Do you update?

Most people I talk to claim that they are strong believers in updating. They update their operating system, applications that come with the operating system and security software almost religiously.

In turn most of these people are surprised when they hear that they should regularly check for updates to all the software they use. One example is some popular media players – some time ago, vulnerabilities were detected in them which allowed for remote code execution. And now of course we’re seeing the same situation with Microsoft Office.

Over time we have also seen an increased focus on exploiting server-based software. Just think back to Net-Worm.Perl.Santy.a – it caused a major epidemic by exploiting a vulnerability in unpatched phpBB forums. More recently we’ve seen a large number of hackers targeting a vulnerability in IPB forum software. This resulted in a lot of sites being compromised and/ or defaced.

And right now we’re seeing extensive defacements on sites using outdated versions of Joomla and/ or Mambo.

It’s clear if a site has been defaced. It won’t be quite so obvious if a site has been compromised.

Although we’ve been telling people to update regularly for a long, long time, this latest case shows that we can’t say it too often. Once again: it’s of the utmost importance you make sure that all of your software is up to date, both on your local machine and on any remote servers which you administer.