Credit Card Reporting

I have heard this story a few times. A married person brings their child for a car, goes to take out a car loan, and finds their credit is ruined. The reasons can be anything from identity theft to marriage problems. Either way, however, it is a bad situation to be in.

Maybe you have heard the "free credit report" Web sites advertising. The main one of these, freecreditreport.com, is free but requires users to sign up for services in order to get their "free" report. However, why do that when the companies that keep track of your history are legally required to provide you this information for free once a year?

In 2001, I graduated from college, and a friend mentioned that New Jersey residents could get copies of their credit reports by sending a letter to each agency. When I got the report, I was surprised to find I had a few active credit card accounts. They were open because I applied. Since I wasn't living at home, I didn't get my mail often, so I had accounts open. I recall applying for one in college in exchange for a t-shirt, and I filled one out at a Devils game for a hat. I spent a while calling credit card companies and closing accounts I did not use.

At that point in time, each state had different laws regarding this, but today, residents of the United States have the right to view this information online once a year for free from each of the three credit reporting bureaus. In order to get a copy of your report, you can log on to the Web site the three agencies have set up:

www.annualcreditreport.com

They may offer to sell you extra services, but if you decline, you will not be charged anything. The general rule of thumb is if they offer premium services, you don't want those.

In my experience, it was good to do a credit report for the first time to see what information they had there. Today, I check it for identity theft or fraud, and fix any errors they might have on there (they may have mistakes, and if it costs you a loan, that is bad).

For most users, an annual credit report for free is enough, but there are services for people who want something more (like real-time monitoring, or access to your credit score). For most users, I think spending an hour a year on this is a great idea. I put it on my calendar to do each year, so if something does happen, I should become aware of it.

Spyware

Spyware is a topic I don't feel like many of my students really see the risk in. I figured I would put up some information about it since I am going to be talking about it in class soon.

Not THAT type of spyware (Image from icanhascheezburger.com)

Spyware isn't the same thing as a virus, and this was a problem at first. Programs started appearing that would monitor what a user was doing and possibly transmit the results elsewhere, and antivirus software programs did not block them, because were not a traditional virus (especially in that they did not replicate/copy themselves to another machine).


Some examples are keyloggers, advertising software ("adware"), and tracking cookies,

Keyloggers keep track of the keystrokes entered on a computer. They can be either hardware or software based. A hardware based keylogger would simply plug in between the keyboard and the system unit. Since most people don't regularly examine their computers, this is a good way to spy on someone. It is generally a little more difficult to detect since the operating system may not even detect it, but it has the drawback that you need physical access to the machine. Software keyloggers are a little safer, but also more likely to be caught by anti-spyware tools. Some of them can record the keys you hit and even email or upload the log file to someone.

Adware keeps track of a user's browsing habits and pops up ads. The adware tends to be a little more aggressive than your standard pop-up ads. Certain adware will attempt to scare you in to buying things like antivirus software. The reason this can be more malicious and dangerous is because once it is installed on your machine, it has more permission to do things (like pop up windows or change system settings) than a regular Web site does.


Tracking cookies also present a threat, though they are less scary than the other things mentioned. These keep track of your viewing habits and store information on your computer. These may be used to, say, display more ads about cars and less about baby clothes if you often click on car ads and never click on baby clothing ads.


The main thing that distinguishes tracking cookies and adware is the way they are used. Adware is usually installed versus the tracking cookies just being left by a Web site.

Either way, you should have some sort of anti-spyware protection on the computer. Most antivirus tools come with some sort of anti-spyware at this point, though if you are looking for extra protection, tools such as Lavasoft Ad-Aware and Spybot Search and Destroy do have free versions.

No, your operating isn't perfect either

When I was in college, I gave up on Microsoft's operating systems (I got tired of Windows freezing on me) and ran a distribution of Linux called Debian for a few years. For my needs, it worked well, probably even better than a Windows system did. I did a lot of programming, and the Linux operating system was very similar to the Unix (Solaris) operating system that our assignments ran on.

When I teach introductory classes, I have students who have Macintosh computers at home or people running Linux. When we come to computer security, I will generally mention the idea of antiviruses. I generally will have some student say "I don't need one because I am not running Windows". Sometimes, I even get "you can't get a virus on a Mac (or Linux) system".

