Thursday, November 24, 2011

Good Practices 1

I will be doing an on going series of good practices you should be aware of and using in your attempt to make your self better protected in this fast paced internet world.  So here is the first of many.  Enjoy


Do you use your Wifi at 3am?

    Well unless you a night owl looking up a last minute flight to your mom’s house then please turn off your router/wifi router when your not using it.  Well not every time you step away.  Just for times like when your at work or when your asleep.  If there is no path to your computer for someone to use then they cant get in.  And if its on all day while your gone your neighbor can use it to download that new album for his favorite band that just came out illegally on your wifi.

You don’t have to shut down your computer but put it in a power save or sleep mode.

    If you running in the screen saver mode then your computer is still alive and can still perform things in the background.  Yes having a password to log in will help but not for everything.  Powering it on and off all the time can start to cause wear and tear on your Hard Drive but thats is another topic.

Make sure you click log out and not just close the browser

    When you log into a website your are creating a Session.  Sometimes these sessions have a timer on them, other times they don’t.  It all depends on the website, or how they have configured their Servers to handle the Sessions on their site.  So lets say you close the browser and walk away from the library computer.  If a person sits down right after you and wants to check their bank account or Facebook like you just did, they may be looking right at your account.  If you select log out every time this session is terminated right there. 

DO NOT open email attachments from someone you do not know

    Who cares if it says the attachment is a desktop wallpaper of a cute kitten fighting a butterfly.  You must resist.  I know you love cats.  Im sorry.  If its from someone you have never heard of then there is a high chance that this is phishing.  Phishing is a way that someone attempts to get you to do something or provide something that will in turn harm you.  Yes when you open it there is a picture of a cat fighting a butterfly.  But when you opened this you also may have executed code or something else malicious that can install something or make your computer do something.  If the email is from the website that you gave your email address to in order to get pictures like this then that is fine.  The address will be from something that sounds legit.  So if you signed up at Catsarethebest.com that is who you should check to see who it came from.  If it is from catscatscats.com you should consider just deleting it.

When was the last time you changed your password?

    Just because nothing bad has happened yet does not mean you should not change it.  And no you should not change it from scrambledeggs4 to scrambledeggs5.  Just performing this increment does not make is safe even though it is different.  You can change it up and use a different food you love.  Password cracking tools check everything in increments as well.  So they do check for ilovemydog1 and ilovemydog2 and ilovemydog3 and so on and so forth.  This is a known weakness in passwords that bad guys would like to exploit.

Sunday, October 9, 2011

Web Site Security Questions

Those questions your bank asks you to get your password unlocked and such.  LIE.  What is your Mothers maiden name?  Spiderman.  Yeah thats what I said. Spiderman.  Even if they find your Mothers maiden name a hacker cant get in because you put in Spiderman.  Pick a favorite movie and use those characters.  Use their favorite color or high school mascot.  Use your favorite actor even and use their personal data.  You will NOT get in trouble for this.  Your bank will not look in your profile and be like “Um Ma’am it has come to our attention you have lied in your security questions.”  Never gonna happen.  Who cares if you said you went to Hogwarts for High  School.  These are for YOU and YOUR security on YOUR accounts.  The harder you have made it then the harder it is for someone else to guess.  Through internet information mining people may very well find out what your mothers maiden name is.  But jeez its gonna be funny when they try.  Cause nowhere and I mean nowhere will it say her name was Spiderman.  Well unless you go around telling everyone the funny story about how you put Spiderman in your security questions.

Don’t share any information even with close friends.  Yes its OK for you to think Im silly and your long time friend wont do anything.  Who cares.  You should.  If your the only one that knows your the only one that can get in.  Well with in reason of course.  Its like practicing what you preach.  You don’t wan to only practice good security with your accounts out in public.  Then go home and break all the rules because you feel safe in your home.  You are only as safe as you can possibly make yourself at your weakest point.  And if you slack off at home then all the other things you do are for nothing. 

Saturday, October 8, 2011

Password Fundamentals

It seems that everything we do on-line requires a username and password. From banking to social networking, forums, and internet news groups. So many usernames and passwords in fact that it leads you to less security then you think. Who can remember 20 passwords or what 20 sites they are for. Are you writing them down? Are you using the same passwords for multiple sites? This can be inherently dangerous because if only one site becomes compromised then in turn all the other sites you use can also be at greater risk. I want to cover a couple of practices and need to know’s that will enable you to be in a greater cocoon of security. This reduce the likely hood of you becoming a victim of an online crime, and keeping your self save from a possible data leak from the company you are trusting with your personal data.

I am sure you have heard of all the recent attacks on companies by groups such as Anonymous and LOLSec. These groups are hacking into big corporations that they feel have unjustly wronged those that they support. Like a Robin Hood scenario but in this Cyber War as in any war collateral damage has occurred to innocent bystanders. When Sony was hacked the usernames, passwords, credit card information and other valuable information was stolen by these groups and put out for all to see on the internet. Sony had to get identity theft protection for those involved and payed for those individuals to be able to get credit reports. Sony released public statements on what they believed was leaked but no one can truly know what was done or stolen once you have been compromised. This is terrible and no matter who you support in this there is no reason for the innocent to be harmed.

Lets say you have an account with XYZ.com and ABC.com. You use the same email address(which in most cases is the username) 12345@email .com. And because you have 500 other sites to log into you use the same password for them all. Well if sitej XYZ.com has a data breach and your information is leaked then in turn they now have your credentials to log into ABC.com as you. And if you use the same for DEF.com and GHI.com they now have access to those. So lets put this in the real world. If XYZ and ABC are Twitter and Facebook they can spam people or get into your contact list. If DEF and GHI are your bank or investment site you can be in big trouble. Hackers are evil and seem like a bad dream but they are real people too. They know what top websites people are most likely to have accounts with.

So with their super hacker skills they have made programs that will take these databases of compromised information and use them all at these sites. Because their is little user interaction that is required because the programs will run while they are counting sheep it is not too labor intensive for the hacker. His return on investment is great because he only needs to have 20-30 work out of the 100,000 he received via the deep dark places on the internet. If he only gets $100.00 from all 30 of those accounts he is now $3,000 richer and he was all snuggled up in bed.

Its time to break the routine of bad security. I will give you simple tricks and tips that will greatly reduce the possibility of you becoming a victim. There is no 100% sure way. There are only ways to reduce the chance of it happening. So lets get started with the most simple way to increase your security know how. Your password. We need to make it easy so you wont cheat and go simple, yet is good enough for simplistic password programs to be defeated. So general practice wants you to have a mix of lowercase, uppercase, numbers, and symbols. Then the longer it is the better it is. Its a game of math. The way the programs methodically attempt to guess your password can be truly put to the test. if your password is abcd1234 it could take 2 hours for it to guess. If your password is aBcD12#4! it could take months even years.

Here is a great way to keep bad guys out. Pick something rough. AbC$%Er13. Then you could use google.com. Yes use the web site to help you. Take the last two letters of the name and put them in the password. So no you have AbC$%Er13le. This made it longer and now is specific to this one web site. If you do this for every site you now have a different password for everything you log into. And you can write down the first part. Just dont tell people your special secret for the end. I do not want to get into all the crazy math but this has made it so that a password cracking tool could take years to crack. They wont go that long. They will just take the ones that were cracked in four hours. There is not a good return on investment if they go for years after your password and then you may even change up to the first two letters and add them in now. Yes you want to switch it up once in a while. This also increases your security strength. So if your Twitter password is compromised they can not get into your Facebook because the passwords are different.

Try it out. See what works for you. Your security will fail faster on your part if you become lazy with security. You can not help it if one website gets attacked by Cyber Criminals. But now if one password is out in the open for use your have greatly reduced the impact to yourself.

Saturday, October 1, 2011

Public Wifi

Would you want someone looking over your shoulder and watching everything on your screen or knowing every keystroke you make on your keyboard. No I am not a guy sitting in my place with a tin foil hat. But this is what can happen if you use public wifi.

No they are not literally watching you. But it only takes that one guy or gal in the coffee shop sitting there sipping their mocha frapa iced coffee. Yeah, that person you see once in a while at your local caffeine dispensary. They can be monitoring everything. Im not going to get into all the voodoo magic that happens but public wifi is like a public pool. Your sharing the water. Your sharing the fun. In order to make up for every device with all possible settings or abilities they have to set the wifi hot spot to wide open. So just like a public pool everyone can see everything. What you normally keep in private they can see because its just wide open. So the guy with the goggles swimming across the bottom can see all the things in the water floating.

Now in a perfect world people will leave each other alone, mind their own business and world peace is here. Well we don’t live in that world. And if you log into your bank to check your balance you can just expect that everyone else saw your user name and password and now they have access to your funds. The scary part is that it really is just that easy in open public wifi. No, not every wifi is that wide open but are you willing to take that risk.

So a good practice is to just to do simple and things you don’t mind sharing in a open public wifi. Check Youtube and watch silly videos. Browse news sites. Just dont use anything that will require you to use a username and password. No Facebook, banking, Amazon, Ebay, and nothing that could let someone into your personal things or life.

Things do get a little safer when you use a secure connection like https in your URL bar vice the http. I will save that one for another day. I just wanted you all to be aware of the dangers of using open public wifi.

Tuesday, September 27, 2011

One last thing on Home wifi

So one thing I forgot to mention. Lets make sure you change the default name and password that you use to get into the router. This can prevent outsiders from changing your settings, or even people within your own home from changing them. Because If you have changed the wifi password to keep your child who is on punishment out, they could just get back in and see it or change your settings. Remember once you have set this please remember it. The only way to get back in generally is to do a hard restart on the router and this will put it back in the out of the box configuration. You will have to start all over again.

Saturday, September 17, 2011

Home Wifi PT2

Getting into your router.

So there are a few ways that you can get into your router. Depending on your manufacturer there may be a specific way to do so. Most that I know require a IP address and your internet browser. Check your routers manual or FAQ or support section on your manufacturer’s website.

Ok so were in your router. familiarize yourself with the different tabs or different areas that are within your router. Most have security tabs or networking tabs or something of that nature. Click around, you want to browse all the tabs or different areas. I can not make a walk through for every router on the market and each model. So we will just ensure some of the most important things are taken care of in order to ensure your security and privacy.

Find where you can change your SSID. This is the name of your network. You can keep it the same but to prevent confusion if there are four others broadcasting the same thing you will want to rename it. Yes people outside the walls of your home will see the name. But thats not an issue and is an option to turn off but I will not cover those in great detail here. We just want to cover the basics. Name it something friendly like your pets name or your favorite planet or something.

Look around to find an are to change your security. You will see that there will be different types of security options to choose from. There are a few types on the market WEP, WPA, WPA2. You may even see WPA or WPA2 Personal and Enterprise. These are other names or higher security for other things then home network. Im not sure what is in your Wifi Router but these should be normal naming conventions. If WPA2 or WPA2 Personal is there go for it. Nothing wrong with getting the most security if you can. Just be aware some of the devices you may want to hook up to your wireless network may not support it. So if you have to, then just select WPA. WEP or Wired Equivalent Protection is broken. While it may thwart casual browsers it can be cracked in minuets by people who want to get in or have 10 mins and google to figure it out.

Ok now you have to make a password. Remember, you will have to type it in on all your devices that support Wifi. So some devices may not have the same character selection. Pick something easy for you to remember yet it is strong enough to keep your Wifi safe. Using “Cats” is not a great password, using “ILoveCATS!!!” is much stronger and will stand up longer to password cracking. Now if you want to go all out “1L0veC@t$!!!” is even stronger and will give crackers a run for their money. They may just move on to the next Wifi and try there. I will get more in depth on passwords in another post.

There are a couple of other options you can choose that will make it more secure. MAC filtering and not broadcasting your SSID (the name of your network) and many more.

Ok. This should cove the bare bones basics. If you need more clarification or need a little help post a comment and I will get to it as soon as possible.

Wednesday, August 17, 2011

Home Wifi PT1

Who helped you set up your home network?


I hope your wifi is not open. Did you take your wireless router right out of the box, power it on, hook up, and start surfing the internet? Is your network name Linksys or D-Link or fill in the blank with the out of the box factory default name? What encryption are you using? Do you know what WEP or WPA is or means?

Did you know if you run an open wifi the FBI could knock down your door and take you in for questioning for stealing movies or music off the internet? Never downloaded anything? Too bad. They found you by your wifi's IP address. But hey, wait a minute, you still did not download anything. Well your neighbors 16 year old did. And he did it with your free and open internet link. While after further investigation they will find you do not have and never had any of the items in question on your computers. Yeah thats right they may confiscate your computers to look for this pirated media. You can avoid this by taking a few more steps and taking a little time to protect your home wifi network.

Do you still have the book that came with your wifi router. Well a google search or trip to your routers website may get one for you if you no longer have it. You will find contained with in this book the steps to interfacing with your wifi router.

Then you must decide just how far you would like to go with your security. Not that its going to be way too hard for you to get in. It makes it a barrier for a casual wifi borrower to move on to the next router. You can hide your networks name from being broadcasted. You can require a password for connection. You can filter phones or computers by their MAC address for entry as well. How long and complicated you make your password for your connection helps.

Through the next couple of posts we will go through and get your home wireless more secure and less likely to be compromised.

Sunday, August 14, 2011

Welcome NOOBS and I mean that in the most loving way from the bottom of my Security filled heart.

As Technology and the threats to your security continue to advance who can keep up with that.

Your world and life are already complicated enough. So what I would like to do with this blog is try to keep things on a simple everyday user level. I want to try and give you the ability to incorporate some simple security practices and know how to your life that will help protect you.

The browser you use to browse the internet has additional security. The websites you use have different security or security policies. Do you really trust that wifi at the coffee shop or in the mall?

We all think it won't happen to us. We all think were doing it right. We all see the stories in the news about the Hacker groups that are going around and stealing personal information or giving it away. The problem is that not all Hackers tell everyone that they are doing it.

Imagine your self as a 500 piece puzzle. Bad people through publicly available information have 50 pieces. Through the information you have shared across all your online profiles give them another 60. The Hacker groups releasing information can give up another 10-50 pieces. Maybe your online friends profiles are not as secure as yours and shares your information and thats another 15 pieces. (This can happen if your mom did not secure her Facebook page and it shows that your her son or daughter. And maybe she has her maiden name in it as well so childhood friends can find her. Well what question do 75% sites ask for verification for password resets. Whats your mothers Maiden Name?) No, on-line Cyber criminals have nothing better to do. Yes, there are tools that help gather these things. If you know all the little tips and tricks with google search you can actually find a lot of information. Leaking puzzle pieces here and there will add up pretty quick. This will give a pretty good picture to the Cyber criminal that they can either just have an idea what it is and fill in the rest. Or they can just be patient and continue to wait for you to slip up and get the rest. A slip up can just be a website changing its policies and sharing more information by default. Most site just share everything by default and you must go in and manually get them to make you private by sorting through pages of yes and no's to get it where you want it.

I want to make tutorials and videos. I want to keep this updated with news and releases of changes to things to keep you in the know. I want to make a dummies guide so that you can see what is going on and what you can do to provide yourself with as much privacy and protection as feasibly possible.

IF YOU PUT IT ON THE INTERNET ITS NOT PRIVATE. SOMEONE CAN SEE IT OR READ IT OR STEAL IT. NO MATTER WHAT, YOU CANNOT STOP EVERYTHING. MAKE THE BETTER DECISIONS ABOUT WHAT YOU WANT OR ARE WILLING TO SHARE.