Htmldb_util.create_user needs ADMIN privs - Security risk?

Hi,
I have an application from which a "super-user" can create end users of the app. I'm using htmldb_util.create_user to create the end users, but the super-user needs ADMIN privs on the workspace to invoke this procedure. This means that potentially, the super-user could log into the workspace development environment and mess around the app design, sql workshop, etc.
Have I missed something, or is this a genuine risk? Is there a way around this?
Thanks
Andrew.

Hello,
i've got the same problem. But how can i prevent the user from logging in and change the running state of the application?
Regards
Daniel

Similar Messages

Firefox deleted a program and I need it back - where can I see a list of programs Firefox deemed a security risk?

Firefox reported a program as security risk and I hurriedly deleted. It is not a virus it is a very important program I need o work. How can I retrieve this program?

you're probably referring to the deactivation of the java plugin - go to [java.com] and download the latest version that has the security vulnerabilities already fixed.
also see [[Unblocking the Java plugin]]

I currently use CS Photoshop 5.1 on Mac. I have just upgraded to Yosemite 10.1.0. In order to run CS Photoshop 5.1 I need to downgrade to Java 6. Is this safe, or will I become exposed to security risks?

I currently use CS Photoshop 5.1 on Mac. I have just upgraded to Yosemite 10.1.0. In order to run CS Photoshop 5.1 I need to downgrade to Java 6. Is this safe, or will I become exposed to security risks?

Photoshop does not use any external java it has it own "ScriptingSupport" plug-in, Some thitd Party plug-in and perhaps Adobe installer may use an external Java. I don't use a Mac, The latest Java I have on Windows is version 8 there are security issues in prior versions.

Create Multiple Developer logins with htmldb_util.create_user

Need some help in creating about 100 user ID's..
Using the htmldb_util.create_user process to do it and I keep getting an error about requiring ADMIN privs..
Code looks like -
DECLARE
V_USER_ID varchar2(30);
CURSOR names IS
select upper(contact_last_name) || upper(substr(contact_first_name, 1, 1)) as USER_ID
from contact
where contact_first_name is not null;
BEGIN
OPEN names;
LOOP
wwv_flow_api.set_credentials(p_company => 'default',
p_username => 'RNASSER',
p_password => 'XXX');
FETCH names into V_USER_ID;
htmldb_util.create_user(p_user_name => V_USER_ID,
p_web_password => 'XXX',
p_web_password_format => 'HEX_ENCODED_DIGEST');
EXIT WHEN names%NOTFOUND;
END LOOP;
CLOSE names;
END;
Can anyone fill me in on what I am missing here? The admin error happens at the call to the create_user, and I am an ADMIN for the application.
Thanks
Rob

Sorry, in addition to my above statement:
Here's my main conflict. From the HTMLDB_UTIL package, it says this:
PROCEDURE create_user (
-- Description:
-- This procedure allows for programatic and bulk creation of users.
-- Example:
-- From sqlplus logged in as a schema assigned to the target workspace
-- begin
-- for i in 1..10 loop
-- htmldb_util.create_user(
-- p_user_name => 'USER_'||i,
-- p_email_address => 'user_'||i||'@myworkspace.com',
-- p_web_password => 'user_'||i) ;
-- end loop;
-- commit;
-- end;
-- /So it appears this can be called outside the APEX environment. But you cannot simply call this statement outside of APEX, or you'll first get an Unauthorized Access Error. Calling wwv_flow_api.set_credentials() before the loop above will get you past the Unauthorized Access exception, but you will hit User requires Admin privs. (Even if you use the credentials of a workspace administrator).
Hope that helps in explaining how I've arrived at this point.
(APEX 2.0, Oracle 10g)
Chris

Windows 8.1 Security Risk / Not able to log off a user

Hello Community,
First and foremost good morning, I hope everyone is having a good morning. I'm in dire need of a solution. The company I work for has four (4) standalone computers with Windows 8.1
which are located in a break room for, you guessed it, breaks! They are not on the domain but are on a workgroup. A former user from the company has one of these machines completely locked up. Here's what I mean:
When a user sits down at one of these computers they click on the account Breakroom1, Breakroom2, etc....up to 4 which lets them login. However, somehow a user has logged in with
an outlook account and there is absolutely no way for me to log this person out. I can't right click anywhere and get a logoff button. I can't right click on the red circle and get an option to log this person out. The only options I get
are restart, sleep, and shutdown. I've browsed through setup to see if there were any options to kick this person off. I'm completely stumped. I believe this to be a security risk because no one has been able to do anything about this.
I'm trying veryhard not to reimage this machine.
If anyone has any ideas I will gladly try them out and I thank everyone in advance for their time.
Respectfully,

Hi Ricky ,
“somehow a user has logged in with an outlook account and there is absolutely no way for me to log this person out.”
Do you mean someone connect the Microsoft account with the local account and then the machine is locked now. You can`t get into the machine unless you know the Microsoft account`s password, right?
To solve this problem ,I am afraid you have to contact the Microsoft account`s owner firstly to unlock the account. To avoid this tiresome issue in the future, I recommend you take the following steps:
1.Log on the computer as an administrator
2.Run the gpedit.msc and look for the following group policy and set “Users can`t add or log on with Microsoft accounts”,
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Block Microsoft accounts
3.Run gpupdate /force
4.I recommend you take this solution to the others` pcs in the Breakrooms .
Best regards

Can not open multiple excel 2003 and excel 2007 files in excel 2010 - message says they may be a security risk and wants to do a scan

We use about 20 excel files to build a consolidated financial statement for our company. Some of the files were built when the computers were running 2003 and some when we had 2007. We are being upgraded to Windows 7 with Office 2010. In
2007, we would simply highlight all the files in a folder, right click, and open. Once they had all refreshed for new data, we would close them all. Now with Excel 2010, we've highlighted all the files, but when we right click, we get a message
that says some files may present an internet security risk. Then it ask if we want to open anyway. If we say yes, we get a box that asks us to scan the files. We've done a scan, but at the end it still doesn't open the files. If we
say no, it does nothing. Either way, we're not getting the files open except to open them 1 by 1. We're not sure how to get rid of this...any suggestions?

In Excel 2010 setting those documents as trusted documents, or adding the folder containing as a trusted location may do the trick for you. There's a full description of what it does here
http://blogs.technet.com/b/office2010/archive/2009/09/28/trusted-documents.aspx but if you go into File, Options, Trust Center, Trust Center Settings..., and then Trusted Locations, you'll see the list of currently configured file paths that are considered
trusted on your machine.
At the bottom of that window you can check the option to allow trusted locations on the network (so you can trust the files that I assume are stored on a network location) and then add the location of those files to the list.
Note, this setting is done per machine profile, so if it does the trick for you then each person needing these files would need to do this. Also, keep in mind that by doing this you're removing some of the protections added into Excel, so you should only
go adding locations you know you can trust (not just the root of a network path where anyone and everyone might go saving spreadsheets they've downloaded form the internet).

Web form and database security risk

I'd like to develop an Oracle Form or APEX Form where people don't have to login to use it. Like a registration form on our website, where anyone can fill it out. Ideally, the information entered into the form would be saved to an Oracle table (could use a flat file if database security is an issue). I'm a developer and don't know a lot about the security side.
I'm thinking we would need a static IP address and an Oracle public password that doesn't expire, since the public doesn't have to login to use the form.
Is this possible and is it a database or network security risk ?

An APEX page can certainly be configured to not require authentication (that's pretty standard for the login/ registration page). There is no need for an "Oracle public password." There are accounts in the Oracle database that APEX uses but that no human needs to know the password for. If that's what you mean by "Oracle public password" then, yes, you do. But that would be the case no matter what authentication and authorization scheme you use in APEX.
A static IP address for your web server is likely a good idea. It's possible to have DNS work with dynamic IP addresses but that's probably not what you want.
Justin

Does an mac air need any internet/security protection from viruses etc. ?

I was wondering does the mac need any interent security such as kaspersky or norton installed for protection? or is there already protection from viruses etc on the software installed? Thanks

1. This is a comment on what you should—and should not—do to protect yourself from malicious software ("malware") that circulates on the Internet and gets onto a computer as an unintended consequence of the user's actions. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the computer, or who has been able to log in to it remotely. That threat is in a different category, and there's no easy way to defend against it.
If you find this comment too long or too technical, read only sections 5, 6, and 10.
OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.
2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user. Internally Apple calls it "XProtect."
The malware recognition database used by XProtect is automatically updated; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
The following caveats apply to XProtect:
It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
As new versions of OS X are released, it's not clear whether Apple will indefinitely continue to maintain the XProtect database of older versions such as 10.6. The security of obsolete system versions may eventually be degraded. Security updates to the code of obsolete systems will stop being released at some point, and that may leave them open to other kinds of attack besides malware. 3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't necessarily been tested by Apple, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.) Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:
It can easily be disabled or overridden by the user.
A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.
4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.
5. The built-in security features of OS X reduce the risk of malware attack, but they are not, and never will be, complete protection. Malware is a problem of human behavior, and a technological fix is not going to solve it. Trusting software to protect you will only make you more vulnerable. The best defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "Trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and the scam artists. If you're smarter than they think you are, you'll win. That means, in practice, that you always stay within a safe harbor of computing practices. How do you know when you're leaving the safe harbor? Below are some warning signs of danger.
Software from an untrustworthy source
Software of any kind is distributed via BitTorrent. or Usenet, or on a website that also distributes pirated music or movies.
Software with a corporate brand, such as Adobe Flash Player, doesn't come directly from the developer’s website. Do not trust an alert from any website to update Flash, your browser, or anything else.
Rogue websites such as Softonic and CNET Download distribute free applications that have been packaged in a superfluous "installer."
The software is advertised by means of spam or intrusive web ads. Any ad, on any site, that includes a direct link to a download should be ignored.
Software that is plainly illegal or does something illegal
High-priced commercial software such as Photoshop is "cracked" or "free."
An application helps you to infringe copyright, for instance by circumventing the copy protection on commercial software, or saving streamed media for reuse without permission.
Conditional or unsolicited offers from strangers
A telephone caller or a web page tells you that you have a “virus” and offers to help you remove it. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
A web site offers free content such as video or music, but to use it you must install a “codec,” “plug-in,” "player," "downloader," "extractor," or “certificate” that comes from that same site, or an unknown one.
You win a prize in a contest you never entered.
Someone on a message board such as this one is eager to help you, but only if you download an application of his choosing.
A "FREE WI-FI !!!" network advertises itself in a public place such as an airport, but is not provided by the management.
Anything online that you would expect to pay for is "free."
Unexpected events
You open what you think is a document and get an alert that it's "an application downloaded from the Internet." Click Cancel and delete the file. Even if you don't get the alert, you should still delete any file that isn't what you expected it to be.
An application does something you don't expect, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
Software is attached to email that you didn't request, even if it comes (or seems to come) from someone you trust.
Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it—not JavaScript—in your browsers.
Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a lock icon in the address bar with the abbreviation "https" when visiting a secure site.
Stay within the safe harbor, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself.
7. Never install any commercial "anti-virus" (AV) or "Internet security" products for the Mac, as they are all worse than useless. If you need to be able to detect Windows malware in your files, use one of the free security apps in the Mac App Store—nothing else.
Why shouldn't you use commercial AV products?
To recognize malware, the software depends on a database of known threats, which is always at least a day out of date. This technique is a proven failure, as a major AV software vendor has admitted. Most attacks are "zero-day"—that is, previously unknown. Recognition-based AV does not defend against such attacks, and the enterprise IT industry is coming to the realization that traditional AV software is worthless.
Its design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere. In order to meet that nonexistent threat, commercial AV software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
By modifying the operating system, the software may also create weaknesses that could be exploited by malware attackers.
Most importantly, a false sense of security is dangerous.
8. An AV product from the App Store, such as "ClamXav," has the same drawback as the commercial suites of being always out of date, but it does not inject low-level code into the operating system. That doesn't mean it's entirely harmless. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
An AV app is not needed, and cannot be relied upon, for protection against OS X malware. It's useful, if at all, only for detecting Windows malware, and even for that use it's not really effective, because new Windows malware is emerging much faster than OS X malware.
Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else. A malicious attachment in email is usually easy to recognize by the name alone. An actual example:
London Terror Moovie.avi [124 spaces] Checked By Norton Antivirus.exe
You don't need software to tell you that's a Windows trojan. Software may be able to tell you which trojan it is, but who cares? In practice, there's no reason to use recognition software unless an institutional policy requires it. Windows malware is so widespread that you should assume it's in every email attachment until proven otherwise. Nevertheless, ClamXav or a similar product from the App Store may serve a purpose if it satisfies an ill-informed network administrator who says you must run some kind of AV application. It's free and it won't handicap the system.
The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have all the disadvantages mentioned in section 7.
9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.
10. As a Mac user, you don't have to live in fear that your computer may be infected every time you install software, read email, or visit a web page. But neither can you assume that you will always be safe from exploitation, no matter what you do. Navigating the Internet is like walking the streets of a big city. It's as safe or as dangerous as you choose to make it. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices.

Firefox Update Requires Admin Privs, But Does Not Check and Just Displays Misleading Message

Firefox attempts to perform an update from an Non-Admin account, the Update File is downloaded, the update is begun but the following misleading message is displayed...
"unable to install firefox update make sure no firefox applications are open and then try again"
...and the message is displayed each time Firefox is activated.
'''Explanation'''
In order to perform the update, the protected file; ''C:\Program Files\Mozilla Firefox\firefox.exe'' must be opened with exclusive access. This fails because Non-Admin account may not modify files in the ''C:\Program Files\'' folder. (Did Not Fail because it is open by another process)
Performing the Update from the Admin Account executes properly. After Activating in Non-Admin Account, misleading message still displays, Firefox opens and includes "Updated" page showing 14.0.1 have been installed. Deleting the files from: ''C:\Documents and Settings\user_name\Local Settings\Application Data\Mozilla\Firefox\Mozilla Firefox\updates\0'' eliminates problem.
'''These issues need to be addressed by Firefox Development:'''
# Before attempting Update, check for Admin Privs. If not, then just notify Update is available.
# Modify Error Message to reflect true meaning for failure (system can be modified that updates are only possible by specific Admin account rather than Admin Group).
# When applying Update, delete other Update Pending files in other user's Directory Trees.
Will a Firefox Developer Please Respond?

Thanks for the link. I have submitted a Bug Report on Bugzilla. Will post back when there is a response there.
And this is more than "plausible", it is "confirmed" (if you watch MythBusters). There are update log files that clearing show what is happening and why.
The most disturbing thing about this "bug", is that it clearly shows that nearly everyone is performing there "normal" activities (browsing, email, etc.) from an account with Admin privs. This means that when ('''not "if"''') the latest version of an infection gets past your AV shield (they can only block the ones already reported), it has access to every sensitive part of your system. I could give a long explanation of infections with a lot boring details, but just believe this:
'''Never perform "Normal" net activities from an account with Administrator privs.'''

Is the Goto Statement in Debugging a security risk?

Hi,
In debugging ABAP code we have the option to jump to a certain statement via the GOTO STATEMENT from the menu.
Is there any security risk in doing this.
It is now controlled in the 02 Activity of the authorization object, which was formerly only used for changing values with the debugger.

