In McGlure’s demo, he accessed his customized website using IE-6, which is vulnerable to the attack and showed how the exploit is downloaded to the machine, saved, decoded, and ran. Exploits like these make it really scary for everyone because it does not even require the end user to perform anything such as clicking or downloading something.

To make things worst, the downloaded file was a jpg (or could be gif, png). To some, it could be an image file. But it is actually an executable file. The process is automatic. The jpg file is downloaded, repackaged, and then the binary is executed. The payload could be anything as installing a backdoor Trojan that sits in your computer to steal information, or it could be a nasty virus that wipes out your entire data.

While I’ve been stressing enough to everyone to be very aware about clicking links from emails or visiting suspicious websites, sometimes at the end of the day, it boils down to your system protection. What are your protections, walls, or shields from this evildoers? Do you have your system locked down, or updated, or patched?

PATCH. One best thing really to do is to patch your system so you are not vulnerable. Today, Microsoft released an out-of-band security patch to addressed this 0-day vulnerability. I highly recommend you to install this patch as your first line of defense. Here is the link: http://www.microsoft.com/technet/security/bulletin/ms10-jan.mspx. Again, do not install any third-party patches. Trust only the one that comes from Microsoft. Currently, I am attending the Microsfot’s Out-of-Band Security Release bulletin webcast, which they covered what is included in this patch.

BROWSE. It is also discovered that other versions of IE, not only IE-6 could be vulnerable to this attack. So, it is not a bad idea to use an alternate browser like Firefox, Opera, or Chrome. I might also include your favorite email clients such as Outlook can easily launch the attack too, since email is displayed in HTML. So be aware of all the doors where this attack can get in.

DEFENSE. For home users it is highly needed you have an antivirus software and an up-to-date virus definitions. Having host firewall or IPS also adds more layer of protection. In corporate world, taking advantage of the powerful features of your Firewall, Proxy, nIPS, hIPS, and your Antivirus is very crucial.

Inline proxies can block those file download that are suspicious or deemed infected, thereby, protecting the corporate users behind the proxies. With a good signature and inline IDS, you can also block or drop these attacks or traffic. And an updated Antivirus can catch this before it can wreak havoc. Multiple line of defense implemented correctly give you and your company a better protection.

So again, download and install the patch now, it is available from the link above; update your antivirus – protect yourself!

Aurora Borealis or the Northern Light is a jaw-dropping awe vista to witness. I have not witnessed one but it’s one of my dreams. While we know the beauty of it, there is another and different aurora (not borealis) that is not to be messed with.

The Operation Aurora dubbed by McAfee to describe the very recent Microsoft’s Internet Explorer Zero-Day vulnerability is a “coordinated attack which included a piece of computer code that exploits a vulnerability in Internet Explorer to gain access to computer systems.” It was used to exploit Google and other 30 more companies as previously reported. Last Friday, George Kurtz, McAfee’s CTO talked in his Security blog about the Aurora exploit that is used to attack Google in December is now in public.

Any zero-day vulnerability is always a bad thing. Two weeks ago, one of my older computers crashed and for what I know it could be caused by this same exploit. While the discovery of this vulnerability has been a while now, Microsoft has yet to release an official patch.

The bad thing is, there are third-party patches out there that have gone out to provide temporary fix for this vulnerability. I would not really recommend installing these third-party patches since we don’t know what the ill-effects in the long run. The good news is, Microsoft is going to release a patch tomorrow, January 21st. Read Microsoft’s Bulletin.

To learn more about Operation Aurora from McAfee, watch the video from George Kurtz and the McAfee team here.

On the other side, I believe this same vulnerability is called by Symantec as Hydraq.

Hydraq is a targeted attack. Through the exploitation of a vulnerability, it attempts to install a trojan on a specific computer that steals information from that machine. The trojan attempts to make contact with command and control servers in order to receive instructions and to upload any information that it may have collected. This type of attack is often called an advanced persistent threat because of the sophistication and persistence of the attack within a business.

What I like about reading the page that Symantec provides is they outlined 3 important things to protect yourself, which is what really I wanted to convey to everyone, not only to home users, but also even helpdesk support, or even any security professionals in their workplace.

• Stay up-to-date with security patches. Zero-day vulnerability like this can wreak havoc and even worst, loss of your important data. So make sure that your OS, applications, antivirus are all up-to-date. It’s a must.
• Complete security solution. Having antivirus, firewall, and even host intrusion detection software will spot these from the very beginning. Again, an updated definitions or dat files is as important as the software. Even if you have antivirus installed if the signature definitions are outdated, it is useless. Get them updated.
• User awareness. This is one of the keys. Understand even the basics of security and how important it is will give you an advantage. I like saying this a lot:  “security is nothing until your computer is hacked and you lost all your data, then security is everything”.