Larry Seltzer

Depending on where you look, most people are either running in circles hysterically or ho-humming the Windows WMF vulnerability. It does have some of the earmarks of a nasty situation. For one thing, if youre running Windows—any version—youre vulnerable. Even the 1990 version of Windows 3.0 is vulnerable! While you were out partying this weekend […]

Anti-virus and intrusion protection firms are reacting quickly to a new zero-day exploit for Windows, and a workaround has been devised by an independent researcher. According to AV-Test, an anti-virus research firm, numerous anti-virus firms were detecting some of the four exploits for the vulnerability that they had at that point. AntiVir, Avast!, BitDefender, Ewido, […]

Days after the revelation of a flaw in Windows handling of WMF graphics files, dozens of exploits are being spread from thousands of adware sites. But good protection is available. At the same time, further testing confirms that a workaround issued by third parties and endorsed by Microsoft Corp. is effective in most regards, and […]

Microsoft really has improved the security of its code over the last few years. The fact that every now and then a bug like the new WMF bug still comes along just goes to show how careless the old code is. The problem with the WMF (Windows Metafile) file format turns out to be one […]

There was a time, it must have been at least five years ago, when we would tell users (at least unofficially) that if you were running an old version of an antivirus program with no update subscription, you were better off than with nothing, In fact, you would still block almost all of the threats […]

Microsoft has been moving slowly, and lately more steadily, towards an approach of having users run, by default, with restricted privileges. The tools for letting users run in less-privileged accounts have for many years been better for domain-based managed networks, especially those with Active Directory, and the potential is there for far more power. A […]

When a term like “rootkit” gets enough buzz that the local Sunday paper mentions it you just have to expect vendors to blurt out that they have a solution for it, whether they do or not. I think this is what happened with Intels recent announcement that they are working on anti-rootkit hardware, a magical […]

In a recent panel discussion I was on it was suggested that spending on the conventional threat mitigation aspects of security was headed for a leveling off, and that the real growth was in compliance issues. This may very well be true. I dont know as much as I should about compliance issues, but when […]

You dont often get warning about a malware outbreak, let alone a month in advance. But according to iDefense, a security consulting firm owned by Verisign, on Jan. 5, 2006, there will be a substantial outbreak of the Sober worm. Its a Friday, so you might want to plan a three-day weekend. Ill probably be […]

Last week a serious vulnerability was revealed to relatively little attention from the press, or even from security circles. I think its a real nasty one, especially in as much as it will go widely unpatched. The program at issue is the ubiquitous Perl programming language. Perl is a scripting language, which means a lot […]

Trend Micros David Sancho paints a scary picture of a future with ubiquitous RSS capability that will come with the deployment of Internet Explorer 7. History has shown that it often makes sense to assume the worst in computer security, but not every assertion is reasonable. Sanchos paper discusses several potential developments in “bot worms,” […]

Youre out on the road. Suddenly you get a sharp chest pain, radiating to your arm. You can fight the pain just enough to dial 911 on your cell phone, but thats all you can do, and you sure as hell cant speak. If you were on a land line phone (other than maybe a […]