Monthly Archives: August 2012

Catch The Patch Batch

Keep your OS and applications up to date with automated updates and patches and by regularly reviewing the vendors’ product update sections on their websites.

Sometimes it seems that the whole world assumes that the only vendor that suffers from vulnerabilities is Microsoft. To see how misleading claims like this can be, check out the weekly “Consensus Security Vulnerability Alert” published by SANS (see http://portal.sans.org). In recent years, vulnerabilities in applications have become a serious threat (arguably more so than OS vulnerabilities).

Unfortunately, users are far less savvy about patching third-party applications than they are about patching the operating system. However, this vector will also decline in impact as application vendors learn to tighten their quality control and patching methodologies.

Ericka Chickowski goes into some more detail on the vulnerabilities of 5 third-party vendor applications and equipment and the urgent need to patch these applications and devices – namely, Java-enabled devices, Printers, Routers, ERP Software, and Databases; all of which suffer from neglect when it comes to patch management – in her article, “5 Systems You’re Forgetting To Patch”, http://www.darkreading.com/vulnerability-management/167901026/security/news/240005971/5-systems-you-re-forgetting-to-patch.html?cid=nl_DR_daily_2012-08-22_html&elq=f3f56ae21c164ea09473836b2a6c4394. This reading is highly recommended.


TRA Consulting, Inc.
375 Redondo Avenue #153
Long Beach, CA 90814


Don’t Let Autorun Be Autoinfect

AutoRun has presented such a problem in recent years. There is a wide range of malware families that install or modify autorun.inf files in order to infect systems. In recent years, Microsoft has taken steps to address this loophole: First, by turning off AutoRun by default in Windows 7, then by making patches available for XP, Vista and Windows Server, and finally by pushing the changes out through

Windows Update so that many more systems would then be updated automatically. Better late than never, some would say.

Still, that change has greatly reduced the volume of malware infections exploiting the AutoRun facility, though it hasn’t (and can’t) make the problem disappear completely. Microsoft tells us that it saw infections on XP and Vista reduced by 1.3 million in the first few months after the changes to Windows update, but there are still high volumes of AutoRun infection attempts, indicating that there are other factors at play.

Consider, for instance, the fact that XP SP2 is out of support, so that the figures for machines that aren’t updated beyond that show only a small drop. But that doesn’t, of course, mean that they aren’t a channel for infection attempts. Don’t assume, either, that this single precaution will save you from every example of this type of threat. Most malware uses more than one technique to infect targeted systems.

Removable devices are useful and very popular. Of course, malware authors are well aware of this, as INF/AutoRun’s frequent return to the number one spot clearly indicates. Here’s why it’s a problem.

The default AutoRun setting in an unpatched version of Windows (apart from Windows 7) will automatically run a program listed in the autorun.inf file when you access many kinds of removable media.

There are many types of malware that copy themselves to removable storage devices. While this isn’t always the program’s primary distribution mechanism, malware authors are always ready to build in a little extra “value” by including an additional infection technique.

As always, if you are unfortunate enough to be running an infected PC, contact your local virus removal experts, TRA Consulting: info@traconsulting.us or 562-225-4222


IT Consulting      |       Managed IT       |      Cloud       |       Desktop Support         |       Privacy        |       Term of Use         |       Contact Us