N TECH NETWORK SECURITY

How to help your kids use social websites more safely

2012-02-19T11:09:00.001+05:30

These days, many kids draw little distinction between real life and online life. They may use social websites designed for children such as Webkinz or Club Penguin, or social websites designed for adults such as Windows Live Spaces, YouTube, MySpace, Flickr, Twitter, Facebook, and others. Whatever they're doing, they should understand that many of these web pages can be viewed by anyone with access to the Internet.

Kids can use these sites to:

=> Chat

=> Play games

=> Post and browse through photos and videos

=> Blog

=> Post an online profile

Unfortunately, some of the information kids post on their pages can also make them vulnerable to phishing scams, cyberbullying, and Internet predators. Here are several ways you can help your kids can use social websites more safely.

>> Communicate with your children about their experiences. Encourage your children to tell you if something they encounter on one of these sites makes them feel anxious, uncomfortable or threatened. Stay calm and remind your kids they are not in trouble for bringing something to your attention. Let them know you will work with them to help resolve the situation for a positive outcome.

>>  Set your own house Internet rules. As soon as your children begin to use the Internet on their own, it is a good idea to come up with a list of rules for using the Internet that everyone can agree on. These rules should include whether your children can use social websites and how they can use them. For more information on setting rules, see Using family contracts to help protect your kids online.

>>   Ensure your kids follow age limits on the site. The recommended age for signing up for social websites is usually 13 and over. If your children are under the recommended age for these sites, do not let them use the sites. It is important to remember that you cannot rely on the services themselves to keep your underage child from signing up.

>>   Educate yourself about the site. Evaluate the sites that your child plans to use and make sure both you and your child understand the privacy policy and the code of conduct. Find out if the site monitors content that people post. Also, review your child's page periodically. For more suggestions, see Tips on blogging safely for parents and kids.

>>   Insist that your children never meet anyone in person that they've communicated with online only, and encourage them to communicate only with people they've met in person. Kids are in real danger when they meet strangers in person whom they've communicated with online only. You can help protect your children by encouraging them to use these sites to communicate with their friends, but not with people they've never met in person.
It might not be enough to simply tell your child not to talk to strangers, because your child might not consider someone they've "met" online to be a stranger. For more advice on protecting your children on the Internet, see Online predators: What you can do to minimize the risk.

>>   Ensure your kids don't use full names. Have your children use only their first names or a nickname, but not a nickname that would attract inappropriate attention. Also, do not allow your children to post the full names of their friends.

>>   Be wary of other identifiable information in your child's profile. Many social websites allow kids to join public groups that include everyone who goes to a certain school.
Be careful when your children reveal this and other information that could be used to identify them, such as their school mascots, their workplaces,or the name of the towns they live in. Too much information can make your children vulnerable to cyberbullying, Internet predators, Internet fraud, or identity theft. For more information, see Recognize phishing scams and fake emails.

>>   Consider using a site that is not very public. Some websites allow you to password-protect your site or use other methods to help limit viewers to only people your child knows. With Windows Live Spaces, for example, you can set permissions for who can view your site, ranging from anyone on the Internet to only people you choose.

>>   Be smart about details in photographs. Explain to your children that photographs can reveal a lot of personal information. Encourage your children not to post photographs of themselves or their friends with clearly identifiable details such as street signs, license plates on their cars, or the name of their school on their sweatshirts.

>>   Warn your child about expressing emotions to strangers. You've probably already encouraged your kids not to communicate with strangers directly online. However, kids use social websites to write journals and poems that often express strong emotions. Explain to your children that many of these words can be read by anyone with access to the Internet and that predators often search out emotionally vulnerable kids. For more information, see things you can teach kids to improve their web safety.

>>   Teach your children about cyberbullying. As soon as your children are old enough to use social websites, talk to them about cyberbullying. Tell them that if they think they're being cyberbullied, they should share this information right away with a parent, a teacher, or another adult that they trust. It's also important to encourage kids to communicate with other people online in the same way they would face-to-face. Ask kids to treat other people the way they would prefer to be treated.

>>   Removal of your child's page. If your children refuse to abide by the rules you've set to help protect their safety and you've attempted to help them change their behavior, you can contact the social website your child uses and ask them to remove the page. You may also want to investigate Internet-filtering tools (such as Windows Live Family Safety) as a complement to, not a replacement for, parental supervision.

Protect your privacy on the Internet

2012-02-18T04:31:00.000+05:30

Your privacy on the Internet depends on your ability to control both the amount of personal information that you provide and who has access to that information. To read about how your information gets on the Internet and how it is used, see Your information on the Internet: What you need to know.

Follow the practical advice below to help increase your privacy online.

Think before you share personal information
First, read the website's privacy policy

Privacy policies should clearly explain what data the website gathers about you, how it is used, shared, and secured, and how you can edit or delete it. (For example, look at the bottom of this and every page on Microsoft.com.) No privacy statement? Take your business elsewhere.

Do not share more than you need to

>>Do not post anything online that you would not want made public.

>>Minimize details that identify you or your whereabouts.

>>Keep your account numbers, user names, and passwords secret.

>>Only share your primary email address or Instant Message (IM) name with people who you know or with reputable organizations. Avoid listing your address or name on Internet directories and job-posting sites.

Enter only required information—often marked with an asterisk (*)—on registration and other forms.

Choose how private you want your profile or blog to be
Modify Windows Internet Explorer or website settings or options to manage who can see your online profile or photos, how people can search for you, who can make comments on what you post, and how to block unwanted access by others.

Monitor what others post

Search for your name on the Internet using at least two search engines. Search for text and images. If you find sensitive information on a website about yourself, look for contact information on the website and send a request to have your information removed.

Regularly review what others write about you on blogs and social networking websites. Ask friends not to post photos of you or your family without your permission. If you feel uncomfortable with material such as information or photos that are posted on others' websites, ask for it to be removed.

For more information, see Your information on the Internet: What you need to know.

Guard your information

Protect your computer
You can greatly reduce your risk of online identity theft by taking these three steps to protect your computer:

1. Use an Internet firewall.
Note: Windows 7, Windows Vista, and Windows XP with Service Pack 2 and Service Pack 3 have a firewall already built in and automatically turned on.

2. Visit Microsoft Update to verify your settings and check for security updates.
Note Microsoft Update will also update your Microsoft Office programs.

3. Subscribe to antivirus software and keep it current. Microsoft Security Essentials is a free download for Windows 7, Windows Vista, and Windows XP. For more information, see Help protect your PC with Microsoft Security Essentials. For more information, see How to boost your malware defense and protect your PC.

Create strong passwords

1.Strong passwords are at least 14 characters long and include a combination of letters (both upper and lower case), numbers, and symbols. They are easy for you to remember but difficult for others to guess.

2.Don't share your passwords with friends.

3.Avoid using the same password everywhere. If someone steals it, all the information that password protects is at risk.

Tip Learn how to create strong passwords.

Save sensitive business for your home computer

Avoid paying bills, banking, and shopping on a public computer, or on any device (such as a laptop or mobile phone) over a public wireless network.
Tip Internet Explorer can help erase your tracks on a public computer, leaving no trace of specific activity. For more information, see InPrivate: Frequently asked questions.
Protect yourself from fraud

Spot the signs of a scam

Watch for deals that sound too good to be true, phony job ads, notices that you have won a lottery, or requests to help a distant stranger transfer funds. Other clues include urgent messages ("Your account will be closed!"), misspellings, and grammatical errors.

1.Think before you click to visit a website or call a number in a suspicious email or phone message both could be phony.
2.Be cautious with links to video clips and games, or open photos, songs, or other files—even if you know the sender. Check with the sender first.

Look for signs that a web page is safe

Before you enter sensitive data, check for evidence that:

1.The site uses encryption, a security measure that scrambles data as it crosses the Internet. Good indicators that a site is encrypted include a web address with https ("s" stands for secure) and a closed padlock beside it. (The lock might also be in the lower-right corner of the window.)

2.You are at the correct site—for example, at your bank's website, not a phony website. If you are using Internet Explorer, one sign of trustworthiness is a green address bar like the one above.

Use a phishing filter
Find a filter that warns you of suspicious websites and blocks visits to reported phishing sites. For example, try the SmartScreen Filterincluded in Internet Explorer.

Help detect potential fraud

In the United States, you are entitled to one free credit report every year from each of the three major U.S. credit bureaus: Experian, Equifax, and TransUnion. Get them by visiting AnnualCreditReport.com.

Tip If you have been a victim of identity theft, find out what you can do about it.

Port Control Protocol (PCP) Security

2012-02-04T00:54:00.000+05:30

A fter the transition to Internet Protocol Version 6 (IPv6), hosts will often be behind IPv6 firewalls. But before the transition, mobile wireless devices will want to reduce their keepalive messages, and hosts of all sorts will share IPv4 addresses using a variety of address-sharing technologies. To meet these needs, the IETF formed the Port Control Protocol Working Group in August 2010 to define a new protocol for hosts to communicate with such devices. The initial output of this Working Group is the Port Control Protocol (PCP). Interoperability between two independently developed implementations of PCP was demonstrated at the IETF meeting in July 2011, highlighting the importance of this protocol to the industry. After it becomes a standard, PCP is expected to be deployed in various operating systems, IPv6 home gateways, IPv4 home gateways (Network Address Translators [NATs]), mobile third- and fourth-generation (3G and 4G, respectively) gateways (Gateway GPRS Support Nodes [GGSNs]), and Carrier-Grade NATs (CGNs).

