Bruce Schneier said, “Blaming the victim is common in IT: users are to blame because they don’t patch their systems, choose lousy passwords, fall for phishing attacks, and so on.”
So true, and something that I have come to (reluctantly) refrain from doing. Face it, people do things they shouldn’t do, or don’t do things they should. Either way, if there are no immediate consequences, no lesson is learned. Unless Lizzie’s PC completely shuts down when she clicks on an email link, she’ll continue to do it, oblivious to any strange behavior in her browser that results. And she’ll never connect those ill-advised clicks to the theft of her credit card information and subsequent fraudulent charges to her account.
These days, malware is designed to appear as if it’s supposed to be there or to make its effects blend in with the normal operation of the computer. I see this stuff every day and when it simply redirects the browser to another search site or pops up a message saying I need to speed up my computer, I find myself sympathizing with the user. When the really scary popups – “You have 10 bazillion infections!!!! Click here to clean now” – show up, I realize that no one with insufficient technological knowledge is going to recognize that for what it is. The knee-jerk-click-the-button reaction to the scary message is what the crooks depend on.
So, don’t blame the victim. Don’t chastise them for what happened. Don’t make them wrong. Do gently explain to them what happened and hope that the repair bill is sufficient experience and feedback for them to think twice the next time.
We’ve all seen it: You try to uninstall junkware and PUPs (Potentially Unwanted Programs) and they phone home to tell you how sorry they are to see you leave. That’s annoying enough, but what else is going on that you don’t know about? Besides not asking for your permission to connect in the first place, they may be:
- Logging your user information such as IP, OS, browser info, etc.
- Installing more junkware (toolbars, etc.) in the background without your knowledge or consent.
- Installing malware such as key loggers and browser hijackers.
The only way to be sure this doesn’t happen is to disconnect from the internet when uninstalling this stuff. And the absolute best way to uninstall it safely is to reformat the hard drive and re-image the OS.
From Krebs on Security:
…early Wednesday morning, two security firms – Milpitas, Calf. based FireEye and Fox-IT in the Netherlands — launched decryptcryptolocker.com, a site that victims can use to recover their files.
The Cryptolocker malware was first spotted in September 2013. It uses very strong encryption to lock Microsoft Office documents, photos, MP3 files, and other files that victims may value. The unfortunate victims of the malware were faced with paying a steep ransom–usually starting at a few hundred dollars in bitcoins–to the cybercrooks. Victims were given 72 hours to pay; if they didn’t make payment in time, the ransom demand increased by five times or more, often amounting to several thousand dollars.
Only about 1.3% of victims ever paid the ransom, so most of them probably lost all of their important files. Even at such a low response, considering that the number of infected systems is probably in the range of six figures, the crooks made (are probably still making) huge profits. 1300 payments of $300 USD (the minimum payment) per 100,000 infections is $390,000.
The decryptcryptolocker.com site provides a free new online service that can help victims unlock and recover files scrambled by the malware.
Victims need to provide an email address and upload just one of the encrypted files from their computer, and the service will email a link that victims can use to download a recovery program to decrypt all of their scrambled files.
According to Krebs, Fox-IT was able to recover the private keys that the cybercriminals were using to run their own decryption service. The firms naturally aren’t saying much about how they got their hands on the keys, but it apparently had something to do with the crooks’ attempts to recover from Operation Tovar, “an international effort in June that sought to dismantle the infrastructure that CryptoLocker used to infect PCs.”
However they did it, I say good for them. Hit the crooks where it counts–their wallets.
What do you do when the very software you depend on to keep you safe from malware has vulnerabilities? Those of us who use Symantec Endpoint Protection on our networks are pondering this dilemma. Seems that SEP is vulnerable to attack.
The people at Offensive Security have announced that in the course of a penetration test for one of their customers they have found several vulnerabilities in the Symantec Endpoint Protection product. While details are limited, the vulnerabilities appear to permit privilege escalation to the SYSTEM user which would give virtually unimpeded access to the system. Offensive Security has posted a video showing the exploitation of one of the vulnerabilities.
Symantec has indicated they are aware of the vulnerabilities and are investigating.
There is some irony in the fact that there are Zero Day vulnerabilities in the software that a large portion of users count on to protect their computer from malware and software vulnerabilities. The fact is that software development is hard and even security software is not immune from exploitable vulnerabilities. If there is a bright side, it appears that there are no exploits in the wild yet and that local access to the machine is required to exploit these vulnerabilities.
This is a good lesson in why layered security or security-in-depth is so important. You cannot rely only upon a single protection method.
This is something that bears repeating by all of us. It’s very important that everyone identify web addresses before clicking the link. Malicious web sites that look legitimate are commonly used by cyber-crooks to trick unwary users.
It’s very easy to identify the true address of a link: just place the cursor over the displayed address and the true destination will reveal itself. If anything looks suspicious (for example, a link like www.wallmart.com.cn), don’t click it.
