Very Important Security Update

January 21 saw the release by Microsoft of a very important out-of-band security bulletin to address recently publicized flaws in Internet Explorer.

So-called “out-of-band” bulletins are those released at a time other than Microsoft’s traditional Patch Tuesday — the second Tuesday of each month. Out-of-band announcements are bulletins/patches/updates that Microsoft believes are too important to delay action on until the next Patch Tuesday.

If Microsoft admit the extra importance of a new “fix” then you should definitely sit up and take notice.

These most recent exploits have been well publicized worldwide (believed to have originated in China and possibly with government sponsorship) and can also cause problems via other applications such as the Adobe PDF Reader.

You must take action NOW!

I strongly suggest that you take immediate action as follows:

1. Visit the Microsoft update website and perform an update on your PC.
2. Visit the Secunia website, download the Secunia Personal Software Inspector (PSI), install it, run it and update any out-of-date applications it reports. Thousands of computer users are being compromised/robbed/impersonated every day because they continue to use out-of-date/unpatched applications.
3. If you’re still using Internet Explorer (sigh!) download and install Firefox and set it as your primary browser. Look, Internet Explorer doesn’t hold a candle to Firefox in ANY respect. Firefox is better, safer, faster and far superior in the usability and productivity stakes.
4. If the Adobe Reader is your PDF reader of choice, disable JavaScript in that application only. You’ll find numerous suggestions to disable JavaScript in your browser, but that’s a self-defeating move. So many websites rely on JavaScript for functionality that you will effectively cripple your browser by disabling JavaScript. However, disabling JavaScript in Adobe Reader is a different matter altogether. Very, very few PDF files utilise JavaScript, and if you should encounter one (very unlikely) you can enable JavaScript just for that document (if you’re absolutely sure it’s safe). To disable JavaScript in Adobe reader, open the reader and proceed as follows:

• Edit –> Preferences
• Select the JavaScript entry in the left column
• Uncheck Enable JavaScript in the right column

And remember this:

The vast majority of damaging exploits rely on you taking some action such as clicking a link or opening an attachment. In my e-book The Hacker’s Nightmare I discussed these ploys in some depth under the heading of “social engineering”.

DO NOT ALLOW YOURSELF TO BE SOCIALLY ENGINEERED!

Related articles

• Why France and Germany Got it Right: IE Must Go
• Critical out-of-band patch for Internet Explorer now available
• Microsoft patching “Google hack” flaw in IE tomorrow
• McAfee: China attackers exploited new IE hole
• McAfee: China attackers exploited unpatched IE hole
• Mozilla releases Firefox 3.6 with promise of more speed, stability
• Microsoft to release early patch
• Microsoft confirms 17-year-old Windows bug
• Microsoft fixes 8 IE holes, including one used in attacks
• How to improve Internet Explorer security