It is often misunderstood as forward and backward navigation instead of stepping in the debugger and always checked actvt 02 - but in earlier releases was not as obvious to find and did not write a system log message. You can now also right-click the location to GOTO.
But it is just as dangerous if not more so that changing a variable in the debugger and more than just display. Reason is that between the current code line and the code line "jumped to", the code in between is not executed at all...
So you can jump over authority-checks instead of having to change the sy-subrc result. Changes can be made without the calls to change documents and logs being made. All other forms of validations or checks can be jumped over, including statements which were created not to be able to debug them (such as kernel calls) then you don't need to be able to change anything in the debugger if you can steer wide of it.
It is functionally equivalent to being able to create a program and execute it, regardless of your other authorizations, developer key or even if the system is closed for changes.
So... very naughty. Only for developers in development systems and even in emergency situations it should not really be used in production either.
Cheers,
Julius

Is Bitdefender safe? If not, what security risks do I run?

Is Bitdefender safe? If not, what security risks do I run?

Mac users often ask whether they should install "anti-virus" (AV) software. The usual answer is "no." That answer is right, but it may give the wrong impression that there is no threat from what are loosely called "viruses." There is a threat, and you need to educate yourself about it.
1. This is a comment on what you should—and should not—do to protect yourself from malicious software ("malware") that circulates on the Internet and gets onto a computer as an unintended consequence of the user's actions.
It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the computer, or who has been able to take control of it remotely. That threat is in a different category, and there's no easy way to defend against it. AV software is not intended to, and does not, defend against such attacks.
The comment is long because the issue is complex. The key points are in sections 5, 6, and 10.
OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.
2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user. Internally Apple calls it "XProtect."
The malware recognition database used by XProtect is automatically updated; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
The following caveats apply to XProtect:
☞ It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
☞ It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
As new versions of OS X are released, it's not clear whether Apple will indefinitely continue to maintain the XProtect database of older versions such as 10.6. The security of obsolete system versions may eventually be degraded. Security updates to the code of obsolete systems will stop being released at some point, and that may leave them open to other kinds of attack besides malware.
3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't been checked for security by Apple unless it comes from the App Store, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.)
Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:
☞ It can easily be disabled or overridden by the user.
☞ A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
☞ An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.
Apple has taken far too long to revoke the codesigning certificates of some known abusers, thereby diluting the value of Gatekeeper and the Developer ID program. Those lapses don't involve App Store products, however.
For the reasons given, App Store products, and—to a lesser extent—other applications recognized by Gatekeeper as signed, are safer than others, but they can't be considered absolutely safe. "Sandboxed" applications may prompt for access to private data, such as your contacts, or for access to the network. Think before granting that access. Sandbox security is based on user input. Never click through any request for authorization without thinking.
4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.
5. The built-in security features of OS X reduce the risk of malware attack, but they are not, and never will be, complete protection. Malware is a problem of human behavior, not machine behavior, and no technological fix alone is going to solve it. Trusting software to protect you will only make you more vulnerable.
The best defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "Trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and Internet criminals. If you're better informed than they think you are, you'll win. That means, in practice, that you always stay within a safe harbor of computing practices. How do you know when you're leaving the safe harbor? Below are some warning signs of danger.
Software from an untrustworthy source
☞ Software with a corporate brand, such as Adobe Flash Player, doesn't come directly from the developer’s website. Do not trust an alert from any website to update Flash, or your browser, or any other software. A genuine alert that Flash is outdated and blocked is shown on this support page. Follow the instructions on the support page in that case. Otherwise, assume that the alert is fake and someone is trying to scam you into installing malware. If you see such alerts on more than one website, ask for instructions.
☞ Software of any kind is distributed via BitTorrent, or Usenet, or on a website that also distributes pirated music or movies.
