Security Corner


May 20, 2009  2:03 AM

Can Your iEi be Improved?

Ken Harthun Ken Harthun Profile: Ken Harthun

Last month, I posted “What’s Your Identity Exposure Index?” I’ve had some interesting feedback. This one stood out:

I was really interested in your article about online identity exposure. Since I’m on the web most of the day – for my job, Twittering, creating a brand for my jewelry business – a Google search for my name delivers all accurate results on the first page. However, after taking your suggested test, my iEi was still only 1.6, which made me feel a little better. Do you have any suggestions for lowering that score…or is the damage already done once it’s done?

I’m still researching this issue, but I can tell you from personal experience that once something is on the web, it’s likely to be there for a very long time. I have managed to get some erroneous public records removed from the web, but some very old USENET postings have resisted my efforts at removal.

Public records are just that, public; but governments are prohibited from revealing, willy-nilly, sensitive information about their citizens. This means that if a “public” record somehow shows up on the Internet with sensitive information revealed (SSN, police reports, legal information, e.g.), a complaint on the proper channels will usually get the record removed.

I’ll give you the best solution I know, one that I’ve been using for some years now: If you are on line regularly, do everything you can to post and reveal the information that you *want* people to find. A blog is great for this. Using my blogs, over the past five years I’ve managed to push the junk well beyond the third page of most search engine results. I can live with that.

May 11, 2009  8:44 PM

Real Spam Statistics

Ken Harthun Ken Harthun Profile: Ken Harthun

Depending on whose reports you view, spam accounts for from 85 to 95 percent of all emails sent. This may hold true over the Internet at large, but as with any other statistical data, there are local and regional variations. My own inbox is an exception to the general rule; I get far more legitimate emails than spam.

The company I work for provides spam filtering for several SMBs, so I have to hand real data that I can evaluate. Based on last week’s numbers, we processed nearly 100,000 messages in our filters. Of those messages, nearly 70,000–70%–were spam; nearly 30,000–30%–were accepted as legitimate. Our data has its own wild variations: one set is very low with only 18% spam; another set reaches a high of 92% spam.

I’m not a statistician, but it’s easy for me to see how big a problem spam has become. I’m not ready to say email is dead as a business communication medium, but it certainly needs an overhaul.


May 6, 2009  12:41 AM

Free Mini-courses from SANS

Ken Harthun Ken Harthun Profile: Ken Harthun

Without a doubt, SANS offers some of the best and most trusted computer security training and certifications. Today, I was thrilled to find that they’re currently offering four free mini-courses. I already completed the Windows Intrusion Discovery course and started on Cyber Forensics and let me tell you, there’s nothing “mini” about the content.

….(there are four – pen testing, forensics, vulnerability testing and Windows intrusion detection). They are very short…but you actually learn a lot in a short time. What is most interesting about them is how close the online teaching is to live classes. When the instructors are good enough,
on-demand courses are just wonderful- perhaps better than traveling to attend a live class because you can replay and review sections (Tivo-like) whenever you want. And you get real time feedback on mastery with quizzes at the end of each section. They are at
http://www.sans.org/ondemand/spring09.php

If you don’t have a SANS portal login, you’ll need to create a free account to gain access to the courses and other material on the site.

Each course presents a five-question assessment test (you can take it more than once) and you get a certificate of completion.

By the way, if you register for any full length SANS OnDemand course before June 15th, 2009, you’ll save 25% off the cost of tuition—a significant discount.


April 30, 2009  8:01 PM

What’s Your Identity Exposure Index?

Ken Harthun Ken Harthun Profile: Ken Harthun

Quick: On a scale of 0 to 5 (0 being nearly invisible, 5 being at risk), how much of your identity is exposed on the Internet? If you’re wondering, there are some tests you can try that will give you a good idea of you Identity Exposure index (iEi). Here are the tests I performed and some calculations you can use. I chose these tests because they could give an identity thief enough information to impersonate you under the right circumstances. For example, knowing your mother’s maiden name and a former address might be enough to get past a security question or two. Heaven forbid your Social Security number shows up anywhere on line!

Keep in mind that this isn’t absolute by any means; it’s more of a quick-and-dirty estimate. But what you find might surprise you.

Use any top search engine. I used Google. My test results are shown in parentheses.

1. Search your name in the form you commonly use; e.g., Ken Harthun, not Kenny, Ken G. or other variants. Count the number of accurate hits on the first page. (9)

2. Search your full legal name as it appears on your birth certificate. Count the number of accurate hits on the first page. (3)

3. Search your mother’s married name, with and without her middle name and middle initial. If her maiden name shows up anywhere on the first page, count 10; if not, count 1. (10)

4.  Search the last six digits of your Social Security number, including the dash. If your name shows up anywhere on the first page, count 10; if not, count 1. (1)

5. Search your home phone number with area code. If your current address is shown, count 10; any former address, count 5; else, count 1. (5)

Now, add all the scores. Maximum score is 50. Divide by 10 to get your iEi. It’s your choice whether or not to round off.

