Security Corner


February 27, 2014  2:33 AM

Mac OS X 10.9.2 released to fix critical SSL security hole



Posted by: Ken Harthun
Mac, OS X, Secure Computing, Security, Security best practice

They promised “as soon as possible” and they delivered. Here are the details straight from the OS X App Store.

osx-109-2-1

February 27, 2014  2:12 AM

Why passwords alone are no longer sufficient security



Posted by: Ken Harthun
Credit Card Fraud, data security, Security, Security best practice, Security management

We have all see this coming for a long time; in fact, I’m surprised it has taken this long to become obvious that passwords are no longer sufficient security. Sure, they’re OK for things that really don’t matter like news sites and entertainment sites — any site that doesn’t store sensitive information about you — but for all other things they’re just not enough anymore.

Passwords are the “something you know” part of security and therefore the easiest factor to guess or otherwise obtain. Beyond the fact that people tend to use passwords that are easily guessable, here are three other reasons why passwords alone are no longer sufficient security.

1. Duplicate passwords. People tend to use the same password in multiple locations, often using the same one for everything. I don’t know how many times I’ve had people tell me, “I always use xxxxx for my password” meaning, of course, that when asked to create a password for anything, that’s the one they use.

2. Keylogger infections. Every day, I see computers with bogus “system cleaners,” “system optimizers,” “pc boosters,” etc. infecting them. I can only assume that beyond these junky scams, there is more sinister stuff installed. People just don’t know any better and if it sounds good to them, they click OK. I envision that some sort of message like “Please click here to protect your bank account from unauthorized access” would be a quite effective technique.

3. Phishing scams. I’ve seen some of these in my own inbox that made me do a double take until I dug a bit deeper. If I almost got phished, I promise you someone else really did. Then, once the hacker had the password, he probably tried it on every site the person had, and was probably successful at gaining access to several of them.

Bottom line: Two-factor authentication is not only long overdue, it’s critical if we ever hope to prevent the huge data breaches like Target’s and others that have been in the news.


February 23, 2014  6:21 PM

Update your iOS to 7.06 on iPad and iPhone!



Posted by: Ken Harthun
Apple, Mac, OS X, Security, Security management, Vulnerabilities

ios-706Apple has released a security update for iOS. (Use this URL: http://support.apple.com/kb/HT6147 for details.) Here’s what Apple says about it:

Impact: An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS

Description: Secure Transport failed to validate the authenticity of the connection. This issue was addressed by restoring missing validation steps.

Basically, this means you are open to a man-in-the-middle (MITM) attack. Engineers at CrowdStrike (see this post) describe the vulnerability and the attack method.

To pull off the attack an adversary has to be able to Man-in-The-Middle (MitM) network connections, which can be done if they are present on the same wired or wireless network as the victim. Due to a flaw in authentication logic on iOS and OS X platforms, an attacker can bypass SSL/TLS verification routines upon the initial connection handshake. This enables an adversary to masquerade as coming from a trusted remote endpoint, such as your favorite webmail provider and perform full interception of encrypted traffic between you and the destination server, as well as give them a capability to modify the data in flight (such as deliver exploits to take control of your system).

This has NOT been patched for OS X, which also has this vulnerability, so Mac users are still at risk until Apple issues a patch.

You can check gotofail.com to see if your device is vulnerable. I checked my MacBook Pro with both Safari and Google Chrome. Safari is vulnerable, Chrome is not, so I suggest you not use Safari on your Mac until after Apple issues the patch.


February 22, 2014  4:33 PM

C’mon Adobe, get your act together!



Posted by: Ken Harthun
Adobe, Critical update, Security, Security management, Vulnerabilities

adobe_hackedI’ve made no secret of my dislike for all things Adobe and their dismal security.  Now this from nakedsecurity:

Adobe has just updated its Flash product for the second time this month, pushing out an emergency patch for an RCE exploit that has been seen in the wild.

