Hackers Focus Efforts On Firefox, Safari, And Office

[Saint_Michael 3]

Many people are switching from Internet Explorer to alternative browsers such as Firefox and Safari. Though that might make them feel more secure, the shift has also opened new doors for bad guys.
Case in point: We have no IE bugs to report this month, but both Firefox and Safari have been hit hard.

So forget the idea that just because you've switched to a new browser, you're magically safer. You may be for a time, but to stay safe with any software, you need to keep current with fixes.
Firefox Holes

In a somewhat dubious recognition of Firefox's growing popularity, hackers have focused their attention on it, leading to a rash of newly discovered holes. The folks at Mozilla recently released two Firefox updates in less than six weeks, fixing a total of five critical security vulnerabilities. All five can be exploited by planting a poisoned JavaScript file in a Web site and waiting for you to stumble across it.

In an actual attack--neither the Safari nor the Firefox bugs have elicited one so far--a bad guy could take over your PC or steal your navigation history.

The latest versions of Firefox--2.0.0.13 on--will stop all five bugs. Mozilla's Thunderbird and SeaMonkey are also at risk (if you have JavaScript enabled), so download updated versions.
Safari in the Wild

Safari 3.1 patches 13 holes affecting Mac OS X, Windows XP, and Windows Vista.

Think you're safe because you don't have Safari? You may have it without realizing it. Apple now distributes its browser with iTunes updates. Forget to uncheck a box in one of these updates, and it's there.

The Safari holes could allow an attacker to trick you into thinking that a fake site is really your bank site, or to take over your PC via a poisoned page. Download Safari 3.1.
Office Bugged Again

Microsoft recently released four patches that fix a dozen dangerous holes in Office. I warned you about one of those holes--a zero-day attack on Excel--in April. Be sure to apply the patches, if your system doesn't install them automatically. Get the four new Office patches and more info. (You are not affected if Microsoft Office 2007 is the version you use.)

No sooner had Microsoft shipped those patches than the company acknowledged the existence of yet another bad Office bug that needs patching. And this one is urgent because some users have already been attacked.

Luckily, Windows Vista, Windows Vista SP1, and the beta version of Windows XP SP3 are not at risk because they ship with a newer version of the affected "Jet" database. But earlier versions of Windows are vulnerable, as are all supported versions of Office, including Office 2007.

Becoming a victim of the bug involves saving two files to your PC's hard drive--one a mail-merge file that uses the database engine. There was no patch at press time. For more information, read Microsoft's advisory.

Well no wonder we had those two new Firefox versions so quickly, but I wonder if that will push back Firefox 3's release date at all because of those big security holes that have been found. Well I figured it would just be a matter of time before Firefox started to have its underground hackers go after it and so I would assume that Firefox 3 will be receiving a lot of updates once the final version is release. Of course, I can't talk about this without mentioning the other side that the mozilla team has spent about two years and some change on this version of the browser, but to do an 180 once again, they mostly focus on the memory issues that I am aware of so there could be some security holes they they might have missed.

As with safari I am not surprise just because they lack a lot of the security features needed to have a secured browser, but I guess after these attacks Apple will be thinking about adding some security stuff to safari in later editions. The same with Office as that software has always had security holes in them, reminds me though that I should update office 2003 on my vista computer just to make sure about that.
Edited May 4, 2008 by Saint_Michael (see edit history)

[bluedragon 0]

Thanks for the info m8.

But I am going to stick with Mozilla.. I think My IE is somehow corrupted.. (I was experimenting with something when it just sort of ate my IE)



I think its not much of a deal if you are careful with what you are downloading and running on the internet . but then Ofcourse most of us just press Yes/Okay to almost every alert that we see..


I've listed two articles for ppl interested to see how the Vulnerabilities work ..


1.)http://forums.xisto.com/no_longer_exists/

2.)http://forums.xisto.com/no_longer_exists/

Edited April 26, 2008 by bluedragon (see edit history)