Security With Norfect

Computer Security Jokes - 4

2022-05-15T13:47:00.001+03:00

SolarWinds Hack to Signal a new form of Warfare?

2020-12-18T13:47:00.009+02:00

The list keeps on growing... The new war. The new espionage. Call it what you will, but this was not a simple attack.

It started by manipulating SolarWinds Orion system updates hackers (state sponsored hackers, i.e. cyber warfare). This updated version allowed the hackers to access any of the servers which hosted the SolarWinds application, which is an IT monitoring and management tool used by administrators and network engineers. This allowed the hackers to have full administrator access to at least one server inside the victim's network, and download any additional malware they needed to get full access of the victims' networks. To set things in perspective, hackers breached the US nuclear weapons agency.

Source: Microsoft

The list of victims is huge. Till now, 40+ major companies or government departments and agencies have been identified. I expected the final number to reach at least a 100+ hi-profile victims. Hackers had around 9 months to do whatever they wanted without being caught. 80% of which are located in the United States, with the rest being spread across seven other countries —namely Canada, Mexico, Belgium, Spain, the UK, Israel, and the UAE.

Companies breached so far:

- Microsoft
- SolarWinds
- Fireeye

Main US targets:

- The US Treasury Department
- The US Department of Commerce's National Telecommunications and Information Administration (NTIA)
- The Department of Health's National Institutes of Health (NIH)
- The Cybersecurity and Infrastructure Agency (CISA)
- The Department of Homeland Security (DHS)
- The US Department of State
- The National Nuclear Security Administration (NNSA)
- The US Department of Energy (DOE)
- Three US states
- City of Austin (also disclosed today)

While not the first attack of its kind, the fact that we are still at the tip of the iceberg in discovering the scale is worrisome. The types of victims, the amount of data that could have been stolen during a 9-month breach, and the fact that it is a state sponsored attack all indicate that the new wars will be fought online as well as with real weapons.

Finally, so many questions come to mind, and I am sure those would be answered within the coming days:

How did the hackers bypass all internal SolarWinds controls, application controls and Quality Assurance to publish such a malicious update.
How were they left undetected for 9 months.
How many companies have been really breached and what type of data has been stolen
What long lasting impact will this have on the cyber world, how can we ensure that software installed on our infrastructure is secure?
Will the US retaliate?

Passwords.... Passwords

2020-09-09T12:51:00.003+03:00

How long would it take to crack your password? This simple table explains it all!

Warning: A Google Drive 'Feature' Could Let Attackers Trick You Into Installing Malware

2020-08-22T16:32:00.000+03:00

An unpatched security weakness in Google Drive could be exploited by malware attackers to distribute malicious files disguised as legitimate documents or images, enabling bad actors to perform spear-phishing attacks comparatively with a high success rate.

The latest security issue—of which Google is aware but, unfortunately, left unpatched—resides in the "manage versions" functionality offered by Google Drive that allows users to upload and manage different versions of a file, as well as in the way its interface provides a new version of the files to the users.

For more info, https://thehackernews.com/2020/08/google-drive-file-versions.html

Steps for a Good Vulnerability Program

2020-08-21T19:38:00.003+03:00

Source: https://secureops.com/

So.... I'm back......

2018-12-03T22:52:00.003+02:00

Looks like I'm back. 4 years and a half since my last post.... I'm back.

A lot has changed since then. On a personal level and on a bigger scale. Infosec and hacking have become on everybody's lips. So many hacks. So many issues. So many breaches and yes..... GDPR. GDPR everywhere.

Well..... This won't be a long post. I'll just leave you with this:

Companies to blame as much as end users!

2014-08-07T22:40:00.000+03:00

People always ask me why it’s so easy to hack into their emails, get their accounts on Facebook or have their credit card data stolen. I usually always focus on end users. This post is about the programmers, the developers and companies which we “trust” with all our data.

Why am I writing this post? Well two days ago I was reading about how Mozilla (of FireFox browser) “accidentally” leaked 76,000 email addresses and 4,000 passwords! PF Chang was hacked for 8 months, until finally thought OOOPS we just realized. Domino’s Pizza was hacked.

