December 30, 2012
Because I keep hearing about this
And it's a wave of people getting hit with virus infected computers again. Not sure why, but it seems to go in spurts. (at least the reportage of such things does). If you run a windows machine, what is the best way to try and keep your computer from becoming minced-meat?
I'm sure there are people out there who will give you all kinds of advice and say what I tell you is a load of crap. The virus/trojan landscape is always changing and every geek has their opinion (which they insist is the only correct opinion ever). People develop attachments to various ways to try and stay safe, whether or not those ways actually work. They seem to "know" this is the best way. Okay fine. I'll tell you what I think. You may take it or leave it. Up to you.
I spread this out over a few posts. Mainly because I don't want one post to get too long.
Let's start with Antivirus software (AV).
First you must understand that no AV product will keep you safe. Many people seem to think that just because they have AV on their system, they are set. Unfortunately that is completely untrue. AV will protect you from KNOWN viruses. The key here is the word "known". It will not protect you from the unknown. It will not protect you from new viruses that haven't had signatures uploaded. (there are 10's of thousands of new viruses released every day). The value in AV is in stopping the older stuff from getting your system because the old stuff is still floating around the net, even stuff from the 1990's is still out there.
So what is the best AV? There isn't one. At any given point in time, one AV product will outperform the others. But all of them will be behind on virus signature updates.
What you want is something that won't degrade the performance of your machine and won't be annoying you with popups while you try to browse the web.
The best in this category is Microsoft Security Essentials. Yes, Microsoft have actually done this right. It updates with system updates, it doesn't get in the way. It does the job it's supposed to do without interfering.
Other AV products like AVG and Avast are okay. You can get free versions, but they tend to slow everything down and become annoying when they try to make you upgrade to the paid version. They don't give you any better protection than MSE.
Unless you work in IT and/or must use it for work purposes, stay well away from McAfee and Symantec. Both of these are resource hogs. Unless you have a fast machine with plenty of RAM, they will slow you to a crawl and can be worse than having a virus on your system. They often will not let you easily install new software. And upon updating they will even change settings you have created (for example, if you set up to allow a vpn through, an update might just turn that off causing much angst while you try to figure out what happened). Worse yet, to get these AV products off your system you have to download a removal tool and use that. Very very annoying!
So there you go. My opinion on AV. Understand what it will and won't do for you and you will be a bit safer.
Next up: Malwarebytes
I'm sure there are people out there who will give you all kinds of advice and say what I tell you is a load of crap. The virus/trojan landscape is always changing and every geek has their opinion (which they insist is the only correct opinion ever). People develop attachments to various ways to try and stay safe, whether or not those ways actually work. They seem to "know" this is the best way. Okay fine. I'll tell you what I think. You may take it or leave it. Up to you.
I spread this out over a few posts. Mainly because I don't want one post to get too long.
Let's start with Antivirus software (AV).
First you must understand that no AV product will keep you safe. Many people seem to think that just because they have AV on their system, they are set. Unfortunately that is completely untrue. AV will protect you from KNOWN viruses. The key here is the word "known". It will not protect you from the unknown. It will not protect you from new viruses that haven't had signatures uploaded. (there are 10's of thousands of new viruses released every day). The value in AV is in stopping the older stuff from getting your system because the old stuff is still floating around the net, even stuff from the 1990's is still out there.
So what is the best AV? There isn't one. At any given point in time, one AV product will outperform the others. But all of them will be behind on virus signature updates.
What you want is something that won't degrade the performance of your machine and won't be annoying you with popups while you try to browse the web.
The best in this category is Microsoft Security Essentials. Yes, Microsoft have actually done this right. It updates with system updates, it doesn't get in the way. It does the job it's supposed to do without interfering.
Other AV products like AVG and Avast are okay. You can get free versions, but they tend to slow everything down and become annoying when they try to make you upgrade to the paid version. They don't give you any better protection than MSE.
Unless you work in IT and/or must use it for work purposes, stay well away from McAfee and Symantec. Both of these are resource hogs. Unless you have a fast machine with plenty of RAM, they will slow you to a crawl and can be worse than having a virus on your system. They often will not let you easily install new software. And upon updating they will even change settings you have created (for example, if you set up to allow a vpn through, an update might just turn that off causing much angst while you try to figure out what happened). Worse yet, to get these AV products off your system you have to download a removal tool and use that. Very very annoying!
So there you go. My opinion on AV. Understand what it will and won't do for you and you will be a bit safer.
Next up: Malwarebytes
Posted by: Teresa in
WebTech
at
12:04 PM
| Comments (8)
| Add Comment
Post contains 581 words, total size 4 kb.
December 02, 2012
Those Scary Moments
After taking back the Home Phone Connect device that was not working properly, I noticed our entire home network was now having problems. I figure the device must have caused some sort of issue with our router or modem... the problems stem from the day I started using the device.
My iphone was having all sorts of problems sending and receiving messages whether I was using the wifi or the cell system (even after doing a restart). There was too much lag time on my regular computers when browsing the net. It just wasn't right.
So this morning I decided to reboot all the network devices. Because my days are not exciting enough.
The network stuff entails just a little bit of work in my house. Unplug the cable modem, unplug the wireless router, go upstairs, contort oneself behind the sofa, unplug the cell phone mini-tower and it's wireless connector. Then go back and start plugging them back in - in order. Let them each cycle through the restart procedure and it works... or not.
Yes, it's always good heart exercise to see that message telling you the router does not see the internet".
What? All the lights are up and good to go. What's up? Trying to connect directly to the modem is also a no go.
Jolly good.
Ended up having to restart the modem a couple of times. Then the wireless connector for the mini-tower refuse to start at all. It's totally dead.
I can hear Bones saying it now:
"It's dead Jim!"
Luckily I had an exact duplicate of the wireless connector for the mini-tower. (thank you credit card points that were burning a hole in my pocket and saying "use me now before they change their mind and take them away!")
Eventually, after much quick thinking of "where can I buy a new..." and "I wonder how much this will cost to replace..." and "how soon can I get hold of this stuff???". I had the network back up and online. It's running MUCH better.
I do need to buy a new wireless connector as a backup for my cell phone mini-tower. Just in case the current connector decides to take a nose dive too.
Ah the joys of home networks. Considering this is a tiny home network, if you extrapolate this problem to world wide large networks, it's a wonder the internet works at all. Ever.
My iphone was having all sorts of problems sending and receiving messages whether I was using the wifi or the cell system (even after doing a restart). There was too much lag time on my regular computers when browsing the net. It just wasn't right.
So this morning I decided to reboot all the network devices. Because my days are not exciting enough.
The network stuff entails just a little bit of work in my house. Unplug the cable modem, unplug the wireless router, go upstairs, contort oneself behind the sofa, unplug the cell phone mini-tower and it's wireless connector. Then go back and start plugging them back in - in order. Let them each cycle through the restart procedure and it works... or not.
Yes, it's always good heart exercise to see that message telling you the router does not see the internet".
What? All the lights are up and good to go. What's up? Trying to connect directly to the modem is also a no go.
Jolly good.
Ended up having to restart the modem a couple of times. Then the wireless connector for the mini-tower refuse to start at all. It's totally dead.
I can hear Bones saying it now:
"It's dead Jim!"
Luckily I had an exact duplicate of the wireless connector for the mini-tower. (thank you credit card points that were burning a hole in my pocket and saying "use me now before they change their mind and take them away!")
