bit9

Chrome, Safari, Office top list for serious bugs

Chrome was the application with the most number of high-severity vulnerabilities that impacted end users this year, followed by Safari, Microsoft Office, Adobe Reader and Acrobat, and Firefox, according to a list to be released today.

Chrome had 76 reported serious vulnerabilities, Safari had 60, Office had 57, Acrobat and Reader had 54, and Firefox had 51, according to Bit9's annual "Dirty Dozen" list.

The fact that Chrome is at the top of the list does not necessarily mean it is less secure than other applications, said Harry Sverdlove, chief technology officer at Bit9.

"Chrome is … Read more

Survey: Corporate PCs cluttered with malware

Despite the efforts of IT departments, many PCs in the corporate and government world are littered with unauthorized software, most notably malware, says application-whitelisting company Bit9.

The results of Bit9's "2010 What's Running on Your Users' Desktops?" survey, released Monday, uncovered PCs with a significant amount of non-business software, including games, toolbars, and torrent software. Of greater concern, IT pros surveyed also discovered malware, such as ransom-ware, Trojans, and Chinese spyware.

Among the 1,282 IT professionals questioned for the survey, 68 percent of them said they have software restrictions in place, but 45 percent said … Read more

Is white listing going mainstream?

White lists will be on every desktop within the next five years, according to Patrick Morley, CEO of Massachusetts-based Bit9. Morley was in town to address the Dow Jones VentureWire Technology Showcase in Redwood City, Calif., on Tuesday. He stopped by CNET News afterward to discuss why he believes white listing will be important in the next few years.

The basic idea behind "white listing" is to define a set of software, a set of vendors, and allow only those trusted applications or files from those vendors to run on your machine. If a file or application is … Read more

Column: Will you be ditching your antivirus app anytime soon?

For the last few months, I've been hearing some well-regarded security people tell me they are considering ditching their antivirus protection all together. They haven't done it, but these individuals feel the days of having a special application scan to remove malware on your desktop are numbered. Malware has changed, but the applications to ferret them out have not.

Antivirus programs, as we know them today, are based on 20-year-old technology of pattern matching. Pattern matching may have worked in the days of the Micheangelo virus and even as recently as Netsky, but methodically matching each and every … Read more

Security Bites 108: Understanding white listing

To put it simply, the concept of "white listing" is to define a set of software, a set of vendors, and allow only those trusted applications or files from those vendors to run on your machine. If a file or application is not approved, it will not run. This is the opposite of how we've blocked malware from our machines in the past.

In 2007, Symantec detected more than 1 million viruses, with two-thirds created within the calendar year. Loading 1 million antivirus signatures or even a percentage of that if generic signatures are used is a … Read more

Restricting insecure applications

Back in August I wrote about a free security program for Windows XP called DropMyRights. It comes from a trusted source, requires no maintenance, and incurs no overhead.

DropMyRights works by front-ending an application. To use it with Internet Explorer for example, you make a shortcut to DropMyRights and modify the shortcut to include the full path to the IE executable. When DropMyRights runs, it, in turn, invokes Internet Explorer. But, as the name implies, it first lowers the "rights" for IE. Thus, even if you are logged onto Windows XP as an Administrator, IE will run with … Read more