Do you update?

Most people I talk to claim that they are strong believers in updating. They update their operating system, applications that come with the operating system and security software almost religiously.

In turn most of these people are surprised when they hear that they should regularly check for updates to all the software they use. One example is some popular media players – some time ago, vulnerabilities were detected in them which allowed for remote code execution. And now of course we’re seeing the same situation with Microsoft Office.

Over time we have also seen an increased focus on exploiting server-based software. Just think back to Net-Worm.Perl.Santy.a – it caused a major epidemic by exploiting a vulnerability in unpatched phpBB forums. More recently we’ve seen a large number of hackers targeting a vulnerability in IPB forum software. This resulted in a lot of sites being compromised and/ or defaced.

And right now we’re seeing extensive defacements on sites using outdated versions of Joomla and/ or Mambo.

It’s clear if a site has been defaced. It won’t be quite so obvious if a site has been compromised.

Although we’ve been telling people to update regularly for a long, long time, this latest case shows that we can’t say it too often. Once again: it’s of the utmost importance you make sure that all of your software is up to date, both on your local machine and on any remote servers which you administer.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.