Category: Computer Security

  • Yet another university hacked for personal records

    College networks are always getting owned.  Why is that?  You'd think that these haven for some of the greatest developing minds in the country would be like digital fortresses with a battalion of young Internet hardened GEEKS patroling the college data 24/7.

    This is a sign that even though security awareness has risen people still are not taking it seriously. 

    POMONA – Computer hackers added Cal Poly Pomona to a growing list of schools from which personal information has been accessed illegally. Notification went out to 31,077 people Thursday that their records might have been stolen after Cal Poly Pomona discovered two computer servers were compromised in late June…

    read more | digg story

  • Experts: Computer Crime Down But Caution Still Needed

    CSI/FBI Computer Crime and Security Survey, Richardson noted that the average loss per cybercrime incident in 2005 was about US$250,000. That compares to $500,000 in 2004 and more than $3 million in 2001

    I guess Computer Crime has gone up comparing the begining of the year to the end of the year but overall more people (especially companies) are taking security much more seriously.  And it is about time, but industry security still has a ways to go… home security has barely started.

    read more | digg story

  • My Honeypot server: Message from system to alert spam

    I plugged an unpatched Windows 2000 system on the Internet with no
    firewall, antivirus or even pop up blockers to sniff out the raw filth
    being pumped to the world. 

    What I was immediately spammed with was “Message from System to Alert messages” from various “security software” sites.   Here are the results:

    “Message from System to Alert” Pop ups

    These messages claimed to be from Microsoft or from my system or from
    System32 saying my registry was corrupt and a bunch of other lies.

  • Surfing with an Admin account or How to Get Owned

    Martin McKeay over at mckeay.net is has good methods of securing his home network:

    I'm a strong believer in the 'rule of least privileges' as my wife and children well know; at least once a week I get called over to the kids computer to log in as administrator and install some program for them. The kids have gotten used to it, but my wife hasn't and she's forgotten that I gave her the adminstrator password.

    The reason it is a great idea to use the least priveleges possible and not go surfing the net with Admin priviledges is that if you (or anyone on your computer with admin priviledges) hit an exploit site that downloads something on your system, it will do so with your administrator permissions. 

    It is best to surf the web with an account that does not have permission to download anything from the web, with elevated security features on Internet Explorer (cookies and java scripts turned off).  In fact, just use and patched version of Firefox. 

    More Security on Internet Explorer

    You can increase security feature of IE by going to Tools | Internet Options | Security tab.  Adjust the trust you have for the Internet by adjusting the level on the slider in the “Security Level for this Zone Area.” 

    If you surf the web with an administrator account without a firewall not only will you more than likely get hit with a trojan and worms you will give the masters of these products elevated priviledges to your system as they will install code in the C:\Windows\System32 – also known as root. From root a criminal hacker can do practically anything they want with your computer (including install a keylogger that copies everything you type and send the data back to some IRC room on the Internet.)

    In layman's terms, they will OWN your ass.  

    If your really paranoid: 

    Customize your selected security levels by clicking the “Custom Level” button inthe “Security Level for this Zone Area.”  Disable Active X, and Java to completely destroy the ability of malicious mobile code to affect Internet Explorer (unless its already on your system).  This will impare your ability to expirience anything beyond text.

     

  • Computer Security 101: Proactive Security

    Another university accepted ethical hacking.  Lately it seems every other month educational institutions are teaching security hacking.  I think this is good.  It is important to learn many kinds of Wire-Fu. 

    Oct. 3–NEW HAVEN, Conn. — The computer lab tucked into a corridor at Jennings Hall at Southern Connecticut State University may not look it, but it's sick.

    Viruses run rampant. Firewalls are frowned on. Here, hacking is not only encouraged, it's a course requirement.

    “Last week, I went onto a computer in the back room. Their homework was to figure out what I did and log into my fake account,” said Lisa Lancor, an associate professor of computer science.

     

    University of Calgary hacker course 

    University of Glamorgan – Certified security Testing Associate and Professional and Certified Forensic Investigation Analyst

     Internation Counsel of e-Commerce Consultants – Certified Ethical Hacker CEH – Certification

  • Updating Your Windows Operating System is very Easy!

    Many everyday Internet Users do not know why they must keep their computer Operating Systems Up-To-Date – and many don’t even know what an Operating System is!

    From “ignorance is bliss” to “surprise attack and disaster” – how many thousands of Internet users have experienced this frustration and grief?

    This raises the obvious question: “Why haven't they prepared to avoid it?”

    The startling fact is that there are many long term Internet users who have never even considered updating their Operating Systems and protective Safe-ware.

    Perhaps the complexity of it all contributes to what might be described as User apathy – or indifference and a lack of enthusiasm toward the following:

    * The news of yet another vulnerability or patch process.

    * The potential damage to computer, personal information and reputation – i.e. the “It can't happen to me” attitude.

    * Their own abilities – i.e. “I’m too old, too dumb, too whatever – to learn how to fix a computer without breaking something.”

    * Updating – i.e. “My computer came with an anti-virus program, so why does it need to be updated now?”

    The sad fact is that the lack of confidence people have in their ability to build a defense often leads to a reluctance to even accept the reality of Cyber Threats.

    Some of the lesser-experienced Internet users rationalize their lack of action with pessimism, even defeatism. Human nature often supports these excuses with defensive attitudes and mis-beliefs like:

    * False sense of disaster support – “My nephew, neighbor, son or whoever, is a computer whizz. They’ll be able to fix the problem if anything ever happens.”

    * Scepticism – “All this talk about viruses is just so the “news people” will have information for publishing, and so the software manufactureres can scare people into buying more of their products.”

    * Ignorance (of the extent of deception, skills and sophistication that the malicious hackers have attained).

    * Disbelief (that personal computer might be infected and used by others to spread malicious viruses and worms). “My computer seems to be working ok – a little slow, maybe, but it is getting pretty old.”

    * Overwhemed (too many choices with firewalls, anti-virus, anti-spam, anti-spyware, Trojan removers). “Why do I need all of these and which ones should I use?” or “Do I really need to update my Operating System, my anti virus, spam, spyware stuff?”…I’ll just never learn how to do all of this.

    * Expense (How much will all this cost and is it really necessary?)

    * Fatalism – “Hey, if it’s going to happen, it will, and I’ll just junk my computer and get another one. Mine’s getting kind of old, anyway.”

    Here, then, are the Shocking facts about updating PC Operating Systems.

    There are many unaware Internet users who have been online for years, but lack in these ares:

    * They don’t know what “Updating” really means.

    * They have never responded to the popup message associated with the icon in the Task tray that announces new Windows Updates.

    * They have never clicked on the Windows Update icon in the Program Start menu.

    * They have never visited the Microsoft Windows Update web page at http://windowsupdate.microsoft.com/.

    * They have never updated their PC Operating Systems.

    Even if they have been able to navigate to the Microsoft Update webpage, many just throw up their hands in despair at the overwhelming number of choices and unknowns, such as:

    * Choosing what to update from the long list of options.

    * Waiting for Windows to check the registry for available updates.

    * Deciphering the Update descriptions (and instructions).

    * Selecting or Removing the necessary options.

    * Starting the download.

    And oftentimes, many people have never even used the Windows Help information to find out how to update their computer Operating Systems.

    How many self taught or untrained computer users are going to persevere through all of the hassle described above? Is it any wonder so many computers become infected? The criminal Hackers building their bot and zombie armies have nearly an open and undefended playing field; many are using it every day to steal money and identities.

    So, what is the solution to this problem?

    If individuals with computer “understanding” would help and assist others with less knowledge, there would probably be less of a problem.

    Nearly everyone who has faithfully kept their PC Operating Systems and Safe-ware up to date surely has family members and friends who could benefit from an hour or so of basic instructions. This would make it much more difficult for the criminal Hackers to compromise another persons computer.

    Hacker's would eventually be faced with a growing number of adequately protected computers, educated Users and hopefully would finally give-up trying!

  • Anti-Spyware Gets HIP

    Anti-spyware software is expected to
    transition from threat-specific technologies to Host-based Intrusion
    Prevention Systems (HIPS) as vendors deploy proactive solutions that
    block new and unknown spyware programs from PCs. Such solutions are
    likely to be increasingly compelling for security.

    Its about time this more proactive approach to malware and spyware is
    put right on desktops.  Eventually the masses will get so fed up
    with malicious code that there will be a huge market for behavioral
    based intrustion detection type software. 

    With the amount of money that is being made by virus and spyware
    makers, malware is developing faster than computer security could ever
    dream.  Proactive methods such as HoneyMonkey servers and HIPS
    products will no doubt be a big hit.  It is about time that
    Information Security had more of a proactive response and not as
    reactive. 

    With corporations more interested in protecting there ASSets then with
    developing a good product and protecting the customers, its time that
    we security professions get aggressive an proactive with our
    methods.  That will be the only way to fight malware in the future.

    read more | digg story

  • Hacked: Who Else Is Using Your Computer?

    A friend called me one day and asked if I would stop by to
    look at his computer. He said it was running abnormally slow
    and he had found something on his hard-drive he could not
    explain. I could almost guess what it was he found.
    Have I been hacked?

    You see, his computer had been hacked. Actually, in his
    case, his computer had been tagged. Similar to the image you
    see here.

    Tag, You're It!

    —————
    The file transfer protocol, commonly referred to as “FTP”,
    has been around for many years. In the early days of the
    Internet, it was one of the few ways to easily upload and
    download files from one computer to another. Many
    commercial operating systems come with an FTP server
    installed. In other cases, the option for FTP services is
    selected by a user when they are installing or updating
    their operating system. If this service is not setup
    properly, or you don't have an adequately configured
    software or hardware firewall, it is an open invitation for
    a hacker or intruder.

    FTP Tagging – The most common purpose for someone to
    compromise your FTP server is for the storage and
    distribution of illegally obtained software and files. This
    could include cracked software, stolen movies, audio files,
    and pornography. Removing this type of contraband from your
    computer can be difficult, particularly if you are using a
    Microsoft Windows platform. Hackers use sophisticated
    scripts to create a maze of directory structures to house
    their wares on your computer. They may use a combination of
    names with spaces in them, and in some cases use extended
    characters (characters outside the normal alpha-numeric
    range). Deleting these directories through normal means may
    be difficult, if not impossible, for the average user. Many
    people wind up wiping their system and re-installing it, and
    that is if they're lucky enough to find out their system has
    been compromised.

    The above is a perfect example of why the statement, “I'm
    not worried about being hacked. What do I have that a
    hacker would want?” is not a good position to take. The fact
    is, you do have something they want, your computers
    resources. Why should a hacker store tons of illegally
    obtained files on their systems when they can use yours.

    The Good, The Bad, And The Ugly

    ——————————-

    The Good

    ——–
    When I was young I use to spend hours upon hours on the
    Internet Relay Chat, also know as the IRC. The IRC is
    another method of Internet communication, which has been
    around for quite a long time. When I was a frequent user of
    the IRC, it was just plain fun. You would meet all kinds of
    people from all over the world. It was the instant messenger
    of the time.

    The Bad

    ——-
    Today, the IRC is a huge communications network. It is made
    up of thousands of channels, and can be accessed by pretty
    much any operating system platform. It is also a favorite
    means of communication for hackers. They can discuss new
    exploits, methods of compromise, and even send and receive
    files. Many hacker groups use a cryptic language to
    communicate with each other on the IRC channels. Unless you
    know the language constructs they use, their conversations
    can look like a bunch of nonsense.

    There are many exploits, backdoors, and Trojans that effect,
    or are contained in, the myriad of IRC clients on the
    Internet. Making sure you choose one that's relatively safe
    to use is not an easy task. As an example, take a look at
    this list of IRC safety and security info at
    irc.org.

    The Ugly

    ——–
    It's not just the exploits and security risks associated
    with using the IRC, which need to concern you. If a hacker
    is able to install an IRC relay agent on your computer, it
    can become a conduit through which they communicate and
    distribute information. In my line of work, I've identified
    many systems with IRC backdoors or relay agents installed.
    The only thing the end user typically experiences is a
    decrease in system performance and Internet access.

    Just Open The Door And Let Them In
    Peer-to-Peer File Sharing

    ———————————-
    If a total stranger were to knock on your door, and ask to
    come in to just hang out for awhile, would you let them in?;
    Most likely not. If you're using peer-to-peer file sharing
    software to locate and download files on the Internet,
    you're opening the door to destruction. Many of the file
    sharing services and software available on the Internet now
    tout themselves as being “safe” and “clean”. This is as far
    from the truth as you can get. If you're a regular user of
    these services, the chance of your computer being
    back-doored or hacked is significant.

    If you have anti-virus software installed (and up-to-date),
    you've undoubtedly received messages regarding viruses when
    downloading files from peer-to-peer services. These are not
    the only things you could be downloading. Many hackers imbed
    root-kits in files and distribute them using peer-to-peer
    file sharing. Root kits contain many types of tools used by
    hackers to gain control over computers. If the installation
    of the kit on your computer goes undetected and is
    successful, it's only a matter of time before your computer
    is completely compromised.

    I can't tell you how many times I've found company
    employees (and technical personnel) using peer-to-peer file
    sharing services. Any organization that permits this is
    putting itself at risk. And, the risk is much greater as
    compared to a single home computer because of the number of
    potential internal targets.

    Conclusion

    ———-
    Of course, the above is just a few examples of different
    methods and types of computer compromise. There are many
    ways your computer can be hacked. Your best defense is a
    good offense along with education and awareness.
    When you configure your computer make sure you enable only
    the software and services that you need. Many programs have
    known exploits and / or require additional steps be taken to
    adequately secure them.

    Don't make the assumption that you are not a target just
    because you don't think you have anything of interest on
    your computer.

    If our computer becomes unstable or dramatically decreases
    in performance, don't assume it's just a quirk or that it's
    time to upgrade.

    Make sure you have a software or hardware firewall in place
    to protect you from the Internet. Your firewall should be
    configured not to allow anonymous inbound access from the
    Internet. This is the default configuration for most
    firewalls, but you should make sure the one you are using is
    properly configured.

    Make sure you have adequate virus and spyware protection,
    and your pattern signatures are up-to-date. Many anti-virus
    applications work on a subscription basis. It's not uncommon
    to find out your subscription expired. If it is expired,
    your software may not protect you from new and emerging
    threats.

    And, do what ever you can to stay away from any type of
    Internet peer-to-peer file sharing service. No matter how
    safe the developer claims it is.

    About The Author

    —————-
    Darren Miller is an Information Security Consultant with
    over sixteen years experience. He has written many technology
    & security articles, some of which have been published in
    nationally circulated magazines & periodicals. Darren is a
    staff writer for http://www.defendingthenet.com and several other
    e-zines. If you would like to contact Darren you can e-mail
    him at Darren.Miller@ParaLogic.Net or
    DefendTheNet@ParaLogic.Net.

    If you would like to know
    more about computer security please visit us at our website. If someone you know has sent you
    this article, please take a moment to visit our site and
    register for the free newsletter at
    Newsletter Subscribe.

    Original URL

    ————
    http://www.defendingthenet.com/NewsLetters/HaveYouBeenHacked.htm

  • Hackers Step Up Attacks on IM Networks

    This is an interesting article on eWeek penned by Gene Koprowski
    adressing the virus portal known as Internet Message chat (AIM, MS
    messenger, ICQ etc).  

    “One security research outfit on
    Wednesday reported the highest monthly total ever of new IM viruses…
    some 25 viruses were reported on IM networks during September alone.”

    Great point but the article speaks as if IM is some sort of NEW
    target.  IM is one of the biggest holes in home computer
    systems.  There are MANY hacker tools that exploit these swiss
    cheese, foolishly trusting apps.  Do a scan on your ISP's Network
    and you will see scores of ports open on AIM and ICQ and others. 

    “We started doing this report about four months ago. What we're
    seeing is that there could be a new phase of IM viruses emerging. In
    the past, IM viruses were variants of e-mail-borne viruses. That's not
    exclusively the case anymore.”

    Jaros said that his company's research demonstrates that there
    is an average of at least one IM virus attack being conducted every day
    now.

    One of the most popular techniques that truly dark hackers use is to
    connect an “owned” box to an IRC (Internet Relay Chat) room from which
    many unholy acts can be done.

    read more | digg story

  • Exploit for every MS Security Bulletin

    114 Exploits / 449 Bulletins on ElseNot.com

    MS05-043: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (896423) Windows 2000 Service Pack 4, Windows XP Service Pack 1, Windows XP Service Pack 2, Windows Server 2003 Gold

    MS05-042: Vulnerabilities in Kerberos Could Allow Denial of Service, Information Disclosure, and Spoofing (899587) Windows 2000 Service Pack 4, Windows XP Service Pack 1, Windows XP Service Pack 2, Windows Server 2003 Gold, Windows Server 2003 SP1

    MS05-040: Vulnerability in Telephony Service Could Allow Remote Code Execution (893756) Windows 2000 Service Pack 4, Windows XP Service Pack 1, Windows XP Service Pack 2, Windows Server 2003 Gold, Windows Server 2003 SP1

    Help to submit more exploits!

    read more | digg story