Skip to main content
To Customer Support To Customer Support

Welcome

News, Announcements, Tech Discussions

44794 Topics
RetiredTripleHelix
Gold VIP
RetiredTripleHelixGold VIP
posted in Security Industry News
Third-party software accounts for 86 per cent of PC vulnerabilities

Almost nine out of 10 security flaws discovered on PCs running Windows were due to vulnerable third-party applications rather than pre-installed Microsoft software. That's according to [url=http://secunia.com/vulnerability-review/]a report[/url] by security expert Secunia, which examined the security of the 50 most-used Windows applications in 2012. Secunia discovered that 86 per cent of vulnerabilities come from non-Microsoft software, despite Microsoft products accounting for almost two-thirds of the top 50 most used software programs on average. Google Chrome was found to have the most vulnerabilities with 291, followed by Mozilla Firefox with 257 and Apple iTunes with 243. The most vulnerable Microsoft product is Windows 7 itself, ranked by Secunia as seventh most vulnerable, with Internet Explorer ninth with 41. The 86 per cent of vulnerabilities in third-party applications marks an increase on 2011, which saw 78 per cent of flaws arise from non-Windows based software. The resear

4401
pegas
Gold VIP
11 years ago
YegorP
YegorPRetired Webrooter
posted in Security Industry News
FTC announces crackdown on telephone-wielding scareware scammers

A huge annoyance at best, these guys have been racking up thousands of dollars from providing fake tech support to unsuspecting victims who were tricked into believing their computers were seriously infected (or were about to be) if they didn't act swiftly and let these self-proclaimed security experts remote into their machines to remove the 'infections' like the tactical tech surgeons they posed to be.   Often times pretending to be affiliated with a computer or internet security company, all these scammers really did was have the victims open up the Windows Event Viewer (which shows messages about how the computer is operating), and then bombard them with claims that each warning or error message would turn into a virus or that their computer would explode (seriously?) if they didn't let the 'expert' work their magic to clear up these threats. And "clear up these threats" typically meant installing a free AV trial and/or deleting the 'virus' (harmless file) in question, followe

713
ProTruckDriver
Moderator
11 years ago
JimM
JimMRetired Webrooter
posted in Security Industry News
Subway Hit with POS Hack

[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/2404i26972E62D897217B.png[/img]   Two men have been indicted on charges that they hacked into Subway POS systems, pilfering $40,000 in the process.  That's 8,000 $5-foot-longs for those of you keeping count.  The interesting part is in how they did it.  One of the men charged, Shahin Abdollahi, actually ran the company that originally sold the POS systems to the Subway franchise.  Those systems came preloaded with remote-access software.  In responsible hands, remote-access tools are wonderful for troubleshooting or leveraging computers at various locations to perform a task when you aren't right in front of them.  In this case however, the hands turned out to be not so responsible, and the task turned out to be creating bogus.gift cards, bringing a whole new meaning to the term "losing pounds with Subway" (£26,530 pounds by today's conversion rate).   What's the lesson?  Don't

9783
ProTruckDriver
Moderator
11 years ago
RetiredTripleHelix
Gold VIP
RetiredTripleHelixGold VIP
posted in Security Industry News
US vulnerability database offline after hack

[img]http://www.h-online.com/security/icons/security_logo_theH.gif[/img] The National Vulnerability Database (NVD) at NIST, the National Institute of Standards and Technology, is currently [url=http://nvd.nist.gov/index.html]offline[/url] after malware was discovered on two NIST web servers, according to a [url=http://www.theregister.co.uk/2013/03/14/us_malware_catalogue_hacked/]report[/url] in [i]The Register[/i]. The NVD is a US Government repository of vulnerability information in [url=http://en.wikipedia.org/wiki/Security_Content_Automation_Protocol]SCAP[/url] format. The [url=https://plus.google.com/u/0/106350285372295328202/posts/HNayDzUoYEz]details[/url]of the infection come from a mail received by Kim Halavakoski, who had mailed NIST when he noticed the site was down. [img]http://www.h-online.com/imgs/43/9/9/6/3/0/6/NIST_logo.svg-8004ad57495326ce.png[/img] He received a reply from Gail Porter at NIST, which he posted on Google+. Porter said the servers had been t

