I plugged an unpatched Windows 2000 system on the Internet with no
firewall, antivirus or even pop up blockers to sniff out the raw filth
being pumped to the world.
What I was immediately spammed with was “Message from System to Alert messages” from various “security software” sites. Here are the results:
“Message from System to Alert” Pop ups
These messages claimed to be from Microsoft or from my system or from
System32 saying my registry was corrupt and a bunch of other lies.
The number of security holes that occur isn't as telling as how they're handled.
Here is the skinny. FireFox actually has more security issues
than Internet Explorer, but the thing is that it usually takes
Microsoft weeks to fix security issues. This gives malicious code
writer PLENTY of time to create and distribute something juicy.
Now here is another thing about Microsoft (and CISCO) they lie and
cover up some of the security flaws. This is probalby because of
reputation and shareholder protection or who knows what other
beauracracy and formalities.. but FireFox is very fast.
I was at Defcon 11 and I recall some Gray Hats found a few flaws in
Microsoft products (serious ones… nothing new about that). They attempted to submit these
flaws to Microsoft and other companies and were completely
ignored. Sometimes it seems giant corporations can only put out
fires instead of prevent them.
Here is an example of how slow the Microsoft people are on security —> 6 Month old exploit.
Martin McKeay over at mckeay.net is has good methods of securing his home network:
I'm a strong believer in the 'rule of least privileges' as my wife and children well know; at least once a week I get called over to the kids computer to log in as administrator and install some program for them. The kids have gotten used to it, but my wife hasn't and she's forgotten that I gave her the adminstrator password.
The reason it is a great idea to use the least priveleges possible and not go surfing the net with Admin priviledges is that if you (or anyone on your computer with admin priviledges) hit an exploit site that downloads something on your system, it will do so with your administrator permissions.
It is best to surf the web with an account that does not have permission to download anything from the web, with elevated security features on Internet Explorer (cookies and java scripts turned off). In fact, just use and patched version of Firefox.
More Security on Internet Explorer
You can increase security feature of IE by going to Tools | Internet Options | Security tab. Adjust the trust you have for the Internet by adjusting the level on the slider in the “Security Level for this Zone Area.”
If you surf the web with an administrator account without a firewall not only will you more than likely get hit with a trojan and worms you will give the masters of these products elevated priviledges to your system as they will install code in the C:\Windows\System32 – also known as root. From root a criminal hacker can do practically anything they want with your computer (including install a keylogger that copies everything you type and send the data back to some IRC room on the Internet.)
In layman's terms, they will OWN your ass.
If your really paranoid:
Customize your selected security levels by clicking the “Custom Level” button inthe “Security Level for this Zone Area.” Disable Active X, and Java to completely destroy the ability of malicious mobile code to affect Internet Explorer (unless its already on your system). This will impare your ability to expirience anything beyond text.
IE 6.0 and below suck. Honestly, it is updated a few times every other
month with SERIOUS security issues. Those security issues are
constantly exploited by spyware and spam. It really is ridiculous
how much business Microsoft has given to spammers.
Switching to FireFox, or Opera
FireFox is the Shiznit!
CLEAN IE, DOWN AND DIRTY:
This should clean your system unless you have some very special Trojans
or RootKits on your system. If the problem is really bad you can
always back up your important data and reload Windows from scratch.
A 41-year old disabled single mother has counter-sued the RIAA for
Oregon RICO violations, fraud, invasion of privacy, abuse of process,
electronic trespass, violation of the Computer Fraud and Abuse Act, and
negligent misrepresentation.
In early 2005 Webroot Software released its State of Spyware Report which was conducted by Webroot and Earthlink. In the survey over 4.6 million computer systems were scanned during 2004 and the results have shown how threatening spyware has become.
It was suggested that more than 90 percent of all computers with internet connections are infected with spyware. During the first quarter of 2005 approximately 88 percent of systems scanned with Webroot’s SpyAudit software had some sort of unwanted application detected.
On corporate computers over 55 percent of PCs had unwanted programs, excluding cookies because they are thought not to be as intrusive or detrimental. The corporate computers averaged 7.2 non-cookie spyware infections per computer.
In 2004 the last quarter yielded 19 percent of consumer and business computers with keyloggers and in the first quarter of 2005 that number had dropped to 7 percent, according to systems scanned with Webroot’s software. In both the last quarter of 2004 and first quarter of 2005 19 percent of consumer PCs and 7 percent of business PCs had Trojans.
Another daunting piece of information gather through online research by Phileas is that 4,294 sites were found to have some type of spyware. This information has proven that in a short amount of time spyware has skyrocketed into the top internet threat. As the internet become a rapidly growing medium used by millions online threats such as spyware can thrive and spread a quick rate, infecting and damaging nearly all user unless protective measures are taken.
Mitch Johnson is a successful freelance author that writes regularly for http://www.1st-in-spyware.com/ , a site that focuses exclusively on spyware removal software, as well as tips on how to prevent spyware from popping up on your computer. This site articles on has spyware guard, http://www.easy-spyware-killer.info/ as well as spyware scanner, http://www.easy-remove-spyware.info/
Another university accepted ethical hacking. Lately it seems every other month educational institutions are teaching security hacking. I think this is good. It is important to learn many kinds of Wire-Fu.
Oct. 3–NEW HAVEN, Conn. — The computer lab tucked into a corridor at Jennings Hall at Southern Connecticut State University may not look it, but it's sick.
Viruses run rampant. Firewalls are frowned on. Here, hacking is not only encouraged, it's a course requirement.
“Last week, I went onto a computer in the back room. Their homework was to figure out what I did and log into my fake account,” said Lisa Lancor, an associate professor of computer science.
University of Calgary hacker course
University of Glamorgan – Certified security Testing Associate and Professional and Certified Forensic Investigation Analyst
Internation Counsel of e-Commerce Consultants – Certified Ethical Hacker CEH – Certification
Many everyday Internet Users do not know why they must keep their computer Operating Systems Up-To-Date – and many don’t even know what an Operating System is!
From “ignorance is bliss” to “surprise attack and disaster” – how many thousands of Internet users have experienced this frustration and grief?
This raises the obvious question: “Why haven't they prepared to avoid it?”
The startling fact is that there are many long term Internet users who have never even considered updating their Operating Systems and protective Safe-ware.
Perhaps the complexity of it all contributes to what might be described as User apathy – or indifference and a lack of enthusiasm toward the following:
* The news of yet another vulnerability or patch process.
* The potential damage to computer, personal information and reputation – i.e. the “It can't happen to me” attitude.
* Their own abilities – i.e. “I’m too old, too dumb, too whatever – to learn how to fix a computer without breaking something.”
* Updating – i.e. “My computer came with an anti-virus program, so why does it need to be updated now?”
The sad fact is that the lack of confidence people have in their ability to build a defense often leads to a reluctance to even accept the reality of Cyber Threats.
Some of the lesser-experienced Internet users rationalize their lack of action with pessimism, even defeatism. Human nature often supports these excuses with defensive attitudes and mis-beliefs like:
* False sense of disaster support – “My nephew, neighbor, son or whoever, is a computer whizz. They’ll be able to fix the problem if anything ever happens.”
* Scepticism – “All this talk about viruses is just so the “news people” will have information for publishing, and so the software manufactureres can scare people into buying more of their products.”
* Ignorance (of the extent of deception, skills and sophistication that the malicious hackers have attained).
* Disbelief (that personal computer might be infected and used by others to spread malicious viruses and worms). “My computer seems to be working ok – a little slow, maybe, but it is getting pretty old.”
* Overwhemed (too many choices with firewalls, anti-virus, anti-spam, anti-spyware, Trojan removers). “Why do I need all of these and which ones should I use?” or “Do I really need to update my Operating System, my anti virus, spam, spyware stuff?”…I’ll just never learn how to do all of this.
* Expense (How much will all this cost and is it really necessary?)
* Fatalism – “Hey, if it’s going to happen, it will, and I’ll just junk my computer and get another one. Mine’s getting kind of old, anyway.”
Here, then, are the Shocking facts about updating PC Operating Systems.
There are many unaware Internet users who have been online for years, but lack in these ares:
* They don’t know what “Updating” really means.
* They have never responded to the popup message associated with the icon in the Task tray that announces new Windows Updates.
* They have never clicked on the Windows Update icon in the Program Start menu.
* They have never visited the Microsoft Windows Update web page at http://windowsupdate.microsoft.com/.
* They have never updated their PC Operating Systems.
Even if they have been able to navigate to the Microsoft Update webpage, many just throw up their hands in despair at the overwhelming number of choices and unknowns, such as:
* Choosing what to update from the long list of options.
* Waiting for Windows to check the registry for available updates.
* Deciphering the Update descriptions (and instructions).
* Selecting or Removing the necessary options.
* Starting the download.
And oftentimes, many people have never even used the Windows Help information to find out how to update their computer Operating Systems.
How many self taught or untrained computer users are going to persevere through all of the hassle described above? Is it any wonder so many computers become infected? The criminal Hackers building their bot and zombie armies have nearly an open and undefended playing field; many are using it every day to steal money and identities.
So, what is the solution to this problem?
If individuals with computer “understanding” would help and assist others with less knowledge, there would probably be less of a problem.
Nearly everyone who has faithfully kept their PC Operating Systems and Safe-ware up to date surely has family members and friends who could benefit from an hour or so of basic instructions. This would make it much more difficult for the criminal Hackers to compromise another persons computer.
Hacker's would eventually be faced with a growing number of adequately protected computers, educated Users and hopefully would finally give-up trying!
Its about time this more proactive approach to malware and spyware is
put right on desktops. Eventually the masses will get so fed up
with malicious code that there will be a huge market for behavioral
based intrustion detection type software.
With the amount of money that is being made by virus and spyware
makers, malware is developing faster than computer security could ever
dream. Proactive methods such as HoneyMonkey servers and HIPS
products will no doubt be a big hit. It is about time that
Information Security had more of a proactive response and not as
reactive.
With corporations more interested in protecting there ASSets then with
developing a good product and protecting the customers, its time that
we security professions get aggressive an proactive with our
methods. That will be the only way to fight malware in the future.
Malicious code masquerading as a trusted application could trick a
ZoneAlarm firewall into letting it connect to the Internet, security
experts have warned.
The notice was given on 28 Sept 05 by Debasis Mohanty. Here is the official word from Zone Alarm. This exploit affects the popular default install of Zone Alarm 5.5 and not 6.0.
ZoneAlarm Pro, ZoneAlarm AntiVirus, ZoneAlarm Wireless Security, and
ZoneAlarm Security Suite version 6.0 or later automatically protect
against this attack in the default configuration.
ZoneAlarm
Pro, ZoneAlarm AntiVirus, ZoneAlarm Wireless Security, and ZoneAlarm
Security Suite version 5.5 are protected against this attack by
enabling the “Advanced Program Control” feature.
Check
Point Integrity client versions 6.0 and 5.1 are protected against this
attack by enabling the “Advanced Program Control” feature.
AFFECTED PRODUCTS:
ZoneAlarm free versions lack the “Advanced Program Control” feature and are therefore unable to prevent this bypass technique.
Recommended Actions:
In my oppinion Zone Alarm is still a great product. This is yet
another example of a highly exposed product getting tested to its
limits like every version of Windows and Internet Explorer.