Cybersecurity tip of the week -- Free Wireless Insecurity

While everyone loves something for free, there's usually a catch. Such is the case with free wireless Internet offered by numerous businesses and libraries. While the intention may be to attract customers with a useful service, this perk also attracts cyber criminals. Therefore, it is best to limit your exposure to free wireless networks. Since the service is free, I doubt that much money if any is put towards providing an acceptable level of security. Without the appropriate security in place, hackers can tap into free networks and snoop on all data transferred between the wireless access point and other customers connected to the network. If you must make use of free wireless Internet, follow these countermeasures: *Confirm the SSID or wireless network name with the business providing the free wireless Internet. Hackers can set up rogue wireless networks with a name very similar to the legitimate network to lure customers usually by showing a higher network strength than the legitimate network. *Watch out for an acceptable use policy that you must accept prior to accessing the wireless network. If you do not have to take any steps to authenticate, the odds increase that you're connected to a malicious wireless network. *Do not surf to websites that require you to enter username/password for access. If someone is snooping on network traffic, they can intercept your login credentials. If you must access a website that requires authentication on the go, use either VPN or your cellphone Internet. Keep the above tips in mind to help avoid becoming the next Identity Theft victim. Feel free to share additional free wireless network tips with the AnythingCyber community.

Cybersecurity tip of the week---Social Engineering

Don't fall victim to social engineering (SE). A quick definition of SE is an attempt by a con artist or hacker to trick a person into revealing personal information such as a date of birth, password of an authorized user, or email address of a high level employee. SE is a low-tech way of gaining valuable information. The requirements are very basic and include: a persuasive person and a victim. SE has been used in different forms probably since the beginning of time.

To protect yourself from becoming a victim of SE, do not provide information to untrusted solicitations via text, email, phone, etc. I've recently noticed a few random text messages that sounded too good to be true. I always ignore these and hopefully you do as well. This is a form of phishing via text or smishing. It is also a form of SE.

Share your personal experiences with SE attempts (hopefully unsuccessful attempts) with the Anything Cyber community.

Check your Mac for the drive-by download Flashback malware

As an owner of many Apple products, news of the Flashback malware infecting hundreds of thousands of Mac computers hit home. I just checked my two Mac computers and fortunately neither is infected. This malware is particularly dangerous since a Mac can become infected if a particular website is visited. There's no requirement for the user to actively download the malware.

Although many Mac users boast of not needing antivirus software on their ultra-secure Macs, I've used AV software on my Macs for years. I feel the main reason malware is less prominent on Macs since PCs have a dominant market share. Yet, the last few years Macs have been picking up ground and therefore cyber criminals have taken note and are more prone to target Macs.

If you are one of the rare breed who actually owns a Mac computer versus an iPad or iPod, please peform the following actions on your computer to check if you've been infected by Flashback.

1. Go to your terminal. To get there, do the following:
       Go to 'Applications', then 'Utilities', then click on Terminal

2. Once in Terminal, go to the following website for directions:
    http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

After you follow steps 1 & 2, report back as to whether or not you were infected. The above website also provides steps to take if you were infected to get rid of the malware.

Self-repairable cloud network in the works

I came across the below interesting article regarding A DoD funded effort to develop a cloud computing environment with the ability to repair itself after cyberattack.  The research is headed by the MIT AI Lab. The effort is comparable to an anomaly Intrusion Detection System (IDS) since cyberattack detection is based on the occurrence of anomaly in the normal operating activity of the cloud environment. False positives will be an issue since it is very difficult to define normal operating activity in a large, diverse network with thousands of users.
 Please post your thoughts and comments.

Jimmie

http://defensesystems.com/articles/2012/02/28/agg-darpa-cloud-self-healing.aspx?admgarea=TC_CLOUD

Microsoft knows better

At least Zappos made it hard on hackers and hashed user passwords. According to a USA Today article published today, the Microsoft online store serving India was breached by Anonymous wannabes called Evil Shadow. The customer database was breached. Username and plaintext passwords were compromised. Customers would expect more security from a company that has been ubiquitous in the IT industry for decades. Storing passwords unencrypted might have saved some processing time but Now will cost customers time changing their passwords.

As in the case of my recent Zappos blog, hopefully customers did not use the same password on multiple websites. If so, those passwords need to be changed as well. For followers impacted by this recent breach, check out my Zappos post for mitigating factors.

Microsoft, we expect much better. Glad I made the switch to Mac products 7 years ago. My 7 year old eMac with 40 GB hard drive still works like a pro with a software update required so infrequently I can't remember last time it was updated. On the other hand. My Windows 7 laptop that I was forced to buy for my Cybersecurity M.S. degree seems to need an update every time it connects to the Internet.

1 man's unneeded hard drive is another man's gain

Computers don't last forever. Assuming computers did last forever, at some point patience with a 100 MHZ computer will come to an end. Before dropping your old PC off at the Goodwill, don't forget
to wipe your hard drive of all personal data. Just moving all your sensitive data to the
recycle bin and emptying the bin is not enough. The data is still on the hard drive until
overwritten by new data.

A web engine search for hard drive wiping tools will offer plenty options free or low cost
options. On the flip side, if you acquire a computer second hand install a good antivirus
program and scan the computer prior to personal use. The used computer might be
infected with a virus or Trojan that collects your sensitive info (I.e. logins) and reports
back to a hacker.

Stay safe out in the wild wild NET.

Biggest security implications of recent Zappos breach

I'm armed with some fresh ammunition just in time for the start of my next Cybersecurity course. Zappos, an online shoe retailer owned by Amazon, was recently breached by cyber criminals exposing personally identifiable information (PII) of approximately 24 million customers. Information such as address, email address, and last 4 of credit card number was compromised. This information will definitely lead to massive e-mail phishing campaigns that will probably seem legit to customers due to the PII that can be provided within the e-mail messages.

Yet, the bit of information with the most far-reaching security implications was the compromise of customer login passwords in encrypted form. Based on my experience in the security field, encrypted passwords are hashed passwords. A hash is an algorithm that modifies it's input in such a fashion that it is very difficult to reclaim the input from the hashed form. Yet many password cracking applications exist that are capable of cracking simple passwords that were hashed in seconds.

Since a significant amount of people still use simple passwords for ease of memory, whoever hacked Zappos will more than likely run those millions of password hashes through a password cracking tool. To make matters worse, since Amazon acquired Zappos, I wonder how many users of Zappos use the same password for both sites? Also, how many Zappos customers use the same password for other sites as well such as banking or e-mail sites?

For all the millons of Zappos customers impacted by this breach, make sure to not only change your password to a strong one on Zappos but also on any other websites in which the same password is utilized.

Feel free to chime in and share your own experiences with massive security breaches. I myself was a victim of the massive Sony PSN breach last year.