Eventually, after much quick thinking of "where can I buy a new..." and "I wonder how much this will cost to replace..." and "how soon can I get hold of this stuff???". I had the network back up and online. It's running MUCH better.
I do need to buy a new wireless connector as a backup for my cell phone mini-tower. Just in case the current connector decides to take a nose dive too.
Ah the joys of home networks. Considering this is a tiny home network, if you extrapolate this problem to world wide large networks, it's a wonder the internet works at all. Ever.
Posted by: Teresa in
WebTech
at
02:10 PM
| Comments (5)
| Add Comment
Post contains 405 words, total size 3 kb.
September 21, 2012
Internet Explorer and iOS 6 Maps
A couple of things you should know.
There is a huge security hole in Internet Explorer. Microsoft has even gone so far as to release what is called an "out of cycle patch" for it. So please run Windows Update if you use a Windows machine. Thank you!
Then, if you will be using Apple's iOS 6 with either your iPhone or iPad you may find you don't like the new Apple Maps which seem to be not quite ready for prime time. If you would like to go back to using google maps, Don McAlister has done a quick tutorial to make it very easy.
Have a great weekend. Happy surfing and driving!
Posted by: Teresa in
WebTech
at
02:18 PM
| Comments (6)
| Add Comment
Post contains 120 words, total size 1 kb.
September 18, 2012
Attention Internet Explorer Users
You may want to reconsider which browser you use. There is currently a honking huge zero day exploit. (this is a big security hole in the browser that is not patched but it is currently being exploited).
So take your choice... if you can possibly do it, use Firefox, Safari, Opera, or Chrome at least until this is patched.
If you must use IE for whatever reason and you are not on IE 10, then please read this by Brian Krebs:
This has been your public service announcement for the day.
Posted by: Teresa in
WebTech
at
09:56 AM
| No Comments
| Add Comment
Post contains 101 words, total size 1 kb.
August 06, 2012
Security Tip of the Week: BACK UP YOUR DATA
With all the news of hackers, crackers, viruses, worms, among all the monsters that hide under the bed... the one security tip that can not be stated too often or too loudly:
Back up your data!
I know there are people reading this who do back up, there are those reading who think, "yeah I should do that". And there are those who think... "well I'd like to, but who's going to pay for it?" And there are those who think we're all just paranoid losers. Whatever. I can only tell you, it's up to you to actually do it.
First of all - go read this story.
Okay did you read it? Do you see what I mean? The first line of defense against hacking is to back up your data. In several places if possible.
Apple and Amazon should have 2 factor authentication. If google can implement such a thing, so can these guys. But they don't have it and it doesn't look like it's coming soon. Which means, if a hacker takes a liking to something you have or a company you do business with, you will be caught in the fall out to prove a point.
So what to do.
Let's start at the higher end. If you can afford an online backup service, that's one backup type accounted for. I use crashplan. I like them because you can get your first major upload of data to them via a hard drive. Then you don't have to spend days, weeks, or months letting your stuff upload in the background. You can also get your data returned in the same way. They seem to be reliable and this is good. There are other plans out there, google to find them and certainly to read reviews!
While that's a good option for some, it doesn't work for everyone for various reasons, so on to the next option. Buy a couple of hard drives. Yes, two of them. Either clone your entire OS onto them, or get some backup software going (like time machine for mac or sync toy for windows) and backup the files you really want to keep.
You wonder why I say 2 drives? Because you should have at least 2 backups and one should be out of your house (in a safe deposit box, with a family member or friend you trust) in case the house itself has a disaster, you can get most of your stuff back.
Then we have the Cloud Storage type of places. This wouldn't be for full backups, it would be more in line with keeping copies of files you don't want to lose and/or want to access no matter where you are in the world. Ars Technica gives you the details in this article. You could open accounts at several of these places and have stuff stashed all around the web. Just make sure you remember where you put it. Also, I would NOT recommend putting anything in any of them that is personal, private information. No tax stuff, no banking stuff, don't do it! These would be for stuff you don't want to lose, but is not private. (Dropbox recently was hacked through an employee account - no matter how good you are about passwords, etc, it won't save you from hackers getting in the back end and getting at your data!)
Most of us though are concerned about our photos. We have many many photos and we don't want to lose them. This is where photo services come into play. If you want to pay a provider, there are a number out there. I prefer Smugmug because I like their management of photos stored on their site. Flickr is about $25 a year for a pro account and is a yahoo company. Free would be Picasa from google. You have to keep an eye on where you store your photos (and maybe have them in a couple of places) in case the site disappears. But your chances are better if you have your stuff in more than one spot (your computer or backup disk AND online too).
I hope this gets you thinking of a backup strategy. Being a blog post I didn't want to get too much into details of stuff, just point out what's there. It's really sad to lose all your data, so try to fix things before it happens to you.
*** yes I know I have "back up" and "backup" in this post but I'm too tired to go through and change it. heh. If only spell check would decide it didn't like one of the spellings, life would be much easier.
*** yes I know I have "back up" and "backup" in this post but I'm too tired to go through and change it. heh. If only spell check would decide it didn't like one of the spellings, life would be much easier.
Posted by: Teresa in
WebTech
at
10:35 PM
| Comments (4)
| Add Comment
Post contains 800 words, total size 5 kb.
August 02, 2012
Outlook is the new Hotmail
So it looks like Microsoft has decided to ditch the Hotmail brand.
I guess I'm rather surprised they stuck with it this long. Hotmail does not have a good name among email clients going way back. I think I had an account for a while about 10 years ago, but shut it down because I didn't like it.
For anyone who was not aware the change was coming, it would be a shock to log in and have the page redirected. (can we say - OMG I got a virus!!! anyone?). No, not a virus. Whew.
It looks like new users won't be able to get a hotmail.com account, they'll be assigned an outlook.com account. Not sure why anyone opening a new account would care about this. If they wanted a hotmail account specifically, I would think they'd have one already. Current hotmail users can change to the new outlook.com if they want, sounds like it's optional.
Although old users will be able to keep their current hotmail addresses, (so you won't have to tell everyone on your mail list that you have a new email and then worry half of them won't figure it out. heh.) I can see them making a force change in a few years to get rid of the old hotmail.com completely. We'll see.
As for the new domain, I foresee some problems with outlook.com. I can see people who are not exactly tech savvy just adding outlook.com to everyone's name and mailing stuff out because the office they work in uses outlook... oh yes, I can so see this. (Tech people prepare for the complaints!).
It sounds like they are trying to give people the outlook experience on the web in hopes people will want to buy Outlook for their own machines. Or maybe it's all altruism... I don't know. But if the tools work and you like them, it's all good.
For anyone afraid they've lost their stuff - it should all still be there as the article explains. I hope the less techy oriented hotmail users have enough tech savvy people around them to help them find it all.
Only time will tell if this a change is useful, but as with all change, it will be painful for many. In the meantime, Microsoft may end up improving the overall image of their email service. We shall see.
Posted by: Teresa in
WebTech
at
02:24 PM
| Comments (3)
| Add Comment
Post contains 407 words, total size 3 kb.
July 28, 2012
Windows Sidebar and Gadgets
Attention all Windows Vista and Windows 7 users. Do you use the Sidebar and Gadgets feature? If so check this out.
This was one of the talks at Black Hat this week which means the exploit has been published and is well known all over the hacker world by now (if it wasn't known prior to the talk).
