Information Security Illustrated

Man in the Browser – The Online Banking Nightmare

noreply@blogger.com (Ahmed Saleh) — Thu, 11 Dec 2014 09:01:00 +0000

Since 2004 the popularity of online banking has been rising rapidly, Hackers, fraudsters, cybercriminals and other individuals with malicious intentions present heavy threats to online banking. These people have led banks to adopt internal and external security countermeasures; some of the internal measures include deploying multiple defense layers, DMZ, filters, firewalls, intrusion prevention systems, honey pots, packet analyzers and so on. While on the external level banks were able to impose some security features on their clients including strong password, double factor authentications, tokens, virtual keyboards, secure socket layer (SSL) encryption, and awareness guides to their clients.

When these cybercriminals realized that targeting banks is now hectic and will require lots of time and effort, they switched to the weaker link, the USER, the person that is using the online banking service.

And therefore a new attack emerged, the Man In the Browser Attack or: MITB attack is an attack that threatens the current online banking systems not by addressing the top notch security implemented by banks but by targeting the less aware and vulnerable end users.

Two-Factor Authentication

Two-factor authentication also known as two-step verification is a process involving two stages to verify the identity of a person trying to access services on a computer or in a network. One of which is typically something memorized, such as a security code, password or PIN, and the other of which being an OTP (One Time Password) generated by a physical token, such as a card, or even mobile verification (SMS).

Since this method elevates the level of security and decreases the incidents of identity thefts, it has not only been adopted by financial institutions (online banking), but also by several online services providers (Social Media, Cloud Storages and Email Services)

The adoption of TFA or Two-Factor Authentication significantly decreased the fraud figures in the last two years. For example if hacker succeeded in unveiling a customer’s login password by either cracking it, regardless of its strength and complexity using commonly used technical tools, or by stealing this password by the use of spear phishing, the hacker will not be able to proceed without supplying the online banking website with the another verification OTP that is sent to the customer via his personal mobile phone (SMS). In this case the hacker along with having the first password is required to have access to the customer’s mobile phone to utilize the received code in order to proceed with any transaction.

Moreover, TFA provide an elevated sense of security to the customer and to the issuing financial institution. But then the MITB attack was introduced.

MITB: Man-In-The-Browser-Attack

Man in the Browser or a modified version of the notorious Man in the Middle Attack is a form of internet threat introduced to the victim’s system using a malware, mainly a Trojan that infects the web browser by taking advantage of vulnerabilities in the browser security and it aims to modify web pages, transaction content or even insert additional transactions. All of these modifications are done in a completely covert fashion invisible to both the user and host web application. An MITB is created to intercept data as it is transmitted over the secure communication channel between the victim and the online application. The Trojan responsible for the infection hides itself deep into the browser code and can be programmed to launch itself when the user accesses a specific online banking website.

The malware responsible for infecting a user’s PC is usually introduced to the victims system when the user is tricked into clicking on an applet placed in a fraudulent website; usually this applet claim that an update or so called advantage is needed to view the un-displayed content. Upon clicking on this applet a script is executed allowing the malware to run and accordingly infect the browser.

When MITB Attack is running it has the ability to intercept, manipulate and modify the contents of online banking WebPages by adding extra fields in order to trick and outsmart second authentication mechanisms.

Two famous examples are widely spread and can explain the situation clearly,

Example1: when a user with an infected browser initiates a transaction, the attacker has the ability to change several parameters of this transaction including but not limited to the amount or the beneficiary but the victim’s browser will still display to the user the original and correct information, tricking him into believing that he had entered the valid data. Thus the user inputs his authentication credentials along with the OTP generated for this transaction and submits the transaction for processing. The attacker can even modify statement of accounts in order to trick the user into seeing the legitimate transaction being processed.

Example 2: Some online banking services require the user to enter another OTP while processing his application: one at the login page in order to verify the user identity, another is when the transaction is submitted or even when the online banking page has been idle for a longer time. The attacker uses advantage of these options and uses them to tricking the user to generate an OTP and input it to field totally controlled by the attacker, and thus trick the user into providing him with an un-used ready to be used OTP. The attacker then makes use of this newly generated OTP to conduct a fraudulent transaction while using the correct credentials of the victim.

In both examples, Banks involved in these transactions can’t detect that the transactions are fraudulent, since they appear to be originating from the authentic customer himself, and therefore these transactions will be normally processed and flagged legitimate.

So, to sum up the basic flow of a Man in the Browser Attack:

A customer gets infected by a Trojan designed to launch an MITB attack
When the customer is initiating an online transaction, the Trojan is activated
The victim will affect all his credentials and authentications required
The Trojan will modify the transaction details.
The Trojan tricks the user by displaying fake pages, showing transaction details originally entered by the user.

MITB attacks are not targeted to one region or geography; they are a global threat affecting all regions. Since they are hard and expensive to conduct, they are usually performed by well funded and well organized cyber criminals. These criminals mostly target clients or accounts with high volume of transactions and multiuser authorizations: accounts that are managed by multiple users within an organization.

MITB Mitigation

Ensuring user confidentiality and integrity of their online banking services, as well as reducing financial impact caused by online frauds are of high importance to financial institutions. Although hackers will keep on finding several technical and non technical ways to conduct fraudulent malicious activities, there are some concepts and methods, in the case of MITB, that could lead to the reduction of financial impacts.

The first would be implementing an Out-Of-Band Authentication and Transaction Verification. An OOB requires that authentication and transaction verification are performed outside the customer’s web browser and essentially outside the customers PC. A common form of OOB authentication is delivering an SMS OTP along with the details of the transaction and therefore allowing the user to review and confirm the details of the transaction before entering the OTP into his PC browser.

The second method would be implementing an enforced secure browsing environment. For example, some financial institutions provide their users with portable web browsers stored on the USB authentication tokens, this USB flash device is set as “Read Only” which prevents any user, malicious attacker or any software from modifying the data stored on it, this setup which will prevent any infection from reaching the stored portable browser application. Moreover, this trusted browser can be pre configured by the bank to open specific internet pages and block any attempt to navigate into other un-assigned sites.

Another effective method to mitigate risks arising from MITB is to use Fraud Detection Based on behavior. User profiling will create a baseline normal behavior so that abnormal behavior can be detected and the user can be alerted before an actual transaction takes place. For example if a bank detects that an online banking customer is conducting an abnormal and unusual transaction (maybe using a new beneficiary, a newly used currency, a new location to establish the online banking session, etc…) it will stop the transaction and require direct intervention from the user in order to verify the validity of this transaction either by using SMS, Email or even phone calls. The bank systems will learn the patterns and behavior of this user in order to improve their screening process.

There are several ways to fight MITB attacks, but the most effective one is user awareness. Total dependency on the technical aspects is insufficient. When indulging in an online Bank agreement with its customers, Banks should provide adequate training, materials and even awareness quizzes and instructions that aim to educate the user into spotting any inappropriate and malicious activity being conducted on his PC, and in his browser specifically. Yet banks should acknowledge that protecting their security should be extended outside their parameter to reach the client side.

Finally a combination of customer awareness and education, the correct and appropriate use of alerting systems, along with the keen screening behavior and monitoring systems can provide the online banking industry with an effective protection against MITB attacks. Although these protective measures will not guarantee a safe and fraud free environment, but it will significantly lower the risks of getting bitten by a malicious attacker.

This article is cross posted in the Lebanese "Certified Accountant" Magazine issue 52 - Year 2014

A Big Problem: Cryptolocker the Ransomware

noreply@blogger.com (Ahmed Saleh) — Fri, 06 Jun 2014 11:57:00 +0000

Cryptolocker is back in the headlines, thanks to a coordinated effort to take down the computers and criminals that run the notorious "ransomware". But what is it? And how can you fight it?

