Security Corner

June 20, 2008  1:02 AM

WiFi Security–The Only Way is WPA

Posted by: Ken Harthun
Cryptography, Encryption, Password, Security, Security management, Security maxim, Wireless

Please note: since this article was posted, WPA-TKIP has been found to be vulnerable. See my post of 2008.11.13 entitled “WPA-TKIP Vulnerable to Attack” for more information.

It’s far too easy to set up WiFi for your home or business; all you have to do is go to your local electronics superstore and pick up a wireless router, plug it in to your network, and connect to it. The default configuration of most consumer products–completely open with no security enabled–will allow you to connect without having to enter any configuration information into your wireless PC. That’s why in any given neighborhood you’ll see multiple unsecured wireless network connections available. Most public WiFi hotstpots are also unsecured, open connections. If you just surf the web and send an occasional email, you might be OK (besides the fact that anyone in range can connect to and use your Internet connection), but the moment you start using your PC for banking, making purchases, and paying bills online, that wireless connection absolutely must be secured. It must be done right, and there’s really only one right way to do it. Before I explain that, let me tell you what not to do:

1. Don’t rely on SSID hiding. I’ve seen numerous articles that tout SSID hiding as a security measure (and one CISSP, no less, is recommending it!) While this technique may serve to hide your network from casual view, there’s nothing secure about it: the SSID is transmitted in clear text in every packet and is easily sniffed by wireless packet sniffers. For example, Network Stumbler will identify the SSIDs of any network within range, regardless of whether or not the wireless access points are broadcasting.

2. WEP is broken. Using 40,000 to 100,000 packets, which can be captured in about a minute, you can crack a WEP key in about three seconds on a Pentium M 1.7 GHz PC. Don’t believe me? Check it out: This list even provides video tutorials on how to do it. Sure, it provides a small measure of security and it’s better than nothing, but why use something that’s already been proven inferior? Would you feel more secure knowing the garage where your store that vintage Corvette is protected by a Master lock or one you bought at an everything-for-a-dollar store? Your personal information is much more valuable than that car.

3. Don’t bother with MAC address filtering . I don’t know why so many people are recommending this. MAC address filtering is equivalent to SSID hiding–it’s virtually useless, except to keep a casual user from inadvertently connecting to your wireless network. Like the SSID, MAC addresses are sent in clear text within the network packets and can easily be discovered and spoofed by anyone sniffing your network.

So, what’s the right way? WiFi Protected Access, known by its acronym, WPA. There are two versions: WPA-Personal and WPA-Enterprise. WPA-Personal relies on a pre-shared key (PSK), while WPA-Enterprise requires a special authentication server and is therefore more suited to corporate environments. WPA implements 128-bit encryption and as long as you create a strong, unguessable passphrase, it’s completely secure. Configuring WPA-PSK on a given wireless router depends on the brand, but you can find a general tutorial at this site.

And that, my dear reader, is Maxim #13 in the How to Secure Your Computer series of articles:

When it comes to securing a WiFi network, the only way is WPA.

June 14, 2008  1:57 PM

Infected PC? Don’t Just Clean–Wipe and Reload

Posted by: Ken Harthun
Anti-malware, Malware, Opinion, Rootkit, Security, Security maxim

You’ve seen them: PCs with serious malware infections that seem to defy any and all attempts to clean them up. You persevere and eventually get rid of the files that regenerate upon deletion, clean up the autorun registry entries that keep the malware going, and kill all the malicious processes that keep showing up. You’re proud of yourself; you’ve conquered the beast, out-hacked the hackers. You’re the man: a real, live uber-geek! Pat yourself on the back–you earned it. Then, after you’ve finished congratulating yourself, reformat the hard drive and reinstall the operating system–you can never trust that machine again unless you do.

There’s no such thing as forgiveness in security; once a machine has been compromised, you can never be certain that it’s free of malware unless you completely wipe it out and start from scratch. Just because everything appears to be working properly after your “cleanup” doesn’t mean it is. Modern malware is designed to be tenacious and stealthy. Many malicious programs leave behind remnants of themselves even when good anti-malware software is able to take the venom out of them. Rootkit technology is becoming so sophisticated that normal means of detection don’t work as this article in The Register explains.

It’s a matter of trust; it’s also a security maxim. So without further ado, I present How to Secure Your Computer, Maxim #12:

Once a PC is infected with malware, you can’t trust it. The only way to restore trust is to wipe the hard drive clean and reload the operating system.

June 13, 2008  1:56 AM

SSL is Your Friend and Protector on the Web

Posted by: Ken Harthun
Cryptography, Phishing, Security, Security maxim

I hope I’ve given you some valuable advice in this series of posts on how to secure your computer. If so, and if you’ve chosen to take my advice, you’re probably careful about what you do on the web. You certainly have strong passwords for all of your logins, all of them different, and you don’t go around telling people what they are or keeping them on sticky notes attached to the monitor at your workplace. But the web can be a dangerous place; make a mistake and you could be in trouble. There’s one common mistake that if you make it, you may as well paint your passwords in 10-foot tall letters on a lighted billboard next to a busy freeway and invite every hacker to drive by it.

I’m talking about entering your password — or any sensitive information — into any web page that’s not secure. All communication — including your username and password — between your browser and a web server is normally transmitted in clear text, easily read by anyone who cares to look. Your data is being sent in clear text if you enter anything onto a page that has the prefix http:// in its URL. That’s how you know the page isn’t secure. While not a totally reliable method of identifying a phishing site, it’s a pretty good bet that any financial site or one requesting personal information that displays http:// is suspect; steer clear and don’t enter your credentials.

How do you know a page is secure? It will use an encrypted connection, signified by the prefix https://. This page will use a technology known as Secure Sockets Layer (SSL). Any information you put into such a page is unreadable by anyone who might intercept it. Only your browser and the web server at the other end can decipher it. Some browsers even show a lock icon to let you know it’s secure. SSL relies on special security certificates issued by a trusted authority who has verified the identity of the website you are logging onto. So, I present you with Maxim #11 in the How to Secure Your Computer series:

Never enter sensitive information into any web page unless you have verified that the information is being sent over a secure connection signified by https:// in the address bar and a lock icon in the browser’s status bar.

June 5, 2008  1:30 PM

Safari for Windows Flaw Quick Fix

Posted by: Ken Harthun
Apple, Browsers, Microsoft Windows, Remote Code Execution, Security, Vulnerabilities

Microsoft has issued Security Advisory 953818 advising Safari users to “restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple.” According to Microsoft:

“A combination of the default download location in Safari and how the Windows desktop handles executables creates a blended threat in which files may be downloaded to a user’s machine without prompting, allowing them to be executed. An attacker could trick users into visiting a specially crafted Web site that could download content to a user’s machine and execute the content locally using the same permissions as the logged-on user. “

Oddly enough, there’s a quick fix for the problem. In the advisory, Microsoft clearly states: “Mitigating Factors: Customers who have changed the default location where Safari downloads content to the local drive are not affected by this blended threat.” Just go to Edit > Preferences > General > Save downloaded files to [your chosen new location].

That was easy.

May 31, 2008  2:13 AM

How to Secure Your Computer: Maxim #10

Posted by: Ken Harthun
Cryptography, Encryption, Password, Security, Security management, Security maxim

A friend of mine came up to me the other day and said, “I love your computer security maxims, but there’s one thing I don’t have anything to worry about–I keep all of my passwords stored on an encrypted thumb drive.”

“Well, that’s a good thing,” I said. “Where do you keep your backups?”

“On my external USB drive.”

“That’s encrypted, right?”

He blinked and looked away. “No.”

Doh! If a cracker is able to access his PC and that drive is connected and turned on, my friend could be toast. If someone breaks into his house and steals the drive, my friend could be toast. Depending on what is actually stored on the hard drive, full backups can contain lots of personal information–information that is much more valuable than mere passwords. Think about it: if you have the user’s name, address, SSN, pet photos, you-name-it, you’re in Fat City; you can easily assume the identity and recover usernames and passwords.

Few people encrypt their data, much less their backups. They should, but they don’t. Some backup programs allow you to make encrypted backups. If this option is available take advantage of it. The most secure plan would be to both encrypt your data and encrypt the backup for a double layer of protection. Then, take the backup media offline and store it in a secure place. And that is Maxim #10:

When using external removable media for backups, either encrypt the backup files or make sure the media is taken offline after the backup has been completed.

May 29, 2008  8:14 PM

Phlashing Attack Can Damage Systems Beyond Repair

Posted by: Ken Harthun
Cyber warfare, Opinion, Remote Code Execution, Security, Security management, Vulnerabilities

It has long been an “everybody knows” that viruses and other malware cannot physically damage hardware. We’ve all seen those alarming emails that say, “…the virus destroys Sector Zero, thus permanently destroying the hard disk,” a statement we know is rubbish; at worst, the disk is rendered incapable of booting an OS, but the drive is still operable and the data recoverable. Seems that now, however, an HP researcher has found a way to exploit security vulnerabilities to create a permanent DOS (PDOS) attack by thrashing embedded hardware. From The Register:

The cyber-assault thrashes systems by abusing firmware update mechanisms. If successful, the so-called phlashing attack would force victims to replace systems.

The attack was demonstrated by Rich Smith, head of research for offensive technologies and threats at HP Systems Security Lab, at the EUSecWest security conference in London on Wednesday [21 May 2008]. Smith told Dark Reading that such a “permanent denial of service” attack could be carried out remotely over the internet.

The attack would be carried out by exploiting flaws in remote management interfaces to gain access to the system and then flashing or fuzzing the firmware binaries to render the hardware useless. One such remote management interface is HP’s Integrated Lights Out (ILO) which is embedded in their ProLiant servers; however, Doug Hascall, an HP manager in charge of ILO firmware, believes the security architecture of the interface makes it invulnerable to the attack.