As you can see, my score was 28, so my iEi is 2.8, which is above the median. For comparison purposes, I also did the tests using my wife’s information and her iEi is 0.7. That makes sense because she does almost nothing on the web, save for checking her one Yahoo! mail account.

I’m interested in some feedback on this for a future article and to further refine the tests.


April 30, 2009  1:21 AM

Swine Flu Breeds Spam

Ken Harthun Ken Harthun Profile: Ken Harthun

As usually happens with major disaster events—in this case the impending Swine Flu pandemic—email scammers are busy perpetrating pharmaceutical and other types of scams. In some cases, they’re using celebrity names to grab attention. Spam is hitting inboxes with various subjects. The following list, compiled by McAfee and posted on the McAfee Avert Labs Blog, shows some of the subject lines they’ve seen:

First US swine flu victims!
US swine flu statistics
Salma Hayek caught swine flu!
Swine flu worldwide!
Swine flu in Hollywood!
Swine flu in USA
Madonna caught swine flu!

They also report a 30x increase in the number of domain name registrations mentioning “swine.” It’s a good bet that many of those names will be used by scammers.

I’ve alerted my clients to this latest wave and sent reminders to everyone that should they receive any such emails, they should immediately delete them. That’s good advice to pass along.


April 29, 2009  12:33 AM

10 Immutable Laws of Security Administration

Ken Harthun Ken Harthun Profile: Ken Harthun

My last post on this subject discussed the 10 Immutable Laws of Security. This one takes the next step–also a Microsoft “archived” essay, but still relevant today. These are so self-evident that I’m not even going to burden you with my thoughts. Print this out and hang it where you can see it as a constant reminder these are the 10 Immutable Laws of Security Administration:

Law #1: Nobody believes anything bad can happen to them, until it does
Law #2: Security only works if the secure way also happens to be the easy way
Law #3: If you don’t keep up with security fixes, your network won’t be yours for long
Law #4: It doesn’t do much good to install security fixes on a computer that was never secured to begin with
Law #5: Eternal vigilance is the price of security
Law #6: There really is someone out there trying to guess your passwords
Law #7: The most secure network is a well-administered one
Law #8: The difficulty of defending a network is directly proportional to its complexity
Law #9: Security isn’t about risk avoidance; it’s about risk management
Law #10: Technology is not a panacea


April 22, 2009  7:52 PM

Lighten Up! We All Need a Good Laugh

Ken Harthun Ken Harthun Profile: Ken Harthun

I don’t know about you, but I sometimes get a little queasy when I’m thoroughly overloaded dealing with security and other user issues. So, while this post is completely off-topic, it’s certainly therapeutic; laughter, after all, is the best medicine. (Yes, I know. This has been floating around for a long time.)

What if Dr. Seuss wrote technical manuals? Here’s what you’d get:

Here’s an easy game to play.
Here’s an easy thing to say:
If a packet hits a pocket on a socket on a port,
And the bus is interrupted as a very last resort,
And the address of the memory makes your floppy disk abort,
Then the socket packet pocket has an error to report!
If your cursor finds a menu item followed by a dash,
And the double-clicking icon puts your window in the trash,
And your data is corrupted ’cause the index doesn’t hash,
Then your situation’s hopeless, and your system’s gonna crash!
You can’t say this? What a shame sir!
We’ll find you Another game sir.
If the label on the cable on the table at your house,
Says the network is connected to the button on your mouse,
But your packets want to tunnel on another protocol,
That’s repeatedly rejected by the printer down the hall,
And your screen is all distorted by the side effects of gauss
So your icons in the window are as wavy as a souse,
Then you may as well reboot and go out with a bang,
‘Cause as sure as I’m a poet, the sucker’s gonna hang!
When the copy of your floppy’s getting sloppy on the disk,
And the microcode instructions cause unnecessary RISC,
Then you have to flash your memory and you’ll want to RAM your ROM.
Quickly turn off the computer and be sure to tell your mom!

Enjoy!


April 22, 2009  2:09 AM

It’s Not Your Fault

Ken Harthun Ken Harthun Profile: Ken Harthun

I’m going to take a lot of heat for this post. Maybe. Unless I’m right (which I usually am). So, let me just get it out of the way: The state of security on the Internet today is NOT YOUR FAULT. Neither is it the fault of the clueless surfers who click on any and every link in their email and say “yes” to every popup on their screen. It’s not the fault of those who love to install the “little bitty kitty” screensavers that are loaded with adware and the ones who use the “fun web products” emoticons and stationery with similar bent. No, it’s not your fault.

It’s M….no, it’s U….no, it’s…hell,  it’s the software developers who don’t have a clue on how to write a secure application. The end user—be she a geek or a regular consumer user—has no way of knowing that there are security holes on the software she uses. And she shouldn’t have to be concerned about it, now, should she? NO.

The more I have to deal with the malicious–and sometimes just crappy–stuff that people manage to get on their systems, the more I want to grab the programmers, web app developers, and insecure software purveyors by the throat. Conspiracy theorists speculate that since the anti-malware software industry is a multi-billion dollar cash cow, we don’t have a chance of ever seeing truly secure software. I don’t think that’s true. There’s enough crap out there to keep the anti-malware industry busy for a long time.