Cryptolocker is ransomware: malicious software which holds your files to ransom

The software is typically spread through infected attachments to emails, or as a secondary infection on computers which are already affected by viruses which offer a back door for further attacks.

When a computer is infected, it contacts a central server for the information it needs to activate, and then begins encrypting files on the infected computer with that information. Once all the files are encrypted, it posts a message asking for payment to decrypt the files – and threatens to destroy the information if it doesn't get paid.

The authorities have won users a two-week window of safety

The National Crime Agency (NCA) announced yesterday that the UK public has got a "unique, two-week opportunity to rid and safeguard" themselves from Cryptolocker. The agency didn't go into more detail, but it seems likely that at least one of the central servers which Cryptolocker speaks to before encrypting files has been taken down.

The NCA has also taken down the control system for a related piece of software, known as GameOver Zeus, which provides criminals with a backdoor into users' computers. That back door is one of the ways a computer can be infected with Cryptolocker in the first place.

What that means is, until the window is closed – and the virus cycles to new servers – users who are infected with Cryptolocker won't lose their files to encryption. As a result, these users have the chance to remove the virus before it destroys data, using conventional anti-virus software. In other words, there has never been a better time to update the protection on your computer.

But watch out – while the servers that control Cryptolocker are out of action, it's possible to be infected with it and not know. If you don't keep your computer clean, then at the end of the two-week period, you could be in for a nasty surprise.

Cryptolocker only infects PCs, but there are other types of ransomware

Cryptolocker is the name of one particular virus, which only infects Windows PCs, running XP, Vista, Windows 7 or Windows 8. So if you use an Apple computer, it can't affect you. Similarly, smartphones are safe from cryptolocker.

Although it is the most famous example of ransomware, it's not the only one. Even in the two-week window, PC users may be infected with other types of ransomware, and Android and Mac OS users should carry on with their normal security precautions. Being safe from one type of malware doesn't mean you're safe from all of them.

If you've been infected by Cryptolocker, your files really are gone unless you have a backup

Some ransomware is little more than a confidence trickster, presenting a message asking for payment without having done anything to the user's files. Cryptolocker isn't like that: the software really does encrypt your files, to a strength which renders it unbreakable even by the fastest computers in the world – even if they had the entire lifetime of the universe to work on it.

That means you'll have to rely on any backups of your data to get it back. But it's important that you don't try and restore your data before you clear your computer of the infection, otherwise you could lose your backup, too.

Sometimes paying the ransom will work, sometimes it won't

Except, of course, there is another possibility. Some users hit with Cryptolocker report that they really did get their data back after paying the ransom – which is typically around £300. But there's no guarantee it will work, because cybercriminals aren't exactly the most trustworthy group of people.

What's more, if the NCA really is bringing down the command and control servers, then the criminals may not be able to return the data, even if the ransom has been paid. There's also a whole load of viruses which go out of their way to look like Cryptolocker, and which won't hand back the data if victims pay. Plus, there's the ethical issue: paying the ransom funds more crime.

This article was originally posted on:

www.theguardian.com/technology/2014/jun/03/cryptolocker-what-you-need-to-know

Quis custodiet ipsos custodes?

noreply@blogger.com (Ahmed Saleh) — Fri, 11 Oct 2013 12:42:00 +0000

We live a life fully dependent on IT services like Hotmail, Facebook, Google, Yahoo, you name it.
They have our names, photos, videos, and addresses. They know our moods and our crushes. They know our hobbies, political views, and preferences. Our histories, what we search for, what we think about, … simply they know our lives.
When you send your friend your CV, when you backup your photos on the cloud, when you sneak on an old girlfriends facebook profile, when you search the web for ideas in your back mind, all is stored somewhere.

We trust these names as we rush to share our personal information, or to hide our data. But shouldn’t we ask the question WHAT IF?

What if their data is hacked and exposed, what if a government law is out that obliges them to share such data. What if they do actually share them with governments or worse with whoever pays $$$

I don’t want to imagine what will happen should something as such occur. Let us hope all such data is well guarded there. Still as we get more and more dependent on such services we will always be asking:

Who guards the guardians?: Quis custodiet ipsos custodes?

Privacy and Smartphones

noreply@blogger.com (Ahmed Saleh) — Sat, 06 Jul 2013 10:27:00 +0000

I feel a bit naive starting with the definition of a smartphone. A recent infographic by the Lebanese carrier "Touch" posted on their facebook page shows that 82.66 % of people using their mobile service are using either a Blackberry, an Iphone or an Andriod phone.

Anyways, a Smartphone is a small handheld electronic device that has features of both a mobile phone and a computer. This device allows us to communicate voice, text, and video, along with sending pictures, sending emails, managing bank accounts, and sharing locations.

Similar to PCs and Laptops, smartphones are currently equipped with powerful processors providing the user with high computing power. Yet unlike ordinary PCs and laptops, smartphone are always in our hand or in our pockets, their small size and easy mobility makes them man's best friend.

Privacy is a major concern to smartphone users; No matter what they do, there will always be seen and unseen pitfalls that may lead to the loss of privacy

Privacy Compromised:

Service Provider

By using a mobile phone, you can rest assured that your service provider is by default retaining log files that include:

Incoming and outgoing calls: the phone numbers you call, the numbers that you receive calls from, and the duration of the call;
Incoming and outgoing text messages: the phone numbers you send texts to and receive texts from;
How often you check your e-mail or access the Internet;
Your location. (GPS / Cell usage)

In addition to the default data collected by your Smartphone service provider, you should also be aware of the possible privacy issues surrounding the collection or disclosure of:

Any photos or video you take on your phone;
The contacts you have stored in your phone;
Passwords;
Financial data;
What you store in your phone's calendar;

Picture Geo-tags

Depending on the brand and settings, your smartphone can use its built-in GPS capability to embed your exact location into the file of photos you take using the smartphone’s camera, this process is called geotagging. If you happen to share any geotagged picture, people can use the geotag to track your movements or find out where you live.

Malware

Malware is malicious software that poses a threat to your smartphone just as it does to your computer. The apps on your smartphone are a rich environment for transmitting malware. Some malware care about stealing money (financial), other malware are concerned only with collecting data and transmitting it to a remote receiver.

Free Apps and Advertisers

There are hundreds of thousands of applications for smartphones across all platforms, anyone can create an app. Most of these applications are free, free means cost free and not risk free. These apps can collect all sorts of data and transmit it to the app-maker and/or third-party advertisers. It can then be shared or sold. Most free applications contain ads, to customize these ads up to the user preferences, personal date should be collected from the user‘s smartphone.

The privacy concern here is that information captured could be used to build a complete profile about you without your knowledge or approval.

Protect yourself

1- Limit others' physical access to your Smartphone

A person who gains access to your smartphone can see all your private stuff or even worse they can physically install a malware capable of collecting data and then discretely transmit this data to other parties.

So in order to decrease the risk of privacy loss via physical access to your smartphone you should:

Password protect your phone;
Do not allow your smartphone to automatically remember login passwords for access to email, VPN, and other accounts;
Use your phone’s security lockout feature. Set the phone to automatically lock after a certain amount of time not in use;
Install security software that allows you to remotely lock your phone and wipe the data;
Never leave your phone unattended.

2- Usage of Public Wi-Fi Networks

When your smartphone uses a public Wi-Fi network to connect to the Internet (eg. coffee shop), it may be possible for others to “see” the data being transmitted by your smartphone so:

Avoid the usage of untrusted public Wi-Fi networks
If not possible, when using public and untrusted Wi-Fi networks. Do not conduct activities that use sensitive information such as mobile banking.

