A "solution" to cyber security (there isn't one.)

I keep hearing a few things in the chatter about cyber security that make me cringe. People claiming they have the "solution" to cyber security and the "we already got hit so we don't have to worry" fallacy.
You can't fix cyber security like solving a puzzle. There are no magic set of pieces that when put together make a solid picture that fixes everything. And if you have been hit already, expect it again, and again until you either go out of business. You got attacked and now they know they can attack you. If you put all the right pieces in place you will still be compromised again and you will start over.
Cyber security is not a target but an ever evolving battle where the opposition is always and rapidly evolving and so must your defense. Your defense must be tailored to your network, information, processes and people. It has to start with knowing what you are trying to protect and evolving your understanding of what you are trying to protect. It doesn't matter what else you do, if you don't know what you are trying to protect (and everything is not an answer) you won't know what controls you need to put in place to protect it.
And there is no way to make your network (corporate network here, home is another matter) 100% secure and you have to face the fact that either you will be or already have been compromised. You just may not know it yet.
The consensus is that all companies are or have been compromised and the sad fact is most don't know it. The average compromise to discovery is months, 6 to 9 months. And your IT Security is probably not who will find it. You still need them but they just don't have the tools and resources to find the threats you are faced with.
It is not just your problem, everyone including places like DHS, the FBI and every other 3 letter acronym are having the same problem so don't beat yourself up for it. You can't protect everything. You still have to do the normal firewall, AV, IDS things to keep the script kiddies out but for APT actors you have to decide what you cannot afford to lose and prioritize your efforts. Split the really must keep stuff off from the rest of your network and put robust controls in place with more layers of firewalls, VPN only access, encrypt the heck out of it and surround it with fakes that will keep the attackers busy.
And if we learned anything from Sony Pictures it is this, make a recovery plan for the possibility that you lose everything. What will you be doing when email doesn't work. How will you communicate with staff and far flung parts of your organization. Do you have backups, off-site backups and a fall-back plan to do things like pay your employees, what won't work if non of your computers do.
And then keep updating your plan, practice what you will do when attacked and keep doing the motherhood procedures but don't think any of this will keep you 100% safe, be prepared.

A new year dawns and with it the same old issues as always. From our point of view though the new year is a new time of plenty, plenty of malware, plenty of attacks and you will be hacked, if you aren't already.
2014 certainly was fun and now with 2015 here I expect it to only get more fun.
There is only one way to be sure you won't be attacked and that is don't use a computer (maybe my father was right, naw... you wouldn't be able to read this if you stopped using a computer.)

I saw a headline today Cyber security groups use fake computers to trap hackers   where the write is all aflutter about this "new" way to detect attackers by putting up fake computers with fake software. The story didn't elaborate much but it just seems that some company has convinced the reporter that honeypots were a new thing and the reporter didn't do any homework. I swear that almost every day there is another company showing up proclaiming their new idea which turns out to be something any good security guy has been doing for years.

There was a good story though at TechCrunch:This Cybersecurity Medicine Might Be Tough To Swallow

The story boils down to my point above, if you want to be sure and not be vulnerable then be prepared to not use your computers. But then whatr would we use to surf for cat pictures?

Happy New Year!

So have you been hacked yet, hopefully it was you doing it but probably not

I do cyber security research, lately more than ever. As most companies have lately, there is an uptick on attacks, some because of recent bugs being published, others because cyber is both big business and sadly, seems to be what governments all over are doing.
It's an open secret that everyone is hacking everyone in terms of spying and trying to get or keep the upper hand in trade. While I am not involved in that I see it all the time. Typically when someone gets attacked it is some user or contractor or supplier that opens the door to the wrong email or link or attachment. We say we have to teach the users and we do.
But then a user clicks the wrong thing and people start pointing fingers. "Why did you do that", implying the user is an idiot or something. Anyone who knows me knows I do not advocate blaming users. They just want to do their jobs and get work done. Sometimes they have to chill and read email or whatever and most of the time, 99.9999% of the time (completely made up but you know what I mean) they don't click the link and trash phishing emails. But the one time in thousands of emails they get and they slip up once they get pointed to as 'the guy'.
It's not fair or even helpful to blame them so we have to stop it. The blame stands only on the people doing the attack, not the user who clicked the link, not the researcher who found the flaw in your program or product, not the people who wrote the software or the OS (sorry no Microsoft jokes today) but the guy who made the attack and the people who back him.
Yes all of those people, the user, programmers, cyber techs, systems admins do have a role to play in making the attackers life harder but it's the attackers who hold 100% of the blame.
I write software. I want the software to just work for users and not be a pain to use, pleasant even, but I also have to consider the security issues and I wish I didn't have to, but I do. It makes programming slower and it makes software slower. I can't see us getting out of this. I do see that we need to make our defenses stronger, always practice defense in depth, segregate our networks, use decoys, honey and tar pots a lot more.
With world events and history as our guide I don't see any of the governments (all of the governments) ever being brave enough to admit they have been doing this or forward thinking enough to use that admission to pressure others to do the same and get started breaking the cycle. The current thoughts seem to be we have to do it because everyone else is.
With the current trend of breaking into control systems of industrial systems, scada or otherwise, at some point someone will get into the wrong thing. Something big and dangerous that should never have been connected anyway but it was easier to do it this way, you know how it is. And once connected they will experiment with it and something horribly goes wrong and people get killed or worse. At that time it becomes a physical attack and then what happens?
None of us want this to happen but it will.
In the time being we all hear the talking heads. The head of some US agency telling people that there are two types of big businesses in the US (and I suspect of every country) "the ones who have been hacked by china, and the ones who don't know they have been hacked by china". In Canada the boogyman, rightly or wrongly is Russia at the moment with people all talking of "sandworm." And yet there is evidence that the malware being used is attacking everyone, Russia included and maybe the top target. Whoever it is seems to also be attacking Ukraine as well so I really don't see who would attack both sides in that conflict except maybe newspapers or TV news.
If we believed everything in the news you would think the west was perfect but as we saw in the leaks by Ed Snowden the west, especially the group of five my own country is in, is just as bad if not worse. Probably not worse, but maybe.
I stand with the users, ordinary people and ordinary companies that just have a job to do and want to feed their kids, make the world a bit better etc. We just want to be able to do our jobs, play a few games and be sociable. Maybe the governments of the world should all just go and make their own network (not the one we took from you) and leave the rest of us alone. Is it to much to ask?
Until then, invest in open source, it seems to be more secure and we can at least find the back doors, turn on your firewall and change the default passwords (to keep the media out), put your must be secure stuff on it's own network segment with another (open source) firewall that is not the same segment that external entities can log into and use a decoy/honeypot to confuse attackers.
Use vpns internally between secure segments. Your switched network is just too easy to spoof but a secure tunnel makes it just that much harder for the attackers. Use two, and only use encrypted protocols on all of your servers all the time, mixing it up and using real certificates and passwords.
Crack your user password database, teach your users when to use secure passwords and when not to, otherwise you end up with password stickies everywhere. 
Educate your users but quit blaming them, let them work.
All of that stuff you put in place to better control your users use of your company computers, it's making it easier for you to be attacked. Diversity is strength, both in people and in computers. You can still use Windows if you want (and you turn on the firewall) but embrace Mac and Linux and Everything. A diverse network confuses hackers to no end.
Learn what your attackers know. Personally learn it. It's way too easy to learn about your company on line without alerting you to the fact you are being stalked. (That also goes for the attackers, they are not as smart as they think they are, and neither am I apparently, amazing how the most views on my various accounts have swung to mostly from Russia lately, they topped the Chinese this month. What I get for baiting them on line I guess, Hi Guys.)
Use the tools they use. Set up a test network in your office (even the CIO should try this once) and hack the hell out of it. Put computers (I use a virtual network populated with virtual machines behind a virtual firewall/router virtual machine and I update it all the time. On there I have a virtual machine running Kali Linux and I also added some new tools for PLCs and snmp and one of my virtual machines is a virtual plc/virtual sensors) using your chosen company os and software. Then search for exploits.
If you have time try fuzzing your network and then start reverse engineering the malware that has worked against your company. I am sure you have something somewhere that was compromised. Hack the software the hackers used to hack you. It will teach you. There are many good tools for reverse engineering code. be careful, hacker code is obfuscated and poorly written for the most part. It can make your brain hurt to see some of the coding used. Also don't believe everything you read. If it includes a language, for instance, that language is used in a lot more than one place in the world. Russian does not mean Russia any more than English means England. IP addresses do lie, just like the cake.
Do all of this and you give yourself a better chance but don't stop, security is a journey not a destination.
You dear reader have most likely already been hacked or compromised in some way or another. If you don't think you have look harder. If you have, look for more. Stopping the attackers from getting in is one thing, stopping them from getting out is the other.
I love fake data. Something that looks real but if used will not work. Fake systems (honey pots), false leads and looking for that false information to show up somewhere have to be part of the deal. Finding the error in your false lead code out there in the wild allows you to connect the dots. There was a company released its own fake version of a game to people to pirate. When people started asking questions about the error message that only showed up in the pirated version it was funny. Do the same to malware users. It's satisfying.
Look at me go on, sorry. But there you have it my advice today on what to do to be secure, basically, open source, diversity and go hack yourself, have fun.

The Cyber Security Mess, a primer

Headlines across the planet are decrying the state of Cyber Security. From major companies being compromised, from the largest banks, to retail chains to government departments to ordinary people. Even police and security companies have been made targets, infiltrated and data taken. There have even been estimates that of companies with over 3000 computers 80% are currently being actively attacked and are compromised. Of these 80% only 20% are aware of it.

The average length of time between a company being compromised and determining this is three months. Most find out by a third party telling them they found data that had been extracted and for sale on the dark side of the Internet.
If your company thinks it has never been compromised then you probably are right now and don't realize it.

The  attackers are varied and have many different motives and targets. There are the cyber criminals, only in it for the money. The state actors, US, China, every other country including the ones who deny it. The hacktivists, political or freedom motivated who hack to bring their cause and the freedom of the web to every one, and then the "script kiddies" who hack because they can and the "lulz".

The current situation is bad, very bad. The criminals have so much information they can't use it all. The governments of the world are hoarding data into huge data warehouses with millions of square feet of server space and can't process it all. Law enforcement cannot keep up with the amount of hacks happening. So they go after the low hanging fruit, the easy to catch script kiddies with the hope of deterring the other actors by giving the ones they catch such long sentences they don't fit the crime committed.

How did we get to this point? How does this happen and happen and happen and yet no-one seems to be able to stop it?
The leading way to break into a network is to get someone else to do it for you. This can be by getting an insider to download malware through social engineering, or a watering hole attack or find an outside company that has access to the target company but is less secure. Once inside attackers have it easy since most companies don't properly segregate their networks into zones with access controls between them. Yes it makes getting at data harder, especially for the attacke

So there you go, make sure you have the minimum defenses in place at least, firewalls, antivirus and intrusion detection with someone who is monitoring them 24/7. Use segementing, a VPN, honeypots, heterogeneity and education to keep your network safe.
rs.

It's not expensive. Most of the tools out there to make a network secure are either open source or based on the open source tools in some way. Open source means free and as a bonus you get the source code so you can, if you know how and want to, verify that the software does what it says and has no back doors. And the extra bonus of you can make it better and give back to the open source project. If you come to rely on them a donation to keep them going is appreciated.

So what do you need to have. I thought everyone knew you needed a good firewall at the perimeter of your network. A single entry point that only lets through authenticated traffic. It stops random entry into your network. Add to that a VPN (Virtual Private Network) where your staff who are not inside your firewall can get in securely. Then filter all outgoing traffic to stop people from going to places where they can bring malware back in.

If you have any external entity accessing your network they must be segregated from the rest of your network. Your HVAC contractor doesn't need to be on the same network segment as your employee records or your client records or your point of sale network. These sensitive data networks should also be segregated from your run of the mill data network and if possible each other. If one part of your network is compromised make sure it isn't the important parts of the network.

Next anti-virus just to stop the threats we already know about. Anti-virus/anti-malware software works by knowing what known malware looks like and if it finds that signature blocks and removes it. But what about the stuff we don't know about? Intrusion detection works on analysing traffic patterns. If something abnormal is happening then someone gets alerted and they check it out. Other forms of intrusion detection include honeypots and tarpits. These are computers on your network who are sitting there to not do any work but be tempting targets for malware. And if they get any activity it is likely someone trying to break in. You get an alert and go see what the attacker is trying to do.  There are public honeypots at honeynet.org and they have a lot of info.

If your company is industrial with computers running machines there are also honeypots for that. Put one up where you think attackers might be looking and see if they are. Try Conpot from honeynet.org.

You also need to educate your users and continuously refresh their skills. For social engineering your users are either your weakest link or you line of defense. If you don't teach them they won't be very defensive.

Another problem we seem to have in almost every computer network is that to make things simple for IT we make every computer on the network exactly the same with the exact same software and access controls. It sure makes things easy for IT and the hackers. Now your IT is a smart but lazy bunch of people, who like to script everything. SO are hackers and your 'make it easy for IT' policy is also making it easy for hackers.  Networks with lots of different computers, heterogeneity, break most hackers tools. Malware that expects everything to be exactly the same breaks down when presented with many different systems all set up with different software and the software not always in the same places. A network full of carbon copy systems is a hackers playground.

Linux is the most secure, so why are you not using it?

Last week there was a study released by the UK government that they tested all of the OSes used within their networks and they found that Ubuntu 12.04 LTS was the most secure.

See the article in TechRepublic or the summary at Ubuntu (pdf)

They did 12 tests, rather comprehensive, fair, impartial and independent from the OS makers. Ubuntu passed 9 of the tests with no significant risks from the 3 it failed. Those 3 were mostly just failed on that item had yet to be independently reviewed. Expect Ubuntu 14 to pass at least 2 of those by April.

Windows only passed 8 the same as Mac Os and both had significant risks in at least 1 of the tests it failed.

Now on Friday I have this system I am working on and we did a backup and had to restore. The backup was before we made an account for me so after the restore I had to create an account for me on a system where there is no root login (Ubuntu doesn't let you log in as root in the default configuration, to compromise it you have to compromise a user account and then the root account) but through the magic of being at the terminal I created my own account.

This made some of the people watching comment that if it was so easy then why do they say Linux is secure. Because if you have physical access to the system it is easy to get into all of them, most have the access built in (Windows recovery mode for instance.)

You can make Linux not let you in by the recovery/single user mode but then just boot a live CD and edit the password and shadow files or on Windows boot a live cd and hack the registry with a Linux based Windows registry editor.

Mac probably the same as Linux as it is BSD.

Nothing is ever 100% secure but for what we can do Linux is the most secure OS out there. Period, full stop.

OK so there is a lot of inertia using Windows. People are used to it, they have programs they are used to using in Windows. Office apparently is a stumbling block although when people tell me libre-office won't do something I can usually find a way to do it easily.

Other people say, games, PC games need Windows don't they? Well, not since Steam went Linux.

So I wonder what excuse people will come up with next, it's too different from Windows? Well so is Windows 8.

There's no excuse now, just switch and be more secure.

Hand Sanitizers

Hand sanitizer gel, seems like a good idea, use it every time you might have gotten your hands onto a surface where viruses and bacteria might be. Unless you actually read the directions and the literature.
Hand sanitizer is supposed to be used if soap and water is not available. It's not a substitute for soap and water but a fallback only if soap and water is not available.
If you work in the food industry you aren't even supposed to use it, only soap and water, both Canadian and American guidelines state this.
It has also been shown in various studies that too much use of things like sanitizers leave children not exposed to enough bacteria and viruses to form proper immunity. Yeah kids need to get a bit dirty to grow up healthy. (link)
For me it is also a trigger for my lung condition and hurts almost as much as hot tar fumes and perfumes.
If you insist on using it please don't near me or anyone with lung conditions like asthma etc.

Watch out for the Polar Vortex (or not)

This blog is turning into the debunk what people are miss-calling things blog (or something like that...)
The current cold snap coming to most of North America (Except Manitoba which is always this cold...) has been described by not just a few as the polar vortex. Which is partly true but mostly just wrong.
Some people even in the weather community have been saying that this is caused by the polar vortex, and while it is involved it's not a vortex of cold are screaming southward like a tornado as some people seem to think.
Our world spins and has two poles. The south one has mountains and glaciers so the winds don't form as much at the pole itself but as a ring of storms and wind off of the edge of Antarctica as well as a tight polar vortex.
The north pole has just ocean, aptly named the arctic ocean, where the winds form a tighter circle around the pole. This is the northern polar vortex; it keeps the coldest arctic air bottle up at the pole. And while it is stable it just whips around the pole because of the spin of the earth, sort of, plus some other stuff like heat transfer from the south. Every once in a while every spinning thing breaks down. An interference wave caused by the land masses around the pole, Greenland for instance, and the weather there, cause the breakdown and this is what happened here, the vortex broke letting the cold air contained within to spill out.
When this happens the resulting southward moving air blasts through the warmer air and disrupts all kinds of things and can form into little low pressure vortex storms like what has hit the US east coast. These are not the polar vortex but the air that was once contained by the polar vortex. While they go south warm air has to replace it at the pole (warmer, not really all that warm) and then the next polar vortex forms and that air gets cold and eventually it all happens again.

Ice Quakes (Baddly named)

Lots of news about ice quakes lately but what are they you ask?
When it gets cold the water in the top layers of ground freeze. Typically in Ontario this is the top 2 or 3 feet of soil. This is why you have to put posts, concrete footings and the like down 3 feet or so (depending on your local municipality rules and codes.)
When it gets really cold after a wet spell this water freezes fast and water expands when it freezes. The resulting expansion of the soil causes it to buckle and heave causing the "quakes."
They are generally very localized and multiple reports from an area will be for multiple ice quakes which are too small and being in only the top 3 feet of soil won't affect much of an area. On a lake the cracks can be miles long but in soil the variability of the soil tends to make them shorter and while they can be noisy if right beside your house generally harmless.
The scientific name for the phenomenon is cryoseism, also called frost quakes.
This has nothing to do with earth quakes as they are in the rock and not the soil. Earth quakes are caused by the bedrock or lower rock layers moving or buckling due to plate tectonics (generally but that's another post later.)
Freezing the surface layer of soil does not affect earth quakes nor do earth quakes generally affect ice quakes as they do not have a common factor in their cause.
What would be cool would be any one who has pictures of the results of an ice quake near them to post the images to Google plus and link them in the comments.

Global warming, we have to learn to live with it.

I was reading this: http://www.newscientist.com/article/dn21465-earth-summit-is-doomed-to-fail-say-leading-ecologists.html?DCMP=OTC-rss&nsref=online-news

Basically they are complaining that the current political governance of the world fails when it comes to global warming. "We can forget about fixing the planet's ecosystems and climate until we have fixed government systems, a panel of leading international environmental scientists declared in London on Friday."

Politicians can never come up with solutions for anything like this. They have only one thing on their mind, getting elected and re-elected so their time frame is the length of time between elections.

And because we have to get elected politicians to agree on what to do for a problem that is long term it will never happen. And even if we did now, the facts are that no matter what other countries do, no matter what Europe, America or Russia do, the only country that now matters is China. If they do nothing, and it looks like they will do nothing because they are now bringing a new coal fired power plant on line every 3 days, plants that will last for 60 years or more, if they do nothing, anything anyone else does will make no difference. And if everyone else does nothing but China does all it can (which means going back to farming rice for a living with oxen and poverty for everyone in the country) then global warming doesn't happen.

So unless you want to make china take one for the team and go back to being a country of rice farmers then we have global warming.

Or if the rest of the world went back to the dark ages, all modern electronics, electricity, transportation, cities went back to what they were before the automobile was made. We all went back to farming and manual labour, sailing ships and horses then we might be able to stop global warming, maybe, but probably not likely.

Global warming is going to happen.

We can't stop it now without gutting our economies losing our consumer lifestyle, losing all of our modern conveniences, medicine, internet and out ability to have a life span of more than 45 years like the 70+ years we have today. Unless we all want to give that up we will not be able to stop global warming.

So instead of wasting all of the effort and generating all of the hot air over trying to stop it, instead, we should be dealing with how to live with it. We have done something that is going to make changes to the whole planet. People will lose the places they live. species will be lost, rain will fall differently than it does now, some places will become deserts, others will get more rain.

We will have to deal. We will have to let people move to new homes, we will have to fish for different fish, eat grains grown in new areas, find new ways to grow food in places it wouldn't grow before.

We can not anticipate all of the problems that will happen, where a desert will grow or shrink, how much the water availability will change. All we can do now is guess and then try to scare people with the worst thing we can dream up and that doesn't help. We have to say yes it's going to happen, and agree that we all will help when it does. No need to talk about what will happen, or that we will only help if this or that happens, just all agree, when stuff starts to happen we will help. Deal with how we will help when it happens because I guarantee when it happens it won't be what we think will happen.

And agree with no strings attached. We will help, period. Sign the dotted line.

Why? I know we as a species have been through a lot before; Ice ages, biblical floods, plagues, volcanic winter, the worst of course we did to ourselves, wars that spanned the globe. We have grown from each and together we will make it through global warming.

SO we can't stop global warming, but we can learn to live with it if we all just agree to help each other, locally and globally as it happens.

What doesn't kill makes me hungry

I'm sitting at home trying not to move to much as that makes it hurt more. I was at work today had a sudden and severe attack of chest pains, my normal lung problem but much worse than normal. So I got a free ride to the hospital from one of my co-workers who is a great chap and I owe him big time.

At the hospital they did everything they could, basically make sure it wasn't my heart and so isn't going to kill me and let me rest and fed me oxygen for 3 hours and sent me home to lay around some more.

No advice on staying home from work tomorrow but unless I feel a lot better I'm staying home.

So I missed lunch. And while I have very good friends who bring me coffee I settled for oven baked fries for supper, which as a diabetic is probably not the best.

Anyway there you have it, it didn't kill me but it did leave me hungry.

New Email

Ysrd has finally moved to gmail! And I am hoping to finally start blogging here again.

If I get to depressing or dark please tell me, I don't intend to but I feel a bit crappy right now.

But here I am and hopefully we can make something of it.

Who's fault is it anyway?

You know what I am tired of? I am tired of people who should know better blaming the wrong people for computer security issues.

When you talk to any computer security people the first person they blame for security issues is Microsoft. People saying Microsoft makes their products with too many security holes. If only Windows was more secure then there would be no viruses or worms or people hacking computers. BUT that is of course wrong. There was computers being hacked into way before Windows and the OS being hacked then? Unix. So if Linux's user access rights were the panacea why were Unix systems being hacked?

Yes Windows is attacked more then any other OS but, it's not Microsoft's fault.

So the next thing people blame, the users. If they only had their systems patched fully and the latest version of the OS available, the latest antivirus software or if they didn't download that codec with the Trojan horse in it. Well then how do you explain all of the computer experts that get hacked, Google, Intel, Microsoft, MIT... Is it their fault? Is Google at fault for being attacked, they are to big a target, they should do what, disconnect from the internet to reduce the risk?

NO! Again users only want to be able to use their computers. They want email, on-line banking and to be able to buy shoes on-line and for it to just work. They don't want bigger better faster, they want good enough and like their TV and toaster, it just has to work.

One other source the pundits point their finger at, security researchers. Blame the guy who found the hole and told the companies what to fix, but then when the companies are too slow (or a 0 day attack is launched) some people blame the researchers because they found the hole. They are trying to be part of the solution, they are not the problem!

Nope, OK who else to the pundits blame, the government? business, ISPs, and who do we never hear the pundits going after? (and why)

How about the criminals that make the attacks? The Mal-ware writers, the script kiddies, scam artists... How come I never hear anyone blaming them? No idea but you never hear it.

OK they may say Chinese hackers or Russian hackers or what ever but no-one goes after them?

When was the last time anyone really blamed the criminals? OK there are a couple of times one or two have been arrested but normally they are petty thieves or collage kids out to have some fun and show off their skills. Did the kid who guessed Palin's password really count as a hacker at all? Come one he guessed her password.

We need to go after the serious crackers and malware writers. And if we can't get to them we need to indict them anyway and convict them in-absentia and if they are backed by governments indict them as well.

For those convicted if we can reach them we need to grab from them everything they have. IF we can't we have to find a way to make what they do not profitable and make their lives miserable. For individual crackers/malz; license/authorize privateers/bounty hunters to do what they can by any means necessary to make the attacks stop.

For larger organized or government sponsored attacks, and if the foreign gov gets convicted and won't stop, declare them rogue and seize all assets/debts.

We have to do something. Patching the heck out of systems isn't working and blaming the wrong people isn't working. We can only win this if we make it not profitable fro them. In the case of individuals (and not the joyriders, just the true criminals) ruin their lives, jail or free season on them. For government sponsored attacks, make the foreign gov pay.

Phishing scams, hotmail and GMail passwords

OK so now someone has posted a ton of email accounts and passwords on the net.

http://news.bbc.co.uk/2/hi/technology/8292928.stm and

http://www.thestar.com/sciencetech/article/706223--hacked-email-accounts-affect-thousands

The problem with a lot of the coverage is either pointing fingers at Microsoft and Google (for not educating their users and not making it more secure) or at the users for getting caught in the phishing scheme.

Speculation is that it is a phishing scheme, but as far as I can see there is no proof of that yet.

(Microsoft believes a phishing scheme is behind the security breach)

(If you have anything better then MS says it is please forward)

But who is out there trying to get the mals who did this?

I try to educate those around me to phishing and other security issues but most people don't want to know and can you blame them? They have other things to do and while some of us live to do this type of thing most people do not have the time.

People want email because it is easy and no fuss. So they want to just get it and they put up with passwords but a lot of people set the password and never have to do anything again.

And while there are things out there like the cryptocard and other pass key generators (which work very well) but a lot of people don't like them because of they are fiddly and you have your pin plus the generated number and, all good for us but most people don't want it, not to mention that they cost money and most people want these email accounts because they are free.

I have seen sites that asked if their users want to buy these devices and the users said no.

I would pay the cost of the device (I believe they are about 20 bucks per in bulk) so that my Google account (or MSN) is secure.

What about you?

Post a comment if you would or wouldn't and why?

MalZ and Crackers, detect, identify and eliminate

Do you think you have been cracked? Someone has been trying to guess usernames and passwords for days on end. How do you know if they have? How do you find out who they are?
What can you do about it?
First thing is detecting the attack, how can you find a Mal if you don't know they are there?
Sings of an attack: 1 Log files. You have to have something watching your log files to see if there is an attack. And that something better not be human as humans don't like boring jiobs and find ways of not doing them.
You need an IDS (Intrusion Detection System) that reads all of your logs and tells you when suspicious activity happens.
How? Well if someone tries to login for a number of times they either forgot their login credentials (I do all the time, early signs of Alzheimer's?) or they are trying to break in (crack your system, hence cracker). If they are trying to break in then your IDS will catch them and in the case of system or network login and also email or whatever you can set on most systems a maximum number of login attempts before you time out that username for a specific period of time after a number of tries (usually 3 but you can set this.)
If the user then starts using other names and trying again then after a number of different names tried unsuccessfully from that location then block the IP for a while. This can all be done with your IDS if you want it to; and have it alert you and you can then watch as the attack unfolds or you can do something about it.
So you now have an crack attempt; if you want to find out who the cracker is then this is where a sniffer comes in handy. You can watch all packets to and from the system being attacked and get the information you need to start finding out who the cracker is.
What you might want to do about it is up to you. And most likely the subject of a future post.

MalZ not hackers

OK I am introducing a new term to the lexicon because i see the word Hacker used way to often in the wrong way.
So since the people we want to talk about are people who make 'Malware' and do 'malicious' acts and are 'maligning' the hacker name, MalZ, it just makes sense.
And it's short, easy to remeber, single silable, has the 1337 look and you can even 1337 it a bit 'M41Z' if you want (Although for using in a media outlet of any sort I recommend 'MalZ'.

Why? I am a hacker, old school. I like being called a hacker cause that's what i do. I make things work by hacking them. I know how to use code and use it to do things that are out of this world.
So there you have it, MalZ, tell everyone.

\\//_

Death and Taxes

They say that there are two ineviatable things, death and taxes. This last little while we have had both.
Tracy's mom had a turn for the worse and we had to go see her ar Easter and then the following week she passed after her long struggle with cancer.
Tracy and the kids took it bad, me I am just depressed so no problem. And today is tax day for canadians and so the inevitable hit us.
I hate taxes, not paying them or the idea but the act of doing the stupid things. I hate the paper work and don't start thinking about it in time to get someone else to do it.

Pain in the butt I say.

Anyway LLAP

good morning

Well another really late post. I was sure they had cut this off and I would have to recreate it. I was wrong :-)

July 1

Canada day and the country is a year older.
I have had a bad few weeks. With smog levels in Ontario at record levels I am sick as a dog. Two trips in stretchers in the month. The first one caused exclusively by the smog. The second smog and kidney stones.

Rob and Sue are here and Tracy's Dad. Fred and Craig are adding a new room in the basement for me and then Jen gets my old room.
I am going to have to add a different machine for the firewall and I will probably use the one I brought home from work.
Marty is coming up today so Rob has to leave. Hopefully Marty can help Fred a bit and also we can get his boat in the water and tracy can get a ride.
Long life and Happiness,

Back hopefully for a while

Sorry gone for a bit, recouping from another bad episode.
Was taken from work on a stretcher last week so am still recovering and not to steady on my feet.
I guess hackfest is going to be late.

My lung condition is dependant on air quality. We are having a bad year, maybe the worset on record.
This sucks.

It wasn't US (Linux Users)

According to Groklaw (http://www.groklaw.net/index.php) and the story they quote from Businessweek (May 30 ed.) the DDOS attacks on SCO were not the work of a Linux user.
according to the story the DDOS attacks were perpetrated by a member of an on-line hacker mob style gang and not a Linux user.
As part of their investigation of on-line criminals the Secret Service (USA) were able to confirm that it was not a Linux user who created the worm that made the DDOS attacks on SCO. The SCO attack was a smoke screen and millions of Windows Users got the worm and lost billions of dollars.
I guess the guy used Windows; as MS is want to say "Where would you like Windows to take you today?" In this guys case into a lot of people bank accounts.