Inland Pacific Consulting
VisitUsAt.com (dba Inland Pacific Consulting) is a development and hosting company serving the on-line demands of today's business. You will find us large enough to offer and support the latest technology, yet small enough for you to talk to.
We are here to answer the questions that will enable you to establish your business on the Internet and to collaborate with employees and clients in the easiest and most cost effective manner. If you are considering implementing the latest Microsoft collaboration tools; or simply looking for a new, more reliable hosting solution and collaboration service provider, VisitUsAt.com can help.
If you have any questions regarding collaboration services, web hosting, design or domain name services, please call 1-800-593-0234 toll free.
Category Archives: Alert
Apple Users Fix for Certificate Attacks
In light of the disclosure on Wednesday about 9 fraudulent SSL certificates being issued by a partner of Comodo, Microsoft was quick to respond with an update to protect users of Windows.
Apple however has not reacted leaving many OS X users in the dark. Mike Shannon from SophosLabs did some research for me this week so we could provide a guide on configuring your Mac to be secured against these bogus certificates.
Unfortunately not all browsers behave the same on OS X so we have to describe a few different processes to ensure maximum protection.
Apple Safari and Google Chrome both support the Apple Keychain application for managing digital certificates and determining who you trust.
You will need to open the Keychain Access application. Go to Applications -> Utilities -> Keychain Access or press Cmd+Shift+U and open Keychain Access.
Choose the Keychain Access menu in the Menu Bar and choose Preferences or press Cmd+[comma]. Within the preferences dialog choose the certificates button and set both OCSP and CRL to "Best Attempt"....
Network Solutions Hack hit up to 5 Million Sites
According to a Tech Herald report appearing over the weekend, an attack on a widget offered by hosting company Network Solutions to customers of its hosting and domain parking services led to the distribution of malware by sites displaying the widget, through the compromise of Network Solutions’ own growsmallbusiness.com site, which distributed the widget.
(WEB HOST INDUSTRY REVIEW) -- According to a Tech Herald report appearing over the weekend, an attack on a widget offered by hosting company Network S...
Worms Attack Skype, Yahoo Messenger
Security researchers at Symantec and BKIS report worms hitting users of Yahoo Messenger and Skype via malicious instant messages.
Just another reminder to not click on links in emails from people you don’t know.
Read full story here: http://www.eweek.com/c/a/Security/Security-Researchers-Report-Attacks-on-Skype-Yahoo-Messenger-199929/?kc=rss
Russian Hacker Selling 1.5 Million Facebook Accounts
Image via CrunchBase
1242 Million Facebook Accounts tweets Million Facebook Accounts 04/23/10 by Jolie O’Dell A hacker who calls himself Kirllos has obtained and is now offering to sell 1.5 million Facebook IDs at astonishingly low prices — $25 per 1000 IDs for users with fewer than 10 friends and $45 per 1000 IDs for users with more than 10 friends — according to researchers at VeriSign’s iDefense. Looking at the numbers, Kirllos has stolen the IDs of one out of every 300 Facebook users. Information for sale includes login credentials; whether or not the e-mail addresses and passwords are legitimate is currently unknown.
Typically, this information would be sold for between $1 and $20 per account, according to data from Symantec. Currently, around 700,000 accounts have been sold. The threads where the accounts are being sold have been removed, as far as we are able to tell. The users whose e-mail addresses and passwords have been compromised risk having their identities stolen, but they could also become targets of more insidious scams.
As always, we will keep you updated about any Facebook scams that come across our news desk. Hacking Facebook isn’t a new hobby for this person. Here’s a screenshot of another offer the hacker previously made on a forum earlier this year; then, he was then selling 100,000 hacked accounts from users around the world: Kirllos also appears to have had an interest in iPhone applications at one point. According to some Antichat.ru forum users, he was born in Russia, lives in New Zealand, is 24 years old and speaks both English and French.
Use McAfee Antivirus Software?
An update to McAfee’s antivirus software falsely identified a standard Windows file as a virus and has wreaked havoc on computers nationwide. Click on the link below to read more.
Apple has more Security Holes than Microsoft
Here's another blow to those insist that Apple products are rock solid and unhackable: The security company Secunia reports that Apple products have more vulnerabilities than those of any other company. Oracle came in second place, with Microsoft in third.
Secunia just issued a report that covers vulnerabilities for the first half of 2010, and it's not good news for Apple. The report (which you can download here) shows that Apple last had the most vulnerabilities of all vendors in 2005, before Oracle took over the top spot. And now Apple is on top again. You can see the chart, below.
The chart shows that Apple products consistently have more vulnerabilities than do Microsoft ones....
Network Solutions Hack Compromises 573,000 Credit, Debit Accounts
Anyone that had an online store hosted by Network Solutions needs to read this article.
Network Solutions Hack Compromises 573,000 Credit, Debit Accounts
- Image by Jordan and Lee via Flickr
Hackers have broken into Web servers owned by domain registrar and hosting provider Network Solutions, planting rogue code that resulted in the compromise of more than 573,000 debit and credit card accounts over the past three months, Security Fix has learned.
