Hacked Every 39 Seconds

March 21, 2007

No updates for the past while because I’ve been up to my tonsils with work. Not that I’m complaining. One of the “joys” of having your own business is the fact that you never know what’s round the corner. My business is just over three years old now, and a lot of that 3 years was spent cold-calling prospective clients, which was neither pleasant nor productive for me. Since Christmas I have done no cold-calls, and customers are beating a path to my door. I’m not sure why this is the case but I watched “The Secret” a while back and read “The Science of Getting Rich” so I’m putting it down to that.

Anyhow, I did get time last week to browse through PC Live, (Great value for just €3), and came across this article. According to a University of Maryland study, a PC connected to the internet will on average be attacked every 39 seconds.

The study also profiled brute force attacks and found the most common methods of guessing passwords. The most common was to re-enter the username or a variation of it, (eg user: admin, pwd: admin123). Other common password guesses were ‘password’, ‘passwd’, ‘test’, ‘123’, 1234′, ‘12345’, ‘123456’ and ‘1’.

Nothing too surpirsing I suppose in the guesses, but the frequency of the attacks was interesting. It also proves again the need for effective passwords, and we’ve discussed before. Make it long, mix letters, numbers and special characters, and change it on a regular basis.


WordPress Hacked

March 8, 2007

Having a WordPress-based blog about computer security, it would be a bit of an oversight if I didn’t mention the recent problems encountered by my gracious hosts.

Last week the server hosting the WordPress 2.1.1 download was hacked, and the code was modified to include code for remote PHP execution. According to Matt Mullenweg it appears that only two files were changed and measures have been implemented to try to prevent a recurrance. Any users of 2.1.1 should immediately upgrade to WordPress 2.1.2.

This is obviously a serious issue for WordPress, but in fairness they appear to have responded in the right way, publicising the attack and doing everything possible to make sure it doesn’t happen again. http://wordpress.org/development/2007/03/upgrade-212/

The point of this blog is that everyone can do all the simple things to protect themselves from the casual attack. This type of attack however sounds like Wordpress was a  very specific target, which makes it much more difficult to defend yourself against.

I’m sure WordPress had already invested heavily in their security infrastructure, (Firewalls, Intrusion Detection etc), so now they’re going to have to go back and look at that investment and see where it failed them. Do they need to spend more on technology to prevent a recurrance, (not necessarily always the answer), or is it a matter of ensuring more effective processes are in place.

According to Matt’s blog, a number of measures have already been implemented to stop the same thing happenning again. Time will tell if they’ve done enough.


Julie Amero Update – Porn Queen or Spyware Victim???

March 5, 2007

There don’t seem to be too many people left who actually believe that Julie Amero was deliberately attempting to expose children to pornographic images. (The notable exceptions to that appear to be the prosecutor in Connecticut). I wrote about this case in more detail here.

Last week the Judge Hillary Strickbein postponed sentencing until March 29th at the request of the defence team. Apparently the postponement had been requested in order to give a new attorney and consultant time to familiarize themselves with the case.

With most of the supposedly “expert” technical evidence apparently having been discredited, Assistant State’s Attorney David Smith claims that Ms Amero did not do enough to protect the children from exposure to pornography, (eg shutting down the computer).  The substitute teacher had already informed colleagues that there was a problem with pop-ups on the PC, and had been told to ignore them. She was also under instruction NOT to turn off the PC.

I wonder if Mr Smith will use the same logic to pursue the individuals responsible for ensuring the school had proper technology in place to protect them from spyware. And whoever was responsible for ensuring teachers had full training on the PC’s. And whoever allowed the PC’s to be implemented without effective password controls. And whoever wrote and circulated the spyware that infected the PC in the first place.

Based on what I’ve read of the case to date, Julie Amero should be way down the list of people culpable for this. If Assistant State’s Attorney David Smith was hoping to make a name for himself out of this case, then he has certainly succeeded. Sadly though it looks as though justice, (and Julie Amero) were poorly served in the process.


Reads this if you use online banking

February 27, 2007

Ever heard of phishing? It’s the process whereby someone tries to lure you into divulging personal details, (username, password, account details etc), usually by sending you a mail that appears to come from your bank explaining that their servers are to be upgraded, and asking you to follow the link and re-enter all your details.

Well, last week a major pharming attack hit users of 65 banks in the US, Europe and Australia. Pharming is kind of a step up from phishing, because you don’t need to click on a link in an email. Basically what it does is recognise when you wype in the url for your banks site, and redirect those requests a duplicate site. In last weeks case, all the information keyed in by users was subsequently forwarded to the banks in question, which of course makes the problem harder to detect. But by the time the banks received the information entered it had already been captured by the guys behind the scam.

According to Yahoo news, target institutions included Bank of Scotland, Barclays Bank, eBay, Paypal, Discover Card & American Express.

The whole thing seems to have been launched through a trojan known as Burglar.A, which in turn downloaded a number of other Trojans. Keylog.LN, which captures keystrokes and looks for user login details, Banker.CLJ which carries out the pharming scam, FileStealer, which installs a web-server on the PC giving the authors remote control of the server, and Sters.P, designed to prevent users and programs from contacting their websites for security updates.

So overall this was a really nasty little piece of code. The Internet is a fabulous place, but to quote Hill Street Blues….Let’s be careful out there!


Why Nasty Hackers Target Nice PC Users!!!

February 26, 2007

Last week I was explaining to a client about how hackers operate, and they simply didn’t believe that anyone would want to hack into their systems. After all, they’re a micro-business operating in the south-east of Ireland. In global terms they are a complete non-entity.

One of the great things about the internet is that you don’t have to be a multi-national corporation to have a multi-national presence. A single PC in the kitchen can provide services to companies all over the world. And that’s what makes every PC a target for hackers. The Washinton Post reported on this last week:

“Last month, a number of anti-spam Web sites came under a sustained distributed denial of service (DDoS) attack, an electronic assault during which the attackers use thousands of compromised personal computers to overwhelm a target with so much bogus traffic that the PCs can’t accommodate legitimate visitors.

The attacks were made possible by tens of thousands – perhaps millions – of computers infected by the recent e-mail virus known as the Storm worm.”

This is just one example but it explains how important it is for every PC to be properly protected. The Storm worm is now particularly ingenious in the way it works. It hit the internet at a time when they’re were particularly bad storms raging across Europe, which helped it spread, but it can be blocked by most commercial security products.

The problem here is that people will go out and spend €1000 on a PC, and then be reluctant to spend €30 or €40 on a decent internet security product. Even the free products like avast and avg provide good levels of protection. I don’t believe that people are that stingy, so surely the problem is a lack of awareness.


How To Battle Spam

February 9, 2007

I just checked my spam filtering service, and according to their website, 70% of emails passing through their scanners is identified as spam, with a further 3% flagged as viruses. MessageLabs, a leading player in this field has the number slightly lower at around 55% & 0.5% respectively.

Other industry sources, (probably with a vested interest), often report spam figures up around 90%, but even at the most conservative, it’s reasonable to say that at least 1 in every 2 emails sent is spam.

For some people, (the lucky few), this never becomes a problem, but for the rest of us it can be a real pain. So what can you do about it. Well, the easist way to combat spam is to avoid it in the first place. You can do this by being careful with your email address. Don’t put it on forms, (written or online), don’t share on the internet, don;t give it to people unless you know them very well, etc.

Great advice but not always practical. So what else can you do? Here’s 4 simple steps that can help reduce the problem.

1. Do NOT un-subscribe from an email you receive. It just lets the spammer know you exist so you will be inundated with mails

2. If you do have to fill in your email address online, check out the privacy statement on the website.

3. Read the small print before you tick (or leave blank) the box. Some of these forms are very sneaky. Like when they have two paragraphs with tick boxes. Paragraph 1 says ticking the box means you agree to receive mails etc, and paragraqph 2 says ticking the box means I do not want to receive mails. Unless you take the time to read properly you will be added to the list.

4. Implement a spam filter. It can be either a local one, (on your PC or server), or an external one, catching mails before they hit your network, or both. There are pros and cons to both options but at least use something. You will need to monitor it, particularly in the early days, but once it’s been running for a while the amount of monitoring required decreases.

Spam is becoming more and more of an issue for computer users, but there are answers out there. Don’t sit and moan, do something about it.


Impact of Cybercrime on business

February 1, 2007

Results have just been published of a survey of businesses in Ireland, asking about internet crime. I haven’t seen the results first hand, (they’re only being fully released tomorrow), but according to the media reports they show some interesting results…

98% said they had been the victim of some form of Internet fraud
20% said this had cost them more than €100,000
40% say that employees have experienced harassment of some form on-line.
90% have been affected by viruses
66% have had hardware or software stolen.
40% of the companies have either fired an employee or had one resign following an incident of cybercrime.
25% of the companies have contacted the police, with half of those cases resulted in a prosecution being brought.
50% of companies reported that employees had been the victimes of phising attacks.

I would have thought more that half would have experienced phishing attacks, but then maybe the other 50% just didn’t report or recognise them. And interesting that only 25% have contacted the police about these crimes. 

For many businesses, (particularly SME’s), there’s still a huge gaping hole in their understanding of comptuer security, and the impact it can have on their bottom line. I think many business owners still adopt the ostrich approach, “If I keep the head down and ignore the problem it will go away”.

Well, guess what guys. It ain’t going nowhere. If you want to learn more about securing your business check out http://www.secureyourbusinessnow.com/