3- Mobile Security Software

Many individuals take great care to protect their computers with security software, but forget to do the same with their smartphones. Products from Eset, AVG, and McAfee may be able to:

Protect your smartphone against malware,
Back up your smartphone data, store data elsewhere
Track your phone if it is lost or stolen;
Lock your phone remotely, and wipe your data remotely.

4- Applications

Install applications only from trusted application sources. Read carefully what the application is trying to access before you install / use it, and only then decide whether to use this application or not.

To most of us, the smartphones are the last thing we put from our hand before we sleep and the first thing we check when we wake up in the morning. I think they deserve a little more caution on our part.

Scareware - Yes it is that Scary

noreply@blogger.com (Ahmed Saleh) — Thu, 27 Dec 2012 07:37:00 +0000

Scareware aka smitfraud or rogue security software, is a type of software that is defined as malware. These types of malware not only try to disrupt your computer, but also try to trick you into conducting a transaction with your credit card.

These types of malware appear to users in the form of pop-ups that resemble Windows system messages, usually masquerading as an antivirus or antispyware software, a firewall application or a registry cleaner.
The message displayed by this malware informs the user that the PC in use is in trouble and contains many security issues and a large number of virus infections. The Popup claims that the software it is marketing will be able to remove all the infections, speed up your PC and optimize its performance.

Naive enough some people do fall for this lame trick, and they follow the pop-up instructions and submit their personal data along with credit card number to buy this rogue software that pretends to save their PCs.
These scareware are well known for their ability to lock or limit the usage of control panel, disable registry editor, and prevent the user from visiting legitimate valid antivirus websites.

Some of the scareware I have encountered and seen on different systems are: Antivirus 2007, 2008 and 2009, XP Antivirus 2010, WinFixer, DriveCleaner, and Malware Cleaner.

If you face a suspicious pop-up, you should carefully close it by right-clicking on the item in the task bar and select "Close" or by manually exit the browser by using the task manager (Ctrl-Alt-Delete). To protect your system from future attempts, install a good pop-up blocker and configure it to prevent pop-ups from sites that you haven’t allowed.

Don’t automatically click download when prompted, don’t follow suspicious links even if received from your known friends (they might be infected and unknowingly spreading the infection).
Keep all your software applications up to date, that includes: Java, Adobe Reader, Flash Player, Windows and certainly your Antivirus.
Remember: Scammers and Hackers will keep on finding new technical and non technical means to exploit systems and PCs. It is your job to avoid their traps.

Chain Letters: Insulting Your Intelligence

noreply@blogger.com (Ahmed Saleh) — Tue, 06 Nov 2012 12:15:00 +0000

Electronic chain letters are emails that urge you to forward copies to other people. Chain letters, like virus hoaxes, depend on you, rather than on computer code, to propagate them.

A typical chain letter consists of a message that attempts to induce the recipient to make a number of copies of the letter and then pass them on to as many recipients as possible.

Common chain letters examples

Hotmail is going under maintenance and accounts that doesn’t pass this message are deleted within 24 hours, pass this message to your friends and people you care about, this is not a joke
Send this email to 5 friends and something good will happen to you, send it to 10 something even better will happen, send it to 20 friends and ..............., Ignore this message and you will die painfully.
Little Rosanna is 9 years old and is suffering from an acute and very rare case of the stupidontitus. This condition causes severe pain and terminal illness. The doctor has given her 6 month to live. But she can be saved using a very costly procedure. Nasa, Nato, UN, and Barcelona Football Club have decided to donate 3 cents for every new person that gets this email.........
Beware of the new computer virus, JBm01.02 aka ComputerEater, don’t open the email with subject: “Contact me, I’m your Mother” for it will download an infected file that will erase all your email messages..... Send this message to your friends and family. Help them save their messages.

Even On Mobile Phones

Starting next month WhatsApp will start charging the amount of 5 usd / month for its service. Forward this message to your friends including me..........
RIM servers are getting overloaded and the blackberry service is delayed, therefore if you don’t forward this message to at least 7 of your contacts, there is a big chance that your BBM will stop working and you will lose your contact list.

Chain letters don’t threaten your information security, but they can waste time, spread misinformation and distract users from genuine emails, they also create unnecessary email traffic and slow down mail servers.

Since hoaxes aren’t malware, your antivirus and endpoint security software can’t detect or disable them.

How to Spot Chain letters

Look for the phrase: 'Forward this to everyone you know”

The more urgent the request, the more you should suspect the message.

Usage of “forward this message to everyone even back to me”, to give the reader the false sense of trust.

Look for the statement: “this is not a spam” or “This is not an urban legend”

When in doubt Google the subject matter of your received message and you will get a better clue about the message.

If the email writer is attributing the text to a 'legitimate' source or implying that powerful corporate is going to take certain action if you don’t forward the email.

Watch for emphatic language, the improper use of UPPERCASE letters, and the multiple uses of exclamation points.

Finally, Read carefully and think rationally about what the message is stating, looking for logical inconsistencies, violations of common sense and false claims.

The Story Continues: MiniFlame

noreply@blogger.com (Ahmed Saleh) — Mon, 22 Oct 2012 13:35:00 +0000

Early July 2012, a smaller Flame module was discovered. This module had many similarities with Flame, so at the beginning it was believed that it might simply be an earlier version or the Flame malware. Few months later, it was found that not only there exists a connection between this malware and Flame, but also came across examples of this module being used concurrently with Gauss and being controlled by the Gauss main module.
Unlike Flame, which is designed for "massive spy operations," miniFlame is "a high precision, surgical attack tool,"
Researchers found that MiniFlame was something of super stealth assassin compared to the other programs. Whereas Flame, Duqu and Gauss had large missions to infiltrate multiple computers in countries like Iran, Syria and Lebanon, MiniFlame targeted just a few select victims in what Kaspersky calls “highly targeted attacks.” Kaspersky reported that MiniFlame, while rare compared to the more well-known malware packages, was more likely to show up in a variety of countries, including a computer located at the Francois Rabelais University in Tours, France.

Kaspersky Lab data indicates the total number of infections worldwide is just 50 to 60, including computers in Lebanon, France, the United States, Iran and Lithuania. "Most likely it is a targeted cyber weapon used in what can be defined as the second wave of a cyber attack."

Kaspersky determined that one machine in Lebanon is the lucky recipient of every nasty cyber weapon in the family:
There is one machine in Lebanon – what senior Kaspersky researcher Roel Schouwenberg calls “the mother of all infections” – which has Flame, Gauss, and miniFlame/SPE on it. “It is like everybody wanted to infect that specific victim in Lebanon for some reason,” he says.
Th Russian antivirus company believes that there are two more malware packages still in the wild, currently code-named only SP and IP. They may function much like the previously known malicious programs, churning through the guts of target computers for sensitive data to send home to their controllers before they execute the final trick in their arsenal, deleting themselves and vanishing from the infected system as if they’d never been there at all.

MiniFlame operates "as a backdoor designed for data theft and direct access to infected systems," which said development of the malware might have started as early as 2007 and continued until the end of 2011, with several variations.

Finally: to protect yourself

1- Make sure that your anti virus definitions are up to date.
(I assume that you already use an antivirus.)
2- Continuously monitor all the PCs you use for the Trojan "win32.Gauss"
3- Refrain from Using the Option "Save Password" that stores your credentials within web browsers.
4- Keep your Operating System Up to date.
5- Change your Password using a trusted clean, in case you doubt that your PC is or was compromised by Gauss or any other Virus.
6- Exercise cautious when using external storage devices (CDs, USBs), in order to limit the propagation of the Gauss or any other infection.