☞ Rogue websites such as Softonic, Soft32, and CNET Download distribute free applications that have been packaged in a superfluous "installer."
☞ The software is advertised by means of spam or intrusive web ads. Any ad, on any site, that includes a direct link to a download should be ignored.
Software that is plainly illegal or does something illegal
☞ High-priced commercial software such as Photoshop is "cracked" or "free."
☞ An application helps you to infringe copyright, for instance by circumventing the copy protection on commercial software, or saving streamed media for reuse without permission. All "YouTube downloaders" are in this category, though not all are necessarily malicious.
Conditional or unsolicited offers from strangers
☞ A telephone caller or a web page tells you that you have a “virus” and offers to help you remove it. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
☞ A web site offers free content such as video or music, but to use it you must install a “codec,” “plug-in,” "player," "downloader," "extractor," or “certificate” that comes from that same site, or an unknown one.
☞ You win a prize in a contest you never entered.
☞ Someone on a message board such as this one is eager to help you, but only if you download an application of his choosing.
☞ A "FREE WI-FI !!!" network advertises itself in a public place such as an airport, but is not provided by the management.
☞ Anything online that you would expect to pay for is "free."
Unexpected events
☞ A file is downloaded automatically when you visit a web page, with no other action on your part. Delete any such file without opening it.
☞ You open what you think is a document and get an alert that it's "an application downloaded from the Internet." Click Cancel and delete the file. Even if you don't get the alert, you should still delete any file that isn't what you expected it to be.
☞ An application does something you don't expect, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
☞ Software is attached to email that you didn't request, even if it comes (or seems to come) from someone you trust.
I don't say that leaving the safe harbor just once will necessarily result in disaster, but making a habit of it will weaken your defenses against malware attack. Any of the above scenarios should, at the very least, make you uncomfortable.
6. Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.
Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it—not JavaScript—in your browsers.
Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a padlock icon in the address bar when visiting a secure site.
Stay within the safe harbor, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself.
7. Never install any commercial AV or "Internet security" products for the Mac, as they are all worse than useless. If you need to be able to detect Windows malware in your files, use one of the free security apps in the Mac App Store—nothing else.
Why shouldn't you use commercial AV products?
☞ To recognize malware, the software depends on a database of known threats, which is always at least a day out of date. This technique is a proven failure, as a major AV software vendor has admitted. Most attacks are "zero-day"—that is, previously unknown. Recognition-based AV does not defend against such attacks, and the enterprise IT industry is coming to the realization that traditional AV software is worthless.
☞ Its design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere. In order to meet that nonexistent threat, commercial AV software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
☞ By modifying the operating system, the software may also create weaknesses that could be exploited by malware attackers.
☞ Most importantly, a false sense of security is dangerous.
8. An AV product from the App Store, such as "ClamXav," has the same drawback as the commercial suites of being always out of date, but it does not inject low-level code into the operating system. That doesn't mean it's entirely harmless. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
An AV app is not needed, and cannot be relied upon, for protection against OS X malware. It's useful, if at all, only for detecting Windows malware, and even for that use it's not really effective, because new Windows malware is emerging much faster than OS X malware.
Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else. A malicious attachment in email is usually easy to recognize by the name alone. An actual example:
London Terror Moovie.avi [124 spaces] Checked By Norton Antivirus.exe
You don't need software to tell you that's a Windows trojan. Software may be able to tell you which trojan it is, but who cares? In practice, there's no reason to use recognition software unless an organizational policy requires it. Windows malware is so widespread that you should assume it's in every email attachment until proven otherwise. Nevertheless, ClamXav or a similar product from the App Store may serve a purpose if it satisfies an ill-informed network administrator who says you must run some kind of AV application. It's free and it won't handicap the system.
The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have all the disadvantages mentioned in section 7.
9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.
10. As a Mac user, you don't have to live in fear that your computer may be infected every time you install software, read email, or visit a web page. But neither can you assume that you will always be safe from exploitation, no matter what you do. Navigating the Internet is like walking the streets of a big city. It can be as safe or as dangerous as you choose to make it. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices.