2460
RetiredTripleHelix
Gold VIP
11 years ago
RetiredTripleHelix
Gold VIP
RetiredTripleHelixGold VIP
posted in Security Industry News
Apple ships fixes for new Java Web Start hole

[img]http://www.h-online.com/security/icons/security_logo_theH.gif[/img][b] [/b] [b]15 March 2013, 17:49[/b] [b] [/b] In the latest Apple update for Mac OS X 10.8, 10.8.3, and Security Update 2013-001 for earlier Mac OS X versions, Apple has fixed a flaw which allowed malicious Java code to be run even when the Java plugin was disabled. The updates fix 21 CVE-listed flaws in Mac OS X, of which 11 are listed as allowing for remote code execution. The Java fix is listed under "CoreTypes" as it does require the file to have been downloaded onto the system. It turns out that the system will attempt to run files automatically if they are labelled as safe and that the Java Web Start application files, .jnlp, were listed among these safe files. An attacker would need to convince a victim, through social engineering or technical trickery, to download the .jnlp file and, if the browser was set to execute safe files, that code would run. At no time would the Java plugin have

20
RetiredTripleHelix
Gold VIP
11 years ago
RetiredTripleHelix
Gold VIP
RetiredTripleHelixGold VIP
posted in Security Industry News
Adblock Plus for Android removed from Google Play store

[h3]2013-03-14 09:37 by Wladimir Palant[/h3]In a rather surprising move, Google removed Adblock Plus and other ad blocking apps from the Google Play store due to “interference with another service or product in an unauthorized manner.” This looks like a course change at Google, until recently the main distinction between Android and iPhone was that Android allowed you to install any app as long as it wasn’t malicious (meaning that it’s obvious what the app does). Google Play still allows apps stating “for rooted phones only” but I wonder whether these are next on the list to be removed – each of them performs “unauthorized actions”. [b]Update (2013-03-16)[/b]: The Electronic Frontier Foundation did a great job explaining [url=https://www.eff.org/deeplinks/2013/03/google-censoring-android-apps]why this move is sadly disappointing[/url], way better than I did. What does that mean for existing users?Users who already have Adblock Plus installed will be able to continue using it. However,

3020
RetiredTripleHelix
Gold VIP
11 years ago
RetiredTripleHelix
Gold VIP
RetiredTripleHelixGold VIP
posted in Security Industry News
Huawei 3G/4G USB sticks put users' security at risk

[img]http://www.h-online.com/security/icons/security_logo_theH.gif[/img] 15 March 2013, 14:48  At the [url=http://www.blackhat.com/eu-13/]Black Hat Europe[/url]conference that is currently in progress, Russian security expert Nikita Tarakanov has presented the results of his analysis of the driver software that Huawei ships with its 3G/4G USB sticks. According to the researcher, the various components – drivers, configuration software, update mechanisms – are all of insufficient quality. The central update server was identified as a massive attack vector by Tarakanov: the Huawei software installs an application and driver auto-update component on every computer. The researcher said that the service in question will contact a server in the Netherlands and query it for updates every 15 minutes. Apparently, the web server is still running on Microsoft's outdated Internet Information Server (IIS) version 6.0, which is part of Windows Server 2003. Tarakanov pointed out that whoeve

2780
RetiredTripleHelix
Gold VIP
11 years ago
A
Fresh Face
AppletcFresh Face
posted in Community 101
New user

Hi WR Community New user with a problem. Installed internet security complete on a Toshiba Satilite M305  and I'm having an issue with the mouse and touch pad. Thought it was the battery so I put in a fresh 1 , didn't work re-booted and the the laptop powered back up with the touch pad dead. Tried a wired USB mouse re-booted  and nothing no pointing devices, even tried re-booting in safe mode no luck. Any suggestions ????? Could this be a software conflict or did the laptop pick a bad time to crap out......... Thanks

