Internet Explorer cookie contents - the new format analysed

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

Microsoft changed the way that Internet Explorer cookie files work and randomised cookie filenames, for security reasons; the cookie text files now have random names which don't indicate the name of the website that saved the cookie, and you have to open up each cookie file individually to check what that is.

However, you can still view the contents of all your IE cookies, unmangled, by exporting your cookies to a single cookies.txt file. Then if you open up that cookies.txt file, you can see the cookie info, in a much more comprehensible, intelligible user-friendly format, eg:

Webtrends seems to be used by Microsoft for recording web visitor analytics & statistics info.

I compared the contents of a couple of the new cookies against the cookies.txt versions to try to figure out how they work. I found that if you copy and paste the text from the cookie file into something else (eg a new text document), the info is broken up into separate lines (ie there's hidden new lines to separate the different components of the info).

For example, the contents of a Twitter cookie file named J0R4GWEF.txt, which like the other contents of cookies appeared to run continuously on in the txt file, was split up like this:

guest_id
v1%3A131542058071389408
twitter.com/
214748475215010693123032155316242192030174605*

The cookies.txt equivalent of that was:

twitter.com TRUE / FALSE 1378897943 guest_id v1%3A131542058071389408

So that helps to figure out the new format of the cookie file. The elements seem to be in this order:

1. variable name (eg "guest_id")
   
2. variable value (eg "v1%3A131542058071389408") - the equivalent of the old "guest_id=v1%3A131542058071389408"
3. domain name (ie the website which set the cookie, eg "twitter.com/")
4. something I haven't figured out yet (in the example above, it's "214748475215010693123032155316242192030174605") - but it must convert to the expiration date for the variable (ie 1378897943 in the example above), which traditionally is the number of seconds since 1 Jan 1970, and shows up as the "proper" figure in the cookies.txt version. Maybe this long figure also contains other info about the cookie file
5. * symbol - which marks the end of this variable, and the start of the next variable set by the website, whose name etc follow in the same order.
   

I worked out the purpose of the * from looking at a single Google cookie file, for example these contents, of a single txt file:

PREF
ID=15025770280c4f56:U=8cbfd7d77ff8ecf4:FF=0:TM=1315398473:LM=1315408615:S=zAzaJeJ5lq1Y-EEk
google.com/
1536
521981312
30321428
744646208
30174577
*
NID
50=IVMzsW2RssDmmdt21XYqM-m6GMBe731GqCispetEG495dEdHdl_tlLqIv8h8tINpCg1kI2lgsAgLheW-TVQzbGoBoiHfBjSJuhOPJSEfWVNTw-H-_Nt16tyNCyIL2zCf
google.com/
9728
2103298560
30211390
722926208
30174577
*

- showed up in the cookies.txt file as this:

google.com TRUE / FALSE 1378844158 PREF ID=15025770280c4f56:U=8cbfd7d77ff8ecf4:FF=0:TM=1315398473:LM=1315408615:S=zAzaJeJ5lq1Y-EEk

google.com TRUE / FALSE 1331583355 NID 50=IVMzsW2RssDmmdt21XYqM-m6GMBe731GqCispetEG495dEdHdl_tlLqIv8h8tINpCg1kI2lgsAgLheW-TVQzbGoBoiHfBjSJuhOPJSEfWVNTw-H-_Nt16tyNCyIL2zCf

Final example, from a Facebook cookie:

eLlnTol8k9yayreWIGxF-h6m
facebook.com/
2147492864
3767864320
30321455
3978419216
30174604
*
translates to:

facebook.com TRUE / FALSE 1378856079 datr eLlnTol8k9yayreWIGxF-h6m
datr

I've not yet worked out how the name of the cookie text file relates to anything in its contents (which no doubt is part of the purpose of the security fix!), so you still can't tell which file was set by which site without opening up each file. The order of info in the cookies.txt document doesn't match the order of the dates that the cookies were created or modified, and they're not in alphabetical order of domain name either. But at least it's possible to check out all the contents of all cookie files at once.

Internet Explorer cookie names change

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

Worried that your cookie filenames have changed to incomprehensible random strings of letters and numbers? No need. Microsoft has, for security reasons, changed the way IE cookies are named. This is to improve security and reduce "cookiejacking", addressing one way in which attackers might be able to access your cookies (which could include your login information etc).