I don't use it, but I assume there are people who do and I can almost hear them saying... yeah... so??? I already have my gadgets so I just won't add any more.
The problem is, there are ways to exploit existing gadgets you already have installed. That makes it very nasty indeed as it's not just a case of installing a bad gadget.
What should be even more of an impetus... Microsoft's "fix" involves disabling the feature completely. That's not something they do very often when confronted with a possible security exploit on their systems.
No, they aren't even going to try and fix it. This means the underlying gadget code is such that it's not a fixable problem without breaking the system completely. Oops.
There is a link to Microsoft's fix page for this from the article above. I would recommend applying the fix even if you don't use the Sidebar/Gadget feature. Just an extra precaution.
Posted by: Teresa in
WebTech
at
11:44 AM
| Comments (12)
| Add Comment
Post contains 236 words, total size 2 kb.
June 20, 2012
Got a Smart Phone?
The latest and greatest scare tactic to part you from your money is now hitting smart phones.
Beware Scare Tactics for Mobile Security Apps
Okay you read it right? Well, stop here, go read... I'll wait.
Now you skimmed it, you saw the word "android", and decided it's not a problem because you have an iphone...
Here's the deal. This is being served up via the browser. This means it could hit your phone or tablet no matter which mobile platform you use, no matter what sites your browse. Yes, "good" sites have ads and reputable sites have served up malware ads.
It's a scam of course. Please do not click on anything, do not give them any info, especially credit card info! But you don't even want to give them your email address. Hijackers should get nothing from their efforts.
With an iphone you can shrink it to a tile and then close it. Not sure what the android platform offers but would assume something similar.
If you read down in the article, Brian has more tips for safe browsing on your smart phone (which includes all tablets). I agree with him. You have to be thinking when you are browsing. Using your brain is the best way to keep crapware off your systems period.
Better yet, go read this
Krebs’s 3 Basic Rules for Online Safety
He's a smart guy and he knows what he's talking about. It's worth a few minutes of your time to read these articles as they may save you hours of grief later.
Happy surfing - mobile or otherwise.
Beware Scare Tactics for Mobile Security Apps
Okay you read it right? Well, stop here, go read... I'll wait.
Now you skimmed it, you saw the word "android", and decided it's not a problem because you have an iphone...
Here's the deal. This is being served up via the browser. This means it could hit your phone or tablet no matter which mobile platform you use, no matter what sites your browse. Yes, "good" sites have ads and reputable sites have served up malware ads.
It's a scam of course. Please do not click on anything, do not give them any info, especially credit card info! But you don't even want to give them your email address. Hijackers should get nothing from their efforts.
With an iphone you can shrink it to a tile and then close it. Not sure what the android platform offers but would assume something similar.
If you read down in the article, Brian has more tips for safe browsing on your smart phone (which includes all tablets). I agree with him. You have to be thinking when you are browsing. Using your brain is the best way to keep crapware off your systems period.
Better yet, go read this
Krebs’s 3 Basic Rules for Online Safety
He's a smart guy and he knows what he's talking about. It's worth a few minutes of your time to read these articles as they may save you hours of grief later.
Happy surfing - mobile or otherwise.
Posted by: Teresa in
WebTech
at
11:58 AM
| Comments (1)
| Add Comment
Post contains 270 words, total size 2 kb.
June 19, 2012
Authenticate Yourself - with slight updatey goodness
Authentication - Part 1
I've been dragging my feet on this for quite a while (over a year which is quite a bit of time). Today I finally set up Two Factor Authentication on my Google account.
When it was first introduced, I was waiting to see if it would all go wrong. After all, new stuff fails all the time in unexpected ways. Then after a while I was simply paranoid and figured I didn't have time to unwind the mess if I locked myself out of my own email. Thus I let it ride and ride. heh.
Of course I'm not at a hugely high risk of having my account compromised. I don't log in from public terminals. I don't use the same password everywhere. I don't do any app that wants my email password to "tell all my friends". Yada, Yada, Yada. It doesn't make me totally safe, but safer than a goodly number of people.
Then I would forget about it because it was too fatiguing to keep trying to remember it. For some reason something reminded me today and I decided to look into it more closely. It looks simple enough... but I'm always looking for the catch. The thing I will forget until I get into the middle of something and suddenly I'm stuck.
I watched the video a couple of times and then took the plunge. And... it all worked beautifully. I have to say I was shocked.
The premise, for those who don't know: you log in with your username/password then you get a second screen and have to enter a special 6 character number sent to you by google. You can have google either send this number to you via a text message or they can call and give it to you via a voice message. (there is a time limit of course so you have to be ready to enter the number when you get it).
Once you are logged into the website portion, you can set up a special password for any of your applications that need to access google - so Outlook, Mail.app, Picasa, iphone mail, ipad mail, etc etc. They go over all of it. The only surprise was the G+ app on my iphone - that actually does the Two Factor Auth instead of the special password.
They even give you special numbers you can print and save them for an emergency. If you need to get things changed but don't have your phone or you're traveling in a foreign country that kind of thing.
Last of all, if you have a smart phone, they have an app that will generate these numbers with or without an internet connection. I'm not sure if that's a good thing or not... can't decide since it's fairly easy to lose your phone.
However, this makes it very easy to de-authorize a phone or tablet or laptop if it is lost.
So I would give this a "yes" if you have a google account. Watch the video a couple of times. Have your cell phone with you (or your landline if you want to do a voice number - you are not supposed to use google voice for this!!!). And turn it on. You do have to reauthorize your home computer for web access every 30 days, but this is far better than trying to get help from google if your account is compromised. The apps do not need to be reauthorized unless there is a problem.
*** UPDATE: when setting up a mail program, hang onto the password they give you until you have done a test send/receive of an email. With gmail you have to authenticate to get mail and to send mail so make sure you've done both and saved the password in both places or you'll have to go back, revoke the current password and do it all again. Just a minor annoyance.
***
Authentication - Part 2
Here's an iphone tip I just heard recently. I can't remember where (drat - because I like to give kudos to people who have good tips!)
Using the simple passcode of a 4 character pin is pretty trivial to overcome, but who wants to be typing in a long passcode on that bitty keyboard? Next best thing on an iphone (and who knows it might work on androids too). Go into Passcode Lock in your settings. Turn off the Simple Passcode. Now when you turn on the Passcode Lock, go to the numbers and enter a number longer than 4 characters. That's it. When you go to unlock the phone, it will give you only the number pad because you only entered numbers.... just more than 4. It's marginally safer than the simplest of passcodes and easier to type too.
Those are today's safety tips. FWIW.
I've been dragging my feet on this for quite a while (over a year which is quite a bit of time). Today I finally set up Two Factor Authentication on my Google account.
When it was first introduced, I was waiting to see if it would all go wrong. After all, new stuff fails all the time in unexpected ways. Then after a while I was simply paranoid and figured I didn't have time to unwind the mess if I locked myself out of my own email. Thus I let it ride and ride. heh.
Of course I'm not at a hugely high risk of having my account compromised. I don't log in from public terminals. I don't use the same password everywhere. I don't do any app that wants my email password to "tell all my friends". Yada, Yada, Yada. It doesn't make me totally safe, but safer than a goodly number of people.
Then I would forget about it because it was too fatiguing to keep trying to remember it. For some reason something reminded me today and I decided to look into it more closely. It looks simple enough... but I'm always looking for the catch. The thing I will forget until I get into the middle of something and suddenly I'm stuck.
