What to do when you can't delete a program in Windows
Featured How To Manually Uninstall a Stubborn Service in Windows?
Featured When Was The Password Last Changed On This Mac?
Local Session Manager
Featured How To Find Out All Remote Desktop Logon Sessions That Took Place On Windows Server 2012 R2
Sitemap Illustration
Featured How to Refresh My Sitemap for Google Search Console to Find It?

Category: Security

Screenshot from networksolutions.com requesting that users change their password.
Cyber Security BreachPhishingSecurityVulnerabiltyWeb Development

Cybersecurity Incident or Full Blown Breach at Web.com, Register.com, and NetworkSolutions.com

As painful as it is to announce this, what some consider the 5th largest domain registration company in the world has been breached. Or should we call it a cybersecurity incident as they claim in their mea culpa, comforting customers that, “No credit card data was compromised as a result of this incident?” (Emphasis ours). The mea culpa is posted on a subdomain of their website: https://notice.web.com/ where they publish the following FAQ.

Frequently Asked Questions

What happened? On October 16, 2019, Web.com determined that a third-party gained unauthorized access to a limited number of our computer systems in late August 2019, and as a result, account information may have been accessed. No credit card data was compromised as a result of this incident.

What are you doing about it? Upon discovery, we took immediate steps to stop the intrusion. We promptly engaged a leading independent cybersecurity firm to investigate and determine the scope of the incident. We notified the proper authorities and began working with federal law enforcement.We are notifying affected customers through email and via our website, and as an additional precaution are requiring all users to reset their account passwords.

What data/information was involved? Our investigation indicates that account information for current and former Web.com customers may have been accessed. This information includes contact details such as name, address, phone numbers, email address and information about the services that we offer to a given account holder.We encrypt credit card numbers and no credit card data was compromised as a result of this incident.

What can I do to protect my account? We have already taken additional steps to secure your account, and there is nothing you need to do at this time. The next time you log in to your account you will be required to reset your password.As with any online service or platform, it is also good security practice to change your password often and use a unique password for each service.

Is my credit card information at risk? We store credit card numbers in a PCI (Payment Card Industry) compliant encryption standard and do not believe your credit card information is vulnerable as a specific result of this incident. That said, it is good practice to monitor your credit card account and we encourage you to notify your credit card provider if you see any suspicious charges.

Should I reset my password as part of this? We have already taken additional steps to secure your account, and there is nothing you need to do at this time. The next time you log in to your account you will be required to reset your password.As with any online service or platform, it is good security practice to change your password often and use a unique password for each service.

FAQ on the Important Safety information at notice.web.com

KrebsOnSecurity was among the first if not the first to break the news to the public in an article published on October 30th. According to Krebs.

Web.com encourages customers to call them with any questions. The phone number is available on the notice page they published.

Our word of advice here: please do not reuse passwords and setup multifactor authentication where possible.

AntivirusMalwarePhishingSecurityVulnerabilty

Warning – Major WannaCry-like Windows Security Exploit

If you have a Windows computer different from Windows 10 and Windows 8, you need this update!

Windows 7, Windows XP, Windows Server 2003, Windows Server 2008 R2 and similar all need updates right now.

More on this

Here: https://krebsonsecurity.com/2019/05/microsoft-patches-wormable-flaw-in-windows-xp-7-and-windows-2003/

and here: https://www.theverge.com/2019/5/14/18623565/microsoft-windows-xp-remote-desktop-services-worm-security-patches

AntivirusLittle TipsMalwareSecurityWindows 10 Tips

Critical Vulnerability in WinRAR Exposed – Absolute Path Traversal

According to a report this morning from SonicWall, a vulnerability that could allow remote code execution has been discovered in WinRAR. This software vulnerability exposes the half a billion users of this Windows unarchiver. The vulnerability exploited is detailed by MITRE in CVE-2018-20250.

To find out if you are vulnerable, check to see if your WinRAR version is anything prior to WinRAR prior to 5.70 beta 1.

The fix is to update your software to the latest WinRAR version to resolve the issue.

For those not familiar with WinRAR, according to Wikipedia, “WinRAR is a trialware file archiver utility for Windows, developed by Eugene Roshal of win.rar GmbH. It can create and view archives in RAR or ZIP file formats, and unpack numerous archive file formats. To enable the user to test the integrity of archives, WinRAR embeds CRC32 or BLAKE2 checksums for each file in each archive. WinRAR supports creating encrypted, multi-part and self-extracting archives.”

Update: According to a March 23 2019 report by SonicWall, this WinRAR vulnerability is now being exploited in the wild.

“There have been two major exploits of this vulnerability, one targeting Ukraine with an Ukrainian law related PDF document and another targeting users in the Middle East. Last week, SonicWall Capture Labs Threat Research team has observed another campaign targeting users in Chile. WinRAR vulnerability is the most sought after exploit used by both cyber criminals and nation state actors.”

The security news brief from SonicWall also details the infection cycle of a WinRAR exploit. Be on guard!