Windows Critical Image Flaw - Temporary Workaround

Computer users are being alerted to a new flaw in Microsoft Windows which can be used to attack a PC.

The US net watchdog, the Computer Emergency Response Center (Cert), and security firms have issued warnings about certain types of image files called Windows Metafiles.

Experts said numerous websites were taking advantage of the flaw to sneak into computers and install spyware.

Microsoft has said it is looking into the issue.

The flaw centres on the way Microsoft's operating system handles Windows Metafiles (.wmf). These are image files that can contain both vector and bitmap-based picture information.

Temporary Fix:
This is a temporary workaround to the problem and should be used by Firefox users as well as users of Internet Explorer:

You need to unregister the bit of code (Shimgvw.dll) that allows the exploit to work. It handles the .wmf type files that are being exploited.

To un-register Shimgvw.dll, follow these steps:

1. Click Start, click Run, type "regsvr32 -u %windir%\system32\shimgvw.dll" (without the quotation marks), and then click OK.

2. A dialog box appears to confirm that the un-registration process has succeeded. Click OK to close the dialog box.

Impact of Workaround: The Windows Picture and Fax Viewer will no longer be started when users click on a link to an image type that is associated with the Windows Picture and Fax Viewer (the code used by the exploit).

Should you need to re-register the file because of poor performance, do the following:

1. Click Start, click Run, type "regsvr32 %windir%\system32\shimgvw.dll" (without the quotation marks), and then click OK.

2. A dialog box appears to confirm that the registration process has succeeded. Click OK to close the dialog box.

.

Criminals target viruses for cash

At first glance 2005 looks like it was a quiet year for computer security because there were far fewer serious Windows virus outbreaks than in 2004.

According to figures gathered by security firm Symantec, there were 33 serious outbreaks in 2004. These are incidents measured by the number of people a virus infects or the severity of the damage they inflict.

In 2005, there were only six such incidents.

'We're talking about a substantial decrease in worldwide pandemics,' said Kevin Hogan, senior manager in Symantec's security response team.

This decline is taking place because virus makers have largely stopped spreading their malicious wares with mass-mailers that try to infect as many people as possible via their inbox.

Instead, virus creators are cranking out more versions of malicious programs than ever before.

The malicious hackers are also keen to replenish the ranks of the viruses circulating online as fixes are found for previous versions.

It also marks a tactical change toward more customised attacks. Instead of trying to infect everyone, many virus creators are creating variants that attack small groups of users.

Sometimes these are customers of particular companies, often banks, and occasionally they are the workers in a single organisation.

Smaller groups are being targeted because many of the groups sending out viruses are criminals keen to profit from the machines they compromise.

Links:
Sophos
F-Secure
Kaspersky

.

'Family from hell' get life terms

Four family members and a teenager have been jailed for life for killing a mother they had tortured for months.

The five, described as the 'family from hell', were found guilty of murdering Rachel Hudson, 20, whose body was found near Newstead Abbey, Notts, in 2004.

Rachel's husband Craig, 21, his brother Ronald Hudson Jnr, 23, along with their parents Ronald Hudson Snr, 49, and Trudi Hudson, 44, had denied murder.

Elisabeth Hogg, 19, was also convicted.


The family from hell. Ronald and Trudi Hudson, Ronald Hudson Jnr., Craig Hudson, Elisabeth Hogg

Ronald Hudson Jnr will serve at least 17 years, Craig Hudson and Elisabeth Hogg will spend a minimum of 14 years in prison.

Rachel's battered body was found face down in mud near a lake just 17 months after her wedding.

She had suffered more than 60 injuries at their hands in the weeks before she died.

When she was found, 11 of her ribs were fractured and her mouth was so badly injured that her bottom lip had become detached from her skull.

She had also suffered cigarette burns, scalds and heavy bruising as a result of countless attacks with a baseball bat and a piece of wood.

She eventually died of thrombosis caused by a blood clot in her brain that had been left untreated for weeks. It had been brought on by septicaemia, dehydration and repeated assault.

Home Office pathologist Professor Guy Rutty told the court it was the worst case he had ever seen.

Cosmetic surgery website launched

A website giving information about cosmetic surgery and treatments is being launched by the government.

