The Ten Most Common Spyware Threats

You've heard the phrase "know thy enemy." Well, here are your most common spyware enemies (source:FaceTime Security Labs). Don't be fooled - spyware is not a game. It costs individuals and corporations millions of dollars each year. Spyware can be used to watch your surfing habits, steal credit card information, or just be a nuisance. In any case, it's a royal pain. Know they enemy.

1. Gator - Gator is installed by users as a password vault. That means that passwords can be recalled for you automatically when visiting sites. The trade-off for this service is that you have to endure pop-ups when visiting certain sites. Claria, the maker of Gator,has cleaned up its act a little by labeling the pop-up ads, but they're still annoying.

2. CoolWebSearch - This has got to be one of the most notorious browser hijackers out there. This is the name given to a program with many different variants that redirect users to coolwebsearch.com or datanotary.com. Uninstallation can be extremely complex. Users shouldn't try to manually remove this software.

3. 180SearchAssistant - This software either serves ads in pop-ups or pops up website windows based on your keyword searches. This software usually comes bundled with other "freebie" type software installs like emoticons or wallpaper. Newer versions of the software have an add/remove program uninstall item.

4. Huntbar - Now here's an annoying piece of software. Huntbar installs a toolbar onto internet explorer and windows explorer windows. It changes your home page and search page settings to point to their servers. If you use another search engine, Huntbar will redirect you to theirs. Great stuff. Oh, and it puts a 15% drain on memory resources.

5. Cydoor - This software usually comes with P2P software, ie. peer to peer. Again, it barrages you with a series of pop up advertisements. It also tracks usage information.

6. ISTbar - Yet another nice, unwanted piece of software. ISTbar does "drive-by" install via ActiveX and javascript. Basically, that means that you visit a site and it tries to install itself to your computer. Nice, huh. The Activex control installs a toolbar that pushes information to my-internet.info and blazefind.com.

7. WhenU-DesktopBar - Displays advertising content. Monitors internet traffic, collects search profiles, and can execute code from a remote server using its update feature only. Relevant searches may cause it to display a special offer, coupon, or other advertising content. The adware may also display advertisements.

8. New.Net - New.Net is a company that sells domain names for "nonstandard" top-level domains. It should be removed pronto.

9. IEPlugin - As the name implies, it installs a toolbar in Internet Explorer. It tracks web site usage, form items (like names, addresses, etc. - ie. yikes!), and local filenames that are browsed. It's invasive - remove it.

10. BargainBuddy - Bargain Buddy used to be everywhere. It is distributed by BullzEye Network. And it sets up a Browser Helper Object (BHO) and monitors your computer usage. It then, you guessed it, pushes advertisements your way based on that usage.

Read More

A Basic Guide To Internet Security

The internet is a wonderful place; many of us use it on a regular basis for a multitude of functions. Email helps us to keep in touch with family, and friends all over the world and most people have at least one email account. The growing use of digital cameras and camera phones means that we can send pictures at the click of a mouse. MP3 players have become increasingly popular, and we can download songs to play on them with extreme ease. All of this is great, and the internet is becoming a big part of our everyday lives.

Unfortunately, there is a downside to all of this increased use of the internet. That is the growth of the spread of viruses and other so-called ‘malware’. Originally, internet hackers were satisfied keeping their attentions focussed on government and business websites, and their viruses were intended to attack corporations. Most hackers saw this as a challenge. However, there is now an increasing trend towards home computer users being targeted by these attacks. The amount of damage that can be caused by a virus varies, but there are a number of easy steps that a person can take to help increase their internet security.

The first step to keeping your computer free from viruses is to have up-to-date antivirus software running on your computer. You need to make regular checks to ensure that your software is updated, and to scan your entire computer for viruses. There are a number of cheap, and free antivirus software programs available that provide excellent protection. You can find these by searching through your search engine for antivirus software.