Side effects: some apps depending on the old cookies names system broke, eg CCleaner and WinPatrol. Also, it's now harder for users to figure out which cookies were set by which websites, as you can't tell the website name from the cookie name anymore. You have to open up the cookie file to check.

However, other browsers like Firefox aren't affected by the change - it's Internet Explorer only.

Old cookie names structure

Internet Explorer cookies used to have filenames with the structure: yourcomputerloginname@partialdomainname.txt eg johnsmith@microsoft.txt (or johnsmith@msdn.microsoft[2].txt etc).

IE cookies are typically located in your AppData\Roaming\Microsoft\Windows\Cookies folder (to find the AppData folder, click Start, in the search box type "appdata" without the quotes and hit Enter. If that doesn't work try "%AppData%" again without the quotes which may go straight to the "Roaming" subfolder).

The security hole, and update

However, in August Microsoft released a Cumulative Security Update for Internet Explorer (2559049) which (according to Microsoft Security Bulletin MS11-057) addresses a "Drag and Drop Information Disclosure Vulnerability CVE-2011-2383" which existed because IE (all versions) didn't properly restrict access to store cookie files.

In more detail for the techies, before the update Internet Explorer did not "properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue".

This vulnerability meant that "An attacker who exploited the vulnerability when a user views a Web page and performs a drag-and-drop operation could gain access to cookie files stored in the local machine."

What the security fix changes

To fix the vulnerability, this update modified how Internet Explorer accesses locally stored cookies, and how it manages cookie files. These changes included changing how Internet Explorer sets file names for cookies, to help make cookie file names less predictable.

Reportedly this change has been seen in several Windows operating systems, ie XP, Vista and Windows 7, and several versions of Internet Explorer including IE8 and IE9 (which would make sense as Microsoft's info says the vulnerability affects Internet Explorer 9 and previous versions).

A Microsoft blog explained the change - see the "Cookie Filenames are Randomized" heading. It's now harder for attackers to guess the location of a particular cookie as IE cookie files are now named "using a randomly-generated alphanumeric string. Cookies are not instantly renamed on [the security] upgrade, but are instead renamed as soon as any update to the cookie’s data occurs."

Consequences of the cookie name change

Now, cookie names look like this:

As mentioned earlier, certain software depending on the old system doesn't work anymore, and will have to be tweaked.

From the viewpoint of those protective of their privacy, while you can't see the website's name from looking at the cookie filename, you can still see it if you open up the cookie in Notepad or other text editor.

For example, here's the contents of cookies saved by Microsoft when I visited and then re-visited their webpage about the cookie change. You can see "microsoft" in there:

And here's the contents of a cookie saved by Google when I searched for info on the cookie change using the search box in Internet Explorer. Again, you can see "google.com" in there, although the filename is now "25Z1H29G.txt", and no longer mylogin@google.txt:

For more details of how it seems to work behind the scenes, I've done a separate blog post on how to view the contents of your Internet Explorer cookies in a more user-friendly way.

Secure your computer against Windows .lnk shortcut zero day vulnerability

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

If you use Windows, you should install anti-malware vendor Sophos's free Windows Shortcut Exploit Protection Tool ASAP - so called because a recently discovered "zero day exploit" enables attackers to use Windows shortcut link files (.lnk files) to run malicious code on your computer when you visit a dodgy website, open a dodgy document, plug in a dodgy USB stick (or open an infected folder on your network, load a dodgy DVD or CD - you get the drift, anything that gets Windows to display the icon of a manipulated file).

You don't even have to click anything to get infected. Bad guys have been having a field day with this security vulnerability but unfortunately Microsoft haven't issued a full fix yet (their suggested workaround blanks out your Start menu shortcut icons), so kudos to Sophos for announcing the provision of their free tool to block the exploit from running on your computer.

Just check your computer for malware first (there are free tools to do that, e.g. NOD32 ESET and Microsoft's Security Essentials), then download the Sophos tool and run it (or click the link and click Run) to install Sophos's blocking tool. Sophos say it won't interfere with any existing anti virus software.

Here's a Sophos video with more info about the problem.

Tags: malware, security vulnerability, security vulnerabilities, zero day vulnerabilities, exploits, Improbulus, A Consuming Experience

Adobe Reader, Flash, Acrobat security issue - update / delete ASAP

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

There's been another critical security vulnerability with Flash (SWF) affecting Adobe products like Flash Player, Reader, Acrobat and possibly others like Photoshop and Fireworks, fo all types of computers whether running Windows, Mac or Linux.

