The Loss Prevention Manager should be receptive to the needs and objectives of upper management and work to prevent and reduce loss from crime, fire accidents etc.

With the continuing threats brought to us by our AL Quaeda and Taliban enemies and the outbreak of new TV shows that reinforce the danger we all face on a daily basis, one must look within as to how we can protect ourselves from threats both real and imagined. I said imagined because we can become either hypochondriacs or completely oblivious to the dangers around us.

The situations we will focus on in this brief evaluation are those where large volumes of people congregate on a daily basis. Much has been written about airports and how the Government has stepped in to facilitate the security of baggage and boardings etc. Although Schools and theatres could be targeted, one area I would like to review is the Mall, which we have first hand knowledge of since we frequent them almost daily. The mall, some large and some small all handlelarge volumes of people daily. Its close proximity to the airports has caused me to visualize a frightening scenario from time to time. This also should be addressed in any critique of physical protection

Security for malls throughout the country is based on protecting the occupants and the property primarily from fire and water damage.

Personnel are generally given basic information as to what should happen in the case of fire and subsequent damage control, but essentially the function of either Security officers or tenants is to pull the fire alarm and wait for the fire trucks to get there, hopefully as quickly as possible.

Business continuity is a primary situation for the Mall and yet there is little accomplished to meet those requirements. With this in mind a good security officer should be a fireman and or be trained in fire prevention and training. In the world of fire training there are those who are listed as fire police. They are primarily there at the scene of a fire to direct traffic and move gawkers away from danger.

Mall security would seem to fit in this category, as they are not really trained in fire prevention nor fire combating. This exclusion in training on a primary and continual basis is a danger faced by the visitors and businesses that expect protection.

Fire-personal as well as the police, by nature, are trained to meet the demand for medical aid in the event of minor or major medical emergencies. At the least, basic first aid should be a required continual training program for all Mall personnel, with an emphasis on the Security Guard. The fact that defibrillators are available at Malls along with first aid kits but with little or no training approved by the Mall is a condition that should be addressed.

Most security guards are usually hired because they are between jobs, work cheap and don’t ask a lot of questions. Training consists of reading a manual, taking an open book test that consists of :

1. Appearance

2. Where the fire equipment is located

3. Reporting problems

4. How to tour the inside and outside of the building and

5. Limits of authority.

It is not the job of the Security Guard to fight fire, provide medical assistance or use force. The primary use of Security personnel is to walk the Mall during the business day and to report from time to time that they have gone into a tenant’s space and shown their presence. Observing possible loss pevention does not appear in their lexicon.

Over the years the defensive tools used by security personnel has been reduced to carrying a set of handcuffs, which can only be used under the direction of a local law enforcement Officer in the completion of his duty. Again, without basic and ongoing training, the uniformed Protective Services officer is of no other use than to be seen. Physical contact with individuals is totally prohibited due to the same reason above. Lack of training creates liability to the Mall and to the officer.

The physical plant known as a Mall has many egresses and entrances. Sets of keys are used by housekeeping, maintenance and protection services to secure the movement throughout the site. In most cases the key systems work as the keys are assigned to individuals and are signed for. Various situations cause damage to the doors, some by the stores themselves and by visiting vendors. Unlawful entrance and egress from the stores occur at all times of the day or night. Doors that are broken and unable to be secured with a key are not repaired in a timely manner. Automatic closing devices are tampered with and are inoperable and in many cases doors are intentionally left open to allow easy access to various parts of the building by not only the Mall employees but many of the store personnel as well. Damaged doors and poor maintenance precludes the hazards to all visitors and employees as well. The ability to enter the building and to cause damage, either unintentionally or inntionally should be of paramount concern to the administration as well as injury to visitors and employees from individuals who may be emotionally, politically or criminally motivated. Daytime situations are normally different than evening and overnight due to the fact that more personnel are available and more activity promotes little opportunity for problematic situations. On one hand this combination of light and sound along with the presence of people creates the environment for terrorism and or criminal acts. During the evening hours there is the added problem produced by teenagers and young adults who create disturbances causing security extra work which distracts them from actual security and placing them in the position of acting as police, which they are not trained for. The use of force has been all but totally removed from their arsenal of protection. No training in civil disturbance or any other disturbance is given on any basis.

Radio communications is used in various ways depending on the requirements of the various departments within the Mall. The benefit is that communications are available to identify negative situations that would require fire, police, housekeeping and maintenance. In the event of an emergency, radio frequencies will be modified to meet the needs of security. Maintenance and housekeeping as well as Mall administration should be subordinate to security. The standard operating procedure would require that the individual in charge be completely cognizant of the workings of the building and at least have the workable phone numbers of department heads. In many situations of various venues, the phone numbers of employ ees are not kept up to date and can cause unnecessary delay not only in emergencies but also on a day to day basis to contact personnel who are due in for shift changes. It should be the responsibility of at least one person in administration to make sure that the phone numbers are kept up to date.

