Top 10 Tips for Computer Security

Being in the Internet Age, we use computers to pay bills online, go shopping, take college courses, and endlessly entertain ourselves.

Before you allow the computer to consume your whole life, take the necessary steps to ensure your finances stay personal.

1.  Use passwords for protection
2. Get your guard up
3. Up the ‘anti’ with software
4. Run scans to stay current
5. Take wireless precautions
6. Pump up password protocol
7. Watch out for attachments and downloads
8. Avoid going public
9. Watch your phones and PDAs
10. Clean up your computer

These are all ‘best practices’ for technical security precautions.

Following these precautions will help you keep your data and personal information safe.  Be sure to never run your computer as administrator unless you must do so for a specific task.

Maintain your software and be sure to run updates on your device.

By backing up your data frequently, you protect your files and hinders your operating system from crashing.    This will also prevent hardware failure and virus attacks.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

References:
Allebrand, Cheryl
10 tips to computer security – Bankrate

http://www.bankrate.com/finance/financial-literacy/10-tips-to-computer-security…
Best practices for computer security – Indiana University
https://kb.iu.edu/d/akln

Half of U.S. Adults have been hacked: Are you one of them?

AARP has estimated, nearly half of all adult Americans have been hacked in the past year.  The Better Business Bureau said 1 in 5 of all victims are college students or in their twenties.

Identity theft is exponentially rising while users aren’t realizing the true risk that is posed.

Roughly, 432 million online accounts that belong to 110 million Americans, which are half of all adults were hacked in cyber-attacks in the past year.

Consumer Reports estimates that 11 million Americans were victimized from email scams in 2013.

This year alone, there have been 260 breaches that have occurred in health facilities, exposing the sensitive data of 8 million people.

Could this be from health care facilities still using Microsoft Windows XP?  The software is no longer supported and vulnerable to zero-day exploits.

From coffee shops to corporate networks, grocery stores to airports, two-thirds of surfers have nothing to protect themselves.

AARP has launched Fraud Watch Network, where you can get access to information about how to protect yourself and stay alert on the latest tricks and scams.

The best ways to safeguard your personal data are:

1. Don’t share if you don’t have to
2. Monitor your finances
3. Protect your electronic devices and accounts
4. Leave a paper trail
5. Don’t trust everyone

Studies have shown that from the ages of 18 to 24, in the average of 132 days, they’ve been scammed.
 
That’s five times larger than the national average.

This goes to show why university computers are popular targets for cyber-criminals.

This year nearly 840,000 private records were exposed in breach attacks in at least 12 universities.
 
Universities affected are: University of Maryland, Indiana University, Johns Hopkins University, Iowa State, University of Minnesota, Auburn University College of Business, University of Wisconsin, Loyola Law School and North Dakota University.

Also, there were 5,000 records hacked in 10 data breaches of financial institutions, according to the Identity Theft Resource Center.

Reducing identity theft includes:

• Monitoring financing accounts
• Keeping checkbooks and statements
• Securely storing computers and all devices
• Avoiding Wi-Fi networks when shopping online
• Reading reviews before installing apps
• Decline free game downloads, music, and screen savers
• Adjust privacy settings for your social network sites
• Use credit cards instead of debit cards for liability protection
• Shredding solicitations for pre-approved credit cards

You can opt out of certain solicitations at https://www.optoutprescreen.com

For information on other scams, sign up for the Fraud Watch Network.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet, “Like” us on Facebook or add us to your circle on Google+.

References:

Kirchheimer, Sid
Half of U.S. Adults Hacked: Are You Among Them? – AARP Blog
http://blog.aarp.org/2014/06/06/half-of-u-s-adults-hacked-are-you-among-them/
June 6, 2014

Kirchheimer, Sid
College Students: Ideal for ID Theft – AARP Blog
http://blog.aarp.org/2014/05/16/college-students-ideal-for-id-theft…

More Bugs Found in OpenSSL Security Tool

There have been six more bugs found in the widely used OpenSSL security tool.

OpenSSL is a security tool that houses computer programs to enable security over the public Internet.

OpenSSL is used in shared consumer applications, like software in Google’s Android smartphones.

With the Heartbleed vulnerability in OpenSSL,  the new publicity had system administrators rushing to update their systems to protect against it.

Computer administrators everywhere have frowned upon six new security issues that were recently found in the OpenSSL security library.

For example: if you see “https://” in your URL bar, it  indicates that the connection is secure.

The server computer at the other end of the connection is using OpenSSL to provide security.
The two main forms of security are:

1. It scrambles information so it is unreadable to anyone other than the intended recipient
2. It authenticates the source of information, ensuring the sender is who they say they are

 

How to protect yourself

Most won’t have to take any kind of action in response to the OpenSSL attack.

Non-browser client applications such as music players and chat programs will need to be immediately updated.

Distributors of Linux, which uses OpenSSL more openly, have already received issued updates.

If you haven’t already reset all your passwords due to the Heartbleed bug, it is the perfect time to do so.

Major service providers will inform you if it is necessary to reset your password.

Websites that are affected, may be unavailable for a short period of time.  This allows the fixed versions of OpenSSL to be installed by their system administrators.

There will most likely be more flaws discovered in OpenSSL.  Password resets, and software updates are becoming more of a habit with increased internet usage.

Delay no more, secure yourself and reset all your passwords.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet, “Like” us on Facebook or add us to your circle on Google+.

References:

Merkel, Robert
Six more bugs found in popular OpenSSL security tool – Homeland Security News Wire
http://www.homelandsecuritynewswire.com/dr20140609-six-more-bugs-found…
Published: June 9, 2014

Within the Heartbleed Bug

Only a few months ago, the Hearbleed OpenSSL bug was discovered.




We are still learning about the countless encrypted transactions that left your accounts vulnerable to theft.
When computers talk to each other, it is called a heartbeat.  Because of a coding mistake, the Heartbleed bug was born.

Lets say there is a banking transaction:  The client (you) sends its heartbeat to the server (your bank) and the server hands it back to you.  So if something goes wrong with the transaction, the other party will know because the heartbeats get out of sync.

It’s like a cassette tape breaking because one of the spindles stopped working correctly.

How it happened

The actual breach happened all because of the following code:

memcpy(bp, pl, payload);

To explain, the memcpy is a command that copies data, and it requires three pieces of information to do so. 
The first set of information is the destination of where the data needs to be copied.  The second is the exact location of the data that needs to be copied.  The third set is the amount of data the computer is going to find when it goes to make the copy.



The bp is a place on the server computer, pl is where the actual data the client sent as a heartbeat is, and payload is the number that says how big pl is.

The bp, which is where the data is going to be copied, is full of the data sitting in the part of the computer before.  Although, the computer treats it as if it were empty because the data has been marked for deletion.

When memcpy takes the data from pl and puts it in bp, it covers up all the old data in bp.

Everything that used to be in bp is destroyed and filled up with the pl data.

If payload says that pl is 64 KB but it only has 0 KB,  memcpy creates a 64 KB sized open space at bp that’s full of garbage data.  None of the bp old data gets overwritten because there’s nothing to replace it since pl is actually empty.

Meaning whatever old data was sitting in bp prior to the heartbeat gets passed back to the client.  Sometimes the data is irrelevant and sometimes its your banking password.

The Heartbleed bug has been fixed but the vulnerability has existed for a decade.  Who knows how much data was exploited.

Do you have maximum protection on your PC?  Is your antivirus out-of-date?  Let us help you protect yourself from the many vulnerabilities that live on the net.  [P] 619-325-0990

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet, “Like” us on Facebook or add us to your circle on Google+.

References:

Aguilar, Mario
Internet Vulnerability Left Encrypted Data Exposed For 10 Years – GIZMODO
http://gizmodo.com/internet-vulnerability-left-encrypted-data-exposed…
Published: June 5, 2014

Limer, Eric
How Heartbleed Works: The Code Behind the Internet’s Security Nightmare – GIZMODO
http://gizmodo.com/how-heartbleed-works-the-code-behind-the-internets-se…

eBay Breach: Password Reset Issues

There are 145 million people affected by the security breach from the Internet giant eBay.

Dumping the Data

When a catastrophic event happens, cyber-criminals come out from the shadows and lurk on their pray…YOU!

It has been stated that  eBay’s database and is on the market and priced for 1.45 bitcoin.

The claimed offer is for sale via anonymous text file site Pastebin.

It is likely that the data is not from the recent eBay data breach but possibly from another source.

The hacker provided a 3,000-row extract from a database with Asian-Pacific user names, addresses, phone numbers and their DOB.  This equals to about 145 million users.

The users are shown in the sample would represent an odd subset of users for an international company like eBay.

Even if the sample is not from the eBay breach, it could potentially be data from another major company’s leak.

Or it could be fake, and just another cyber-criminal trading for bitcoin on the blackmarket.

Did you receive a notice?

Many reports from worried eBay users says eBay has not yet sent them an email about the issue.  There is no notification when you go to eBay.com or any kind of warning about the breach.

There was a notification after the user tries to reset their password which urges users to create a new one.





It is common for websites to put a banner or notification on their site after a breach.  Notifications urging their users to change passwords, even when the theft is only of encrypted (and properly salted and hashed) passwords.

The reason why eBay hasn’t done the same, is a mystery…

 

Beef up the password

If you haven’t already done so, create a strong, unique password for your account.
Make sure you can remember it but nobody else will be able to guess it.

eBay unlike many others, allows short 6 character passwords.  The suggested amount of characters is at least 8.

eBay does require a mix of characters with upper, lower, number and a symbol.  Try and use a combination of them all.

The following passwords are rated as “medium” allowing users to use these as passwords:

• Password1
• MyH0us3
• Iloveyou!
• !2345@

You see how these passwords still have a combination of characters and numbers, although they are still quite easy to guess.

This is why it is so important to create a strong, secure password at least 8 characters long.

De-link PayPal

Since eBay owns PayPal, they suggest users to link their PayPal account to their eBay account.

Since the breach, if you have followed their suggestion, you may want to rethink your choice.

If you un-link PayPal from eBay account, you can still pay with your PayPal account at any time.

Linked accounts provide cyber-criminals with an easy way to gather a variety of data.

Anytime a step is removed from the process of logging in as a user, you remove a step of security against criminals gaining access to your information.

It took eBay two months to discover the hack because there was no sign of “unusual activity” detected.  eBay has not confirmed if the data stolen was private information or not.

Security experts have criticized the company for not encrypting all private customer information obtained.
eBay is aggressively investigating the intrusion with police enforcement but has no evidence that user accounts have been tampered with.

What do you think about this data breach?  Please leave your comments below, we would love to hear from you!

Be sure to follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest computer security threats.

References:
Myers, Lysa
ESET
eBay breach news: Posted data dump not valid, password reset issues
http://www.welivesecurity.com/2014/05/22/ebay-breach-news-posted-data-dump…
Published: May 22, 2014

Gibbs, Samuel
TheGuardian
Ebay denies ‘stolen database’ on sale for 1.45 bitcoin is authentic
http://www.theguardian.com/technology/2014/may/22/ebay-denies-stolen-database-on-sale…
Published: May 22, 2014

Signs you’ve been hacked

Today, antivirus software gives you peace of mind from scammers.  Although, anti-malware scans can be inaccurate.  So how are we supposed to know if we are hacked?

System monitoring and network traffic detection can help monitor malware, but may often fail on a regular basis.

In this blog, I will give you the signs to look out for, to know if you’ve been hacked.  Also, instructions on what needs to be done after you’ve found out your system has been compromised.

Reformatting your computer and restoring all the programs and its data is the old way of taking care of this problem.  Today, depending on your operating system, it might mean to simply click on a Restore button.
No matter what, a compromised computer can never be fully trusted again.

Here are a list of steps to take if your system has been infected:

Fake antivirus message

Fake antivirus warning messages are the surest signs that your system has been compromised.  But how are you supposed to know what messages are real or fake?

By the time people see the “Virus Detection” message, damage has already been done.  If you click the No or Cancel to stop the fake virus scan, it may likely be too late.

Your system has most probably been compromised.  The malicious software has already made use of unpatched software.

Malicious programs put out an “antivirus warning” because the fake scan is a lure you to buy their product.  By clicking on the links, you are more involved in the process of “fixing” the problem.  Then for a small fee, the antivirus software will clean your system resulting in your credit card number put in the hands of cyber criminals.

What to do:  As soon as you notice the antivirus warning, power down your computer.  Boot your computer system in Safe Mode, No Networking and try to uninstall the newly installed software.  Then restore your system.

Unwanted browser toolbars

This is one of the most common signs of exploitation.  If you experience a sudden change with multiple toolbars in your browser your computer may be infected.

What to do:  Remove any toolbars you don’t need and don’t remember installing.  Try and reset your browser back to its default settings.  If the toolbar didn’t show a Licensing Agreement, then it is most likely malicious.

Redirected Internet searches

Hackers will redirect your browser to a site that you didn’t intend on going to.  They get paid for the clicks to the malicious re-directed websites.

If you go to an Internet search engine and type in common words related to what you are looking for, look to see if you get the same results.  Many times the redirected Internet searches are well hidden from the user through proxies.  The bogus results are never returned to alert the user.  Usually if you have unwanted toolbar issues then you also have redirect problems.

What to do:  Remove the bogus toolbars and programs is usually enough to get rid of the malicious redirection.

Frequent random popups

Companies pay search engines to track your searches in order to tailor advertisements to your interests.  But if you’re getting random browser pop-ups from websites that don’t normally generate them, or of products that you’ve never looked at before, your system has probably been compromised.

What to do:  Random popups are also from bogus toolbars.  Uninstall the toolbars and restore your system back to its default settings.

Your friends receive fake emails from your email account

Even though this is a common problem, it is a security risk.  Malicious emails sent to friends from your address book compromises your account and all your friends’ accounts.

What to do:  Run a complete antivirus scan and change your email password.  Also you should contact your friends in your address book and notify them of the situation.

Have you seen these signs of a compromised computer?  Did you uninstall the malicious programs or reset your system to its default settings?  Let us know your experience below!

Don’t miss out on the latest tech news and computer security alerts!  Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+

References:
11 sure signs you’ve been hacked – TechWorld
http://news.techworld.com/security/3500234/11-sure-signs-youve-been-hacked/