I watched the video a couple of times and then took the plunge. And... it all worked beautifully. I have to say I was shocked.
The premise, for those who don't know: you log in with your username/password then you get a second screen and have to enter a special 6 character number sent to you by google. You can have google either send this number to you via a text message or they can call and give it to you via a voice message. (there is a time limit of course so you have to be ready to enter the number when you get it).
Once you are logged into the website portion, you can set up a special password for any of your applications that need to access google - so Outlook, Mail.app, Picasa, iphone mail, ipad mail, etc etc. They go over all of it. The only surprise was the G+ app on my iphone - that actually does the Two Factor Auth instead of the special password.
They even give you special numbers you can print and save them for an emergency. If you need to get things changed but don't have your phone or you're traveling in a foreign country that kind of thing.
Last of all, if you have a smart phone, they have an app that will generate these numbers with or without an internet connection. I'm not sure if that's a good thing or not... can't decide since it's fairly easy to lose your phone.
However, this makes it very easy to de-authorize a phone or tablet or laptop if it is lost.
So I would give this a "yes" if you have a google account. Watch the video a couple of times. Have your cell phone with you (or your landline if you want to do a voice number - you are not supposed to use google voice for this!!!). And turn it on. You do have to reauthorize your home computer for web access every 30 days, but this is far better than trying to get help from google if your account is compromised. The apps do not need to be reauthorized unless there is a problem.
*** UPDATE: when setting up a mail program, hang onto the password they give you until you have done a test send/receive of an email. With gmail you have to authenticate to get mail and to send mail so make sure you've done both and saved the password in both places or you'll have to go back, revoke the current password and do it all again. Just a minor annoyance.
***
Authentication - Part 2
Here's an iphone tip I just heard recently. I can't remember where (drat - because I like to give kudos to people who have good tips!)
Using the simple passcode of a 4 character pin is pretty trivial to overcome, but who wants to be typing in a long passcode on that bitty keyboard? Next best thing on an iphone (and who knows it might work on androids too). Go into Passcode Lock in your settings. Turn off the Simple Passcode. Now when you turn on the Passcode Lock, go to the numbers and enter a number longer than 4 characters. That's it. When you go to unlock the phone, it will give you only the number pad because you only entered numbers.... just more than 4. It's marginally safer than the simplest of passcodes and easier to type too.
Those are today's safety tips. FWIW.
Posted by: Teresa in
WebTech
at
11:08 PM
| No Comments
| Add Comment
Post contains 815 words, total size 5 kb.
June 14, 2012
Patchy - Patchy
Microsoft has released its monthly patches. Java has released a huge patch recently (I found I did need to keep Java on my machines because of a printer that uses it - irritating). Also Adobe Flash has updated. Check on all of them on your system if you have Windows machines.
Apple sent out the Java patch just yesterday. And Adobe Flash updated although flash updates through the browser rather than through Apple.
So there you go. Check your updates and be sure they are done. This makes you and others safer since it keeps your system from being easily hijacked by known issues.
As for me, I've been patching work computers which is tedious and about like watching grass grow, but it must be done and has to be supervised. Such is life in computerland.
Apple sent out the Java patch just yesterday. And Adobe Flash updated although flash updates through the browser rather than through Apple.
So there you go. Check your updates and be sure they are done. This makes you and others safer since it keeps your system from being easily hijacked by known issues.
As for me, I've been patching work computers which is tedious and about like watching grass grow, but it must be done and has to be supervised. Such is life in computerland.
Posted by: Teresa in
WebTech
at
10:10 AM
| Comments (2)
| Add Comment
Post contains 139 words, total size 1 kb.
June 06, 2012
LinkedIn Woes
Today is LinkedIn's day in the spotlight of computer security. Not a joyful day so far either.
First we have a tweet from Brian Krebs
So if you use LinkedIn - go change your password. If you are using the same password for your email account - change that too (to a DIFFERENT password than you are using for LinkedIn please!)
They are still trying to confirm whether or not something happened. But changing a password is easy to do and less bothersome than finding out later that someone did get your password and is now causing trouble for you.
Then to continue on this same theme I saw this at Ars Technica
Your iPhone calendar isn't private—at least if you use the LinkedIn app
I had heard a while back that the LinkedIn app was sending the login password in the clear. Since I don't use LinkedIn enough to have an app for it, I didn't bother thinking much about that bit of info. Now it seems the app is doing even more fun stuff. It is scraping your calendar for information even if the calendar item has nothing to do with LinkedIn... awesome!
I would say - give LinkedIn apps a wide berth for a while. Even if they are Android apps. They are looking at iphone apps, but just because no one is talking about the Android counterparts does not make them safe.
Yeah, not such a hot day for LinkedIn.
First we have a tweet from Brian Krebs
Still no confirmation from LinkedIn, but it's a good idea to change your password now if you use this service http://bit.ly/LqCjK4
So if you use LinkedIn - go change your password. If you are using the same password for your email account - change that too (to a DIFFERENT password than you are using for LinkedIn please!)
They are still trying to confirm whether or not something happened. But changing a password is easy to do and less bothersome than finding out later that someone did get your password and is now causing trouble for you.
Then to continue on this same theme I saw this at Ars Technica
Your iPhone calendar isn't private—at least if you use the LinkedIn app
I had heard a while back that the LinkedIn app was sending the login password in the clear. Since I don't use LinkedIn enough to have an app for it, I didn't bother thinking much about that bit of info. Now it seems the app is doing even more fun stuff. It is scraping your calendar for information even if the calendar item has nothing to do with LinkedIn... awesome!
I would say - give LinkedIn apps a wide berth for a while. Even if they are Android apps. They are looking at iphone apps, but just because no one is talking about the Android counterparts does not make them safe.
Yeah, not such a hot day for LinkedIn.
Posted by: Teresa in
WebTech
at
11:17 AM
| Comments (3)
| Add Comment
Post contains 267 words, total size 2 kb.
May 27, 2012
Do you participate in social media?
If you participate in social media, or your kids do, or you know other people who do (that you care about), you might want to have a listen to at least part of this podcast from Risky Business. It's one of my favorite security podcasts.
The Zetas Cartel and social media
It's rather scary stuff, but better to know what you are facing than to be totally unaware... at least in my world.
The podcast starts with an introduction and Patrick giving an overview of the show. Then there is security news. I like that part very much, but it may not be your cup of tea, so if you want to skip to the presentation about the Zetas, go to minute 21 in the podcast and start from there.
Last of all Patrick talks to Brad Arkin from Adobe about their efforts in fixing code to prevent malware attacks. I have to say, after listening to Brad speak with Patrick on several shows, I have revised my poor opinion of Adobe and their patching practices. They are making a concerted effort to fix their code and get patches out in a timely manner. Kudos to them and to Brad for being such a wonderfully articulate spokesperson.
The Zetas Cartel and social media
It's rather scary stuff, but better to know what you are facing than to be totally unaware... at least in my world.
The podcast starts with an introduction and Patrick giving an overview of the show. Then there is security news. I like that part very much, but it may not be your cup of tea, so if you want to skip to the presentation about the Zetas, go to minute 21 in the podcast and start from there.
