Category Archives: End-user Focused

3 Browser Security Tips for End-Users

Posted on by
Reply

browsers_mojomonster.gif

Browser security continues to be an absolutely vital part of providing safety and privacy to end-users and their systems. Browser-based attacks are easily the most common threat on the Internet today. Attacks range from old-style traditional exploits like buffer-overflows to modern, sophisticated attacks like Active-X injection, drive-by downloads of malware and exploitation of cross-site scripting attacks and other web applications issues to steal user credentials or even install arbitrary code. Recent attacks against huge numbers of sites have even made strategies such as only visiting sites “you know and trust” inadequate to ensure security. Today, all sites are targeted and even huge sites with common household names have been exploited and used for illicit activities.

Obviously, our dependence on the web grows with each passing day. Web 2.0 features and capabilities have also made strategies like disallowing all client-side scripts an impossibility for most users – even though this increases safety logarithmically. Users today want those features, bells and whistles that they have become accustomed to, and as usual, they will choose performance and ease of use over safety and privacy. So, that said, we wanted to put together a quick list of some ways for end-users to make their browsers as secure as possible. These are the basics, and some of these steps may interfere with some site operations (especially number 2), but we hope that users will adopt at least some of these suggestions to better protect themselves online.

1. Keep your browser up to date.

This is the easiest of all of the steps. However, it is also the one that removes the easiest of exploits from the attacker’s arsenal. Attackers are very good at exploiting known, public, well documented vulnerabilities – so the more of them your browser is vulnerable to, the easier it is for them to compromise your system. Combatting this is very very easy, simply keep your browser up to date. Browser updates are issued periodically by all of the major browser programmers and they often close a number of known security issues in each release. To help with this, many of the browsers have even begun to build in auto-update capabilities – so if your browser has this, make sure it is turned on. If you are a user of Internet Explorer, the updates are delivered as a part of the regular Windows Update process. This can be configured to automatically execute as well. Modify your current settings using the same Control Panel interface as the firewall configuration.

2. Harden your browser against common attacks.

This is a very powerful process as well. It will make you safer by an exponential amount. However, the side effect will be that some web sites may not work properly. You will have to tune and tweak these settings as needed to create your personal balance between risk and usability. This will obviously vary by your specific lifestyle online and your level of risk tolerance. Generally though, there is a fantastic guide to making these configuration changes here. It was created by CERT and walks users through browser hardening, step by step. Follow their instructions and you will get a much safer browsing experience.

3. Be aware of social engineering tactics.

Even if you do follow the other two steps, social engineering will still be a possibility. Attackers use social engineering to trick users into doing things that they should not do, like opening a file, divulging their passwords, etc. You should always remain aware of social engineering tactics and strategies. Many of them are covered in the definition page linked above. Another good place to keep current on emerging social engineering attacks he the SANS incident center. They routinely cover emerging threats against both corporate and end-user systems.

So, there you have it. Three tips, that once enacted and followed, make browser security a much more attainable process. Of course, like with most security undertakings, you have to periodically update them, ensure your settings remain as you desire and keep aware of new changes – but these three steps make it much easier for even basic users to be a bit safer online.

Hardware Hacking Gets All Too Real

Posted on by
Reply

Hardware and wireless hacking have combined in a pretty scary way. This article talks about security researchers that have found ways to monitor, attack and exploit the most popular of pacemakers used today. According to the article, the attackers were able to gain remote access to the data and control system of the device. Once they tapped into it, they were able to siphon off health-related information and even cause the pacemaker to apply voltage or shutdown – essentially killing the human host of the device.

flatline.jpeg

It really doesn’t get more scary than that. While the odds of such an attack occurring in real life against a specific person are very slim, it is simply another side effect of the integration of technology into our daily lives. As I have written about many times before, the integration of technology into so many aspects of our lives is a powerful thing. On one hand, it frees us up to do other work, makes our lives easier, more healthy, perhaps even longer than life would have been otherwise. However, many vendors simply fail to realize the implications of the risks that are inherent in their products. They fail to comprehend the basic methodologies of attackers and certainly fail to grasp how the combination of technologies in many of their products can create new forms of risk for the consumer.

I am quite sure that the company who created the pacemaker was truly interested in advancing the art of healthcare and extending the human life. They simply wanted to make things better and saw how adding remote management and monitoring to their device would allow patients to be diagnosed and the device operation modified without the need for surgery. That is quite an honorable thing and is sure to make patients lives easier and even reduce the rate of death since patients would no longer undergo the stressful and dangerous operations that used to be needed to make changes to the implanted pacemakers. These are very noble ideas indeed.

