Security Bytes: IE7 defenses revealed |
 |
By Bill Brenner, News Writer
27 Oct 2005 | SearchSecurity.com |
|
|
IE7 security features revealed
Internet Explorer 7 (IE7) will include tighter HTTPS controls and other features to ensure better security, IE program manager Eric Lawrence said on Microsoft's IE blog. HTTPS uses either Secure Sockets Layer (SSL) or Transport Layer Security (TLS) to encrypt data and prevent malicious users from tampering with Internet traffic, Lawrence noted. But he said TLS is stronger and that in IE7, the default HTTPS protocol settings will be changed to disable the "weaker SSLv2 protocol" and "enable the stronger TLSv1 protocol."
The decision to end SSL 2.0 support means upgrades will be necessary for any Web site still requiring the protocol. But Lawrence suggested this wouldn't be a significant issue, since there are "only a handful" of such sites. He added that IE7 is designed to deal more efficiently with any security issues it runs into. "Whenever IE6 encountered a problem with a HTTPS-delivered Web page, the user was informed via a modal dialog box and was asked to make a security decision. IE7 follows the XP SP2 'secure by default' paradigm by defaulting to the secure behavior," he said.
Former HP CEO joins Cybertrust board
Carleton "Carly" Fiorina has found a new job, months after Hewlett-Packard Co. ousted her as president and CEO. Herndon, Va.-based security firm Cybertrust Inc. announced Thursday that Fiorina has joined its board of directors. "She brings an incredible wealth of knowledge and insight into how technology impacts businesses and governments, and her leadership and management experience will be a tremendous asset to the company," John Becker, CEO of Cybertrust, said in a statement.
Fiorina also issued a statement, saying, "Information security will be a key driver of growth and innovation in the technology industry for years to come, and Cybertrust is uniquely positioned to lead the global security market." Fiorina, 51, had been maintaining a low profile since the HP board dismissed her in February. She has been praised for her business savvy, but she fell from favor after HP's $19 billion acquisition of Compaq in 2002 failed to yield the benefits she had promised.
Malware exploits bird flu fears
The makers of a new Trojan horse program are preying on avian flu fears to trick users into getting infected. According to PandaLabs, a unit of Glendale, Calif.-based Panda Software, Naiva-A reaches computers in a Microsoft Word document containing information about bird flu, which health experts fear could mutate into a strain that would spread among people and spark a deadly pandemic.
The security firm said in a statement that the first line of the document is "Outbreak in North America" or "What is avian influenza (bird flu)?" The Trojan uses two Microsoft Word macros to run and install a second threat on infected computers. "The first macro calls five kernel functions that allow the Trojan to modify, create and delete files. The second macro installs Ranky-FY, which is embedded in the document and allows a potential attacker to gain remote control of the infected computer," the lab said. "To protect against this threat, users should ensure that the macro security level is set at medium to receive a warning, or high to stop them from running."
Survey measures Zotob's impact
If a Cybertrust survey of 700 enterprise users is any indication, last summer's Zotob attack was a big inconvenience but not very damaging. Zotob affected organizations around the world by exploiting a security hole in the Plug and Play feature in Windows 2000. It emerged less than a week after Microsoft issued a patch for the flaw. According to the Herndon, Va.-based security firm, 13% of respondents said they experienced at least some adverse impact from Zotob -- spending time, resources or money fighting or recovering from the worm.
Only about 6% reported a moderate or major impact from Zotob resulting in more than $10,000 in losses and at least one business critical system affected. "This compares to a moderate or major impact of more than 60% of organizations due to Nimda, and more than 30% of organizations due to Blaster," Cybertrust said in a statement. Hard-hit organizations reported an average cost of $97,000 to clean up Zotob's mess. Cleaning infected systems required more than 80 hours of work for 61% of those organizations. The healthcare industry experienced the greatest impact, with 26% of organizations experiencing at least some adverse impact, compared to 7% of financial institutions.
BBC suspends BlackBerry service amid security scare
Security pros at the British Broadcasting Corp. are searching for answers after a security problem forced the U.K. media conglomerate to suspend its BlackBerry wireless e-mail service. According to a report in the British newspaper The Guardian, the BBC made the move more than a week ago after it learned that some users had received message fragments intended for other users in the body text of their own messages.
While the exact cause of the problem is unknown, an insider said the service is likely to remain unavailable for another two weeks. The BBC's BlackBerry messaging service is maintained by networking vendor Siemens AG, wireless carrier Vodafone Ltd. and BlackBerry maker Research In Motion Ltd., and is used by more than 300 employees, including upper-level executives. The BBC's BlackBerry security snafu is the latest in a series of setback for RIM, which finds itself embroiled in a patent dispute that may soon limit or ban the sale of BlackBerry devices in the U.S.
|
|
|
|
