Friday, March 26, 2004
Hacked in a Flash
How can data thieves sneak behind your firewall, steal hundreds of megabytes of information, and leave without a trace? One way is via the same type of tiny USB drives many of you carry around in your pockets.
How can data thieves sneak behind your firewall, steal hundreds of megabytes of information, and leave without a trace? One way is via the same type of tiny USB drives many of you carry around in your pockets. Most organizations have no policy in place for detecting USB drives or regulating their use. Therefore, it is relatively easy for a visiting customer, technician, consultant, disgruntled employee, or anyone clever enough to gain entry to plug a USB drive into any PC USB port and download dozens or hundreds of files at USB 2.0 speeds when nobody's looking. USB drives have surpassed 2GB of storage and are still growing. Since most of them are tiny, they are very easy to hide.
Information theft isn't the only threat these little devices pose. As with floppy and ZIP disks, telecommuters or road warriors can introduce viruses into networks through USB drives when they get back to the office, completely bypassing typical antivirus gateways or e-mail servers. Hackers can load a bevy of sophisticated tools on the tiny devices, including port scanners, spyware, password crackers, and keyword loggers. A hacker can then use a variety of social engineering techniques to enter your facility or access a notebook and use a USB drive for all kinds of sinister attacks. And if one of these devices is lost, anyone who finds it has easy access to all the stored files.
What can you do to protect your company network? The first line of defense is education. Make sure your organization's security policy specifies the proper and improper use of USB flash drives and possibly the need for prior permission before staff members are allowed to use them. Then educate your users on the policies you have put in place and the reasons behind them.
Configure desktop and notebook PCs to lock when not in use for 3 to 5 minutes, or whatever interval of time you feel is appropriate. An easy way to do this in Windows XP is to use the screen-saver password-protect feature, which can be activated by clicking on Display in the Control Panel. Then choose the Screen Saver tab and check the box labeled On resume, password protect. There are also third-party utilities available for locking a desktop, including TopLang Software's Desktop Lock, Ixis's PC Lockup, Spytech Software's SpyLock, and Tomorroware's StayOut.
Provide users with secure USB flash drives. For example, the Lexar Media JumpDrive Secure is a USB flash drive with built-in password protection. And SanDisk offers CruzerLock software with its USB flash drives, letting you password-protect and encrypt individual files. Other vendors offer products with fingerprint authentication.
Set up your antivirus system to scan all drives and removable media for viruses and other malware. Tell your users to confirm that the scanning takes place or to run a manual scan before transferring any files to the desktop.
For maximum security, you can disable your USB ports. This may be too extreme, but if not, you can do so via the system BIOS settings, which can be password-protected. For more fine-grained protection, SecureWave's SecureNT lets you control end-user access to a number of I/O devices, including USB flash drives, using an access control list. You can even use SecureNT to create lists of company-approved devices, deny access to devices not on the list, and monitor the use of all such devices.
Finally, tell each user to keep a text file with his name and phone number on each USB flash drive, so that if it is lost, an honest person can return it. Make sure such identification files are not encrypted or password-protected.
MY ADVICE endeavors at keen.com. The number is 1-800-275-5336 (800-ask-keen) + ext. 0329063 for tech stuff, 0329117 for running a small business, and 0329144 on investing. Want to CHAT, I use Yahoo's IM as the_web_ster. View me in the Friends & Family part of webcamnow.com, just click on "view cams", then in the Java window click on WebcamNow Communities drop down arrow & select Friends & Family. Under the live webcams look for & click on me "the_webster".
Thursday, March 25, 2004
Walt Mossberg for this week - New Program Searches Hard Disks Really Well, But...
March 25, 2004
New Program Searches Hard Disks Really Well, But Has Rough Edges
By WALTER S. MOSSBERG
For many people, e-mail has become a running record of their business and personal lives. Somewhere in that big clot of e-mail messages that have accumulated over the years is a wealth of information about people they've met, work they've done, meetings they've held. There are tough calls and tender moments, great debates and funny episodes.
When did you first meet a certain person? Just what was the initial offer in a business deal? What was that joke somebody sent you in 1998? The answers lie in your old e-mail.
Unfortunately, it's often easier to search the vast reaches of the Web than to quickly and accurately search your own stored e-mail. This is because the most important e-mail program in use today, Microsoft's Outlook, really stinks at searching. If you have a sizable amount of stored e-mail, searching within Outlook e-mail is painfully slow, and often inaccurate.
To address this problem, a number of companies have developed add-on programs that search Outlook e-mail. I've been testing a new entry in this category, a $99 product for Windows users called X1. This search product doesn't just do a great job of finding things in Outlook e-mail. It also can rapidly search for any word within e-mail attachments and Outlook contacts.
But that's not all. X1 also searches for words within e-mail in Outlook Express and the Netscape and Eudora e-mail programs. And it can rapidly search for terms in most types of files you have stored on your hard disk outside of your e-mail. These include word-processor documents, spreadsheets, slide presentations, graphics, database files and more.
