No, really. Update your Windows install, your Java install, your Adobe Flash install, and update your browser if you’re using something other than Internet Explorer. Turn on the automatics for everything that has them, because you’re too busy to remember to do it before it’s too late. If you’re using a Mac, stop clicking Remind Me Later when Software Update pops up.
Today I clicked on a link from a webcomic I read every day. I have confidence in this site (I link to it from this blog, even!) and have never had a problem with its links before. This time was different; upon hitting the rogue site (to be clear: not the webcomic!) I started seeing Adobe Reader errors.
This was a bit unexpected, as the page in question does not have any PDF files visible. I hit Control+U to view source, and sure enough–there was the funky code linking to a “.am” domain.
I was a bit alarmed, because I realized then that my Adobe Reader was probably out of date. I checked–it was behind. Shame! I was reminded of the old saying: “doctors make the worst patients”; I was not following my own recommendations for healthy computer use.
I ran as many checks and traces as I could on my system–everything was coming up clean, fortunately. A closer inspection of the site in question (this time with Javascript and plugins turned off) revealed that it was a multi-pronged attack using two distinct Java vulnerabilites (here and here) and possibly a PDF vulnerability that I couldn’t capture.
I checked Java lastly. It was current–a relief. The exploits attacked version 27 of Java6, and I had version 31.
The moral of the story: do not ignore your software update notices. Even if it’s dreadfully inconvenient because they always pop up when you’re busiest. Otherwise, I’ll see you at the shop and we can commiserate while I charge you a nontrivial amount of money to clean your computer!