This update covers vulnerabilities numbered CVE-2014-0498, CVE-2014-0499 and CVE-2014-0502 if you care to look them up. The last one is known to have been exploited in the wild and the other two are being patched as a precautionary measure. Adobe’s next update isn’t due until April.

In all fairness, it’s not just Adobe who frustrates me; any software company who puts out a product full of holes is responsible. The current production model:

  • Slap together a product
  • Run superficial testing
  • Release to the public (and hackers) for real-world testing
  • Fix the vulnerabilities they should have caught in the lab

This just doesn’t work anymore if, in fact, it ever did.

C’mon, people. ALL of you get your acts together.


January 31, 2014  7:24 PM

Hacking Skills Challenge – Realistic 1



Posted by: Ken Harthun
Hacker, Hacking Skills Challenge, Security

hacker_1My hacking skill challenges are still very popular posts, particularly Hacking Skills Challenge – Level 7, so I’m going to pick them back up. Since I have previously presented all 11 of the basic challenges from HackThisSite.org, let’s move on to some realistic ones. Here’s the description from the site for the first Realistic Challenge:

Uncle Arnold’s Local Band Review
Your friend is being cheated out of hundreds of dollars. Help him make things even again! Difficulty rating: Easy.

The challenge is for you to hack a band review site and move your friend’s band, Raging Inferno to the top of the list.

Hints: 1. You’re going to need some way to edit the page “live;” and, 2. There are some numerical values you will need to change.

Give it a try and post your results in the comments. I’ll present the solution in a future post.

Good luck!


January 30, 2014  1:41 AM

That’s it! No more! I quit!



Posted by: Ken Harthun
Big Brother, Computer Humor, Eavesdropping, Security

This will be short and sweet.

It’s bad, you know.

I’m fed up. Through with it. Officially done. Permanently withdrawn.

Don’t try to talk me out of this because it won’t work; don’t try to talk me into something else, either, because that won’t work…um, either. Neither will I be seduced by the lure of unlimited knowledge that I will supposedly be abandoning.

If I listen to all the pundits, everything I think, do or say is monitored by the NSA, FBI, CIA, IRS, local police, my wife, children and the next-door neighbor–and probably anyone with that nifty little program that turns my laptop camera and microphone on without my knowledge.

I can have no secrets. Even that blemish I’m picking at as I stare in my bathroom mirror is probably being broken down into packets, transmitted around the world and filed in multiple redundant databases just waiting for the day when I am busted for possession of galena crystals and used paper towel rolls (these can be used to build clandestine radio receivers, you know).

I can hear the neighbors now: “He was so nice. I never thought he was capable of such things. But, he had a blemish, you know!”

I can’t take it anymore, this steady stream of bad news about surveillance states and how we have no privacy. I’m disconnecting from the bad news. Every site that publishes such bad news goes on my black list.

That’s it! No more! I quit!

[Until I change my mind]


January 29, 2014  10:51 PM

Top worst password in 2013 is no longer “password”



Posted by: Ken Harthun
Security

522845_passwordWell, it’s not getting any better out there. People are still using idiotic, easy-to-guess passwords despite the advice of every security wonk out there, including me. But “password” is no longer the top most idiotic password: It has been replaced by “123456.”

SplashData, which makes password management applications, has released its 2013 list of the 25 worst passwords based on files containing millions of stolen passwords posted online in the last year. “123456″ now tops “password,” which normally leads the round-up. (Read more: Worst Passwords Top 25 of 2013 | TIME.com http://newsfeed.time.com/2014/01/20/the-25-worst-passwords-of-2013/#ixzz2rWcFRY6r)

Here’s the list:

  1. 123456
  2. password
  3. 12345678
  4. qwerty
  5. abc123
  6. 123456789
  7. 111111
  8. 1234567
  9. iloveyou
  10. adobe123
  11. 123123
  12. admin
  13. 1234567890
  14. letmein
  15. photoshop
  16. 1234
  17. monkey
  18. shadow
  19. sunshine
  20. 12345
  21. password1
  22. princess
  23. azerty
  24. trustno1
  25. 000000


January 26, 2014  5:30 PM

Sophos Security Threat Report 2014 released



Posted by: Ken Harthun
Security

gremlinFrom Sophos (full Press Release here):

Cybercriminals are smarter, and malware is stealthier and more dangerous than ever before. We currently see more than 250,000 unique samples of malware every day. The bad guys are constantly moving. Can you keep up?

