TechTidBit - Tips and advice for small business computing - Tech Experts™ - Monroe Michigan

Brought to you by Tech Experts™

Security

Critical Bugs Plague Quickbooks Online Edition

The federal government’s cyberdefense arm has warned users of the popular QuickBooks small-business accounting software that they risk losing data and control of their PCs to hackers.

According to two advisories published by the U.S. Computer Emergency Readiness Team (US-CERT), the ActiveX control that enables Intuit Inc.’s QuickBooks

Online Edition contains flaws that attackers can exploit simply by getting users to view an HTML e-mail message or visit a malicious website.

Of the two bugs discovered and reported by US-CERT, the one spelled out here is the most dangerous. Not only could attackers seed a vulnerable Windows PC with malware, US-CERT, but “an attacker can also retrieve files from a victim’s PC.”

Copenhagen-based vulnerability tracker Secunia ApS ranked the vulnerabilities “highly critical,” its second-most serious threat rating.

QuickBooks Online Edition is a Web-based subset of the traditional on-disk software, and it uses a subscription pricing model that starts at $19.95 per month.

According to US-CERT, Version 9, and possibly those prior to that, contain the ActiveX vulnerabilities. US-CERT recommended that users update to Version 10 as soon as possible or, failing that, set the so-called “kill bit” to disable the control.

Doing that, however, means that users won’t be able to access QuickBooks Online through Microsoft’s Internet Explorer, the only browser supported by the service.

Intuit’s support site showed no mention of the bugs today. Ironically, one of the documents in the Online Edition’s support database, entitled “What is the ActiveX control for, and is it safe?” answers: “The short answer is yes, our control is safe.”

ActiveX vulnerabilities in non-Microsoft products are nothing new, of course. Just over a month ago, for example, a critical ActiveX flaw was spotted in Yahoo Widgets, a development platform that runs small, Web-based, gadget-like applications on Windows desktops.

Researcher: Don’t Trust Google Toolbar

Makers of some of the most popular extension software used by the Firefox browser are not doing enough to secure their software, a security researcher said Wednesday. The problem is that many widely used Firefox extensions, including toolbars from Google, Yahoo, and AOL, do not use secure connections to update themselves, according to Christopher Soghoian, a security researcher.

The Indiana University doctoral student discovered the Firefox issue last month while examining network traffic on his computer. He noticed that many of the most popular Firefox extensions are not hosted on servers that use the very secure SSL Web protocol.

Although the corporation behind Firefox, Mozilla, hosts the majority of Firefox extensions on its own SSL-enabled Web site, it is common for commercial extension-makers such as Google to host their software on an unsecured site, Soghoian said in an interview.

This leaves users vulnerable to a “man-in-the middle” attack, where Firefox could be tricked into downloading malicious software from a site it mistakenly thought was hosting an extension.

It wouldn’t be easy for an attacker to pull this off, however. In one scenario, the hacker would set up a malicious wireless access point in a public area where people are using wireless connections. He could then redirect extension update traffic to a malicious computer. “An attacker who sets up a wireless access point can then infect anyone who connects to it,” Soghoian said.

Data Security And Theft Top IT Concerns For 2006, Continuing Into 2007

The number of personal records exposed in data security breaches surpassed 100 million this year.

So says the Privacy Rights Clearinghouse, which has been keeping count ever since a high-profile data leak at information broker ChoicePoint in early 2005. It keeps track of thefts and losses of gear such as laptops, storage tapes and drives, as well as of hacking incidents and insiders who leak data.

The count climbed throughout 2006: Boeing, the Department of Veterans Affairs, Hewlett-Packard, McAfee, the University of California, and many others made headlines as a result of breaches.

Most incidents come to light because of laws requiring public notification of data loss in cases where data is unencrypted. In response, security companies are increasingly pitching encryption products for secure storage–for example, Seagate Technology is building it into its drives. Microsoft is also getting into the game: business versions of Windows Vista have a full-disk encryption feature called BitLocker.

But encryption technology still lacks usability, a panel of industry experts said at an event celebrating the 30-year anniversary of cryptography.

Meanwhile, banks and credit agencies are hawking credit-monitoring services. In September, researchers named several banks as a consumer’s best bet in terms of offering protection against identity theft.

Breaches are only one way people’s identities can be compromised. Phishing scams are getting more widespread, and fraudsters are getting trickier in their attempts to con Internet users. People with high incomes attract more phishing e-mails and lose more money to them than other Internet users, according to a November Gartner report.

Scammers are helped by an apparent influx of cross-site-scripting bugs. These Web security flaws could let attackers craft a URL that looks like it points to a trusted site, but serves up content from a third, potentially malicious site. This year, this type of bug was found in many popular Web sites and in Google’s search appliances.

Phishing shields are now common. Microsoft has built one into its latest browser, IE 7, and Mozilla offers a similar feature in Firefox 2.

Alternative approaches to combat phishing include a new DNS service, OpenDNS, whose free address-lookup service blocks phishing sites and other threats.

Yahoo added an antiphishing feature to its site that displays a custom image on the log-in screen to verify that it is indeed a Yahoo page.

But if confidential data isn’t exposed through data breaches or pilfered through a phishing scam, there’s still malicious software. Criminals are crafting more-targeted Trojan horse attacks that seek to sneak onto PCs through zero-day flaws, experts have warned. In addition, some malicious software is now designed to let cybercrooks surf into online banks with you to steal your money.

You could also be exposed while on the go. Privacy watchers warn that people carrying passports equipped with radio chips could have the information in the document read from a distance. The solution: keep the passport closed and in a foil bag.
— from CNET News Service