ORLANDO -- Antivirus programmers just can't get a break before the next computer security problem pops up in an unexpected way.
Oracle recently repaired a crucial flaw in Java, and Adobe is expected to repair problems with Shockwave next month
Cyber-criminals will target computers using Adobe Flash, Shockwave and Java because of security vulnerabilities found in each of them, according to the companies that write antivirus software.
Nearly every computer on the planet uses the three software plugins. They are essential for many websites to display correctly in browsers.
Computer viruses and malware are legitimate serious threats to computer users, but the companies often over hype the dangers. The warnings often downplay what the New York Times describes as the antivirus industry's dirty little secret: Its products are often not exceptionally good at stopping viruses.
Oracle released an urgent Java upgrade, Sunday, Jan. 13, to correct significant problems with their software. The patch sealed a dangerous exploit that would permit hackers to seize control of Windows PC.
The sigh of relief was short lived.
Less than 24 hours after the release of the Java patch, blackguards secretly began peddling instructions on ways to exploit the newest version, according to KrebsonSecurity.com.
New Java 0day, selling to 2 people, 5k$ per person.
~Posting in hacker forum
To get the exploit instructions, a hacker will shell out $5,000 and pay $10,000 a week to use it, according to Brian Krebs.
The posting was taken down the next day indicating a buyer had been found.
A zero day flaw is one that the developers of software don;t know about -- yet.
The U.S. Computer Emergency Response Team first identified vulnerabilities in Shockwave in 2011. Adobe says the exploit should be fixed in February 2013.
Cyber-criminals use the exploits to infect computers with malware when internet users visit certain websites infected with malware. Once infected by a form of malware, cyber criminals can take control of your computer for a variety of nefarious purposes.
"It is undoubtedly the preferred method of infection for compromising systems transparently, used by both cyber-criminals and intelligence agencies in countries around the world," said Luis Corrons, technical director of PandaLabs.
Most computer malware and virus code are in the wild for at least a month before they are discovered. Then it can take anywhere from a day to years to write code that can eradicate it.
The makers of anti-virus software have several goals:
- Sell more software and increase profits for shareholders.
- Frighten computer users into buying antivirus software.
- Protect computers from anti-virus and malware software.
Once antivirus software is part of your computer, there are basic steps to protect your computer:
- Check the anti-virus software to make sure it is up to date.
- Download computer programs only from sites that are trustworthy.
- Do not open email attachments from unknown senders. Even if you receive an email attachment from a trusted source, scan it with antivirus software before using it.
- Do not click or follow links in spam email.