Macrotone Blogs

Macrotone blogs upon Joomla, our products and other matters.
Categories
Tags
Archives
Calendar
Categories:   All Categories
Suggested keywords
x
Miscellaneous
Blogs that do not fit into any other of our specified categories.
Geoffrey Chapman

High CPU usage MSE and QNAP QGet

We have noticed a problem since we installed KB2754296, which is an update to Microsoft Security Essentials where our CPU usage continually peaks at 100% usage.

Investigation reveals that the high usage is caused by process NisSrv.exe which is the Microsoft Network Realtime Inspection Service.

We use QNAP network devices and there is a small program called QGet which is used to contact the QNAP Download manager.  QGet runs on the PC and communicates with the QNAP process, and is used to provide the QNAP service with instruction as to what files to download.  When the QGet process is running the NisSRV.exe usage goes through the roof,slowing down the PC to a point where its is virtually unusable.

The version of QGet does not seem to matter and we have tested versions 2.1.5.0702 and 3.0.5.1009 and the result is the same.

The version of MSE is 4.1.5220 and in our installed version there is no way in which the Network inspection service can be disabled.

The only conclusion we can draw is that the two programs are incompatible.  We have disabled the QGet program, since it is not really used much anyway, but MSE should never cause the problem in the first place in our opinion.

Possibly we should consider an alternative security program over MSE!

See: QNAP Forum

Tags:
Windows 7 QNAP
Geoffrey Chapman

Firefox Upgrade offline due to Security Fears

firefox
The latest version of Mozilla's Firefox browser has been taken offline after a security vulnerability was discovered.

Users who had upgraded to version 16 were advised to downgrade to the previous safe release until Firefox developers released a fix.

The vulnerability allowed "a malicious site to potentially determine which websites users have visited", Mozilla said.

BBC article.

Update: Mozilla re-released Firefox 16 today after pulling the browser from distribution Wednesday when one of its developers found a critical bug that could be used by attackers to hijack machines. At around 2:30 p.m. ET, Mozilla turned on its upgrade servers and started pushing Firefox 16.0.1 to users who had earlier downloaded the flawed browser, or who were still running version 15 and earlier.

Geoffrey Chapman

Microsoft IE Bug


Microsoft has released details of a method users of Internet Explorer can use to secure their computers from a recently discovered exploit allowing malicious code to run on a PC.

Microsoft has admitted to the bug, which it says hurts Internet Explorer versions 6 through 9, but leaves IE 10 alone. The flaw is described as follows:

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.

The remedy is detailed in Security Advisory 2757760, where it says that there's no outright fix for the issue at present, but that users can work around the threat by deploying the Enhanced Mitigation Experience Toolkit (EMET), described as "... a utility that helps prevent vulnerabilities in software from successfully being exploited by applying in-box mitigations such as DEP to applications configured in EMET."

Tags:
security browser
Geoffrey Chapman

Web Site access blocked by Bad Behavior

I have written this blog after a recent incident when a legitimate user was trying to access our website. It is based on our experiences and that of other users of the software.

The user was obviously a little peeved but after working through the problem we obtained a resolution although there is still some doubt as to the exact cause.

Bad Behavior claims to be one of the Internet's most trusted solutions for helping to prevent link spam and other malicious activity, from well-known sites to the smallest blogs. Bad Behavior complements other link spam solutions by acting as a gatekeeper, preventing spammers from ever delivering their junk, and in many cases, from ever reading your site in the first place.

Users identified as being suspect are presented with a message that we configure such as "Your IP address is exhibiting behaviour similar to that of spammers, hackers or other undesirable visitors".

There are a reasonably comprehensive set of log entries and inspection of these often gives a clue as to why the user has been identified as ‘suspect’.

If the denied_reason says, “I know you and I don’t like you, dirty spammer,” then this means that the IP address has been previously identified and is being temporarily blocked, and another entry will have the real reason for the block.