When computers were being developed, no one had security in mind. When the internet was created, no one thought about security. Security came as an afterthought, years and years after people started using computers, programs and the internet. So when cyber criminals decided to cash in, a new domain called information security was created, and the game of cat and mouse started. Cyber criminals always have the upper hand, and security professionals are always running behind to fix the holes.

Almost in all situations, the problem in any security flow starts from the programmer(s) who design and write code. When programming languages were created, many security flows existed. Even though those flows are always being fixed, programmers are under a lot of pressure to finish their work in record time. They are barely given time to test a program let alone check it for security flows. What used to be an issue with lack of security knowledge has now transformed into an issue with management. Get the program out as soon as possible is what’s important; you can fix the problems later.

I used to think that since I live in a third-world country, it was an issue with companies in this country. I truly believed that in advanced countries, security is a prime concern and that the whole system would not allow for such flows. The more I read about the topic, and got interested in it, the more I realized that it’s a universal problem. How many “top” companies had defected products, systems hacked and passwords stolen?

The idea is that it is impossible to secure systems/website unless you don’t want to use them; that is have them inaccessible by anyone. Any other way? No!. The closest is having a dedicated security team of at least a 100 employees (which should all be competent)… Having the management on the security wagon. Programmers, network people and server people all sufficiently trained and believing in what it takes to secure the system. Only then would you have a chance of being partially secure.

Back to the initial question… Why is it easy to hack into our data… Well it’s because even if you do whatever you can do from your end as an end-user, and follow every single guideline… It’s still not in your hands! The truth is that many people working in the cyber world are incompetent, unhappy, pressured or just not interested. As long as we are playing the cat and mouse game, we will always be the losers. Security has to be part of any design of the future of internet… Not just a simple afterthought.

How well do you know your security?

2014-06-21T00:02:00.003+03:00

Quizzes by Quibblo.com

2014 Norfect Security Predictions!!!

2014-01-10T00:06:00.000+02:00

It's a new year and it's time for Norfect's 2014 security predictions.... You can run away now!

But before that, a small message to my amazing wife. HAPPY BIRTHDAY! My life would mean nothing without you by my side.

So without further ado, here are my predictions!

1. Many house users, corporations and websites will be attacked by new vulnerabilities found in Windows XP, Office 2003, and Java 6. You see, support and security patches will be suspended for these products in 2014 as they have reached their end of support life cycle. This means anyone using these products won't be able to patch any newly found vulnerabilities. Can you guess who will benefit most?

2. Hackers will increase the use of ransom-ware. They will attack end-users and corporations in order to get easy money to use elsewhere. It will be "fast money" used for other bigger breaches.

3. Which gets us to the prediction that major data breaches will increase significantly. At the end of 2013, not a month passed without at least 1 million user ID and password were hacked from known companies. In 2014, even more world-wide companies will be hacked. More usernames and passwords will be published online.

4. Due to the whistle-blowing actions of Edward Snowden, more and more people will be aware about their online privacy. Users will have less trust in the internet because anything they do can and is being traced by governments. Web activists will be pushing towards an internet reform.

5. Corporate mobile devices will be targeted by specific malware to gather sensitive data/emails. Many of these malware will be left undetected for a long period of time. Antiviruses for mobiles in my opinion are still pretty weak with many false positives that make you ignore real threats.

6. With more and more people storing information on the cloud, at least one major cloud storage provider will be hacked and millions of terrabytes of user data will be exposed.

7. Attacks will become more personalized. The attackers will spend more time focusing on their targets to be able to craft personalized attacks via emails or the social network.

And that's the end folks! What are your predictions?

Computer Security Jokes ~ 3

2013-12-22T21:44:00.001+02:00

Since it's been a long while and I am not having much time to blog since my second son was born, though I'd just share a few new jokes I've come across over the internet! Enjoy

Legitimate it is ....

Trust me, best source of complex passwords!

Finally, the smartest :p

Two-factor Authentication .... Microsoft/Outlook

2013-06-17T23:35:00.004+03:00

Update: Changed the post title from : "A Simple Way to Keep Your Hackers Away" to better reflect the content.

