Larry Seltzer

Microsoft issued seven security bulletins Tuesday, two of them designated “critical,” for various versions of Windows and associated products. The company recommends that all Windows users apply the critical updates immediately. One of the critical bulletins, MS04-023, titled “Vulnerability in HTML Help Could Allow Code Execution,” addresses vulnerabilities in the Windows HTML Help system that […]

In the wake of last weeks revelation of a security hole in Mozilla that allows the execution of arbitrary programs on the client system a philosophical debate has emerged: Is this a bug in Mozilla or a bug in Windows? I think the argument is that Windows should prevent the shell scheme from executing programs, […]

Thanks to the many readers of my last column who pointed me toward AutoPatcher. I had been complaining about the lack of a good offline patching solution from Microsoft, and thats what AutoPatcher tries to be. I decided to give it a spin on my own. First of all, its free. Not, as the anarchist […]

Security researchers are reporting another security issue in Web browsing under Windows, but this time Internet Explorer is not the culprit. The Mozilla Foundations Mozilla and Firefox are reported as vulnerable. The Mozilla Foundation has confirmed the problem and issued a fix, which is available here. The reports indicate that links in a Web page […]

The U.S. Computer Emergency Readiness Team gained a lot of attention with its advisory on the most recent Internet Explorer attack. In the “solutions” section, it suggested—as the last of six things you might do—that you could use a different browser. Absolutely, and I wonder why the team doesnt make the same recommendation for numerous […]

Microsoft Corp. on Friday released what the company termed a “configuration change” to several versions of Windows in response to the recent attacks designated Download.Ject against its Internet Explorer browser. The change disables a system component called ADODB.Stream that was utilized by the attack to execute code on the victims system. The change will be […]

After nagging by myself and others, Microsoft back in February finally came out with a Windows Update CD. Its a CD version of the key updates to Windows that you would get by running Windows Update. Of course, Windows gets a lot of updates, so every time you go to the Windows Update site you […]

It was the Simpsons who first broke the story: Major League Baseball was spying on Barts thoughts with a special satellite that he shot down, only to have Mark McGwire come and hush the whole thing up. But subscribers to Major League Baseballs MLB.TV service may be surprised to hear what the big leagues are […]

Security analysts say that the malicious code that has been infecting some Windows machines since Thursday morning was planted via an IIS (Internet Information Services) vulnerability on the Web servers that host some high-traffic sites. Users visiting those sites have had their machines infected with a piece of code that installs a keystroke logger and […]

I love the service model. Some guys (Im one of them) like running their own systems and tuning them and being “self-sufficient,” but for almost any real company out there running your own perimeter, security is not core to your business. Why not hire someone else to do it? Even IBMs in the business now. […]

Bringing together work done over the past year by vendors and standards bodies, a consortium of some of the largest e-mail providers on the Internet published a proposal Tuesday to advance authentication of e-mail as a tool to fight spam. The ASTA (Anti-Spam Technical Alliance), which comprises AOL, Earthlink, Microsoft and Yahoo, issued the document, […]

The spit is hitting the fan these days over the impending standards for SMTP authentication. Im a big fan of it, but many are arguing against it—some constructively and some not. One of the main dismissive put-downs against authentication, especially with respect to zombied PCs, is that spammers and worms will simply switch to using […]