Computer Security Resolutions for 2008

As many of us approach a new year, we like to make resolutions that we want to do in the coming year. Nothing should be different when it comes to computer security so I thought I would help you out. First things first. Please care about computer security. In this post, I will refer back to some of my prior posts that explain why you should care. It reminds me of the old joke. Doctor Doctor! It hurts when I do this!!! The Doctor said “Don’t do that!!!”. Computer security is kind of like that. You can tell people what to avoid and behaviors to do or not do, and they choose to ignore suggestions. Or you have kids who choose not to do what you tell them. So here it goes for my computer security resolutions.

1. Care about computer security. Bad guys would love to get control of your PC. Click here to see why.

2. Steps to take in 2008. Click here to see them.

3. Get smarter! I’ll try and help teach you what steps to take to not be a victim. Click here to see how.

4. Change passwords to a more secure password. Click here to see why.

5. Be careful when going mobile. If you have a laptop and travel, take caution when connecting to wireless AP’s. Click here to see why.

6. Change your Internet behavior. Click here to see what I mean.

If you can’t tell, I am rather passionate about what I do for a living. If I can help someone not have their ID stolen or credit card information stolen, I would feel much better. Hopefully this outlet has allowed me to help you some this year. I hope you will continue to read my posts. I will try and keep them current and yes I’ll probably repeat myself on certain topics. It is because the bad guys are always looking for a way to entice you to click on some attachment or a link in an unsolicited e-mail. Please let me know if you find this information helpful. I think one of the most popular posts I have made is how to find the SSID on a wireless router.

Stay safe this New Years Eve and have fun. I talk some about my KC Chiefs and well all I can tell you is I’m glad this season is almost over. My Kansas University Jayhawks are in the Orange Bowl on January 3. We are really starting to get into the heart of the NCAA Basket ball season and my Hawks are ranked number 3 right now. They look good. I’m looking forward to another great year so stay safe while online and we’ll talk again after the New Year!

 

Storm Bot-net Attack! Merry Christmas You Animal!

Not too long ago, the Storm Bot-net has been starting a much anticipated attack that is trying to recruit more members into it’s growing bots-net.  The attack is documented in the SANS Internet Storm Center.  Here is a snippet of what is mentioned there.

Shortly after 0000 GMT 24-DEC-2007 reports came in indicating that the Storm Botnet was sending out another wave of attempts to enlist new members.  This version is a Christmas-themed stripshow directing victims to merrychristmasdude.com.

The message comes in with a number of subjects:

Subject: I love this Carol!
Subject: Santa Said, HO HO HO
Subject: Christmas Email
Subject: The Perfect Christmas
Subject: Find Some Christmas Tail
Subject: Time for a little Christmas Cheer

Once again this is just another way of tempting you to click on something thinking you are getting one thing, instead you get attacked by the infamous Storm Worm Bot-net.  As always, don’t click links or attachments in unsolicited e-mails.

My Chiefs really suck.  Even Detroit who sucks just a bit less than my KC Chiefs beat us.  Well I hope the Chiefs have been good and Santa brings them all the help they need in the offseason.  Take care and stay safe.  Happy Holidays and remember the reason for the season.

 

It’s Christmas Time!

With Christmas right around the corner, it’s a good reminder to talk about Internet Safety.  Spammers work overtime this time of year to try and trick you in to giving up your personal information.  Sometime, spammers can really look authentic.  So I ring the warming bell, to be very careful when going through your e-mail’s Inbox.

And the bad thing is, after Christmas, you will start seeing spam e-mail that appears to be from the IRS.  They’ll tell you track your refund, and all you have to do is give us some really valuable information.  Probably name, address, of course your SSN.  The IRS doesn’t have an e-mail service that tracks and tells you where your refund is.

This is just a reminder that you really need to be vigilant.  Question EVERYTHING that comes via e-mail.  Hey, be vigilant when people on the phone asks you for information.  Create your own “Need to Know” policy.  Protect your information.  It is up to you.  Little things you can do will protect you and keep from being taken advantage of.

OK, now for a little football.  I’m a KC Chiefs fan.  And it has been a REALLY long season.  I think I read it is now 7 loses in a row.  This really is defining that I am a fan.  I don’t jump the band wagon to another team.  I just hope that the KC Chiefs get what they want for Christmas.  Let’s see new offensive line would be nice.  A healthy Larry Johnson.  A new offensive coordinator.  A good YOUNG kicker.  Wow, I hope we’ve been good because our list is long.

Stay safe, and question everything.  Hope your Holiday season is a blessed one.  Talk soon.

 

Beware of Wireless AP’s While Traveling

Well hope all is well with you this Holiday Season. It’s been a few days since posting anything so I thought I would add something here late Sunday evening. I took a trip to a popular area in the Ozark Mountains this past weekend. Ended up driving home in a storm that was highlighted on The Weather Channel. This is where this posting comes from.

Well, traveled down to the Branson area on Friday evening. Guess I missed a pretty big storm around home. Ice, snow, sleet, or a mix off all three. Anyway, of course the lodging that I stayed in offered free WiFi. Fantastic. I’m always leary of signing on these AP’s so I don’t enter any personal information. I had brought the handy dandy laptop and fired it up to get some information on Silver Dollar City, and of course look at the weather story that was starting to unfold this weekend. Well we arrived late enough Friday that I really didn’t want to call and get the sign on information from the front desk, but decided to fire up Net Stumbler to see what I could at least find.

I could see the resort’s AP’s. They were named something really obvious. To access it you had to have the credentials. However, I also noticed what looked to be an internal network the resort ran, plus an interesting AP that was named linksys. Wow, linksys. Very common name. Just happens to be the default SSID name for LinkSys wireless routers. So I closed down Net Stumbler and opened up the wireless AP’s that were broadcasting and within range of my laptop. I could see the LinkSys SSID called linksys.

Interesting thing about that AP is that it was an open network. Yep. Very risky if you ask me. The security professional in my said, I hope nobody is connecting to this SSID because you don’t know if someone is sniffing the traffic. This is a huge security risk. To you and your personal identity. So I thought this would be a great lesson since many of you probably travel with your laptops. There are times that you see an open wireless AP that you could connect to. But think of this. Do you have cookies on your hard drive that contain account numbers, passwords, pin numbers? Do you have any saved passwords for certain accounts that a hacker can steal? You don’t save your bank account information do you? Or your investment account number and password? I hope not. If so, you may have lost it in a matter of seconds.

Only use trusted AP’s. Many times, this means you own secured network you have set up at home. I stress the word SECURED! Password protect your own AP at home. When traveling, be very cautious of the networks you connect to. When using a hotel’s wireless system, I would still not enter too much personal private information. Make sure you don’t save log on credentials that browsers like to offer to do for you. That means that log on information is written to a file and it can be stolen quickly. You’d never know that it happened. When traveling, check trusted sites. Weather, your destinations web pages, possibly news, but that is about it.

I’m just glad to be home even though it is a bit of a mess, weather wise. I hear we have a bad ice event that is starting Monday night into all day Tuesday along the I-70 corridor. My poor Kansas City Chiefs lost badly in Denver today. It is hard to watch but I know that there will be major changes coming next year. Many of the guys on this team will not be here next year. Gotta hope for a great draft, a few free agent signings, and then we’ll look forward to next year. Not sure we’ll have any more wins this year.

As for my Kansas Jayhawks, they looked great on Saturday taking DePaul down in Lawrence. Love to hear you Missouri (MISERY) Tiger fans cry that they didn’t get the BCS bid. I can’t wait for Christmas, I can’t wait for BCS Bowls, I can’t wait for March Madness and I can’t wait for WARM WEATHER!!

 

Encrypt your USB Drive to Protect Your Information

Are you one who has found that the convenience of those USB drives that fit in your pocket but can hold tons of information?  What kind of information are you storing on those drives?  Is it information that you really would prefer to keep private in case it fell into the wrong hands?  Have you even thought about what is there and what happens if you lose it?  This is a great thing to think about and you can take action to protect yourself with a free open source tool called TrueCrypt.

Let’s say you back up files that contain banking information or other financial information, then you need to encrypt these files.  With TrueCrypt, you can encrypt the entire drive.  New technologies are great and there are great uses for these small devices, but you really need to think of what you are storing on these.  With larger sizes of these devices, more and more people are buying these.  They are inexpensive, and very handy.  But can be a security risk to you.  Don’t wait.  If you have personal information on your USB storage device, visit TrueCrypt and encrypt your drive and protect your information.

OK, I’m a huge sports fan and this weekend was a big weekend for my teams.  In college, my KU Jayhawks played those Misery Tigers at Arrowhead Stadium Saturday night.  OK, MU is good.  Really good.  KU couldn’t get anything started and ran out of time.  MU is now number one.  I’ve tried to tell myself that it would be good for MU to win against Oklahoma this weekend for the Big 12 Championship.  Here is what happened though.  I can’t come to accept pulling for the Misery Tigers.  So, BOOMER SOONER I hope the crush the Tigers dream of being the national champion.  So Saturday I’ll be pulling for OU to beat the Tigers.  If there are any Missouri fans who read my blog or run across it this week when they do a Google Search, I hop you don’t take my advice.  I hope you get hacked, I hope you lose your personal information, and I hope you get pwned by some evil bot master.  That really wasn’t nice.

Well Sunday, I had another chance to have my team win and make me feel better.  Kansas City Chiefs played their old hated rivals the Oakland Raiders.  We’ve  owned the series over the past few years.  Oakland on the schedule became a win you could count on.  Well this year, it was different.  Oakland actually ran KC to death in the 4th quarter.   Kolby Smith ran really well.  150 yards for the game.  But KC fell short.  I am OK.  The earth didn’t stop revolving.  This year is just a rough year for the KC Chiefs. May be a few but I think all us fans can bear with it if the outcome is a stronger team in the future.

Hope your weekend was good, and I hope you are finding this information informative.  Stay safe (unless you are Misery fan) and hope your Holiday season has started off well.  ROCK CHALK JAYHAWK GO KU!!!

 

What Would a Hacker Want with my PC?

I review SANS Internet Storm Center everyday to try and keep up with the current “bad guy” happenings that the Internet Storm Center reports back. They are a source of sharing information with the Security Community and let you know what is happening currently. The Storm Center has somewhere around 40 people who rotate 24 hour shifts and it is manned continually. The link I have in the first line of this post is the story I’m using as my source for this posting.

Have you ever asked the question, what would a hacker want with my PC? You may not bank online and you may not shop online, but you need to know what a hacker sees in your PC. Kevin Liston wrote this post to remind us that when you have a presence on the Internet, you do have things of value to the criminal mind. You have a CPU, Memory, Hard Drive, and an Internet access/IP address. From using your PC as a bot that the criminal can control, to your hard drive where they can store pirated files or even child pornography, to an IP that hasn’t been blacklisted.

If you’ve ever thought that “no hacker wants anything on my PC”, look at your PC as an asset that can be used to the hacker’s advantage to gain financially over possibly you, or others. Ignorance is your enemy. Hopefully, if you are reading this for the first time, you will come back for more knowledge.

My Kansas University Jayhawks meet the BEST TEAM EVER the Mizery Tigers lead by Chase Daniels or whatever his name is. The Jayhawks have decided to actually show up and not mail in the victory for Missouri U. Saturday night at Arrowhead Stadium, KU and MU go head to head. Me, I’ll be rooting on my Jayhawks. On top of this game on Saturday, My KC Chiefs take on the dreaded Raiders. Let me tell you, this game will be interesting. Priest Holmes retired this week. Larry Johnson is still unable to play. That leaves…..Colby Smith? Who the heck is he? He will be tested on Sunday.

Hope you all had a great Thanksgiving, and you’ve got a good start to your Christmas shopping on Black Friday. Stay safe, keep reading and learning, and arm yourself with knowledge and protect yourself from the criminal hacker. ROCK CHALK JAYHAWK GO KU!!

 

Spammers Try to Trick you with YouTube Video

Hope your Sunday evening is going great. We are at the end of the weekend and we have Thanksgiving coming up this Thursday. In my job, I keep tabs on how attackers are targeting good folks out there who will eventually click on something and give attackers control of their PC. Today the popular YouTube is being used as bait. There is a write up in Trend Micro’s blog that really gives great information. This is one of my sources I use when keeping up with Computer Security news.

Seems that the attacker sends spam e-mails out to millions and millions of e-mail addresses and you may be one of those who gets one in their inbox. Here is an example of the e-mail that Trend Micro has seen.

The trick is this. You click on the link in the spam e-mail and you get presented a message stating something like, to view this video, you need to download a new FlashPlayer and some similar spam e-mails have said you need to download a new codec file which really is the nasty file. This is once again a reminder to not click on links in unsolicited e-mails and NEVER give information when asked from an unsolicited e-mail.  If you want to check the out Trend Micro’s blog you can find it at http://blog.trendmicro.com/

The KU Jayhawks are 11 - 0. Ranked number 2 in the BCS polls. And who’s number 3? Mizzery (Missouri) Tigers. A nationally televised game this coming Saturday in Kansas City Chief’s Arrowhead Stadium. Let us all remember that the Mizzery Tigers are the greatest team ever and should always have been rated over the KU Jayhawks and the Jayhawks should never even show up because they can’t stand up to the great and mighty Mizzery Tigers. Oh well, I’m REALLY looking forward to this game and I’ll be glued to the tube. The game has been sold out for weeks prior to all that has happened to make this game huge in the BCS standings.

My Chiefs…didn’t get their butts kicked like I thought. Really the defense is the best thing the Chiefs have this year. They did a great job holding Manning and the Colts down. Granted, the Colts have a lot of injuries.

Hope you have a great week and with the Holiday’s coming fast, the spammers will come up with new twists and try to trick you so stay safe. Be careful out there and we’ll talk again soon.

 

All About Wireless Security

By far, my most popular post has been the one titled “How to Find My SSID” so it is obviously a topic on people’s minds. Well we will talk wireless as we enter in to this weekend just prior to Thanksgiving. I won’t repeat myself totally, so if you want more information on wireless and computer security, you can read my previous posts.

This is probably a good time to talk about wireless with the Holiday Season is upon us. A few years back, TJ Maxx had what has now been reported at over 94 million personal records being stolen. Well almost 3 years later, many retailers have not done enough to secure the wireless security and is putting YOU at risk. A company called Security Sweep who does wi-fi penetration testing for companies, did a study in what type of security is in place. They found a whopping 85% of retailers have little or no security at all. Click here to read the whole story. Makes you wonder what to do with your Christmas shopping. This argument may make you think more before you whip that plastic card down.

Here is another helpful hint if you do shopping online for Christmas. Apply for a credit card that you will use only for your online shopping. Have your financial institution only set a low limit. Maybe $300. You just have to ask for a low limit credit card. Use this only when making purchases online and then you can spot inconsistency’s on your bill each month. This low limit will minimize the losses that can be run up.

Review some of my tips we reviewed in other posts from my blog here on WordPress.

Hey, the KU Jayhawks play in a big home game tomorrow against the Iowa Stae Cyclones. They will hopefully come out strong and do what is expected. KU football has totally impressed me this year. All must say this has really been a strange season with all the teams who you normally see there getting beat. Well the dream stays alive tomorrow.

My beloved KC Chiefs will probably get a can of “whoop ass” opened up on them Sunday at Indy. I’d say they are mad they have lost 2 games in a row. With our change to a new QB, no LJ, and no O Line , it will be a LONG day.

That is it for now, so stay save and have a great weekend!!

 

Internet Behavior Can Protect You

We’ve talked about this in previous entries but it is always good to review how your behavior while surfing the Internet can go a long way in protecting yourself from the bad guys. The specifics we’ll talk about in this entry will be porn, P2P, and free applications on the Internet.

Porn. It is a weakness that a lot of men have and probably some women too. You have to understand that bad guys know that they want as many targets as possible so they look to what can be used to spread their evil wares. Like anyone else, bad guys want to spread their keyloggers, file stealing applications, and bot software to be able to use your computer for their evil purposes. Since many have a weakness for pornography, this is a known target for bad guys to plant their traps. My advice? Stay away. Make sure all people in your household stay away also.

P2P. Also known as peer 2 peer software. It is known as file sharing software that can be used to spread software, music, videos, and pictures. All I have to say about P2P is that you need to be warned. Not only is it illegal, you may get more that you than you bargained for. Bad guys like attaching some of their evil software along for the ride. My advice? Don’t use P2P unless it is a trusted source and if it is legal.

Lastly, we’ll talk free applications.  I am really careful about what applications that are free that I use.  I’ve mentioned in previous entries that I use firewall, antispyware, and antivirus that are free.  When you are making the decision to download a “free” application from the Internet, it is best to actually read the EULA.  The EULA is end user license agreement.  You may be agreeing to be tracked so adware popups can be sent to you or your e-mail address might be given to spammers so you get even more of the e-mail crap than you do today.

Your behavior on the Internet really may be your absolutely best protection.  More than antivirus, or antispyware.  Be smart and don’t fall for the bad guys out there trying to take advantage of you in a financial way.

OK, now to my KC Chiefs.  OK, the whole AFC West is really bad.  KC got beat by the Stinkin’ Broncos.  They suck just a little less than we do.  My mid-season prediction is San Diego will win the West.   KC and Denver will really suck.  Oakland sucks too.  Doesn’t matter who actually wins because it will be one and done in the playoffs.  KC changed QB’s today and I don’t think that will make much of a difference, but then you never know.

KU on the other hand looked fantastic defeating the OSU Cowboys.  I want to continue to hear how much better the Misery Tigers are than KU.  Ask the Tigers and they think that they should be rated number one in the country.  Wake up Misery!

That is it for now.  Stay safe and have a great week!

 

TGIF!! Computer Security Update.

It’s been a few days since I last posted anything so it is time.  That way I can comment on my Jayhawks as they face Oklahoma State on Saturday.  On Sunday my Chiefs host the stinkin’ Broncos at Arrowhead.  I love watching the NFL and I love watching my Chiefs beat the Broncos.  Looking forward to that.

OK, back to Computer Security for a moment.  It has actually been a rather quiet week.  As I browse through all the security stories for this week, I don’t think the Storm Worm was mentioned one time.  This is actually SOP for the Storm Worm.  It turns off and on at the attackers will.  So on this slow week, we’ll talk about a really nice computer security tool that helps you to check and see if your machine has all the patches, so that is what we’ll talk about in today’s posting.

The tool is a Google gadget that works with Google Desktop.  So if you want to use it, then you will need to download and install the Google Desktop tool.  After doing this, then you can visit Shavlik’s site to download the Shavlik Patch Google Gadget.  Once installed, you can scan your PC to see that you are patched.  The great thing about this tool is it doesn’t limit you to just Microsoft patches but it includes scanning for other products too, like Adobe, RealPlayer, and WinZip to name a few.  It is a great tool to make sure you are patched.  You can run the scan and it is very quick.  You can then view what patches you are missing and  gives you links  to go get the patches.

That is my one fantastic tip I can give you on what seems to be a fairly slow week.  Have a great weekend and stay safe.  Rock Chalk Jayhawk GO KU!!