More info on Securelist.com

AUB: Information Security Alert: e-Scams‏

noreply@blogger.com (Ahmed Saleh) — Wed, 10 Oct 2012 05:57:00 +0000

I received an email message from my University administrator that I would like to share:
AUB: American University of Beirut.

From: Administrator <administrator@mail.aub.edu>

Date: Tue, 9 Oct 2012 09:30:32 +0300

To: AUB-ALUMNI

Subject: URGENT: Information Security Alert: e-Scams

Dear AUB users,

Some users are receiving messages (please check below) asking them to provide their credentials (e.g. username, password, email) in order to upgrade their accounts:

This is a scam message (also known as “phishing”), which involves Internet fraudsters who send spam emails or pop-up messages to lure innocent users to submit their personal information (passwords, credit card numbers, bank account information, Social Security numbers, or other sensitive information) from unsuspecting victims. In this case, the scammer’s interest is your AUBnet’s username and password.

So please beware of such scams and phishing messages and remember that the IT Staff in general and IT Helpdesk in particular at AUB and AUBMC will not request you to provide them with your Passwords via email, or in person, or via telephone. To counter these activities, the anti-spam tools that we have deployed on our systems would block the malicious emails and our IT team takes precautionary measures by blocking this type of emails.

If you provided your password by responding to the phishing email, please change your password IMMEDIATELY by doing the following:

1- Go to AUB’s home page (http://www.aub.edu.lb)

2- Click on “Faculty and Staff” or “Student Life”

3- Click on “Computing Services for AUB Faculty or Staff

4- Under Quick Access, click on “Change AUBnet password”

For further help, please contact the IT Help Desk Team in the IT Customer Success department at Extension 2260.

For more information about online scams, please check http://www.fbi.gov/scams-safety/e-scams

For more information about phishing, please check http://www.aub.edu.lb/it/custsupp/alerts/Documents/cns-phishing.ppt

The Original Scam message looks like this:

-------------------------------------------------------------

From: American University of Beirut Webmaster

Date: 8. Oktober 2012 21:29:46 GMT+03:00

Subject: FINAL WARNING

Reply-To: American University of Beirut Webmaster <aabuse1@gmail.com>

Dear AUB Communications Subscriber,
Strange activity has been detected in your AUB Communications account, which is against our Acceptable Use Policy (AUP). This account is suspected to have been hijacked, for a proof of ownership Kindly fill the blank space below for verification form within 48hours on receipt of this mail.

Full Name:
Current Username/ID:
Current Password:
Date of Birth:

Enter all this information accurate and complete, otherwise for security reasons we may have to close your AUB Communications account permanently. Please understand that this is a security measure intended to help protect you and your AUB Communications account.

We apologize for any inconvenience.

Thanks,
Webmaster Administrator
© - 2007 - (Web Master) AUB. All Rights Reserved

Best Regards,

Watch out for the Facebook Scam!

noreply@blogger.com (Unknown) — Thu, 30 Aug 2012 11:10:00 +0000

Many Facebook users receive notifications by email when they are tagged in pictures, or if someone had written something on their wall and so on. This is not a really a good idea because of a newly discovered malware by the security firm "Sophos". Why isn't it a good idea? Basically, because this malware sends a fake email notification masquerading "Facebook Notification Emails" informing you that "one of your friends has tagged you in a picture". Once you click on the link provided in the email, a file that is able to infect your Windows-operated computer will be downloaded automatically, allowing hackers to gain control and access to your PC.

This is how the email looks like:

How identify this Malware?

Usually, when Facebook sends you an email notification, it identifies the user that tagged you in a photo, wrote on your wall or sent you a message by displaying the Name or Alias. Notice that in the above picture, this email does not specify who tagged you, it just states that "one of your friends". So whenever you see "one of your friends" in the email notifications, do not open that email, just delete it and mark it as junk mail.

Another way to protect yourself from this scam is to stop email notifications in general. Who wants a bulk of email notifications in their inbox? It just causes your inbox to be congested and that will discourage you from checking your email more often. I advice you to stop these email notifications. So whenever you receive an email notification from Facebook, it will probably be a scam since you already stopped all email notifications. You can always check your Facebook notifications on the Facebook site itself. It is simple, easy and most importantly safe.

Always remember to keep your antivirus up to date, that will also help in identifying new malware.

Gauss A targeted Cyber Threat

noreply@blogger.com (Ahmed Saleh) — Thu, 23 Aug 2012 11:40:00 +0000

What is Gauss?

In simple words Gauss is a new virus capable of spying on bank transactions and stealing sensitive data such as browser passwords, cookies and network information has been discovered infecting computers in Middle East.
Called Gauss aka Win32/Spy.Gauss.A, the virus may also be capable of attacking critical infrastructure and was very likely built in the same laboratories as Stuxnet, the computer worm widely believed to have been used to attack Iran's nuclear program.

Gauss Complexity

Kaspersky Lab would not speculate on who was behind Gauss, but said the virus was connected to Stuxnet and two other related cyber espionage tools, Flame and Duqu. Experts said that surveillance viruses like Gauss are perfect tools for government intelligence units to gather information for such investigations.

The discovery of Gauss indicates that there are probably many other related cyber-espionage malware in operation. The current tensions in the Middle East are just signs of the intensity of these ongoing cyber-war and cyber-espionage campaigns.

The Moscow-based firm said it found Gauss had infected more than 2,500 personal computers, the bulk of them in Lebanon, Israel and the Palestinian territories

Why the name Gauss

Kaspersky Lab said it called the virus Gauss because that is the name of the most important module, which implements its data-stealing capabilities.

The toolkit earned its name because of references discovered within the code that pay tribute to mathematicians and philosophers. Johann Carl Friedrich Gauss was a German mathematician.

Stop the Gauss

1- Make sure that your anti virus definitions are up to date.
I assume that you already use an antivirus.
2- continuously monitor all the PCs you use for the Trojan "win32.Gauss"
3- Refrain from Using the Option "Save Password" that stores your credentials within web browsers.
4- Keep your Operating System Up to date.
5- Change your Password using a trusted clean, in case you doubt that your PC is or was compromised by Gauss or any other Virus.
6- Exercise cautious when using external storage devices (CDs, USBs), in order to limit the propagation of the Gauss or any other infection.

Finally In order to remove this Malware follow one of the following links and install the appropriate removal tool / Antivirus:

https://support.kaspersky.com/viruses/avptool2011?level=2

Software Updates, why should I bother?

noreply@blogger.com (Ahmed Saleh) — Thu, 02 Aug 2012 08:56:00 +0000

Why Update

Usually Software updates are released for four reasons:

Patch a security vulnerability;
Fix bugs;
Add new features;
Pure marketing purposes.

Staying away from the fourth reason, I believe that the most important aspect to apply a software update is to patch security vulnerabilities. Hackers do exploit these security vulnerabilities in order to gain access to your workstation and ultimately compromise your confidential data (passwords, emails, bank accounts).

Usually, when any software is being created it goes through series of phases within its development life cycle (SDLC). Two important parts of this life cycle are quality assurance and user acceptance testing. Yet the best testing any software could get is the Wild Testing.

Wild testing is done when vendors release their software un-officially (leaks, test or evaluation versions) to be tested and reviewed by enthusiastic users.

When these users submit their feedback directly to the vendor or share their experience using social networking media such as Facebook and twitter or even write a detailed review on Cnet they are able to draw the software vendor / developer attention. The developer consequently fixes the problems reported. And therefore a bug free update is released.