But it does make one wonder, doesn’t it?


April 15, 2009  8:13 PM

10 Immutable Laws of Security

Ken Harthun Ken Harthun Profile: Ken Harthun

I search the web constantly for security-related news and content. One day last month, I came across a series of articles on TechNet buried in the archive. Microsoft prefaces the articles with this statement: “Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.” Well, I find the content interesting and relevant, certainly worthy of bringing to your attention. Here are the 10 Immutable Laws of Security according to Microsoft with my comments included:

Law #1: If a bad guy can persuade you to run his program on your computer, it’s not your computer anymore

We tend to take the programs and utilities we run for granted. We trust them to work as advertised and not harm our systems or corrupt our data. What we often don’t consider is that our computer is being controlled by the programs it’s running and those in control of it are the programmers who wrote the software. This isn’t a problem with normal software since we tell it when to run, what data to manipulate, and when to quit; we are able to exercise a measure of control. We still “own” our computer. With malware, “To run or not to run, that is the question” and those are our only two options.

Law #2: If a bad guy can alter the operating system on your computer, it’s not your computer anymore

As in #1, there’s a degree of trust that the operating system is doing what it’s supposed to be doing. If the OS is altered by a bad guy, then it’s doing his bidding, not yours.

Law #3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore

Physical security isn’t complicated. My Security Maxim #8 covers it admirably.

Law #4: If you allow a bad guy to upload programs to your website, it’s not your website any more

That’s an understatement. Not only is it not your website anymore, but you’ve just become an unwitting accomplice in whatever havoc the bad guy wreaks. There is no reason in the world to allow anyone to upload programs to your website before you have the chance to vet them.

Law #5: Weak passwords trump strong security

I am reminded of a friend who was baffled when he discovered that his PC was part of a P2P network being used to transfer pirated music. He couldn’t understand why his firewall “quit working” suddenly (he had P2P blocked on his router). Long story short, his teenage son had guessed the router password and changed the configuration. Heed my advice and make your passwords unguessable.

Law #6: A computer is only as secure as the administrator is trustworthy

If you can’t trust the admin, you can’t trust the PC. The administrator can install anything he wants.

Law #7: Encrypted data is only as secure as the decryption key

Make sure that your decryption key is kept in a secure place, not on your computer. It’s best to memorize it, but if you can’t, store it on a memory card and put it in your wallet. Make two copies and keep one in some other physically secure place. The first place the bad guy is going to look is on the hard drive.

Law #8: An out of date virus scanner is only marginally better than no virus scanner at all

Out-of-date malware scanners of any kind won’t protect you against the inevitable new variants that come along.

Law #9: Absolute anonymity isn’t practical, in real life or on the Web

As it says in the article: “All human interaction involves exchanging data of some kind. If someone weaves enough of that data together, they can identify you.”

Law #10: Technology is not a panacea

No matter how sophisticated the hardware and software become, they’ll never replace common sense and sound security policies and practices.


April 15, 2009  12:31 AM

Beware U.S. Tax Phishing Scams

Ken Harthun Ken Harthun Profile: Ken Harthun

It’s tax time in the U.S. and with that generally comes an increase in the number of phishing scams directed at taxpayers. The IRS, whether we like them or not, has an excellent anti-scam/anti-phishing web site. One key thing to remember is that the IRS does not initiate taxpayer communications through e-mail. Here’s an excerpt from their site:

The IRS does not initiate taxpayer communications through e-mail.

* The IRS does not request detailed personal information through e-mail.
* The IRS does not send e-mail requesting your PIN numbers, passwords or similar access information for credit cards, banks or other financial accounts.

If you receive an e-mail from someone claiming to be the IRS or directing you to an IRS site,

* Do not reply.
* Do not open any attachments. Attachments may contain malicious code that will infect your computer.
* Do not click on any links…

Additional information is provided by the IRS in a recent press release:

Beware of IRS’ 2009 “Dirty Dozen” Tax Scams

IR-2009-41, April 13, 2009

WASHINGTON — The Internal Revenue Service today issued its 2009 “dirty dozen” list of tax scams, including schemes involving phishing, hiding income offshore and false claims for refunds….

The IRS urges taxpayers to avoid these common schemes:

Phishing

Phishing is a tactic used by Internet-based scam artists to trick unsuspecting victims into revealing personal or financial information. The criminals use the information to steal the victim’s identity, access bank accounts, run up credit card charges or apply for loans in the victim’s name.

Phishing scams often take the form of an e-mail that appears to come from a legitimate source, including the IRS. The IRS never initiates unsolicited e-mail contact with taxpayers about their tax issues. Taxpayers who receive unsolicited e-mails that claim to be from the IRS can forward the message to phishing@irs.gov. Further instructions are available at IRS.gov. To date, taxpayers have forwarded scam e-mails reflecting thousands of confirmed IRS phishing sites. If you believe you have been the target of an identity thief, information is available at IRS.gov.

I highly recommend you visit the IRS site and heed their excellent advice: How to Report and Identify Phishing, E-mail Scams and Bogus IRS Web Sites


Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: