS in your account settings.

Lock Down Your Computer Like the NSA

Here is an article from Lifehacker about how to secure your computer like the NSA. It links to the NSA web page with documents on securing Windows, Mac, Linux and Solaris.

Facebook leaked personal data to advertisers

According to this article, a vulnerability in some Facebook apps allowed third-party advertisers to access security tokens that act as a spare key to users' profiles, allowing them to read posts and access profile information.


While the article points out that the advertisers may not have known they had the ability to do that and Facebook has now fixed the vulnerability, those security tokens may still exist on third-party servers. To make sure you're protected, change your Facebook password.

Macs are not impervious to malware

This article in Lifehacker makes a very good point: As Macs capture greater market share, attackers have greater incentive to write malware that targets Mac OS.


Macs are not impervious to malware. The author predicts that it's only a matter of a couple of years until Mac users will need to get serious about protecting their Macs from infections.

Offline NT Password & Registry Editor

Have you ever been locked out of Windows because you don't know the password?  Maybe you forgot it.  Or maybe you got a hand-me-down computer and the previous owner neglected to tell you the password.  Or maybe somebody else using your computer changed it and didn't tell you.  There are a number of scenarios that require the ability to reset a Windows password.


The Offline NT Password & Registry Editor bootable CD is the solution to the problem.  You just download the ISO image and burn it to a blank CD, then boot the afflicted computer from that CD and follow the prompts to reset the password for the chosen Windows account to one of your choosing.


Tada!


http://pogostick.net/~pnh/ntpasswd/

Strong Password Generator

Need to generate one or more strong passwords?  Easy:

http://strongpasswordgenerator.com/

LastPass

LastPass is a password manager.  But, it's not just any old password manager.  It encrypts your passwords locally on your computer and then uploads the encrypted data to a secure site online.  That means that you can access your passwords from any computer with an Internet connection.


What I love about LastPass is that I can easily install the browser add-on/plug-in/extension into IE, Firefox and Chrome on all of my computers and have my passwords available in any browser on any of my computers.  How convenient!


http://lastpass.com/