X1 handles these file searches much faster and better than the built-in search feature of Windows XP, which I find to be slow and inaccurate, and which can't search within e-mails.
The program was developed by X1 Technologies, a small Pasadena, Calif., company. It can be purchased and downloaded at www.x1.com.
In my tests, X1 proved speedy and accurate, both in searching e-mail and files. It is rough around the edges and displays a certain geeky heritage, but it really works. You can run it in its own window, or as a narrow toolbar that runs across the top of the screen.
Like all other sophisticated search programs, X1 must index all the words in your e-mails and other files before it can search them. When you first install X1, this indexing process can take several hours, and it can slow down your PC because it keeps the hard disk in constant motion and can tax the processor. But X1 stops its indexing temporarily when other programs need the hard disk. After the first time, you can set up indexing to operate on a schedule, and it takes only a few minutes.
When you do a search in X1, it lists all the e-mails, or files, containing the search term on the left side of the screen, with the term highlighted in the file name or e-mail header.
On the right side, the e-mail or file is displayed, in its original format, with the search term highlighted in the body of the document. Spreadsheets look like spreadsheets. Graphics display properly. Word-processor files show up in their original fonts, with proper formatting.
Once an e-mail, an attachment or a file is located, you can open it, print it and delete it. In the case of Outlook e-mail, you can reply to it, forward it, move it to another Outlook folder and do other tasks -- right within X1, even if Outlook isn't open on your screen.
I tested X1 against a hefty Outlook database of more than 120,000 e-mails going back many years. I searched for people and places and obscure terms, and I concentrated on items buried deep within e-mails and attachments I hadn't seen in years. In every case, X1 succeeded in locating the relevant e-mails and documents in just seconds. I got the same great results with e-mails stored in Outlook Express.
X1 turned up an e-mail from a person I'd met on a plane ride in 1997, and a name in a single cell of a large spreadsheet from 1999. It found e-mails about my father's obituary, from 1998, and a picture I had saved from an event in 2000. It even found a word inside the electronic-user manual from an old cellphone. The program allows you to narrow your search by file name, type, size and date, and it even searches in Outlook archive databases, where many users store old e-mails.
But those rough edges in X1 are annoying. For instance, you can't search everything at once. You have to choose whether you want to search among e-mails, attachments, contacts or non-e-mail files on the disk. You can't save searches you perform frequently. You can't search for exact phrases, like "long-term contract." You can't search the embedded song information in music files. And, in e-mail programs other than Outlook, you can't directly open or reply to e-mails from within X1.
The company is working on all these problems and promises to fix the major ones in new releases that could be out in a couple of months. But, even in its current state, X1 is a very valuable tool for rapidly unlocking all the precious information on your hard disk, and especially in Outlook e-mail.
Write to Walter S. Mossberg at mossberg@wsj.com
Walt's page at The Wall Street Journal - http://ptech.wsj.com/ptech.html
And he's on CNBC on Thurs. sometime between 10 and 11 AM
MY ADVICE endeavors at keen.com. The number is 1-800-275-5336 (800-ask-keen) + ext. 0329063 for tech stuff, 0329117 for running a small business, and 0329144 on investing. Want to CHAT, I use Yahoo's IM as the_web_ster. View me in the Friends & Family part of webcamnow.com, just click on "view cams", then in the Java window click on WebcamNow Communities drop down arrow & select Friends & Family. Under the live webcams look for & click on me "the_webster".
News on new worm
What is W32.Netsky.P@mm and how does it affect me?
W32.Netsky.P@mm, also known as W32.Netsky.Q@mm, is yet another varient of the Netsky worm, a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard
drives and/or mapped drives. The worm also tries to spread through various file-sharing programs by copying itself into various shared folders.
The "From" line of the email is spoofed, and its "Subject" line and
message body vary.
The attachment name varies with .exe, .pif, .scr, or .zip file extension.
Also, this threat is compressed with FSG.
Notes:
- Symantec Consumer products that support Worm Blocking functionality
automatically detect this threat as it attempts to spread.
- The worm's executable has a static MD5 hash value of 0x0A9FFA57D65083
C92E0D3D69B00F2F0D.m.
- Rapid release definitions dated March 21, 2004 or March 22, 2004 may
detect this threat as W32.Netsky.Q@mm.
To read more about the W32.Netsky.P@mm, please click here.
This worm is currently undergoing analysis. The record at Security Response will be updated as information becomes available.
MY ADVICE endeavors at keen.com. The number is 1-800-275-5336 (800-ask-keen) + ext. 0329063 for tech stuff, 0329117 for running a small business, and 0329144 on investing. Want to CHAT, I use Yahoo's IM as the_web_ster. View me in the Friends & Family part of webcamnow.com, just click on "view cams", then in the Java window click on WebcamNow Communities drop down arrow & select Friends & Family. Under the live webcams look for & click on me "the_webster".
Wednesday, March 24, 2004
Opera, the browser, the browser I use, to recognise speech
Opera Software is to include IBM's embedded speech recognition technology ViaVoice in the next version of its Web browser.
Web users will be able to navigate, request information and complete Web forms by speaking, which should offer added convenience as more users access the Web on smaller, mobile devices, Opera said.
"Voice is the most natural and effective way we communicate. In the years to come it will greatly facilitate how we interact with technology," said Christen Krogh, Opera's vice president of engineering. "By making this technology available today for the Wider Web audience, the serious work of voice-enabling the Web can commence."
According to Opera, THE REST OF THE STORY
MY ADVICE endeavors at keen.com. The number is 1-800-275-5336 (800-ask-keen) + ext. 0329063 for tech stuff, 0329117 for running a small business, and 0329144 on investing. Want to CHAT, I use Yahoo's IM as the_web_ster. View me in the Friends & Family part of webcamnow.com, just click on "view cams", then in the Java window click on WebcamNow Communities drop down arrow & select Friends & Family. Under the live webcams look for & click on me "the_webster".
Asus preps "Wi-Fi hard drive"
Asus is promising to "change your perception on data storage" when it releases what may be the world's first Wi-Fi enabled network-attached hard drive storage system.
The WL-HDD is a hard drive enclosure capable of taking any 2.5in ATA-100 hard disk. The enclosure also contains an 802.11g adaptor and antenna, plus a pair of wired 10/100Mbps Ethernet ports.
The full stroy
MY ADVICE endeavors at keen.com. The number is 1-800-275-5336 (800-ask-keen) + ext. 0329063 for tech stuff, 0329117 for running a small business, and 0329144 on investing. Want to CHAT, I use Yahoo's IM as the_web_ster. View me in the Friends & Family part of webcamnow.com, just click on "view cams", then in the Java window click on WebcamNow Communities drop down arrow & select Friends & Family. Under the live webcams look for & click on me "the_webster".
OK, now we are two, that I know of, Larry Seltzer is blogging on Security
Larry Seltzer is a Editor on Security at eweek.com. And now he's writing a blog as well. He is someone to read. His Blog. I've also list his blog site in the left hand column, so you can find him again till you put him in your bookmarks. The blog is very new so do go over to his column at eweek.com (lick above).
MY ADVICE endeavors at keen.com. The number is 1-800-275-5336 (800-ask-keen) + ext. 0329063 for tech stuff, 0329117 for running a small business, and 0329144 on investing. Want to CHAT, I use Yahoo's IM as the_web_ster. View me in the Friends & Family part of webcamnow.com, just click on "view cams", then in the Java window click on WebcamNow Communities drop down arrow & select Friends & Family. Under the live webcams look for & click on me "the_webster".
Sunday, March 21, 2004
MONEY MATTERES - Thinking of a Pre-Bankruptcy Spending Spree?
Congress and the courts aren't particularly fond of people accumulating new debts right before they file bankruptcy. It just smells like you racked up debts with no intention of paying your bills. Eve-of-bankruptcy spending binges is really bad karma. Debts racked up in this manner may not get wiped out, and in extreme cases can cause your bankruptcy case to be rejected. Don't risk it.
Luxury purchases and credit cash advances are presumed fraudulent when they're made within 60 days of filing bankruptcy and total more than $1,150. For that reason, putting bankruptcy attorney fees on your credit card (even as a cash advance) isn't a good idea.
MY ADVICE endeavors at keen.com. The number is 1-800-275-5336 (800-ask-keen) + ext. 0329063 for tech stuff, 0329117 for running a small business, and 0329144 on investing. Want to CHAT, I use Yahoo's IM as the_web_ster. View me in the Friends & Family part of webcamnow.com, just click on "view cams", then in the Java window click on WebcamNow Communities drop down arrow & select Friends & Family. Under the live webcams look for & click on me "the_webster".
Vicious Worm Infects Without Attachment
A handful of Bagle worm variants are attacking Windows users with an insidious new twist: They can infect computers without tricking them into opening a file attachment -- opening an e-mail is all it takes.
When a user open an e-mail carrying one of these new Bagle variants, the e-mail "goes back out to the Internet and tries to find a certain server that has the Bagle executable on it and bring it down through HTTP," Belthoff said.
The full story
But if you don't use outlook your alot safer. That's why I use Yahoo. You open your mail on THEIR computers not yours. At lease that's it was. God only knows, now that you don't even have to open the damn attachments, if that well last or stand up. Don't forget to put a ROUTER inbetween your computer and your modem if your using Broadband. Not that a router well help your if you open your mail on your own computer but it well stop others from getting into your computer. Good luck!
MY ADVICE endeavors at keen.com. The number is 1-800-275-5336 (800-ask-keen) + ext. 0329063 for tech stuff, 0329117 for running a small business, and 0329144 on investing. Want to CHAT, I use Yahoo's IM as the_web_ster. View me in the Friends & Family part of webcamnow.com, just click on "view cams", then in the Java window click on WebcamNow Communities drop down arrow & select Friends & Family. Under the live webcams look for & click on me "the_webster".
