Various ESET products suffer from a malformed archive bypass vulnerability. The parsing engine supports the ZIP archive format. The parsing engine can be bypassed by specifically manipulating an ZIP Archive Compression Information Field so that it can be accessed by an end-user but not the Anti-Virus software. The AV engine is unable to scan the container and gives the file a "clean" rating.

The parsing engine for various Bitdefender products supports the RAR archive format. The parsing engine can be bypassed by specifically manipulating an RAR Archive (HOST_OS) so that it can be accessed by an end-user but not the anti-virus software. The AV engine is unable to scan the archive and issues the file a "clean" rating.

The Bitdefender parsing engine supports the RAR archive format. The parsing engine can be bypassed by specifically manipulating an RAR Archive (Compressed Size) so that it can be accessed by an end-user but not the Anti-Virus software. The AV engine is unable to scan the archive and issues the file a "clean" rating. All Bitdefender Products and Vendors that have licensed the Engine before Dec 12, 2019 are affected.

The Bitdefender parsing engine supports the RAR archive format. The parsing engine can be bypassed by specifically manipulating an RAR Archive (RAR Compression Information) so that it can be accessed by an end-user but not the Anti-Virus software. The AV engine is unable to scan the archive and issues the file a "clean" rating. All Bitdefender Products and Vendors that have licensed the Engine before Dec 12, 2019 are affected.

The ESET parsing engine can be bypassed by specifically manipulating a ZIP Archive Compression Information Field so that it can be accessed by an end-user but not the Anti-Virus software. The AV engine is unable to scan the container and gives the file a "clean" rating.

The Kaspersky parsing engine supports the ZIP archive format. The parsing engine can be bypassed by specifically manipulating an ZIP Archive (File Name length Field) so that it can be accessed by an end-user but not the Anti-Virus software. The AV engine is unable to scan the container and gives the file a "clean" rating.

The Bitdefender parsing engine supports the GZIP archive format. The parsing engine can be bypassed by specifically manipulating a GZIP Archive (Compression Method) so that it can be accessed by an end-user but not the Anti-Virus software. The AV engine is unable to scan the archive and issues the file a "clean" rating.

The QuickHeal parsing engine supports the ZIP archive format. The parsing engine can be bypassed by specifically manipulating an ZIP Archive (GPFLAG) so that it can be accessed by an end-user but not the Anti-Virus software. The AV engine is unable to scan the archive and issues the file a "clean" rating.

An issue exists where a malformed iMessage can brick an iPhone. A method in IMCore can throw an NSException due to a malformed message containing a property with key IMExtensionPayloadLocalizedDescriptionTextKey with a value that is not a NSString.

Government minister Safia Boly outlines efforts to foster entrepreneurship

4

In Week 1 of National Cybersecurity Awareness Month (NCSAM) we looked at spoofed emails, cybercriminals' preferred method of spreading malware. Today, in an effort to provide you with the best information out there to keep you safe online, we're hitting you with a double dose of cybersafety news.

Let's take look at the topics for Week 2 and 3 of National Cybersecurity Awareness Month: malware and password security. They're separate but related issues in the world of Internet crime prevention, and a better understanding of each is key to protecting your property and personal information in today's digital world.

Malware

Malware is an umbrella term used to describe software that is intended to damage or disable computers and computer systems. If you'd like, you can take a moment and watch this video on malware from Norton Security. But the best way to begin protecting yourself against this stuff is to learn about all the different types of malware that can affect your computer. There are tons, so we'll just go over the broader categories for now.

Viruses: Malicious bits of code that replicate by copying themselves to another program, computer boot sector, or document and change how a computer works. Viruses are typically attached to an executable file or program and spread once a user opens that file and executes it.

Worms: They're like viruses, but are different in terms of the way they're spread. Worms typically exploit a vulnerability or a weakness that allows an attacker to reduce a system's information assurance. Missed that last Windows update? You might be more vulnerable to worms.

Trojans: These look like legitimate pieces of software and are activated after a user executes them. Unlike a virus or a worm, a trojan does not replicate a copy of itself. Instead, it lurks silently in the background, compromising users' sensitive personal data.

Ransomware: This refers to a type of malware that prevents or limits users from accessing their system, either by locking the system's screen or by locking or threatening to erase the users' files unless a ransom is paid. You may recall the WannaCry attack that affected users across the globe this summer, only to be thwarted by the accidental discovery of a "kill switch" that saved people from the malicious software.

Spyware: This malware collects your personal information (such as credit card numbers) and often passes this information along to third parties online without you knowing.

You can check out more descriptions and examples of the types of malware that exist today at MalwareFox, a malware detection and removal software program.

Tips for Protecting Yourself Against Malware

Staying malware-free doesn't require an engineering degree. You can greatly reduce, if not completely eliminate, your chances of falling victim to malware by following these easy tips.

• Keep your operating system current.
• Keep your software up to date, particularly the software you use to browse the Internet.
• Install antivirus and security software and schedule weekly scans. At TechSoup, we're protected by Symantec Endpoint Protection. At home, there are dozens of solutions you can use to protect yourself (PCMag lists many here).
• Mind where you click. Think twice before you download torrent videos or free Microsoft Office templates from some random website.
• Avoid public, nonpassword, nonencrypted Wi-Fi connections when you can. Use a VPN when you cannot.

Spread the Word

Let people know that TechSoup is helping you become more #CyberAware by sharing a message on your social media channels. If you tag @TechSoup on Twitter, we'll retweet the first two tweets. Remember, we're all in this together.