This is factually incorrect. In security, there are no absolutes. There are viruses, malware, and other programs which end up out there for both operating systems. This doesn't mean the Macintosh and Linux operating systems aren't inherently safer, however.

If I am a hacker, I have to determine my audience (much like a research paper). Who am I hacking? The answer is probably something like "new computer users". Most new computer users are not running Linux, and therefore, if you are writing an exploit, you want to target non-Linux users. Similarly, if you are writing an exploit through the Web, you want to target your biggest audience, and that would be Windows operating system users running the default browser (Internet Explorer). Of course there are other reasons you might target the Windows/IE combination (such as Active-X controls).

The reason this is on my mind...out at the Pwn2Own hacker challenge, some folks from a French penetration testing company hacked a fully patched Mac. They did it using an exploit in the Safari browser.

Link to story

Teams will also compete to create more exploits for a number of different browser/OS/plug-in today and tomorrow.

Spy vs. Spy

A few years back, I attended a workshop hosted by NJ Infragard. It's a group that puts on workshops related to security, specifically computer security.

(Amusingly enough, every time I mention Infragard, I get an email from someone telling me how "bad" they are. I also get a comment every time I post anything remotely related to Web design, from someone who hates a stock photo company called Getty Images. Always interesting to see what brings out the commenters and emailers!)

Anyway, that said, one meeting had the key speaker being Kevin Murray, of Murray Associates. His company is one that is part of an industry I didn't even realize exists. His company will come in and sweep your company for wiretaps, listening devices, and the like. It was quite educational for me. He told some crazy stories about how far people go to spy, in politics, and in private industries like pharmaceuticals.

Anyway, the company maintains a blog with tons of news involving espionage, privacy, and security. This site is definitely one I check out from time to time. I enjoy computer security, but I am not actively involved in it on a day-to-day basis. Reading the perspective of someone who is out there in the field is entertaining and educational for me.

Link to Kevin's Security Scrapbook

Metadata and You

I first encountered the word metadata back when I started creating Web pages in the mid 1990's. Programs called "search engines", like Webcrawler and Altavista, would automatically find your page and make it available for the world to find. They did have issues adequately describing your page, so as a Web developer adding "meta tags" was critical. It was a way of adding text that did not show up in the Web browser, but allowed search engines to find information about your site.

Metadata is something that is used today in many areas, from computer forensics to corporate espionage. I will give you a regular example first. As a professor, there are times when I think something might be an exact copy of someone else's file. The first thing I will do is take a look at the file properties. In Office 2010, I would go to the File tab and select "Info". On the right side are properties. I can see very easily the name of the person who created the file. In a computer lab, most people probably have the same user name, so that may not tell me anything. However, if you created it at home and gave it to a friend, there is pretty damning evidence since your friend has handed in a file with your name in it. Other ways include "date created" - this tells me the day and time the file was created. I am of course not opening up my whole bag of tricks here, but these are two ways to investigate a file further.

In terms of corporate espionage and hacking...many times, the metadata in programs such as Word (and most of the rest of Office) includes data like username, company name and a file path. If this file was created on a network drive, I now know the name of one of your company's internal servers and possibly your username. This information is valuable for hackers!

If you are distributing a file from Office, also be aware if your company uses tracking changes, revisions, comments, or hidden text, that information can be included in a file you distribute. If a member of a company's staff left a comment in the file, there is a good chance it could be found. You can use the Office 2010 Prepare for Sharing options to minimize this risk, though once again, most people do not realize this.

Even programs like Photoshop can cause metadata issues. Let's say you have an image, and you choose to blur out bits of it. Photoshop will save a thumbnail as part of the file, to make it quicker for the operating system to give users a preview. Therefore, a smart hacker may be able to see your original image using some advanced techniques. Programs such as jStrip will help minimize this risk, but many people don't realize it is a risk.

Like many other technology issues, the only way people know about this generally seems to be if they are burned by it.

Java up, Adobe down

...in terms of exploits, anyway. Looks like Java exploits are gaining favor with hackers again lately, according to this CNN article.

