Attackers are exploiting this newly discovered security hole by embedding malicious Flash content in PDF files and then sending these infected documents to victims. Once the victim opens the infected PDF file, a data stealing trojan is then loaded onto the victims PC. Adobe announced today that a patch to fix the security vulnerability will be released next week. So what do you protect yourself until then? We’ll tell you how!

Adobe has recommended that users disable flash in Acrobat until the fix is released. Security experts have also recommended that users completely disable Adobe Flash on their systems until the fix is released. Even though attackers have only used PDF files at this point, they’re concerned that this exploit may move to the web. Personally, I think that completely removing Adobe Flash from your system is a little overkill.

As always, don’t open PDF from people you don’t know. Even if the attachment is from a person you know, but something about it seems strange, trust your instincts. Contact the person who sent you the PDF file and ask them about it. The next thing you can do is disable Adobe Flash in Acrobat. You can do this by clicking Edit > Preferences > Multimedia Trust (Legacy) > Highlight Permissions for Adobe Flash > Change Permissions for Selected Multimedia Player > Never > Click OK.

A new distribution of Linux in itself really isn’t exciting news or anything special.  New and totally free distributions of Linux are released to the general public on an extremely frequent basis. The problem with Linux as a desktop operating system is that for the average person even a trivial task like installing a new program can be daunting if not impossible.

Linux isn’t like Windows or OS X, there isn’t a nice graphical installer that runs when you want to add a new piece of software to the machine. Installing a piece of software or installing operating system updates usually requires the end user to use a terminal interface. Some distributions of Linux are more user friendly than others, and some distributions allow self-installers (RPM packages for example) but the simplicity and familiarity  isn’t there for the average user. Another huge problem is the lack of driver support. Once again, some distributions are better than others in this area.

The Google Chrome OS is built around the idea that all programs the end user needs to access will be delivered via the Internet and their web browser. Things like SaaS (Software as a Service) is becoming more common by the day, and here at Falcon Worx we implement SaaS and we also offer it to our clients.  Google believes that with any software available via a web browser, you’ll never need to install a piece of software anyway.

With widespread support from PC manufacturers things like compatible drives shouldn’t be an issue. Google is doing a smart thing by targeting the small and relatively new netbook market as a starting point for their new operating system. Netbooks are designed for well, surfing the internet and not much more. They’re low powered, and don’t have much capacity. So accessing software via a web browser makes perfect sense.

In addition to widespread support from PC manufacturers, I’m sure Google will implement some type of self-installer for software packages that will be easy to use. As a result, software developers will probably release a plethora of software for Chrome OS. I’m sure we’ll  see Chrome OS move to notebooks and then eventually desktops.

How successful will Chrome OS be with consumers? Only time will tell but I suspect it will be fairly popular. PC manufactures are going to be cramming the Google Chrome OS down consumer’s throats because it’s free. Unlike Windows, Chrome OS doesn’t come with a hefty licensing fee for each unit sold.

I’m pretty eager to get my hands on Google Chrome OS, if their operating system is anything like any of their other products I’m sure it will be pretty darn good if not great. Do I think that all software a person or company needs will be available via your web browser? For most companies that answer is no. It’s far too costly and security is always a concern. However, I do believe that SaaS will be more widely implemented for some types of software.

So how does this attack occur and why should you be concerned? For this attack to be successful, the user simply has to open an email or browse to a website that opens a Video ActivecX Control. A malicious payload of the attacker’s choice is then downloaded onto the user’s system. This could be anything from annoying adware to password stealing programs that could allow an attacker to steal your online banking or Paypal credentials.

Currently, there’s no official patch for this exploit but there is a workaround that was just released. The workaround disables this particular ActiveX control in Internet Explorer. This will not degrade the end users experience because there is no legitimate need for this particular ActiveX control in Internet Explorer to begin with. The next round of patches are due from Microsoft on July 14th, which may or may not include a patch for this very serious security risk.

In the mean time, Falcon Worx recommends that all of our customers and friends visit the Microsoft’s Security and Defense blog to download the work around for this exploit. Go to the bottom of the page and click the “Fix It” image. Download the .MSI file, and just click “Next”. Yes, it’s really that simple!