So I’ve been away since a long time. Blame George RR Martin’s A Song of Ice and Fire. That thing is pure genius it makes you forget everything else!

(Ok that and I’ve been really busy lately)

Oh well, I keep on hearing from my friends and relatives at least monthly that someone hacked their accounts, be it an email, Facebook, blog, Twitter, LinkedIn… and it really sucks. I’m sure you've already read or heard about it, that’s not why I’m writing this post.

To be honest, I am very careful and try my best to protect my accounts. To do that, I have to use whatever capabilities the companies I'm registered at provide me. We all know that usernames and passwords are the way we prove to a site that we are the owners of that account. That’s not enough, and it’s easily hacked by anyone who really puts his mind to it.

Hence, I have decided to use two-factor authentication for all my critical accounts. This post and the next ones will be about setting up and testing the two-factor authentication for the major companies out there. I already have two-factor authentication enabled for my main Google/Gmail account, so this post will be to enable it for my main Microsoft/Outlook (ex-Hotmail) account. The next will be about Google/Gmail.

Hold on a minute….WHAT IS TWO-FACTOR AUTHENTICATION???

Two-factor authentication is basically adding an extra layer to the password. The password is effectively something a person “knows”. The second layer would be something a person “owns”, for example, a code sent to his mobile phone. This would make hacking into your account very tough… Even if the hacker gets your password, he won’t be able to log in without having your mobile phone.

Very smart yet very simple.

So back to my Microsoft two-factor authentication experiment. I will illustrate it via images, and any explanations will be included in captions.

After Logging into outlook, press your name and then account settings

Press Edit Security Info

Microsoft double checks that it is truly you accessing your security info

After receiving the code on your alternate email, add it here. If you do not have an alternate email, create one asap. It is very useful when/if you lose your password.

The email received from Microsoft for double checking. To be honest, it looks fishy (phishing), yet it is legitimate!

After inputting the code, you reach this screen. Press "set up two-step verification"

After activation, Microsoft explains that some of your accounts might require special permission to be able to access your accounts.

Extra info on setting up your devices and applications.

http://windows.microsoft.com/en-us/windows/app-passwords-two-step-verification

Seems pretty easy… Just a few clicks to enable my two-factor authentication.

Note: You have to follow the steps in the link in the last picture to enable easy access to your account via your phone.

Please do comment below and provide me with your feedback in case you decide to go ahead with enabling two-factor authentication. Next post, Google/Gmail Two-factor authentication!!!!

Want to click? Think again…

2013-02-17T19:31:00.002+02:00

How many times have you received an email like the one above? Or an email from your friendly FedEx informing you that your parcel was not delivered… What about an email from Facebook or LinkedIn or Hotmail or any other site that asks you to press links to view messages or invitations?

It pays to think… Thinking before clicking would save you, your PC and most probably the company you work in a lot of hassle. Why you ask???… Simple.

Let me explain. The easiest way these days is to attack any PC via the human interaction element. Why should the hackers bother with spending hundreds of hours to find a possible opening when we the users present them with the easiest path?

Those hackers infect one or two sites with malware. Then they send mass (or targeted) emails like the ones mentioned above. One click without thinking and BAAAAM! You’re their prey. They’d have almost unstoppable access to your PC.

During the last month alone, such a technique was used to attack Twitter, FaceboDuring the last month alone, such a technique was used to
attack Twitter, Facebook, New York Times and Wall Street Journal.

To make things worse, there are major flaws in the software we use. Java had a major security flaw that was being used to exploit the companies mentioned above. Now, Adobe PDF reader has a major flaw. Hint… DO NOT OPEN THOSE PDFs in emails you receive, especially if you do not know the sender… (More on that issue can be found on http://www.zdnet.com/dont-open-that-pdf-theres-an-adobe-reader-zero-day-on-the-loose-7000011241/?s_cid=e539)

Finally, I would like to mention a new initiative by the Lebanese government who has endorsed the importance of internet safety. The new site, www.e-aman.com contains very important tips for "National Internet Safety Lebanon". Keep up the good work!

Predictions... Norfect's 2013 Security Predictions

2013-01-02T22:23:00.002+02:00

So everyone is so busy reading 2013 predictions, and aligning their lives to whatever our lovely predictors are predicting… Here are Norfect's 2013 SECURITY predictions….

At the end of 2013, the most common passwords will remain the same. “password” will remain the mostly used password. It’s been on the top of the list since man created the concept of passwords, and we will keep on using it till man creates an alternate concept. It was still number 1 in 2012, and it will remain number 1 in 2013. For a list of the top 25 common passwords check http://gizmodo.com/5954372/the-25-most-popular-passwords-of-2012 . If yours is on the list, PAAALLLEEAASSSSEEE change it NOW!

Smart phones will be at more risk as we keep on integrating them into our lives. We will continue hearing horror stories of how insecure they are, how easy it is to hack into them, but will keep on using them more and more.

Apple will be under major security attacks, especially over their iOS. Hackers search for large markets, and Apple suits that bill perfectly. (Remember when everyone said Firefox was so secure no-one can attack it???)

Anonymous and other hacktivists (hackers with a cause) will occupy the headlines even more this year. More hacktivists will be caught and coordinate with police to catch other hacktivists to rescue their own lives. (Lesson to be learnt: Do NOT trust anyone over the internet)

We will hear more of cyber war, yet it will remain a “taboo” concept. It’s just a conspiracy theory most people will say… Until some major incident becomes public.

Bring your own device (BYOD) to work will be the next major risk for companies. Balancing between company provided phones vs. the employees own phone will be a major challenge.

Finally, the cloud (the use of computing resources (hardware and software) that are delivered as a service over a network (typically the Internet)) will face some major setbacks, with very well-known companies being attacked. This will only help in strengthening the cloud as the future of computing.

Those were my security predictions for the year 2013. Any feedback is well appreciated in the below comments section.

Who in Lebanon Has Your and My Passwords?

2012-12-06T22:17:00.002+02:00

Reading this week's news was majorly concerning. I couldn't believe what I was reading. You see, the "information section" of the Internal Security Forces (ISF) has requested access to view our:
1. LogFiles, including IP Address, Name, Addresses, Usernames, Passwords, and Phone Numbers.
2. All chat sessions and emails.
3. Contents of VOIP phone conversations, and the applications used in such conversations.
4. Names of applications downloaded and installed on the mobile phone.

WHAT!

A certain entity out there in Lebanon has ALL the above data about you and me and everyone (including politicians, imagine the things they might find there) in Lebanon. CAN YOU BELIEVE IT? And another entity is asking to be granted access to view all that data. That data includes any facebook accounts, hotmail/gmail/yahoo accounts.....

In this case (as per the above letter), the data is currently residing with MIC2 (as per my knowledge MTC). This most probably means that another request was sent to MIC1 (Alfa).

This post is not about discussing the request of the ISF or the political reasons behind it. That's the last of my worries. This post is to highlight the idea that our mobile companies have all the above listed data. I have no idea if our DSL providers also have that type of data or not... Had it not been revealed that this request was done, I for one would not have known that we have a big brother watching our every move. Believe it or not, I feel "violated". Where is my privacy? Where is my right of not being followed... I can understand that certain specific individuals under suspicion might have their calls and activity tapped, but that was the limit I had imagined.

A final thought to leave you with ... How are Alfa and MTC storing all that data requested by ISF? Are they secure enough or can they be stolen and used by entities/individuals other than the law enforcement. That would be scary...

Hoaxes... Stop Believing Them!!! (Hint: WHATSAPP!)

2012-11-30T21:58:00.000+02:00

So now the latest issue to haunt mobile users is that their favorite application Whatsapp will start becoming a paid application.

Here's the whole message

"Whatsapp is shutting down on 28th jan Message from Jim Balsamic (CEO of Whatsapp) we have had an over usage of user names on whatsapp Messenger. We are requesting all users to forward this message to their entire contact list. If you do not forward this message, we will take it as your account is invalid and it will be deleted within the next 48 hours. Please DO NOT ignore this message or whatsapp will no longer recognise your activation. If you wish to re-activate your account after it has been deleted, a charge of 25.00 will be added to your monthly bill. We are also aware of the issue involving the pictures updates not showing. We are working diligently at fixing this problem and it will be up and running as soon as possible. Thank you for your cooperation from the Whatsapp team..:)

FINAL WARNING!
If your WhatsApp status is error:status unavailable then you are not frequent user and by 5:00pm C.A.T WhatsApp will start charging you. To become a frequent user send this message to 10 people who receive it.."

