Security Advisor

SharePoint Data Could Be At Risk, Says Researcher

SharePoint data might not be in compliance. Plus: Microsoft in process of tightening Xbox Live security; why you need to remind users not to seek out videos of Osama's body.

• By Jabulani Leffall
• 05/02/2011

SharePoint is apparently in the crosshairs of potentially nefarious attackers, according to security expert Randy Franklin Smith.

Smith, who runs the Ultimate Windows Security Web Site, said in particular that enterprise users need to be careful about sharing sensitive data online via Sharepoint. It's not just because of the risk. There's also the confusion around version control, or who's viewed, edited or downloaded a SharePoint-shared document. At issue are two specific versions of SharePoint, Windows SharePoint Services 3.0 and SharePoint Foundation. Smith called the audit function in those two versions "basically unusable."

According to a recent Ultimate Windows Security survey, 76.3 percent of respondents said they keep a general Windows audit log to check suspicious access or activities on an OS and its related applications. Only 36.8 percent keep a unique SharePoint audit log, while 46.1 percent don't do it at all.

Currently the only way to check who's doing what on SharePoint Services 3.0 and SharePoint Foundation is for an admin to create a SharePoint object model API. It's worth noting, especially if you're an enterprises who plans on adopting SharePoint.

Xbox Security Tightened in Wake of Sony Hack
What happened to Sony's online system is scary, so Microsoft isn't wasting any time fortifying its own gaming system's live play architecture. In this post, Redmond said that online gamers "may receive potential phishing attempts via title specific messaging while playing Modern Warfare 2."

It's already happening of course. One example comes from this CNBC video. The report doesn't offer up the exact details, but does explain how one kid playing an Xbox Live console was duped into just signing up and providing a password on a site given by a hacker. That simple act exposed credit card data via the console.

Osama's Body: The Video
Would you like to see the video of SEAL Team Six members jumping daringly from a helicopter into Osama Bin Laden's compound during the historic raid announced by President Obama late Sunday night? You do? Well click here.

Shame on you. We saved you the trouble by not taking you to the link that spammers and cyber criminals have been using to unleash a terror war on your systems. That hackers jumped on the Osama Bin Laden information bonanza less than five hours after Obama announced the raid shows that hackers are jumping at any chance to have their malware go viral, so to speak.

As admins, your job is to prevent users from even using work time to check out news or anything not related to their jobs. Barring that (users are sneaky), you then have to constantly remind users to beware of links claiming to come from trusted news sources, via unsolicited e-mails, through news searches on search engines, from wherever. Hackers are using their own form of black ops, hiding bad code in highly ranked search results garnered from highly sophisticated tweeking of search engine optimization tools.

In plain English: tell users that news links showing video of the body just aren't real.