It could enable bad hackers to take over your computer, and has been increasingly exploited since it was first announced last week, with malicious websites using it to make the computers of unsuspecting visitors download malware like trojans. See the US-CERT report and e.g. BBC report and TrendLabs.

Given the widespread use of Acrobat Flash (e.g. for YouTube and web animations) and PDF files, this sort of thing is serious - indeed, according to a Symantec internet security threat report published in April 2010, the bad guys are now targeting Acrobat Reader more than anything else these days: 49% of all web-based attacks made use of infected PDF files (next 3 were vulnerabilities with Windows and Internet Explorer).

How to protect your computer

Flash Player, Adobe AIR - Adobe have recently released a security update for these products. You ought to update them via auto-update or downloading Flash Player and (if you use AIR) downloading AIR.

Adobe Reader, Adobe Acrobat - there are instructions here with the fixes or workarounds for the main operating systems, Mac and Linux as well as Windows. Windows users need to delete or rename the Adobe authplay.dll files - one for Reader (which most people have), one for Acrobat (which only some people have).

Note however that doing that will result in a crash or error message when you open a PDF file containing Flash SWF content - which isn't that common, so it seems worth it. Hopefully when Adobe issue an update for these products it'll all be sorted.

If you're a Windows user, to save time you can click on the following links in order to open the appropriate folder fast, then find authplay.dll in it and delete or rename it (if those folders aren't used on your computer, try searching for the filename in Windows Explorer):

• Reader - file:///C:/Program%20Files/Adobe/Reader%209.0/Reader/
  
  
  
• Acrobat (only works if you have Acrobat!) - file:///C:/Program%20Files/Adobe/Acrobat%209.0/Acrobat/

Note: if clicking these links doesn't work, such as where your system is set to open URLs in a browser other than Internet Explorer (e.g. I've previously blogged how to get Outlook links to open in Firefox instead of Internet Explorer), you'll have to copy and paste the link into the Internet Explorer address bar and then hit Go or Enter. Don't worry, those links only let you access your own local system, neither I nor anyone else can use them to mess with your computer!

Tags: Flash, SWF, Flash Player, Acrobat, Reader, Adobe AIR, security issue, security vulnerability, Improbulus, A Consuming Experience

Public Bank of Malaysia phishing scam

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

To my Malaysian and other Asian readers - and I know I have some, thank you for the links to this blog! - just to point out that there's a phishing scam targeting Public Bank of Malaysia customers, so be extra careful before clicking links in emails supposedly from that bank. Spotted by TrendLabs.

Tags: phishing, Improbulus, A Consuming Experience

What App?: security & privacy ratings of applications; tools to protect privacy

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

Before downloading and installing a new application, whether on your computer, Facebook, iPhone or Android or other smartphone, you can now check reviews of web and mobile apps for their privacy, security and openness.

Reviews on the What App site, by a team of about 15 lawyers, computer scientists, and privacy and security experts from Stanford University and other institutions, were recently thrown open to all visitors (who can request as well as post reviews). "Think Consumer Reports blended with Wikipedia and Yelp, but focused on the narrow issue of Internet security and privacy."

The site also reviews web browsers like Firefox and Safari, social networks including Twitter and Facebook and mobile platforms like Apple's iPhone, Windows Mobile and Google's Android.

According to the Stanford news item, "The reviews come in the form of written comments and badges that award applications up to five green bars for privacy, security and openness. Wikis accompany the reviews to summarize what the app does, and the site immediately serves up a list of links to news stories about an app's privacy and security issues.

The site also allows app developers to sign in and write notes about the privacy and security of their creations."

Check out the most privacy-friendly applications on What App? - including tools to help protect or enhance your privacy online.

Tags: WhatApp, Improbulus, A Consuming Experience

Internet Explorer: critical security updates

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

Microsoft have just released a set of important security updates for Internet Explorer for Windows to fix some critical vulnerabilities, so if you don't set your Windows updates to happen automatically, you ought to go update your computer manually ASAP.

See Microsoft Security Bulletin MS10-108 for more info.

Tags: Internet Explorer, security vulnerabilities, security holes, Improbulus, A Consuming Experience

Blogger users beware: phishing attack

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

According to security firm Trend Micro, bad guys are sending emails to Blogger users, pretending to be from Blogger.

The email asks users to "update" their accounts by clicking a link - which seems to lead to a Blogger login page starting with the same domain name as the real Blogger site, but in fact is a fake page where, if you enter your Blogger login details, they'll steal them.

So beware.

Granted, people might not be surprised that British politicians were taken in by Twitter phishing scams last week, but when even someone as tech-savvy as Cory Doctorow has had his account hacked (according to a Yahoo! story), it shows you just can't be too careful.

Tags: phishing, blogs, Improbulus, A Consuming Experience

Google security problem: have you had this?

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

Is Google logging people into Google's system randomly with someone else's Google account? How is this possible?

Here's what happened: I started my computer, which I'd set to automatically open a few programs like Firefox.

I went to Firefox and searched via the Firefox search bar (which goes through GoogleSharing) for something I'd posted a query on, to check if anyone had answered the query.

I then clicked the search results link to go to the Google Group entry I was looking for - and was startled to see, at the top of the webpage, that I was logged in as sol[rest of name deliberately deleted]@gmail.com! Which obviously isn't me. See screenshot below (click pic to enlarge):

Like a good citizen, after taking the screenshot I immediately clicked "Sign out". But I suspect that if I'd then gone to Gmail, Google Calendar etc, I'd have been able to view sol...'s private stuff.

I closed Firefox and re-opened it, and then did exactly the same search in exactly the same way. This time, I got what I expected, I wasn't signed in as anyone at all:

I don't know what's going on. I did have some trouble with my computer slowing down terribly this morning, and had to shut it down using the Power button as it wouldn't shut down by itself. I run a full anti-virus and anti-spyware scan every week, but that doesn't mean my computer hasn't been infected. I'm about to run them again.

But, I really don't know what's going on. I'm now really concerned that someone else somewhere else in the world could just go to a Google webpage without logging in, and find that they're already logged in as me. And, being less scrupulous, get access to all my Google stuff, without my being any the wiser.

Has this happened to anyone else? On searching, I see this sort of thing has happened before (and not just with Google Groups), in 2007 there was "isolated bug in our [Google's] interaction with a proxy server in Singapore" and it seems to have happened again with Singapore users in 2009.

But I'm in the UK. Which isn't supposed to have fancy national filtering or censoring software, as far as I know anyway...

Anyway, I'm reporting it to Google but if anyone else has come across this issue, please post a comment. Very worrying.

UPDATE: no, I can't report it to Google, the link that Matt Cutts of Google gave in relation to the previous problems in 2007 just has no category appropriate to this issue! Well I hope someone from Google spots this.

UPDATE 2: with apologies to sol... for not thinking to do this straight off, I've obscured the second half of their name in the email address, and also in the screenshot, so that spambots etc don't pick up their email from this blog post.

UPDATE 3: Also, Moxie Marlinspike of GoogleSharing is looking into whether it might be to do with GoogleSharing. The person concerned has confirmed that they don't use GoogleSharing so it's not a GoogleSharing issue.

Internet Explorer, Outlook: update ASAP!

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

Yesterday Microsoft issued a Windows security update for the Internet Explorer browser exploit that had been, well, exploited by cyberspies to get data from the computers of Google and other companies, as I previously mentioned. Criminals have already started using the same security vulnerability. The security hole can affect other Microsoft products like Outlook, Heise Security have pointed out.

If you haven't already got the update for your Internet Explorer, make sure you do. The easiest way is via Windows Update. Those who have it set to automatically download and install Windows Updates should have had it installed automatically.

If not, be sure to manually check for Windows updates and install - find Windows Updates via your Start Menu, check, download and install - or download and install the version suitable for your version of Windows and your browser from Microsoft. (For beginners - to find your browser version go to the Help > About Internet Explorer menu. If you're a non-techie your computer is very likely a 32 bit rather than 64 bit system.)

How to improve Internet Explorer security

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

You may have heard (e.g. BBC, MacWorld, New Scientist) about the recent cyberspying attacks from within China which tried to obtain secret commercial data from the systems of Google and other large companies like Adobe (corporate espionage, it seems) and to access Gmail accounts of human rights advocates - attacks which led Google to reconsider its approach to China and stop filtering / censoring search results there.