Last of all Patrick talks to Brad Arkin from Adobe about their efforts in fixing code to prevent malware attacks. I have to say, after listening to Brad speak with Patrick on several shows, I have revised my poor opinion of Adobe and their patching practices. They are making a concerted effort to fix their code and get patches out in a timely manner. Kudos to them and to Brad for being such a wonderfully articulate spokesperson.
Posted by: Teresa in
WebTech
at
12:41 PM
| No Comments
| Add Comment
Post contains 213 words, total size 1 kb.
May 10, 2012
Let's Talk Passwords - now updated with a significant point
I was just reading a lament by a friend on Facebook who had accounts compromised because of weak passwords. Therefore, you lucky readers now get an entire post on passwords. Aren't you thrilled! Okay - don't throw things at me.
Let me first state - this does not begin to cover everything to do with the subject at hand. It's just a blog post not a dissertation (although some of you may be wishing for a simple dissertation before I'm done and others stamping in a rage because I "forgot" something important). Consider it a glancing blow pointing out a few items that might help you stay a bit safer online. The vast majority of information will be omitted. That's life.
Passwords. What can we say about passwords? Well, the entirety of the username/password type of access system sucks. Period. It completely and totally sucks pond water. That will not change in the near future much as we all hate it. Until computers evolve enough to find better ways to know "we are who we say we are", we have to deal with it. This post won't be about better ways to do it. Those topics are fun to talk about but completely irrelevant to this discussion. We have to work with what we've got the best way we can.
So what's the number one problem with passwords? Remembering them. If you forget, you either give it up in disgust or you have to jump through hoops to get back in the system. We hate hoops. They waste time and cause massive irritation. We just want things to work. That is the entire problem in a nutshell.
So, what do people do about this? When they are at home and are not under the tyranny of computer security people at work, they go for the easiest solution. Pick a password that is memorable and use it everywhere. This would be what I call: Huge ass mistake number 1.
Here's one list of
The 25 worst passwords of 2011
Do you use any of these? Yeah? You might want to consider changing things in that case... just sayin'...
Everyone wants things to be easy. Security is not easy. It's a huge wet smelly blanket thrown over all the fun in life. If it was easy, this post wouldn't be necessary.
Let us move on to:
Huge ass mistake number 2. No one will know.
Ah yes, the "obscurity factor". No one will know what I choose for a password, they aren't sitting here, they can't see me type it. They can't possibly know so how could they guess? There's no way they can figure it out, it's not even a real "dictionary" word. (here's a hint: the hackers don't figure it out - they let computer tools figure it out - way easier)
It really is a toss up as to which of the 2 huge ass mistakes listed above are the worst. Both are parts of human nature and both make it very easy for people to totally ignore any advice that might help keep them safer online. Because... really... can't we all find something better to do with our limited free time? Like there is always a good excuse not to workout at the gym, there is always a good excuse to not to "worry" about passwords we use.
Of course, there is another difficulty. Even if you take as many precautions as possible, bad guys can still manage to make your life a misery. They have the advantage. They only need to find one way in, you have to block all ways in. Not fair and very tiring, but there it is. We're at a disadvantage before we start. Even people who are very good and try to do everything right can be "gotten" by a bad guy (especially if they are specifically targeted). So why should you make an effort? Because:
You don't want to be the low hanging fruit.
If the bad guys really want to get you, make them work for it! You don't want them to steal a username/password database like the RockYou data breach or the Gawker data breach, take that info and start trying to apply it to email accounts, credit card companies, or banks.
Since most username/password combos are email address/password, the first thing an intelligent hacker would do is try to use what they have to log into your email account. If you are a person who uses the same password everywhere - voilà! They're in. From there they can peruse your email and check out your bills and bank notices to figure out what to hit next. Simple.
To that end, let's go with some tips to help you fix your passwords. Let's start with where you'll keep them so you don't forget.
1. A database just for passwords.
Because it's best if you have a different password for every site where you log in, remembering becomes next to impossible. That's where a password database shines. You can use apps like 1Password (my preferred) or LastPass among others to store your passwords safely. This way you don't have to remember anything except the one password to log into your password database. The database remembers everything else for you. The good ones can also generate good random passwords and keep track of password changes among other things.
2. A homemade spreadsheet option.
Okay you don't want to get a password safe, you can create your own spreadsheet to hold your information. Not exactly the safest way to do it, but certainly doable. Point in favor, you don't have to pay for anything. You could even use the basic notepad app every system comes with. However, it won't generate passwords for you and you will have to decide if you want encrypt the document in case your system is compromised or you lose your computer.
3. Stone Age - paper and pencil.
At the very least, decide what accounts are your most important. Banks, credit cards, utilities, email, social media (no one wants to try and unravel a breach through "facebook help" now do they?). List out the places you find the most important and make sure the passwords you use for each are different. Then you can use another single password for sites you don't consider important. Next, write them down in a notebook. If you don't leave the notebook at the local coffee shop, this could work for you.
UPDATE (by VW in the comments) The only thing I would add, is that you really should use one of the options you list and make sure your significant other knows what the 1pass is or the location of the spreadsheet or written paper.
How to create a decent password.
Ah - therein lies the rub. If you google it, you will get an endless list of helpful advice on how to create good passwords. What is unclear is exactly how good any of the advice might be.
Let's just go for an overall set of "rules", for lack of a better word, you can follow to create passwords that aren't quite so guessable by your roving hacker.
1. Check the website for any directions on what it will allow for passwords including length and types of characters. Some sites have major restrictions so create your password accordingly.
2. Length is your best bet. Go for between 10 to 15 characters if you can.
3. Use upper and lower case letters.
4. Use at least a couple of numbers.
5. If they allow it, use at least a couple of special characters such as !@#$%^_ ( or spaces.
But - how to remember it if you don't have a password database handy? If you create your own, the best thing is to use something like book titles or sentences from a favorite book and then embellish. (do not use family names, addresses, birthdates, that kind of thing)
A couple of examples might be like these I made up from Douglas Adam's Hitchhiker's Guide to the Galaxy
#D0n't^P4nick!
my_G@laxy-guiD3
Get creative. Look at it as a fun exercise.
As for changing passwords. There is some controversy there too. Once again it depends on your circumstances, who has access to your computer, that kind of thing. And let's be realistic, you are not going to change anything on a regular basis are you. Ha! Yes, I already know this.
If you ever think about changing passwords on important sites, when would be a good time? Maybe right after you've been traveling, every 6 months to a year, or if one of your accounts is "owned" that would be a good time to go through and change things. (as long as the attacker doesn't have access to your email account).
I think that covers the very very basics. It could be made much more complicated, but what would be the point? No one would do it then, just like they pretty much don't do it now.
For anyone still reading - congratulations. You deserve a medal for persevering to the end. Now that you've read this, think about it. If your current password strategy is the bare minimum, you can always improve it and save yourself some headaches later on. Or not. Up to you.
Now - you can go find something more fun to read.
Let me first state - this does not begin to cover everything to do with the subject at hand. It's just a blog post not a dissertation (although some of you may be wishing for a simple dissertation before I'm done and others stamping in a rage because I "forgot" something important). Consider it a glancing blow pointing out a few items that might help you stay a bit safer online. The vast majority of information will be omitted. That's life.
Passwords. What can we say about passwords? Well, the entirety of the username/password type of access system sucks. Period. It completely and totally sucks pond water. That will not change in the near future much as we all hate it. Until computers evolve enough to find better ways to know "we are who we say we are", we have to deal with it. This post won't be about better ways to do it. Those topics are fun to talk about but completely irrelevant to this discussion. We have to work with what we've got the best way we can.
So what's the number one problem with passwords? Remembering them. If you forget, you either give it up in disgust or you have to jump through hoops to get back in the system. We hate hoops. They waste time and cause massive irritation. We just want things to work. That is the entire problem in a nutshell.
So, what do people do about this? When they are at home and are not under the tyranny of computer security people at work, they go for the easiest solution. Pick a password that is memorable and use it everywhere. This would be what I call: Huge ass mistake number 1.
Here's one list of
The 25 worst passwords of 2011
Do you use any of these? Yeah? You might want to consider changing things in that case... just sayin'...
Everyone wants things to be easy. Security is not easy. It's a huge wet smelly blanket thrown over all the fun in life. If it was easy, this post wouldn't be necessary.
Let us move on to:
Huge ass mistake number 2. No one will know.
Ah yes, the "obscurity factor". No one will know what I choose for a password, they aren't sitting here, they can't see me type it. They can't possibly know so how could they guess? There's no way they can figure it out, it's not even a real "dictionary" word. (here's a hint: the hackers don't figure it out - they let computer tools figure it out - way easier)
It really is a toss up as to which of the 2 huge ass mistakes listed above are the worst. Both are parts of human nature and both make it very easy for people to totally ignore any advice that might help keep them safer online. Because... really... can't we all find something better to do with our limited free time? Like there is always a good excuse not to workout at the gym, there is always a good excuse to not to "worry" about passwords we use.
Of course, there is another difficulty. Even if you take as many precautions as possible, bad guys can still manage to make your life a misery. They have the advantage. They only need to find one way in, you have to block all ways in. Not fair and very tiring, but there it is. We're at a disadvantage before we start. Even people who are very good and try to do everything right can be "gotten" by a bad guy (especially if they are specifically targeted). So why should you make an effort? Because:
You don't want to be the low hanging fruit.
If the bad guys really want to get you, make them work for it! You don't want them to steal a username/password database like the RockYou data breach or the Gawker data breach, take that info and start trying to apply it to email accounts, credit card companies, or banks.
Since most username/password combos are email address/password, the first thing an intelligent hacker would do is try to use what they have to log into your email account. If you are a person who uses the same password everywhere - voilà! They're in. From there they can peruse your email and check out your bills and bank notices to figure out what to hit next. Simple.
To that end, let's go with some tips to help you fix your passwords. Let's start with where you'll keep them so you don't forget.
1. A database just for passwords.
Because it's best if you have a different password for every site where you log in, remembering becomes next to impossible. That's where a password database shines. You can use apps like 1Password (my preferred) or LastPass among others to store your passwords safely. This way you don't have to remember anything except the one password to log into your password database. The database remembers everything else for you. The good ones can also generate good random passwords and keep track of password changes among other things.
2. A homemade spreadsheet option.
Okay you don't want to get a password safe, you can create your own spreadsheet to hold your information. Not exactly the safest way to do it, but certainly doable. Point in favor, you don't have to pay for anything. You could even use the basic notepad app every system comes with. However, it won't generate passwords for you and you will have to decide if you want encrypt the document in case your system is compromised or you lose your computer.
3. Stone Age - paper and pencil.
At the very least, decide what accounts are your most important. Banks, credit cards, utilities, email, social media (no one wants to try and unravel a breach through "facebook help" now do they?). List out the places you find the most important and make sure the passwords you use for each are different. Then you can use another single password for sites you don't consider important. Next, write them down in a notebook. If you don't leave the notebook at the local coffee shop, this could work for you.
UPDATE (by VW in the comments) The only thing I would add, is that you really should use one of the options you list and make sure your significant other knows what the 1pass is or the location of the spreadsheet or written paper.
How to create a decent password.
Ah - therein lies the rub. If you google it, you will get an endless list of helpful advice on how to create good passwords. What is unclear is exactly how good any of the advice might be.
Let's just go for an overall set of "rules", for lack of a better word, you can follow to create passwords that aren't quite so guessable by your roving hacker.
1. Check the website for any directions on what it will allow for passwords including length and types of characters. Some sites have major restrictions so create your password accordingly.
2. Length is your best bet. Go for between 10 to 15 characters if you can.
3. Use upper and lower case letters.
4. Use at least a couple of numbers.
5. If they allow it, use at least a couple of special characters such as !@#$%^_ ( or spaces.
But - how to remember it if you don't have a password database handy? If you create your own, the best thing is to use something like book titles or sentences from a favorite book and then embellish. (do not use family names, addresses, birthdates, that kind of thing)
A couple of examples might be like these I made up from Douglas Adam's Hitchhiker's Guide to the Galaxy
#D0n't^P4nick!
my_G@laxy-guiD3
Get creative. Look at it as a fun exercise.
As for changing passwords. There is some controversy there too. Once again it depends on your circumstances, who has access to your computer, that kind of thing. And let's be realistic, you are not going to change anything on a regular basis are you. Ha! Yes, I already know this.
If you ever think about changing passwords on important sites, when would be a good time? Maybe right after you've been traveling, every 6 months to a year, or if one of your accounts is "owned" that would be a good time to go through and change things. (as long as the attacker doesn't have access to your email account).
I think that covers the very very basics. It could be made much more complicated, but what would be the point? No one would do it then, just like they pretty much don't do it now.
For anyone still reading - congratulations. You deserve a medal for persevering to the end. Now that you've read this, think about it. If your current password strategy is the bare minimum, you can always improve it and save yourself some headaches later on. Or not. Up to you.
Now - you can go find something more fun to read.
Posted by: Teresa in
WebTech
at
07:47 PM
| Comments (10)
| Add Comment
Post contains 1573 words, total size 10 kb.
April 15, 2012
When in doubt start pointing fingers
Well it looks like Google is in a bit of hot water with the government
Google fined $25,000 for impeding FCC investigation
That's it? Twenty-five thou is not even pocket change for this company, it's more like pocket lint. They lose more than this between the cracks of the server farm frames every day.
In their infinite wisdom, The Goog has decided they are not turning anything over to the eeeevil US government merely because some of their more zealous employees broke a little bitty law. Pish and tush!
After all they are only following the dictum of Eric Schmidt their executive chairman.
Which, it seems, the company took to include the collection of your username and password along with other data as they drove by.
However, I guess this bit of government interference has been just a tad too much for the old Goog to tolerate. One of the "don't be evil" founders has taken to the news media to loudly proclaim:
Web freedom facing greatest threat: Google founder
Seriously? Apple, Facebook, and the government are all out to destroy the internet? They are all eeeeevil!!! But the Goog... the Goog is pure of heart and wants only the best for us all!
Right.
While portions of the government seem hell bent on taking away our internet freedom, why do I have the feeling Brin is talking about one particular agency?
Maybe The Goog should take Eric's advice above. After all he's one of their top guys. Isn't that why they pay him?
Now, how long before I'm totally delisted form Google for this completely offensive post. Ha.
Google fined $25,000 for impeding FCC investigation
That's it? Twenty-five thou is not even pocket change for this company, it's more like pocket lint. They lose more than this between the cracks of the server farm frames every day.
In their infinite wisdom, The Goog has decided they are not turning anything over to the eeeevil US government merely because some of their more zealous employees broke a little bitty law. Pish and tush!
But Google also collected passwords, Internet usage history and other sensitive personal data that was not needed for its location database project, the FCC said.
After all they are only following the dictum of Eric Schmidt their executive chairman.
"If you have something that you don’t want anyone to know maybe you shouldn’t be doing it in the first place”
Which, it seems, the company took to include the collection of your username and password along with other data as they drove by.
However, I guess this bit of government interference has been just a tad too much for the old Goog to tolerate. One of the "don't be evil" founders has taken to the news media to loudly proclaim:
Web freedom facing greatest threat: Google founder
Seriously? Apple, Facebook, and the government are all out to destroy the internet? They are all eeeeevil!!! But the Goog... the Goog is pure of heart and wants only the best for us all!
Right.
While portions of the government seem hell bent on taking away our internet freedom, why do I have the feeling Brin is talking about one particular agency?
Maybe The Goog should take Eric's advice above. After all he's one of their top guys. Isn't that why they pay him?
Now, how long before I'm totally delisted form Google for this completely offensive post. Ha.
Posted by: Teresa in
WebTech
at
09:47 PM
| Comments (2)
| Add Comment
Post contains 321 words, total size 2 kb.
April 10, 2012
Patchy - Patchy Please
New windows updates came out today. Time to patch as there are exploits in the wild already.
Interestingly enough on reading the article linked above, we're back to nasty stuff being passed along via Windows Office documents. Please be careful and don't just open stuff that hits your inbox!
You'd think after all these years people would kinda get that. But apparently such is not the case.
In Apple news, they will be releasing software to get rid of the Flashback trojan. They are also trying to take the botnet offline. Of course as with any botnet, the only way to get rid of it is to get rid of all of it. Depends on how distributed it is as to whether they can take it down. We shall see.
This has been a public service announcement on behalf of your computer. Thank you for your cooperation.
Interestingly enough on reading the article linked above, we're back to nasty stuff being passed along via Windows Office documents. Please be careful and don't just open stuff that hits your inbox!
You'd think after all these years people would kinda get that. But apparently such is not the case.
In Apple news, they will be releasing software to get rid of the Flashback trojan. They are also trying to take the botnet offline. Of course as with any botnet, the only way to get rid of it is to get rid of all of it. Depends on how distributed it is as to whether they can take it down. We shall see.
This has been a public service announcement on behalf of your computer. Thank you for your cooperation.
Posted by: Teresa in
WebTech
at
08:44 PM
| No Comments
| Add Comment
Post contains 151 words, total size 1 kb.
April 05, 2012
All That Java - small update
I'm a little late blogging this. Sorry about that. But here's a quick tip for everyone browsing about the web. Windows, Mac, it doesn't matter.
If you have Java on your system please disable it! (instructions on that to follow)
Yes you see it in bold because this has been the week of the Java meltdown and it's not pretty. If you've missed the high drama surrounding this bit malware fun and games you can catch up via this post at F-Secure.
Mac Flashback Infections
If you aren't interested in backtracking through all of it, suffice it to say, Apple left Java unpatched for about 6 months... finally sending out the patch yesterday after the news hit the internet that it was a problem. Guess what happened... the Java hole that had been patched by Oracle but NOT by Apple was exploited on Macs running Java. All people had to do was hit a web site with an infected Java applet and voilà! instant own by the trojan. Yippee Skippee.
So let's start with the Mac people... did you get owned? (If you are running a new machine with Lion you might not have Java - it does not come on Mac with Lion and would only be there if you downloaded it)
If you are a Mac user, certainly check your updates and make sure you've got it patched. Then open a terminal window (it's in Applications --> Utilities --> Terminal.app). Terminal looks like an old DOS window with cute things like your computer name and $ where you would enter text if you knew what to type. Well, here you go, enter the following - you can cut and paste from here:
defaults read /Applications/Safari.app/Contents/Info LSEnvironment
Hit enter. If it says:
"The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist"
Breathe a small sigh of relief. If you run Firefox, you'll need to change the Safari.app to Firefox.app and do it again.
Next copy and paste this into the terminal window:
defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
Hit enter. Once again if you receive:
"The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist"
All is well and you are set. (BTW the "joe" above will be your login name) If you got anything other than the "does not exist" message for either of these commands, see the F-Secure Disinfection Page to get rid of it.
Now... on to the fix. Disable Java! You can do this in several ways. Either disable Java in the browser, disable it on the system or remove it from your system. I would suggest disabling both the system and browser, wait about a month. If you haven't broken anything, remove it from your system. That should be the least traumatic way to do this. If something is broken, you'll then have to decide if it's worth keeping Java or not. You could keep it and only enable it when you really need to use it.
So here we go:
Windows:
On the system. Go to control panel. In the search bar type in "Java". This should bring up the Java entry. Click this to open the Java panel. There are several tabs across the top, click the "Java" tab. Click on "View" it will open a new little window. Uncheck the "Enable" box and click "OK". Then "OK" again to close the Java box.
In IE (this might be different for different versions - I have the latest so I hope you don't have to search too hard to find this). Open the "Internet Options" box. In the latest version it's located in the "settings wheel" on the top right of the browser. Click the "Programs" tab and the the "Manage add-ons" button. Scroll down and you should see the Java plugin(s). Disable them.
In Firefox open the "Options" box. Under the "General" tab (the first tab!) Click the "Manage Add-ons" box. Disable the Java plugin(s).
Restart the browser. That should do it for Windows.
Mac:
Open Finder. Type in "Java Preferences" in the search bar. You will have to scroll, but it should be in the list of stuff there. The icon is a cup of coffee with a window background. Click it to open. Depending on your system you may have both a 32bit and 64bit Java. Doesn't really matter, just uncheck the boxes under the "general" tab. Then you can close the window.
In Safari:
Open Preferences. Go to the Security tab and uncheck "enable Java". That's it.
In Firefox - go to Tools -- Add-ons and disable Java.
Now at least you might not pick up any unwelcome little trojans. Maybe. At least for a little while.
I hope the instructions make sense. If not, you can ask, or you can find a local geek who can help.
****
I don't have Chrome, but it looks like you don't have to do anything if you do have it : For Java specifically, Chrome now disables Java by default on all pages and prompts you to allow it to run each time a site needs it. So you should be okay with the browser part.
***
Update 2: I should be clear that Apple didn't patch Java for about 6 months. But the current exploited hole is one that Oracle patched in February. Be that as it may, there were other Java patches in the meantime just not noted as being exploited on Macs like this one.
If you have Java on your system please disable it! (instructions on that to follow)
Yes you see it in bold because this has been the week of the Java meltdown and it's not pretty. If you've missed the high drama surrounding this bit malware fun and games you can catch up via this post at F-Secure.
Mac Flashback Infections
If you aren't interested in backtracking through all of it, suffice it to say, Apple left Java unpatched for about 6 months... finally sending out the patch yesterday after the news hit the internet that it was a problem. Guess what happened... the Java hole that had been patched by Oracle but NOT by Apple was exploited on Macs running Java. All people had to do was hit a web site with an infected Java applet and voilà! instant own by the trojan. Yippee Skippee.
So let's start with the Mac people... did you get owned? (If you are running a new machine with Lion you might not have Java - it does not come on Mac with Lion and would only be there if you downloaded it)
If you are a Mac user, certainly check your updates and make sure you've got it patched. Then open a terminal window (it's in Applications --> Utilities --> Terminal.app). Terminal looks like an old DOS window with cute things like your computer name and $ where you would enter text if you knew what to type. Well, here you go, enter the following - you can cut and paste from here:
defaults read /Applications/Safari.app/Contents/Info LSEnvironment
Hit enter. If it says:
"The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist"
Breathe a small sigh of relief. If you run Firefox, you'll need to change the Safari.app to Firefox.app and do it again.
Next copy and paste this into the terminal window:
defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
Hit enter. Once again if you receive:
"The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist"
All is well and you are set. (BTW the "joe" above will be your login name) If you got anything other than the "does not exist" message for either of these commands, see the F-Secure Disinfection Page to get rid of it.
Now... on to the fix. Disable Java! You can do this in several ways. Either disable Java in the browser, disable it on the system or remove it from your system. I would suggest disabling both the system and browser, wait about a month. If you haven't broken anything, remove it from your system. That should be the least traumatic way to do this. If something is broken, you'll then have to decide if it's worth keeping Java or not. You could keep it and only enable it when you really need to use it.
So here we go:
Windows:
On the system. Go to control panel. In the search bar type in "Java". This should bring up the Java entry. Click this to open the Java panel. There are several tabs across the top, click the "Java" tab. Click on "View" it will open a new little window. Uncheck the "Enable" box and click "OK". Then "OK" again to close the Java box.
In IE (this might be different for different versions - I have the latest so I hope you don't have to search too hard to find this). Open the "Internet Options" box. In the latest version it's located in the "settings wheel" on the top right of the browser. Click the "Programs" tab and the the "Manage add-ons" button. Scroll down and you should see the Java plugin(s). Disable them.
In Firefox open the "Options" box. Under the "General" tab (the first tab!) Click the "Manage Add-ons" box. Disable the Java plugin(s).
Restart the browser. That should do it for Windows.
Mac:
Open Finder. Type in "Java Preferences" in the search bar. You will have to scroll, but it should be in the list of stuff there. The icon is a cup of coffee with a window background. Click it to open. Depending on your system you may have both a 32bit and 64bit Java. Doesn't really matter, just uncheck the boxes under the "general" tab. Then you can close the window.
In Safari:
Open Preferences. Go to the Security tab and uncheck "enable Java". That's it.
In Firefox - go to Tools -- Add-ons and disable Java.
Now at least you might not pick up any unwelcome little trojans. Maybe. At least for a little while.
I hope the instructions make sense. If not, you can ask, or you can find a local geek who can help.
****
I don't have Chrome, but it looks like you don't have to do anything if you do have it : For Java specifically, Chrome now disables Java by default on all pages and prompts you to allow it to run each time a site needs it. So you should be okay with the browser part.
***
Update 2: I should be clear that Apple didn't patch Java for about 6 months. But the current exploited hole is one that Oracle patched in February. Be that as it may, there were other Java patches in the meantime just not noted as being exploited on Macs like this one.
Posted by: Teresa in
WebTech
at
10:30 PM
| Comments (5)
| Add Comment
Post contains 912 words, total size 6 kb.
March 12, 2012
Posterous Bought By Twitter
The big news this evening... that Posterous is now a part of Twitter.
I have my iphone photo blog on Posterous. (Technicalities to Go) although I haven't been posting much of anything lately. It's dead easy to post using only an email then it will send out messages via twitter, facebook, flickr, etc, etc, etc. Can't hardly beat it.
Guess it's wait and see time. I do hope it doesn't go away. If it ends up being dissolved I'll be very unhappy. That's the blogging life I suppose.
I have my iphone photo blog on Posterous. (Technicalities to Go) although I haven't been posting much of anything lately. It's dead easy to post using only an email then it will send out messages via twitter, facebook, flickr, etc, etc, etc. Can't hardly beat it.
Guess it's wait and see time. I do hope it doesn't go away. If it ends up being dissolved I'll be very unhappy. That's the blogging life I suppose.
Posted by: Teresa in
WebTech
at
08:49 PM
| Comments (2)
| Add Comment
Post contains 92 words, total size 1 kb.
March 02, 2012
An Amazing Woman
Grace Hopper who was a computer scientist before the term was even coined. Here's a short vid where she explains the "nanosecond". I so wish I had had her for a teacher in school.
Mind Your Nanoseconds!
I'm pretty sure she could teach today's young programmers a thing or two or three.
Mind Your Nanoseconds!
I'm pretty sure she could teach today's young programmers a thing or two or three.
Posted by: Teresa in
WebTech
at
05:03 PM
| Comments (2)
| Add Comment
Post contains 55 words, total size 1 kb.
March 01, 2012
If You Have That "Someone Is Watching Me" Feeling
You may not be too far off. It's amazing how much data we give off to the world at large.
Phone Call 'Line Noise' Could Expose Thieves
In this case the data being watched is being used for "good" according to the people writing the article. However, if you give it a little thought you could see how it might be used in many and varied nefarious ways.
If you are interested in a true expert talking about this, Patrick Gray of Risky Business has a two part interview with the incredibly brilliant Dan Geer. I was fortunate enough to hear Dan speak at a meeting recently and I swear I would have become a statistician if he had been my stats teacher in college... amazing man!
Part 1 of the interview is "Digital Exhaust"
Part 2 of the interview is "Surveillance"
Be aware... the first 20 minutes or so of the show is security news. I find it fascinating and informative, but you may want to fast forward until the interview starts directly after the news.
Keep looking over your shoulder - you never know who is watching.
Phone Call 'Line Noise' Could Expose Thieves
In this case the data being watched is being used for "good" according to the people writing the article. However, if you give it a little thought you could see how it might be used in many and varied nefarious ways.
If you are interested in a true expert talking about this, Patrick Gray of Risky Business has a two part interview with the incredibly brilliant Dan Geer. I was fortunate enough to hear Dan speak at a meeting recently and I swear I would have become a statistician if he had been my stats teacher in college... amazing man!
Part 1 of the interview is "Digital Exhaust"
Part 2 of the interview is "Surveillance"
Be aware... the first 20 minutes or so of the show is security news. I find it fascinating and informative, but you may want to fast forward until the interview starts directly after the news.
Keep looking over your shoulder - you never know who is watching.
Posted by: Teresa in
WebTech
at
10:07 PM
| No Comments
| Add Comment
Post contains 198 words, total size 2 kb.
January 31, 2012
Winding Your Way Through Google's Latest Privacy Maze - UPDATE
***sorry wrong wrong link earlier - fixed now. Ha! ***
If you don't want to completely drop Google from your world, Naked Security will give you the step by step of what to look for.
How to navigate Google's privacy options
It's so tiring having to go back and redo privacy options all the time. Of course we all know the reason these places keep changing things is in hopes you'll eventually just say "the hell with it, I'm tired of messing with these things" and then they get their way and get to track you all over.
If you don't want to completely drop Google from your world, Naked Security will give you the step by step of what to look for.
How to navigate Google's privacy options
It's so tiring having to go back and redo privacy options all the time. Of course we all know the reason these places keep changing things is in hopes you'll eventually just say "the hell with it, I'm tired of messing with these things" and then they get their way and get to track you all over.
Posted by: Teresa in
WebTech
at
03:23 PM
| Comments (3)
| Add Comment
Post contains 108 words, total size 1 kb.
128kb generated in 0.19 seconds; 81 queries returned 314 records.
Powered by Minx 1.1.4-pink.
Powered by Minx 1.1.4-pink.
