Things that are injurious to your computer's health right now

ACCORDING TO reports on Bugtraq and Full-Disclosure, new holes have been found in Microsoft's RPC implementation. This was supposed to have been fixed by update MS03-039, but there was a hole in the patch that patched the hole left by the previous patch.

This will doubtless be fixed by a new patch (this is a link to the future, so it may not work yet). It is unclear whether the hole is actively being burrowed through by cyberworms. You can protect yourself by blocking certain ports at the firewall (details here and here), but if you block these ports on your computer then file sharing and domain login won't work any more, so lets hope there are no infected machines inside your firewall.

As far as we can gather, updating your virus definition files and your Windows installation won't help yet.

In a separate development, a list of unpatched security problems in Internet Exploder has been removed from the net. According to the people at Pivx this was their own decision, after not even a single nanopascal of pressure from the Vole. Anyone who misses the list can still find it in Google's cache.

Here's where it used to be, now replaced with an explanation of how Microsoft has recently turned over a new leaf and started taking security problems seriously. Would it be overly cynical to say that we've heard that before?

Gallery, a PHP-based application that lets you bore people with the contents of your photo album without requiring their physical presence on your sofa, had to issue an updated version after a post to Bugtraq pointed out a way to allow execution of arbitrary code and household pets using a flaw in the Gallery's configuration mode. Another PHP-based web application, myPHPCalendar, also has issues, according to this Bugtraq posting.

In other Open Source news, OpenSSL has some issues you should already have patched, and if you are using perl for your website you had better take a look at this one.

If you feel like suing Microsoft for letting evil things happen to your PC then the full text of the class action suit is not online here. Join in now or the hamster gets it!

There is a rash of emails out there trying to steal your password by getting you to log in to the websites of banks, ebay, paypal, etc. The emal directs you in a more or less subtle way to a rogue (or cracked) web site and snarfs your password and personal details for nefarious purposes. The practice is known as phishing and the easiest way to avoid it is never to type in a password after following a link obtained from email, and always to make sure you are on the correct site. Banking sites will always have the address (in the URL bar):

http s://www.companyname.com /

and if either the 's' or the slash is missing then you are not on the site you think you are. The 's' and the locked padlock symbol at the bottom of the web browser tell you you are on a secure site, but not whose secure site you are on. You can check the identity of the secure site by looking at the name in the URL bar (watch out for that slash!) or, better, checking the certificate of the secure web site by clicking on the padlock.

There's a lot of poor information out there on this subject from people who should know better. On this page Moneybookers.com tell you to look out for the 's', but forget the '/'. Paypal make the same mistake here. E-gold warn their users here, but make it appear that only HTML mails are dangerous (in fact most email programs will pick URLs out of text mails too). Barclays Bank has a lot of good advice, but also fail to give the right way to check a URL or a certificate. To their credit, that information is here for their most persistent customers. µ