The next step to maintain your internet security is to be extremely cautious about the type of files that you open, or download. The majority of viruses are actually spread through email attachments. Having these on your computer, in your inbox, is not the danger; the real danger is when you open the attachment. It may not be obvious that anything has happened when you first open the attachment containing the virus, quite often they appear blank. The damage is caused by the program that is activated within the attachment. If you do not know, and trust, the person who has sent you the attachment then delete the email.

Read More

Network Security – The Real Vulnerabilities

Scenario: You work in a corporate environment in which you are, at least partially, responsible for network security. You have implemented a firewall, virus and spyware protection, and your computers are all up to date with patches and security fixes. You sit there and think about the lovely job you have done to make sure that you will not be hacked.

You have done, what most people think, are the major steps towards a secure network. This is partially correct. What about the other factors?

Have you thought about a social engineering attack? What about the users who use your network on a daily basis? Are you prepared in dealing with attacks by these people?

Believe it or not, the weakest link in your security plan is the people who use your network. For the most part, users are uneducated on the procedures to identify and neutralize a social engineering attack. What’s going to stop a user from finding a CD or DVD in the lunch room and taking it to their workstation and opening the files? This disk could contain a spreadsheet or word processor document that has a malicious macro embedded in it. The next thing you know, your network is compromised.

This problem exists particularly in an environment where a help desk staff reset passwords over the phone. There is nothing to stop a person intent on breaking into your network from calling the help desk, pretending to be an employee, and asking to have a password reset. Most organizations use a system to generate usernames, so it is not very difficult to figure them out.

Your organization should have strict policies in place to verify the identity of a user before a password reset can be done. One simple thing to do is to have the user go to the help desk in person. The other method, which works well if your offices are geographically far away, is to designate one contact in the office who can phone for a password reset. This way everyone who works on the help desk can recognize the voice of this person and know that he or she is who they say they are.

Why would an attacker go to your office or make a phone call to the help desk? Simple, it is usually the path of least resistance. There is no need to spend hours trying to break into an electronic system when the physical system is easier to exploit. The next time you see someone walk through the door behind you, and do not recognize them, stop and ask who they are and what they are there for. If you do this, and it happens to be someone who is not supposed to be there, most of the time he will get out as fast as possible. If the person is supposed to be there then he will most likely be able to produce the name of the person he is there to see.

I know you are saying that I am crazy, right? Well think of Kevin Mitnick. He is one of the most decorated hackers of all time. The US government thought he could whistle tones into a telephone and launch a nuclear attack. Most of his hacking was done through social engineering. Whether he did it through physical visits to offices or by making a phone call, he accomplished some of the greatest hacks to date. If you want to know more about him Google his name or read the two books he has written.

It’s beyond me why people try and dismiss these types of attacks. I guess some network engineers are just too proud of their network to admit that they could be breached so easily. Or is it the fact that people don’t feel they should be responsible for educating their employees? Most organizations don’t give their IT departments the jurisdiction to promote physical security. This is usually a problem for the building manager or facilities management. None the less, if you can educate your employees the slightest bit; you may be able to prevent a network breach from a physical or social engineering attack.

Read More

Microsoft Updates for Multiple Vulnerabilities

Systems Affected

* Microsoft Windows
* Windows Server


Overview

Microsoft has released updates that address vulnerabilities in Microsoft Windows and Windows Server.

I. Description

As part of the Microsoft Security Bulletin Summary for March 2009, Microsoft released updates to address vulnerabilities that affect Microsoft Windows and Windows Server.

II. Impact

A remote, unauthenticated attacker could gain elevated privileges, poison the DNS cache, execute arbitrary code, or cause a vulnerable application to crash.

III. Solution

Microsoft has provided updates for these vulnerabilities in the Microsoft Security Bulletin Summary for March 2009. The security bulletin describes any known issues related to the updates. Administrators are encouraged to note these issues and test for any potentially adverse effects. Administrators should consider using an automated update distribution system such as Windows Server Update Services (WSUS).


IV. References

* Microsoft Security Bulletin Summary for March 2009 - <http://www.microsoft.com/technet/security/bulletin/ms09-mar.mspx>
* Microsoft Windows Server Update Services - <http://technet.microsoft.com/en-us/wsus/default.aspx>
* US-CERT Vulnerability Notes for Microsoft March 2009 updates - <http://www.kb.cert.org/vuls/byid?searchview&query=ms09-mar>

Resouce:http://www.us-cert.gov/cas/techalerts/TA09-069A.html

Read More

What Are Intrusion Detection Systems?

With computer hackers and identity thieves getting more computer literate, the security your computer needs to keep them out has to always stay at least one step in front. There is a different type of computer safety tool that detects an attack or system intrusion before it has the chance to harm your computer. It is called an IDS or Intrusion Detection System and is another form of application layer firewall. Intrusion detection systems are programmed to detect attempted malicious attacks or intrusions by computer hackers trying to get into your system by detecting inappropriate, incorrect, or anomalous activity. There does seem to be some question of how well this system works when many personal computer users are going to wireless online connections. Some will argue that with the adoption of intrusion prevention technologies has created a unique challenge for security professionals. In order to make this type of system effective, such monitoring of these devices requires extensive security expertise and time. If devices are incorrectly tuned and not regularly updated, attacks of malicious traffic and intrusions may be permitted. In order to prevent downtime, security professionals also must continually check on these devices in order to keep the system running smoothly.

There are three different types of intrusion detection systems.

A host-based Intrusion Detection Systems consists of an agent on a host that can identify intrusions by analyzing system calls, application logs, and host activities. Network Intrusion Detection System is an independent platform that identifies intrusions by examining network traffic and monitors multiple hosts. These gain access to network traffic by connecting to a hub, network switch configured for port mirroring, or network tap.

Hybrid Intrusion Detection Systems combine both approaches and the host agent data is combined with network information to form a complete view of the network.

A Signature-Based Intrusion Detection System can identify intrusions by watching for patterns of traffic or application data presumed to be malicious. These systems are able to detect only known attacks, but depending on their rule set, signature based IDS's can sometimes detect new attacks which share characteristics with old attacks.

Anomaly-Based Intrusion Detection Systems identify intrusions by notifying operators of traffic or application content presumed to be different from normal activity on the network or host. Anomaly-Based Intrusion Detection Systems typically achieve this with self-learning.

A Signature-Based Intrusion Detection System identifies intrusions by watching for patterns of traffic or application data presumed to be malicious. These type of systems are presumed to be able to detect only 'known' attacks. However, depending on their rule set, signature-based IDSs can sometimes detect new attacks which share characteristics with old attacks, e.g., accessing 'cmd.exe' via a HTTP GET request.

An Anomaly-Based Intrusion Detection System identifies intrusions by notifying operators of traffic or application content presumed to be different from 'normal' activity on the network or host. Anomaly-based IDSs typically achieve this with self-learning.

Features and Benefits The Managed Intrusion Prevention Service includes:

Configure and provision device

Create initial policy; update and tune policy on an ongoing basis

Monitor and report on health and security events 24x7

Industry leading Service Level Agreement

Report all security events on the Client Resource Portal

Flexible reporting options on Client Resource Portal

Notify customers of major security and health issues

Upgrade and patch devices

Seamless integration with VeriSign's Incident Response and Computer Forensics team

Whether used for detection or prevention, Intrusion SecureNet technology is peerless in accurately detecting attacks and proactively reporting indicators of future information loss or service interruption. Using pattern matching for performance and protocol decoding to detect intentional evasion and polymorphic or patternless attacks, as well as protocol and network anomalies before a new attack has a signature created, the SecureNet System is ideal for protecting critical networks and valuable information assets.

Read More

Intrusion Prevention - IT Risk Management

Intrusion Prevention solutions detect and eliminate content-based threats from email, viruses, worms, intrusions, etc. in real time without degrading network performance. They detect and eliminate the most damaging, content-based threats from email and Web traffic such as viruses, worms, intrusions, inappropriate Web content and more in real time - without degrading network performance.

Today's global information infrastructure faces possible huge financial losses caused by ineffective Intrusion Prevention. Among the most vulnerable technologies are Providers of VoIP, video teleconferencing and data over cellular networks. While these providers have integrated into their products, the need for new Intrusion Prevention solutions is constant. Here are some of the area in which Intrusion Prevention offers effective solutions.

Instant Messaging - Intrusion Prevention
The real-time, interactive nature of Instant Messaging makes it a valuable tool for business partners, customers and fellow employees. The breach of security opportunities created by the use of IM must be managed for given its postion as a widely accepted business communications tool.

Real Time Vulnerability - Intrusion Prevention
Real Time Vulnerability Protection Suite breaks away from the reactive method of chasing attacks after they happen to eliminating and protecting vulnerabilities on your systems. By protecting against known and unknown vulnerabilities, you can ensure data reliablity and sercurity.

Network Infrastructure - Intrusion Prevention
Intrusion Prevention protect the network infrastructure to carry on your business without disruption. Enterprise level solutions offer effectevie network intrusion prevention solutions (IPS) within the context of your company's comprehensive security policy.

Email - Intrusion Prevention
Financial Companies, manufactures, retailers, etc. use intrusion prevention to scan messages and attachments for viruses. Together with "preemptive" email security approach, effective intrusion prevention offers the best protection from spam and virus attacks.

Application Level Attacks - Intrusion Prevention
A successful denial of service attack can put a corporate website off line for hours or more. Intrusion Prevention products offer the best protection against application level attacks and secure all networked applications, users and server resources.

Large Enterprises - Intrusion Prevention
Large Enterprises with widely dispersed Carrier & Data Center Networks need specially built high-performance security gateway Intrusion Prevention with proven firewall and IPSec VPN to deliver scalable network and application level security. Intrusion prevention protects the enterprise against the seemingly insignificant worm, virus, trojan, etc. that can topple its network.

Read More

Identity Theft – Who is ‘phishing’ for your information?

There’s a new type of internet piracy called ‘phishing’ (pronounced ‘fishing’). Internet thieves are ‘fishing’ for your personal information. They’re looking for ways to trick you into giving out your Social Security Number, credit card number and other personal information that they can use to their advantage. You could become a victim of identity theft that could take years to clear your financial history and personal reputation. But understanding how these internet thieves work, will help you to protect yourself from becoming a victim.

How do these thieves get your information?
Typically, you might receive an email from a company that you are familiar with that looks ‘real’. It has the company logo, they may call you by name, and the tone of the email is that they are looking out for your best interests. This email will warn you of some imminent danger to your account or credit card and that you need to take action immediately or you will suffer dire consequences. There will be a link (underlined writing usually in blue) for you to click on that will take you to their website. And guess what? The website they take you to will look like the real thing with the company logo and all.

Next, you will be asked to ‘verify’ your account, password, or credit card information. If you ever find yourself here, STOP! Do nothing. Do not fill in any personal information. Immediately exit from this website and delete the phony email that you received.

How to know that this is a ‘phishing’ email.
If you did not email this company asking for information about your account or for help with a problem, be suspicious. If you are still not sure because it looks so ‘real’, call the company yourself and ask. You can find these phone numbers on your monthly statement. If it is after hours and no one is there to take your call, wait until the next day when you can reach someone. Don’t fall for the ‘imminent danger’ message and feel that you have to take action immediately. ‘Phishers’ are hoping that you will take immediate action – don’t panic and let them trick you into clicking on their link.

What can you do?
Never give someone your password over the internet or phone when it is an unsolicited request. Your credit card company knows what your password and credit card number is. They don’t need to ask you for it.
Likewise, your bank knows what your account number and social security number, they won’t ask you to repeat it verbally over the phone.

Review all of your monthly statements every month as soon as they arrive. Check for charges that you never made. If your statement is ever late in arriving in the mail, call and ask why. Protect yourself from these would-be thieves. Don’t let them take your identity! Please remember to Bookmark www.wheatgrass-fountain-of-youth.info now! Thanks for visiting.

Read More

Internet Monitoring, Safety And Security

www.monitoringsoftwareonline.com

Internet monitoring is a necessary part of having internet service. Whether you allow your children to surf the web or if you have the need to monitor employees, effective programs can be used to help you to do this simply. There are many aspects that can be monitored and the results can be delivered to you privately. No one needs to know that you are using internet monitoring technologies either.

There are many options when it comes to internet monitoring. No matter what your need is in these products, you can expect to use high tech gadgets and software. But, they are simplistic to use. Many software programs that monitor internet usage will tell you such things as how long the individual was online as well as what websites they visited, who they chatted with in instant messages, as well as anything that they input into the web. Emails can be tracked as well as a number of other things.

Why should you use internet monitoring? If you are not sure your employees are using their time on the job for job related tasks, this can help you know for sure. If you are unsure of who your spouse is chatting with at night, consider the use of these monitoring solutions. Do you know if someone is stalking your child as they play games on the web? If they use instant message software, find out who they are talking to and what they are saying. Internet monitoring is really a necessary part of keeping people safe and your business under control. Effective internet monitoring software products can be purchased and installed quickly and discreetly. Be in the know.

There are also many information portals now devoted to the subject and we recommend reading about it at one of these. Try googling for “internet monitoring” and you will be surprised by the abundance of information on the subject. Alternatively you may try looking on Yahoo, MSN or even a decent directory site, all are good sources of this information.

Read More

Skype Trojan poses as the real McCoy to steal your password

A new password-stealing Trojan that targets Skype has been spotted in the wild. It poses as a security plug-in for the popular VoIP service but instead presents its own log-in screen to steal your user name and password.

The Trojan calls itself “Skype-Defender,” and other than attempting to steal your Skype user name and password, it also swipes clean all user names and passwords saved in Internet Explorer.

More information at: http://blogs.techrepublic.com.com/tech-news/?p=1418

Read More

Don't Get Lured Into This Phishing Scam

http://static.howstuffworks.com

One good thing about writing articles for a living is that I get to learn about new things. Since I spend most of my time in front of a computer, it seems I don't get out much and unless it's on the nightly news, I don't usually hear about computer scams. That's how I found out about Phishing Scams. I had never heard of such a thing until I was asked to write an article about it, and I'm glad that I was asked. I now know what a Phishing scam is and I'm happy to share this information with you, in case your not very computer savvy either. Now most of us know enough not to openly give out personal information online to just anybody, and common sense tells us when something looks a little shaky when we see it. However, Phishing scams are hard to see because they are made to look like things we are used to. We do a lot of things online today, banking, paying bills, shopping, stock trading, etc. We usually don't give it a second thought to give our information in doing any of these activities. That's what these Phishing scams are hoping for, that you won't give a second thought to giving them your personal information.

Phishing scams usually come as emails or pop-up messages to lure your personal information from you. “We suspect an unauthorized transaction has occurred in your account. To ensure that your account is not compromised, please click the link below and confirm your identity.” Have you received an e-mail that looks like that one? Or how about; “During our regular verification of accounts, we could not verify your information. Please click here to update and verify your information.” Both of these scams are called phishing, and it involves Internet schemers who send email or pop-up messages that lure you into giving them your personal information. Credit card numbers, bank account information, Social Security numbers, and passwords, any information or sensitive material you think is safe. According to the Federal Trade Commission (FTC), phishers claim to be from a business or organization that you deal with, including Internet service providers, online payment services and even government agencies. The messages can ask you to update or confirm your account information, or threaten you if you don't respond immediately. The messages will then direct you to a website that looks just like the one you're used to dealing with, but it's not, it's a fake website and its only purpose is to trick you into giving out your personal information.

FTC recommends never give out personal information to email or pop ups that ask you for it. Legitimate companies never ask for this information via email. Don't cut and paste a link from the message into your Internet browser. Don't “click” on a button or web address given to you via email unless you're absolutely sure of were its going. For more information, look for websites pertaining to phishing scam information.

Read More