Our Security Threat Report 2014 explains how the threats are changing, and shows you how Sophos is working to stay ahead of them. Download the report today to get the best threat intelligence in the industry from our SophosLabs experts. You’ll be smarter, and better prepared for the threats of tomorrow.

Highly recommended. Download the report here.


January 26, 2014  4:57 PM

Bogus funeral announcement points to malware



Posted by: Ken Harthun
Security
Source: FortBendNow.com

Source: FortBendNow.com

One of the latest tricks in the cyber-criminals’ bags is an email with the subject (it varies), “Death and Funeral Announcement.” Now, what normal person would see that and NOT open it? I know I did. What I DIDN’T do, of course was click the link which pointed to a site <domain name>.be. Here’s the text:

For this unprecedented event, we offer our deepest prayers of condolence and invite
to you to be present at the celebration of your friends [sic] life service on
Thursday, January 22, 2014 that will take place at Eubank Funeral Home at 11:00 a.m.

Please find invitation and more detailed information about the farewell ceremony  here .

Best wishes and prayers,

Funeral home receptionist,
William Mccarty

After a few seconds of oh-my-god-who-died, I re-read the email and spotted the obvious bad grammar and realized this was a scan. Researching led me to discover that the link target delivers a Trojan. I also looked at the headers and found the originator was at IP address 89.108.70.217 (lookup tool) which has these attributes:

IP : 89.108.70.217     Neighborhood
Host : vm1351.vps.agava.net    OK
Country : Russian Federation  

And that is enough to confirm that I certainly don’t want whatever they have!


January 20, 2014  8:53 PM

How to stay (relatively) secure with XP at the end of support – Part 2



Posted by: Ken Harthun
Secure Computing, Security, Security best practice

In How to stay (relatively) secure with XP at the end of support – Part 1, I recommended that you ditch IE 8 for Chrome or Firefox for web surfing and promised to provide even more advice. In this post, I give you several more ways to operate with Windows XP in a relatively safe manner after the end of support.

Microsoft has extended its anti-malware protection for Windows XP until July 15, 2015: Anti-malware protection for Windows XP extended to July, 2015 and Malwarebytes Anti-malware is likely to support Windows XP for several years to come. So, the first thing to do is make sure you keep both of these programs updated. Windows Secrets has this to say:

Keeping your antivirus software up to date is always important, but even more so with Windows XP. My preferred AV setup is a combination of Microsoft Security Essentials (site) and Malwarebytes’ Anti-Malware (site)

It’s also a good idea to run periodic scans using an offline rescue disk such as Sophos’ Bootable Anti Virus to detect and remove rootkits and stealthy malware.

Naturally, you’ll want to make sure that your XP box is sitting behind a NAT router and make sure your Windows Firewall is active and properly configured.

While you’re at it, why not just disable web browsing entirely? You can still keep your XP box accessible to your local network and use it for file sharing and those special apps, it just won’t be able to reach the internet. Here’s how:

lanproxyProxy2And one more tip from Windows Secrets. OpenDNS blocks browsing to known malicious sites.:

Adding the OpenDNS settings to your router extends Web filtering to all devices on the local net. The process is relatively simple: open the router’s admin menu system and enter 208.67.222.222 and 208.67.220.220 (these are OpenDNS’s IP addresses) into the router’s DNS section.

And finally, keep any third party applications that continue to support XP up to date. Many vendors will probably move on, but there will be those who continue to support XP well into the future. Take advantage of their efforts by applying patches as they become available.


Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: