Israel-Hamas Malware

Trend Micro is reporting the latest variant on the "please install a fake Flash player that is actually malware" attack, this one using CNN and the war between Israel and Hamas.

The attack comes as an unsolicited e-mail with news about the conflict. The sender and subject change with every message. The message claims to contain a link to an Al-Jazeera video. Clicking the link brings the user to a fake CNN page with a video on it. Start the video and the user gets a dialog box telling them to "Please Download the correct Flash Media Player!" Clicking OK starts a download of the malicious file Adobe_Player10.exe, which Trend detects as TROJ_DLOADR.QK.

This malware is a "downloader" which then downloads and installs other malware, TROJ_INJECT.ZZ, which "...is an info-stealer that logs keystrokes and launches a sniffer to retrieve passwords from network packets. It then uploads the gathered data to several URLs. It also drops a rootkit component detected as TROJ_ROOTKIT.FX." Bad news. (story Link)

64-Bit Computing Has Finally Arrived

We uncovered what 64-bit computing means (both to you and the pros) and ran hands-on tests with key apps on high-end workstations. What's more, we built our own 64-bit powerhouse, at a price that's lower than you'd guess. We'll show you how.

In technology, some ideas take time to germinate, none more so than 64-bit computing, where the operating system and software (including most drivers) run on a 64-bit CPU from Intel or AMD. Linux has been 64-bit for eight years, and Apple's operating system for five. But compatibility problems have dogged the 64-bit versions of Windows since its introduction in Windows XP. There are several key advantages, such as improved performance and support for many gigabytes of RAM. The real question is, why 64-bit—and why now? And, why should you care?

Let's be honest: The promise of 64-bit computing has been around for a while—some would say it's a broken promise. Yet the planets have finally aligned: Microsoft offers a 64-bit version of both Windows Vista Ultimate and Windows XP Pro, and 64-bit versions of Linux are freely available. According to Gartner, one out of every four PCs sold today comes with a 64-bit OS installed. As for hardware, both Intel and AMD have offered 64-bit processors for years. And the additional RAM supported by the wider data bus is now amazingly affordable, thanks to a streamlined manufacturing process and mainstream levels of demand.

Most important, companies such as Adobe, Apple, and Autodesk (and that's just those that start with the letter A) now offer their flagship software products in 64-bit versions. Adobe, for the first time, offers its Creative Suite 4 in a 64-bit version—currently for PC only, with a Mac version in the works.

The main benefit has to do with memory addressing. A quick lesson in processor technology: Long ago, the brilliant minds in computer science (engineers working at Intel and other companies) decided that a PC would need only a 32-bit "register size"—the amount of RAM a CPU can access. In mathematical terms, that's 232 or exactly 4GB of RAM. Back then, the high cost of memory and the absence of 64-bit software or operating systems meant that few imagined a CPU running in 64-bit mode. (full Story)

Adobe Releases 'Clickjacking' Fix for Flash

When we first wrote up clickjacking we noted that the "...proof of concept code was said to affect every major browser and 'an Adobe product' (Flash? Acrobat?)" Turns out it was Flash.

Now Adobe has revealed a workaround for the attacks, which can trick a user into clicking on a link or dialog box unwittingly. Adobe Flash Player 9.0.124.0 (the current version) and earlier are affected.

The Flash player's camera and microphone access dialog are the problem, and the workaround involves denying interactive access to them through Flash. There is a workaround to the workaround in which specific sites may be allowed access.

Adobe says that a true fix will be available before the end of October. (story Link)

Adobe Creative Suite 4

Adobe Creative Suite 4 (CS4) is the planned successor to Adobe Creative Suite 3. It is currently being developed by Adobe Systems. Public betas of some applications (Dreamweaver, Fireworks and Soundbooth) were released on May 27, 2008.

Currently, little is known about the development of CS4. New versions of Photoshop and Flash are known to be in development, and have been released to select beta testers. Other applications from previous versions of Adobe Creative Suite are also assumed to be in development. CS4 will be available as both 32-bit and 64-bit applications for Windows, but only 32-bit for OS X.

There is currently no public release date or pricing information for Adobe CS4, although there is speculation of a release date in late 2008 or early 2009.

Confirmed-applications

So far, only a limited number of applications from previous versions of Creative Suite have been confirmed to be in development. These are:

• Adobe Dreamweaver - codenamed "Stiletto"
• Adobe Fireworks
• Adobe Flash - codenamed "Diesel"
• Adobe Flash Player - codenamed "Astro" (a new version of Flash Player may be released separately from CS4)
• Adobe Photoshop - codenamed "Stonehenge"
• Adobe Soundbooth

It is assumed that other popular applications from previous versions of Creative Suite, including Bridge, Illustrator, and Premiere will be updated and included with CS4. Some new applications, including Thermo, may also be included. Additionally, it is possible that existing applications will be removed or merged together, given the several overlaps in Adobe's product line since acquiring Macromedia, and comparable feature consolidation from CS3.

New features

Although Adobe has not made any formal announcement about the new features to be introduced in CS4, some new features have been shown in beta tests and demonstrations. Visually, the suite is undergoing a new UI overhaul that does not following typical consistencies, similar to how Office 2007 uses a non-standard interface).

• Dreamweaver - Many new features aimed towards improving workflow and ease of use:
  • Live View - The ability to view a web page under standards-based browser conditions, while still retaining direct access to the code
  • Related Files - Manage related files more easily; all files related to the currently displayed page will be displayed in a toolbar
  • Code Navigator - Displays all code sources that affect the current selection in a window
  • CSS - Help information to be displayed to the user while editing CSS
  • Code hinting for Ajax and Javascript
  • Improved spry widgets and HTML datasets
  • Increased compatibility with Photoshop

• Fireworks - There are several new features included in the Fireworks beta:
  • Increased compatibility with Photoshop, Illustrator and Flash
  • Web design and CSS export - allows graphical design of web pages, which can then be exported with standards-compliant CSS sheets created automatically
  • PDF export ability
  • Live style updates - when a style is updated, all elements using the style are also updated
  • Adobe Type Engine - enhanced typesetting abilities, similar to that already seen in current versions of Photoshop and Illustrator
  • Live gradients

• Flash - It is believed that Adobe will be performing a substantial overhaul of Flash for CS4. Possible changes include:
  • Pixel Bender
  • Removal of keyframes
  • Inverse kinematics
  • "Mobile Convergence", making it easier to make Flash content for mobile devices
  • Object-based tween modeling
  • 3D rotation

• Photoshop
  • Compatibility fixes for Microsoft Windows Vista
  • There has been speculation about Photoshop having Content Aware Image Resizing due to Adobe hiring one of its inventors
  • Further integrates Bridge into one menu bar at the top
  • Options for using greyscale application icons

• Soundbooth - According to Adobe Labs, several new features are available in the beta release:
  • Arranging audio files on multiple tracks
  • Making quick edits and applying fades
  • Matching volume levels with a single command
  • Removing unwanted noises and background sounds
  • Adjusting tempo and pitch
  • Recording and polishing voice-overs
  • Adding effects and filters
  • Previewing MP3 compression quality.

(Source Link)

New Security Risks Discovered and Patched

Microsoft Windows: Microsoft Windows has issued bug fixes for 11 new security loopholes in its April windows Updates. Five of them are classified ad critical, i.e. they can be used to capture a PC through the Internet and remotely install software that uses it as part of botnet.

Solution: Use the automatic windows Update tool without fail. Thereafter, your operating system will be secure.

Adobe flash player:

Seven security loopholes affect the Flash player for windows, Linux, Mac and Solaris. Attacker can seize control of affected computers using a doctored swf file. vista users are only at risk if the also use java.

Solution: Adobe has the version number 9.0.124.0

Apple QuickTime: In spite of the patches to version 7.4.5, the video codec QuickTime has not become reliable. A hacker known as David Maynor has publicized many loopholes which exist even after the update.

Solution: If one wants to be on safer side, one should do without QuickTime entirely.

Apple iCal: Researchers have disclosed three bugs that could allow malicious code to execute, since Apple has failed to respond to their reports since January this year.