News

Passwords

Computer Culture Admin - Thursday, September 28, 2017
Hacked The man who wrote the book on password management has a confession to make: He blew it.

14 years ago Bill Burr advised creating complex and different passwords, now he says N3v$r M1^d!

Back in 2003, as a midlevel manager at the National Institute of Standards and Technology, Bill Burr was the author of “NIST Special Publication 800-63. Appendix A.” The 8-page primer advised people to protect their accounts by inventing awkward new words rife with obscure characters, capital letters and numbers—and to change them regularly.

Now he says the vast majority of the trusted tips and tricks we employ when crafting a custom password actually make us more vulnerable to hackers. In an interview with The Wall Street Bill Burr admitted that the document he authored on crafting strong passwords was misguided. “Much of what I did I now regret,” says Burr, who is 72 years old and now retired.

The problem wasn’t that Burr was advising people to make passwords that are inherently easy to crack, but that his advice steered everyday computer users toward lazy mistakes and easy-to-predict practices. Burr’s eight-page password document, titled “NIST Special Publication 800-63. Appendix A,” advised people to use irregular capitalization, special characters, and at least one numeral. That might result in a password like “P@ssW0rd123!” While that may make it seem secure on the surface (neglecting, of course, that “password” is a bad password), the issue is that most people tend to use the same exact techniques when crafting these digital combo locks. That results in strings of characters and numbers that hackers could easily predict and algorithms that specifically target those weaknesses.

Even worse, Burr suggested people should change passwords regularly, at least every 90 days. This advice, which was then adopted by academic institutions, government bodies, and large corporations, pushed users to make easy-to-crack passwords. Most people can probably point to a password they’ve created that was deemed strong simply because it had a special character like the “!” or “?” symbol and a numeric string like “123.” And when prompted to change a password, who hasn’t altered it only slightly to avoid the hassle of coming up with an all-new code?

A popular xkcd comic from cartoonist Randall Munroe, published back in August 2011, poked a hole in this common logic by pointing out how the password “Tr0ub4dor&3” could be cracked in about three days with standard techniques, due to its predictable capitalization, numeric substitutions, and special character use. The password “correct horse battery staple,” written as a single phrase, would take 550 years. (Security experts have confirmed Munroe’s math, according to the WSJ.) “Through 20 years of effort, we have correctly trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess,” Munroe wrote at the bottom.

In other words, the passwords you should be using are obscure, almost unexplainable phrases full of human randomness that make them easy to commit to memory and yet almost impossible for an automated system to make sense of. Of course, for those who use password managers like LastPass, you can generate cryptographically secure passwords on the fly. But it’s still important to have a hard-to-crack master password.

“In the end, it was probably too complicated for a lot of folks to understand very well, and the truth is, it was barking up the wrong tree,” Burr admits of his advice. The new NIST standards that were published in June, authored by technical advisor Paul Grassi, did away with much of Burr’s advice."

We ended up starting from scratch,” Grassi tells the WSJ. But Burr might be exaggerating the negative effects of his password advice, Grassi adds: “He wrote a security document that held up for 10 to 15 years. I only hope to be able to have a document hold up that long.” For the complete article click here
Trackbacks (0) | Permalink

System Security Buzz Words Made Easy

Computer Culture Admin - Thursday, September 28, 2017
HP Phishing
the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.

Ransomware
a type of malicious software designed to block access to a computer system until a sum of money is paid.

Malware
Short for malicious software, is an umbrella term used to refer to a variety of forms of hostile or intrusive software, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other software. Malware is defined by its malicious intent, acting against the requirements of the computer user - and so does not include software that causes unintentional harm due to some deficiency.

Programs supplied officially by companies can be considered malware if they secretly act against the interests of the computer user. An example is the Sony rootkit, a Trojan horse embedded into CDs sold by Sony, which silently installed and concealed itself on purchasers' computers with the intention of preventing illicit copying; it also reported on users' listening habits, and unintentionally created vulnerabilities that were exploited by unrelated malware.

Software such as anti-virus and firewalls are used to protect against activity identified as malicious, and to recover from attacks

Viruses
A computer program usually hidden within another seemingly innocuous program that produces copies of itself and inserts them into other programs or files, and that usually performs a malicious action (such as destroying data).

