Nerd News: Adobe CEO "Answering" Questions about Pricing from Australian Parliament

To me this certainly seems like the CEO of Adobe,  is evading the question about price gouging, in his response to Australian Parliament.

Via http://www.dailytech.com/Update+Adobe+CEO+Dodges+Questions+on+Overpricing+in+Australia/article29902.htm

In case you missed it, yesterday was Microsoft Patch Tuesday

Brian Krebs has excellent review of Microsoft's Patch Tuesday http://krebsonsecurity.com/2013/02/microsoft-adobe-release-critical-security-updates/

He also covers Adobe patches for Flash Player, AIR and Shockwave.

Nerd News: Apple, Microsoft and Adobe to face Australian parliament about pricing

Source & full story at http://www.bbc.co.uk/news/business-21406745# snippet:

The firms have previously made written submissions to the committee but have so far declined to appear in person.

They are now scheduled to appear before the committee on 22 March.

The Australian newspaper quoted Ed Husic, a member of parliament, as saying that according to some estimates the price of some of goods in Australia were as much as 60% higher than in the US

Security & Hacking: Adobe & Microsoft Update Patches

http://krebsonsecurity.com/2013/01/adobe-microsoft-ship-critical-security-updates/

http://www.livehacking.com/2013/01/09/in-brief-adobe-fixes-at-least-26-security-problems-in-adobe-acrobat-and-adobe-reader/

Short Version:  Make sure your Updated & Patched!

Also, use Firefox with Noscript (Addblockplus as well is good idea, you can Whitelist ie allow sites you want to support or trust) or Chrome, (again with Addblockplus) Chrome has functionality that is similar to Noscript!

Stop using IE unless your forced to, if your forced to use IE set updates to auto AND check updates second Wednesday (Microsoft issues patches every second Tuesday, but checking Wednesday you generally avoid checking to early in the day, and also usually have bit faster download speeds).

Windows & Adobe Patch Recap: Microsoft patches Windows & Office problems; Adobe Flash Update

In case you missed my post before Microsoft's Tuesday, Brian Krebb's post http://krebsonsecurity.com/2012/10/microsoft-patches-windows-office-flaws/ covers all the important aspects, and he mentions the Adobe Flash update as well.

Adobe patch, make sure you get it.

Both Brian Krebs http://krebsonsecurity.com/2012/10/critical-adobe-flash-player-update-nixes-25-flaws/ and Sophos http://nakedsecurity.sophos.com/2012/10/09/adobe-security-update/ cover this latest patch/update.

Security & Hacking: Windows 8 Internet Explorer 10 has vulnerable Flash unpatchable via Adobe

Story at http://arstechnica.com/information-technology/2012/09/internet-explorer-10s-bundled-flash-leaves-users-exploitable/

User can't patch via Adobe, have to wait till Microsoft pushes update from what I understand.

Is it just me, or do some of these company's seem to forget lessons about security they have already learned?

PSA: XSS bug in Adobe Flash controlled users' Web accounts

Full story at Ars, but this is the part that got my attention:

Most XSS vulnerabilities are the result of coding errors on a specific website. A universal XSS, by contrast, stems from bugs present in browsers or plugins and can be exploited as they access multiple sites. Besides its zero-day status as a vulnerability—meaning it was fixed only after it was under attack—the Flash bug is noteworthy because it affects software that is installed on a majority of the world's computers. What's more, universal XSS vulnerabilities typically give an attacker the ability to run custom-written JavaScript in a victim's browser that can steal authentication cookies used to log into private accounts and take similar actions, such as send spam or messages to all addresses contained in an address book.

Security bulletin from Adobe https://www.adobe.com/support/security/bulletins/apsb12-03.html, "Adobe categorizes these as critical updates and recommends users update their installations to the newest versions."


So you might want to make sure your up to date, if you don't do that automatically. 

Personally I like to manually check upgrades on a weekly basis, more to make sure I think about security.  It helps me make thinking about security risks a habit.