Lost Administrator rights..Cant change or edit, because it says I dont have admin priv

Help..
I have been spending days trying to get my administrator privilege back. One day, they just disappeared. I cant download or add software, because of this. I have tried every which way, and just when I think I found out why, it still
comes back no admin priv.
This is really limiting me. Does someone have a remote computer that they could look at this for me? I am not that good using config, unless I am guided. I make mistakes, and lose things!
I have tried all options that I could find on line. no go..
It probably is an easier fix that I think, but I need help now..hate to admit it.
At the moment, I dont have enough money for a service call. When problems happen, they come in threes. Need to get a plumber for clogged drains, and my dryer quit. So, I am hoping there is someone that could help me by remote and fix it.
I could pay something by billpay, but I do not have $200 to have someone come out and look at it.
Thank You for any help you can give me.
Ann
[email protected]

Don't think so, linking another credit card or buying an itunes giftcard are the only solutions..

HP printer software includes old flash player that poses critical security risks

I would like to use the HP Solution Center for a Photosmart C309a printer but the HP software includes an older flash player (Adobe Flash Player 9.0 r115) that poses critical security risks.
HP includes this old flash version at:
C:\Program Files (x86)\HP\Digital Imaging\help\player\FlashPla.exe
Is there a way to update this HP program file to a safe version of Flash Player?
I think this is a generec security issue, but if it helps I run Windows 7 64-bit.

Hello dghdah,
Welcome to the HP Forums, I hope you enjoy your experience! To help you get the most out of the HP Forums I would like to direct your attention to the HP Forums Guide First Time Here? Learn How to Post and More.
I understand you are looking for an updated version of Adobe Flash Player to use with Solution Center. When you install the Solution Center, normally Windows would skip the older version as your OS may have an up to date version. If this is not the case and the older version installed, you would need to update the flash player. Below I have linked you to the Adobe website to complete the update.
Adobe Flash Player Support Center
Best wishes,
R a i n b o w 7000I work on behalf of HP
Click the “Kudos Thumbs Up" at the bottom of this post to say
“Thanks” for helping!
Click “Accept as Solution” if you feel my post solved your issue, it will help others find the solution!

BW Admin and security Notes.

Hi Friends..
i need some informations and materials regarding SAP ADMIN and SECURITY..I searched in our forum..i am not able to Get required material...so if any body have it please post it to <email address removed by moderator>
Thanks in advance,
Regards,
Gowri S N.K.

Hi,
Check these threads on BASIS:
basis info...!
New in SAP Basis
XI Basis Samples
Regards,
Subhasha Ranjan

Portable hard drive no longer requires password to decrypt it - security risk

I have a WD passport for Mac. It was previously encrypted and i would have to enter a password every time I wanted access to the drive - perfect. But then I had to decrypt it and when I had finished I re-encrypted the drive once again by right clicking and selecting encrypt drive. The drive is now encrypted again which is good, but the problem is that when I now plug it into my MBP the files are automatically accessible...the drive doesn't require a password to decrypt it anymore.
This is obviously a security risk so i want to go back to having to provide a password to unlock the drive. I've read some stuff about the password being saved in keychain but not had any luck looking for it and I'm a bit of a novice!
I'm using a 2012 MBP Retina with the latest OS
Can anyone help please?

This procedure is a diagnostic test. It makes no changes to your data.
Please triple-click anywhere in the line below on this page to select it:
{ diskutil list; echo; diskutil cs list; } | pbcopy
Copy the selected text to the Clipboard by pressing the key combination command-C.
Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad and start typing the name.
Paste into the Terminal window by pressing the key combination command-V. I've tested these instructions only with the Safari web browser. If you use another browser, you may have to press the return key after pasting.
Wait for a new line ending in a dollar sign ($) to appear below what you entered.
The output of the command will be automatically copied to the Clipboard. If the command produced no output, the Clipboard will be empty. Paste into a reply to this message.
The Terminal window doesn't show the output. Please don't copy anything from there.
If any personal information appears in the output, anonymize before posting, but don’t remove the context.

Htmldb_util.create_user needs ADMIN privs - Security risk?

Similar Messages

Maybe you are looking for