Even greater caution is needed with shortened addresses like tinyurl.com and bit.ly and many other such services. Use their preview feature to display the true source. For QR codes, make sure your app allows you to preview the destination before opening the link.
And when it comes to apps and software, only download from trusted sources.
I’m a firm believer that you get what you put your energy into, so I can see how something like that might work. I would start by making a list of things I want to accomplish and come up with suitable passwords to match the tasks. But let’s take a different look here and come up with some passwords that serve to reinforce good security practices. How about these:
Yes, this is slightly tongue-in-cheek, but not to make fun of the article above. It’s a valid approach. Just make sure you don’t re-use any of those on more than one site!
This article, “eBay’s StubHub ransacked for over $1 million, international crime ring arrested,” from Naked Security said:
It’s a shame that users all too often make it easy for crooks to just plug in credentials leaked from other breaches.
It’s yet another example of why passwords shouldn’t be reused.
Password reuse is, apparently, a given. No matter how much we lecture, a (hopefully shrinking!) percentage of people are going to commit this security sin.
Should we start expecting businesses like eBay to plan for that? Or should we just let password reusers suffer the consequences of their redundancy?
I’m certainly guilty of having re-used passwords myself, but it has been a long time since I’ve done it. In fact, since I started using LastPass, I no longer use duplicate passwords, and I am cleaning out those that still exist. What duplicate passwords I have are not on anything critical; all of my important logins such as email, banking, credit cards and other sensitive sites, have unique, strong passwords.
Now, I don’t know how we can expect businesses to plan for such a thing. How would they know a password is reused elsewhere? Monitor hackers’ sites and password dumps? They could do what Facebook did and run researchers’ recovered plaintext passwords, I suppose, but that’s a lot to ask of any company. No, I think it’s just going to take continuing education on the part of those in the know and trial by fire for those guilty of reusing passwords for critical sites.
Make sure your family, your friends, your colleagues and anybody else you can think of are choosing strong passwords, at least 12 characters long, that mix letters, numbers and special characters.
If those passwords are impossible to remember, that’s good – all the better. That’s what they make password managers like LastPass or KeePass for.
Don’t reuse passwords!
We all carry mobile devices be they phones, iPads or other tablet devices, USB drives or laptops. By their very nature, these devices are easily lost or stolen making the data on them at risk of compromise. It’s important to protect the actual devices from loss, but perhaps it’s even more important to protect the information that resides on them. Here’s how to accomplish that:
- Make regular backups of all critical data
- Securely wipe all data from a device before you discard it, donate it or give it away.
- Encrypt all sensitive data
- Use anti-malware software and keep it up to date
- Keep up with security updates for all software on your device
- If your device has a means to wipe it out if it is lost, be sure to configure this option.
Tired of resetting certain students’ passwords numerous times (will they EVER remember them?), this administrator replied to an instructor’s request for a password reset with this email:
It’s on the way to you.
Please send him to see me ASAP for his tattoo. My new policy is that after the third password reset, the student must change the password in my presence and have it tattooed permanently on the inside of his or her left arm. The password tattoo, which will be in black 36 pt. Droid Sans with slashed zero and European 7 and Z glyphs, is free. There is a $100 extra charge for aesthetic enhancement unless the student prefers to do it herself. I would encourage you to instruct them on how to design graphics around their password so that it also serves as a mnemonic. I have attached an example for your reference.
Optional: Students who don’t know how to type or otherwise operate a computer may purchase the RFID package ($150) in lieu of the tattoo. I will implant the chip in their forehead, allowing them to log in by simply banging their head against the PC (something I have been doing much more frequently these days).
Oh, I forgot to mention this: my tattoo gun is currently in the shop. Until I get it back, all tattoos will be done using the old sewing needle/thread/India ink method. This is much more painful, but just as effective.
If you or your students have any questions about this policy, feel free to drop me a line.
In the wake of recent news about Germany’s considering using typewriters instead of computers to thwart electronic surveillance, one has to ask the obvious question: Huh?
Oh, they have to be manual typewriters. Electric ones just won’t do (you can plug in a keylogger to an electric one, apparently). Makes sense, especially in light of how IBM Selectric typewriters were hacked in the 1980s. Here’s how an installed spy sensor (bug) worked, according to CBS News:
“The devices picked up the contents of documents typed by embassy secretaries and transmitted them by antennas hidden in the embassy walls. The typewriters used a round ball with numbers and letters around the surface, which revolved before hitting the ribbon against the paper. The bugs could work out each letter typed by detecting how the ball moved.”
I don’t think that manual typewriters would solve this problem. Someone will develop a way to tell which key was pressed by the audio spectrum analysis of the “clack” sound the letter hammer makes as it hits the ribbon and paper. It doesn’t even have to be so complicated. You can just go back to the old low-tech spy methods like posing as a janitor and stealing the ribbons or relying on security lapses and stealing documents that should have been shredded.
Spying isn’t going to go away no matter the technology being used. Only on the day when we can fully trust each other will spying become unnecessary.