Find your vulnerable desktop applications

02.03.2008

Many corporate and private computers have installed “standard” set of free programs and utilities which users use in everyday work. You use them for sure as well, Adobe Acrobat Reader, ICQ, Skype, Irfan view, Quick Time, iTunes, Firefox, plugins as flash, shockwave, Sun Java and many others. As it is usual, in every piece of non trivial software package is a hidden bug which just wait for discovery and if possible misuse with no exception for those above.

What is good that some of them have incorporated automatic patching function (like Adobe Acrobat, Quicktime, Firefox) but these mostly work only when logged as Admin and others don’t have anything. So after all its up to user to watch security lists like that in Secunia or just install every new version wherever available which is quite boring and nobody is doing it.

One nice option which is offered by danish security company Secunia for free. It is online (as Java applet) or offline (Secunia PSI) security scanner which “know” what vulnerabilities in what piece of sw is known and will tell you that. All the rest is up to user so he’ll install recommended new versions. Better once for a time than never. Self describing info can be found at http://secunia.com/blog/20/ which is telling that 81.01% of all Windows users that run Secunia’s security scanner had some piece of installed sw vulnerable to hacking.

So don’t wait, do a scan and patch, patch, patch as you do not want to become “privileged” member of botnet or do you? 😉

Advertisements

Thinstall – another aquisition

17.02.2008

Just another very interesting acquisition. Vmware company – a big virtualization player – just acquired the Thinstall company, an application virtualization provider.

In their words the Thinstall technology – application virtualization – is:

“The Thinstall Virtualization Suite is a technology for virtualizing Windows software. Administrators do not have to install all applications on the workstation anymore – applications will be packed into a virtual environment, a sandbox, which contains all necessary information such as registry entries and applications’ DLL files. Now, the virtualized software can be started from every workstation. After the virtualization, there is no need for a local installation, because all program routines are emulated in the virtual environment.”


Simply said: you have whole software package packed into a single exe file and that’s it. It can run with standard user priviledges, you can run two versions together etc. All in all it mean no pollution of OS via sw package installation and no difficult upgrades and patches.

You want to deploy a new Firefox to workstations? Easy. Just copy one file using startup script into a local disk or – and that’s easier – just update server side repository of “thinstalled” programs (they call it application streaming) and push a link onto user’s START menu.

If you want to try it straight away go to http://www.thindownload.com/ where they offer “thinstalled” free licenced software for direct download. My favorite Opera browser is there together with Firefox, Adobe Acrobat, ICQ and even huge iTunes.

Not to forget to mention, they were able to “thinstallize” even Internet explorer, Office etc. Wow!

I’m gonna to discover its internals soon. It would be nice – no difficult GPO installs and updates … 🙂

Some nice flash demos are available here

update: I found they offer Thinstall suite for USD 5000. Ehm ehm …


Postini antispam service provider acquisition

16.02.2008

Google has bought Postini service provider and is becoming more and more gigantic service provider.

“With Google security and compliance services, powered by Postini, you can secure all of your electronic communications – email, instant messaging, and the web – and manage your company’s communication policies from one central location. These services can also make it easy to meet your archiving and encryption needs. Best of all, it’s all 100% hosted, so there’s no hardware or software to install or maintain. Whether you’re looking to transition from or enhance your existing messaging infrastructure for better control, Google enables you to provide employees the tools they need to be productive while reducing the cost and complexity of managing those tools.” www.postini.com

I’m definitely going to try this antispam service as soon as I will have chance as it looks good event though so far I have experience just as a user and not admin. But what also have weight in my eyes is positive reference from IT fellows of one big international PR company based in London. I will update post when I’ll have personal experience on this. But still, Google and Postini together mean to me solid base for any business.