Zero Day Bugs exposed in IE & Firefox

Michal Zalewski, a computer security expert and white hat hacker published demos of four different browser vulnerabilities on the Full Disclosure mailing list. These Multiple vulnerabilities pertaining to cookie stealing, keystroke snooping, page hijacking, malicious downloading and content spoofing can be exploited by malicious people to compromise a User's System.

MSIE bait & switch vulnerability (page update race condition), has been rated critical affecting Microsoft's IE 6 and IE 7 (fully patched). This IE Vulnerability gives attackers a window of opportunity to run malicious Javascript to hijack the System. Firefox is not vulnerable. Click here for an online demo and technical details.

Firefox cross-site IFRAME hijacking bug was rated as a major vulnerability that could allow Malicious Coders to use Javascript to inject malicious code including keystroke snooping and content spoofing attacks, on pages that rely on IFRAMEs to diplay contents or store state data. Click here for an online demo and technical details.

Third Vulnerability targeting Firefox is realted to bypassing the Firefox file prompt delay. An attacker can download or run files without user's knowledge by using a sequence of focus operations that can be used ti bypass delay timers implemented on certain Firefox confirmation dialogs. Click here for an online demo and technical details.

Finally, the last vulnerability is a URL bar spoofing that affects MS IE 6 and could allow an attacker to mimic an arbitary site, possibly including SSL data. Click here for an online demo and technical details.

Mozilla is aware of both the Firefox bugs and Microsoft said the company's security team is looking into Michal Zalewski's claims.

Free Anti Virus Software

Earlier, there were Viruses but Now a days there are plethora of malicious programs like Trojan Horses, Worms, Spywares, Adwares, Root kits etc that can infect your computer and compromise Confidentiality, integrity and availability of sensitive information and data on your machine. If you are on an "always-on" Internet connection, You need to have a Security Software that offers REAL TIME PROTECTION. If you want complete protection against Malware, You need at least the following type of Software Applications.

1. Anti-Virus - To protect against Viruses, Worms, Trojan Horses.
2. Anti-Spyware - To protect against Spywares, adwares, malicious scripts, unwanted pop ups etc.
3. Firewall - To protect against Network based Attacks (DoS, DDoS), unauthorized Access, restrict Access etc.

I will discuss about the Anti-Virus Softwares for Home Users & Non Commercial Use focusing on the ones which are available for FREE. The following are the important features you must look at an Anti Virus software (whether free or commercial).

• Real Time Protection - AV Software should Always be ON and monitor the system in real time for suspicious activity.
• On Demand Scanner - User should be able to Scan for inactive viruses and malicious programs whenever required.
• Auto Updates - AV Software should be able to download Automatic Updates of Virus Definitions on a frequent basis.
• Heuristics - AV Software should be able to detect and quarantine previously unknown viruses.
• Detection Rate - AV Software should be able to detect almost all known threats with a fast speed.
• Additional features if available like Email Protection, P2P & IM Protection, Scheduler, Reporting/Logs etc.
  

There are lot of commercial AV Softwares that includes all of the above features and much more. But if you are looking for a FREE AV Software for Windows Operating System, then I have compiled a List of the Top Free AV Softwares.

A free Anti-Virus Software by AOL (No, You don't need to Subscribe to AOL), powered by “Kaspersky Antivirus” which is the best AntiVirus on the market and offers excellent detection rates and update frequency that can be expected from Kaspersky. Features includes:

• Real time protection from viruses, worms, Trojan horses, spywares, adwares and other potentially dangerous malware
• Email Protection for all E-mail Clients
• On Demand Scanner File/Mail Scanner
• Scheduler, Automatic Hourly Updates
• Variable Scan Speed and hence very little impact on your System Performance
• Easy to Install and Friendly User Interface
• Laptop power saving and HT technology support & Support for 64 bit Windows.
  

Click here to go to Active Virus Shield website.

Grisoft has been offering AVG Free Anti-Virus Solutions to home and non-commercial use for a long time. The Software is very configurable and includes the following features:

• Real Time Protection & E-mail real time protection
• On Demand Scanner & Heuristic Scanning
  
• Auto Updater for both Virus Definitions and Program
• Rescue Disk, Very Configurable easy to Use GUI
• Virus Vault for Quarantined Files, Multilingual support
  

There is No Support, downloads are bit slow and you have to manually move the Quarantined and Infected files to Virus Vault. The Software doesn't scan for spyware and adware. In fact, the have a separate product called AVG Anti-Spyware Free for that purpose.

Click here to go to AVG's Website

Avast! 4 Home Edition is a very feature rich Anti Virus package FREE for home users and non commercial use. The software feature includes

• Real time Resident Protection for Operating System, File System and E-Mail Clients
• Automatic Updates, P2P and Instant Messaging (IM) Shields
• Network Shield that analyzes Network Traffic for Malicious content
• Web Shield that analyzes HTTP Traffic for malicious content
• Heuristic Analysis, Integration with Windows Explorer, Simple Skin based User Interface
  
• Virus Chest for Quarantined files, Boot Time Scanner
  
• Support for 64 Bit Windows, Multiple Language Support.

The Software requires Registration.
Click here to go the website of Avast! 4 Home Edition.

Avira offers FREE of Charge Avira AntiVir Personal Edition Classic that also comes with new root kit detection. The Software is quick to install and includes following features:

• Real time protection against viruses, worms, Trojan horses
• Protection against expensive dialers and phishing
• On Demand Scanner, Scheduler
• Automatic Updates, Heuristic Scanning
• Detects and deletes root kits
• Friendly GUI with easy to configure options

There is no Email scanner for Email Clients and support is limited. The Software doesn't scan for Spywares and Adwares. The Automatic Updates are slow for the free version.

Click here to go to Avira's Website.

ClamWin is an open source (GPL) Free Antivirus for Microsoft Windows Operating Systems. The software comes with the following features:

• Standalone virus scanner
  
• Scanning Scheduler, Automatic updates
• Integration with right click menu of Windows Explorer,
  
• Addin for scanning MS Outlook attachments.
  

ClamWin Free Antivirus does not include an On-Access Real-Time Scanner. You would need to manually scan a file in order to detect a virus or spyware. Also, it doesn't scan for Spywares and Adwares.

Click here to go to Clamwin's website.