Introduction to PCP
PCP performs two major functions: It allows packets to be received from the Internet to a host (such as to operate a server), and allows a host to reduce keepalive traffic of connections to a server. PCP can be extended in two ways: with new OpCodes or with new Options. The base PCP specification defines two OpCodes: map and peer , and defines several Options that can be carried with those OpCodes.
To operate a server, packets are sent from a host on the Internet to a server. The IP model expects devices to be connected to a network and be able to exchange packets with each other. However, few deployed networks actually permit hosts to receive packets from the Internet because of business needs (for example, to protect wireless spectrum from malicious or accidental packets originated on the Internet) or because of technology restrictions (for example, IPv4 address-sharing devices such as Network Address and Port Translators [NAPT]). To operate a server, a host uses the map OpCode.
To reduce keepalives, a host needs to send traffic before a middlebox will destroy an idle connection. Many middleboxes, such as firewalls or NATs, maintain state and will destroy mappings if the connection has been idle. Today, in order to prevent destruction of mappings, hosts send keepalive traffic to keep those mappings alive. The keepalive traffic has several disadvantages, including reduction of battery lifetime, network chatter, and server scalability (servers have to discard the keepalive traffic). PCP allows a host to determine how aggressively a middlebox will destroy an idle connection, allowing the host to reduce its keepalive traffic with the PEER OpCode.
PCP is encoded in binary and carried over the User Datagram Protocol (UDP), which eases implementation on clients and servers. The client is responsible for retransmitting messages, and all messages are idempotent. The PCP client can be part of the operating system (much like a Dynamic Host Configuration Protocol [DHCP] client or a Universal Plug and Play [UPnP] Internet Gateway Device Protocol [IGD] client) or the PCP client can be coded entirely in an application (much like any other application-level protocol such as the Network Time Protocol [NTP]). A major feature of PCP is its flexibility and simple messaging, so it can be implemented easily in a variety of systems and at high scale.

PCP Mapping IPv6 and IPv4

>>Security

When installing an IPv4 NAPT on a residential network, the NAPT has a side effect: it prevents unsolicited incoming traffic from reaching hosts inside the home. Traffic that originates inside the home can traverse the NAPT toward the Internet. This function is expected by many users to such a degree that when IPv6-capable routers were first installed on residential networks, users complained that their IPv6 hosts were seeing traffic from the Internet. This visibility meant that IPv6 printers, webcams, and other hosts had to be protected from malicious traffic from the Internet. Based on this experience, IPv6 Customer Premises Equipment (CPE) routers intended for installation in the residential market filter most unsolicited incoming traffic by default. Thus, IPv6 CPE routers provide filtering similar to what users experience today with IPv4 NAPT devices.

With both IPv4 NAPT and RFC 6092 IPv6 routers, outgoing traffic from a host creates a mapping that then allows bidirectional traffic to a specific (Transmission Control Protocol [TCP] or UDP) port on the internal host, meaning when a host sends a TCP SYN, a SYN ACK can be returned to the host. Neither IPv4 NAPT devices nor RFC 6092 IPv6 routers have to do any additional filtering of that mapping, and after that mapping is created will allow traffic from any host on the Internet to reach the internal host—not just traffic from that particular host. This lack of filtering is necessary for certain applications
to function.
PCP was built with a security model similar to that deployed on home networks. With PCP, a host can send a PCP packet requesting a mapping so that any host on the Internet can now initiate communications with the internal host. Similarly, without PCP, a host could send a TCP SYN from a specific port (for example, port 80), thereby creating a mapping nearly identical to a PCP mapping. As with sending a TCP SYN, PCP allows a host to open mappings only for itself, unless the network administrator has taken the extra step to enable the PCP THIRD_PARTY option.

You may wish to have additional restrictions for some networks. PCP is extensible to support authorization, and there is ongoing work to support authentication and authorization within PCP.
PCP is extensible and there are already several proposed extensions to the protocol, including a way to control which IP address pool is assigned to a mapping, bulk port allocation to optimize acquiring a large set of ports, and rapid recovery after NAT failure or network renumbering.

Multifunctional malware, staged drive-by attacks to rise in 2012

2012-01-01T10:16:00.000+05:30

Automated toolkits with business models that include rental agreements and constant updates will gain considerable improvements in 2012, with many attack kits being primed with new features that enable even the least tech-savvy cybercriminals to hone malware in 2012 for highly targeted attacks.

Financial malware designed to target and infiltrate bank accounts could be recoded for targeted non-financial attacks, according to Boston-based security vendor Trusteer. The Zeus and SpyEye codebases, which are now publicly available, can be manipulated to pull off more sophisticated targeted attacks against enterprises. “Over the next twelve months perimeters will face an onslaught from various sources, viruses going financial, APT-style technologies in Zeus code derivatives manipulated by new coders and in other commercially available malware kits,” Trusteer CTO Amit Klein noted in the company’s list of predictions.

A scourge of compromised legitimate websites will continue to fuel an increase in staged attacks in 2012, according to South Jordan, Utah-based network security vendor, Solera Networks Inc. High-profile attacks carried out by hactivist groups demonstrated that even the largest enterprisesstruggle to control website vulnerabilities that can give cybercriminals a way into sensitive systems. Andrew Brandt, Solera’s director of Threat Research, urges Mozilla Firefox users to keep their plug-ins updated and install NoScript to stop the onslaught of drive-by attacks using malicious JavaScript.

“As far as I can tell, it’s the only surefire method of preventing an accidental infection of a Windows PC by exploit-kitted webpages,” Brandt wrote in the Solera blog. “It all starts with a blob of heavily obfuscated Javascript and ends within a few minutes with the victim’s PCpwned and the victim’s passwords in the hands of some Asian or eastern European goon squad.”

Solera’s Brandt also points to vulnerable WordPress.org blog plug-ins as a major contributor to the problem. Malware writers upload their code to the vulnerable webpages, enabling them to serve up keyloggers to blog visitors. “Most of the code we’ve seen uploaded to legit sites redirects the browser into the maw of one or another exploit kits,” Brandt wrote.

Hardware security weaknessesMeanwhile, security giant McAfee, which was acquired in 2010 by chipmaker Intel, is predicting a spike in attacks that leverage embedded hardware or use a computer’s master boot record and BIOS layers, to bypass traditional security technologies. “We expect to see more effort put into hardware and firmware exploits and their related real-world attacks throughout 2012 and beyond,” according to McAfee.

Embedded systems that run GPS routers, ATM machines, medical devices and other systems can be rooted and are at risk to falling under the control of sophisticated cyber criminals.

“Controlling hardware is the promised land of sophisticated attackers,” according to the report. “If attackers can insert code that alters the boot order or loading order of the operating system, they will gain greater control and can maintain long-term access to the system and its data.”

McAfee’s prediction is somewhat buoyed by Columbia University researchers who demonstrated how HP printer vulnerabilities could be used by cybercriminals to gain access to corporate networks.

Michael Sutton, vice president of security research at SaaS-based email and Web gateway security vendor Zscaler Inc. said the focus on hardware-based threats may force hardware vendors to increase their focus on security and take vulnerability disclosure more seriously. Sutton’s presentation at Black Hat 2011 focused on weaknesses in embedded Web servers.

“Security in the hardware space is at least ten years behind security in the software industry,” Sutton wrote in Zscaler’s ThreatLabZ blog. “Hardware vendors will get a wake-up call as researchers shift their efforts to hardware and party like it’s 1999.”

Cybersecurity career experts: Mobile app security skills hot in 2012

2012-01-01T09:40:00.000+05:30

Enterprises are going to be on the hunt for security professionals with the skills and certifications required to embrace the explosive demand for mobile devices and the cocktail of mobile security threats associated with them, according to several security industry career experts.

Security job recruiters and career advisors predict that in 2012 the swelling attraction to smartphones, tablets and other mobile devices will trigger substantial growth in jobs requiring IT security expertise. In particular, organizations are keen to nail down applicants with skill sets related to developing and maintaining mobile app security and enforcing mobile device security policies, according to Jeff Snyder, president of Woodland Park, Colo.-based SecurityRecruiter.com.

“The applications are now being written for mobile devices, and that brings up some different issues,” Snyder said.

Enterprises have been too focused on network security issues over the last few decades and as a result, according to Snyder, few organizations have spent enough time on creating secure applications.

“That’s where a lot of the vulnerabilities lie,” Snyder said. While secure application development has improved, other experts acknowledge that many firms lack enough developers skilled in creating secure Web applications and far fewer have the staff knowledgeable in creating hardened mobile applications.

Job recruiters and career advisors say application security has remained a sought after career path for decades, and those looking for career advancement may want to hone their skills in mobile security. Many enterprises are wild to implement Google Android and Apple iOS mobile applications that enable employees to log into company systems as well as engage customers with mobile apps. As a result, this stampede is leading toward a lack of mobile secure coding expertise, Snyder said.

”I cannot fathom how little they really understand of how serious this is coming at them,” Foote said. Enterprises have been slow to come to terms with and provide for the wave of security measures necessitated by smartphones and other mobile devices connecting to the corporate network, said David Foote, CEO and co-founder of independent research and analysis firm Foote Partners LLC. Now is the time for enterprises to plan ahead; and as many have not, the ramifications within the security job market will be huge, Foot said.

