Microsoft has issued a warning today about an unpatched issue with their DNS service. There's a mitigation which is pretty easy to do, I'd suggest you do it ASAP if you run a Windows-based DNS server. Unfortunately, the security guy at the Washington Post doesn't seem to understand the vulnerability, as he's reporting it as a problem with their web server, which is wholly inaccurate.
My security key arrived last night from PayPal/eBay. I've activated it, and it seems to work pretty well. They're in the early stages of deploying this, but for $5, my accounts are a lot more secure.
Their implementation requires you to login with your username and password, the way you do today, but then also requires you to push the button on the front of your keyfob and enter the six-digit code that appears there. The code changes every 30 seconds, so that even if someone does see your code, they have very little time to do something with it.
If you use PayPal or eBay much, I'd suggest ordering yourself a key as an extra layer of security on your accounts.
The Governator has signed a bill that'll force tech companies to warn consumers about securing their wireless routers. That's both good news and bad news. It's good that more people will be securing their personal information, but on the other hand, I've certainly piggy-backed off those clueless users when I've been somewhere and needed to check my e-mail.
SANS links to details of a nasty security problem affecting the Mac OS X browser that will automatically run shell scripts linked to from web pages. If you're reading this via a Macintosh, do the following ASAP:
The best immediate recourse against such an attack is to deactivate the option "Open 'safe' files after downloading" in the "General" section of Safari's preferences. Alternative web browsers such as Camino or Firefox do not support the automatic execution of files. These browsers can be prompted to automatically download a file by using the refresh command in the HTML source code of a web page. However, the file will not be executed. Since the Finder selects the icon for a file based on its extension, users are advised to verify that the OS is using the proper file type. This can be done through the information window or in column view.
I got my notification on Saturday that my personal info may have been exposed in this breach of security, though from what I've heard, it wasn't a "virus" per se, but rather a bot that was on the laptop in question:
UNI warns of ID theft after computer security breach
CEDAR FALLS, Iowa (AP) -- The University of Northern Iowa has warned students and faculty to monitor their bank accounts after someone accessed a computer system holding confidential information.
The university detected last week that a laptop computer holding W-2 forms was illegally accessed, though officials said the person likely did not realize he could obtain tax information for about 6,000 student employees and faculty.
"A virus was detected during routine monitoring," said Tom Schellhardt, vice president for administration and finance. "We immediately took steps to fix the problem and increase security."
The university sent letters to everyone whose data was on that computer, warning them to protect against identity theft by monitoring their accounts and contacting credit reporting agencies.
Steve Moon, the school's director of network services, said the person who used the laptop computer did so to review the print jobs for the W2 forms.
"There had been problems with printing, and the person wanted to review what the print stream was trying to do," he said.
A. Frank Thompson, a UNI professor of finance, said he didn't think W2 forms should be on the computer because the information must be made into a hard copy anyway for tax purposes. Also, "it simply opens up the possibility of that information being inappropriately accessed," he said.
