Archive for July, 2005
Keep Your Home Wireless Network Secure

Wireless can be a huge risk to your personal life.  Wireless has been one of the most unsecured methods of computers. 

Working from home while using a wireless local area network (WLAN) may lead to theft of sensitive information and criminal or virus infiltration unless proper measures are taken.  As WLANs send information over radio waves, someone with a receiver in your area could be picking up the transmission, thus gaining access to your computer. 

Criminal hackers and spammers could load viruses on to your laptop which could be transferred to the company's network when you go back to work.

Up to 40% of WLAN (see Wireless Attacks links below) users do not have standard security features installed, while 20 per cent are left completely open as default configurations are not secured, but made for the users to have their network up and running ASAP.

It is recommended that wireless router/access point setup be always done though a wired client.

Change default administrative password on wireless router/access point to a secured password.

Enable at least 128-bit WEP encryption on both card and access point. Change your WEP keys periodically. If equipment does not support at least 128-bit WEP encryption, consider replacing it.

Although there are security issues with WEP, it represents minimum level of security, and it should be enabled.

But how secure is WEP:

WEP Cracked in 10 Easy Steps (Video)

WEP Cracked in 10 Minutes (Video)

How to Crack WEP parts 1 & 2 (Tutorial)

WEP is not very secure but it is better than nothing.  Without it neighbors can accidently access your network that is being broadcast for all with reception.

Change the default SSID on your router/access point to a hard to guess name. Setup your computer device to connect to this SSID by default.

Setup router/access point not to broadcast the SSID. The same SSID needs to be setup on the client side manually. This feature may not be available on all equipment.

Block anonymous Internet requests or pings.

On each computer having wireless network card, network connection properties should be configured to allow connection to Access Point Networks Only. Computer to Computer (peer to peer) Connection should not be allowed.

Enable MAC filtering. Deny association to wireless network for unspecified MAC addresses. Mac or Physical addresses are available through your computer device network connection setup and they are physically written on network cards. When adding new wireless cards / computer to the network, their MAC addresses should be registered with the router /access point.

Network router should have firewall features enabled and demilitarized zone (DMZ) feature disabled.

You can test your hardware and personal firewalls using Shields Up test available at http://www.grc.com.

All computers should have a properly configured personal firewall in addition to a hardware firewall.

Update router/access point firmware when new versions become available.

Locate router/access point away from strangers so they cannot reset the router/access point to default settings.

Locate router/access point in the middle of the building rather than near windows to limit signal coverage outside the building.

While none of the measure suggested above provides full protection as countermeasures exist, a collection of suggested measures will act as a deterrent against attacker when other insecure networks represent easier targets.

Another more recent method of securing your system is WI-FI Protected Access (WPA).  Newer routers will have a wizard to assist users in setting up the WPA security.  Although WPA is more secure than WEP, it can also be hacked:

Crack WPA (WPA)

WPA2, recently released, offers a new hope for a very secure and trusted Wireless solution.  Unfortunately it may not work with older routers.

 

 

Wireless Attacks

http://www.eweek.com/article2/0,1759,1605143,00.asp

http://www.onlisareinsradar.com/archives/000624.php

http://www.pcmag.com/article2/0,1895,2345,00.asp

Spam and Phishing, Europe and the USA against the scourge

From the analysis of Trend Micro, a company that specializes in computer security, you can clearly see that the year 2004 was a record year for the distribution of computerized viruses: 30 attacks, 28 of which medium risk and two high risk. Three worms held the first position: Bagle, Mydoom and Netsky, which, together with their variants, were the cause of 25 of the registered attacks.

Email was the preferred channel of diffusion of the several black hat hackers, but others chose to channel illegally to create more, serious damage. The indiscriminate sending of email messages and/or newsletters, Spam, without the consent of the receiver, is illegal. In some countries (the most developed ones), the authorities established that: to send email published without the consent of the receiver is illegal. If this activity is done systematically for profit, you also violate a criminal norm and could be reported to the judicial authorities.

There are several sanctions, and in the worst case, imprisonment. The considerable damage that these activities have done to companies and people has been enormous moreover another tragedy called Phishing, the name given to the system that captures information, like passwords or other personal information, used by many criminal hackers and digital con artists pretend to be reliable people with a real need for information send false emails containing eBay, Pay Pal graphics and official logos and also offer Banking and Credit Card services, asking you to fill in a form enclose in the same email or on a web page with your personal data, and often with your passwords or Credit Card numbers. The form has nothing to do with the official organism imitated in the mail so the password or Credit Card number ends up in the data bank of the black hat who had sent the false email. The experts define this illegal practice as a form of “Social Engineering”.

The latest news reported on this issue is that in order to fight the main threats coming through the web: Spam and Phishing, Europe and the United States have promoted two very distinct initiatives that will start at the same time. The intention is to defeat that virtual monster that has caused damage worth millions of Euro year after year, and according to the experts, will involve a considerable number of people. “Safer Internet Plus” is the project carried forward in Europe. The main target of the project is to beat Spam. The American project on the other hand is called “Digital PhishNet” and is based on the collaboration of several institutions, such as the FBI and private companies. The target is to identify and to bring to justice those people responsible for online fraud, thanks above all to the technique of Phishing.

Glossary
Computerized virus, means small programs able to change clone itself, self send in order to damage or make a network or a single machine vulnerable.

Spamming means the indiscriminate sending of email and/or newsletter messages, without the consent of the receiver.

According to the definition in “Wikipedia” the word Phishing is the capture of personal information, like passwords, personal information, the hacker hiding himself as a trustworthy person with a real need for that information. It is a form of “Social Engineering”.

Social Engineering is the most simple and reliable means of obtaining information that you could not learn otherwise for example username or even your personal data (address, telephone number, etc).

A Black Hat is a criminal hacker.

PGP creator cooks up Net phone protection

PGP creator Zimmermann has developed a prototype of an Internet telephony application that encrypts calls to prevent eavesdropping. He plans to unveil the prototype on Thursday at the Black Hat Briefings security industry conference in Las Vegas.

read more | digg story

Insecurity at Black Hat: antivirus vulnerabilities

This is the reason I manually remove many of the viruses that I've gotten.  For one thing they sometimes don't recognize the virus and until the anti virus software creators update the signature file and for another thing experts are warning that the popularity of antivirus software could turn the defensive measure into a security risk.

read more | digg story

Auditor Flash Video Showing WPA Cracking (some WHAX hacks too)

I don't think if would be this easy to crack WPA2.  Unless a hacker really wants your goods he/she/shim is more than likely going to exploit your neighbor next door who doesn't even have WEP enabled.

A nice flash video showing how to crack wpa wireless security encryption. Using the auditor security collection.

This one is even better: http://www.hackingdefined.com/movies/whax-aircrack-wpa.html

WPA hack using WHAX.

More WHAX ATTACKS:

http://eks0.free.fr/whax-demos/

Click read more to access subject of this post.  See why auditor is so very cool.

read more | digg story

Computers Hacking People ver 1.0

I honestly think you ought to calm down; take a stress pill and think things over. – Hal, 2001 Space Odyssey
 
Information Systems will eventually have the infrastructure and ability to “socially engineer” its creators.  This is far fetched science fiction blooming before our very eyes being created by our own hands.
It will happen when three criteria are in place: 1) The creation of laws that can completely disregard the privacy and sovereignty of human beings.  2) The advancement of Information Awareness System and 3) Smart Artificial Intelligence
 
 
LAWS
Lets discuss the situations that will give governments the pretext to implement laws to track their citizens.  This is happening now.  Laws and systems are being created for unchecked monitoring of individuals under the guise of security, safety and prosperity.  Systems such as national ID cards. 
They were implemented after the Sept 11 attacks on the World Trade Center and in the U.K. after the 7 July attacks in London. 

It was 19th Century philosopher Samuel T. Coleridge who said, “In politics, what begins in fear usually ends in folly.” 

Imagine it: The PATRIOT ACT IV is passed as a result of recent Critical Infrastructure cyber-terrorism attacks.  International terrorists implement a globally synchronized Distributed Denial of Service Attack against the worlds Root nameservers and successfully cripple the Internet for three days.  The impact is devastating as corporations lose billions. 

Domestic Cyber Terrorists infiltrate hospitals by becoming apart of the staff only to socially engineer and infecting HIPPA protected networks with virus’ that wipe out databases and actually scramble prescriptions causing an array of death by misdiagnosis.

Local police and security personnel repeatedly thwart numerous attempts by religious fundamentalists to detonate suit case sized tactical nuclear weapons inside major United State cities but security professionals predict that it is only a matter of time before at least one slips through the cracks.  All the enemy needs is one.
Patriot Act IV is the patron saint of lawmakers who have been screamed at by constituents to “DO SOMETHING NOW!”  The new Patriot Act is eventually internationally accepted and allows for unrestricted Data Mine into commercial and state owned databases worldwide (US-EU).  It of course has deferent names and variations world wide but its application is the same.  In the United Kingdom it is called the Civil Contingencies Bill.  The data mining would tap into the “transaction space” by accessing hospital, financial transaction and legal databases world wide to be shared by all law enforcement agencies (county, federal, city local and international).  The system works like a global Amber Alert system that can track criminals anywhere in the world and notify the respective local agency immediately.  The system works very, very well.
 
 
Information Awareness Systems

The system, developed under the direction of John Poindexter, then-director of DARPA’s
Information Awareness Office, was envisioned to give law enforcement access to private data without suspicion of wrongdoing or a warrant. — Electronic Privacy Information Center.
 
Government funded unrestricted Data Mining and Information Awareness programs develop and run revolutionary Information Awareness Systems.  Despite public opinion, these National Security systems continue to work to protect the nation against enemies foreign and domestic.  The system extracts data from its transactional databases and recognizes patterns of behavior that would fit that of a terrorist.  The system is so exhaustive that is works with 70% accuracy and seamlessly in conjunction with systems such as Next Generation Facial Recognition systems and Activity, Recognition Monitoring for enhanced surveillance. 
 
           
Artificial Intelligence
Within thirty years, we will have the technological means to create superhuman intelligence. Shortly after, the human era will be ended. – Vernon Vinge, 1993, What is the Singularity?
 
Artificial Intelligence has been in use for many years.  It is greatly relied upon for businesses, hospitals, military units and even in forms of entertainment such as video games.  However Strong Artificial Intelligence, the development of cognitive systems simulating the human brain, have been developing quietly in research labs around the world under programs dedicated to the “scientific understanding of the mechanisms underlying thought and intelligent behavior and their embodiment in machines. (AAAI)” 
 
Smart Information Awareness is Strong Artificial Intelligence merged with Information Awareness Systems.  Smart Information Awareness seems to go beyond merely recognizing patterns of behavior as it predicts the future actions of a given psychological profile with over 75% accuracy allowing Law Enforcement to be like an all seeing eye with incredible new methods of forensics and counterterrorism.  Crime as a whole will be greatly reduced.  System that recognize criminal patterns have been around for some time, Smart Information Awareness systems are a new trend.
 
 
The Smart Information Awareness system is so accurate in determining human behavior trends that it is used to track and manipulate consumer buying habits for corporations.  With its accuracy, the system will be able to determine what marketing tools can be used to influence the behavior of buyers. 
 
With unfettered access to consumer’s personal transactions, buying habits, methods of payment, and credit history a system would be able to pin point buyers who demonstrate interests in certain products and offer “special deals” a specific group of highly interested buyers.
 
  
Inevitably the very system (laws, practices and technologies) that successfully protects humanity from itself is used to manipulate and exploit humanity.
 
Perhaps you believe that there is nothing wring with this level of target marketing.  If so, I submit to you these questions:  What will separate humanity from cattle if every man, woman and child is seen as nothing but a number and a consumer to the system that we rely on to survive?  Since we are already regarded as merely numbers and consumers by the corporate beast, how much control and information will we allow them to have?
 
 
Perhaps this is a bit much.  Perhaps I exaggerate the technology and extent of fear that will breed it.
 
 
 
 
 
http://www.p2pnet.net/issue03/page1.html
 
http://www.epic.org/
 
http://www.jbholston.com/weblog_discussion.php?post_id=74
Statewatch.com – Secret EU-US agreement being negotiated. http://www.statewatch.org/news/2002/jul/11Auseu.htm
http://www.eff.org/Privacy/TIA/20030523_tia_report_review.php
 
http://www.aaai.org/

Russia's Biggest Spammer Brutally Murdered in Apartment

Um, ok.  I hate spammers as much (if not more) than the next guy, but not enough to murder any one. 

Vardan Kushnir, notorious for sending spam to each and every citizen of Russia who appeared to have an e-mail, was found dead in his Moscow apartment on Sunday, Interfax reported Monday. He died after suffering repeated blows to the head.
Nobody in the entire population is being ruled out as a suspect. 😉

Found this story via digg.  And it occured to me that I had a category called “Kill Spammers.”  I was just being sarcastic.  Killing someone for sending you too many emails is just a BIT extreeme.  I think people get a little too into their little worlds and forget that there are other things our side of email.. things like LIFE.

Perhaps I should rename this category “Don't Kill Spammers.”

read more | digg story

WLAN (Wireless LAN) Whitepaper

WLAN Topics Discussed:
The Benefits and Drawbacks of Wireless LANs, WLAN Architecture and Security Challenges, Authentication, Data Privacy, Rogue Access Points, Early WLAN Implementations, The problem with WEP, The 802.1x Solution, Tools Available for use on WLANs.

read more | digg story

Finding Anit Virus, Anti Spyware Resources

The whole arena of spyware intrusion is extremely fluid with the
spyware writers trying to outsmart everyone, and the software
protection writers diligently working to keep up with the hundreds of
new worms and viruses appearing nearly every day.

Fortunately, there are generous individuals and organizations who
have the facilities to review the work of the Anti-spyware developers
and make the results available for all of us everyday users of the
Internet.

The challenge for us is to know where to go for these results and
recommendations, and to know which of the anti-spyware and anti-virus
programs to use on our computers.

There are many web masters, newsletter, and Blog publishers who
constantly monitor the results published by the anti-spyware reviewers.
Most of them pass these information alerts on to their readers and
subscribers, often offering suggestions and advice based on their own
personal experiences and expertise.

A real benefit for us is that most of the top rated anti-spyware
and anti-virus programs are free, or available in Trial or Demo
versions.

All we need do is find out where to get them. But first, we need to find the reviewers who post the alerts.

If subscribing to newsletters and Blogs isn't your usual surfing
activity, you can do a search for security alert newsletters or
security alert blogs. For example, do a Yahoo search for “security
alert newsletter” (use the quotation marks to get the most appropriate
search results). Do the same for a Yahoo or Google search on “virus alert blog”. (Blogs are web logs).

Investigate the first and second pages of the search results and
select three or four of the listings as a starting point. Many
newsletters are published on a monthly schedule and may not contain the
most current information. Some are published weekly. They may be better
choices.

Blogs are usually much more current since Blog authors often post
their information every couple of days – some even on a daily basis.

Blogs are riding a major wave of popularity. For the serious
searchers of current information, this is a great benefit. There aren't
as many Blog sites as web sites yet, so it's often much easier to find
the information you're looking for.

Many Blog authors make their publications available for RSS (Real
Simple Syndication) readers. If you have added a RSS reader to your
browser, you can get up-to-the-minute alerts presented to you
automatically. You don't need to go looking for them.

Many updated browsers, like Netscape 8 and Firefox include this
feature as part of their package. Expect the newest Internet Explorer
to have a RSS Reader, too.

Don't be overwhelmed by all of the information you get. After doing
these searches and reviews once or twice, it will be a simple task to
select what you need to keep yourself current.

For starters, it is generally accepted practice to select and use
at least two anti-spyware programs. Choose from among the two or three
that receive the highest recommendations and ratings from the
newsletter and Blog authors. Be especially watchful for and select one
of those programs that provides 'Real Time' monitoring. (Which means
that they monitor and catch any incoming bugs that may try to infect
your machine while you are online).

Downloading instructions are nearly always present with the
reviews. If not, you'll find sites like c|net.com to be a good source
for download links.

Just don't forget to check for and update your security software. The spyware writers won't give you a break if you do.

Londonbombings Virus Alert

A virus maker has exploited the London bombings tradgedy – using it to lure people into downloading the virus. An e-mail is sent to the victim posing as a CNN newsletter; and claiming to link to ameteur video footage of the disaster – but it’s just a link to the virus.

read more | digg story