The Department of Health says it is important people considering treatment can access reliable information about the risks and likely outcomes.

Cosmetic surgery is not available on the NHS, but there has been a big increase in demand in recent years.

There are concerns that many people opt to undergo treatment without first seeking proper medical advice.

I do know of one lady who went in for a nose job and came out in a box because the surgery was botched. The surgeon, in an attempt to stem the bleeding from a vessel he had inadvertantly severed, stuffed packing bandages into her nasal cavity ... problem was he kept stuffing and ended up driving the packaging into her brain (no shit, you couldn't make this stuff up).

Links:
Dept. of Health - Cosmetic Surgery
British Association of Aesthetic Plastic Surgeons

Had Enough of Blogshares

Well, it is with some sadness I have decided to stop all Bloshares activities. It's a complicated game I have played for quite a time. Indeed, I renewed my subscription just last week. This came immediately after a devaluation of Blogshares currency that resulted in my B$40 trillion fortune (half bought and half worked for, heh) devalued to a measly B$4 billion.

Ok, I thought, I can understand the need to lose some of the zeros across the board and thought the game could still use my support, despite much grumbling from other irate players who had witnessed their fortunes obliterated overnight.

Today, I was playing and got scammed out of the B$6 billion I had been patiently working to build since the devaluation. A player exploiting a loophole or a fault of the game? I don't know. The player involved did offer to put right my losses when I complained about the situation on the Blogshares forum.

What made me decide I'd had enough of Blogshares was not the losses so much as the attitude of the Admins towards a paying customer - me. In effect they said, "So what? It's what happens." when I appraised them of the situation. No, it isn't what happens. I've played the game for more than a year and this type of situation does not happen. The game, or system, as it's known, was faulty. It shouldn't allow such a situation to occur ... but it did.

Being told, "Too bad," isn't good enough for a long-term, paying customer of the game. Especially one who doesn't open multiple accounts, exploit bugs in the system or run automated blogshares scripts like those found here and here.

That's what finally made me say, enough is enough, and wave goodbye to Blogshares.

.

Google’s Dodgy New Firefox Extension

Google just released a new Firefox extension called “Safe Browsing for Firefox”. From the 'Introduction' section of the plug-in website, here is what it does:

'Google Safe Browsing is an extension to Firefox that alerts you if a web page that you visit appears to be asking for your personal or financial information under false pretences. This type of attack, known as phishing or spoofing, is becoming more sophisticated, widespread and dangerous. That's why it's important to browse safely with Google Safe Browsing. By combining advanced algorithms with reports about misleading pages from a number of sources, Safe Browsing is often able to automatically warn you when you encounter a page that's trying to trick you into disclosing personal information.'

Good enough. I clicked on the FAQ section of the web-site to learn how the extension works, and here is the explanation given:


'6. How does Google know a page is bogus?
We use several techniques to determine whether a page is genuine, including the use of a blacklist containing pages that have been identified as suspicious and/or misleading based on automated detection or user reports. Our software also examines pages' content and structure in order to catch potentially misleading pages. Google Safe Browsing can't offer perfect protection, so you should always be on the lookout for indications that a site isn't what it appears to be. But Google Safe Browsing can help identify and protect you against many of the sites designed to trick users.'

techie explanation ...

Then the conclusion:

This extension is designed to help protect users from illegitimate resources, but the irony is that it has the potential to expose sensitive information about you when you visit legitimate resources!

Bit of a bugger. Your anti-nasty-site toolbar from your trusted friend Google sends all your sensitive info (including credit card numbers, etc. ) in plain text because of bad programming.

I wonder if other anti-nasty-site toolbars such as eBay's do the same thing?

.

Browser users urged to patch up

Windows users are being warned about a bug that lets attackers take over a PC via the Internet Explorer browser.

The bug made possible webpages that can compromise a PC without a user spotting the attack, Microsoft warned.

Code to exploit the bug was circulating online which led Microsoft to label the bug 'critical' and said users should apply a patch immediately.

At the same time a similar bug was found to be affecting the rival Firefox web browser.

more ...

14-Day Plan Improves Memory

It sounds like an infomercial from late-night TV: Follow this four-step plan and improve your memory in just 14 days!

