A week ago, Microsoft officials said they were removing one of the company’s Windows patches from the Windows Update pipeline because of reports of blue-screening by some XP users after applying that patch.

On February 17, via the Microsoft Security Response Center (MSRC) blog, the Softies shared the fruits of their investigations of this issue. My ZDNet blogging colleague Ed Bott had predicted, the blue screening was a result of malware already on users’ XP machines. And that seems to be the case, Microsoft officials said — specifically the   Alureon rootkit.

According to the new blog post by MSRC Director Mike Reavey, Microsoft is “working on a simpler solution to detect and remove Alureon from affected systems which should be released in a few weeks.” (Other third-party security firms are doing the same, Reavey said.)

There’s no update in the new post as to when Microsoft will recommence distributing MS10-015 via automatic update (I’d think if and when that happens, it will be after Microsoft releases the Alureon rootkit-detection fix.)

Microsoft pulled MS10-015 (KB977165) from WIndows Update in early February after reports by users, including some XP users claiming blue-screen-of-death (BSOD) issues seemingly resulting from application of the that patch.

Users still having issues they believe may be the result of MS10-015 can obtain free support from Microsoft by going to https://consumersecuritysupport.microsoft.com or by calling 1-866-PCSafety (1-866-727-2338). International customers can find local support contact numbers here: http://support.microsoft.com/common/international.aspx.

The software vendor has released an unscheduled update to fix vulnerabilities in all previous versions of Reader, including a code injection vulnerability more »

Opera Software has released version 10.61 of the Opera web browser to fix a high severity hole. The issue was a heap overflow in the HTML5 canvas when performing some painting operations, which could in some cases be used to execute code. Read the full article

This week in our regular free music slot, we showcase the electro band, The Slips, who are offering up a series of free mixtapes to celebrate their new forthcoming single. Read more

So it looks like it's not only Geek Squad staffers that scour customers' computers for free porn. A woman in California has recently gone public with claims that she not only watched as a Dell tech support worker downloaded nude pics of her remotely, but that he also set up a website featuring the photos. Oh, and he used her Dell credit card to buy stuff for another woman.

The woman called Dell support after some "personal pictures" she'd stored on her new Dell PC appeared to have disappeared from her hard drive. "I couldn't find them on my computer and that made me nervous," she said.

She was connected to a Dell tech in Mumbai, India, who asked if he could access her computer remotely, which she agreed to. "I trusted him," she explained. "I trusted him because he was a Dell technician and I don't like the cyberworld, you're so vulnerable."

But that's when, she alleges, she watched as the Dell employee not only found the photos, but downloaded them onto his own computer. Says the woman, "I'm totally convinced. I watched him take the pictures out of my e-mail. I watched him."

Not long after her call with Dell, those same photos popped up online.

At this point, you'd think she would have gotten a lawyer involved, but the woman continued to communicate with the Dell tech. In a head-scratcher of a twist, he talked her into shipping him a new Dell laptop so he could "work on her case" from home.

Says the woman:

“And I'm telling myself, my conscience is talking to me saying, 'Tara, don't send this. What are you doing? Are you crazy?' I sent it anyways because I really believed in this guy. I really had faith that he was protecting my dignity.
”
But wait -- it gets stranger.

Apparently, the California customer wasn't the only woman the Dell dude was chatting with online. In fact, on Valentine's Day he admitted to having fallen in love with a customer from Tennessee.

And he he must have been so blinded by his love that he used the California woman's Dell credit card to order $800 in Dell computer gear for the his Tennessee sweetheart.

The tech admitted the thievery in an e-mail from his official Dell account. "You're my true friend," he wrote. "I am sorry accidentally I charged your Dell account but I will pay. I don't want to lose my job. It was a mistake which happened with me."

According to the woman, Dell has been unresponsive to her complaints. They also did not reply to a request for comment from the ABC affiliate that first aired the story.

The woman says she has contacted an attorney and is considering legal action against Dell
 

Continue reading »

This is not the first time a famous Twitter account is hacked, and I can bet it won't be the last. Barack Obama, Britney Spears, British Petroleum and the New York Times are just a few big names/brands that have gone through this painful process.  Usually, accounts representing companies or celebrities are managed by people with excellent communication skills, not IT skills, and especially not IT security skills.

In general, a lack of user education and strong policies regarding online security often lead to undesirable events.  Whether you manage an official Twitter account or a personal one, you should know how Twitter accounts get hacked so you can protect yourself.

Continue reading »

I've read a lot of stores lately about "credit score enthusiasts" who want to get the perfect credit score or are obsessed with improving their score. While it's certainly better than not caring about your credit score at all, it almost never pays to get a perfect score.

More »

Easily identify and remove crapware from a new (or old) PC. "The PC Decrapifier is a program designed to remove or uninstall a specific list of unwanted software in an unattended fashion. It can be used to clean off most of the annoying software that is typically shipped with new PCs

Downloaded

Livescribe's 500,000 customers have something new to talk about a second digital pen, the Echo, released in late July. Read more

Researchers are advising Facebook users to avoid offers to download an “official dislike button”, which the firm claims has spread virally across the service. There are  two different versions of the ruse thus far, both with tiny URL links to rogue applications. Read the full article. [

Opponents of Arizona's immigration crackdown  went ahead with protests Thursday despite a judge's ruling that delayed enforcement of most the law, and dozens of people in Phoenix were arrested after peacefully confronting officers in riot gear

Continue reading »

More than a year after the pop icon's death, Michael Jackson has a new video game on the way, one that teaches players to moonwalk, spin and slide like the King of Pop once did.

Michael Jackson The Experience, due in November for Wii, Xbox, PS3, PSP and DS (rated E10+ for ages 10 and up), lets players try to match some of his classic moves.

John Branca and John McClain, co-executors of the Michael Jackson estate, say they had been looking for a video game to showcase his legacy. (His last game, Moonwalker, in the early '90s, had him dancing to defeat "Mr. Big" and save the children

Continue reading »

Google has restored its "personalized" search suggestions after purging the tool of a critical vulnerability that allowed attackers to steal a user's web history. Read the full article

With stories abounding of identity theft aided by information lifted from discarded storage devices, you want devices you no longer plan to use to have no usable information when they head out the door. Here's how to wipe them clean

How to Completely Erase Your Hard Drives, SSDs and Thumb Drives

Coconut water is well, watery, and high in the electrolyte potassium. Recently, some marketing genius realized that it was basically a natural "sports drink." But is it really better?

Mother Jones looked into the issue and found that, while coconut water isn't exactly the same as a sports drink, it's pretty good for a mild to moderate workout.

“

But according to Liz Applegate, director of sports nutrition at UC-Davis, coconut water isn't ideal for prolonged bouts of physical activity. That's because of its particular blend of electrolytes. Unlike sports drinks, which generally contain a lot of sodium and a little potassium, coconut water is the opposite: heavy on potassium, light on sodium. "Even though the belief is that when you exercise you need a lot of potassium, sodium is more important," says Applegate. "When you sweat, you lose a lot more sodium than potassium." (Zico's new Natural Bottle product has a little more sodium, but unlike most coconut waters, it's made from concentrate.) Applegate says she has never seen any convincing scientific evidence to support anti-aging and kidney health claims. Still, she doesn't dismiss coconut water entirely. "If you like the taste, great," she says. "If you're doing a short workout, great."

”

Mother Jones also says that coconut water isn't horrible for the environment, because coconut trees require little fertilizer or pesticides and prevent soil erosion.

Just don't confuse it with coconut milk, which is made from the white part of the coconut. Coconut water is a clear liquid found inside young coconuts.

Is Coconut Water Really Better Than Sports Drinks? [MotherJones]

Adobe Reader comes pre-installed on most computers. And even if you never use it, just its mere presence can leave your computer at risk. If you absolutely must keep Adobe Reader or Acrobat, here are the must-follow security tips you need to make Adobe Reader and/or Adobe Acrobat safer. 
 Continue reading »

Dell said human error was to blame for mistakes which led it to ship a number of replacement server motherboards to customers pre-loaded with spyware. The company declined to say whether it was running anti-virus software at its factory but said it had taken 16 steps to improve processes. Read the full article

The tool allows users and IT professionals to harden existing software against known attacks - without the need to recompile
more »

In the wake of all of the stories about the Windows DLL hijacking bug, it appears that certain Linux distributions may be vulnerable to a similar problem related to the way that Linux handles a specific variable in some cases. The bug apparently was introduced via a Debian patch last year.Read More

Google has restored its "personalized" search suggestions after purging the tool of a critical vulnerability that allowed attackers to steal a user's web history.

Personalized search suggestions were disabled on March 1, and they didn't return until April 20. Ordinarily, Google adds these personalized keyword suggestions to its generic suggestion list if you've turned on Google Web History, a service that stores your searches and page visits. The personalized suggestions are based on data from Web History

By Cade Metz in San Francisco Get more from this author

I’ll be purposefully neglecting the Site over the next day or 2. Time For Family matters as we prepare to celebrate. Have a wonderful Easter, everyone! ::NB::

Bot herders and the crimeware gangs behind banker Trojans have had a lot of success in the last few years with using bulletproof hosting providers as their main base of operations. But more and more, they're finding that social networks such as Twitter and Facebook are offering even more fertile and convenient grounds for controlling their malicious creations.

New research from RSA shows that the gangs behind some of the targeted banker Trojans that are such a huge problem in some countries, especially Brazil and other South American nations, are moving quietly and quickly to using social networks as the command-and-control mechanisms for their malware. The company's anti-fraud researchers recently stumbled upon one such attack in progress and watched as it unfolded.

The attack is as simple as it is effective. It begins with the crimeware gang setting up one or more fake profiles on a given social network (RSA isn't naming the network on which it saw this specific attack). The attacker then posts a specific set of encrypted commands to the profile. When a new machine is infected with the banker Trojan, the malware then goes out and checks the profile for new commands. The specific command in this case begins with a string of random characters that serves as an authentication mechanism of sorts, letting the Trojan know it's found the right commands.

The rest of the encrypted string are hard-coded instructions telling the Trojan what to do next, whether it's to look for other machines on the network, search for saved data or log keystrokes when the user visits a specific online banking site.

This certainly is not the first example of this kind of activity on social networks. There have been botnets controlled via Twitter for at least a year now, and researchers have found a number of example of Facebook profiles set up specifically for malicious activity. But this is one of the results of the success that researchers and law enforcement have had in recent years in shutting down the bulletproof hosting providers who have been harboring botnet C&C servers and Trojan drop zones for a long time.

"The most interesting thing is that it's part of a growing trend. These groups have had four main options for hosting if they want to put it in a resilient infrastructure," said Uri Rivner, head of new technologies--consumer identity protection at RSA, the security division of EMC. "You can build your own, and there are some that are very sophisticate with great disaster recovery, but that's expensive. You can go with bulletproof hosting, but that's getting harder. You can use cloud services, which we've seen some of lately. Or you can now use social networks. That's getting more popular because resilience is they key for some of these Trojans that can run for months or years. It's so important to them to find a good hosting environment."

The other thing that makes networks such as Twitter and Facebook attractive for bot herders and Trojan gangs is the ease with which they can set up new profiles. The profiles themselves essentially become disposable, because the attackers can code a list of dozens or hundreds of such profiles into the Trojan and if one is discovered and taken offline, the malware move on to the next one. It's also quite difficult for the operators of these sites to identify and block these profiles quickly enough, making them soft targets for the attackers.

"The only downside for the attackers is if the companies start fighting back against it, but that's hard," Rivner said. "This is the easiest, the cheapest and most reliable infrastructure that I see  (VIA /threatpost.com)

Add this to the list of reasons why you should think twice before moving to Yuma, Ariz., where the thermometer can hit 124 degrees: nearby Marine Corps radio signals can kill your garage door opener

Foothills resident has garage door problem

All of the holes are contained in WebKit and can be exploited to compromise systems

 more 

A Twitter user has demonstrated a cross-site scripting (XSS) vulnerability on the microblogging platform that could allow an attacker to take over users' accounts or spread malware. Read the full article

The developers of the uTorrent file-sharing application have released an updated version that fixes a problem that could allow an attacker to load malicious code onto a user's computer. Read the full article

Windows 7 Starter edition is the lowest, basic Windows 7 edition available at a very cheap price. Such a price is justified by the fact that a lot of features and options available in other Windows 7 editions are completely missing in this version. In fact, for example, you can not change and customize the wallpaper,  you can only use the “Windows Basic”, you can not switch between users, you can not change window colors, or sound schemes etc. This little tutorial will teach you how to unlock certain features in Windows 7 Starter in order to customize it in any way you wish!

1. As a first step, download  and install Stardock MyColors.  This little tool will let you change the theme of your Windows 7.
2. Now, if you want to change the screensaver click Start and in the Search field, type change screen saver.
3. Click the Change Screen Saver option and change the screensaver!
4. If instead you want to change the system sound, click Start and in the Search field, type change system sounds.
5. Change the system sound scheme with the ones available

The guys over at LiveSide.net have once again stumbled upon new screenshots of Windows Live Wave 4.  The screenshots reveal a new look on the header themes for some of the Windows Live services, including Hotmail, live.com, and other sites. Microsoft accidentally gave some users a sneak peak when they released... Read More