Now it's emerged from computer security company McAfee (see ComputerWeekly, Reuters, BBC) that one of the attacks exploited a little known vulnerability in Microsoft's ubiquitous Internet Explorer browser software - more details are in Microsoft's security advisory and blog post.

If you use Internet Explorer 6 (or indeed Internet Explorer 7 or Internet Explorer 8) in Windows, clicking on a link or file attachment, e.g. in an email from a supposedly trusted source, can through this vulnerability cause malware to be downloaded, enabling control to be taken of your computer totally unbeknownst to you. The cyber attacks were mainly focused on Internet Explorer 6 which, while now outdated and very insecure, is still used by many organisations

Even if you don't think you have juicy intellectual property on your system and you're not a human rights activist, you can bet your bottom dollar that bad hackers everywhere will want to exploit this vulnerability to try to get into computers generally.

So if you have Internet Explorer you should take steps to try to secure it better. The Microsoft security advisory has suggestions but I always find screenshots more helpful so here's a summary of what they said (bearing in mind that 100% security can never be guaranteed):

1. Internet security zone - the best protection seems to be to set this zone's security to High. Then you'll get warning prompts before certain possibly dangerous things (ActiveX controls, Active Scripting) can be run, which you can refuse (it may be safer to say No if you're not sure). Though this may cause some websites not to function fully.
1. How? - menu Tools > Internet Options > Security tab, click Internet, move slider to High:
   
   
2. See the advisory for more details e.g. dealing with trusted sites so you don't have to keep clicking Yes for those.
   
   
2. Internet and Local intranet security zone - to get a prompt before running Active Scripting or (which may make some sites stop working) to disable it completely.
1. How? - menu Tools > Internet Options > Security tab, click Internet then Custom Level (see pic above). Then find the Scripting section, Active scripting subheading and ensure it's set to Prompt or Disable, then OK:
   
   
2. Then again - menu Tools > Internet Options > Security tab, click Local intranet this time, then Custom Level:
   
   - then find the Scripting section, Active scripting subheading and ensure it's set to Prompt or Disable, then OK as before.
3. See the advisory for more details e.g. dealing with trusted sites so you don't have to keep clicking Yes for those.
   
   
3. Internet Explorer 7 or Internet Explorer 6 SP2 (to check your version, menu Help > About Internet Explorer) - enable Data Execution Prevention or DEP. It should already be enabled in IE 8.
1. How to enable DEP? Go to this site and under "Enable Application Compatibility Database" click the Fix it button, Run and follow the instructions.
   
2. Alternative way to enable DEP - menu Tools > Internet Options, Advanced tab, scroll down to the Security section and ensure "Enable memory protection to help mitigate online attacks" is ticked, then OK.
   
   
   
1. Can't do it? Close IE, rightclick the Internet Explorer icon, choose "Run as Administrator" to re-open it and try again. If that doesn't work still, login as administrator. You may not have administrator rights in which case this won't work.
4. Use another less attacked browser like the free Firefox browser instead (ideally with NoScript)! If you have Outlook be sure to then set Outlook to open email links in Firefox instead of IE, so that when you click links in an email they won't open up in Internet Explorer but in Firefox.
   

And of course, ensure you use a firewall like the free ZoneAlarm, plus anti-virus and anti-spyware software, which can be free, make sure you regularly update them and run the scans, and also regularly update Windows and other software like Firefox, Adobe Acrobat Reader, Adobe Flash and so on.

A helpful official UK site for beginners:

• Get Safe Online
  

Tags: security vulnerability, exploits, hacks, Improbulus, A Consuming Experience

Security - passwords

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

It's always worth emphasising (even though I have before!) the importance of having strong passwords for your online accounts, and a recent Microsoft Malware Protection Center blog post has some useful do's and don'ts for passwords

It includes some interesting stats on the most common usernames used by bad hackers in automated attacks (change your username from Administrator, or if your name is andrew, dave, steve, paul or adam!).

Common words used in password attacks were also given, and again using "password" or "123456" really isn't a good idea.

See that blog post for their tips and you can always test your password on their password strength checker.

Tags: password, passwords, tip, tips, Improbulus, A Consuming Experience

Check if your Hotmail etc account is safe; secure your passwords

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

You've probably seen the tons of publicity recently about lots of webmail account details (e-mail addresses and passwords) being stolen or phished and published online - initially for 10,000 HotMail emails but then it transpired also some 20,000 other email accounts on Hotmail, Yahoo, AOL, Gmail and also service providers Comcast and EarthLink.