But researchers have indeed found a way to improve memory function in older people. After a two-week study that involved brainteasers, exercise and diet changes, study participants' memories worked more efficiently.

Here's the program:

Memory Training: Brainteasers, crossword puzzles and memory exercises that emphasized verbal skills throughout the day.

Healthy Diet: Five meals daily included a balanced diet rich in omega-3 fats, whole grains and antioxidants. Eating frequent meals prevents dips in blood glucose, the primary energy source for the brain.

Physical Fitness: Brisk daily walks and stretching. Physical fitness has been found in other research to reduce the risk of Alzheimer's disease.

Stress Reduction: Stretching and relaxation exercises. Stress causes the body to release cortisol, which can impair memory and has been found to shrink the memory centers in the brain.

Before-and-after brain scans showed the participants experienced on average a five percent decrease in brain metabolism in the dorsal lateral prefrontal region of the brain, which is directly linked to working memory and other cognitive functions. This suggests they were using their brains more efficiently. The subjects also performed better on a cognitive test.

A control group that didn't follow the plan showed no significant changes.

'We've known for years that diet and exercise can help people maintain their physical health, which is a key component of healthy aging,' said Gary Small, professor of psychiatry and behavioral sciences UCLA. 'But maintaining mental health is just as important. Now we have evidence which suggests that people can preserve their memory by adding memory exercises and stress reduction to this routine.'

Song lyric and tab sites face legal crackdown

The music industry is to extend its copyright war by taking legal action against websites offering unlicensed song scores and lyrics.

The Music Publishers' Association (MPA), which represents US sheet music companies, will launch its first campaign against such sites in 2006.

MPA president Lauren Keiser said he wanted site owners to be jailed.

He said unlicensed guitar tabs and song scores were widely available on the internet but were 'completely illegal'.

Mr Keiser said he did not just want to shut websites and impose fines, saying if authorities can 'throw in some jail time I think we'll be a little more effective'.

Yes! Jail the evildoers for their heinous crimes. 20 years in the slammer should stop these music peddlars in their tracks and prevent the corruption of children who try to learn to play music

US warns of fake net domain data

More than 5% of the net's most popular domains have been registered using 'patently false' data, research shows.

A US congressional report into who owns .com, .net and .org domains found that many owners were hiding their true identity.

The findings could mean that many websites are fronts for spammers, phishing gangs and other net criminals.

The report also found that measures to improve information about domain owners were not proving effective.

Painkiller liver failure warning

Scientists are warning about the risks posed by paracetamol after it emerged the painkiller had become the leading cause of liver failure in the US.

The annual proportion of cases caused by paracetamol - known in the US as acetaminophen - had risen from 28% in 1998 to 51% in 2003, researchers said.

The US team found just 20 pills a day - the recommended maximum is eight - was enough to kill, New Scientist reported.

Wikipedia tightens online rules

Online encyclopaedia Wikipedia has tightened its submission rules following a complaint.

Prominent journalist John Seigenthaler described as 'false and malicious' an entry on Wikipedia implicating him in the Kennedy assassinations.

When he phoned Jimmy Wales, Wikipedia's founder, he was told there was no way of finding out who wrote the entry.

Wikipedia has since removed the entry and now requires users to register before they can create articles.

But visitors to the site will still be able to edit content already posted without having to register.

'Mirror neurons' lacking in autism

Abnormal activity in neurons that help individuals imitate others may underlie some of the social deficits found in autism, US researchers believe.

A Nature Neuroscience study found autistic children had less brain activation in an area involved in understanding others' state of mind.

The degree of activation of the 'mirror neurons' housed in this area correlated with measures of social impairment.

The lower the activation, the stronger the impairment the children had.

Oh Crap!

Changes to ocean currents in the Atlantic may cool European weather within a few decades, scientists say.

Researchers from the UK's National Oceanography Centre say currents derived from the Gulf Stream are weakening, bringing less heat north.

Their conclusions, reported in the scientific journal Nature, are based on 50 years of Atlantic observations.

They say that European political leaders need to plan for a future which may be cooler rather than warmer.

The findings come from a British research project called Rapid, which aims to gather evidence relating to potentially fast climatic change in Europe.



That's what we really need in Scotland; colder weather. :o/