Sometimes, the term software update is used instead of software upgrade, this happens when the developer company releases a new version of their software with added features that is didn’t exist in the previous release.

Most software nowadays, given the proper permission from their operator, has the ability to periodically and automatically check for updates. Moreover you as an operator can configure this software to download and install updated seamlessly and on recurrent basis, without any further more intervention from your part.

Four Software updates that shouldn’t be missed:

1. Operating Systems

Operating systems provide a software platform on top of which other programs, called application programs, can run, examples of operating systems include windows 7, windows XP, ubentu, fedora, snow leopard, Lion, and most recently mountain lion released by apple a week ago.

Vulnerabilities are discovered within an operating system on daily basis, the vendor of that operating system tries to mitigate these vulnerabilities by releasing patches. Since these patches should be able to save the day, you should install updates as soon as you see a prompt to do so, or set the computer to install them automatically.

2. Web Browsers and Supporting Software

Since the internet service and browsing experience is always evolving the ability to keep your data secure becomes a greater challenge. Microsoft’s Internet Explorer and Apple ‘s Safari are updated the same way an operating system is updated, while Google’s Chrome and Mozilla Firefox are updated automatically.

For an ultimate user experience, web browsers need supporting packages like Adobe Flash, Adobe Reader, Sun Java and Microsoft Silverlight. And therefore due to their popularity, they are often the target of malicious attackers. It is extremely essential to update these type of software as soon as you see an alert.

3. End User Applications

Every now and then applications downloaded from the internet inform their user than a newer software update is released and ready to be downloaded and installed. These software updates are there either to fix bugs within the application or to offer brand new feature: perhaps a new graphical user interface or even better processing speed. Keep in mind that although these updates may not be mandatory, but sometimes these updates fix undisclosed security vulnerabilities within the application. So whenever an application prompts you for an update. Go ahead and do it.

4. Anti-Virus/Anti-Malware Software
New threats are introduced to the information technology field every day. And so, in order immune your PC against these threats you should keep your Anti-Virus/Anti-Malware updated. Usually these protection software update themselves seamlessly without any user intervention.

Finally, keeping all the software installed on your PC updated can sometimes be hectic, but if you consider the risks you are mitigating, it is definitely worth the hassle

Six Ways To Secure Your Email

noreply@blogger.com (Unknown) — Sun, 08 Jul 2012 16:59:00 +0000

We all use emails for our day to day work, studying, banking and many more errands. Emails are easily hacked if we do not secure them properly.

Here are six ways that will help Securing your email

I. Passwords

Never ever use an easily guessed password, like "iloveyou" or "12345678" and so on. Always use complex passwords that are easy for you to remember but hard for others to guess. Click on passwords to know more about strengthening your password. Remember: Do not reveal your password to any relatives or friends since the closest people to you are a major threat, not intentionally, but their PC/laptop might be infected and that might compromise your email account. No company employee will ever ask you for your password, not even the email service provider himself. In the case of someone asking you for your password by sending you an email or any other way, rest assured that this person is a hacker and wants to gain access to your account.

II. Rescue Email

Always add a rescue, or commonly known as an alternate email to your primary email in order to recover your email in case it was hacked. Make sure both emails have different passwords!

III. Don't change your password regularly

Although many email service providers as well as websites recommend that you change your password regularly, I strongly disagree with them for the following reasons:
Changing your password regularly has a major downside, it makes passwords harder to remember. People who are forced to change passwords regularly tend to choose easy to remember and easy to guess passwords. It's actually better to stick to one strong password that is hard to be guessed and can be easily remember by the user.

If you feel something suspicious about your account, use a trusted clean PC/laptop to change your password immediately

IV. Junk Mail

One of the best ways to filter unknown, suspicious and malicious emails is by activating the Junk Mail option. Most, if not all, email service providers have junk mail option that will prevent suspicious and malicious emails from reaching you. Especially emails that tend to look real, for example the fake Paypal email.

V. Anonymous Attachments

Never open attachments from emails you do not recognize or which come from an unknown email senders. Most hackers use attachments to infect your computers or your address book in order to send replicated copies of the infected email to other computers.

VI. Protect your computer

Try not to access your email from public computers that are utilized by multiple users. Doing so will put your email at risk and there's a big chance that you might lose your email.

Unless this public PC/laptop has an updated antivirus, refrain from using it to enter your email credentials.

Securing Mobile Devices

noreply@blogger.com (Ahmed Saleh) — Fri, 06 Jul 2012 13:11:00 +0000

Mobile devices are without doubt people's greatest friends. Whether it is a Ipod, an Ipad , a Blackberry, an Android phone, or even a symbian phone these devices accompany us wherever we go.

People usually underestimate the security flaws of their mobile phones, although current mobile phones have the same computing power of a normal PC, people fail to treat them with equal importance.

Here are seven Tips to Secure Data stored on your Mobile Device

I. Use the PassCode

Nowadays, nearly all mobile devices are manufactured with the ability to set access control passcodes that prevent unauthorized access to the confidential data stored on these devices.

Choose a strong passcode that is easy for you to remember but hard for others to guess, and for God sake don’t use your birthday or your girlfriend birthday (even though u should always remember that date). Use a mixed combination of letters and numbers.

Security tip: Don’t use consecutive numbers and letters because they are very easy to be guessed and surprisingly commonly used.

Grid pattern locks work fine, and fun to use, but beware that they leave finger smudge marks on the mobile touch screen especially when using a protective layer shield. This smudge makes it easier to guess your pattern.

Recent mobile devices offer device encryption for their files and data, whether for their own internal memory or their multimedia memory card. Using device encryption is the best method to protect your data from being stolen through plugging your phone to a PC to transfer data.

II. Careful Use of Wireless Networks

Mobile phones can be set up to connect to available public WIFI networks automatically; this improper setup allows the mobile phones to shake hands with an insecure environment that might compromise your data.

So when you are not connected to a trusted wireless network, turn off the WIFI ability on your phone.

Moreover, Bluetooth communication could be exploited to spread mobile malware and eventually leak confidential data from your mobile. It is imperative to turn of the Bluetooth service when not using it.

Security Tip: Recent phones have the option to automatically turn off Bluetooth when it is gets idle for 5 minutes, use it.

III. Applications Access and permissions

Apps installed on mobile phones have the ability to access sensitive data stored on the phone itself. In general when you initially setup an application on your mobile device it requests special access, like accessing your contacts and storing them in the cloud, tracking your location, and sending you push notifications.

Usually people have the tendency to accept these modifications without thoroughly reading their content and assessing their risks. You should setup the permission level of each application depending on the level of sensitivity of your stored data.

Note that:

- You can disable push notifications by changing the settings in your device options.

- You can deactivate location based services by turning them off from your device menu. This option will stop your phone from broadcasting your GPS location regardless of the app using it.

IV. Backup your Data

Backing up your data is the most effective way to prevent data loss, Data loss could be the result of lost or stolen phone, damaged memory card, bad application setup leaking data or even human error by messing with phone options.

Copy your data from your mobile phone to your PC or Laptop, schedule routinely backup notification in order to keep your backup copy updated.

Security tip: remember to encrypt your backup copy. Recent mobile management application enables you to utilize encryption as part of the synchronization process.

V. Firmware updates

Similar to your PC operating system, Your Smartphone should be updated in order to overcome any newly known exploits that could compromise security.

Firmware upgrades is not only limited to security issues but also to performance enhancement of you mobile experience.

Security Tip: Commit to using firmware that is certified by the vendor of your mobile Device. Tampered (Custom made) firmware might contain malicious codes that compromise your information security

VI. Remote Device Access

Many of the recent mobile phones and smart devices give u the ability to wipe its data remotely. You should exercise that option if your phone gets lost or stolen.

Moreover, you can setup your phone to automatically wipe itself clean of any personal data should the PIN guarding your phone is entered incorrectly for a certain number of attempts.

Security Tip: Don’t forget to remove your media card before sending your phone to any repair station.

VII. Sensitive Financial Data

Storing Financial Data on the phone is a big mistake; mobile phones are easily stolen or lost. I know people that used to store credit card numbers on mobile phones; others store ATM pin codes. People should really understand that it is much easier to lose data from smart mobile devices than losing their own wallets. For a start you will directly notice a missing wallet, but you will only find out a theft of sensitive info such as credit card number only when it is used or billed.

Remember: You should be always aware of shoulder surfers that scan around in order to catch you enter your PIN or passcode.

Finally, good judgment and cautious behavior are key factors to prevent data leak or loss caused by mobile devices.

Again! I’m Not Falling for That One!

noreply@blogger.com (Ahmed Saleh) — Tue, 26 Jun 2012 10:47:00 +0000

From time to time I review my email junk folder to check if a legitimate message got stuck in there, and in order to keep myself updated of new techniques and methods utilized to scam people into disclosing their confidential information.

Recently I ran across an email message, apparently from paypal requesting me to update my records in order to continue using their services.
Since I really don't have a paypal account yet, this email is definitely a scam.

Upon More Investigation, carefully following the link mentioned in the email in order to update my non existing records, I was redirected to a webpage that looks like the original Paypal.com website

The first thing that caught my attention was the address of this fake Paypal page was the URL of this page

I tried to login to this false paypal page using incorrect and offensive credentials, i was redirected to a "Session timed out" page, and of course the credentials I used where sent, stored (stolen) by the creators of this illegitimate page.

Note that, the first thing that a user should check before disclosing any confidential data is the correctness of the URL for the page requesting this information.

Always look for the httpS.

I wonder how many people took the bait and were scammed by this scenario.
The good thing is that the Firefox browser started to alert people before accessing the false paypal webpage by displaying this message

Finally, don't fall for these scams, exercise a keen sense of responsibility, awareness and an appropriate dose of suspicion before disclosing personal information.

Suicide Ability: Update on the Flamer Virus

noreply@blogger.com (Ahmed Saleh) — Mon, 11 Jun 2012 13:50:00 +0000

Being described as the largest, most sophisticated, most discreet, and certainly the most complex virus ever created, The Flame virus shows more of its abilities before it disappears.

It has been Proven that Flame has a built-in feature called SUICIDE that can be used to uninstall the malware from infected computers. However, late last week, Flame’s creators decided to distribute a different self-removal module to infected computers that are still connected to the predefined servers and still under their control.

Compromised computers regularly contact their pre-configured control server to acquire additional commands. Following the request, the C&C (command and control) server sent them a file named browse32.ocx. This file can be summarized as the module responsible for removing Flamer from the compromised computer. “The Disinfector”

The module “browser32.ocx” has not been seen and recovered from the field, but instead it was captured in honeypots. Any client receiving this file would have had all traces of Flamer removed, including this module itself.The suicide feature and the browse32.ocx module are designed to prevent further forensic analysis.

Meanwhile, an important question remains unanswered, since C&C servers are able to execute a command that kills the flamer virus, aren’t they able to plant the seeds of a new undiscovered virus that will reside undetected for several years performing the same or even more damage that the current Flame virus.

For more info about the files and folders removed by this “browser32.ocx” read the following from Symantec.

Avoiding the Flame

noreply@blogger.com (Ahmed Saleh) — Tue, 05 Jun 2012 12:36:00 +0000

After reading many articles and expert reviews about the Flame Virus I came up with the following summary

What is the Flame: Worm or Trojan

Flame is a complex attack toolkit, it is a TROJAN modified to have WORM like features, allowing it to replicate within local networks and removable media.

The initial entry point of Flame is still unknown – but once a system is infected, sKyWIper, another name for Flame virus, begins a sophisticated set of operations, including:

Running on Windows XP, Windows Vista and Windows 7 systems;

Scanning network resources;

Stealing information as specified;

Communicating to Control Servers over SSH and HTTPS protocols;

Detecting the presence of over 100 security products (AV, Anti-Spyware, FW, etc);

loading itself as a part of Winlogon.exe then injects to Explorer and Services;

Concealing its presence as ~ named temp files, just like Stuxnet and Duqu;

Attacking new systems over USB Flash Memory and local network;

Creating screen captures, Recording voice conversations;

Using SQLite Database to store collected information;

Utilizing PE encrypted resources;

Flame Complexity: Master Piece

Flame is a huge package of modules accumulating up to 20 MB in size when fully deployed. Because of this, antivirus companies state that it is an extremely difficult piece of malware to analyze.

The reason why Flame is so big is because it includes many different libraries, such as for compression (zlib, libbz2, ppmd) and database manipulation (sqlite3).

Flame creation date: unknown

The developers of Flame were able to change the dates of creation of the files associated with this virus to 1992, 1994, 1995 and so on, but it’s very obvious that these dates are incorrect and they aim only to give false data to investigators.

Analyzers believe that the main Flame project was created in 2010, but is still undergoing active development to date. But there is big possibility that an earlier version of this virus existed before 2010.

Why the Name: Flame

Flame aka Flamer aka SKyWIper all different call signs for the same malware. The Flame virus consists of multiple modules, one main module is called Flame – as the picture indicates – The flame module is responsible for attacking and infecting additional computers, and this is mainly the reason behind this malware naming.

No one to claim the spoils

Although, no party has claimed responsibility for the creation and usage of this malware, but it is so obvious that it was not created by a group of hacktivists to send a certain message or anonymous hackers just for the lulz.

The complex anatomy of this malware along with the geographic spread of the targets leaves no doubt that great deal of resources were invested in the creation of this virus and that it was created by nation state in order to collect info on the operations of certain countries in the Middle East, including Iran, Lebanon, Syria, and so on.

Here’s a map of the top 7 affected countries:

Stop the Flame: Update your Antivirus

In general, most of the recent malware are small in size to be easily hidden, usually between 100k and 700K, but in Flame's case things are totally different. The large size of the Flame malware is precisely why it wasn’t discovered two years ago. For who would doubt a nine megabytes ~ named temp file to be a malware database file.

Finally In order to remove this Malware follow one of the following links and install the appropriate removal tool / Antivirus:

Mcafee Stinger

BitDefender Flame Removal Tool

AVG and Keep it updated

Six ways to secure your Facebook!

noreply@blogger.com (Unknown) — Fri, 01 Jun 2012 14:01:00 +0000

Facebook has become big part of our lives. It is integrated in our social and private life. Nevertheless, Facebook users still face an obstacle, an issue that will exploit their privacy. Security is an essential issue when it comes to social networking, and if you don't secure your Facebook, you are in trouble. Here are six ways to secure your Facebook.

1. Go to your "Account Settings" by clicking on the arrow in the top right corner of your Facebook and selecting "Account Settings". Next, select the "Security" tab on the left side of the page, this will take you to this page:

2. Click on the first item labeled "Secure Browsing" and check "Browse Facebook on a secure connection (https) when possible". Don't forget to save your changes.

3. Next click on "Login Notifications" and check either Email or Text message/Push notification or both.

4. Edit "Login Approvals" and check the box. This will send you a text message to your phone whenever a user attempts to login to your Facebook account from an unrecognized computer or browser.

5. Click on the "Facebook Ads" tab on the right left side of the page

Then click on "Edit third party ad settings" and "Edit social ad settings" set share to "no one" in both.

6. Finally, go to your "Privacy Settings" reachable from the top right corner by clicking on the arrow. Set the default sharing permission to "friends".

Free Online Storage: Practical - But is it safe?

noreply@blogger.com (Ahmed Saleh) — Thu, 24 May 2012 12:11:00 +0000

Who wouldn’t like to have his data available 24 /7, Accessible from everywhere using any computer or operating system?

How many times have you left home without your precious USB drive? Well worry no more because the internet has provided you with a solution!

Online Data Storage, with products like: Google Drive, iDrive, Sky Drive, and CX will give you the ability to stash your data on a virtual drive (cloud Storage) and access this data from approximately anyplace that has internet connection.

Although online storage seems appealing and interesting but there are some concerns that should be taken into consideration when using these services.

Having tried many products myself I will try a more direct approach:

PROS

Availability: Online storage provides users with access to their data virtually at any time, and anywhere.

Free: Most online storage vendors provide free accounts for people to try their services. Using free accounts services users are granted between 5 and 25 GB of online storage.

Recovery: Storage drives can be used as backup drives, where users can upload their data and keep it available should they lose their original data.

Cross Platform: Since all that you need to access your data is an internet browser, and since nearly all platforms and operating systems are equipped with at least one browser. Users should have no difficulty accessing their files.

Sharing: After your files are uploaded to your cloud drive, it would be very easy to share a certain file with someone else, or even link it directly to your website.

CONS

Downtime: Since we are talking about the free service provided from some vendors, there is no guarantee that your files will be available 24/7. Although most of online storage providers brag about their compliance with the Five Nines Availability (99.999% available) there is no solid guarantee of ultimate availability.

Bandwidth Limitations: There are two drawbacks within this aspect

First, in some “Internet Primitive Countries” Internet Service Providers assign limited bandwidth speed and limited quota to their users. So if a user exceeds his preassigned quota extra charges will apply. For example, here in Lebanon, it would take me around 66 minutes to upload a 100MB file to the internet. And around 17 minutes to download the same file.
The second drawback is related to the online storage vendor: since it is a free account, bandwidth limitation is more likely to be forced by the vendor.

Data Security: this is the most interesting part of online data storage; we tend to convince ourselves that since the vendor claims that our data is safe and sound, then no one could access it. But this is not the case; I believe that the moment you agree to upload your data to the so called internet drive, you should be aware that your data might be compromised. Your Storage Drive account might be hacked, your password guessed, revealed or even stolen. These things usually do happen, and when they do you lose Confidentiality, Integrity and Availability of your Data. Moreover, who could guarantee that the vendor doesn’t disclose any of your data?

Finally, Cloud Storage is effective in storing, sharing and managing data, but when it comes to information security there should be a big question mark around your virtual drive.

Physical Information Security

noreply@blogger.com (Unknown) — Mon, 14 May 2012 05:47:00 +0000

A lot has been written on information security, how to protect your PCs, your email accounts, your bank accounts, and so on. But what about physical files, credit cards, even personal conversations. Social engineers do not always have to hack your PC to collect information, they can eavesdrop on conversations, sneak a look on your laptop especially when you are writing personal confidential information.
The key is to Protect your personal and confidential information at all times, whether in your PCs, in hard copies, or even in your mouths.
Below are some tips to ensure the security of your information.

Work elevators: They are the gold mine for social engineers. People tend to discuss loudly work issues, personal stuff and other confidential information in the elevator. We should refrain from discussing such topics when there is a stranger in the lift.
Coffee shops: We often tend to use our laptops in coffee shops and restaurants, and we often open personal or confidential files there. Remember, someone can be looking. You should be cautious when using your laptop in public areas. You can also use privacy filters to make sure only you can see what is on the screen.
ATM machines: Make sure no one is standing close to you once to key your pin. It goes without saying that you should never share your pin; that is why it is called PERSONAL Identification Number
Banks and government counters: Make sure that no one is looking when you are filling applications in banks or at government counters. These applications may contain confidential and personal information that can be easily used by social engineers. Also make sure no one is close enough to hear your conversation with the clerk.
Credit card payment: A car rental agency once asked me to take a photocopy of my credit card and process the transaction later! Be careful when paying with a credit card, and never accept such offers. Also remember to verify the amount on the slip before signing it.
Your office: It is a treasure of information. Make sure all confidential files are locked away, and unauthorized people are not admitted to the office space. Don’t leave your PC unlocked and unattended. Discard confidential files smartly by shredding them. (Always consider the environment by reducing the quantity of printed material, and recycling the shredded documents)

Bottom line, caution handling confidential information should be a part of our life, not a task that we do once a week. Whether at home, at work, or in a public place, remember that personal information is for you only.

A Disaster in The Making part 2

noreply@blogger.com (Ahmed Saleh) — Sat, 12 May 2012 12:32:00 +0000

While I was having a presentation by one of the Middle East leading firms in providing Disaster Recovery and Business Continuity solutions, I was able to take the following picture using my phone

I just wonder: how could any one buy this vendor so called “end to end” solution! and pay a huge amount of cash, while they fail to present a good and SAFE image of what they are selling.

Business Continuity is not always about having the latest servers and backups, but also it is about the level of awareness and maturity.

New Technology Protects your Storage Devices

noreply@blogger.com (Unknown) — Tue, 08 May 2012 16:42:00 +0000

We previously discussed USB flash drive security and how to protect it. ThumbDrive has developed a new technology to prevent unauthorized access to the information stored on your USB by using a fingerprint authorization.

This USB has some advantages and disadvantages. Aside from securing your data, the advantages of this USB is that you can configure it to grant access to at most three users. You can also partition the USB flash drive to divide the storage capacity into secured data and open or unsecured data. It is a small, easy to set up and easy to access USB with an interface that reads your fingerprint.

Unfortunately, this USB has two major disadvantages, cost and storage capacity. Storage capacity is an essential issue when buying storage devices. The ThumbDrive flash drive is available in 16, 32, 64 and 128MB, which is relatively small compared to our day-to-day flash drives. The reason behind this issue is that the flash drive is mainly designed to hold confidential files, and these files are usually personal files, legal documents, and financial or accounting data that don’t require huge storage capacity. So capacity isn’t really an issue here. Another major disadvantage is cost. The ThumbDrive touch 16MB costs $160, 128 MB $465, which is really a major concern for the buyer.

Another solution for securing sensitive data on your flash drive is by using the newly designed “Voicelok Voice Authenticating USB drive”. This USB uses “voicecode”, in other words, it uses voice recognition to secure your data. The USB’s software detects precise frequencies and shades in the user’s voice. The advantages of this flash drive is that its price is much more reasonable than the fingerprint flash drive and has a better storage capacity, around $46 for a 8GB USB. Unfortunately this USB is still not reliable as the reviews indicate.

If you want my advice, the best solution is to check the “Lenovo ThinkPad USB Portable Secure Hard Drive”. The hard drive protects the data from unauthorized access by requiring the user to enter a code into the numeric pad located on the hard drive. It allows up to ten different users and an administrator. It has a huge storage capacity compared to the fingerprint flash drive and its price is perfect, $179 for 160GB and $219 for the 320GB. The size of the hard drive is similar to the size of any other normal hard drive.

Paying a little extra money to protect your information that can cost you a lifetime is worth it. If you have sensitive information and don’t want it falling in the wrong hands, I suggest you go for reliable technology like fingerprint flash drives or the numeric pad hard drive.

Ten Ways to Protect And Safeguard Your PC

noreply@blogger.com (Ahmed Saleh) — Wed, 02 May 2012 09:51:00 +0000

Since the use of computers has become an integrated part of our lives, information security has become a greater challenge; here are the Ten Commandments to protect and safeguard your PC:

1- Install Updates

Keep your operating system updated (install patches and service packs). If you are using Microsoft Windows turn ON Automatic Update.
Keep your third party applications updated especially your web browsers. New web browser exploits are discovered regularly and can severely impact your PC.

2- Use an Antivirus / Anti-Spy / Anti-Adware

There are many good and free anti-malware applications that are free and can be downloaded and installed easily. I personally use AVG (free and effective)
Usage of anti-spy and anti-adware application will help you preserve your identity and privacy while using the internet. I personally use two: Spybot Search and destroy, and Lavasoft Ad Aware.
Keep your antivirus definitions updated or else you will be vulnerable to multiple types of threats that your current antivirus cannot detect.
Full scan your PC periodically.
Don’t panic: sometimes anti-spy-adware applications generate false positive alerts where for example some legitimate browser cookies are flagged as adware and scheduled for deletion.

3- Use Windows firewall

Although many professionals consider Windows firewall to be dumb and bypass-able, there is no reason why you shouldn’t utilize this extra free, built-in feature in your windows (Available on all Windows versions from XP and up)
Use third Party firewall to increase your defense against internet attacks, I personally use: Zonealram

4- Turn on the popup blocker

Pop-ups are usually used for advertising purposes they appear to grab your attention and redirect you from one website to their own. But not all pop-ups are used for advertising purposes; others are planted with malicious intent. Some use these programs to distribute adware, spyware and more dangerous types of malware (Trojans and even Rootkits)
Recent Browsers give you the ability of blocking Pop-ups, and the option of choosing which sites are allowed to pass pop-ups

5- Suspicious Mails are not to be Opened

Never open emails that look or feel suspicious to you or not known to you, Use the “Mark as Phishing – Scam – Spam- Junk” option that most email providers utilize.
Some malicious Emails contain links that direct users to malicious websites that aim to harvest usernames and passwords of social media websites such as Facebook and Twitter or financial websites.
Never communicate your confidential data via email. Confidential data includes but not limited to usernames, passwords, addresses, telephone numbers, and social security number. Note that: Legitimate companies will never ask you to share your credentials via email.

6- Caution When downloading Software

Exercise extreme caution when downloading applications and software from the internet because these applications could carry different types of malware.
Cracks and serial number generators are hosts to many kinds of malicious codes that most of the times can’t be detected by antivirus applications.

7- Usage of USB and External Storage Devices

Transferring data from one PC to another using an external storage media without the proper information security measures could lead to virus infections, data loss and data theft.
Disable auto run functionality in windows, although most antivirus software perform an activity monitor over files trying to slip into your pc from an external storage, but mistakes do happen.
Always scan the USB memory sticks, mp3 players, iPods, and Mobile phones memory cards before browsing its content. Always: better safe than sorry.
Don’t compromise your data; don’t use your semi full 500 GB External Hard Disk that contains “Your Lifetime Data Backup” as a transfer media to copy small files less than 8 GB from one PC to another. Get a memory card for this task – 8 GB sticks are currently cheap easy to handle, easy to carry and protect.

8- Back-up Data

Perform periodical backup of your data, and please taking a copy of your “important files” To your D: drive (which is the same primary drive, but another partition) is not considered backup.
Backup should be done on an External media such as USB drive or Hard Disk; I personally keep two backup copies on two different media storages.

9- System Restore – Time Machine

Use Windows System Restore to create restore point before doing any major change to your operating system. If something goes wrong you can use this option to restore windows to a previous saved point.
Similar to System Restore on Windows, time machine works on OS-X. Backup is done seamlessly provided the designated drive is connected. And restore option allows users to restore from multiple points simultaneously.

10- Password Protection

Passwords are unique strings of characters that users provide in conjunction with a User ID, to gain access to an information resource.
Passwords should be at least eight characters long including upper and lower case letters along with digits and punctuation characters.
Should not be a word in any language
You shouldn’t reveal your password in an email message.
You shouldn’t talk about or HINT the format of your password in front of others.

It is not hard to protect and safeguard your Data and PC, you just have to exercise some attention, and run the extra mile

Online Payment

noreply@blogger.com (Unknown) — Sat, 28 Apr 2012 20:13:00 +0000

I think this is a joke, but stupid hackers will always find preys.

Online payment is becoming an integral part of our life, still it poses multiple risks ranging from identity theft to financial losses.

Here are some safety tips to follow when purchasing online:

Use a prepaid internet card, you can ask your bank for an internet credit card with a low credit line in order to limit the loss should that cards be stolen. You should recharge this card with the exact amount needed before usage.
Use your credit card diligently with well known websites – trusty websites (appstore, amazon, your airlines…)
Verify that the URL you are using is right and always look for the "S". (https)
Monitor your statement for any suspicious transactions on a weekly basis, directly report any fraud or theft to your issuing bank.
Subscribe to SMS or email services that can directly notify you with every transaction after seconds of being conducted.
Don’t ever send your Credit Card number using email, fax, SMS or any other communication media.

Shop online safely

Scams: The Story Never Ends

noreply@blogger.com (Unknown) — Mon, 23 Apr 2012 06:03:00 +0000

Last week, I received 2 missed calls from an unknown number, When I called the number back a voice with an accent said "hi sir, this is Etisalat (The main mobile operator in UAE), congratulations you won AED500,000. Please turn off your phone, and get your sim out and read the last 3 digits on it, they should read 639 (apparently all Etisalat sims end with this number) and call me back" - I said ok, and closed.

He made another missed call after 5 min, he said did you check, I confirmed and said that I should receive my gift. Here I asked why do you make missed call, and not call, if you are from Etisalat, he said they are calling me, but it's is an issue in the network (Etisalat is suddenly having problems with my sim only).

He asked for my name, and nationality, I gave fake ones, he said that they opened an account with my name in Dubai Islamic Bank and gave me an account number. And then he said, one more thing is needed, I have to go to the nearest supermarket, buy AED2,000 worth of Etisalat vouchers to verify that I'm an Etisalat user.

I started laughing and told him, I will get them later, he said no, now, you have 15 min, you are on the air on the radio and people are listening to me as I speak.
I ended the call by threatening them, and I called the police who took the number and promised to take action.

Surprisingly, I was telling this story to a friend, and he told me that he fell for it, and after giving them the pins for the vouchers, they asked for another set of AED2,000 and another one ( they turn greedy once they capture a prey)
They ripped him AED 6,000 and you know what happened.

Again, spotting scams requires a little bit of awareness and questioning. I hope that this post saves some people from getting conned.

Certified and Validated

noreply@blogger.com (Unknown) — Thu, 19 Apr 2012 19:36:00 +0000

In this post, I will elaborate more on HTTPS. We previously discussed the term phishing in this blog. To summarize, phishing is an attempt to manipulate or trick a person into providing confidential information to an individual that is not authorized to receive such information. To protect yourself from phishing, recent web browsers have developed a way for checking if a website is valid or not.

Web browsers trust HTTPS websites based on certificate authorities which come pre-installed in their software. Examples of certificate authorities are “Microsoft” and “VeriSign”. In the example below, the bank's web site is verified by "VeriSign, Inc."

Always look for the green address bar. Recent web browsers show a green address bar in order to tell the user that this web site is legit and trustworthy. Its purpose is to give more confidence to the user and ensure them that they are visiting a trusted web site.

This issue plays an important role in Information Security. Next time you visit a web site make sure you look for the green address, especially web sites that ask for important and private information and web sites for payment transactions. To reassure yourself, check the certificate to know if this site is validated.