Link shortening service Bitly late Thursday announced it has suffered a data breach, and urged all users to reset their credentials.  Bitly’s CEO wrote in the blogpost that they have “reasons to believe that Bitly account credentials have been compromised; specifically, users’ email addresses, encrypted passwords, API keys and OAuth tokens”. This is really bad because it is not enough just to reset the password. Each user has actually to change all applications that were using the service using the OAuth tokens. Even if the company assures users that they have no indication at this time that any accounts have been accessed without permission, this is no guarantee. And indeed, Bitly reset Twitter and Facebook connections. Fortunately, they can be restored with just one click. Following are step-by-step instructions to reset your API key and OAuth token: 1) Log in to your account and click on ‘Your Settings,’ then the ‘Advanced’ tab. 2) At the bottom of the ‘Advanced’ tab, select ‘Reset’ next to ‘Legacy API key.’ 3) Copy down your new API key and change it in all applications. These can include social publishers, share buttons and mobile apps. 4) Go to the ‘Profile’ tab and reset your password. 5) Disconnect and reconnect…

It is now a month since the official support from Microsoft has ended for Windows XP. Read here about strategies to move away from it. In the meanwhile, all XP users are getting this message: If you click on the link in the above picture, you see this page where you are kindly explained to move away from Windows XP and take Windows 8:   What happened in a month? Not much… except for one security update for Windows XP and a lot of companies (especially banks) and governments (Google search link) that paid for special support for Windows XP. Yes, despite the fact that the support has been officially stopped, Microsoft was forced to release an out of band patch for Internet Explorer 6-8 for Windows XP.     What’s next ? The honest answer is, we don’t know. But, the events in the past years showed us that there will be many zero-day exploits. It remains to be seen if Microsoft will choose to fix them for XP as well.   If you don’t want to be nervous while Microsoft thinks whether or not to patch the Windows XP, read this article and act accordingly.   Sorin Mustaca IT Security Expert   from Avira…

We wrote about the new Zero-day vulnerability in the Internet Explorer affects all IE Versions from 6 to 11 which is being exploited in limited and targeted attacks. This vulnerability, identified as CVE-2014-1776, could allow remote code execution even if the user doesn’t click on anything. Microsoft kept their promise and fixed the problem in only 5 days after informing the public. Most of the customers have automatic updates enabled and will not need to take any action, but if you want to manually trigger an update, just visit Windows Update. What comes as a surprise is that Microsoft issued the update also for the already beyond End Of Life, Windows XP. Microsoft writes in a blog post: “We have made the decision to issue a security update for Windows XP users. Windows XP is no longer supported by Microsoft, and we continue to encourage customers to migrate to a modern operating system, such as Windows 7 or 8.1. Additionally, customers are encouraged to upgrade to the latest version of Internet Explorer, IE 11.” If you want to get the latest version of Internet Explorer, visit the dedicated page here. Note that for Windows XP you can only install IE up to version 8. IE 9-11 are not…

A new Zero-day vulnerability in the Internet Explorer affects all IE Versions from 6 to 11 and is being exploited in limited and targeted attacks. This vulnerability, identified as CVE-2014-1776 ,could allow remote code execution even if the user doesn’t click on anything. Remote code execution means that attackers could distribute malware via a drive-by installation. The bad news is there is still no patch at the time writing this article. The good news is that the attacks seen in the wild so far seem to have relied on hitting IE 9, 10 and 11, using Adobe Flash as a lever. This doesn’t mean that the older versions are not being hit. It can be that the efforts of the cybercriminals are focused on the masses which have IE 9 and newer.   How can you protect yourself The current exploit can be mitigated by disabling Adobe Flash Player, which is the vehicle used in exploiting the IE flaw. Note that the bug isn’t in Flash, so this is not something Adobe can fix, nor its it Adobe’s fault (as unbelievable as it may seem). Using specially crafted Flash files can help attackers prepare the contents of the memory on your computer in order…

At the beginning of this week a new vulnerability in OpenSSL called Heartbleed was made public. OpenSSL is the library used by most computers to encrypt data sent across the Internet and not only. OpenSSL is perhaps the most widely deployed SSL library and appears in a wide variety of applications, including a number of Linux distributions (see below). The vulnerability has by now a dedicated ID CVE-2014-0160 (see references): essentially it lets an attacker pull the keys used to encrypt your data directly from the memory of a vulnerable web server, thereby letting him read any traffic sent from that server including usernames, passwords, financial information and more. Some technical details The vulnerability lies in the way that OpenSSL handles the heartbeat extension in the TLS protocol. OpenSSL replies a requested amount up to 64kB of random memory content as a reply to a heartbeat request. Sensitive data such as message contents, user credentials, session keys and server private keys have been observed within the reply contents. More memory contents can be acquired by sending more requests. The attacks have not been observed to leave traces in application logs. To make it clear, this vulnerability does not hack the server and it does not extract from…

