Get rid of vulnerabilities

Sep 30, 2007 18:08 GMT  ·  By

Carrying unpatched software may result in major trouble for the security of your computer and implicitly your data. Keeping all your software up to date is a task that should take place once a month or even sooner.

Software like IE6 and 7, Mozilla Firefox, Flash Player, Java JRE, QuickTime, Adobe Reader, RealPlayer, Yahoo! Messenger or Winamp are constantly sending and receiving information to and from the Internet. Running them unpatched may result in quite a trouble.

Fortunately there are solutions for this and many of them are absolutely free. There are softwares able to detect if you have the latest application versions installed on your computer. More than that, many of them offer download links as well.

However, the major issue with these is that the majority of them detect standalone applications like Foobar2000, Filezilla, DreamMail, CCleaner, Paint.NET and others. Generally they cannot detect if you have the latest version of Flash player or Java Runtime Environment. Or, if this is not an issue, then reliability indeed is.

P2P is a great technology and seems to gain more and more turf lately in detecting the latest software versions installed as well. The procedure is simple: a server collects all the installed software versions from the users of the application and then these are shared with all the users of the community. However, there may be beta testers in the community and in this case some of the returned results are not accurate.

Secunia, the known and reliable website for vulnerability and virus information reporting created Secunia Inspector, a free online tool that scans your computer for outdated software versions. The database is populated with the most common end user applications (web browsers, browser plugins, instant messaging clients, media players, email clients, operating systems). The complete list is available on their website, but I have to say that it is not impressive at all.

In order to run the online app Java JRE is required to be installed on your computer. Other than this (which you probably have already installed) and a good Internet connection to speed things nothing else is needed.

The user's part in handling the online service is simple: just click Start Now button and Secunia will begin checking the insides of your computer for file names, vendor names, product name, file description, software version or revision number and registry uninstall key. Does it sound peachy?

Not to me as once you start the process you consent to Secunia's inspection of your computer and I bet you have not read any agreement or disclaimer stipulating the file formats the Inspector has in sight. I urge you to find this kind of information on Software Inspector's web page.

I don't know about you, but this is a blatant violation of privacy rights. The user is indeed the one pressing the button for starting the online scan but shouldn't there be a disclaimer informing us on the files that are searched and locations that are scanned? At least a small note about customer privacy and protection of personal information.

Personal Software Inspector, the downloadable version of the online scanner, on the other hand comes complete with a License Agreement and a Privacy Statement that provide details on the type of files inspected and inform the user on the fact that all collected information will not be stored on Secunia servers more than one year (but you have the possibility of immediately erasing that with one click by cancelling registration).

By default the online scanner from Secunia will search the default locations (I am sure that newbies know exactly which these are) but you can turn the inspection into a more thorough scouting operation by giving green light to the Inspector to look in non-default locations. Now doesn't this mean snooping in the entire system and perusing all my files, both personal and belonging to the system?

But let's look on the brightside. After scan process is complete the service displays a list of the applications that are (non)conformant to the latest releases of their developers. A brief list, indeed, but at least it covers the most used 30 applications including operating systems and plugins. The complete list of Secunia File Signatures covers email clients (Eudora, Outlook Express 6 and Mozilla Thunderbird), Windows operating systems (XP Pro, XP Home Edition, Vista, Server 2003 Web and Standard editions, 2000 Server and 2000 Professional, Windows Mobile), web browsers (Firefox, IE (6 and 7) and Opera), instant messengers (Yahoo! Messenger, Live Messenger, MSN Messenger, Skype and AOL IM), media players (Apple Quicktime, iTunes, Macromedia Flash Player, Windows Media Player, Winamp, Realone Player and RealPlayer).

Among additional applications supported by the Online Software Inspector from Secunia we count Adobe Acrobat Reader, Adobe Reader, WinZIP and ZoneAlarm. You have to know though that not only the latest versions are supported and in some cases the web service can detect even four versions earlier.

The bottom line is that you will benefit from an online service that will scan your computer for outdated versions of installed applications and warn you about missing patches that could affect the security of the system. However, there is no disclaimer informing you on the privacy of the collected data or for how long it will be stored on Secunia servers, or the way it will be used.

Still on the downside, the list of supported applications is not at all impressive. But it contains some of the most employed applications an average user would not leave the computer without. Though the service comes from a very reliable vulnerability reporter, I guess I still need the assurance that my privacy is not violated, even if this is just through a paragraph of a few words.

Photo Gallery (4 Images)

Software Inspector start
Software Inspector at workSoftware Inspector scan results
+1more