<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jul 12, 2012, at 4:11 PM, Ron Frazier (ALE) wrote:</div><blockquote type="cite">
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
<div text="#000000" bgcolor="#ffffff">
Hi all,<br>
<br>
FWIW, here are some miscellaneous security items that you might want to
be aware of that I heard on the latest Security Now podcast. I haven't
had any chance to investigate any of these in detail.<br>
<br>
* If you're a lastpass user, there is a setting in the options which
allows you to turn on iterative password hashing. This helps prevent
brute force attacks on your password. Recommended setting is 512 I
believe. Apparently, for some accounts, it is not turned on by default.<br>
<br>
* If you're forced to use Windows, a vulnerability in Vista and Windows
7 sidebars and gadgets has been discovered which potentially allows an
attacker to do "remote code execution". In other words, they can take
over your machine. Microsoft has released a FixIt button on their
website to totally disable sidebars and gadgets.<br>
<br>
* The following applies if you use the Plesk website management
system. This is a quote from the following website:<br>
<br>
<a class="moz-txt-link-freetext" href="http://blog.sucuri.net/2012/06/plesk-vulnerability-leading-to-malware.html">http://blog.sucuri.net/2012/06/plesk-vulnerability-leading-to-malware.html</a><br>
<br>
"The first issue is that old versions of Plesk store passwords in <em><strong>clear
text</strong></em> (yes, clear text in 2012). The second is a remote
SQL vulnerability that has been found in old versions of Plesk allowing
attackers to exploit those passwords."<br>
<br>
As I understand it, even if your Plesk installation has been updated,
the passwords in the database are vulnerable until they are changed.<br>
<br>
Sincerely,<br>
<br>
Ron<br>
<br>
<pre class="moz-signature" cols="72">--
(To whom it may concern. My email address has changed. Replying to former
messages prior to 03/31/12 with my personal address will go to the wrong
address. Please send all personal correspondence to the new address.)
(PS - If you email me and don't get a quick response, you might want to
call on the phone. I get about 300 emails per day from alternate energy
mailing lists and such. I don't always see new email messages very quickly.)
Ron Frazier
770-205-9422 (O) Leave a message.
linuxdude AT <a href="http://techstarship.com">techstarship.com</a>
</pre>
</div>
_______________________________________________<br>Ale mailing list<br><a href="mailto:Ale@ale.org">Ale@ale.org</a><br>http://mail.ale.org/mailman/listinfo/ale<br>See JOBS, ANNOUNCE and SCHOOLS lists at<br>http://mail.ale.org/mailman/listinfo<br></blockquote></div><div><br></div>If I heard the report correctly. LastPass users with existing accounts do NOT have iterative hashing enabled and must manually go into their settings and turn it on. For new LastPass users (signed up after this announcement was made), the option will be enabled by default.<div><br></div><div>And, not to hijack this and turn it into a discussion about Micro$oft (in)security, if you run ANY version make sure you're systems are up to date (DUH!!!). They recently released a patch for the XML Core Services vulnerability (finally!!!) -- <a href="http://technet.microsoft.com/en-us/security/bulletin/ms12-043">http://technet.microsoft.com/en-us/security/bulletin/ms12-043</a></div><div><br></div><div><div apple-content-edited="true">
<div>-- <br>Ted W. < <a href="mailto:Ted@Techmachine.net">Ted@Techmachine.net</a> ><br>Registered GNU/Linux user #413569</div><div><br></div><br class="Apple-interchange-newline">
</div>
<br></div></body></html>