SHOCK HORROR!!! OMG!!! What shall we do???

Relax guys. Remember Hotmail???

What about these from Facebook???

These are JUST hoaxes. I.e. it is NOT TRUE... Your favorite application will remain free and will remain alive. You don't believe me? Read this from the makers of Whatsapp:

“We have been getting a lot of emails and questions from you about a chain letter message circulating in our network. Please understand that this is a hoax and there is no truth to it.

“While we are flattered that we made it Hoax Slayer we would rather work on cool new features instead of debunking silly stories like these.”

So now that we all agree that this is a hoax, let's just agree on another thing. NO COMPANY will stop its services or turn into a paid service and inform its customers via a message asking them to send that message to X people. Whenever you see "forward this to 10 (or any number) of people OR ELSE ...." just ignore it. It is definitely a hoax. If the company plans to charge you, you will read about it in the news, business websites....

Viber blocked in Lebanon... Coming soon/Already Came

2012-11-25T23:15:00.001+02:00

Update #2: Appears that since almost beginning of the year, Viber on Alfa network is working again. Had to wait for a period of time before confirming. Seems like the ministry changed its mind after all.

Update: Please check Viber's official response below in the comments.

Yes... That's true. One day I was using viber to connect with my family abroad, the next day my viber status indicates "disconnected". I asked my friends to check if their viber was disconnected... Nopes. Theirs is working perfectly fine. Hmmm what's wrong?

I go back home, use my wireless, and bammm... it connects again. Sooo the issue has to do with my alfa line. Fair enough.. They have a problem I say to myself. Next day, same issue. I call alfa,...

Alfa: Viber is blocked in Lebanon
Me: May I know why?
Alfa: No. Ministry of communications has decided to block it.
Me: But I would like to know why.
Alfa: We cannot say.
Me: How come MTC and my DSL provider have not blocked it yet.
Alfa: They eventually will block it. Its the ministry's decision... It will be enforced.

Two days before the above, I received a newsletter linking to this article "ما لا تعرفونه عن برنامج المحادثات المجاني “Viber”!" : http://goo.gl/DLu4e . I linked the blockage on Viber to this news.

To cut the story short, it appears Viber is owned by an Israeli-American and its head quarters are in Cyprus, and concludes that since it is a free application and ad-free application, the only reason it was created was to "spy" on its users. The article discusses more reasons to question Viber.

This whole story made me think of two main things. The first is that a simple article in an online news site can lead to a decision from the ministry to block a major application that is used by hundreds of thousands in Lebanon to contact their dear ones.The ministry did not publish any reasons for this block, nor did it inform the Lebanese mobile users. I, as a user of the application, would like to know whether I was being spied on or not. Has the ministry done its research and confirmed the issue or is the blockage just based on rumors? I believe that we have the right to know.

Secondly and most importantly, and that's why this is posted on a security blog is to remind myself before others that all these applications we install on our phones should not be blindly trusted. We grant these applications access to our phone books, messages, instant messages, photos, location..... Can you imagine what one of those application creators could know about your life? Just a thought.

How To Detect and Remove Gauss Malware

2012-08-14T03:35:00.001+03:00

Just a quick post to update on the Gauss malware...

To check if your PC is infected, simply press on this link

http://gauss.crysys.hu/

then click on "click here for results"

In case your PC is infected, you can download the removal tool from Kaspersky for free from : https://support.kaspersky.com/viruses/avptool2011?level=2

New Cyber Malware Targetting Lebanon

2012-08-10T09:30:00.001+03:00

A new trojan, named Gauss is targetting the middle east and Lebanon specifically.

It is related to the stuxnet and flame malware previously discussed and is of the same nature. The trojan has been on the loose since september 2011... It currently can NOT send any information out of the infected pcs as its command center is dormant since july 2012. Yet no-one knows when it can go live again.