Heise have provided a link to a page where you can enter your email address (just the part before the @ sign) to check if your own email address is on those published lists or not.

If not, at least it's some relief to know, although that only means your account isn't on that particular list - it doesn't mean your account hasn't been compromised in some other way, so you should always remain vigilant about security and not reply to phishing emails (even the FBI director's nearly been caught out!).

Check your email address on Thomas Springer's ServerSniff.

More secure passwords

Many of the passwords concerned were easily guessable (don't use 123456 or 123456789 and the like for your password!) so follow good password practices, don't use the same one for every account or service; follow advice for choosing secure passwords e.g. Michael Santerre for Gmail, or Elinor Mills on cnet (including this free Microsoft password strength checker page), and of course security guru Bruce Schneier's tips.

Tags: password, passwords, tips, Improbulus, A Consuming Experience

More Acrobat security issues - try Foxit

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

After yet another report on Adobe Acrobat Reader and Acrobat security flaws for all of Windows, Mac and Linux, I think I'm going to switch back to the free Foxit Reader for PDF files - pictured above.

I'd lazily left it at Adobe when I had to switch my main computer last Christmas, but Foxit seems a lot safer. It's certainly faster at opening Portable Document Format (PDF) files. And did I say it was free?

The Foxit PDF reader has plugins for Internet Explorer and Firefox and, though I've not tried it yet, it seems you can manually integrate it with Chrome in Windows (see rdnetto's post here - note that on my Windows Vista system the Foxit plugins folder in fact had both DLL and OCX files in it, and the Chrome plugin folder was in C:\Users\myusername\AppData\Local\Google\Chrome\Application\ - your mileage may vary). You also have to let it through your firewall too, of course.

Try it: download Foxit.

Tags: Foxit Reader, PDF, PDFs, Adobe Acrobat Reader, Adobe Reader, Improbulus, A Consuming Experience

More critical Adobe security updates

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

If you use Adobe Flash (you do if you watch YouTube videos), Adobe Acrobat Reader (for viewing PDF files) or Adobe AIR (for TweetDeck etc), best update all of them ASAP for critical security vulnerabilities.

See the Adobe page for what to download for your own setup.

Via Heise Security.

Tags: Adobe, Adobe Reader, Adobe AIR, Adobe Flash, Improbulus, A Consuming Experience

Windows: update Internet Explorer ASAP

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

If you were asked by Windows Update to update last night and you didn’t do it, or if somehow you got missed out, best get the MS09-034 update ASAP that Microsoft rolled out quickly yesterday (scroll down that page for a link for your particular system) as that has fixes for critical ActiveX security vulnerabilities affecting your web browser use.

Via Heise Security.

Tags: critical security vulnerability, security update, internet explorer, web browsers, Improbulus, A Consuming Experience

Ironkey: secure USB stick, surfing? - review

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

This is a review of the Ironkey Personal secure USB flash drive.

Many people use USB sticks or memory sticks, also called USB keys, thumb drives, flash drives and the like, for portable storage or transport of data from computers.

But they can be used to store confidential or sensitive information, e.g. copied from government databases by government employees, and are unfortunately all too easy to lose or steal (e.g. with info on suspected terrorists, vehicles of interest to the police, RAF personnel and NHS patient’s medical/personal details) - yet often they are allowed by UK government departments to be used unencrypted, despite a few recent improvements.

Is something like an Ironkey secure memory stick the answer?

It’s supposed to work on Mac and Linux as well as Windows (just for encrypted storage), and I bought an Ironkey Personal unit about a year ago, because it claimed to offer:

1. hardware-based encryption of the files on the stick (using AES encryption) with military-grade waterproofing / shock resistance, and
2. secure surfing with Portable Firefox (what they call “internet protection” – it’s only “free” i.e. included in the original price for a year; after that you have to pay an ongoing subscription).

It certainly cost enough, at an eye-watering £80. Well OK, it cost less than a Ferrari, granted, but considering that you can get USB drives with far greater capacity for under a tenner, you want to be sure you’re getting your money’s worth. And in my case, I don’t think I did.

Verdict

My view? Unless perhaps you’re a government department, don’t buy an Ironkey - except maybe for encrypted storage of any sensitive passwords (Personal or Enterprise versions) or files (Basic version) you might want to carry around with you (and even then, you can encrypt files or store passwords securely on a normal price USB thumb drive for free using the excellent open source TrueCrypt software, although it seems you need administrator rights on the computer you plug it into – I’ve not used TrueCrypt enough, myself, and will report further when I have).