Herndon, Va. based Network Solutions discovered in early June that attackers had hacked into Web servers the company uses to provide e-commerce services – a package that includes everything from Web hosting to payment processing — to at least 4,343 customers, mostly mom-and-pop online stores. The malicious code left behind by the attackers allowed them to intercept personal and financial information for customers who purchased from those stores, Network Solutions spokeswoman Susan Wade said.
Wade said the company is working with federal law enforcement and a commercial data breach forensics team to determine the cause and source of the break-in. The payment data stolen was captured from transactions made between March 12, 2009 and June 8, 2009.
Image by dfmartins via Flickr
On Friday, Network Solutions began notifying affected customers by e-mail and postal mail. Due to the potential high cost of notifying individual victims, the hosting company is offering to handle the notification of affected customers of the breached online stores. Forty-five states and the District of Columbia have enacted laws requiring organizations to notify consumers when a data breach or loss jeopardizes the security of personal and financial data, but the rules for complying with those laws differ from state to state.
“We feel terribly about it to burden them with the notification process, which can be kind of tricky because there is no one federal data breach statute,” Wade said.
Critical JavaScript vulnerability in Firefox 3.5
Microsoft Internet Explorer has long been criticized as ‘insecure’ and vulnerable to attack while Mozilla Firefox was touted as the browser to use to keep your web browsing and your computer safe. It doesn’t appear that this is the case any longer. Make sure you apply all available patches as soon as they become available–for all your software–to keep your computer secure and less vulnerable to attack.
07.14.09 – 10:15am
Issue
A bug discovered last week in Firefox 3.5’s Just-in-time (JIT) JavaScript compiler was disclosed publicly yesterday. It is a critical vulnerability that can be used to execute malicious code.
Impact
The vulnerability can be exploited by an attacker who tricks a victim into viewing a malicious Web page containing the exploit code. The vulnerability can be mitigated by disabling the JIT in the JavaScript engine. To do so:
- Enter
about:configin the browser’s location bar. - Type
jitin the Filter box at the top of the config editor. - Double-click the line containing
javascript.options.jit.contentsetting the value to false.
Note that disabling the JIT will result in decreased JavaScript performance and is only recommended as a temporary security measure. Once users have been received the security update containing the fix for this issue, they should restore the JIT setting to true by:
- Enter
about:configin the browser’s location bar. - Type
jitin the Filter box at the top of the config editor. - Double-click the line containing
javascript.options.jit.contentsetting the value to true.
Alternatively, users can disable the JIT by running Firefox in Safe Mode. Windows users can do so by selecting Mozilla Firefox (Safe Mode) from the Mozilla Firefox folder.
Conficker Worm Targets Microsoft Windows Systems
Original release date: March 29, 2009
Source: US-CERT
Systems Affected
- Microsoft Windows
Overview
US-CERT is aware of public reports indicating a widespread infection of the Conficker worm, which can infect a Microsoft Windows system from a thumb drive, a network share, or directly across a network if the host is not patched with MS08-067.
I. Description
The presence of a Conficker infection may be detected if a user is unable to surf to the following web sites:
- http://www.symantec.com/norton/theme.jsp?themeid=conficker_worm&inid=us_ghp_link_conficker_worm
- http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx
- http://www.mcafee.com
If a user is unable to reach either of these web sites, a Conficker infection may be indicated (the most current variant of Conficker interferes with queries for these sites, preventing a user from visiting them). If a Conficker infection is suspected, the infected system should be removed from the network. Major anti-virus vendors and Microsoft have released several free tools that can verify the presence of a Conficker infection and remove the worm. Instructions for manually removing a Conficker infection from a system have been published by Microsoft in http://support.microsoft.com/kb/962007.
II. Impact
A remote, unauthenticated attacker could execute arbitrary code on a vulnerable system.
III. Solution
DotNetNuke 5.0.0 Upgrade Warning
We have been supporters of DotNetNuke (DNN) for the past several years and offer it as a hosting option to our clients. For those not familiar with DNN, it is the Open Source ASP.NET answer to Joomla!–both being content management systems. A content management system is software that keeps track of every piece of content on your Web site, much like your local public library keeps track of books and stores them. Content can be simple text, photos, music, video, documents, or just about anything you can think of. A major advantage of using a CMS is that it requires almost no technical skill or knowledge to manage. Since the CMS manages all your content, you don’t have to.
Recently, DotNetNuke released to market (TRM) their newest version 5.0.0, and we upgraded immediately and were met with a multitude of problems–from images not showing up, users not being able to logon to their portals, and a whole host of other little issues. After visiting the DNN site forums, it turns out that we were not the only users experiencing these problems. There were some ‘fixes’ for some, but further reading found some of the developers suggesting restoring the previous version as there were a lot of problems that somehow escaped detection in the preliminary testing before the release. Additionally, they promised that there would be a version 5.0.1 that would ‘fix’ all of these issues coming out in short order. We restored our previous version of DNN and anxiously awaited the 5.0.1 version to be releases.