Saturday, June 19, 2010

Beyond SecBrowsing with Secunia

I've tested Secunia PSI, a free vulnerable software manager. I recommend it.

What is Secunia
It extends beyond SecBrowsing's checks for out-of-date browser plugins, and identifies known vulnerabilities in software such as media players, office, IM, Skype, and other  applications that don't run in your browser.

Why
Malicious attachments, sent over email or IM, can attack your applications. Vulnerabilities in internet-connected apps such as IM clients or Skype may allow attackers to install malware on your machine without any interaction. You really don't want to run applications with known security holes on your machine.

A review
Last week I had the chance to try it out on a PC. It took a while to scan the machine (see say about 5 minutes) but it identified various software that were unpatched, such as OpenOffice, Skype and VLC. In an ideal world, Secunia would also update this software for me. Or Windows! Anyway, it looks like something is in the works already for this.

I was glad (and kind of surprised actually) to see that as soon as I was able to update a certain application, secunia picked it up immediately and even notified me that it was now up-to-date. On the downside, it took me a lot of time and effort to update all the software.

Take OpenOffice, for example. Secunia says it's unpatched, what next? Start -> Programs -> OpenOffice ... I see apps like Writer, Spreadsheets, but no "updater" or anything. I took an educated guess and opened one of the applications (Writer). Help -> Check for Updates ... yes, that's it. 20 minutes later or so it has downloaded and installed the new version. Why so slow!

In any case, Secunia also has links to their forum, I'm sure they explain how to update your applications. Or maybe you can Google it. Auto-update sure sounds exciting.

I installed Secunia on my brother's machine, hoping he will act upon the warnings. I told my father to install it too, but I really really doubt he can act upon the warnings. It all boils down to automatic, silent updates. This should be the responsibility of the Operating System (Ubuntu, Android, iPhone OS all do this, to a certain degree), but not OS X or Windows, which makes third-party apps such as Secunia essential.

So Windows users, try out Secunia.