Security watchers, myself included, don’t see crackers destroying systems since there would be no money in it; rather, this attack could make it possible for them to plant malware inside of the firmware: a far more insidious threat. Moreover, a country’s enemies could use the technique as an effective cyberwarfare weapon either to take out critical infrastructure or to implant spyware to gather military intelligence.

May 29, 2008  5:14 PM

Beware the Internet Criminals’ Latest Trick

Posted by: Ken Harthun
Browsers, Email security, Opinion, Phishing, Security, spam

Some spammers, phishers, and other Internet criminals have resorted to (mis)using the convenient service of in order to disguise their web site addresses and entice you into clicking. takes those weird, long URLs and converts them into something smaller and more manageable. So, instead of a URL that might look like this, http://3468664375@3468664375/o%62s%63ur%65%2e%66t%6D (not a real address), you see one that looks like this: That’s a bit less intimidating and you may be tempted to click on it. Don’t; you’ll be sorry.

Never, ever click on a link in an email unless you know and trust the sender. Never, ever click on a link in a website, blog post, online article, or what-have-you, unless you know the content is safe.

May 22, 2008  7:38 PM

Foxit Reader Security Vulnerability

Posted by: Ken Harthun
Buffer Overflow, Remote Code Execution, Security, Vulnerabilities

Since I discovered Foxit Reader in early 2006, I’ve been recommending it to everyone. There’s no question it’s a best-of-breed tool for speed and simplicity. But recently, Secunia issued a bulletin advising of a security vulnerability in the program. According to that bulletin, Foxit Reader version 2.3 build 2825 is vulnerable to a remote code execution buffer overflow. attack on your system. The problem will be fixed in the upcoming build 2912.

I’m still using version 1.3.x which, apparently, is not vulnerable. So, if you’re using an older version of Foxit, you should be OK; however, just as soon as build 2912 is available, I’m going to upgrade just to be on the safe side. You should, too.

May 18, 2008  6:39 PM

Are You a Hacker Target?

Posted by: Ken Harthun
Browsers, Firewalls, NAT, Opinion, Routers, Security

Aside from those unenlightened, naive souls who invite every hacker, phisher and Nigerian scammer on the planet into their computers how many people actually fall victim to hackers? I’m talking about people who take reasonable precautions, like installing a NAT router, running a personal firewall (not Windows’ firewall) and anti-virus software. I ask this question because for some months now, I’ve been running half naked behind my hardware firewall: no anti-virus, no software firewall, just a hosts file to block known bad sites (I do update it frequently). I use both IE and Firefox for web surfing.

I haven’t been hacked, nor have I been infected by any malware. In my entire history of computing (since 1974), I’ve never been plagued by a virus or worm. I guarantee you that my PCs are not part of any botnet. No one has ever tried to run a DDOS attack on me. It’s not that I’m invisible–Google my name and you’ll get several thousand hits (some of those aren’t me; apparently more than one Ken Harthun out there). I have a couple of different web sites in plain view, too.

Am I immune to attack or just lucky? Or is it that by applying the various security tips I give you here (yes, I do the same things I tell you to do) , I’m out smarting the hackers so they can’t figure out how to get me? Food for thought. Your comments are welcome.

May 17, 2008  3:08 PM

Two Ways to Operate Securely on the Web

Posted by: Ken Harthun
Browsers, Linux, Microsoft Windows, Security, Security management, Security maxim, Virtualization

If you’ve done any coding at all, you probably have a good idea why software developers often run their untested code in a protected environment–a sandbox. If the software misbehaves, all you have to do is shut down the sandbox and everything returns to normal, no harm done.

A sandbox is also a great way to prevent viruses and other malware from infecting your machine while browsing the web. Confine your browser to its own little box and if any malicious software tries to run, it can’t get to your system, it stays within in the box’s boundaries. Kill the box and you kill the malware. The top, free sandbox program for Windows–the one I use for secure surfing and testing– is Sandboxie. It runs only on Windows and is Vista-compatible. Run Internet Explorer, Firefox, or any other program under Sandboxie and you should be safe.

Flash Update: Seems CheckPoint agrees and has released a product of its own. Check out this article from Dark Reading.

You can also operate securely from inside a virtual machine. This is different from a sandbox in that you actually run an entire operating system, rather than a single program. Many people, this Geek included, use virtual machines to run alternative operating systems like Linux. In a virtual machine, you can do everything you do on a real machine and like the sandbox, if things go wrong, your computer won’t be harmed. A big advantage of the virtual machine over a sandbox is that you can examine the actual behavior of malware and any damage to the OS. Microsoft provides the free Virtual PC and VMware provides its free VMware Player and VMware Server. For the Mac, there’s Parallels (not free). You might want to check out the secure browsing applicance provided for VMware Player.

Security Maxim #9:

When surfing the web, testing unknown programs, or engaging in other activities with the potential to harm your computer, use a sandbox or virtual machine to protect your base system from harm.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: