Category: Network Security

Mobile codes to boost Google account security | Security – CNET News

My comments

Google have worked on a way of improving security for Web-page login experiences because these login experiences are easily vulnerable to phishing attacks.

What is this technology

This method is similar to a hardware security “token” used by some big businesses for data security and increasingly by some banks to protect their customers’ Internet-banking accounts against phising attacks. This is a device that you keep with you in your wallet or on your keyring which shows a random number that you key in to a login screen alongside your user name and password and is based on “what you have” as well as “what you know”.

This time, the function of this “token” is moved to the mobile phone which nearly all of us have on ourselves. It will appear as a smartphone “app” for the Blackberry, Android or iPhone platforms that shows the random code number or will operate in the form of your phone showing an SMS with the token code or you hearing a code number from a call you answer on that phone. Of course, you will register your mobile number with Google to enable this level of security.

The direction for the technology

Google are intending to use it with their application platform which covers GMail, Adsense, Analytics, Picasa and other Google services. Initially it will be tried with selected user groups but will be available to the entire user base.

They will provide an option to avoid the need to use this “Google codes” system on the same computer for a month, which would appeal to users who work with their GMail account from their netbook or desktop PC. They will still need to have this work if they “come in” to their GMail account from another computer and it will work if someone else uses the same PC to check on their GMail.

What I am pleased about with this is that they intend to “open-source” this system so that it can be implemented in to other platforms and applications. Similarly, the “apps” can then be ported to newer smartphone platforms or “baked in” to other PDAs and similar devices. As far as the “apps” are concerned, I would like to allow one piece of code to service multiple service providers rather than loading a smartphone with multiple apps for different providers.

Making the home network secure

I would like to see this technology being tried out as a method of securing devices that use Web-based data-access or management interfaces, similar to D-Link’s use of CAPTCHA for securing their home-network routers’ management login interfaces. This is becoming more so as nearly every home uses a wireless network router as the network-Internet “edge” for their networks. Similarly, there is an increasing tendency to use a network-attached storage for pooling data to be available across the network or as backup storage and most of these units use a Web-based user interface.

Conclusion

One feature that I like about this Google project is that they have applied a security technology normally available to big business and made it available to small business and consumer users.

Articles

Intel acquires McAfee for $7.68 billion – Engadget

My comments

Most of the laptops that I have reviewed on this blog came with a trial edition of a McAfee desktop-security program. Similarly, there are some people who have cottoned on to a McAfee desktop-security solution of some form, either by taking out a full subscription to a trial program that came with their new computer, used a business-supplied program or, for long-time computer hobbyists and students, ran the shareware program on their DOS-based PCs to keep the likes of “Ping Pong” or “Stoned” off their hard disks.

This program, one of the “old dogs” of PC virus control and desktop security, has served many users very well but some users would find that Intel owning McAfee may change the course of the McAfee product lineup either to make it more cheaper or costlier. It could also be a chance to make for a “vertical” desktop-security package directed at a particular user group or, as I would hope for, prepare a competitive antivirus program for the Apple Macintosh platform. This is because as more people take to the Macintosh platform, the “computer underworld” could work on that platform and create malware for it.

A good question to ask is whether McAfee, being profitable, was simply bought out by Intel or whether McAfee was posting a loss and Intel offered to buy out the software company to offset the losses. The latter situation may be brought about by the arrival of the free desktop antivirus programs offered by AVG, Avira, Avast and Microsoft; and the fact that Microsoft is providing a highly-competent desktop firewall program that is baked in to the Windows Vista and 7 operating systems.

Who knows what could be the direction for premium desktop security programs, especially for the Windows platforms.

Articles

Scareware Indictments Put Cybercriminals on Notice – Microsoft On The Issues

Swede charged in US over ‘scareware’ scheme | The Local (Sweden’s News in English) – Sweden

US-Behörden klagen Scareware-Betrüger an | Der Standard (Austria – German language)

From the horse’s mouth

FBI Press release

My comments

What is scareware

Scareware is a form of malware that presents itself as desktop security software. Typically this software uses a lot of emphasis on “flashing-up” of user-interface dialogs that mimic known desktop security programs, whether as add-on programs or functions that are integral to the operating system. They also put up dialogs requiring you to “register” or “activate” the software in a similar manner to most respected programs. This usually leads you to Web sites that require you to enter your credit-card number to pay for the program.

In reality, they are simply another form of Trojan Horse that is in a similar manner to the easy-to-write “fake login screen” Trojans that computer hackers have created in order to capture an administrator’s high-privilege login credentials. Some of the scareware is even written to take over the computer user’s interactive session, usually with processes that start when the computer starts, so as to “ring-fence” the user from vital system-control utilities like Task Manager, Control Panel or command-line options. In some cases, they also stop any executable files from running unless it is one of a narrow list of approved executable files. They are also known to nobble regular desktop anti-malware programs so that they don’t interfere with their nefarious activities. This behaviour outlined here is from observations that I had made over the last few weeks when I was trying to get a teenager’s computer that was infested with “scareware” back to normal operation.

Who ends up with this scareware on their computer

Typically the kind of user who will end up with such software on their computer would be consumers and small-business operators who are computer-naive or computer-illiterate and are most likely to respond to banner ads hawking “free anti-virus software”. They may not know which free consumer-grade anti-virus programs exist for their computing environment. In a similar context, they may have found their computer is operating below par and they have often heard advice that their computer is infested with viruses.

What you should do to avoid scareware and how should you handle an infestation

The proper steps to take to avoid your computer being infested with scareware is to make sure you are using reputable desktop security software on your computer. If you are strapped for cash, you should consider using AVG, Avast, Avira or Microsoft Security Essentials which have the links in the links column on the right of your screen when reading this article on the site.

If you have a computer that is already infected with this menace, it is a good idea to use another computer, whether on your home network or at your workplace, to download a “process-kill” utility like rkill.com to a USB memory key or CD-R and run this on the infected computer immediately after you log in. It may alos be worth visiting the “Bleeping Computer” resource site for further information regarding removing that particular scareware threat that is affecting your computer. This is because I have had very good experience with this site as a resource when I handled a computer that was infested with scareware.

If you are at a large workplace with a system administrator, ask them to prepare a “rescue CD” with the utilities from the “bleeping-computer” Web site or provide a link or “safe-site” option on your work-home laptop to this site so you can use this computer as a “reference” unit for finding out how to remove scareware from a computer on your home network.

How the criminal law fits in to this equation

The criminal law is now being used to target the “scareware” epidemic through the use of charges centred around fraud or deception. Like other criminal cases involving the online world, the situation will touch on legal situations where the offenders are resident in one or more differing countries and the victims are in the same or different other countries at the time of the offence.

This case could raise questions concerning different standards of proof concerning trans-national criminal offences as well as the point of trial for any such offences.

Conclusion

Once you know what the “scareware” menace is, you are able to know that criminal-law measures are being used to tackle it and that you can recognise these threats and handle an infestation.

Disclaimer regarding ongoing criminal cases

This article pertains to an ongoing criminal-law action that is likely to go to trial. Nothing in this article is written to infer guilt on the accused parties who are innocent until proven guilty beyond reasonable doubt in a court of law. All comments are based either on previously-published material or my personal observations relevant to the facts commonly known.

Introduction

Over this last few weeks, there has been hysterical media and political activity in Europe and Australia concerning Google’s Street View activities. This activity has become focused on the collection of Wi-Fi network data by the Street Survey vehicles which grab the initial street images.

The hysteria focused on identifying details about Internet use and Wi-Fi devices that existed at individuals’ addresses and that this data could be used to spy on individuals.

The truth

Wi-Fi site surveys are a part of Wi-Fi networking life

The Wi-Fi site survey is associated with nefarious activities like wardriving but it is commonly practised as part of Wi-Fi network use.

When you want to connect to your Wi-Fi wireless network with a client device, you will come to a point in the device’s setup operation where you see a list of SSIDs, then you choose the SSID that you wish to connect to. This is an elementary form of a site survey.

This is extended to technology enthusiasts like myself who activate Wi-Fi network scanning functions on smartphones to see a list of wireless networks operating in the neighbourhood that they are in for curiosity’s sake. Here, we see the list of SSIDs and an icon beside each SSID that indicates whether the network is protected or not. The practice also extends to use of “Wi-Fi-finder” devices to look for open Wi-Fi networks.

Similarly, people who are optimising wireless networks will use software like inSSIDer (which I have reviewed) or HeatMapper for site surveys and wireless-network optimisation. This software can also yield information about the BSSID and operating channel for that particular SSID and more sophisticated versions can use spectrum analysers to determine interfering frequencies or determine the location using support for GPS modules.

This leads me to Navizon and Skyhook Wireless who have done these surveys in order to turn these beacons in to a location tool in a similar manner to GPS or mobile-phone-tower-based positioning. The most common application of this is the Apple iPhone platform which uses this information for locating the phone during setup, avoiding the need for users to determine their time zone or location.

What does my Wi-Fi network yield

A normally-setup wireless access point or router will send out a “beacon” with contains the following data:

• SSID or ESSID which is the wireless network name
• BSSID which is the MAC address for the access point’s radio transceiver. This MAC address does not have any relationship to the Ethernet MAC address or the broadband (WAN) interface’s MAC address on your wireless router.
• Information required to determine security protocol to establish a successful conection

This data that is in this “beacon” is publicly available in a similar context to the information written on a vehicle’s registration label which would have the registration number (written on the number plates / license plates) and the VIN (vehicle identification number) for that vehicle.

It is also worth knowing that all access points and wireless routers have the option to turn off SSID broadcast. Here, you don’t have the SSID made available but have the network listed as a “hidden network” on some devices. This is something you can do in your router’s or access point’s Web-based management interface

When your network client devices are active in your wireless network and are “talking” to your wireless access point or router, they don’t broadcast an SSID or other beacon because they have “latched on” to that access point or router. This data will usually be encrypeted as part of the WPA security protocols that should be in place on your private wireless network.

Conclusion

Once you know how the Wi-Fi network works, you should then know that a site-survey operation should not gather the actual data that is moved across the network.

Main article

‘Maga No Need Pay’: Nigeria Gets Creative to Fight Cyber Scams | Microsoft On The Issues blog (Microsoft)

Music video – “Maga No Need Pay”

Turn up the volume to enjoy this clip!

Direct link to YouTube clip for TwonkyBeam users to “push” to DLNA media players or if you can’t see the clip on this page.

At the moment, there aren’t any reliable sources where one can obtain the song as an MP3 file.

My comments on this action

Previously, I had written about social networking sites being used as part of 419-style scams, primarily in the form of the “lost traveller” appeal on these sites.

After reading the blog article about Microsoft assisting Nigerian music talent to take steps to educate the youth against cybercrime, I was impressed about how this country can turn itself around and out of the “419-scam” quagmire.

The song was emphasised at the youth there who would think it was cool to become engaged in these scams and other cybercrime, especially thinking they could “live large” on the profits of these scams at the expense of their victims or “maga”. It is part of the Microsoft-led programs which work in a similar way to “Hand Brake Turn” and similar redirection programs sponsored by churches and similar non-profit organisations to steer youth who are at risk of committing crime away from it.

Here, it is definitely a break from the usual information that exists about these scams where the emphasis is on preventing people becoming victims of these scams.

This is my first Internet-security product review for this blog and this product class is a very competitive one, now that there are free “home edition” or “entry edition” programs being offered to Windows platform users from the likes of AVG, Avast and Microsoft. Kaspersky has been known to offer a line of affordable desktop and network security programs that have been built on a strong security platform and this program is no exception.

Installation and Use

The installation went ahead very smoothly and was able to draw attention to a clash between this program and my prior setup which was Windows Firewall as the desktop firewall solution and Avast Home Edition as the anti-malware solution, and offered to uninstall Avast Home Edition before installing itself.

Kaspersky's main operating console

The main software dashboard has a “traffic-light” bar at the top which glows green for a safe environment, yellow for situations that need your attention and red for dangerous environments. It uses a tabbed interface which can show information that pertains to particular aspects of the program. This dashboard can be minimised to a “red K” indicator located in the System Notification Area on the Taskbar and ends up being relative unobtrusive. If it needs to draw your attention, a coloured “pop-up” message shows near that area. You don’t even see “splash screens” when the program starts during the system’s boot cycle, unlike what happens with Norton AntiVirus and other computer-security software delivered as “crapware” with many Windows computers.

Notification Tray icon

The program does download many updates through the day because of the nature of the computer-security threats that evolve too quickly. This is typically indicated with a “globe” symbol underneath the “red K” indicator when the program is minimised to the System Notification Area.

Performance

Kaspersky’s performance under a “full-scan” situation is typical for may desktop computer-security applications because this involves reading files from the computer’s hard disk which is competitive with applications that need use of the hard disk. It had highlighted a password-protected executable file as a risk because of the fact that this can become a way of concealing malware.

The software’s “behind-the-scenes” behaviour can impinge on system performance if you are doing anything that is graphic intensive. But there is an option to have the program concede resources to other computing tasks.

Gaming Profile option

The program also has options available for optimising its behaviour to particular situations. For example, there is an option to disable scheduled scans when a laptop computer is running on batteries and a “gaming mode” which reduces its presence and can disable scheduled scans and updates when you are playing a full-screen game or video and you don’t want the program to interrupt you.

From what I have observed, Kaspersky does a very good job at maintaining a “sterile zone” for your computer. For example, if you plug in a USB memory key, the program will scan the memory key for malware. This is important with malware like the Conficker worm that has been attacking Windows computers and creeping on to USB memory keys.

Privacy protection and security options

There is an optional on-screen virtual keyboard that works against keystroke loggers which capture data from the hardware keyboard.It may not be a defence against keystroke loggers that capture the character stream that is received by an application or software that records on-screen activity.

There is also an anti-banner-ad module which may appeal only to those who “hear no ads, see no ads, speak no ads”. I wouldn’t use this for most Web browsing activities and you still need to be careful that you run only one “pop-up blocker” at a time. I would rather that this can be used to filter advertising that is used for “fly-by-night” offers.

The e-mail protection does work with Windows Live Mail but, if you want to run it as an anti-spam solution for any e-mail client, you have to have it list your mail on a separate screen so you can tell which mail is which. This feature may be useless if you are running multiple other anti-spam measures such as a spam filter integrated in to your mail client or provided as part of your email service.

Desktop content filter

I do have a personal reservation about desktop-based “parental-control” programs because these programs only control the content that arrives at the computer that they run on. This may be OK for situations where the Internet access is primarily on the general-purpose computer that they run on. It doesn’t suit an increasingly-real environment where Internet access is being done on other terminals such as smartphones, multifunction Internet devices, games consoles, and Internet-enabled TVs. Here, I would prefer a “clean feed” that is provided as an option in the Internet service or the content-filtering software to be installed in a very fast router. The desktop filter can work well if a computer is taken to places like hotspots that don’t provide a filtered Internet service.

The content control is also limited to few categories such as the “usual suspects” (porn, gambling, drugs, violence, weapons, explicit language). There isn’t the ability to filter on “hatred” and “intolerance” sites which may be a real issue in today’s world, although the weapons and violence categories may encompass some of that material. I would like to see more granular filtering to suit different age groups and needs.

Nice to have

A feature that this program could have is management of interface to UPnP IGD routers. This could include identifying port-forward requests by applications and checking that these port-forward requests are destroyed when the application is stopped. This could include destroying port-forward requests when the application crashes or clearing all port-forward requests when the system starts so as to clean up port-forwarding “holes” left when a UPnP-enabled application or the system crashes. This is because I have noticed port-forward settings being left standing when an instant-messaging application, game or similar UPnP-enabled application crashes and the router’s UPnP port-forward list has settings from these prior sessions still open. This can provide various back door opportunities to exist for hackers and botnets to operate.

Macintosh users are looked after by Kaspersky through the “Kaspersky AntiVirus For Mac” program which provides virus protection for that platform. It doesn’t provide the full Internet security options that this program has to offer but there may be a desktop firewall built in to MacOS X which can protect against Internet hacks.

As far as the desktop content filter is concerned, I would like to see increased filtering options like an option to filter out “hatred” / “intolerance” sites; and “games and sports” for business needs. There should also be the ability to set up granular filtering options to suit different user needs.

Conclusion

This program may be a valid option for those of us who want to pay for “that bit more” out of our computer security software and want to go beyond the operating-system-standard desktop firewall and the free anti-virus programs like AVG and Avast.

Statement of benefit: I have been provided with the 3-computer 2-year subscription which is worth AUD$159.95 including GST (street price $84 including GST) as a complementary product in order for me to review it.

Facebook | Fighting the Battle Against Money Scams

My comments and further explanation on this topic

This article in Facebook’s blog touches on a very common risk that can affect any social-networking site and user community. It mainly talks of the “money scam” which is really similar to the common “Nigerian” or “419” scam that many of us have encountered through the spam that comes in our mailboxes.

In the social-network version, a fraudster “sets up shop” on a Facebook or similar site and takes over a user’s account. They will then message the user’s social-network friends claiming that they are in another land and out of money. This will be via a message on the Wall or a direct message via the Inbox or a Chat session. They will typically require the friends to wire a huge amount of money to the scammer.

If you do receive one of these kinds of contacts from your friends via a social-networking Website, make a call by regular telephone to the number that you know the friend (or a person that you are sure knows them well such as their spouse / partner, child or employer) can answer such as their home or mobile number. Here, I would prefer to make a voice call rather than use text messaging. Then you can ascertain whether it is the friend who is in need or simply a scam taking place. As well, confirm the situation with mutual contacts. If the friend’s account is being compromised, tell them to change the account’s password immediately. Sometimes, companies like Facebook can lock down a compromised account and e-mail the account holder about what is going on. Then they advise the account holder to change their password immediately.

As well, know what resources do exist in your social-networking service for reporting compromised user accounts and be ready to identify “out-of-character” messages, links or pictures posted up on these services by your friends. For Facebook users, the link is http://www.facebook.com/help.php?page=420 .