An interesting weakness has emerged in a new pre-release product, Google Desktop. This is a Windows utility from the famous search engine company that allows you to index and search all the content on your computer, including e-mail and web pages you have visited.
Unfortunately, Google Desktop also indexes the contents of encrypted, password-protected files and makes their contents visible without the passwords. It's only a beta (a public beta, to be more precise), but it's something users should know about. See Security Alerts and Updates for more details.
It's been some time since a major e-mail worm outbreak happened, but last week brought us three new variations of Bagle, one of the most successful families of e-mail worms and our Top Threat this week. The outbreak petered out within a couple days, but was progressing at high volume for a while, probably because of a large and deft "seeding" of the worm. This term refers to the initial distribution of the worm by its author.
Bagle is typical of mail worms. It spreads through peer-to-peer networks and through the e-mail using its own mail engine. It harvests the e-mail addresses it uses from files on the computer it infected. It opens a backdoor allowing an attacker to take control of the computer.
Bagle may have been the big news, but the top threat in terms of actual volume, according to several antivirus vendors, continues to be the many-months-old Netsky.P. They just don't build them like they used to back in March, when Netsky.P emerged.
New vulnerabilities, listed in the Top 5 Vulnerabilities section, focus for a change on Microsoft competitors, including MacOS X and the RealPlayer software. Security Alerts and Updates also has information on a security hole in Apple's QuickTime for Windows.
There's a different kind of phishing attack out this week. It doesn't try to steal information from you, it tries to trick you into performing a task on behalf of the phisherman. Specifically, some spammers want some Yahoo! Mail accounts for spamming, but Yahoo!'s techniques prevent them from automating the creation of accounts. So they spam out a fraudulent message trying to trick you into creating an account for them. The best defense against this sort of thing is to be suspicious of everything.
Finally, passwords can be an effective tool to protect your information, but weak and short passwords can be easy to crack. One possible answer is to use passphrases, which are groups of words, as in a sentence or sentence fragment. Not every system lets you use such a password, but many do, and it may be easier to remember a passphrase like "The Boston Red Sox are finally champions after all these years!" than a strong password like "G*80mbVC#rqL0".