Malvertising

Malvertising is where third-party ad servers serve up "poisoned" ads- fake anti-virus scams usually comprising a bit of social engineering and an exploit kit to make it a drive-by download if the social engineering fails. the attraction for cyber criminals is that they can get access to mainstream web sites by hacking third-party servers, or ad feeds into those servers- they can attack the weakest link and see their malware on the most trusted websites.

I've noticed a few stories about malvertising today, and a few different points leap out of the stories.

The BBC has a story here about malware on a government-backed website. Not that that surprises me- I've been saying for a long time that the idea that if you're careful where you surf, malware won't be a problem is deluded. What I noticed was this statement:

The exploit only affected users of Internet Explorer, including the most recent versions. Other browsers, including Firefox, were not affected.

Really? This is an exploit to which even the most recent versions of IE are vulnerable? Well, I've also been saying for a long time that Firefox is a safer browser for Windows, and I recently posted about IE getting pwned, but is IE really wide open to an exploit? (Since switching to Linux, I've followed the browser wars with less interest.)

The BBC has another story about malware on the London Stock Exchange site. The following grabbed my attention:

Security expert Paul Mutton fell victim when he viewed the site on 27 February.

He visited the LSE homepage to find out why some people reported that they could not access it.

The site was blocked by Firefox, he said, but accessible via Google's Chrome browser.

"It seemed to work with Chrome but then a few seconds later, without having to click on anything, pop-ups started to appear," he said.

The malicious code closed down several of the programs Mr Mutton was using and stopped new ones being started.

"I visited the site and it compromised my machine," said Mr Mutton.

Now if I was a security expert and had to visit a suspect site, I'd do it in Linux, to be honest. I assume Paul Mutton is a real security expert (this is the BBC) and had his system up-to-date (no vulnerable versions of Adobe PDF or Sun Java or Macromedia Flash installed), so where was the zero-day vulnerability? In Chrome, for all its claims of sandboxing? Or in the OS? Or in some other web-facing application?

My final BBC story reports on malware in Spotify. This story actually allows me to identify the vulnerability exploited- unsurprisingly, it's a fairly old vulnerability in Adobe PDF software- affecting version 8.1.2, when adobe is now shipping 9.4.2. These sort of exploits (affecting software other than the browser and OS- such as PDF readers) are actually as much of a risk as zero-day browser or OS vulnerabilities (meaning Microsoft, if you use IE on windows), which is why I found the previous two stories so surprising, as they suggest zero-day exploits in browsers or windows.

"Users with anti-virus software will have been protected," Spotify said in a statement.

Well, if you check the VirusTotal report available by following the links, you'll find this is horseshit- vulnerabilities may be years old, but if you still have the vulnerable software installed years later, you'll still be vulnerable to the latest malware, and the chance of your anti-virus program detecting that malware is slim.

Firefox 4 borked by Compiz bug in Linux

As mentioned in a previous post, Firefox 4 is suffering badly from a known bug in Compiz on Linux. After coming out of a screen saver, menus will disappear when hovered over.
Minimising and maximising the browser will fix the problem, but for a permanent fix, the only solution seems to be to disable Compix until a newer version of Compiz arrives in your distro. For Ubuntu users, that will be soon- Natty has the fix. For Debian users like me, Compiz will be disabled for quite a while.

Return of the Living Dead Part II

A while ago I wrote about some annoying bugs that had affected me in Ubuntu, but not in Debian Lenny, and how they had "come back from the dead" in Debian Squeeze.
I've just worked out that two of the bugs (failure of copy and paste in Firefox and disappearing controls in Totem in full screen) were actually the same bug- a problem with Compiz described here. Another manifestation of the bug was in the "awesome bar". Typing a letter in Firefox's address bar usually brings up previously visited web sites beginning with or containing that letter- but on occasion this would not happen. All these unexpected behaviours result from the fact that in Compiz "somehow inactivity messes up the order of 'layers' to draw and stuff that is supposed to be on top is drawn below other windows" (Vaphell).
The bug has an even bigger impact on Firefox 4, with right-click menus and even the main menu disappearing when hovered over- a show stopper of a bug.
The head shot required to kill these bugs seems to be to disable Compiz.
The Firefox 4 Compiz bug is discussed on the Debian Forum, the Ubuntu forum, and the Linux Mint forum.

Firefox 4- needs polish

Firefox 4 is out. There are plenty of comprehensive reviews out there, so I'm just going to look at a couple of features that caught my eye. These are features Opera has had for a while, so I'm going to compare Firefox 4 to Opera 11 (on Debian Squeeze)- it's FOSS Vs. Proprietary.
Firefox 4 has removed the menu bar and replaced it with a drop down menu button in the tab bar- this is certainly an idea I like as it gets rid of some wasted screen real estate. This is how the Firefox 4 and Opera 11 implementations compare.


I think Opera has the edge here- its menu button is neater, and the tabs more readable on a dark theme. (The Firefox menu button doesn't seem to give access to all the options present in the menu bar, for example View>Sidebar, so it looks like it's functionally less polished as well.)

Firefox 4 also introduces tab management, called Panorama- a feature Opera 11 already has in tab stacking. Here's how they compare:





For me, the Opera method is better. Firefox's Panorma requires you to fiddle around with the size of tab group windows, whereas in Opera's tab stacking, thumbnails are automatically grouped and displayed when hovering over a tab stack. Tab stacking is also more immediate in that you can just flick one tab on top of another, without changing window.
A big problem with Firefox's Panorama window is that thumbnails are very low resolution, and when clicking on a thumbnail, that thumbnail is maximised to full screen to become the web page depicted, but intermediate images are just the low resolution thumbnail magnified, which appears ugly, even disconcerting.
Opera's implementation is more polished; Firefox's functional but visually cruder.
Firefox 4 needs more polish: automatic sizing of windows in Panorama, and a smoother change from thumbnail to full screen browser page.

Qt4 GUI Styles

Qt4 is a cross-platform application and UI framework. It has a configuration manager in System>Preferences (or enter qtconfig-qt4) in a terminal.
If Qt4 applications don't look quite right on your desktop, try changing the GUI style.

Here is the Qt configuration editor:


Here's KeePassX with the Cleanlooks GUI style:


And with the GTK+ GUI style:


Spot the difference! (I was sure the Cleanlooks style was not right, but couldn't work out why for some time- then I realised, my GTK+ applications have a dark menu bar as well as title bar.)

One Qt4 application is Skype- according to this post, it is hard-wired to use one particular style, but there is a method given to change the style used.

[Update: Skype has a Chose style dropdown menu in Options>General.]

Open as administrator in Nautilus

It's sometimes useful to be able to open a folder as administrator in Nautilus, the Gnome file browser, for example to edit a configuration file or drop a new theme in the root directory for all users to be able to use.
I had enabled this feature in Lenny, but not in Squeeze. This post on the Debian forum reminded me how to do it. (Install nautilus-gksu.)

Password Managers

We all have a large number of passwords to look after- web sites, email accounts, user accounts. How to remember them? Password managers in web browsers help a lot, but they don't remember everything, and we still need to record email and user account passwords- either for other users we've set up or for ourselves on other computers. One option is to simply write them down- perfectly safe in a private place. I have a lot of usernames and passwords scribbled down in an old notebook. Trying to be more organised recently, I started typing them into a text file in my user directory. No bad people have access to my computer, so not really a problem. But just in case, I wondered whether I should encrypt the passwords file in some way. A recent thread on the Debian forum discussed password managers, so I thought I'd give some a try- all available in the Debian repositories.

The first I tried (it seems to be the most popular on the Debian forum thread) was KeePassX. It's a cross platform application and uses Qt4, and at first the GUI didn't fit into my desktop, but using qtconfig-qt4, I was able to get the GUI to use GTK+, like the rest of my desktop GUI's.
A useful feature is AutoType, which will automatically enter username and password details on web pages.

Then I tried Password Gorilla, another cross-platform application. This one required the installation of some cryptographic libraries as dependencies. (I haven't looked into the relative security of encryption methods or library used.) The GUI on this program is seriously old fashioned, and glitchy too- the right click menu disappears before you can select an action. The GUI also locked up for me a couple of times.


I also tried a couple of native Gnome applications. GPass is a simple password manager for Gnome.


Revelation is another.

Both are pretty basic (if competent) applications, although lacking the more advanced features of KeePassX like auto type.