Trojan horses
A Trojan horse is a malicious computer program which misrepresents itself to appear useful, routine, or interesting in order to persuade a victim to install it. The term is derived from the Ancient Greek story of the Trojan horse used to invade the city of Troy by stealth. Trojan horses are generally spread by some form of social engineering, for example where a user is duped into executing an e-mail attachment disguised to be unsuspicious, (e.g., a routine form to be filled in), or by drive-by download. Although their payload can be anything, many modern forms act as a backdoor, contacting a controller which can then have unauthorized access to the affected computer. While Trojan horses and backdoors are not easily detectable by themselves, computers may appear to run slower due to heavy processor or network usage. Unlike computer viruses and worms, Trojan horses generally do not attempt to inject themselves into other files or otherwise propagate themselves.

Rootkit
Once a malicious program is installed on a system, it is essential that it stays concealed, to avoid detection. Software packages known as rootkits allow this concealment, by modifying the host's operating system so that the malware is hidden from the user. Rootkits can prevent a malicious process from being visible in the system's list of processes, or keep its files from being read. Some malicious programs contain routines to defend against removal, not merely to hide themselves. An early example of this behaviour is recorded in the Jargon File tale of a pair of programs infesting a Xerox CP-V time sharing system: Each ghost-job would detect the fact that the other had been killed, and would start a new copy of the recently stopped program within a few milliseconds. The only way to kill both ghosts was to kill them simultaneously (very difficult) or to deliberately crash the system.

Backdoor (computing)
A backdoor is a method of bypassing normal authentication procedures, usually over a connection to a network such as the Internet. Once a system has been compromised, one or more backdoors may be installed in order to allow access in the future, invisibly to the user. The idea has often been suggested that computer manufacturers preinstall backdoors on their systems to provide technical support for customers, but this has never been reliably verified. It was reported in 2014 that US government agencies had been diverting computers purchased by those considered "targets" to secret workshops where software or hardware permitting remote access by the agency was installed, considered to be among the most productive operations to obtain access to networks around the world. Backdoors may be installed by Trojan horses, worms, implants, or other methods.

Evasion
Since the beginning of 2015, a sizable portion of malware utilizes a combination of many techniques designed to avoid detection and analysis. The most common evasion technique is when the malware evades analysis and detection by fingerprinting the environment when executed.  The second most common evasion technique is confusing automated tools' detection methods. This allows malware to avoid detection by technologies such as signature-based antivirus software by changing the server used by the malware. The third most common evasion technique is timing-based evasion. This is when malware runs at certain times or following certain actions taken by the user, so it executes during certain vulnerable periods, such as during the boot process, while remaining dormant the rest of the time. The fourth most common evasion technique is done by obfuscating internal data so that automated tools do not detect the malware. An increasingly common technique is adware that uses stolen certificates to disable anti-malware and virus protection; technical remedies are available to deal with the adware.  Nowadays, one of the most sophisticated and stealthy ways of evasion is to use information hiding techniques, namely stegomalware.
Trackbacks (0) | Permalink

Billions of devices at risk as Bluetooth-bourne vulnerability exposed

Computer Culture Admin - Thursday, September 28, 2017
HP
A Bluetooth vulnerability dubbed BlueBorne, discovered in April 2017, has been made public after companies including Google and Microsoft issued updates.

US-headquartered security company, Armis Lab, revealed the vulnerability on 12 September 2017.

BlueBorne is an attack vector through which hackers can potentially use Bluetooth connections to access devices including computers, mobile phones and IoT devices.

Such an attack would not require the targeted device to be paired to the attacker’s device, or even to be set on discoverable mode. Armis Labs has identified eight zero-day vulnerabilities so far, which indicate the existence and potential of the attack vector. 

Armis Labs estimates that more than 8 billion devices could be at risk. The vulnerabilities affect all devices running on Android, Linux, Windows and pre-version 10 of iOS operating systems, regardless of the Bluetooth version in use.

All iPhone, iPad and iPod touch devices with iOS 9.3.5 and lower, and AppleTV devices with version 7.2.2 and lower are affected by the remote code execution vulnerability. 
BlueBorne’s difference to other types of attack vectors is the fact that it spreads through the air, which according to Armis, allows it to spread with minimum effort.

The other major concern is that traditional security measures do not protect from this type of threat. Also, no action from a user is necessary to trigger the attack.

On 19 April, Armis Labs contacted Google and Microsoft about the vulnerability. Google released a public security update and security bulletin on 4 September.

Microsoft had already issued updates on 11 July.

Apple was contacted in August but it had no vulnerability in its current versions. Samsung was contacted on three separate occasions and did not respond to the security company.

Linux was also contacted in August, information was provided to the Linux kernel security team and to the Linux distributions security contact list.

For the original article click here.
Trackbacks (0) | Permalink

Identifying Phishing Emails

Computer Culture Admin - Thursday, September 28, 2017
With the increasing use of phishing emails, we’d like to draw your attention to how to identify whether the email links you are being asked to click are legitimate. This is done by hovering your cursor / pointer over the link and revealing the domain or destination to where you will be sent. If you look at the final part of the domain before the forward slash (/) you can determine whether you think this link is from the organization referred to in the email. In the example below .cenotehopping makes little sense and indicates the link is not authentic. 

If there is a string of cryptic numbers or an .exe file do not click on the link. Ring the organisation who has sent you the email and verify that the email is legitimate.  As always it is better to be cautious than caught out.

Microsoft offers this information on recognising phishing email messages, links, or phone calls.
Trackbacks (0) | Permalink

Bit Defender has been selected as Editor’s Choice by PC Magazine

Computer Culture Admin - Thursday, September 28, 2017
HPPCMAG.COM Neil J. Rubenking - EDITORS CHOICE

Pros
Excellent scores in antivirus lab tests and our own tests. Autopilot mode for no-hassle protection. Best antiphishing score. New ransomware protection. Enhanced password manager. Secure browser. Vulnerability scan.

Cons
Password manager's form-fill ability proved inaccurate in testing.

Bottom Line
Editors' Choice winner Bitdefender Antivirus Plus earns top scores in lab tests and our own tests, and also packs in a wealth of useful bonus features.

The line dividing a simple antivirus utility from a full security suite isn't always clear. Take Bitdefender Antivirus Plus, for example. In addition to every feature you'd expect in an antivirus, it includes a password manager, a hardened browser, a secure deletion utility, a scan for system vulnerabilities, protection against ransomware attacks, and more. However, it doesn't offer a firewall, spam filtering, or parental control, among other features you get with Bitdefender's actual suite products. It's an antivirus, with benefits, and it remains an excellent choice if you're seeking malware protection.

Installation and Appearance
As with many modern security utilities, installation of Bitdefender involves going through your online account. Log into Bitdefender Central, enter your product key, and download protection. During the installation process, it runs a quick scan for active malware.
The product's appearance hasn't changed much since the previous edition, still featuring mostly white text against a dark gray background. A left-rail menu offers access to features: Protection, Privacy, Tools, Activity, Notifications, Account, Settings, and Support. The status panel displays a red warning if your configuration settings put the system at risk. Putting the system back in Autopilot mode should solve such problems, and if you leave Autopilot on, you should always see Protected in green as your status. Autopilot has been a Bitdefender staple for quite a few years now. In this mode, the antivirus takes care of business with an absolute minimum of fuss. It quietly wipes out any malware it finds. It updates itself as needed. If it really wants to communicate with you, it displays a number on the Notifications icon.

Bitdefender Antivirus Plus Main Window
From the Protection and Privacy tabs, you can click to view feature details. Here, you'll begin to realize how this feature-rich antivirus differs from Bitdefender's security suite products. On the Protection Features page, you see that firewall and antispam protection require an upgrade. Under Privacy Features, file encryption, webcam protection, and parental advisor all require an upgrade. The Tools page, furthermore, is filled entirely with features that are only present in Bitdefender's top-of-the-line suite.

Fantastic Lab Scores
Each of the independent antivirus testing labs takes its own approach to testing and scoring antivirus products. The more labs that include a product in testing, the more complete a picture I can get by looking at all their results. I follow five labs, and all five of them include Bitdefender. That's an honor not accorded to many. Of the companies I track, the only others covered by all five labs are Avast, AVG, ESET, and Kaspersky Anti-Virus.

SE Labs attempts to emulate real-world situations as closely as possible in testing, by capturing real malicious websites and using a playback system to hit each product with the exact same attack. This lab offers certification at five levels: AAA, AA, A, B, and C. Bitdefender took the top certification, AAA, along with quite a few others.

Out of the many tests regularly performed by AV-Comparatives, I track results of four. This lab certifies a product at the Standard level provided that it achieves a passing grade. Those that do better, or much better, than the minimum can earn certification at the Advanced or Advanced+ level. Out of four tests, Bitdefender earned four Advanced+ ratings.

Most of the tests that I follow return a numeric result or a rating level. Tests by MRG-Effitas don't do that. A product either turns in a near-perfect performance or it fails, and many do fail. Bitdefender passed this lab's banking malware test. In the general malware test it received Level 2 certification, which means that while it did not completely prevent every malware attack, it did remediate all attacks within 24 hours.

For the full article click here.
Trackbacks (0) | Permalink

1

Back to Top