One of the problems with the Internet and specifically the World Wide Web is there are so many moving parts. Many novice users do not seem to realize the complexity of it all. Any application software (including Web browsers) present security risks, and when you add in the various plug-ins (such as Adobe Flash Player, Javascript, Microsoft Silverlight, etc.), you have a hacker's paradise. In the typical interaction, you have three points where security breaches can happen:
1) The browser
2) The plug-in
3) When the browser and plug-in interact

A perfect secure world would have no plug-ins at all, but that is not realistic. We are left as end users to hope the developers of the plug-ins secure their products.

Adobe has come under fire a bit for some of their exploits, but it seems as if they have done a good job (albeit, a reactive job) of plugging up some of their security holes. The report linked above shows that the number of Adobe exploits recorded has gone down, while Java exploits have gone up. Does that mean that Adobe has fixed their problems, or does it mean that Java problems are easier to exploit? That I can not tell you.

Bring out the Dancing Pigs!

"Given a choice between dancing pigs and security, users will pick dancing pigs every time."

Once someone explained that line to me, I loved it. Basically, Bruce Schneier (a US computer security consultant and cryptographer) explained, "If the computer prompts him with a warning screen like: "The applet DANCING PIGS could contain malicious code that might do permanent damage to your computer, steal your life's savings, and impair your ability to have children," he'll click OK without even reading it. Thirty seconds later he won't even remember that the warning screen even existed."

That basically seems to summarize computer security these days. Users often get taken in by phishing schemes, download viruses, give out personal information, and do other things that compromise security...for the promise of dancing pigs. Smart hackers do this and create attractive links that people will click on.

As you can see, there are tutorials taking potential phishers through the process of stealing information. Stopping sites posting information like that is like playing Whac-A-Mole.

Congrats, you shut down a phishing site! Put down the hammer, I don't think others will pop up!

I do not know that most Americans are adequately prepared to figure out what sites are legitimate and which ones are not (and to read warnings). Sadly, people seem to learn by making mistakes and losing their personal information or getting hacked.

Proper Hardware Disposal

In one of my classes last week, we discussed the proper way to get rid of old computer hardware, to avoid privacy issues.

I've gotten rid of old computers, but I generally either keep the hard drives (to destroy) or use software to do a thorough wipe of the drive's data When I say "thorough wipe", I am not talking about deleting files, because data can easily be recovered from a hard drive, EVEN AFTER YOU DELETE IT. Really. As a matter of fact, Microsoft's pre-Windows operating system, DOS, used to include an undelete tool which could recover deleted files easily.

eBay is one place people can purchase used hard drives, and they even provide information on why you need to thoroughly wipe a hard drive before you sell it. You can see that the site shows that social security numbers, credit card numbers, and all sorts of stuff can be found on these hard drives. This means your identity can be stolen even if you do nothing wrong, if a company you have purchased from does not follow good procedures for hard drive disposal. Aside from eBay, there are sites like Craigslist where people get rid of old hardware, and there are always garage sales. In the corporate environment, many colleges and companies pay companies to dispose of old hardware (such as eRevival locally). If you go with a cut-rate company, you may find that though they promise to clean hard drives, they may not do so thoroughly. Any of these are ways that data can be leaked if the hard drives are not wiped.

One way you can provide a level of security is to physically destroy the hard drive, though someone could pick it out of the trash and recover something. The best way is to do a full wipe of the hard drive, or what we used to call a "zeroize" at the company I used to work for. We were putting defense systems in military crafts, and one of the requirements was that the pilot needed to have a button to wipe all the data in the system, to prevent classified data from falling in to the enemy's hands. (Yes, that information is public.)

The Department of Defense has pretty high standards for data wiping, and there are a number of tools that meet their standards. The problem is most of these tools cost money. The one that I recommend is a free tool called Darik's Boot and Nuke (available for download at www.dban.org). Despite the informal name, it is a legitimate program (referenced by CNN and the BBC). There are commercial tools that do this sort of thing as well, but the major difference is not function, it is speed (DBAN has a reputation for being slow - the BBC article says it took two hours for an 80GB drive). DBAN is cool because it gives you a CD to boot off of, and you select the depth of the wipe you want. The more depth you want, the longer it will take to run. If you are going to do this, I would recommend choosing the most in-depth wipe, doing it before you go to bed (as a home user) or before you leave work in the evening (at work), and just letting it run overnight. That way, there is no time wasted waiting for wipe to be completed. In a professional environment, having a DBAN CD around is not a bad thing, especially so your company does not end up in violation with the standards that govern your industry (Sarbanes-Oxley, HIPAA, FACTA, etc.).

A larger company may want to invest in faster, packaged software for this, or a hard drive sanitizer (such as this one - though I am certain their claim of 7 minutes per drive is for the simple wipe and not the seven-pass version).

Any of these options are better than the ol' sledgehammer method, because who wants to clean up that mess?

Time Machine: Everything Old is New Again

Some topics of interest from this week's classes.

We discussed the Do Not Call Registry, which was a way to prevent telemarketers from calling you. Someday, we may see a Do Not Email Registry, but I wouldn't expect that for a while. I remember telemarketing being annoying in the 80's, and it took them until 2003 to do anything about it. Here's my original post about how to get on the registry and save yourself from telemarketers.

Second of all, passwords came up in one class this week. Microsoft has a free password strength checker on their Web site, where you can see how strong or weak your password is. Here's the link. We also discussed passwords, and how you can make a better password. I discussed the mnemonic device method for creating and remembering a password in class, and here is my original post on that.

Of course, for people majoring in the IT area, it's always a struggle to find a balance between security and ease of use. If you require difficult passwords, your users may end up writing them on a sticky note, or putting them in a passwords document.

Using Google Earth to make $75,000

Just another case of learning from my students...

In class today, we were discussing Google services, including the advanced Google search options, image search, and Google Maps. It came out during class that the town of Riverhead, NY used Google Earth in a very interesting way. People started getting summonses for having illegal pools, and it came out that they were using Google Earth to find this out. Really! Turns out they wrote about $75,000 worth of summonses before people caught on and complained.

NPR did an interview with the chief building inspector of the town, and he said they did it for the protection of the neighborhoods, saying "I use it strictly for safety." Of course, there is some validity there, because as he states, there are requirements to make sure children don't drown, and I agree with that. I also think that, well $75,000 had something to do with it. I'm a little cynical when someone won't admit to that. Of course money making is part of it. It's not just about safety.

In the "DUH" statement of the year, he stated "Most of the people that complained were the ones that didn't have the permits." Of course those are the people that complained, because they were the ones who were directly affected and may or may not have had their right to privacy violated.

The town is no longer doing this, so I think that tells us how they feel about whether it was a good decision. If they thought it was, they would have kept on doing it. My opinion? As someone who worked for a company doing government contracting, we were told that the government could not spy on its own citizens. The government tried to implement domestic spy-satellite imaging through the innocuous-sounding National Applications Office, but this idea was withdrawn over privacy concerns. If the government can't do it using our own satellites, why can they do it using Google's? Again, my opinion, they shouldn't be doing that, but that's me.

The other interesting part is Google. This sort of use of Google Earth is not prohibited, either in the main terms of service or the government agency terms of service addendum. Yes, I checked. In theory, this is fine per Google's viewpoint. Then again, they haven't updated the terms of service in a while.

Zero-Day exploits

I have pretty tight security on my home system. I have my anti-virus, my anti-spyware, and router with built in firewall. I keep my operating system and anti-virus up-to-date. I feel pretty safe on a day-to-day basis. I sometimes forget that this is not true. We are all vulnerable to "zero-day exploits". These are basically newly discovered ways for you to get a virus (or get hacked, etc) even if your virus scanner and operating system are 100% up-to-date. This is the part of computer security that people don't always understand. Anti-virus programs, anti-spyware programs, the operating system, and things like that all get updated AFTER problems happen, so someone needs to be the first group of people to get this virus. Unfortunately, fixes are often reactive (oh, no, we didn't think of that!) rather than proactive (hmm, how would I exploit this system if I were a hacker?).

Yesterday, Adobe (the company that makes Acrobat and Flash, among other tools) released a statement saying there was a vulnerability in even the latest version of Adobe Reader. This is a free tool most people have installed that reads read-only versions of documents. Sounds pretty innocuous, right? Well, there is an exploit that allows this to beat security. If I were to download a file, my firewall, anti-virus, anti-spyware, and operating system would all be beaten by this exploit.

What helps is avoiding high-risk activities online. File sharing networks and torrents obviously present advantages in the form of free stuff, but even if you have all the protection I mentioned before, you are subject to zero-day exploits. This one is an exploit with Adobe Reader, but it could happen in iTunes, or in Windows Media Player, or Internet Explorer, or Firefox, or any other software package. It can also happen when people download software through these networks and actually run a program on their machine. Just remember that despite the updated anti-virus, you are vulnerable. This doesn't even take in to account the folks who have anti-virus software that they don't subscribe to and don't receive updates to.

(For those of you who understand digital signatures, this is a very clever exploit that seems to take advantage of stolen certificates. Who knows, maybe the hackers used a zero-day exploit to steal the certificates!)

The Weakest Link: Password Reminders

Security vs. Ease of Use...always is a tradeoff.

I always use an example of a car security system in class. If I could GUARANTEE that no one could steal your car, and it wouldn't be expensive to install, you'd probably go for it, right?

What if I then told you it would take 90 minutes to get in to the car? At that point, the security isn't worth it.

Generally, when you sign up for accounts, you are given very few choices for password hints. For example, what is your mother's maiden name? Or, where were you born?

The problem is that some of these things can be found out from social networking sites or even from personal knowledge. For example, if you friend your mother, everyone who is a friend of yours now knows the answer to that security question, especially if you use the Facebook "related to" option to show she is your mother. Where were you born can be guessed many times as well, even without Facebook. Where I went to high school, I would guess that most of the students were born in the same hospital. In more rural areas, that isn't as tough of a question as you might think. A good private investigator might chat you up in a bar to find out the answer to the question "what was the name of your first pet", if the answer to that question is valuable enough. In divorce cases, this sort of information can be a gold mine. If you are going through a divorce, remember that things like birthdays and anniversaries are things your future ex may know, and they can circumvent your password that way. Even things like "what is your blood type" aren't great, because how many possible choices are there? (A, B, AB, and O, I think). Even questions like "who is your favorite actor/actress" is tough, because answers change.

On the other hand, no one wants the question to be "pick your favorite number between 122 and 488".

Some sites will let you create your own questions, which present their own problems. People may tend to make even easier questions ("what is your middle name"), or really poor questions ("what color shirt are you wearing"). Yes, I've seen questions like this when helping people.

One of the better questions I have seen is "what is your father's middle name". I couldn't tell you the middle name of my friend's fathers, so this would require a little more work. Other good questions might be "what was the first bone you ever broke" - certainly something you would remember, but still vague.

Another clever idea that hasn't taken off is "Passfaces", where people use visual reminders as a password. Clever idea either as a replacement for a password or as something to augment password reminder security, but not mainsteam yet.

The best defense is to pair sets of questions together, asking people to answer multiple questions to get access. Another way would be to give people a checklist, for example, ask "which of the following statements are true about you", give a list of 15 things, and have the person check off which they have done. For example, give statements like:
I have shoplifted something worth more than $10.
I have been to Cincinnati.
My first car was white, yellow, brown, or green.

Have the person check off yes or no for each, and they are only granted access if all 15 questions are correct. Even if someone tries to guess their way through that, that is hundreds of possible responses. The problem here is that the best questions are the deeply personal ones that no one else knows the answer to. These are also the questions people might be shy about answering honestly. For example, the "shoplifted" question is good, but would I really check off "Yes" if this were a password reminder for a company I work for?

Or, you can do what I do, and give fake answers to the questions in a way that you will still remember it. Or, just use your mother's maiden name everywhere and wonder how all your accounts got hacked on the same day.

Hacking Facial Recognition Software

One thing that I see often in TV is facial recognition software.  For example, in the current season of "24", Chloe O'Brien is able to very easily figure out who someone in based on the digital image of their face.  The way these software programs work is similar (though not as advanced as in "24").  They take a facial image and scan it to determine what the features of the person are, and then compare that to a database of people's characteristics.

Of course, the easy way to beat this would be to wear a ski mask or something, but it would be way too obvious if you were walking around in public with one on.  I often wondered if some sort of plastic surgery would make you harder or impossible to detect, and that certainly is an option.

However, a computer programmer was able to reverse engineer this software to find ways to beat it, in theory by using makeup patterns.  He had three sets of images.  The first set were basic images with no makeup, the second set was images with random patterns, and the third set were images that exploited what he considered potential weaknesses in the facial recognition software.  His conclusions?  The patterns he created all fooled the system, while the random patterns and the blank patterns did not fool the system.

His conclusion?  The images represent potential anti-surveillance makeup.

Now, if someone was walking around with the makeup you see in the images, it might look weird still...but the potential is there.  If someone can wear a weird makeup pattern and throw off these systems - well, these systems need to be more mature and figure these things out.  I am sure the companies will say "well, no one is going to walk around with that makeup" publicly, while privately scrambling to find a fix.

Needless to say, if a graduate student came up with an idea like this...imagine what terrorists who do not want to be found will come up with.


http://ahprojects.com/c/itp/thesis

When Good People Get Taken Advantage of...

There are a lot of opportunists in this world, and that is a sad thing to see.

For example, take the recent tragedy in Haiti.  The Red Cross and other humanitarian efforts have been taking legitimate donations, and I think that is awesome.  In an excellent use of technology, the Red Cross is using a new service called "Text 2Help" - this service allows you to send a text message to a special number and donate $10 (this will appear as a charge on your cell phone bill).  This is the first major catastrophe that I can remember seeing this used, and it's apparently worked.  This text donation plan has raised over $21 million dollars, according to CNN. 

However, as I said before, the opportunism is shocking.  Thomson Reuters reports that there are a number of reports of people taking advantage of this situation.  For example, people are using the same spam mailing lists that they use to try to sell you Viagra and say your bank accounts have been hacked to send out emailing claiming to be important people in Haiti who need YOUR help moving money...or advertising false charities and taking donations on behalf of the victims of the earthquakes...or setting up Web sites inviting people to enter their email address for more information on how to help...it's just a little disheartening.  It's not like this didn't happen before computers; people would call up and do this over the phone years ago and use it as a pretense to get people to give out credit card information.

It always seems so sad that people resort to things like that.

Security Sense Summer 2009

My colleague David Csuha has posted his latest "Security Sense" newsletter. His newsletter promotes some good security habits, among other things.

I particularly love the section this month about peer to peer file sharing (Limewire, etc) put people's security at risk. This doesn't require any hacking skills. ANYONE with Limewire can do this. David shows a few things, including a bank vice president who is sharing her personal photos and credit reports, and a model sharing her resume and some, er, risque pictures.

He also discusses how Twitter is being used by places such as the New Jersey State Police to disseminate information in ways that Web sites or emails don't accomplish.

Read more...Summer 2009 Security Sense

Old Data Never Dies

In 1997, I was working for a department at Montclair State University. The woman in charge had a lot of large files, and a need to be portable, so she used Zip disks (this is before the days of USB flash drives). At one point, one disk stopped working, and she hadn't backed it up, and was very upset that her data was gone forever.

Except that it wasn't. Many people don't realize that just because you delete something doesn't mean it is gone forever. The malfunctioning disk was sent to data recovery specialists, who recovered about 99% of what was originally on the disk. I looked like a genius for knowing that this type of company existed.

Whether a disk fails, things CAN be recovered. The key is, how important is the data? There is usually a price associated with this.

Another thing - if you delete something from your hard drive, it's not gone. Going back to the Microsoft DOS days, there used to be ways to undelete files. When you delete a file, it's not shredded; the hard drive simply says "oh, okay, I can use that space to save stuff now" - which means the original file is still there, just not being recognized by your operating system.

The next step up is computer forensics. There are more advanced ways to pull information off of a hard drive, which means that if you plan on being investigated by the FBI, deleting is NOT enough.

Anyway, some students in our Cyber Security and Computer Forensics certificate decided to put the skills learned in to use and open up a data recovery consulting firm called Old Data Never Dies. I've had most of the students in at least one class, and it's great to see the growth they've all undergone since the "Introduction to Windows" class days to the point where they are now.

The company's Web site can be found below.
www.olddataneverdies.com

Stalking tips and tricks

One of the things I bring out from time to time is how easy it is for companies to find information about you given your email address.

For example, if you have an uncommon email address, people can Google that. (That's easy).

Another, more advanced way is to use Facebook or Myspace. You can put in an email address, and it's easy to find people.

Okay, so many people are smart enough to hide themselves. However, there is always a more advanced way to find people. One of those ways is Pipl.com. I find that people use the same username everywhere. So, for example, if your email address is abc123@yahoo.com, you are likely to use abc123 as your username everywhere.

You can take that username and put it in to pipl.com and it searches all over the Web for that username. Let's say you have a blog on xanga.com...or an account on flickr...this site will find all sorts of accounts associated with that username.

Be it a potential employer...or a private investigator...a lot of this information can be found for free, if you know where to look.

http://pipl.com/username/

Microsoft Morro

Coming later this year, Microsoft plans to release their own security suite, currently called "Morro". They claim that they won't compete with McAfee and Symantec, but we'll see what happens. When Microsoft says "second half of 2009" - I assume "December" and not "July".

In my CIS 152 course I've had students do a paper discussing who is responsible for protecting consumers on the Internet - is it the operating system manufacturer, the PC manufacturer, the Internet service provider, or the consumer?

I didn't really trust Microsoft to do the right thing here - I was wondering if it was going to be available for Vista only to drive people away from Windows XP - but they're doing the right thing and making it available for XP and Vista (as well as "7"). I also have my suspicions that this is vaporware, but that's just me not trusting Microsoft.

If this happens and it is done right, it could be one of the most important things to happen in computer security in a long time - instead of requiring people to do work, you integrate it in to the operating system and make it passive. Will it be something hackers try to exploit? Of course, because it will be the security suite for "noobs". However, it would be better to have a locked door rather than an unlocked one, even if the lock is easy to pick.

http://www.microsoft.com/presspass/press/2008/nov08/11-18NoCostSecurityPR.mspx

Just because security is an illusion doesn't mean you can't be safer

I had a discussion with my CIS 101 course yesterday regarding protecting their computers. Even though security is an illusion, it doesn't mean you can't protect yourself somewhat. Basically, your goal is not to be airtight and perfect - if someone is motivated enough to hack YOU, they probably will be able to. However, if they are just looking to hack SOMEONE, you want to present enough challenge that they move on to someone else.

One of the problems is that the Windows operating system includes no virus protection and only the latest versions came with a firewall (which is rather basic). Another problem is that many computers may come with anti-virus software installed, but only for a trial period. The problem is that you are protected against any viruses that were released up to your last patch date, but that is all. Any new viruses can slip through and infect you.

There are ways that you can upgrade this protection for free.

First of all, many of our local students don't realize that if they have Optimum or Comcast, they are entitled to free security software. Both of the high speed Internet service providers give out security suites. Optimum gives you CA's Internet Security Suite for free, while Comcast gives you the free McAfee suite.

For anti-virus software, there is a free tool called AVG anti-virus that I always recommend to students. You can get the AVG Anti-Virus Free Edition on their Web site:
free.avg.com

In terms of a firewall, you can always upgrade from the Microsoft one. I used a free version of the ZoneAlarm software package for many years, until I got the free McAfee suite. You can download this from the following site:
zonealarm.com

Are any of these programs 100% foolproof? No. However, if you have nothing, this will make you a harder target, and really, that's all you can ask for. Remember, in a herd of animals, the predators go after the easiest targets. Don't be that easy target.

US Power Grid hacked

Apparently, China and Russia "cyberspies" have both hacked in to the US electrical grid. This does not shock me. It also may be possible that programs have been left behind that, in the event of war, could be activated and used to shut down power in the country. If this sounds a lot like "Live Free or Die Hard"...well, yeah.

Yet another example of how security is a mirage.

http://online.wsj.com/article/SB123914805204099085.html