Unfortunately, the creators of the heart system were so focused on saving lives and so focused on medical technology, that they seem to have missed the idea of securing their pacemaker against improper access. This is certainly understandable, given that they are a medical company and not an IT firm, where such risks have been more public in their discussion. The problem is, in many cases today, there is essentially no difference between IT and other industries, since many of the same technologies are present in both.

Again, there is little to truly be immediately concerned about here. While the attack is possible, it does require technical knowledge and the vendors will undoubtably work on improving the product. However, upgrading existing users is unlikely. But, unless you happen to be a high profile target, you are obviously much safer with the device than without it. The big lesson here and the one I hope vendors, consumers and the public are learning is that we must add risk management and security testing processes to any device with a critical role, regardless of industry. Today, there are simply too many technologies that can impact our daily lives to continue to ignore their risks.

A Great Windows Maintenance Find for FREE

Posted on by
Reply

A few days ago I stumbled onto a pretty decent Windows maintenance tool I wanted to share. It is called Advanced WindowsCare Personal and is available from snapfiles.com here.

Overall, this is a pretty great tool. It is very easy to use and does a lot of tuning and preventative maintenance for Windows systems – especially home and end-user systems that might not have a corporate IT person to take care of them. It does a good bit of clean up around the system, helps to protect it against spyware and some malware. While not a full anti-malware solution, it does make some basic registry changes to help prevent installation of the most common spyware and other bad stuff.

It did a very nice job of helping me tune a Windows system that I was messing with and in running basic management functions and maintenance tasks. I am not sure I would upgrade to the “Pro” version, but for a free utility, this one is pretty good.

If you still have Windows systems to manage, especially for family members and the like, this may be worth the time to install for them and spend 15 minutes teaching them to use it. Likely, they can repair most of their own problems using the tool, instead of calling you over to Aunt Millie’s for tech support. 😉

0wned By a Picture Frame & Other Digital Errata

Posted on by
Reply

First it was Trojan firmware on network routers, firewalls and other network appliances. That was followed by attackers installing trojans and malware on USB keys and then dumping them back into those sale bins by the registers. Now, SANS is reporting that a number of digital picture frames sold by retailers were pre-infected with malware, just waiting to be mounted on a PC during the picture loading process.

As we have been predicting in the State of the Threat presentations for more than a year, the attackers have found new and insidious ways to turn the newest and seemingly most benign technologies into platforms of attack. Now that just about everything from refrigerators to washing machines and from toasters to picture frames have memory, CPU and connectivity – the vectors for malware introduction and propagation are becoming logarithmically more available. As computers, mesh networks and home automation continue to merge, we have to think differently about risk, threats and vulnerabilities.

Until we as security folks can get our head around overall strategies for securing the personal networks and tools we become more dependent upon each day, we have to rely on point tactics like wiping drives when we get them, reloading firmware on all devices – even new ones – from trusted vendor sources and doing the basics to secure home and business networks and systems. Hopefully, one day soon, we can build better, more proactive solutions like integrated hashing, malware identification and other mechanisms for alerting users to basic tampering with our devices. While we geeks are getting the wired world we always dreamed of, we are learning all too quickly that it comes with some unexpected risk…

** Reminder ** – New Systems Should Be Patched Before Use

Posted on by
Reply

Please remind teens, kids and adults who might receive computers for the holidays this year to patch them before general use. They should ensure that software and network firewalls are in place before connecting them to ANY network.

They should also ensure that they have anti-malware software that is up to date for any and all operating systems (even Linux and OS X) and that they follow other general guidelines of safe computing.

Remember, fight the urge to save the safety speech for another time. If the system gets compromised while they are using it for a test drive – being safe later will likely not help them be protected against bots, identity theft and other illicit computing dangers. It only takes one moment of exposure to compromise the system on an irreparable scale.

Happy and safe holidays to everyone. Have a joyous, peaceful and wonderful holiday season!

Things You Need to Know about Bot Net Attacks

Posted on by
Reply

Bot nets are one of the most common forms of compromise on the Internet today. Bot networks grew out of the explosion of home and user systems and the common availability of high speed Internet connections. Basically, they are little more than systems that attackers have compromised and put under their control that use some type of mechanism to get new tasks or commands and report their results.

Mostly, bot infected computers are home systems that attackers often use for scanning other systems, sending spam or performing other illicit activities. Often, the controller of the bot systems will rent or sell the bot services to others. No matter if they use the systems themselves, or sell their services – usually the master is after one thing, MONEY.

That’s right. They make money from the illicit use of YOUR system, if it belongs to a bot network. They use your hardware and your bandwidth, and they receive the returns. Even worse, if your system would be used in a serious crime, there may be criminal and civil penalties for YOU. While case law continues to grow on this, it appears there may be some capability for some victims of the bot net to come back at you for failing to adequately protect your system – which ultimately caused them damage.

So, the big question is – how do home users protect themselves from bot infections and the other issues associated with them? Primarily, they do by following this advice:

  1. Ensure that your computer has a firewall and anti-virus at all times. Make sure the firewall is engaged and that the anti-virus software is up to date.
  2. Keep your computer current on patches. Turn on the auto-update capabilities of the operating system and make sure you patch your applications if they have available update mechanisms as well. This is a lot like safe sex in that failure to be safe even once can have long term implications on your security.
  3. Consider using a browser that is somewhat hardened or hardening your browser. There are a ton of browsers out there, and a ton of tools for hardening the common ones. Check them out and make sure your browsing tools are protecting you against attack. Don’t use default installs of IE or FireFox – configure them for higher protections, if at all possible.
  4. Consider other security tools and mechanisms. You need spyware tools and other security mechanisms if you travel. Spend some time reading about mobile security and apply what you can to your life.
  5. If in doubt, rebuild your system. THIS IS CRITICAL – there are simply some things that can be done to a computer that impact the long term security of it. If you have doubts about your system’s security – rebuild it and protect it from the start. If you know you have an infection or problem – backup your critical data and rebuild. It is much easier than most other solutions.

Take these steps and some basic vigilance and apply them to your computing experience. Bot nets will continue to be a primary threat to Internet users, but being smart about them and aware of the defenses makes you less likely to be a victim.

Do It Yourself Identity Theft Protection

Posted on by
3

By now you have probably heard the commercials. The CEO of the company gives you their social security number to prove that they have his identity locked down. He is so confident in their process that he is willing to give the world his name, information and SSN.

I probably get asked twice a week about this service, so I decided to take a look at it a bit closer. What I found was a pretty easy manipulation of the credit management system in the US combined with some customer service and consumer offloading of tedious work. What does that mean? It means that you can outsource your identity theft protection to them or you could save $10 a month and do it yourself – IF YOU REMAIN VIGILANT.

How does it work? It works like this. Inside the US credit reporting system, there exists a  mechanism called “fraud alert”. This mechanism can be placed on any account, at any time, by the consumer. The purpose of the mechanism was originally to give people who have already been a victim of identity theft a tool for ensuring that no further damage would occur. The mechanism works like this:

  1. The consumer, or someone with their power of attorney, contacts the major credit reporting agencies and requests a “fraud alert” be placed on their account.
  2. The credit agency places the “fraud alert” on the appropriate credit file. There is no charge for this, it is required by law.
  3. The credit agency MUST contact the consumer prior to approving any change, addition or new activity on the consumer’s account. Failure to do so is a violation by the credit agency of federal lending laws.
  4. The consumer must either approve or disapprove the addition or change. If they disapprove, the creditor should refuse the account activity – THUS STOPPING THE FRAUD.
  5. ** PAY ATTENTION TO THIS ONE ** The credit reporting agency removes the “fraud alert” after 90 days from the date of placement. The consumer, or their legal agent, may renew the “fraud alert” at any time after that 90 day period.

So, that said, you could save the $10 per month and contact the credit reporting agencies yourself. You simply call them and ask that the “fraud alert” be placed upon your own file. If you do that every 90 days, you will have protection from credit attacks caused by identity theft. The key is, you HAVE to do it every 90 days. Miss a day, and you have exposure…

Before you run to the phones, you should also know that having the “fraud alert” on your accounts can be a bit frustrating if you actually want to use your credit or open new loans, accounts, etc. Sometimes, creditors will simply refuse the accounts until the “fraud alert” is removed – regardless of your consent to open the account. Other than that, it is a pretty tight mechanism for protecting your information.

There has been a lot of media attention to the company in question that has made this service popular. They seem to be everywhere. Their marketing is certainly working – though I would estimate, mostly due to consumer fear. My guess is that it won’t be too long until the fears they seem to be playing to will lead to saturation and slower growth, but my friend Alex always told me “You can sell just about anything for $10 a month.”

So, at the end of the day, is this a service you buy or a task you manage yourself? Is it worth worrying about, or is it something you deal with if you have a problem? Only you can decide if you are capable of managing the work or if you would rather have someone do it for you. No matter what you decide, at least you know the facts. As with most security things, it is less magic and mystery and more of a common thing.

Should you decide to do it yourself, here are the contact numbers for the three primary credit reporting agencies and for the primary checking account verification house in the US (same thing applies)….

Equifax – 1-800-525-6285
Experian – 1-800-422-4879
Trans Union – 1-800-916-8800
Chex Systems (check fraud management) – 1-800-428-9623