One common denied_reason says, “Required header ‘Accept’ missing,”. In this situation the user should check to ensure that they are not using a proxy server, personal firewall, or any other software that may be interfering with their Web browsing. These types of software, if not configured properly, will cause this problem. Bypass the proxy (when possible) and try again.

If the denied_reason contains a long string of “Aaaaaaaaaaaaa,” says “User-Agent … prohibited,” or contains “Banned proxy server” and the user is not using a proxy server, this is an indication that the user’s computer has most likely been infected with a virus or Trojan horse which is sending comment and referrer spam. The computer should be cleaned before trying again.

If the denied_reason contains anything else, one may well find that the reason for the block is made obvious by the reason given. For instance, if there is a fake User-Agent string, Bad Behavior may detect this and cause the block. The solution In this case would be to correct the User-Agent string.

Geoffrey Chapman

Reuters News Agency hacked -- AGAIN


News agency Reuters has been hacked for the third time in a month. This is beginning to become a habit. If this continues one must begin to wonder how much reliance one can place in any of their articles.

Geoffrey Chapman

Windows 7 Updates August 2012 Problems


Having experienced a few problems with the latest set of Windows 7 Updates for August 2012 I thought I would create this post to possibly assist others.

Firstly the problem seems to only impact 64 bit versions of windows, since 32bit seems to work successfully.

The problem manifests itself as a ‘Failure to apply updates’ following the forced reboot, causing it to fall back to the created restore point.

The cause seems to be fix KB2647753 which can be applied upon its own but not in combination with the others.

Up to 12 updates may be required depending upon the system being updated, but the solution appears to be to select KB2647753 and install it on its own, and then following the reboot (which showed a message about updating the registry) to install all of the other updates as one set. This does require a few reboots but all the updates do get applied successfully.

If like me you tend to update several machines at the same time and start off an update on one machine before starting it in another etc., before returning to the first machine, it is easy to miss he failure message which doesn't stay on the screen for very long. The first one notices is when the machines require updates to be applied a second or possibly a third time. Very annoying.

Tags:
Windows 7 updates
Geoffrey Chapman

Amazon and Apple close security hole.


Amazon has closed a security hole discovered following the earlier journalists security hack earlier this week. On Tuesday, Amazon handed down to its customer service department a policy change that no longer allows people to call in and change account settings, such as credit cards or email addresses associated with its user accounts.



Apple has also suspended its policy of allowing over the phone AppleID password resets.


The journalists actual report is here.

Tags:
Privacy security
Geoffrey Chapman

Dangers of having your data in the cloud.

iCloud logo
 This article describes how a US journalist was cut off from his entire digital life by attackers who tricked Apple support into re-setting his iCloud account.

If does illustrate very clearly just how much we trust we place in the cloud provider irrespective of who they are, when we put any of our data into the cloud. There is a lot to be said for the ‘old’ fashioned method running your own systems and ensuring they are backed up securely.

Tags:
social security
Geoffrey Chapman

Dropbox security breech.

dropbox
Dropbox is the latest in a long line of services that has had a security breech. This has led to many of the members receiving unsolicited emails.

The cause is claimed to be a stolen password which was used to access an employee’s accounts allowing a ‘project document’ containing user emails to be accessed and copied.

More details here.

Tags:
security Privacy Information
Geoffrey Chapman

Invalid Logging Attempts

We saw a situation of a brute force login attack the other day and thought we would share it with our readers, although we are flattered that anyone thought our site sufficiently important enough to make the effort, their efforts were in vain as they did not get very far.   This particular attack is classed as one of the most common (and least subtle) attacks that can be conducted against Web applications.  The sole aim of a brute force attack is to gain access to user accounts by repeatedly trying to guess the password of a user or a group of users.   It is often carried out by automated tools -- readily available on the Internet – enabling submission of thousands of password attempts in a matter of seconds (or less), trying to make it easy for an attacker to beat a password-based authentication system.

Continue reading
Tags:
Privacy Password Control joomla
Go To Top

Joomla! Debug Console

Session

Profile Information

Memory Usage

Database Queries