New technology, no matter what it is, has security ramifications, said Lee Kushner, recruitment expert and CEO of L. J. Kushner and Associates. Technology is constantly evolving and surging forward, sending enterprises scrambling and opening gateways for incredible industry and employment opportunities, Lee said.

“If these times have taught anybody anything, it’s the importance to reinvest in your career and continue to grow and push yourselves,” Lee said.

So what exactly is it that security recruiters are searching for as they look to hire during this mobile revolution? Recruiters recommend the path to cybersecurity career success is found by having a well-rounded skill set and the ability to communicate effectively in a business environment.

“If you want to stand out, go do the things most people don’t do; learn how to speak; learn how to write; things a computer science education didn’t advent,” Snyder advised.

The technical computing world and the business world are crossing paths more frequently, and with mobile technology taking over the way enterprises operate, the line that separates the two is greyer than ever, Foote said.

“What companies come to me for is generally to find those people who are technologists, but they’re also very savvy business people,” Snyder said.

IT security professionals need to know as much as possible about the structure and practices of the business at stake, the career experts said. When security pros are truly seeking to elevate themselves within their field, increasing business and industry knowledge is the surest path, Snyder said.

“When companies are using a search firm to fill a position, then they’re going to usually expect that a candidate’s going to have industry experience,” he said. “In other words, if it’s a bank, they want someone who’s coming out of a bank; if it’s a retailer, they want someone coming out of retail; and if somebody’s going after that job on their own, then the bar isn’t usually sent quite as high.”

The security profession is becoming increasingly unilateral, spreading across boundaries and seeping into all factions of trade; mobile technology is accelerating this process, Foote said. Millions of IT professionals are employed who don’t have traditional job titles, according to Foote. Despite lacking these customary classifications, when questioned, hiring managers often say they selected an employee because of their great IT skills, he said.

The secret lies in “being able to demonstrate you’ve continually grown and invested in your career, and you have an aptitude to kind of be able to evolve; it’s those types of folks who are winning the most highly sought after roles,” Kushner said.

New Network Security Challenges for 2012 Happy New Year

2011-12-31T20:22:00.000+05:30

2012 will be the year that a cyberattack really does hit a public utility hard, taking down an electric grid. Along those same lines, industrial control systems in other countries will be rocked with a sustained cyberattack that will make Stuxnet look like child's play in a year that increasingly will find that cyber-sabotage and cyberwar are realities that must be reckoned with.

Hackers armed with a single machine and a minimal broadband connection can cripple Web servers, researchers disclosed Wednesday, putting uncounted websites and Web apps at risk from denial-of-service attacks.

In a security advisory issued the same day, Microsoft, whose ASP .Net programming language is one of several affected by the flaw, promised to patch the vulnerability and offered customers ways to protect their servers until it releases an update.

In a follow-up message, Microsoft announced it was shipping an "out-of-band," or emergency update today. The update was released at 1 p.m. ET. Designated MS11-100, it also fixed three other bugs in ASP .Net, one tagged "critical." None of those three had been disclosed publicly prior to today.

The problem that caused a stir in the security community exists in many of the Web's most popular application and site programming languages, including ASP .Net, the open-source PHP and Ruby, Oracle's Java and Google's V8 JavaScript, according to two German researchers, Alexander Klink and Julian Walde.

Klink and Walde, who presented their findings at the Chaos Communication Congress (CCC) conference in Berlin on Wednesday, traced the flaw to those languages' -- and others' -- handling of hash tables, a programming structure used to quickly store and retrieve data.

Unless a language randomizes hash functions or takes into account "hash collisions" -- when multiple data generates the same hash -- attackers can calculate the data that will trigger large numbers of collisions, then send that data as a simple HTTP request. Because each collision chews up processing cycles on the targeted server, a hacker using relatively small attack packets could consume all the processing power of even well-equipped servers, effectively knocking them offline.

Microsoft confirmed that a single 100K specially-crafted HTTP request sent to a server running ASP .Net would consume 100% of one CPU core for 90-110 seconds.

"An attacker could potentially repeatedly issue such requests, causing performance to degrade significantly enough to cause a denial of service condition for even multi-core servers or clusters of servers," company engineers Suha Can and Jonathan Ness said in a post to the Security Research & Defense blog yesterday.

Klink and Walde estimated that packets as small as 6K would keep a single-core processor busy on a Java server.

The implications are significant for Web apps and sites that run on those servers.

"An attacker with little resources can effectively take out a site fairly easily," said Andrew Storms, director of security operations at nCircle Security, today. "No botnet required to create havoc here."

Microsoft's rush to patch the flaw in ASP .Net hinted at the seriousness of the bug.

How to avoid a costly mistake on a Christmas Eve

2011-12-25T10:25:00.000+05:30

>>Never reveal your personal password to anyone, even payment companies

>>Ensure domain name matches the website name

>>Have up-to-date anti-virus, anti-malware and anti-spyware software on your computer

>>Check warranty conditions, product disclosures and shipping details.

"A fraudulent site selling TVs or video cameras will look very convincing," Choice spokeswoman Ingrid Just said in a statement today.
"This makes it hard to tell the difference between what's dodgy and what's not.
"It's worth taking a few seconds to verify the security certificate, especially when the site is one you're not familiar with."

*Shoppers are being told to look out for a small padlock symbol that appears beside the URL during payment process.

*This indicates that details should be secure, with shoppers able to click on the padlock to check the status of the retailer's security certificate.

*Another sign of a secure site is if an 's' appears in the website address - beginning with https//: - during the payment process.
The 's' is another indicator your information will be encrypted.

Internet Security for Christmas Presents

2011-12-25T09:24:00.000+05:30

This Christmas has seen a large increase in the sales of new devices such as iPads, tabs, laptops, games consoles and smart phones. Fife Police are hoping that users obtain security software to protect themselves and their devices.
The most likely forms of attack on computers will involve 'phishing' and 'malware'. Phishing attacks will lead users to a website with the aim of obtaining personal information, such as bank accounts and passwords. Malware, or malicious software, enables criminals to infiltrate a computer and control it remotely, allowing them to use the computer for illegitimate purposes, for example, to steal personal information or send spam emails. Keeping the computers operating system and security software up-to-date is the most effective way of protecting your machine.

Parents and carers should also ensure that the children are sufficiently aware of the online risks particularly when engaging in social networking, instant messaging or online chat.
Detective Inspector Stuart Morris, e-crime Unit said: "A common sense approach has to be used online. Many scam offer deals that are tempting becs you think you are getting a bargain, so if it luks too good to be true, it probably is."

The 12 Internet scams of Christmas

A timely reminder of some security traps, some of which we see time and time and time again every year.

1. On the first day of Christmas, I downloaded an advent calendar that unleashed a virus attack on my computer.

Santa says: be very cautious of downloaded games and novelties unless from a trusted source, or you could find yourself with an unwanted security breach.

---------------------------------------------------------

2. On the second day of Christmas, I scanned a QR code with
my smartphone to find a good deal on a Christmas hamper.

Santa says: QR codes, or digital barcodes, can link to malware or other nasties that can be installed on your phone and steal your private information. Again, trust the source.

---------------------------------------------------------

3. On the third day of Christmas, a Twitter follower sent a private message with a link to a Christmas card.

Santa says: The shortened links in some Tweets mean you can click on something without realising where it's really going, or without bothering to check. You might also receive a link from a follower sent in a private message. If their account has been hacked the message will appear to be from a legitimate follower.

---------------------------------------------------------

4. On the fourth day of Christmas, I bought a cheap iPhone online that I'm still waiting to be delivered.

Santa says: Where possible opt for shopping through local websites as you’re covered by Australian consumer protection laws and follow the rule that if a deal looks too good to be true, it usually is.

---------------------------------------------------------

5. On the fifth day of Christmas, I clicked on a Facebook giveaway page that offered a $200 voucher for an online shopping site that was nothing but a hoax.

Santa says: companies don’t usually give away large-value vouchers for commenting or liking a Facebook page.

---------------------------------------------------------

6. On the sixth day of Christmas, I bought a cheap holiday with some bargain airfares from a travel website.

Santa says: Apply the commonsense test about why a holiday or flights would be so cheap and, if it looks too good to be true ... you know the rest.

---------------------------------------------------------

7. On the seventh day of Christmas, I opened an email with some funny dancing elves that shuts down my computer.

Santa says: Never, never, never open emails or attachments from unknown senders. If suspicious, delete.

---------------------------------------------------------

8. On the eighth day of Christmas, I paid for some presents using my mobile phone and the free wireless in a cafe.

Santa says: use mobile networks rather than unsecured wireless networks such as those in cafes and fast food outlets if making financial transactions on your phone, as you risk your PIN and account details being stolen.

---------------------------------------------------------

9. On the ninth day of Christmas, the bank rang about my credit card being hit with some unusually large purchases after I’d done by online present shopping.

Santa says: when paying for something online, make sure that the address uses the secure https and displays a closed padlock symbol as well as SSL encryption so that your credit card and other financial information is protected.

---------------------------------------------------------

10. On the tenth day of Christmas, I did a Google search for some festive Santa suits online.

Santa says: don’t just follow the top search engine results without checking that the business is legitimate. Criminals and scammers can target search engine results to capture unsuspecting victims.