Password Security

Now that we've covered the nasty stuff that can make your life miserable if it ends up on your computer, let's go over some password security tips to help prevent malware from getting there in the first place. Using best practices when it comes to protecting your passwords is a proven way to protect your personal and financial information. Curious how knowledgeable you already are? Watch this video and take this quiz to enter a drawing for a $25 Amazon gift card!

First, let's go over some facts.

• Passwords are the first line of defense to protect your personal and financial information.
• A weak password can allow viruses to gain access to your computer and spread through TechSoup's or your family's network.
• It's estimated that 73 percent of users have the same password for multiple sites and 33 percent use the same password every time. (Source: Digicert, May 2014)
• Despite a small sample size of 1,110 U.S. adults, a recent YouGov survey still found that 28 percent of adults use the same passwords for most of their online accounts. (Source: Business Insider, October 2017).

Best Practices for Effective Password Protection

One great way to better protect yourself is by opting for a passphrase, which is much more difficult to crack than a single-word password. Here are some guidelines to creating one.

• Pick a famous quote or saying and use the first letter of each word.
• Add a number that you can remember.
• Capitalize one letter.
• Make it unique by adding the first letter of your company's name to the beginning or end of the passphrase.
• Make it between 16 and 24 characters.

You should never write your password down, but if you must, never store user IDs and passwords together. Finally — even though it might seem unwieldy — you should always use a different password for each site that requires one. In today's world, everything is connected. A savvy hacker can easily breach your bank account, email, and medical records in one fell swoop if you're using the same password for all three.

Additional Cybersecurity Resources

In case you missed it, take a look at last week's post on recognizing suspicious emails.

Need a little inspiration? Find out how TechSoup and Symantec are making a difference in the lives of at-risk teens.

Get more security tips from the National Cyber Security Alliance. National Cyber Security Alliance Month — observed every October — was created as a collaborative effort between government and industry to ensure that all Americans have the resources they need to stay safer and more secure online. Find out how you can get involved.

spanhidden

Poor infrastructure and political instability deter tourism, but small and manageable steps to avoid chaos and promote hospitality can work wonders.

Siemens Gamesa Renewable Energy (SGRE) said that is has begun operation of its electric thermal energy storage system (ETES), a milestone in the development of energy storage solutions, according to the company.

The Clean Power Alliance (CPA) has signed three long-term power purchase agreements, including two new solar projects and one existing small hydro project.

Missouri’s smallest investor-owned utility is charting a dramatically different course two years after being acquired by new owners.

Last week, Corvias announced that it had entered the final phase of its geothermal installation and energy upgrades effort at the U.S. Army’s Fort Polk in West-Central Louisiana, a milestone that once complete will not only modernize the aging infrastructure but save the Army significant money and benefit military families.

South Australian energy storage company 1414 Degrees and Stone & Wood Brewing Company have agreed to undertake a feasibility study for the integration of 1414 Degrees’ electrically charged Thermal Energy Storage System (TESS-IND).

The U.K. could be producing electricity from a geothermal plant for the first time early next decade after drilling at a site in southwest England showed it could become a viable part of the renewable energy mix.

In late February, Hawaiian Electric Companies announced that they have achieved a consolidated 27 percent renewable portfolio standard in 2018, even with the loss of Hawaii Island’s geothermal resource for most of the year following the Kilauea volcanic eruption. Hawaii has a goal of reaching 100 percent renewable energy by 2045.

BlackRock Inc., the world’s largest money manager, is boosting its bet on clean energy.

The Clean Power Alliance (CPA) has signed three long-term power purchase agreements, including two new solar projects and one existing small hydro project.

Missouri’s smallest investor-owned utility is charting a dramatically different course two years after being acquired by new owners.

Utilities are a natural partner for the geothermal heat pump (GHP) industry. Why? Because utilities have a broad consumer base and infrastructure, and need to both build load (sales) and levelize that demand to make the most efficient use of their electrical generation capacity throughout the year.  GHPs are a technology that fills that niche.

It’s been a whirlwind year for Packetized Energy, the Vermont-based clean energy sector start-up spun off from a U.S. Department of Energy project in 2016 by three University of Vermont electrical engineering faculty, Paul Hines, Mads Almassalkhi and Jeff Frolik.

Italy’s Five Star Movement used to rave about towns like Montieri, a village in the verdant Tuscan foothills that burns little coal or natural gas. Instead, the local power plant harnesses steam rising naturally from hot springs deep underground to generate electricity.

Italy’s government is dragging its feet on incentives for geothermal power and one local politician has decided to take his protest to the extreme.

This week the University of Nevada, Reno announced two discoveries in the Great Basin by the Nevada Bureau of Mines and Geology using a previously untried method for finding unknown, hidden geothermal resources.

Reykjavik Geothermal, a power developer backed by hedge fund billionaire Paul Tudor Jones II, is about to kick off a $4.4 billion project to bring geothermal energy to Ethiopia.

Missouri’s smallest investor-owned utility is charting a dramatically different course two years after being acquired by new owners.

Last week, Corvias announced that it had entered the final phase of its geothermal installation and energy upgrades effort at the U.S. Army’s Fort Polk in West-Central Louisiana, a milestone that once complete will not only modernize the aging infrastructure but save the Army significant money and benefit military families.

The latest news on global small hydroelectric facilities from November-December 2014

New power-generating units at Kenya’s Olkaria I plant are saving East Africa’s biggest economy about 2.2 billion shillings ($24 million) a month on fuel costs, according to the country’s biggest electricity producer.

Power to Sardauna, Taraba, Nigeria has increased with the Aug. 14 commissioning of the 400-kW Tunga hydroelectric project on the Donga River.  

Changes to the United Kingdom's Feed-In Tariff program could have a negative impact on a number of generation sectors -- including small hydroelectric power -- according to a number of industry groups.