Windows update - the real and the scam

Date: 11 April 2008 Original URL: http://www.auscert.org.au/render.html?cid=7066&it=9117 Greetings, It was once again Windows Patch Wednesday for all of us on this side of the planet and there were quite a few patches to be had. Office, Internet Explorer, VBScript, JScript and of course various flavours of Windows all had their issues. Usually there is a burst of malicious activity around Patch Wednesday as miscreants try to use whatever flaws have been revealed before everyone goes to Windows or Microsoft Update, but this time there was something a little more direct. A scam message was circulated claiming to be a Microsoft patch that was instead (unsurprisingly) a virus. Hopefully the effectiveness of this type of 'event driven' scam is starting to drop. Another interesting event this week was our release of ESB-2008.0354 - HP USB Floppy Drive Key (Option) for ProLiant Servers, Local Virus Infection. While the contents of the bulletin is interesting, more interesting is the fact that once we pushed it certain media and other groups began jumping up and down as if we'd released some kind of amazing unheard of information that stunned the world. I bet the poor guy who wrote up the HP bulletin is feeling a little left out. Of course that bulletin did point out that any new media, no matter how new, sealed, and unopened it appears to be, should be treated with suspicion. Anything that plugs in via USB and has storage capacity should be checked for viruses before use - remembering to turn off AutoPlay. Have a good weekend. MDB