85410
JimM
11 years ago
Rakanisheu Retired
Rakanisheu RetiredRetired Webrooter
posted in Community 101
Hello!

Just thought I would introduce myself to the Forum. I am a Webroot employee who works in the threat research department. I am handy enough at removing infections so I will be keeping an eye on the forums for any malware issues or potential new malware.

9115
RompinRaider
Popular Voice
11 years ago
YegorP
YegorPRetired Webrooter
posted in Tech Talk
Samsung's new Galaxy S4-The Specs

Yesterday, , I posted a [url=http://community.webroot.com/t5/Techie/Galaxy-S4-before-the-Galaxy-S4-Announcement/m-p/30572#M549]report of leaked review[/url] about the Samsung's rumored Galaxy S4 before the behemoth electronic manufacturer unveiled the 9-month awaited flagship phone in all of it's glory in NYC. And the rumored review proved to be pretty darn accurate in spoiling the design. Nevertheless, the event still had the world watching.  Now, almost a full day after all the major tech reporters got their initial hands-on impressions, I'll break down the specs (now that they are certain).   [list] [*]OS-Android's latest 4.2.2 Jelly Bean [*]Design-Looks very much like the S3 with a few tweaks: Larger screen (5 inches), higher resolution (1080p), better battery (2,600mAh), less plasticy-feeling plastic, and two color options-white and "Black Mist" [*]Processors-faster and will vary depending on the market (1.9GHz quad-core or 1.6 GHz octa-core) [*]Improved camera (13MP rea

2850
YegorP
11 years ago
YegorP
YegorPRetired Webrooter
posted in Security Industry News
Apple purges OS X flaw which allowed attackers to bypass security measure

In an [url=http://ars.to/WMpgLN]OS X update that saw more than a dozen security flaws getting patched,[/url] one particularly stood out. The CoreTypes vulnerability affecting OS X Lion and Mountain Lion was a major security risk because it allowed attackers to override Apple's security measure and allow Java apps to run even when the browser plug-in was disabled.   "...attackers could override the protective measure by manipulating the Java Network Launching Protocol, or JNLP, which allows applications to launch directly from a browser.'" To fix the issue, JNLP files were removed from the CoreTypes safe file type list in order to ensure that the Web Start app couldn't be run unless the user opened it in from "Downloads". Apple addressed other bug fixes as well, including ones that allowed malicious code to be executed via compromised PDF files or QuickTime videos.   The full ARS Technica report can be found via the aforementioned link.   [i][img]https://d1qy7qyune0

10
YegorP
11 years ago
YegorP
YegorPRetired Webrooter
posted in Security Industry News
Apple purges OS X flaw which allowed attackers to bypass security measure

In an [url=http://ars.to/WMpgLN]OS X update that saw more than a dozen security flaws getting patched,[/url] one particularly stood out. The CoreTypes vulnerability affecting OS X Lion and Mountain Lion was a major security risk because it allowed attackers to override Apple's security measure and allow Java apps to run even when the browser plug-in was disabled.   "...attackers could override the protective measure by manipulating the Java Network Launching Protocol, or JNLP, which allows applications to launch directly from a browser.'" To fix the issue, JNLP files were removed from the CoreTypes safe file type list in order to ensure that the Web Start app couldn't be run unless the user opened it in from "Downloads".  Apple addressed other bug fixes as well, including ones that allowed malicious code to be executed via compromised PDF files or QuickTime videos.   The full ARS Technica report can be found via the aforementioned link.   [img]https://d1qy7qyu

30
YegorP
11 years ago
YegorP
YegorPRetired Webrooter
posted in Tech Talk
Galaxy S4 before the Galaxy S4 Announcement

Title confusing you? Let me explain.   As you may very well know, Samsung's "Next Big Thing", the much [url=http://reviews.cnet.com/samsung-galaxy-s4/]rumored,[/url] [url=http://www.droid-life.com/2013/03/13/samsung-unleashes-flash-mob-on-times-square-before-tomorrows-galaxy-s4-announcement/]hyped[/url], and [url=http://news.cnet.com/8301-1035_3-57572304-94/samsung-unpacks-galaxy-s4-teaser-video/]comercially-campaigned-without-showing-anything[/url] Galaxy S4 smartphone is being unveiled tonight in New York City at 5:00PM EST. But if a brand new review form a Chinese source is any suggestion (and it looks like it is), you don't have to wait until tonight to see the device (or some of it's general specs for that matter).   The full story (with a link to the original review in Chinese) can be found [url=http://techcrunch.com/2013/03/14/samsung-galaxy-s-iv-gets-picked-over-before-the-unpacked-event-in-exhaustive-review/]here[/url], but I'll break down some of the basics: [list]

20866
pegas
Gold VIP
11 years ago
M
New Voice
MaurizioNew Voice
posted in Community 101
Maurizio

Maurizio.

13698
pegas
Gold VIP
11 years ago
L
Fresh Face
lizgun45Fresh Face
asked in Community 101
Hi I'm new to Webroot!

Hi Everyone. I'm new to Webroot anti-virus.  I'm still trying to find out how to set it up to delete attachments & viruses from my email.  I'm sure I'll find it somewhere, otherwise I can't use webroot.  Still searching. . . .LOL  The good news is that it's Friday!!  I'll go post in the forum for some help.  Have a good weekend everyone! :D

5974
pegas
Gold VIP
11 years ago
F
Fresh Face
frozensmurfFresh Face
posted in Security Industry News
Ars exposes RAT's and RATTERS to the world - cover your webcams

[url=http://arstechnica.com/tech-policy/2013/03/rat-breeders-meet-the-men-who-spy-on-women-through-their-webcams/]http://arstechnica.com/tech-policy/2013/03/rat-breeders-meet-the-men-who-spy-on-women-through-their-webcams/[/url] "The woman is visible from thousands of miles away on a hacker's computer. The hacker has infected her machine with a remote administration tool (RAT) that gives him access to the woman's screen, to her webcam, to her files, to her microphone. He watches her and the baby through a small control window open on his Windows PC, then he decides to have a little fun. He enters a series of shock and pornographic websites and watches them appear on the woman's computer. The woman is startled. "Did it scare you?" she asks someone off camera. A young man steps into the webcam frame. "Yes," he says. Both stare at the computer in horrified fascination. A picture of old naked men appears in their Web browser, then vanishes as a McAfee security prod

4902
ProTruckDriver
Moderator
11 years ago
JimM
JimMRetired Webrooter
posted in Security Industry News
National Vulnerability Database Taken Down by Vulnerability-Exploiting Hack

From ARSTechnica: [quote]The federal government's official catalog of software vulnerabilities was taken offline after administrators discovered two of its servers had been compromised. By malware. That exploited a software vulnerability.   The [url=http://nvd.nist.gov/index.html]National Vulnerability Database[/url] is maintained by the National Institute of Standards and Technology and has been unavailable since late last week, according to an e-mail sent by NIST official Gail Porter published on Google+. At the time of this article on Thursday afternoon, the database remained down and there was no indication when service would be restored. [/quote]Oh, the irony!  It appears to still be down at the time of this post.  Currently, the site messaging reads: [h1]Site/Page Not Available[/h1]The NIST National Vulnerability Database (NVD) has experienced an issue with its Web Services and is currently not available. We are working to restore service as quickly as possible. W

4631
RetiredTripleHelix
Gold VIP
11 years ago
JimM
JimMRetired Webrooter
posted in Security Industry News
National Vulnerability Database Taken Down by Vulnerability-Exploiting Hack

From ARSTechnica: [quote]The federal government's official catalog of software vulnerabilities was taken offline after administrators discovered two of its servers had been compromised. By malware. That exploited a software vulnerability.   The [url=http://nvd.nist.gov/index.html]National Vulnerability Database[/url] is maintained by the National Institute of Standards and Technology and has been unavailable since late last week, according to an e-mail sent by NIST official Gail Porter published on Google+. At the time of this article on Thursday afternoon, the database remained down and there was no indication when service would be restored. [/quote]Oh, the irony!  It appears to still be down at the time of this post.  Currently, the site messaging reads: [h1]Site/Page Not Available[/h1]The NIST National Vulnerability Database (NVD) has experienced an issue with its Web Services and is currently not available. We are working to restore service as quickly as possible. W

2950
JimM
11 years ago
jgouverneur
Community Leader
jgouverneurCommunity Leader
posted in Security Industry News
Kaspersky fixes IPv6 problem in Internet Security Suite

The following story was posted on the H online (h-online.com): [i] [/i] [i]Security researcher Marc Heuse discovered that the firewall in Kaspersky Internet Security 2013 has a problem with certain IPv6 packets. The researcher said that he publicly disclosed the details of the problem because Kaspersky didn't respond when he reported it. Shortly after his disclosure, Kaspersky did release a fix.[/i] [i] [/i] Full Story: [url=http://www.h-online.com/security/news/item/Kaspersky-fixes-IPv6-problem-in-Internet-Security-Suite-1822839.html]http://www.h-online.com/security/news/item/Kaspersky-fixes-IPv6-problem-in-Internet-Security-Suite-1822839.html[/url]

4190
jgouverneur
Community Leader
11 years ago
RetiredTripleHelix
Gold VIP
RetiredTripleHelixGold VIP
posted in Security Industry News
Oracle investigating after two more Java 7 zero-day flaws found

Here we go again! :@   Summary: Polish security researchers have discovered yet more zero-day vulnerabilities in Java, the beleaguered Web plug-in, that led to the successful intrusion of Facebook, Apple and Microsoft in recent weeks. [img]http://cdn-static.zdnet.com/i/r/library/author/zackwhittakerhs2012-60x45.jpg?hash=ZTVmBTH5Mw&upscale=1[/img]By [url=http://www.zdnet.com/meet-the-team/us/zack-whittaker/]Zack Whittaker[/url] for [url=http://www.zdnet.com/blog/security/]Zero Day[/url] | February 28, 2013 -- 16:36 GMT (08:36 PST)   Java is at the center of yet another security storm after Polish security researchers found not one, but two new separate zero-day flaws in the Web plug-in software. Web users are once again warned to [url=http://www.zdnet.com/how-to-disable-java-in-your-browser-on-windows-mac-7000009732/][b]disable Java immediately[/b][/url] to prevent any infection on production machines or networks.  [h3]Read this[/h3][img]http://cdn-static.zd

510
RetiredTripleHelix
Gold VIP
11 years ago
RetiredTripleHelix
Gold VIP
RetiredTripleHelixGold VIP
posted in Security Industry News
The danger of an exposed account username.

   0 inShareIn each of the recent attacks on [url=http://www.itproportal.com/2013/03/04/evernote-hack-forces-users-to-reset-passwords/]Evernote[/url], [url=http://www.itproportal.com/2013/02/16/facebook-targeted-by-hackers-but-insists-your-data-is-safe/]Facebook[/url], [url=http://www.itproportal.com/2013/02/02/twitter-compromised-hackers-make-details-250000-users/]Twitter[/url] and others, the companies involved were quick to point out that passwords remained secure. But user information has a life of its own, and the effects of an attack on an individual can be felt long after the attack is over. Typically what you hear when a major company has been compromised is something along the lines of how payment information is still secure, passwords were encrypted, but other information was accessible. Usually, this includes usernames and emails. To most of us, that might not seem dangerous. After all, we give out our own emails all the time – we even post them online. But th

4791
shorTcircuiT
Gold VIP
11 years ago
YegorP
YegorPRetired Webrooter
posted in Security Industry News
Microsoft's March Patch Tuesday

According to a [url=http://bit.ly/Yny08t]recent PC Mag report[/url], this month's Patch Tuesday took care of a major USB flaw along with 20 other bugs via seven security bulletins released by Microsoft. There were a number of affected applications ranging from Internet Explorer to Sharepoint to Office for Mac. Four of the bulletins had a 'critical' rating while the other three were marked as 'important'. The cumulative Internet Explorer patch, which has the highest priority, applies to all supported version of Internet Explorer, from versions 6 to 10...The IE advisory does not apply to users who downloaded and installed IE 10 for Windows 7 released just a few weeks ago, as Microsoft had already included those fixes. While none of them are currently being targeted in the wild, IE is a frequent target and should be patched immediately. Also important to note is that none of the vulnerabilities that were exploited in [url=https://community.webroot.com/t5/Security-News/IE-Chrome-and-Fi

6371
cohbraz
Community Leader
11 years ago
YegorP
YegorPRetired Webrooter
posted in Security Industry News
Microsoft's March Patch Tuesday

According to a [url=http://bit.ly/Yny08t]recent PC Mag report[/url], this month's Patch Tuesday took care of a major USB flaw along with 20 other bugs via seven security bulletins released by Microsoft. There were a number of affected applications ranging from Internet Explorer to Sharepoint to Office for Mac. Four of the bulletins had a 'critical' rating while the other three were marked as 'important'. The cumulative Internet Explorer patch, which has the highest priority, applies to all supported version of Internet Explorer, from versions 6 to 10...The IE advisory does not apply to users who downloaded and installed IE 10 for Windows 7 released just a few weeks ago, as Microsoft had already included those fixes. While none of them are currently being targeted in the wild, IE is a frequent target and should be patched immediately. Also important to note is that none of the vulnerabilities that were exploited in [url=https://community.webroot.com/t5/Security-News/IE-Chrome-and-F

3000
YegorP
11 years ago
RetiredTripleHelix
Gold VIP
RetiredTripleHelixGold VIP
posted in Security Industry News
Adobe Air 3.6.0.6090 Released

Adobe Air needs to be updated also! [url=http://get.adobe.com/air/]http://get.adobe.com/air/[/url]   [i][b]TH[/b][/i] [i][b] [/b][/i] [b][img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/2334i5FDCF75D9866B5DB.png[/img] [/b]

5404
pegas
Gold VIP
11 years ago
JimM
JimMRetired Webrooter
posted in News & Announcements
Webroot Offers User-Based Pricing

[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/2310iD1A31FE9A1B8E12F.gif[/img]   Our Webroot for Business line of products just got a pricing makeover and we're excited about it because it just...makes sense!   Here's an excerpt from the release: [i][b] [/b][/i] [i][b]Broomfield, Colo. – March 12, 2013[/b] – Webroot, a leader in cloud-based security intelligence solutions, today launched Webroot SecureAnywhere Business User Protection Pricing. Unlike traditional fixed per device plans, the new flexible licensing program enables enterprise and service provider customers to leverage a user-based licensing model. Companies can now quickly and easily deploy Webroot SecureAnywhere endpoint and mobile protection services with a simple, straightforward licensing model that protects users across endpoints, mobile devices, physical servers, and virtual servers—all in a single, user-based license to keep companies secure, anywhere.[/i] [i] [/i] [i]Some of th

390
JimM
11 years ago

Badges

Show all badges

Join the Conversation

Terms & Conditions

© 2004 - Webroot Inc.

We have recently updated our Privacy Policies. We encourage you to read the full terms here.