I should say that I was also frustrated that I’d bought the Ironkey on the basis that they’d promised Linux support would be forthcoming. New models released just after I bought mine did support Linux, but it took Ironkey forever to roll out upgrades enabling existing units to support Linux.

Secure web browsing?

I’d wanted to use the Ironkey for secure surfing too, e.g. plugging it into a public computer in a public library or internet cafe and then surfing the web via portable Firefox i the unit, but in my view it wasn’t fit for that purpose because:

1. At least in all the London libraries / cafes I tried, it doesn’t work – they lock things down so you can’t use Portable Firefox on the Ironkey
2. The point of security is, well, security. Browsers ought to be upgraded as and when browser security updates are issued. If Ironkey really cared about security they would immediately provide upgrades for the browsers built into their units as soon as security updates were made available. But for months after major Firefox security upgrades were released last year, you couldn’t download security upgrades for the browser on the Ironkey. Maybe you can now, but I’ve stopped asking Ironkey or looking on Ironkey’s site. I can’t use the browser anyway, see the previous point.

Also, their secure web sessions are based on but claimed to be much faster than Tor – being routed through Ironkey’s own computers, hence the periodic subscription fee. Whether you trust the security and anonymity of things going through their routers (they’re headquartered in California) is of course up to you.

Features

For those interested (but really I’d suggest you save your money), the Ironkey:

1. comes in a nice strong shiny metal case
2. requires a password to access its contents, and physically “self destructs” internally if the wrong password is tried too many times
3. (Personal and Enterprise editions only) includes a password manager which enters your saved passwords for you (make sure you’re keylogger free first!) – that’s actually the only use I’d see for it, myself
4. (Personal and Enterprise editions) lets you backup your passwords to the Ironkey site, and yes I know, you have to trust how they say it works
5. enables some portable applications to be run from the drive.

See their FAQs for more info, and their user guide for Personal, and comparative chart of their 3 models (Enterprise, Personal, Basic).

Tags: Ironkey, review, files, encryption, USB thumb drives, USB flash drives, USB memory sticks, secure USB drives, Improbulus, A Consuming Experience

Security updates for Internet Explorer & Firefox 3.0.5 / 2.0.0.19 - upgrade ASAP!

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

Both of the major browsers Microsoft Internet Explorer and Mozilla Firefox recently issued important security updates.

You've probably heard about the critical Internet Explorer security flaw which even hit the mainstream media, e.g. see the BBC news report which noted that the security hole could let criminals "take control of people's computers and steal their passwords".

If you use Internet Explorer or Firefox (particularly the former), you're well advised to upgrade your web browser ASAP:

• Download the Internet Explorer 960714 security update, scroll down to find the download for your version - menu Help, About Internet Explorer to check which version you have (you'll need to use the general update site if you have Internet Explorer 8 Beta 2, but you can download the security fix for Internet Explorer 8 Beta 1).
  
  
• Download Firefox 3.0.5 or download Firefox 2.0.0.19 - incidentally if you're still using Firefox 2 you really should upgrade to Firefox 3 as Mozilla aren't planning to provide any further security or stability updates for Firefox 2.

For those of you who aren't using Firefox yet - why not? It's as easy to use as Internet Explorer, a lot more powerful in terms of free useful or fun extensions or add ons you can install, and probably most importantly it's generally a lot more secure (especially if you download the free NoScript extension). I plan to write a short post extolling the virtues (but a couple of minuses) of Firefox soon, to help persuade the unconvinced (you know who you are!).

I actually use 3 different browsers for different purposes: Internet Explorer, Firefox, and Opera (and I'm playing with Google's Chrome). E.g. if I'm going to a site I don't know or completely trust yet, I'll use Firefox with NoScript. If I'm impatient or need speed I use Opera, e.g. as a reference browser with lots of tabs open at the same time relating to a subject I'm looking into. And I use IE if a site just won't work in anything else, or just to split out identities (for one identity I login to Webmail etc in Firefox, for another in IE, etc.)

Tags: Internet Explorer 960714, Firefox 3.0.5, security updates, security upgrades, security holes, critical updates, Improbulus, A Consuming Experience