Me on Airport Security

Charles Mann made me the central focus of his article on airport security for Vanity Fair. (Mann also wrote about me in 2002 for The Atlantic.) The article was supposed to have been in the tenth-anniversary-of-9/11 issue, but got delayed....

Dead Software Walking: Update...

Some of our legacy software is approaching its end-of-life (EOL).



F-Secure has a long history of protecting its customers, and as a result, we have some long established customer relationships. And some of our customers have been running our software for years and years. But, just like any other software vendor, we have to stop support for old legacy products at some point.

Thus, we need to remind our home and corporate customers that antivirus updates for F-Secure 8-series software will end on January 1st, 2012.

In practice, EOL means that products such as these will no longer receive antivirus updates:

  •  F-Secure Internet Security 2009
  •  F-Secure Anti-Virus 2009
  •  F-Secure Client Security 8-series
  •  F-Secure Linux Security 7-series

There are other affected products as well. For a full list of affected consumer products, see here, and for a full list of affected corporate products, see here.

To reiterate: this doesn't just mean that these products are no longer supported (some of them have actually been out of support for quite a while). This means that the actual antivirus signature updates will no longer be published for these products. No new databases will be produced.

So upgrade now:

  •  Home users
  •  Business users

There's no reason not to upgrade. The upgrade is free and will continue to be valid for as long as you have a license/subscription.

If you're running a product which you received through an Internet Service Provider, then the operator will make sure your is software is up-to-date.

Here's a link to a discussion thread on the topic in our community site.

Do you have this installed?



Update now… the end is nigh.

On 21/12/11 At 12:36 PM

New Year's Wishes - with...

It's almost the end of 2011. What with Christmas recently passed, and the New Year coming up, there's naturally a lot of well wishes and holiday greetings being messaged around. Looks like somebody's decided to join in (a little late) — and also do a bit of data harvesting at the same time.

Spyware:Android/AdBoo.A appears to be one of those programs that lets you send witty/sweet/funny messages to your contacts. On execution, it displays a list of text messages that fall into different categories: new year wishes, friendship, love and jokes:



When the user selects one of these messages, the app prompts a dialog box asking for the next action: Contact, Edit or Cancel:



If Contact is chosen, the app tries to read the stored contact data. Presumably, it needs to know to whom to send the message:



During our initial analysis, because the test phone didn't have any stored contacts, the app didn't retrieve anything at this point.

However, when AdBoo was retested with (bogus) contacts present, no text message was sent then either — AdBoo only produces a dialog box with the message "Sending fail":



We noticed that the app did do something else though. On selecting the Contacts options, it silently obtained the following information from the device:

1) Phone Model
2) Android Version
3) Phone number
4) International Mobile Equipment Identity (IMEI) number

The harvested details are then forwarded to remote server.

Incidentally, looking at the certificate for this variant of AdBoo, it appears to be from the same developer as Zsone.A:

AdBoo:



Zsone:



Threat Solutions post by — Irene

On 29/12/11 At 10:12 AM

Microsoft prepares for 14...

Microsoft is preparing to addressing 20 vulnerabilities for its December Patch Tuesday, including flaws in Internet Explorer, Windows Media Player and Microsoft Publisher

Don't open email about...

US cables found on Bradley...

A witness at the hearing of Bradley Manning has revealed that confidential US cables were found on the US Army private's computer

(ZDNet UK - Security)

Do you think like a German or...

Today we've been reading through a 208 page European Commission report called: Special Eurobarometer 359, Attitudes on Data Protection and Electronic Identity in the European Union (PDF). One thing is very clear. European attitudes on digital privacy and identity vary greatly by culture, and even adjoining countries have some interesting differences.

Which country's views most reflects your own?


Click here for the full image.

On 03/01/12 At 05:25 PM

Adobe security update being...

Adobe has issued a warning about a critical zero-day vulnerability in Adobe Reader and Acrobat for Windows. An emergency security update is scheduled.