Geek Life 3.1

Yup. That’s all-caps in the title. And for good reason … actually, two good reasons. One, over the course of 2016 WordPress installations became the number one target of professional cyber-attacks. WordPress had long been the favourite target of the script kiddies, basement crackers, and other sorts of amateur slime but over the past 12 months the big players started turning their attention to the platform as well. Two, WordFence is the shit.

THE SHIT.

If you have an installation that runs WordPress in any shape or form – whether it’s the platform for your entire web presence, just the blogging component of a larger site, or anywhere in between – you need to harden it now. Not tomorrow, not this weekend when you are taking a break from surfing porn, not next week after you run it by yet another committee. It’s free* (as in beer), it works, and it’s stupidly easy to use … either start it up and forget about it until it tells you that you need to do something, sit down and tweak the crap out of it, or split the difference and get it started as is for now and tweak it later. The choice is yours.

You can download it for manual installation here, or you can look under the Plugins – Add New section of your WordPress dashboard for an automated install. Just get it. You’ll thank me later.

*NOTE: There IS a “pro” version that requires a subscription. And if you are an enterprise user of WordPress it is money well spent – I would encourage you to upgrade to the pro version right away. But for everyday “hobby” bloggers, the free version works extremely well, and is probably all you need.

Yesterday a rather worrisome exploit was found in the Firefox browser and all products that use the underlying Mozilla engine – Thunderbird, Tor Browser – that allowed otherwise safe and trusted web sites to inject malicious code into computers using the Windows operating system. You can read about it (and get links to updated versions of the software that correct the problem) here.

Now an even more startling development reveals that the exploit may have been added to the Firefox/Mozilla codebase by law enforcement officials, specifically the FBI. Since James Comey assumed the leadership of the FBI they have constantly targeted the Tor Browser, ostensibly as a way to investigate and prosecute offences in child pornography but with a quietly stated endgame of adding to their toolbox for mass surveillance upon all citizens of the United States. It’s not out of the realm of possibility to assume that they will be ramping up these efforts with an incoming president who is publicly committed to destroying personal privacy and free speech rights, and this is the first stage in surreptitiously broadening their listening powers. The widespread fallout that compromises the computer security of millions of innocent “cyber bystanders” would likely be considered acceptable collateral damage in the current political climate.

A full update has been added to the original post on the WordFence blog. It’s definitely worth a perusal – if you only have the time to read one article today, this is definitely the one.

And remember – UPDATE YOUR FIREFOX/MOZILLA PRODUCTS NOW.

A freshly discovered “zero day” vulnerability in the Firefox browser is currently being exploited and – if you are using Windows – can compromise your computer simply by visiting otherwise benign web sites. Fortunately, the exploit was published rather quickly and the Firefox team was able to issue a security patch within a few hours.

However – the exploit uses benign websites (especially ones that are commonly used as starting pages for browser sessions) as “watering holes” and any use at all of previous versions of Firefox is contraindicated until you download and install the newest release. If you use Firefox you need to immediately switch to another browser such as Safari or Chrome until you update Firefox. You can get the update here:

Firefox 50.0.2 Release Notes And Download

If you use Thunderbird for your email you also need to update as it uses the same Mozilla engine for parsing HTML within email messages. This is only a concern if you have Thunderbird set to allow inline content to be displayed automatically or you manually select content to load, but it would be in your best interest to update regardless:

Thunderbird 45.5.1 Release Notes And Download

Finally, if you use the Tor browser and security package, you also need to update as it contains a discrete version of the Mozilla engine that is affected by the same exploit:

Tor Browser 6.0.7 Release Notes And Download

Remember – you should not use either Firefox or Tor for any reason, even to download the updates, until you have the newest versions installed. Kudos to the Firefox/Mozilla team for getting these updates out so quickly. If you are interested in how the nuts and bolts of this works, there is an excellent write-up along with some pro analysis at the Wordfence Blog.