Tuesday, March 06, 2007

Running UAC and some other tricks to keep your computer running smoothly

Some of these may be obvious but much of the time are overlooked.



Most users that I know run Microsoft products. A few of you may benefit from some basic tips to keep your computer out of BestBuy or your local computer vendor for repairs. The first and probably most important is also the most difficult to get people to abide by. Use UAC (user access controls). By default Windows XP uses the administrator account which is convenient when an operating system is first loaded but most users load all of their programs on a PC in just a short time. After you get everything installed run as a 'user' account and not an administrative context. This will prevent most spy ware and viruses from trashing your system. Even if you accidentally download some malware it will most likely at the worst trash the user profile but not the system which is a pretty easy fix.



Vista by default has UAC turned on. This is annoying at first but is a positive action by Microsoft in order to cut down on end-users trashing their systems. UAC may be disabled but I wouldn't recommend it. A majority of computers that become compromised with spy ware is because malware or viruses entered through a profile that had administrative privileges and then self installed.



Antivirus must be installed. Most computers I come across don't have it installed or it's so out of date it might as well not be installed. It's a small fee to pay or even free to avoid the headache of infecting your computer or worse other computers.



Scripting attacks may be prevented by staying out of crappy sites. One problem is some popular sites still seem to host ads from vendors that are known to install malware. Using a registry based block lists is a quick and free way to avoid these pitfalls.



Peer2Peer software is another way to trash a system. Installing poorly written software for the purpose of downloading music and whatnot is a pretty sure fire way to hose a system. While in college most of the computers I have seen that run poorly are because a Napster type of software was installed and some of the files downloaded from the network were virus ridden. The peer sharing software themselves sometimes have ad-ware built in for the purpose of bombarding your computer with trash. So the alternative sucks but pay for it using iTunes or something along those lines.



I don't want to even start with email. Basically if it looks too good to be true then it probably is. Don't click on the links or download the images from it, just delete it or report it as spam.

Labels:

posted by Stephen Reese at 0 Comments

Wednesday, December 20, 2006

Using Common Sense to Secure your Information

Every day technology helps create efficiency for millions of people. With all of the benefits that technology provides there are also many pitfalls that come with convenience.



Online vendors make it easy for people to purchase goods at reasonable prices when compared to brick and mortar stores. There are many good companies to do business with but there are also a lot of shady vendors run by people trying to make easy money. There are some pretty easy ways to spot these characters.



First off just by viewing a site that looks poorly designed can be a sign of a site that was put together with haste just to be taken back down shortly after a few people are ripped off. Searching for reviews of the company that people have expressed there opinions of the company similar to what eBay has in the form of feedback may help you decide. Also companies that are serious about business will no doubt have thoroughly thought about security.



Do not use sites from SPAM or other illegitimate sources. Phishing sites are a sure fire way to have your identity stolen and you don't want that to happen. Make sure the site uses an SSL certificate in order to encrypt your information, this is a must have. Do not use the same password for your various logins at different sites. Use at least 8 characters if not more and make sure to include some random characters which make cracking a password much more difficult. Know that there are sites that you may login to that may not use SSL certificates so your password may be picked up using a traffic sniffer. Also wireless networks are an easy way to lose information. Be weary of people listening on the wire with traffic sniffers. So do not send important information via email and instant messenger since they are almost always sent in clear text. I have tested this numerous times and you wouldn't believe the information that is sent in plain text. Finally make sure to review you credit at least once a year, you may not even know that you a victim of online or identity theft until it’s already happened.



There are a number of resources online to help you from online fraud. A simple Google search can help you find these resources.

Labels: ,

posted by Stephen Reese at 0 Comments

Wednesday, August 09, 2006

Elite programmers compete in CTF at DEFCON

Am I really cool enough to know one of the people in this crew...

Elite programmers compete in CTF at DEFCON by ZDNet's George Ou -- Members of the winning team 1@stPlace after 2 day marathonAt this years CTF (Capture the Flag) competition at DEFCON 2006, elite programmers and security penetration experts duke it out in a grueling two and a half day competition. Out of hundreds of teams that signed up for the competition, only eight qualified for the finals [...]

Labels: ,

posted by Stephen Reese at 0 Comments

Monday, February 20, 2006

Pod Slurping!

A article on CNET describes how Abe Usher has written an application that can be loaded on a IPOD to steal sensitive information from a corporate network. The process works by scanning the network and grabbing document files such as acrobat and word files.

Labels: , ,

posted by Stephen Reese at 0 Comments

Tuesday, February 14, 2006

New phishing techniques to fool online users.

Every day people are becoming aware of the problems posed by online shopping, browsing, and even messaging. The days of email that are obviously spam due to misspelled words and links that contain ip addresses instead of dns names are moving to a new level. The following post describes the process in which an actually SSL certificate was used to trick users into entering confidential information, a tatic previously not used before.

Labels: ,

posted by Stephen Reese at 0 Comments