So far information is still limited, but the trojan seems to search directly for any information related to Bank of beirut, blom bank, byblos bank, citi bank, eblf and fransabank amongst other general searches like hotmail amd yahoo and facebook. This proves that the target ia mostly Lebanon.

Users with kaspersky antivirus can scan their systems to ensure that the trojan Has not infected their systems. Other antivirus companies have not yet published any news on whether they can detect the trojan or not.

I will update this blog with further information as soon as it is available.

Links:

http://www.guardian.co.uk/technology/2012/aug/09/stuxnet-gauss-virus-kaspersky

http://www.kaspersky.com/about/news/virus/2012/Kaspersky_Lab_and_ITU_Discover_Gauss_A_New_Complex_Cyber_Threat_Designed_to_Monitor_Online_Banking_Accounts

http://www.securelist.com/en/analysis/204792238/Gauss_Abnormal_Distribution

Beware the Flame

2012-05-30T00:05:00.001+03:00

Many people believe that cyber-war is a part of movies and conspiracy theories… Other people read about it and just decide to ignore it because they don’t think it’s really true or would affect them…

Well I for one believe that cyber-war has already started, and what we know about it is pretty little. True, this form of war is still probably primitive, but every day I read a story or article about an attack or a new form of malware related to cyber-wars.

To cut the story short, in 2010, a computer worm called Stuxnet directly affected the Iranian nuclear program by attacking the computer systems that were used in the program. It is said to have derailed their program several years. It was widely speculated that nations opposing the program were responsible for creating and spreading this worm.

Well in the last two days, a new worm called “FLAME” (also known as Flamer and sKyWIpe) has been discovered by Kaspersky. This worm especially effects the Middle East area. It is a data-stealing worm which is said to be very close to Stuxnet, and most probably also targeting the Iranian nuclear program (at least part of its duty is to do that). It is said to be “certainly the most sophisticated malware encountered; arguably, it is the most complex malware ever found.” Iran is blaming it for several breaches in security in the last few months.

As of May 2012, the countries most affected are Iran, Israel, Sudan, Syria, Lebanon, Saudi Arabia, and Egypt… Kaspersky (the anti-virus producing company) believe that it is a nation-endorsed worm, with Israel the prime suspect so far in the information security world.

I will definitely update this blog with details on how to ensure your PC is not infected, and how to remove the worm if infected. So far only the Iran's Computer Emergency Response Team (CCCERT) has released a tool for removal. It would be better to wait for antivirus companies to release their version of tools.

Further information can be found in the below links…

http://goo.gl/QnF1K

http://goo.gl/Pg5Dt

http://goo.gl/2EemV

Securing your PC… 5 Easy Steps

2012-04-11T22:51:00.000+03:00

Excuse me for the long delay, but even an avid computer security fan sometimes gets fed up with all the wrongs in this industry to a point that he doesn’t feel like writing a post for a few months.

So after a long delay, I thought I’d attend to a simple question that many people ask me…

“How can I protect my PC without much hassle?”

People don’t want to get extremely worried about details… All they want are some automatic methods to setup once and just go on with their lives. Here are 5 must dos to secure your PC.

1. Windows Updates

Run windows updates automatically (for the windows and office products)

Select Control Panel from the Start Menu

Select Windows Update from the Control Panel, if the view is different from the above image, choose "View By: Small Icons"

Ensure that the settings are as above. To get to this screen, press "Change settings" in the Windows Update page.
You can choose the "Install New Updates" time and frequency to fit your needs.

2. Anti-Virus Protection

Install an anti-virus with malware protection, and most importantly KEEP IT UPDATED! Any trusted anti-virus is advisable. Since I am not affiliated with any anti-virus company I can recommend a few.

a. First there are the known ones which you pay for to get the updates, such as Norton, McAfee, Kaspersky…

b. Second there are the free ones such as AVG (http://free.avg.com/ww-en/free-antivirus-download) and AVAST (http://www.avast.com/free-antivirus-download).

Personally, I use AVAST anti-virus and anti-spyware.