---------------------------------------------------------

11. On the eleventh day of Christmas, I clicked on a flashing banner on a website offering cheap personalised Christmas cards.

Santa says: flashing banners and advertisements aren’t just annoying because they distract you from the site you’re on, they can potentially take you to infected sites that can attack your computer before you realise.

---------------------------------------------------------

12. On the twelfth day of Christmas, I installed a Christmas wallpaper app that ate my data usage allowance and sent my user data without my permission.
Santa says: only download legitimate apps from either iTunes or the Android Marketplace and check the handset settings about what updates and user data is authorised.

Working from home, is your office data security compromised?

2011-12-23T06:30:00.000+05:30

In many cases executive IT and security professionals trust their Information Security departments to provide adequate security to protect employees while operating in their business environment. However it is rare for users to extrapolate this security to a home environment.What does this mean in practical terms? Well, an enterprise will normally provide a risk analysis of a security threat and then provide adequate controls to mitigate that risk to an acceptable level. And users need to consider the same things when at home. So what are the considerations which IT directors should take into account when looking at cyber security provisions for mobile workers?

Challenges

Complying with a growing number of regulations governing the handling and protection of customer data
Establishing consistent backups and reliable recovery with limited IT resources and network bandwidth
Dealing with exponential growth in data at remote sites, which makes wide-area network backups impractical
Minimizing high administrative costs associated with a backup applications and tape media at multiple remote sites
Reducing or eliminating the off-site transport of backup data on tapes from remote sites to other locations

Key security questions outlined below:

>>Is the home network secure? Consider the following points; do employees use wireless and have they enabled the security features? In practical terms this means, do they use WPA with a key which is sufficiently complex to avoid dictionary attacks?

>>Do they have an up to date Anti Virus package which is set to receive automatic updates to avoid the latest attacks. Does it offer full malware coverage? Do they ensure the AV package is running (be aware that some viruses will disable the AV if it can)

>>Is their firewall capability enabled at their router and if so, do they look at the logs?

>>Do they scan their systems regularly and do they check the reports?

>>Is their software regularly checked for the availability of security updates, and are these installed when they become available?

>>Is their software up to date – or do they run older versions which may not be as secure?

>>Do they use custom software where vulnerabilities aren’t automatically installed, and if so, how do they ensure they are manually update?

>>Do they use reputable file sharing and Instant Messaging technology and sites? Is the technology up to date?

>>What do they do if they observe unusual behaviour on their system (e.g. if the system behave slowly)?

>>Do they look at the URL they are connected to and ensure it is what they expect?

>>If they connect to systems which request payment details – do they check that the website is reputable, that the SSL certificate is valid, signed and belongs to the organisation that they expect?

>>Do they all understand the implications of opening attachments/files from unexpected emails?

>>Do they understand that reputable organisations will never request authentication details via emails?

>>Do they set their browser and AV to ensure add-ons, Active X controls etc. aren’t installed without user action required to confirm?

>>Do they avoid offers of “free scans” and pop up offers in general?

>>Do they use a standard password for all logins – or do they mitigate risks by using separate passwords for different applications?

>>Do they have complex passwords and do they change them regularly?

>>Do they treat any unsolicited messages/mails with suspicion?

>>Do they use public systems and if so, do they change the passwords they utilised, when they return home?

>>Do they use any software provided by their financial institution to improve security e.g. one time passwords, extra keystroke protection etc?

>>Do they check their credit card statements, online bank accounts etc. for any unusual or unexpected transactions?

>> Do they encrypt very important files on their disk – in case of theft? E.g. (password files, bank details etc.)

>> If they have to replace disks or systems do they ensure all data is deleted on their old systems? Is the engineer reputable who comes to replace/repair disks?

>> Are all members of the family aware of these risks and act in the same way?

>>Do they ever check running processes to see if there is anything unusual and how do they validate unusual vs. usual?

The above list outlines key security considerations; however the important thing to be noted when reviewing your organisation’s, or even your own personal cyber security, is that no single control will protect users from attacks. IT directors and individuals simply have to make it as difficult as possible for hackers to get through.

Network Anomaly Detection using Soft Computing

2011-12-19T13:14:00.000+05:30

INTRUSION detection is based on the assumption that intrusion activities are noticeably different from normal system activities and thus detectable. As defined in, intrusion detection is “the process of monitoring the events
occurring in a computer system or network and analyzing them for signs of intrusions. It is also defined as attempts to compromise the confidentiality, integrity, availability, or to bypass the security mechanisms of a computer or network”. Anomaly Intrusion Detection Systems (IDSs) aim at distinguishing an abnormal activity from an ordinary one. Many approaches have been proposed which include statistical, machine learning, data mining and immunological inspired techniques. There are two main intrusion detection systems. Anomaly intrusion detection system is based on the profiles of normal behaviors of users or applications and checks whether the system is being used in a different manner.

The second one is called misuse intrusion detection system which collects attack signatures, compares a behavior with these attack signatures, and signals intrusion when there is a match. Independent component analysis (ICA) aims at extracting unknown hidden actors/components from multivariate data using only the assumption that the unknown factors are mutually independent. The theory of rough sets has been specially designed to handle data imperfections same as in fuzzy logic. Rough sets remove superfluous information by examining attribute dependencies. It deals with inconsistencies, uncertainty and incompleteness by imposing an upper and a lower approximation to set membership. Rough sets estimates the relevance of an attribute by using attribute dependencies regarding a given decision class. It achieves attribute set covering by imposing a discernibility relation. It is often impossible to analyze the vast amount of whole data, but one has to focus the analysis on an important portion of the data such as using some criteria, only the classes of interest can be selected for analysis or processing while the rest is rejected. This paper suggests the use ICA as a dimensionality reduction technique to avoid this information loss. The rest of this paper is organized as follows. In section II, we discuss the related works and independent component analysis; introduce rough set, fuzzy set and rough fuzzy in section III; explains experimental design in section IV; evaluate our intrusion detection model through experiments in section V; and in section VI ends the paper with a conclusion and some discussion.

Network Anomaly Detection using Soft Computing [PDF]

CA-2001-22 W32/Sircam Malicious Code

2011-11-15T15:37:00.000+05:30

Original release date: July 25, 2001

Last revised: August 23, 2001
Source: CERT/CC

A complete revision history can be found at the end of this file.

Systems Affected

Microsoft Windows (all versions)

Overview

"W32/Sircam" is malicious code that spreads through email and potentially through unprotected network shares. Once the malicious code has been executed on a system, it may reveal or delete sensitive information.

As of 10:00EDT(GMT-4) Jul 25, 2001 the CERT/CC has received reports of W32/Sircam from over 300 individual sites.

I. Description

W32/Sircam can infect a machine in one of two ways:

When executed by opening an email attachment containing the malicious code

By copying itself into unprotected network shares

Propagation Via Email

The virus can appear in an email message written in either English or Spanish with a seemingly random subject line. All known versions of W32/Sircam use the following format in the body of the message:

English	Spanish
Hi! How are you? [middle line] See you later. Thanks	Hola como estas ? [middle line] Nos vemos pronto, gracias.

Where [middle line] is one of the following:

English

I send you this file in order to have your advice
I hope you like the file that I sendo you
I hope you can help me with this file that I send
This is the file with the information you ask for

Spanish

Te mando este archivo para que me des tu punto de vista
Espero te guste este archivo que te mando
Espero me puedas ayudar con el archivo que te mando
Este es el archivo con la informacion que me pediste

Users who receive copies of the malicious code through electronic mail might recognize the sender. We encourage users to avoid opening attachments received through electronic mail, regardless of the sender's name, without prior knowledge of the origin of the file or a valid digital signature.
The email message will contain an attachment whose name matches the subject line and has a double file extension (e.g.subject.ZIP.BAT or subject.DOC.EXE). The CERT/CC has confirmed reports that the first extension may be .DOC, .XLS, or .ZIP. Anti-virus vendors have referred to additional extensions, including .GIF, .JPG, .JPEG, .MPEG, .MOV, .MPG, .PDF, .PNG, and .PS. The second extension will be .EXE, .COM, .BAT, .PIF, or .LNK. The attached file contains both the malicious code and the contents of a file copied from an infected system.
When the attachment is opened, the copied file is extracted to both the %TEMP% folder (usually C:\WINDOWS\TEMP) and the Recycledfolder on the affected system. The original file is then opened using the appropriate default viewer while the infection process continues in the background.

It is possible for the recipient to be tricked into opening this malicious attachment since the file will appear without the .EXE, .BAT,.COM, .LNK, or .PIF extensions if the "Hide file extensions for known file types" is enabled in Windows. See IN-2000-07 for additional information on the exploitation of hidden file extensions.

W32/Sircam includes its own SMTP client capabilities, which it uses to propagate via email. It determines its recipient list by recursively searching for email addresses contained in all *.wab (Windows Address Book) files in the %SYSTEM% folder. Additionally, it searches the folders referred to by

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache

for files containing email addresses. All addresses found are stored in SC??.DLL or S??.DLL files hidden in the %SYSTEM% folder.

W32/Sircam first attempts to send messages using the default email settings for the current user. If the default settings are not present, it appears to use one of the following SMTP relays:

prodigy.net.mx
NetBIOS name for 'MAIL'
mail.<defaultdomain> (e.g., mail.example.org)
dobleclick.com.mx
enlace.net
goeke.net

Propagation Via Network Shares

In addition to email-based propagation, analysis by anti-virus vendors suggests that W32/Sircam can spread through unprotected network shares. Unlike the email propagation method, which requires a user to open an attachment to infect the machine, propagation of W32/Sircam via network shares requires no human intervention.

If W32/Sircam detects Windows networking shares with write access, it

copies itself to \\[share]\Recycled\SirC32.EXE
appends "@ win\Recycled\SirC32.exe" to AUTOEXEC.BAT

If the share contains a Windows folder, it also

copies \\[share]\Windows\rundll32.exe to \\[share]\Windows\run32.exe
copies itself to \\[share]\Windows\rundll32.exe
when virus is executed from rundll32.exe, it calls run32.exe

Infection process

When installed on a victim machine, W32/Sircam installs a copy of itself in two hidden files:
- %SYSTEM%\SCam32.exe
- Recycled\SirC32.exe
Installing in Recycled may hide it from anti-virus software since some do not check this folder by default.
Based on external analyses, there is also a probability that W32/Sircam will copy itself to the %SYSTEM% folder as ScMx32.exe. In that case, another copy is created in the folder referred to byHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup (the current user's personal startup folder). The copy created in that location is named Microsoft Internet Office.exe. When the affected user next logs in, this copy of W32/Sircam will be started automatically.
The registry entry HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Driver32 is set to%SYSTEM%\SCam32.exe so that W32/Sircam will run automatically at system startup.
The registry entry HKEY_CLASSES_ROOT\exefile\shell\open\command is set to "C:\Recycled\SirC32.exe" "%1" %*", causing W32/Sircam to execute whenever another executable is run.
A new registry entry, HKEY_LOCAL_MACHINE\Software\SirCam, is created to store data required by W32/Sircam during execution.
W32/Sircam searches for filenames with .DOC, .XLS, .ZIP extensions in the folders referred to by

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
While the personal folder may vary with configuration, it is often set to \My Documents or\Windows\Profiles\%username%\Personal. A list of these files is stored in %SYSTEM%\scd.dll.

W32/Sircam attaches its own binary to selected files it finds and stores the combined file in the Recycled folder.

II. Impact

W32/Sircam can have a direct impact on both the computer which was infected as well as those with which it communicates over email.

Breaches of confidentiality: The malicious code will at a minimum search through select folders and mail potentially sensitive files. This form of attack is extremely serious since it is one from which it is impossible to recover. Once a file has been publicly distributed, any potentially sensitive information in it cannot be retracted.
Limit Availibility (Denial of Service)
- Fill entire hard drive: Based on external analyses, on any given day, there is a probability that it will create a file named C:\Recycled\sircam.sys which consumes all free space on the C: drive. A full disk will prevent users from saving files to that drive, and in certain configurations impede system-level tasks (e.g., swapping, printing).
- Propagation via mass emailing: W32/Sircam will attempt to propagate by sending itself through email to addresses obtained as described above. This propagation can lead to congestion in mail servers that may prevent them from functioning as expected.NOTE: Since W32/Sircam uses native SMTP routines connecting to pre-defined mail servers, propagation is independent of the mail client software used.
Loss of Integrity: Published reports indicate that on October 16 there is a reasonable probability that W32/Sircam will attempt to recursively delete all files from the drive on which Windows is installed (typically C:).

III. Solution

Run and Maintain an Anti-Virus Product

It is important for users to update their anti-virus software. Most anti-virus software vendors have released updated information, tools, or virus databases to help detect and partially recover from this malicious code. A list of vendor-specific anti-virus information can be found in Appendix A.

Many anti-virus packages support automatic updates of virus definitions. We recommend using these automatic updates when available.

Exercise Caution When Opening Attachments

Exercise caution when receiving email with attachments. Users should never open attachments from an untrusted origin, or ones that appear suspicious in any way. Finally, cryptographic checksums should also be used to validate the integrity of the file.

The effects of this class of malicious code are activated only when the file in question is executed. Social engineering is typically employed to trick a recipient into executing the malicious file. The best advice with regard to malicious files is to avoid executing them in the first place. The following tech tip offers suggestions as to how to avoid them:

Protecting yourself from Email-borne Viruses and Other Malicious Code During Y2K and Beyond

Filter the Email or use a Firewall

Sites can use email filtering techniques to delete messages containing subject lines known to contain the malicious code, or they can filter all attachments.

Likewise, a firewall or border router can be used to stop the W32/Sircam outbound SMTP connections to mail servers outside of the local network. This filtering strategy will prevent further propagation of the worm from a particular host when the local mail configuration is not used.

Appendix A. - Vendor Information

Computer security risks to home users

2011-11-15T14:40:00.000+05:30

A. What is at risk?
Information security is concerned with three main areas:

>Confidentiality - information should be available only to those who rightfully have access to it

>Integrity -- information should be modified only by those who are authorized to do so

>Availability -- information should be accessible to those who need it when they need it

These concepts apply to home Internet users just as much as they would to any corporate or government network. You probably wouldn't let a stranger look through your important documents. In the same way, you may want to keep the tasks you perform on your computer confidential, whether it's tracking your investments or sending email messages to family and friends. Also, you should have some assurance that the information you enter into your computer remains intact and is available when you need it.

Some security risks arise from the possibility of intentional misuse of your computer by intruders via the Internet. Others are risks that you would face even if you weren't connected to the Internet (e.g. hard disk failures, theft, power outages). The bad news is that you probably cannot plan for every possible risk. The good news is that you can take some simple steps to reduce the chance that you'll be affected by the most common threats -- and some of those steps help with both the intentional and accidental risks you're likely to face.

Before we get to what you can do to protect your computer or home network, let’s take a closer look at some of these risks.

B. Intentional misuse of your computer

The most common methods used by intruders to gain control of home computers are briefly described below. More detailed information is available by reviewing the URLs listed in the References section below.

> Trojan horse programs
>Back door and remote administration programs
>Denial of service
>Being an intermediary for another attack
>Unprotected Windows shares
>Mobile code (Java, JavaScript, and ActiveX)
>Cross-site scripting
>Email spoofing
>Email-borne viruses
>Hidden file extensions
>Chat clients
>Packet sniffing

C. Accidents and other risks

In addition to the risks associated with connecting your computer to the Internet, there are a number of risks that apply even if the computer has no network connections at all. Most of these risks are well-known, so we won’t go into much detail in this document, but it is important to note that the common practices associated with reducing these risks may also help reduce susceptibility to the network-based risks discussed above.

1. Disk failure
Recall that availability is one of the three key elements of information security. Although all stored data can become unavailable -- if the media it’s stored on is physically damaged, destroyed, or lost -- data stored on hard disks is at higher risk due to the mechanical nature of the device. Hard disk crashes are a common cause of data loss on personal computers. Regular system backups are the only effective remedy.

2. Power failure and surges
Power problems (surges, blackouts, and brown-outs) can cause physical damage to a computer, inducing a hard disk crash or otherwise harming the electronic components of the computer. Common mitigation methods include using surge suppressors and uninterruptible power supplies (UPS).

3. Physical Theft
Physical theft of a computer, of course, results in the loss of confidentiality and availability, and (assuming the computer is ever recovered) makes the integrity of the data stored on the disk suspect. Regular system backups (with the backups stored somewhere away from the computer) allow for recovery of the data, but backups alone cannot address confidentiality. Cryptographic tools are available that can encrypt data stored on a computer’s hard disk. The CERT/CC encourages the use of these tools if the computer contains sensitive data or is at high risk of theft (e.g. laptops or other portable computers).

Steam hack confirmed by Valve game company

2011-11-14T17:08:00.000+05:30

Steam, the online gaming network run by game company Valve, confirmed Thursday that its forums had been hacked and warned users to keep a close eye on their credit card statements.

The service’s forums had been defaced earlier in the week, resulting in some gamers receiving e-mails from a hacking Web site, Kotaku report

Gallery

In recent years, lawmakers and advocacy groups have made increased efforts to protects users’ privacy online. Here are some cases that helped stoke the debate about tracking and privacy on the Web.

On Thursday, Valve co-founder Gabe Newell left a message on the company’s forums confirming the intrusion, saying that all forum passwords will be reset and adding that the attack “goes beyond the Steam forums.” While there is evidence of a deeper intrusion, the company is not yet requiring all Steam users to reset their account passwords, which are separate from forum accounts.

“We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked,” Newell wrote. “We are still investigating.”

He added that there have been no reports that Steam accounts were compromised, but advised users to change their passwords as a precaution.

“I am truly sorry this happened, and I apologize for the inconvenience,” he said.

The intrusion comes at a bad time for Steam, which is not only premiering a major title — Bethesda’s “Elder Scrolls V: Skyrim” — Friday, but is also facing long-term challenges from Electronic Arts’ Origin service, cloud gaming service OnLive and an as-yet-unreleased online service from retailer GameStop.

Security, understandably, is the most pressing issue facing these services as they ask gamers to trust their saved data, credit cards and other personal information to off-site servers. Companies are also jumpy following the Sony data hack that pulled the PlayStation Network and Sony Online Entertainment services off line for a month and resulted in a lot of bad press for the electronics giant.

