The independent test lab AV-Test has issued certifications for antivirus products operating on Windows 7.

The results were based on tests conducted during April, May and June of this year, and therefore do not show results for the new versions just appearing from all the vendors (such as our just-published review of Kaspersky Internet Security 2011), but I would expect the results to be pretty similar. Tests on Windows XP and Vista are promised for a later date.

AV-Test scores in 3 categories: Protection, Repair and Usability. Each has a score from 0 to 6.0 in increments of 0.5. To achieve certification, a product needed a combined score of 12 or more. 13 of the 17 products were certified.

Apple has issued QuickTime version 7.6.7 for Windows to fix a vulnerability in that product. The Mac version of QuickTime is not affected.

The vulnerability is a stack overflow in QuickTime's error logging. As a result, viewing a malicious movie file can lead to unexpected application termination or arbitrary code execution.

Researchers at (my alma mater, '83) the University of Pennsylvania have published a paper describing techniques to recover key patterns, such as unlock codes, from smartphone touch screens.

The research was performed on HTC phones running Google's Android and focused, for good reason, on Android unlock codes. Android phones can be configured to require the user to enter a patterned unlock code after the phone sleeps. The user sees a 3 by 3 grid of dots and drags a finger between dots, touching at least 4 of them.

The general idea of the attack is that if you can take a photograph of the phone's screen, then you enhance the image in software to reveal smudge patterns which show the locations on the screen the user touched and dragged his finger in the code..

I happen to use an Android phone myself so I tried their techniques. There's something to it, but dragging one's finger is not the usual method on Android. Usually you touch spots on the screen and it looked to me as if the smudges from these touches obscured the smudges from the finger swipes. So unless the user unlocked their phone and then did nothing with it (or just used the hard keyboard, which the HTC doesn't have but my Motorola Droid does), the swipe pattern is probably obscured. They don't claim the attack to be perfect, I'm just skeptical that it will be successful often enough.

The authors volunteer the other big problem with the technique: Android 2.2, which is being rolled out to Android users as we speak, allows alphanumeric PINs as well as the "schmear" method

Bruce Schneier was reminded of a different attack in which hard keypads became more crackable because a few of the keys had their markings worn off by use.

Apple has released iOS versions 4.0.2 and 3.2.2 to fix the vulnerabilities which made the jailbreakme.com exploits possible. The updates are available for the iPhone, iPad and iPod Touch.

The first error is a stack buffer overflow in the FreeType, the code which handles PDF files, in the handling of CFF opcodes. The result of an exploit is running arbitrary code. The second error is an integer overflow in the handling of IOSurface properties which allows privilege elevation from user to system privileges. The result of the two attacks combined is a PDF file which grants the attacker complete control over the system.

Apple's history of patch development doesn't often show examples of fixes this quickly. Clearly they can do it when they need to.

Adobe has released a series of updates to Flash, AIR and the ColdFusion and Flash Media Server products.

The Flash and AIR updates affect all platforms: Windows, Mac and Linux. The Flash update addresses 5 remote code execution bugs and one clickjacking bug. The new version of Flash Player is 10.1.82.76 and the new AIR version is 2.0.3. Users of older versions are vulnerable and should upgrade. You can update Flash at the Flash Player Download Center and AIR at the AIR Download Center. There is a patch for Flash 9, but moving to Flash 10 is much better from a security standpoint.

The ColdFusion vulnerability is a directory traversal bug which could result in information disclosure. All 8.x and 9.x versions are affected. The fix is actually a hotfix which is applied by extracting files to specific locations.

The Flash Media Server update affects 4 vulnerabilities. 3 denial of service and 1 remote code execution. The new fixed versions are 3.0.6 and 3.5.4.

Adobe will be releasing updates to Reader and Acrobat next week.

Microsoft released a record 14 security bulletins today, 8 of them with a maximum rating of Critical, fixing a record-tying total 34 vulnerabilities. One of the updates addresses a vulnerability report that was released by third parties several days ago. Another addresses a vulnerability disclosed long ago.

Have you seen these people?

They are all wanted by the authorities somewhere in the world for computer crimes. The woman pictured is Laura Vanessa Brown, 39, born in Glen Cove, New York. She's wanted in Georgia (the US Georgia, not the one in Eastern Europe) for "COMPUTER AND INFORMATION TECHNOLOGY CRIMES, DRUGS RELATED CRIMES."

There are 40 such wanted notices for citizens of Belarus, the UK, New Zealand, Angola, China, Russia, Albania, Korea, Liechtenstein, even Fiji.

If you have seen any of these people, click on their link and you can report them to Interpol.

The Microsoft Malware Protection Center has identified a clever new malware obfuscation technique which they have observed circulating on 4chan message boards.

The malware is distributed as a PNG graphic file. The image itself (see one variant nearby and click it for a larger version) contains instructions to the user to open it in Paint and save it with a .HTA extension.

This makes it a HTML application, a browser-based program that can be run from the command line. Dump the file out, as they did in the Microsoft article linked to above, and you'll see that there's JavaScript at the end of it. The HTA parser bypasses all the graphic data at the beginning and runs the script at the end. This particular script repackages itself and reposts it to 4chan, defeating the CAPTCHA.

The important point to take away from this is that HTA files are programs, just like EXEs and can do dangerous things.

Microsoft detects the threat as Trojan:JS/Chafpin.gen!A.

A group of researchers from Stanford University and Carnegie-Mellon University has published a paper which analyzes the current approach to private web browsing and offers some suggestions.

In version 4.0 of Firefox, currently in beta 2 with beta 3 due this week, Mozilla is planning to change the update system so that minor updates will be applied silently and automatically by default. Major version updates (such as 4.1) will present a user confirmation dialog and users can make a configuration change to require this confirmation for minor updates (such as 4.1.1) as well.