I repeat that the most important thing is to keep updating the signatures. Every anti-virus has its way, but all can be configured to update automatically.

3. Third Party Application Updates

Update third party applications, namely Adobe products, Java and Web browsers such as Mozilla Firefox and Google Chrome. This is very critical, as most vulnerabilities and risk is through third party applications.

Adobe (pdf reader and flash) has become prone to issues, and thus requires constant updates. They have lately allowed automatic updates, making the lives of all users a lot easier.

Chrome auto-updates in the background so need to worry here, while Firefox always asks you to upgrade… Always accept.

Internet Explorer issues are handled via the Windows updates mentioned in part 1.

Update Java if it is installed on your machine, and if possible uninstall it completely.

4. Windows Firewall

Make sure Windows Firewall is running. This protects your PC from any unnecessary internet traffic from and into your PC.

5. Trust

Never EVER press any link they do not trust or download attachment they are not sure of. If you suspect any link or website, you can use the site http://www.aceinsight.com to test that site.

Computer Security Jokes ~ 2

2012-01-31T23:56:00.000+02:00

A few funny jokes from the web about computers and computer security! Hope you enjoy!

Doomed if we fill out our CV, doomed if we don't!

Evolution!

Call in the police

Pretty effective!

The next generation....

Pretty much....

And my most favorite!!!!!

Don't we all wish we could do this?

Thoughts About Security ~ Issues

2012-01-11T19:54:00.000+02:00

So I recently had a long vacation…

During this lovely vacation one thing was always nibbling on my happiness. I was pretty sure that when I would eventually return to work, it would be back to failure after failure of the security systems we have employed.

Hold on… Let me start from the beginning.

Security professionals spend a long time and effort on convincing upper management and IT department of a security product, be it an email/web filter, IPS (intrusion prevention system), SIEM (Security Information and Event Management)… After literally years of fighting with upper management to get the funding, the deals are signed off and finally we get a smile on our face. That smile is short-lived.

IT departments have a tendency of making our life a living hell! Yes you heard that right… IT is there to support users, not the Security departments… They are used to have things their way, because they are the technology savvy people, and not the business people. What happens next is that the security department wants to impose new rules and systems, and the IT department is fighting it. With the upper management on the security side finally, the IT department agrees on setting up and installing the system.

YOU WISH!!!! No celebrations last longer than a few days… Here is what happens!

IT department blames any issues on the new “security” system!

o Security: “HELLO!!! That issue you’re talking about has been happening for the last 10 years. We just installed our system!”

o IT: “Our systems show that it’s your system’s fault. Deal with it.”

o Security: “Let’s sit down and discuss.”

o IT: “Turn off your system and then we will discuss when we have time.”

o Upper Management: “Business cannot be affected, stop your systems and find a solution”

o Security: “Stop systems…”

Eventually, IT and Security sit together, and find out what the issue was…

o Sometimes it’s the security systems fault

o Most times it’s not!

The system is back on and functional…. Guess what!!!

o The system now starts to fail… Instead of spending time analyzing security incidents, you spend time trying to fix the damn system…

You call the supplier. The supplier has sold you the system… Yet, they are either

o Too important/big to supply proper support to your “small” company

o Not really knowledgeable of their own products!

Back to troubleshooting the systems instead of benefiting from them

So back to my first day back from the vacation… IT WAS HELL! All the systems had errors in them. Instead of relying on my systems to provide me with data and automate part of my analysis, we switched roles, and it became my job to fix the system (with NO help whatsoever from the suppliers!)

You know what… This will be for another post, but I am starting to truly agree with the professionals out there who keep on saying that we should completely change our approach to computer security. We are always relying on the incorrect set of tools, and these tools don’t even work half of the time. The other half, well they are lagging behind the attackers who keep on getting new (or very old neglected ways) of attacking our systems…

Phishing

2011-12-21T22:29:00.000+02:00

No, we are not going fishing today, although I do feel like it. Actually in this age of technology, we have become the fish rather than the fisherman.

Those lovely hackers out there keep on creating ways to steal your data in order to impersonate you, access your accounts and even get your money. So how and why do these hackers do it? Simple.