7 Things You Need To Know About Recent Web Hack Attacks

2011-11-14T00:14:00.000+05:30

By Jeremiah Grossman
Citigroup, Sony, PBS, Sega, Nintendo, Gawker, AT&T, the Central Intelligence Agency, the United States Senate, NASA, Nasdaq, the NYSE, Zynga, BBC Music, the Royal Navy, and thousands of others have one thing in common – they have all fallen victim to hack attacks in the last year.
Jeremiah Grossman
Millions of credit-card numbers, customers’ personal information and records, not to mention gigabytes worth of intellectual property, have been compromised. And the onslaught shows no signs of stopping. The net result has been stark – hundreds of millions of dollars in corporate losses, sharp stock price declines, lawsuits, fines and costly downtime. Most alarmingly, it no longer matters whether a company is in financial services, retail, education, gaming, social networking, government, telecom, media or travel – no industry is immune to these breaches.

The recent attacks provide every company good reason to review their own data security policies. Here are 7 insights to help address the challenge of the Wild Wild Web:

> Every recent, high-profile breach in the news could easily happen to any online business.

This goes for both small-to-medium enterprises and Fortune 500 mega corporations. Data shows that most Web sites were exposed to at least one serious vulnerability every day of 2010.

>Today’s hacker is relentless in victimizing a ‘target.’

Recently there have been a large number of breaches solely in the gaming industry. Sony, Nintendo, Sega and the online account of Microsoft XBox Live’s security chief have all been targeted. This highlights one of the most significant challenges for large corporations especially –they have vast online footprints to protect. Proper defense requires a consistent, concerted effort and resource allocation commensurate with the level of risk.

>Becoming a ‘target of choice’ rather than a ‘target of opportunity’ can happen at any time.

Unfortunately, companies do not get to decide what type of target they are in this game; the attacker does.

>Firewalls and SSL cannot stop today’s attack techniques of choice.

Recent attacks include SQL Injection, PHP Local File Include, password reuse, denial of service and malware. Attackers compromise Web sites directly by exploiting application vulnerability. Later they use stolen account credentials from one system to compromise others or knock them offline with a mountain of network traffic. Attackers will also target corporate employees directly, primarily via email or social networks, by sending them a piece of malicious software and convincing them to install it. The common denominator is that legacy network security and “best-practice” defenses are powerless here.

>None of the attack techniques should be considered ‘sophisticated’ by modern standards

We’ve known about SQL Injection, PHP Local File Include, and Denial of Service attacks for years and there is nothing technical about these we haven’t seen a thousand times before – with the exception of Stuxnet. Also, the techniques used by malicious hackers whose behavior is primarily for personal entertainment, which are best viewed as canaries in the coal mine, are the very same techniques used by profit motivated cyber criminals and of those that are nation-state sponsored. It is the latter of the two groups that we should be most concerned about, because when they succeed, they don’t advertise their successes. We have no idea how many similar breaches are currently going unnoticed.

>Like it or not, everyone gets a free penetration-test by the bad guys, so hack yourself first.

This is especially important for those who are a ‘target of choice’ with large Internet-accessible attack surfaces and plenty of them. Find your websites, identify what you are vulnerable to, prioritize fixes and then strategize an effective software security program.

>If you want to improve something, measure it.

Almost anything that can be measured tends to improve over time. This could include the number of vulnerabilities development groups are introducing into your websites every month, the speed at which issues that do slip through QA are fixed or how many days of the year a particular system is exposed to something serious. Having access to timely, accurate, informative and trend-driven data allows for more intelligent decision making, which can make the difference in being a headline or not.

2011 appears to be a turning point in IT security, where yesterday’s best-practices, products and services that dominate the budget line-items are being publicly humiliated by today’s attackers as ineffective and a mis-allocation of resources. Throwing more firewalls and SSL won’t help; this is a software issue, not a network security problem. While these products were effective in the past, they have effectively pushed the attackers to focus on an area outside their coverage zone: Web sites. And the resulting resistance to new security measure allocation shows just how woefully inadequate these systems are in securing a company against the continuous threat of website attacks.

Defense against the latest attack trends requires a new way of thinking that allows IT security to be treated as a strategic business initiative. The castle and moat model is broken. Our experience tells us that security is by no means mandatory, but then again survival is also optional.

Jeremiah Grossman is CTO of WhiteHat Security.

8 Steps To Keep Your PCs Safe From Online Criminals

2011-11-13T23:37:00.000+05:30

By Mike Cote
Mike Cote is vice president at Dell Secureworks.

Mike Cote

With the diversity of security attacks globally, it is becoming increasingly difficult and complex for small and medium-sized businesses to assemble the right in-house resources to protect themselves against the cyber threats they face, whether it’s a data breach through the network, data leakage by employees, or lost laptops or mobile devices. We have also seen an uptick in the number of court cases, where SMBs have had six-figure amounts stolen out of their bank account by cyber thieves. The liability for these breaches is being shifted to the CIOs and IT managers, as SMBs are being accused of not taking the appropriate precautions to protect their data. The need for comprehensive information security is more pressing now than ever before.

According to estimates, cybercrooks are stealing as much as $1 billion a year from SMBs in the U.S. and Europe. One startling example of the effects of increased security liability for SMBs lies with a small, family-owned construction company in Maine, PATCO Construction. PATCO was victim to a cybercrime that cost the company half a million dollars in 2009. While the bank was able to recover about $150,000, the construction company sued the bank for the remaining $350,000. In May 2011, the court ruled in favor of the bank, claiming that the bank followed Federal Financial Institutions Examination Council guidelines set in 2005 for multi-factor authentication for online banking, leaving PATCO unable to recover the hundreds of thousands of dollars lost.

A single financial attack could put a smaller company out of business or irrevocably cut into annual profits for a medium-sized business. The implications of a financial breach can be a matter of life or death for SMBs.

Ensuring that organizations not only have the right network security solutions in place but have implemented comprehensive endpoint security is important to defending against the current and emerging cyber threats. This is especially relevant as we have seen hackers move from attacking the network to attacking the PC. Organizations should reevaluate their current security precautions on a regular basis and make sure these measures are communicated company-wide.

Here are 8 simple steps to help protect financial data and minimize risk:
1. Use a dedicated computer for financial matters such as online banking and bill pay. That computer should not be used for extraneous activities such as sending and receiving emails or surfing the Web. Web exploits and malicious email are two key infection vectors for malware.
2. Avoid clicking on links or attachments within emails from untrusted sources. Even if you recognize the sender, if an attachment is unexpected or looks suspicious, you should confirm that the sender has sent the specific email before clicking on any links or attachments.
3. Reconcile your banking statements on a regular basis with online banking and/or credit-card activity to immediately identify abnormal transactions that may indicate account takeover.
4. Advise your employees against visiting small, hosted websites that feature community forums for hobbies involving sports, computer games, etc. These small community forums are often hosted by Internet Service Providers which are not diligent about securing their hosted websites.
5. If you are visiting a website and are not sure if it has been secured from viruses, observe the quality of the site. Watch out if the site appears to be quickly put together and is not sophisticated or has a disclaimer that warns browse at your own risk and indicates the authors are not liable for any information you might see on the site
6. Make sure you have your security protections in place throughout the organization and install regular updates for your applications and for your computer’s operating system.
7. Be cautious about installing software (especially software that is too good to be true – e.g. download accelerators, spyware removal tools, etc.), and be cautious of pop-ups from websites asking users to download/execute/or run otherwise privileged operations. Often this free software and these pop-ups have malware embedded.
8. Do your homework before selecting an anti-virus vendor, ensuring that they not only provide coverage for the key threats but also respond quickly with protections when new ones are introduced. Invest in an anti-virus product instead of using “trial versions” as your source of protection.Trial versions of anti-virus products are good for testing products but they do not receive updates, so any new virus that is introduced after the trial version was released will have total access to your PC.
The bottom line: It’s much more expensive to deal with the consequences of a financial breach than it is to prevent one. Don’t wait until the last minute to find out just how essential it is and start putting your security precautions into place before it’s too late.

Homes & Small Businesses Network security tips

2011-11-12T19:23:00.000+05:30

A basic firewall or a unified threat management system.
For Windows users, basic Antivirus software. An anti-spyware program would also be a good idea. There are many other types of antivirus or anti-spyware programs out there to be considered.
When using a wireless connection, use a robust password. Also try to use the strongest security supported by your wireless devices, such as WPA2 with AES encryption.
If using Wireless: Change the default SSID network name, also disable SSID Broadcast; as this function is unnecessary for home use. (However, many security experts consider this to be relatively useless).[5]
Enable MAC Address filtering to keep track of all home network MAC devices connecting to your router.
Assign STATIC IP addresses to network devices.
Disable ICMP ping on router.
Review router or firewall logs to help identify abnormal network connections or traffic to the Internet.
Use passwords for all accounts.
For Windows users, Have multiple accounts per family member and use non-administrative accounts for day-to-day activities.
Disable the guest account[citation needed]
Raise awareness about information security to children

Want to Enable GodMode in Windows 7? Here's how !!!

2011-11-11T08:32:00.000+05:30

I thought this was a joke when I read it, but evidently not. If you want a quick way to get to all the settings on Windows 7 at a SINGLE PLACE.
Then.
GodMode is a great trick that allows you to access all Windows 7 configuration options from one location.
Windows 7 users are all abuzz about the OS and its GodMode. If you haven't heard of it, GodMode is a feature that was revealed by CNet's Microsoft Correspondent, Ina Fried. GodMode is a folder that brings together a long list of customization settings allowing you to change all your settings from one place. Neat huh? It's very easy to enable and damn useful if you tweak things around a lot.