The Federal Office for Security in Information Technology (BSI) has informed the press (in German) about a new case of identity theft. Also this time a lot of German users are affected, according to the source, more than 3 million email addresses. BSI is working with big telecom providers like Telekom, Freenet, GMX, Kabel Deutschland, Vodafone, Web.de in order to inform their customers that are affected. For those that don’t want to wait for the official email coming from the above mentioned providers, BSI continues to support the website http://bit.ly/1eiR7p7 where any user can check if his email address is affected by this incident. The accounts were discovered as part of a police investigation and BSI assumes that the cybercriminals have used various sources to get access to the login data: infected computers that transmit the data to some servers in the world. There are, however, other possible sources like phishing websites and social engineering schemes. If you are one of the affected users, please take the following actions to make sure that you will no longer be affected: – clean up your computer  using Avira’s PC Cleaner More details about the PC Cleaner can be obtained in this Techblog article: http://bit.ly/1eiR7p9 – Change all your…

Because of the growth of mobile commerce and the need to keep users safe as they increasingly use mobile devices, we are proud to announced today that we significantly upgraded the mobile solutions for iOS and Android.   Avira Mobile Security for iOS The free app gets two new features: Identity Safeguard Avira is the only security vendor to offer iOS users a feature called Identity Safeguard, which ensures an individual’s personal email is not one of the 160 million that have been caught in security breaches in the last 6 months alone. Users can see if their personal identity details have been leaked in any security breaches, and an on demand scanner allows the user to scan their entire address book to detect any compromised contacts. If any contacts have been compromised, users can email any breached contacts directly to alert them about the danger. On average, between 5% and 10% of a typical user’s address book contains email addresses that have been compromised.   Locate Device (up to five iOS and/or Android devices) iOS users get a new feature called Locate Device, which monitors and keeps track of up to five devices. Users can see at any time on…

The Stiftung Warentest just published the results of the test for the Internet security products.   We are happy to announce that Avira Free Antivirus 2014 has received the result GOOD (2..2) and is the winner of the category free antivirus.   Avira Internet Security Suite 2014 has received the result GOOD (2.1)  and reached the second place out of 13 products tested. Both products were praised for – a good usability – a good user manual – good performance (not overloading the computer) – good detection   Sorin Mustaca Product Manager and IT Security Expert   from Avira – TechBlog http://bit.ly/1jYFpVe via IFTTT

Immer mehr soziale Medien, aber auch andere Webseiten, nutzen die Zwei-Faktor-Authentifizierung, um ihre Nutzer besser schützen zu können. Nach allen anderen großen Webseiten macht nun auch Tumblr diesen Schritt.     Befolgen Sie folgende einfache Schritte, um die Aktivierung durchzuführen: Gehen Sie zu Ihren Kontoeinstellungen. Klicken Sie die „Zwei-Faktor-Authentifizierung“ Schaltfläche an. Geben Sie Ihre Telefonnummer ein. Nun können Sie entscheiden, ob Sie den Code als SMS oder über eine Authentifizierungs-App erhalten möchten. Wir empfehlen Ihnen beides, falls Sie eines der beiden als Backup benötigen. Befolgen Sie die Schritte, die auf der Einstellungsseite angezeigt werden. Nach der Aktivierung müssen Sie sich in Zukunft folgendermaßen anmelden: Melden Sie sich mit Ihrem Benutzernamen und Ihrem Passwort bei Ihrem Tumblr Konto an. Geben Sie den Code in das dafür vorgesehene Feld ein, sobald Sie ihn erhalten haben (als SMS oder über eine Authentifizierungs-App). Haben Sie übrigens bemerkt, dass die Webseite standardmäßig nicht SSL verwendet? Bitte klicken Sie die „SSL Sicherheit aktivieren“ Schaltfläche an, um SSL von nun an standardmäßig für Anmeldungen zu aktivieren.   Zwei-Faktor-Authentifizierung bei Anmeldung über iOS oder Android-Apps Wenn Sie die Zwei-Faktor-Authentifizierung aktiviert haben, müssen Sie ein einmaliges Passwort generieren, um sich über Ihre mobilen Apps anmelden zu können. Sie können dies über…