Simplest form of phishing:

How can that be you ask? How many times have you received emails claiming to be from Hotmail/Facebook/Gmail/bank/game asking you for your username and password to verify that you are still a user of that service? If you don’t answer in 2 weeks, your account will be shut! It won’t be shut and you should NOT answer any of those mails.

Advanced form of phishing:

So, hackers got smarter as people realized that they should not go ahead and email them their passwords. What did they do? They started imitating the actual websites! Yup, hackers will take all the time and effort needed to get that password.

Their new technique is as follows:

1. They send an email appearing to be from the company, example support@yourbank.com. It actually is NOT from your bank, but it is a “spoofed” or fake email. That is pretty easy to do.

2. The email claims that your account could be disabled if you do not log in to your online banking. They provide you with a link which appears to be very legitimate.

3. You press the link, and get a site with the exact look and feel of your bank’s log-in page, but in reality it is not.

4. You enter the username and password, and the hacker gets them. Most probably he will either display a message saying that your account will not be disabled, and thanking you for verifying your account.

5. The hacker will have full access to your account.

Protection from phishing:

So how do you protect yourselves you ask me? It’s not that tough, but you have to be very alert.

1. Never respond to emails with password requests. Companies who respect themselves will never ask you for your password.

2. Do not press on links within the email. If you really believe that the email is authentic and you need to perform an action, just go to your internet browser and type in the address of the site you need to visit. That will directly take you to the site you want, not the site the hacker wants you to visit.

3. In case of a bank, when in doubt, call the customer support. Ask them if they did send an email. Even then, go back to rule 2. Hackers might know that the bank sent an email and so they make use of such an event to attempt phishing.

4. Lookout for any misspellings, different website designs, or any other modification to the site you visited. That could indicate a definite phishing attempt.

5. Check if the site is not using HTTPS. For example, Gmail and Hotmail and your bank’s accounts will ALL be using HTTPS, with that “golden lock” icon. Phishing sites will be using HTTP and no golden lock icon.

6. Google is your friend, I keep on repeating this. When in doubt, search the internet, you WILL definitely find something.

Finally, do check this site which has a small “test” regarding phishing. It tests your observation, and gives more tips. It won’t take more than 5 minutes, please do check it. https://www.phish-no-phish.com/

Computer Security Jokes

2011-12-12T22:10:00.001+02:00

I know I know... Security professionals keep making your life hard... It's good to make fun of ourselves from time to time.

Enjoy these "nerdy" jokes!

Safest place for saving your passwords!

Easy on that Head!

We're getting there...

Sometimes it feels this way!

Lol!

Don't we all wish it was this easy!!!

Thoughts About Security ~ 1

2011-12-04T22:16:00.001+02:00

I keep being asked about what I do for a living… I answer that I work in security.

Shock!! Horror! “Poor you, you studied in the US of A to work as a security personnel? You have to protect the company from burglars and save the day when staff members fight?”

People who know me a bit know that I studied for two years in the USA to pursuit my Master’s degree.

I start with my explanation. No offense to any physical security personnel, I actually work in computer security. You know, I protect the company’s computers, data and ensure that no harm can happen from the evil guys out there. I spend minutes after minutes trying to explain what I do.

You can imagine what type of questions I am asked… Instead of questions related to security, people start asking me about anything related to computers and technology… Can I format their PCs? Should they buy phone X or phone Y? How can I fix their wireless network at home to reach the whole house? Is this printer a good printer?

Don’t get me wrong, I love technology and I love to help people, especially when I know the answer. But this is all not security!!!

Eventually and after so many attempts at explaining what I do, their eyes lighten up and I feel that they actually are relieved. All that money spent and those two years didn’t go in vain… THANK GOD!

No one really cares about computer security until he/she has been hit by a virus, lost some data or had their account stolen. Other than that, why care?

The exact same issue applies to work. Managers out there don’t care about security. All that compliance is just an additional burden… more money to pay, more workers to employ and more systems to deploy. The only thing that gets them interested is when their own company gets hit, and when it’s hit, it is usually hit hard. Just ask SONY!!!

So people please don’t wait till your accounts are stolen, or your company is attacked… Do something about it, and do it now…