I've broken it down into five-step process to avoid confusion:

Step 1: Right click.

Step 2: Click create folder.

Step 3: Rename Name your folder this to :-
GODMOD.{ED7BA470-8E54-465E-825C-99712043E01C}

Step 4: Blink as the folder changes form to look like the control panel.

How Encryption Works

2011-11-10T19:54:00.000+05:30

When we use the Internet, we're not always just clicking around and passively taking in information, such as reading news articles or blog posts -- a great deal of our time online involves sending others our own information. Ordering something over the Internet, whether it's a book, a CD or anything else from an online vendor, or signing up for an online account, requires entering in a good deal of sensitive personal information. A typical transaction might include not only our names, e-mail addresses and physical address and phone number, but also passwords and personal identification numbers (PINs).

The incredible growth of the Internet has excited businesses and consumers alike with its promise of changing the way we live and work. It's extremely easy to buy and sell goods all over the world while sitting in front of a laptop. But security is a major concern on the Internet, especially when you're using it to send sensitive information between parties.

Let's face it, there's a whole lot of information that we don't want other people to see, such as:

Credit-card information
Social Security numbers
Private correspondence
Personal details
Sensitive company information
Bank-account information

Information security is provided on computers and over the Internet by a variety of methods. A simple but straightforward security method is to only keep sensitive information on removable storage media like portable flash memory drives or external hard drives. But the most popular forms of security all rely on encryption, the process of encoding information in such a way that only the person (or computer) with the key can decode it.

In this article, you will learn about encryption and authentication. You will also learn about public-key and symmetric-key systems, as well as hash algorithms.

5 Tips to Improve Your Wireless Connection

2011-11-10T09:51:00.000+05:30

Wireless technology makes it easy to get rid of the cables and take computing away from the desk. It's becoming the household norm, and while the technology is advancing quickly, there are some easy things you can do to improve your own wireless connectivity.

1: Position Your Router

2: Replace your Antenna

3: Get a Repeater

4: Get an Antenna Booster

5: Upgrade Firmware

1: Position Your Router

A wireless signal doesn't carry far, and any walls or large objects may cause interference. For this reason, a wireless router should be centrally located in your home to insure the best range possible. Place the router on a flat surface off the floor and away from obstructions. Additionally, there could be interference from a neighboring wireless signal. Make sure that you're using a unique wireless channel to limit interference.

2: Replace your Antenna

The antennas shipped with most routers are small antennas with omni-directional capabilities. These antennas broadcast a signal in all directions, which can be useful if you need wireless throughout your house, but the range is quite short. A directional antenna can improve range by focusing the signal in a specific way, allowing you to aim it where it's needed. These antennas are often called "high-gain" and the signal increase is measured in decibels (dB).

3: Get a Repeater

A wireless repeater is the easy and safe way to boost your signal. A repeater works very much like a router, but instead of creating a signal, it relays an existing signal. A repeater is easy to install and doesn't require any additional wires or connections. Multiple repeaters make it easy to create a home or business network with complete connectivity.

4: Get an Antenna Booster

It's possible to make a homemade reflector or antenna to improve your wireless signal. There are templates and building instructions on many Web sites across the internet to use materials as commonplace as foil and cardboard. Common designs are a parabolic satellite shape and a "coffee can" yagi antenna. Both can increase range and direct your signal, though homemade quality will vary.

5: Upgrade Firmware

Router manufacturers publish firmware updates regularly and upgrading your router can provide a performance boost and access to new features. Another option for the tech savvy is to install third-party firmware. There are a number of free, safe alternatives that may be compatible with your router. One project, DD-WRT, offers more robust features than many of the official firmware packages.

Using these tips, you should be able to squeeze every bit of connectivity out of your own home network.

How to Detect if Someone's Stealing Your WiFi

2011-11-09T18:39:00.000+05:30

Okay, it's time to get down to it. Is your wireless network running slowly? Do you have intermittent losses in Internet access and you can't figure out why? Chances are, you've already detected a WiFi squatter and didn't even know it. If you regularly experience these problems, maybe you have something wrong with your wireless connection. But if you're suddenly having intermittent problems with your Internet performance, especially at the same time each day, it's a red flag that someone is piggybacking off your wireless connection and it's time for you to diagnose your WiFi network.

The first and simplest thing you can do is check out your wireless network connection and see if it's secure. When you install your router, you're given the option of setting a wireless encryption protocol (WEP) key. Basically this is a password-protected method for you to log on to your own wireless network. If you don't have one, you're operating an open network. That means anyone within range can use your wireless for free. While it's not hacking, it is debatable as to whether this is actually stealing. In any case, if you don't have a WEP key, you're vulnerable to WiFi squatting and certainly not deterring squatters.
Even if you have a WEP key, that doesn't necessarily mean your neighbor hasn't bypassed it. To determine if he or she is logging onto your wireless network, you can do so by checking your wireless network log. To do this, click your Start Menu in Microsoft Windows, then double-click My Network Places. Next, double-click View Entire Network. If there are more devices connected than you have allowed on your network, you have WiFi thieves.
A similar method to determining the status of your WiFi user list is to check your router's DHCP client table. Much like viewing your network, your DHCP client table will list the machines on your network. If the number exceeds what you've set up, you have someone stealing your WiFi.
Nobody wants to be taken advantage of. What's more, you certainly don't want illegal information flowing through your wireless network. That's why you need to take matters in your own hands. The final section will give you the power to thwart off Internet thieves and protect your wireless connection. Are you ready to fight back? Turn the page to learn how.

Stopping Digital Thieves

A WEP key is an absolute must for any wireless network; however, even those are vulnerable. While WEP protection will stop the guy parking in front of your house, it may not stop a more determined user like your neighbor. In that case, you can use a security protocol such as WiFi protected access (WPA). This route is more secure but can still be hacked by a determined WiFi thief.

You can also use manual DHCP assignment. To do this, simply set your router's DHCP to the manual setting and enter in each of your computer's physical addresses. This will restrict your network to allow only those computers recognized by the router.

If the manual DHCP route isn't comfortable for your level of computer expertise, you may want to consider generating a MAC access list which usually can be created through the browser interface of the router. Unfortunately, MAC address lists can also be bypassed by savvy WiFi thieves; nevertheless, when used in conjunction with other security methods, they're probably enough on a small home network.

Internet monitoring software is also a viable option. Monitoring software will walk you through some of these methods and is user friendly for those who aren't as comfortable setting up wireless security methods. In addition, monitoring software makes it easy to see what is going on with your wireless connection. Your WiFi router may have some built-in software that will help you monitor your network. Explore the user guide and help section to see if there's a built-in application that will help.

Finally, turn off your router's SSID broadcasting. This effectively makes your network invisible. It's much harder to steal WiFi from a network that doesn't appear on anyone's radar.

Next time you suspect WiFi theft, peek out the front window and see if an unfamiliar car is parked in front of or close to your home. If so, you'll probably find someone in the car sapping your Internet. It sounds simple, but it could be just that easy to determine if someone is stealing your WiFi.

10 Worst Computer Viruses of All Time

2011-11-09T17:05:00.000+05:30

Computer viruses can be a nightmare. Some can wipe out the information on a hard drive, tie up traffic on a computer network for hours, turn an innocent machine into a zombie and replicate and send themselves to other computers. If you've never had a machine fall victim to a computer virus, you may wonder what the fuss is about. But the concern is understandable -- according to Consumer Reports, computer viruses helped contribute to $8.5 billion in consumer losses in 2008 [source: MarketWatch]. Computer viruses are just one kind of online threat, but they're arguably the best known of the bunch.

Computer viruses have been around for many years. In fact, in 1949, a scientist named John von Neumann theorized that a self-replicated program was possible [source: Krebs]. The computer industry wasn't even a decade old, and already someone had figured out how to throw a monkey wrench into the figurative gears. But it took a few decades before programmers known as hackers began to build computer viruses.
While some pranksters created virus-like programs for large computer systems, it was really the introduction of the personal computer that brought computer viruses to the public's attention. A doctoral student named Fred Cohen was the first to describe self-replicating programs designed to modify computers as viruses. The name has stuck ever since.
In the good old days (i.e., the early 1980s), viruses depended on humans to do the hard work of spreading the virus to other computers. A hacker would save the virus to disks and then distribute the disks to other people. It wasn't until modems became common that virus transmission became a real problem. Today when we think of a computer virus, we usually imagine something that transmits itself via the Internet. It might infect computers through e-mail messages or corrupted Web links. Programs like these can spread much faster than the earliest computer viruses.
We're going to take a look at 10 of the worst computer viruses to cripple a computer system. Let's start with the Melissa virus.

Melissa

ILOVEYOU

The Klez Virus

Code Red and Code Red II

Nimda

SQL Slammer/Sapphire

MyDoom

Sasser and Netsky

Leap-A/Oompa-A

Storm Worm (The latest virus on list)

Famous Hackers

2011-11-09T12:25:00.000+05:30

Steve Jobs and Steve Wozniak

Steve Jobs and Steve Wozniak, founders of Apple Computers, were both hackers. Some of their early exploits even resembled the questionable activities of some malicious hackers. However, both Jobs and Wozniak outgrew their malicious behavior and began concentrating on creating computer hardware and software. Their efforts helped usher in the age of the personal computer -- before Apple, computer systems remained the property of large corporations, too expensive and cumbersome for average consumers.

Linus Torvalds, creator of Linux, is another famous honest hacker. Hisopen source operating system is very popular with other hackers. He has helped promote the concept of open source software, showing that when you open information up to everyone, you can reap amazing benefits.

Richard Stallman, also known as "rms," founded the GNU Project, a free operating system. He promotes the concept of free software and computer access. He works with organizations like the Free Software Foundation and opposes policies like Digital Rights Management.

On the other end of the spectrum are the black hats of the hacking world. At the age of 16, Jonathan James became the first juvenile hacker to get sent to prison. He committed computer intrusions on some very high-profile victims, including NASA and a Defense Threat Reduction Agency server. Online, Jonathan used the nickname (called a handle) "c0mrade." Originally sentenced to house arrest, James was sent to prison when he violated parole.

Kevin Mitnick

Kevin Mitnick gained notoriety in the 1980s as a hacker who allegedly broke into the North American Aerospace Defense Command (NORAD) when he was 17 years old. Mitnick's reputation seemed to grow with every retelling of his exploits, eventually leading to the rumor that Mitnick had made the FBI's Most Wanted list. In reality, Mitnick was arrested several times for hacking into secure systems, usually to gain access to powerful computer software.

Kevin Poulsen, or Dark Dante, specialized in hacking phonesystems. He's famous for hacking the phones of a radio station called KIIS-FM. Poulsen's hack allowed only calls originating from his house to make it through to the station, allowing him to win in various radio contests. Since then, he has turned over a new leaf, and now he's famous for being a senior editor at Wired magazine.

Adrian Lamo hacked into computer systems using computers at libraries and Internet cafes. He would explore high-profile systems for security flaws, exploit the flaws to hack into the system, and then send a message to the corresponding company, letting them know about the security flaw. Unfortunately for Lamo, he was doing this on his own time rather than as a paid consultant -- his activities were illegal. He also snooped around a lot, reading sensitive information and giving himself access to confidential material. He was caught after breaking into the computer system belonging to the New York Times.

It's likely that there are thousands of hackers active online today, but an accurate count is impossible. Many hackers don't really know what they are doing -- they're just using dangerous tools they don't completely understand. Others know what they're doing so well that they can slip in and out of systems without anyone ever knowing.

How to Secure Your Home Network

2011-11-09T11:53:00.000+05:30

We've been treated to some pretty entertaining feats of espionage courtesy of Hollywood. Who can forget the way Tom Cruise dangled from the ceiling as he attempted to crack into a computer security system in "Mission Impossible?" Or how about the mysterioushacker who seems to slip past every security to corrupt the Rossum Corporation's data in the "Dollhouse" television series? Hacking into a network must require superhuman skills and knowledge, right?

You might be surprised to learn how easy it is for someone to hack into a computer network. The fact is that many computer networks are practically defenseless to intruders. In the early days of home computer networks, the people who put the networks together were experts and enthusiasts. They put their systems together knowing how computers can communicate with each other and built in protective measures to prevent other computer users from snooping.

Today, home computer networks are popular among a broad range of consumers. User knowledge spans from expert to newbie. Some users may be unaware of the dangers they can encounter if they don't properly secure their network. Others may think home network security is too complicated or confusing. But network security is more important than ever and it's worth the effort to learn more about it.

An unprotected network could allow malicious hackers -- known as crackers -- access to your data. It might even allow someone to take control of your computers and use them to commit crimes like a distributed denial of service attack (DDoS). Even if no one snoops on your information or controls your computer, someone might use your network to access the Internet. As more ISPs begin to place caps on how much data you can download, it becomes even more important to control your network. You don't want to get slapped with a huge bill for Internet services you didn't even use.

With the right tools and knowledge, you can minimize your chances of having your security compromised by malicious hackers or computer viruses. Let's get started.

How Hackers Work

2011-11-09T11:41:00.000+05:30

Thanks to the media, the word "hacker" has gotten a bad reputation. The word summons up thoughts of malicious computerusers finding new ways to harass people, defraud corporations, steal information and maybe evendestroy the economy or start a war by infiltrating military computer systems. While there's no denying that there are hackers out there with bad intentions, they make up only a small percentage of the hacker community.

The term computer hacker first showed up in the mid-1960s. A hacker was a programmer -- someone who hacked out computer code. Hackers were visionaries who could see new ways to use computers, creating programs that no one else could conceive. They were the pioneers of the computer industry, building everything from small applications to operating systems. In this sense, people like Bill Gates, Steve Jobs and Steve Wozniak were all hackers -- they saw the potential of what computers could do and created ways to achieve that potential.

A unifying trait among these hackers was a strong sense of curiosity, sometimes bordering on obsession. These hackers prided themselves on not only their ability to create new programs, but also to learn how other programs and systems worked. When a program had a bug -- a section of bad code that prevented the program from working properly -- hackers would often create and distribute small sections of code calledpatches to fix the problem. Some managed to land a job that leveraged their skills, getting paid for what they'd happily do for free.

As computers evolved, computer engineers began to network individual machines together into a system. Soon, the term hacker had a new meaning -- a person using computers to explore a network to which he or she didn't belong. Usually hackers didn't have any malicious intent. They just wanted to know how computer networks worked and saw any barrier between them and that knowledge as a challenge.

In fact, that's still the case today. While there are plenty of stories about malicious hackers sabotaging computer systems, infiltrating networks and spreading computer viruses, most hackers are just curious -- they want to know all the intricacies of the computer world. Some use their knowledge to help corporations and governments construct better security measures. Others might use their skills for more unethical endeavors.

In this article, we'll explore common techniques hackers use to infiltrate systems. We'll examine hacker culture and the various kinds of hackers as well as learn about famous hackers, some of whom have run afoul of the law.

How Trojan Horses Work

2011-11-09T11:29:00.000+05:30

One of the most enduring stories of the Trojan War, the most important conflict in Greek mythology, is the tale of the Trojan horse. Trying to find a way into the city of Troy, the great warrior Odysseus ordered his men to build a massive wooden horse, one big enough for several Greek soldiers to fit in. Once the structure was finished, he and several other warriors climbed inside, while the rest of the Greeks sailed away from Troy. One man named Sinon, however, stayed behind in order to deceive the Trojans, convincing them that his fellow Greeks had betrayed him and fled from the city. The wooden horse, he told the Trojans, was safe and would bring them luck.

After some discussion over the matter, the Trojans agreed to wheel the horse through their gates, unknowingly giving the Greek enemy access to the city. After proclaiming victory and partying all night, the citizens of Troy went to sleep -- it was then that Odysseus and his men crept out of the Trojan horse and wreaked havoc on the city.
Video Trojan Horses Working exploitation. click here

Although you've probably heard of the Trojan horse from Greek mythology, chances are you've also heard of Trojan horses in reference to computers. Trojan horses are common but dangerous programs that hide within other seemingly harmless programs. They work the same way the ancient Trojan horse did: Once they're installed, the program will infect other files throughout your system and potentially wreak havoc on your computer. They can even send important information from your computer over the Internet to the developer of the virus. The developer can then essentially control your computer, slowing your system's activity or causing your machine to crash.

Though they're not actually viruses, they're referred to as "Trojan horse viruses," "Trojan viruses," "Trojan horses" or just plain "Trojans." Regardless of what people call them, they all mean same thing. But what happened? How did you let this Trojan horse into your computer in the first place? And what can you do stop one from getting in?

N TECH NETWORK SECURITY

How to help your kids use social websites more safely

Protect your privacy on the Internet

Port Control Protocol (PCP) Security

Multifunctional malware, staged drive-by attacks to rise in 2012

Cybersecurity career experts: Mobile app security skills hot in 2012

New Network Security Challenges for 2012 Happy New Year

How to avoid a costly mistake on a Christmas Eve

Internet Security for Christmas Presents

Working from home, is your office data security compromised?

Network Anomaly Detection using Soft Computing

CA-2001-22 W32/Sircam Malicious Code

Original release date: July 25, 2001

Systems Affected

Overview

I. Description

Propagation Via Email

Propagation Via Network Shares

Infection process

II. Impact

III. Solution

Run and Maintain an Anti-Virus Product

Exercise Caution When Opening Attachments

Filter the Email or use a Firewall

Appendix A. - Vendor Information

Aladdin Knowledge Systems

Central Command, Inc.

Command Software Systems

Computer Associates

Data Fellows Corp

McAfee

Norman Data Defense Systems

Panda Software

Proland Software

Sophos

Symantec

Trend Micro

Computer security risks to home users

Steam hack confirmed by Valve game company

7 Things You Need To Know About Recent Web Hack Attacks

8 Steps To Keep Your PCs Safe From Online Criminals

Homes & Small Businesses Network security tips

Want to Enable GodMode in Windows 7? Here's how !!!

How Encryption Works

5 Tips to Improve Your Wireless Connection

1: Position Your Router

2: Replace your Antenna

3: Get a Repeater

4: Get an Antenna Booster

5: Upgrade Firmware

1: Position Your Router

2: Replace your Antenna

3: Get a Repeater

4: Get an Antenna Booster

5: Upgrade Firmware

How to Detect if Someone's Stealing Your WiFi

Stopping Digital Thieves

10 Worst Computer Viruses of All Time

Famous Hackers

How to Secure Your Home Network

How Hackers Work

How Trojan Horses Work