Video surveillance, on the most part, functions well. The worst problem is the lack of light particularly in the parking lot. Often the failure of pole lights creates blackout areas during evening hours. This makes it impossible to check activities from the control center. If there is only one guard on the midnight shift, it requires that the control center may be left unattended to check the lot as well as the entrance and loading doors. video cameras with night vision capabilities would provide the necessary protection of the lot. The inability to patrol and or visually observe the site have created criminal acts from break-ins,vandalism and murder. Using the parking lot or a lover’s lane cannot be tolerated.

Without listing banal conclusions to these initial thoughts, lets recognize the need to be aware of that, which surrounds us. Remember, God is in the details!

With 8 years of service in the Military Police and former investigator for the State of NY election fraud bureau, a retired private and insurance investigator and presently actiove in the field of security. Member of the Police Commissioner’s Association of Connecticut, International Foundation of Protection Officers.

Much has been said on the theory of password protection for files, computer login, and other network access. In the past we used a combination of letters, special characters, and other techniques to try and prevent unwanted or unauthorized access to our computers, resources, and networks. A new theory on passwords is emerging that may help us remember our access codes, be more secure, and generally keep hackers and thieves out of our networks.

A password is a combination of words, letters, and special characters that only the user knows, allowing access to a computer or other information resources. As humans we have a large number of codes and numbers we need to remember every day – such as the key lock on our apartment entries, national identification numbers, automobile license or tag numbers, telephone numbers – it is a large and confusing suite of items we need to memorize.

When selecting a new password or pass code for access to a computer system, most of us understand how difficult it is to remember complex codes, and thus we select something already know n to us, such as names, birthdays, national identifiers, or other known items, and then place a number or character in front of the name or number thinking it is secure. This is easy to understand, as most of us simply do not have an ability to instantly recall large numbers of complex codes.

In a worst case we simply write down the complex code on a piece of paper, and leave it in a desk, our pocketbook, or in many cases taped to the front of our computer monitor.

However, to a hacker this makes access to your network or computer much easier, at they generally only have to learn a couple things about you, and add a few numbers to the front or ending of your personal data – you would be surprised how often this grants access to computers and networks. Ad some good “cracking utilities” to the hacker’s suite of tools, and you can understand the threat.

PassPhrases are a concept that will help us create more secure, easy to remember safeguards for our computer and network resource protection. A passphrase is a selection of words and/or numbers that are 15 characters or more in length, and are easy for us to remember. A couple examples of a good pass phrases are:

• igotodalaieejdaily

• shehasbeautifulhair

• surfinginhawaiiisgreat

According to Mark Minasi, a noted security consultant, a 15 character pass phrase will require a cracking program the following number of computations to try and break a 15 character pass phrase:

• 15 lowercase letters = 1,677,259,342,285,725,925,376 possibilities

• Try a million a second, it’ll take 531,855 centuries/years to break the code

As you can see, this is a pretty good level of security for your resource.

Another concern with passwords is if you forget or lose the password, and are using a utility like Microsoft’s Encrypting File System (EFS), you run the risk of losing all access to your important files if you require a hardware reset of your password. All EFS encrypted files are linked to your login profile, meaning if you encrypt a directory or file with EFS, and you do a hardware reset on your computer, those files and directories are lost FOREVER.

For Microsoft Windows users you can now also use spaces within your pass phrase, however we would not recommend embedding spaces in your pass phrase, as that actually does allow a cracker better access to getting your code – it may help them crack it in 100,000 years rather than 250,000!

(About the Author – John Savageau is a managing director at CRG-West, responsible for managing operations and architecture for several of the largest telecommunications interconnect facilities in the US, including One Wilshire in Los Angeles)

During the release of a new software product specialized to track spam, ACME Software Inc notice that there was not as much traffic as they hoped to receive. During further investigation, they found that they could not view their own website. At that moment, the VP of sales received a call from the company’s broker stating that ACME Software Inc stock fell 4 point due to lack of confidence. Several states away, spammers didn’t like the idea of lower profit margins do to an easy to install spam blocking software so they thought they would fight back. Earlier that day, they took control of hundreds of compromised computers and used them as DoS zombies to attack ACME Software Inc’s Internet servers in a vicious act of cyber assault. During an emergency press conference the next morning, ACME Software Inc’s CIO announced his resignation as a result of a several million dollar corporate loss.

Scenarios like the one above happen a more then people think and are more costly then most will admit. Denial of Service (DoS) attacks are designed to deplete the resources of a target computer system in an attempt to take a node off line by crashing or overloading it. Distributed Denial of Service (DDoS) is a DoS attack that is engaged by many different locations. The most common DDoS attacks are instigated through viruses or zombie machines. There are many reasons that DoS attacks are executed, and most of them are out of malicious intent. DoS attacks are almost impossible to prevent if you are singled out as a target. It’s difficult to distinguish the difference between a legitimate packet and one used for a DoS attack.

The purpose of this article is to give the reader with basic network knowledge a better understanding of the challenges presented by Denial of Service attacks, how they work, and ways to protect systems and networks from them.

Instigation:

Spoofing - Falsifying an Internet address (know as spoofing) is the method an attacker uses to fake an IP address. This is used to reroute traffic to a target network node or used to deceive a server into identifying the attacker as a legitimate node. When most of us think of this approach of hacking, we think of someone in another city essentially becoming you. The way TCP/IP is designed, the only way a criminal hacker or cracker can take over your Internet identity in this fashion is to blind spoof. This means that the impostor knows exactly what responses to send to a port, but will not get the corresponding response since the traffic is routed to the original system. If the spoofing is designed around a DoS attack, the internal address becomes the victim. Spoofing is used in most of the well-known DoS attacks. Many attackers will start a DoS attack to drop a node from the network so they can take over the IP address of that device. IP Hijacking is the main method used when attacking a secured network or attempting other attacks like the Man in the Middle attack.

SYN Flood - Attackers send a series of SYN requests to a target (victim). The target sends a SYN ACK in response and waits for an ACK to come back to complete the session set up. Instead of responding with an ACK, the attacker responds with another SYN to open up a new connection. This causes the connection queues and memory buffer to fill up, thereby denying service to legitimate TCP users. At this time, the attacker can hijack the system’s IP address if that is the end goal. Spoofing the "source" IP address when sending a SYN flood will not only cover the offender’s tracks, but is also a method of attack in itself. SYN Floods are the most commonly used DoS in viruses and are easy to write. See http://www.infosecprofessionals.com/code/synflood.c.txt

Smurf Attack- Smurf and Fraggle attacks are the easiest to prevent. A perpetrator sends a large number of ICMP echo (ping) traffic at IP broadcast addresses, using a fake source address. The "source" or spoofed address will be flooded with simultaneous replies (See CERT Advisory: CA-1998-01). This can be prevented by simply blocking broadcast traffic from remote network sources using access control lists.

Fraggle Attack - This types of attack is the same as a Smurf attack except using UDP instead if TCP. By sending an UDP echo (ping) traffic to IP broadcast addresses, the systems on the network will all respond to the spoofed address and affect the target system. This is a simple rewrite of the Smurf code. This can be prevented by simply blocking broadcast traffic from remote IP address.

Ping of Death - An attacker sends illegitimate ICMP (ping) packets larger than 65,536 bytes to a system with the intention of crashing it. These attacks have been outdated since the days of NT4 and Win95.

Teardrop - Otherwise known as an IP fragmentation attack, this DoS attack targets systems that are running Windows NT 4.0, Win95 , Linux up to 2.0.32. Like the Ping of Death, the Teardrop is no longer effective.

Application Attack - Thess are DoS attacks that involve exploiting an application vulnerability causing the target program to crash or restart the system.

Kazaa and Morpheus have a known flaw that will allow an attacker to consume all available bandwidth without being logged. See http://www.infosecprofessionals.com/code/kazaa.pl.txt

Microsoft’s IIS 5 SSL also has an easy way to exploit vulnerability. Most exploits like these are easy to find on the Internet and can be copied and pasted as working code. There are thousands of exploits that can be used to DoS a target system/application. See http://www.infosecprofessionals.com/code/IIS5SSL.c.txt

Viruses, Worms, and Antivirus - Yes, Antivirus. Too many cases where the antivirus configuration is wrong or the wrong edition is installed. This lack of foresight causes an unintentional DDoS attack on the network by taking up valuable CPU resources and bandwidth. Viruses and worms also cause DDoS attacks by the nature of how they spread. Some purposefully attack an individual target after a system has been infected. The Blaster worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135 is a great example of this. The Blaster targeted Microsoft’s windows update site by initiating a SYN FLOOD. Because of this, Microsoft decided to no longer resolve the DNS for ‘windowsupdate.com’.

DoS attacks are impossible to stop. However, there are things you can do to mitigate potential damages they may cause to your environment. The main thing to remember is that you always need to keep up-to-date on the newest threats.

Mitigation:

Antivirus software - Installing an antivirus software with the latest virus definitions will help prevent your system from becoming a DoS zombie. Now, more then ever, this is an important feature that you must have. With lawsuits so prevalent, not having the proper protection can leave you open for downstream liability.

Software updates - Keep your software up to date at all times. This includes antivirus, email clients, and network servers. You also need to keep all network Operating Systems installed with the latest security patches. Microsoft has done a great job with making these patches available for their Windows distributions. Linux has been said to be more secure, but the patches are far more scarce. RedHat is planning on incorporating the NSA’s SE Linux kernel into future releases. This will give Mandatory Access Control (MAC) capabilities to the Linux community.

Network protection - Using a combination of firewalls and Intrusion Detection Systems (IDS) can cut down on suspicious traffic and can make the difference between logged annoyance and your job. Firewalls should be set to deny all traffic that is not specifically designed to pass through. Integrating an IDS will warn you when strange traffic is present on your network. This will assist you in finding and stopping attacks.

Network device configuration - Configuring perimeter devices like routers can detect and in some cases prevent DoS attacks. Cisco routers can be configured to actively prevent SYN attacks starting in Cisco IOS 11.3 and higher using the TCP intercept command in global configuration mode.

Access-list number {deny | permit} tcp any destination destination-wildcard ip tcp intercept list access-list-number ip tcp intercept ? (will give you a good list of other options.)

Cisco routers can prevent Smurf and Fraggle attacks by blocking broadcast traffic. Since Cisco IOS 12.0, this is the default configuration. ACLs or access control lists should also be configured on all interfaces.

No ip directed-broadcast

The Cisco router can also be used to prevent IP spoofing. ip access-group list in interface access-list number deny icmp any any redirect access-list number deny ip 127.0.0.0 0.255.255.255 any access-list number deny ip 224.0.0.0 31.255.255.255 any access-list number deny ip host 0.0.0.0 any See Improving Security on Cisco Routers - www.cisco.com/warp/public/707/21.html

Old Cisco IOS versions are vulnerable to several DoS attacks. The "Black Angels" wrote a program called Cisco Global Exploiter. This is a great software to use when testing the security of your Cisco router version and configuration and can be found at http://www.blackangels.it/Projects/cge.htm

Security is not as mystical as people believe. DoS attacks come in many different types and can be devastating if you don’t take the proper precautions. Keep up to date and take steps to secure network nodes. Keeping security in mind can minimize damages, downtime, and save your career.

Security Resources:
Black Angels: http://www.blackangels.it/
Cisco: http://www.cisco.com
Microsoft: http://www.microsoft.com/technet/security/current.aspx
Forum of Incident Response and Security Teams: http://www.first.org/
SANS Institute: http://www.sans.org/resources/

Author: Jeremy Martin CISSP, ISSMP, ISSAP, CEI, CEH, CHS-III, CCNA, Network+, A+ http://www.infosecwriter.com

Member of:
BECCA - Business Espionage Controls & Countermeasures Association
ISACA® - Information Systems Audit and Control Association
(ISC)² - International Information Systems Security
Certification Consortium ISSA - Information Systems Security Association.
OISSG - Open Information Systems Security Group
YEN NTEA - Young Executives Network

In 1997, I decided after 15 years as a practicing CPA that it was time to put down my pencil and explore a new venture on the exciting new internet which, while perhaps not exactly in its infancy at that point, was still at least a pimply faced teenaged medium still unexplored by most accountants.

I founded CPAsites.com and made a life for myself and a few other employees by designing and managing websites for CPA firms across the country. We had no competition in the early, heady days of the late 90’s and were able to quickly secure a name for ourselves by offering quality sites to quality firms.

Since 1997 however, the internet has grown from a pimply faced teenaged medium to a…well, goliath-sized pimply faced teenaged medium. I can recall getting my first spam messages in the early days of email and like everyone else, I thought they were "kinda’ neat" in the way that my teenage daughters think college mail is "kinda’ neat."

As a website developer in 2005 however, spam has become the bane of my existence. Invariably, once a week, we get a call or email from a CPA exasperated by the volume of spam email he or she is receiving and, also invariably, we - or the website we host for the accountant - gets the blame. "Please remove all of our email addresses off the site!" they proclaim with finality.

So much for the golden age of instant internet communication at your fingertips. Dutifully, we would comply with their requests and it wasn’t until I endeavored to solve another common CPA complaint that I stumbled on the perfect solution for email theft.

For several years, the second most common complaint coming from my CPA clients was concerning an easy way to have clients email them securely from their website. After we explain to them the intricacies of password management and secure logins, they immediately dropped their security plans. They, like everyone else on the internet, suffer from "password fatigue" and weren’t about to subject their clients to learning and remembering yet another password just to send their CPA some tax information.

About a year ago, we finally decided there SHOULD be an easy way to just click on a website or email link and download a person’s encryption key so that you can email encrypted documents to the individual. We searched. There wasn’t. Seeing a critical need not only for our CPA clients, but also for attorneys, physicians and other financial professionals, we called an encryption programmer, gave him our idea and said "do it."

The result is CipherSend.com which began selling in March of 2005 for $19.95. As the encryption programmers promised, it works perfectly for what we needed (click the button, encrypt anything and send it with no password), but imagine our surprise when we realized it also solved an even bigger problem - spambots stealing our clients’ email addresses!

When our clients replace their email addresses with CipherSend buttons, spambot crawlers are stopped in their tracks. The button-owner’s email address is stored on our secure server, not on his or her public website. Needless to say, both we and our clients were rather delighted that a "side effect" of the program was even better than the intended cure!

The service is ideally suited for professionals and physicians who can now quickly and easily receive secure documents from clients, associates and patients at their standard email address without the inconvenience of giving out passwords or secure logins, but it is also finding a huge market among millions of aggravated spam victims needing to replace an email address posted on a public website or included in the coding of a contact form.

CipherSend offers advantages over standard website email or contact forms with its spam-block security and double notification to site visitors when their email has been delivered and again when it is opened by the recipient. Despite the low price, CipherSend uses sophisticated 2048-bit RSA asymmetrical (two-key) encryption algorithms with maximum key length and meets government security regulations required in the healthcare industry for the transfer of patient medical information.

Since messages and documents are encrypted right on the sender’s computer with a downloaded public key and decrypted by the recipient’s private key, CipherSend represents true end-to-end security. A demo of the button can be found on the CipherSend.com website and the program has a 30 day free trial membership.

Generally, "the law of unintended consequences" is a nightmare scenario for people introducing a new product or service on the market, but for this fortunate CPA, "two birds with one stone" just took on new meaning and made my life a whole lot less stressful!

Jeffery N Drake, CPA, MBA President http://www.CipherSend.com http://www.CPAsites.com

Can You Prevent Spyware, Worms, Trojans, Viruses, … To Work When You Switch Your Pc On ? I Can And I Do It On A Pro-active Basis.

Surfing Means More And More To Stay Invisible, To Be Clean From The Inside And To Prevent Installment Of Malicious Software (So Preventing Unwanted Communication From Inside To Outside And From Outside To Inside).

How do you stay invisible while surfing? Of course by installing a firewall. How do I get one free? That’s the easy point.

You like to stay invisible. But are you? And how do you know? You could do a test from someone out there trying to get in. But who can you trust?

Suppose you are doing a test. Do you obtain objective and reliable information about your PC-vulnerability (for free)?

Now even if you stay invisible, you will visit websites leaving cookies in your PC and you will download software. By doing so you will get spyware, viruses, …

How can you detect them and delete them? That’s also the easy point: you have to install an anti-virus program and anti-spyware programs. Research on the internet makes it clear that you need 2 anti-spyware programs. Why 2? Because a great fish may be caught by the net but a small fish can swim through the holes. Using 2 makes the holes smaller. What are those 2 free programs you have to download?

Can you prevent spyware to install on your PC? Maybe, maybe not. There is one free software that might prevent it (but not with 100% guarantee).

And even then you need an additional freeware program to prevent a piranha to install itself on your PC (just enabling itself to start up whenever you switch your PC on). This freeware program is overlooked by many and gives you an additional feeling of relief and security. It gives you also a hint whether some new downloaded software is good or bad (and thus giving you the chance to delete it anyway before it becomes too malicious).

Now you owe it to yourself to maximize the safety of your PC for surfing. You need a firewall,an anti-virus software, 2 anti-spyware programs, one spyware preventing program, a trusty guard preventing installment in your startup files and even 3 musketeers. And last but not least do a safe test to get an objective idea about the vulnerability of your PC.

Everything is free. It only needs your attention. So look after the fully simple and logical steps in:

http://www.optinfire.com/p.php?user=42&c=BLOGSEC1

http://www.optinfire.com/p.php?user=42&c=BLOGSEC2

After all, preventing a disease is better than curing it!

Finally. Discover A Lifetime Of Amazing Simple And Free Web Marketing Strategies, Tips And Resources. Subscribe to my Monthly Newsletter. Reply To My Survey And Receive A Free Software And Ebook! Go to http://startwithoutadime.blogspot.com

This is not some new fangled techno-speak, it is a real tool to be used for the protection of your wireless internet network and LAN. African American SMBs have to realize that if your Internet connection is on 24/7 then your network, and it is a network that your computer is connected to, is at risk. Any business that uses the Internet to share or exchange information, news, or ideas with clients, vendors, partners, or other locations look in the reflection of your monitor and realize that your business is an unintentional (or intentional) target.

You should already be aware of all the thousands of bugs, viruses, denial of service attacks and other unfriendly items that lurk on the internet and virtually try attacking every second. It’s like having a screen door on your most valuable assets. Let’s not repeat what you know about, let’s look at a larger picture that should concern everyone - the unknown. There are attacks that go unreported for various reasons, these are the ones that the major software and hardware vendors have no clue about and can only warn you after an attack is reported.

If your files, email, identity, client or product information are important to your african american business and you cannot afford a network being down for 24 hours. Then a firewall is what should be between the internet and everything else. You need to expect an intrusion if you have a small amount or no network protection. Hackers have tools that search the Internet 24/7 looking for a vunerable point to destroy. Overzealous marketers use similar tools to harvest information to use for spamming and unfortunately no one currently calls that a crime that we know as identity theft.

You have a deadbolt and a door lock on your front door and some even have a home security system in place. Why have a screen door latch on your home computer network, when you know there are people trying that door 24/7?

If you want to put a digital rottweiler between your home wireless network and hackers, marketers and other cyber-vandals then evaluate a strong firewall for your african american business.

Don’t have the time or resources to get your home wireless network protected and need a african american Wireless Solution Provider partner to be there for you? We can help give you your freedom back…and a whole lot more. M.D.T.G.

Daviyd Peterson ©2005 All Rights Reserved

***********************************************

Daviyd Peterson: 10-year consultant, instructor, trainer Helps african american SMBs bridge the digital divide by going wireless. Free article on Home Wireless Internet Security and other related articles http://www.mogendaviydtechgroup.com/firewallsmb.htm See a video where big time firewalls duke it out!

****************************************************

MDTG

Microsoft routinely releases new security updates, many of which are given it’s highest severity rating "critical". Here’s a typical announcement:

"A security issue has been identified that could allow an attacker to compromise a computer running Internet Explorer and gain control over it."

I’m not making this up. Is this funny to anyone else? They do this every month and they are still the most popular web browser in the world! Don’t get me wrong, the browser is good, as long as you don’t mind "attackers" gaining control over it once in awhile. Who are these attackers? Is it a cyber-geek with coke bottle glasses and an evil glint in his magnified eye? Could I tell if I saw one on the street? Would he have a lot of pens in the top pocket of his gangsta leather jacket? Does he have pentagrams sewn into his polyester leisure suit? I know only one hacker, but he swears he’s a "Light-Side" hacker. He hacks only for good.

And what if we received these kinds of letters from other manufacturers? "A security issue has been identified that could allow a pirate to board all pleasure boats running an outboard Mercury 150 and joy ride it to Mexico for Cinco de Mayo. Install this jack screw on your rudder immediately."

So let’s review with an analogy because this is "critical". If you had a steel combination safe (your computer) in which you stored precious belongings, (your data) and you towed this safe around in a wagon through many of the world’s most dangerous cities (surfing the internet), Microsoft announced that there are 8 easy ways, and 4 just "so so" ways for thieves to break in and take everything you’ve got. But let’s stay positive, the good news is, you can patch it all right up with a click. What could be easier? Maybe that’s why we forgive them so often. Wouldn’t it be great to get an email from GM saying your vehicle will soon be stolen but click here and it will be alright.

It’s nice that they announce the holes and the patches together, that way I’m not so worried the whole time before, while I browsed Internet Explorer around care free down the mean streets of the internet completely innocent. I could have been E-jacked by I-marauders, demanding that I hand over every E & I in my wallet.

The truth is, the good guys are winning the security battle online, why? Because they are rich and can hire the best light-side hackers money can buy. Even hackers known for evil all wind up working for large corporations. A headline of one going to jail for 18 months is a resume item on the lap of every CEO in the world with computers to protect. Now they’re a cyber security expert, with all the dark secrets for sale! The speaking engagements start pouring in, "Come meet the man (or woman) who sent a KaGillion emails from a billion computers to Microsoft during lunch break. He did his time at Club Fed, and now works for the Department of Defense.

So cyber villains may come and critical updates may go, I just click and fix my way along the information highway and say a little prayer that the world’s "attackers" never know I exist until they’re on the payroll of the good guys somewhere.

Rick David writes a humor column called, "Don’t Laugh It Could Happen To You" for http://sandiego.merchantamerica.com

No auntie Sookie, not earth worms, computer virus worms that can get to you computer and slowly dig deep into your files and eat them away. Put that eggnog down and I’ll tell you some more about these new worms.

This worm is a self-replicating (makes a copy of itself, aunt sookie!) program that reproduces itself over a network. It can be hidden in an email attachment from an unknown sender, a movie download from a suspicious website, or an application sent from someone you don’t know. Once on your computer it then can replace a single file, like a winsock.dll or many files and send copies of itself along with email or newsgroup messages that you can post.

The following are ways to keep these type of worms out of your network:

a) Never, I said never (for emphasis) connect an unpatched, non updated computer or other Internet related device to the Internet. How do you update and patch a computer without connecting to the Internet? Get a cd from Microsoft with the latest and greatest patches and updates, then connect the device and then check for updates while connected to make sure you have protection.

b) Always, I said always (yes I am being redundant) use a firewall between your network of computers and the Internet. Even if your network of computers is 1 or 2 computers, it is still a network and needs a firewall to protect it, really protect it. A single computer connected to the Internet is now part of a world wide network thru it’s Internet connection and is therefore vulnerable without protection. Get a firewall, a real firewall.

c) Educate and train anyone who uses your computer(s) network. Many times an infection is invited by careless users who download infected email, visit infected sites, or bring infected machines (laptop’s, pda’s) into a network from outside.

d) Patch and update, patch and update, patch and update (redundant, oh yeah). Yes it’s a pain, and it requires time to do and verify that it’s actually patched and updated. However it’s definitely simpler and cheaper than trying to fix an infestation, or explain to everyone why the network is down or their computers won’t work because a worm is eating through everything they have worked hard to save and protect.

e) Make sure up-to-date anti-virus software is on every machine, everything connected to the Internet. Anti-virus packages aid in protection and detection against worms.

f) Establish security rules for your network and educate everyone who touches the network. They must be enforced, daily.

g) Frequently check your network for vulnerabilities. Visit vulnerability website’s, take advantage of free scanning tools on the Internet to test your machines. New vulnerabilities and new exploits are released constantly, and you can’t protect against what you have no idea what is coming your way.

********************************************************

Daviyd Peterson: 10-year consultant, instructor, trainer Helps african american homeschools bridge the digital divide by becoming computer homeschools. Free article on "Computer Homeschooling" and other related articles http://www.homeschoolwireless.com/homeschoolwireless.htm

*************************************************************

A friend called me one day and asked if I would stop by to look at his computer. He said it was running abnormally slow and he had found something on his hard-drive he could not explain. I could almost guess what it was he found. Have I been hacked?

You see, his computer had been hacked. Actually, in his case, his computer had been tagged. Similar to the image you see here.

Tag, You’re It!
—————
The file transfer protocol, commonly referred to as "FTP", has been around for many years. In the early days of the Internet, it was one of the few ways to easily upload and download files from one computer to another. Many commercial operating systems come with an FTP server installed. In other cases, the option for FTP services is selected by a user when they are installing or updating their operating system. If this service is not setup properly, or you don’t have an adequately configured software or hardware firewall, it is an open invitation for a hacker or intruder.

FTP Tagging - The most common purpose for someone to compromise your FTP server is for the storage and distribution of illegally obtained software and files. This could include cracked software, stolen movies, audio files, and pornography. Removing this type of contraband from your computer can be difficult, particularly if you are using a Microsoft Windows platform. Hackers use sophisticated scripts to create a maze of directory structures to house their wares on your computer. They may use a combination of names with spaces in them, and in some cases use extended characters (characters outside the normal alpha-numeric range). Deleting these directories through normal means may be difficult, if not impossible, for the average user. Many people wind up wiping their system and re-installing it, and that is if they’re lucky enough to find out their system has been compromised.

The above is a perfect example of why the statement, "I’m not worried about being hacked. What do I have that a hacker would want?" is not a good position to take. The fact is, you do have something they want, your computers resources. Why should a hacker store tons of illegally obtained files on their systems when they can use yours.

The Good, The Bad, And The Ugly
——————————-

The Good
——–
When I was young I use to spend hours upon hours on the Internet Relay Chat, also know as the IRC. The IRC is another method of Internet communication, which has been around for quite a long time. When I was a frequent user of the IRC, it was just plain fun. You would meet all kinds of people from all over the world. It was the instant messenger of the time.

The Bad
——-
Today, the IRC is a huge communications network. It is made up of thousands of channels, and can be accessed by pretty much any operating system platform. It is also a favorite means of communication for hackers. They can discuss new exploits, methods of compromise, and even send and receive files. Many hacker groups use a cryptic language to communicate with each other on the IRC channels. Unless you know the language constructs they use, their conversations can look like a bunch of nonsense.

There are many exploits, backdoors, and Trojans that effect, or are contained in, the myriad of IRC clients on the Internet. Making sure you choose one that’s relatively safe to use is not an easy task. As an example, take a look at this list of IRC safety and security info at irc.org.

The Ugly
——–
It’s not just the exploits and security risks associated with using the IRC, which need to concern you. If a hacker is able to install an IRC relay agent on your computer, it can become a conduit through which they communicate and distribute information. In my line of work, I’ve identified many systems with IRC backdoors or relay agents installed. The only thing the end user typically experiences is a decrease in system performance and Internet access.

Just Open The Door And Let Them In Peer-to-Peer File Sharing
———————————-
If a total stranger were to knock on your door, and ask to come in to just hang out for awhile, would you let them in?; Most likely not. If you’re using peer-to-peer file sharing software to locate and download files on the Internet, you’re opening the door to destruction. Many of the file sharing services and software available on the Internet now tout themselves as being "safe" and "clean". This is as far from the truth as you can get. If you’re a regular user of these services, the chance of your computer being back-doored or hacked is significant.

If you have anti-virus software installed (and up-to-date), you’ve undoubtedly received messages regarding viruses when downloading files from peer-to-peer services. These are not the only things you could be downloading. Many hackers imbed root-kits in files and distribute them using peer-to-peer file sharing. Root kits contain many types of tools used by hackers to gain control over computers. If the installation of the kit on your computer goes undetected and is successful, it’s only a matter of time before your computer is completely compromised.

I can’t tell you how many times I’ve found company employees (and technical personnel) using peer-to-peer file sharing services. Any organization that permits this is putting itself at risk. And, the risk is much greater as compared to a single home computer because of the number of potential internal targets.

Conclusion
———-
Of course, the above is just a few examples of different methods and types of computer compromise. There are many ways your computer can be hacked. Your best defense is a good offense along with education and awareness. When you configure your computer make sure you enable only the software and services that you need. Many programs have known exploits and / or require additional steps be taken to adequately secure them.

Don’t make the assumption that you are not a target just because you don’t think you have anything of interest on your computer.

If our computer becomes unstable or dramatically decreases in performance, don’t assume it’s just a quirk or that it’s time to upgrade.

Make sure you have a software or hardware firewall in place to protect you from the Internet. Your firewall should be configured not to allow anonymous inbound access from the Internet. This is the default configuration for most firewalls, but you should make sure the one you are using is properly configured.

Make sure you have adequate virus and spyware protection, and your pattern signatures are up-to-date. Many anti-virus applications work on a subscription basis. It’s not uncommon to find out your subscription expired. If it is expired, your software may not protect you from new and emerging threats.

And, do what ever you can to stay away from any type of Internet peer-to-peer file sharing service. No matter how safe the developer claims it is.

About The Author
—————-
Darren Miller is an Information Security Consultant with over sixteen years experience. He has written many technology & security articles, some of which have been published in nationally circulated magazines & periodicals. Darren is a staff writer for http://www.defendingthenet.com and several other e-zines. If you would like to contact Darren you can e-mail him at Darren.Miller@ParaLogic.Net or DefendTheNet@ParaLogic.Net.

If you would like to know more about computer security please visit us at our website. If someone you know has sent you this article, please take a moment to visit our site and register for the free newsletter at Newsletter Subscribe.

Original URL
————
http://www.defendingthenet.com/NewsLetters/HaveYouBeenHacked.htm

Virus damage estimated at $55 billion in 2003. "SINGAPORE - Trend Micro Inc, the world’s third-largest anti-virus software maker, said Friday that computer virus attacks cost global businesses an estimated $55 billion in damages in 2003, a sum that would rise this year. Companies lost roughly $20 billion to $30 billion in 2002 from the virus attacks, up from about $13 billion in 2001, according to various industry estimates." This was the story across thousands of news agencies desk January 2004. Out of $55 billion, how much did it cost your company? How much did it cost someone you know?

I. The Why
There is an average of 10-20 viruses released every day. Very few of these viruses actually make ?Wild? stage. Viruses are designed to take advantage of security flaws in software or operating systems. These flaws can be as blatant as Microsoft Windows NetBIOS shares to exploits using buffer overflows. Buffer overflows happen when an attacker sends responses to a program longer then what is expected. If the victim software is not designed well, then the attacker can overwrite the memory allocated to the software and execute malicious code.

People make viruses for various reasons. These reasons range from political to financial to notoriety to hacking tools to plain malicious intent.

Political: Mydoom is a good example of a virus that was spread with a political agenda. The two targets of this virus were Microsoft and The SCO Group. The SCO Group claims that they own a large portion of the Linux source code threatened to sue everyone using Linux operating systems (with "stolen" programming source). The virus was very effective knocking down SCO’s website. However, Microsoft had enough time to prepare for the second attack and efficiently sidestepped disaster.

Financial: Some virus writers are hired by other parties to either leach financial data from a competitor or make the competitor look bad in the public eye. Industrial espionage is a high risk/high payout field that can land a person in prison for life.

Notoriety: There are some that write viruses for the sole purpose of getting their name out. This is great when the virus writers are script kiddies because this helps the authorities track them down. There are several famous viruses that have the author’s email in the source code or open script

Hacking Hackers sometimes write controlled viruses to assist in the access of a remote computer. They will add a payload to the virus such as a Trojan horse to allow easy access into the victims system.

Malious: These are the people that are the most dangerous. These are the blackhat hackers that code viruses for the sole intention of destroying networks and systems without prejudice. They get high on seeing the utter destruction of their creation, and are very rarely script kiddies.

Many of the viruses that are written and released are viruses altered by script kiddies. These viruses are known as generations of the original virus and are very rarely altered enough to be noticeable from the original. This stems back to the fact that script kiddies do not understand what the original code does and only alters what they recognize (file extension or victim’s website). This lack of knowledge makes script kiddies very dangerous.

II. The How
Malicious code has been plaguing computer systems since before computers became a common household appliance. Viruses and worms are examples of malicious code designed to spread and cause a system to perform a function that it was not originally designed to do.

Viruses are programs that need to be activated or run before they are dangerous or spread. The computer system only becomes infected once the program is run and the payload has bee deployed. This is why Hackers and Crackers try to crash or restart a computer system once they copy a virus onto it.

There are four ways a virus can spread:
1.) Email
2.) Network
3.) Downloading or installing softwarev 4.) Inserting infected media

Spreading through Email
Many emails spread when a user receives an infected email. When the user opens this email or previews it, the virus is now active and starts to immediately spread.

Spreading through Network
Many viruses are network aware. This means that they look for unsecured systems on the network and copy themselves to that system. This behavior destroys network performance and causes viruses to spread across your system like wildfire. Hackers and Crackers also use Internet and network connections to infect systems. They not only scan for unprotected systems, but they also target systems that have known software vulnerabilities. This is why keeping systems up to date is so important.

Spreading through manual installation
Installing software from downloads or disks increase the risk of infection. Only install trusted and scanned software that is known to be safe. Stay away from freeware and shareware products. These programs are known to contain Spyware, Adware, and viruses. It is also good policy to deny all Internet software that attempts to install itself unless explicitly needed.

Spreading through boot sectors
Some viruses corrupt the boot sector of disks. This means that if another disks scans the infected disk, the infection spreads. Boot sector viruses are automatically run immediately after the disk is inserted or hard drive connected.

III. Minimizing the effect of viruses and worms
We have all heard stories about the virus that destroyed mission critical company data, which cost companies months to recover and thousands of dollars and man-hours restoring the information. In the end, there are still many hours, costs, and would be profits that remain unaccounted. Some companies never recover fully from a devastating attack. Taking simple precautions can save your business

Anti-virus Software
Another step is to run an antivirus program on the local computer. Many antivirus programs offer live update software and automatically download the newest virus definitions minutes after they are released (Very important that you verify these updates weekly if not daily). Be careful of which antivirus program you chose. Installing a PC antivirus on a network can be more destructive on performance than a virus at work. Norton makes an effective corporate edition specifically designed for Windows NT Server and network environments. When using antivirus software on a network, configure it to ignore network drives and partitions. Only scan the local system and turn off the auto protection feature. The auto-protect constantly scans your network traffic and causes detrimental network issues. Corporate editions usually have this disabled by default. PC editions do not.

Email Clients Do not open emails from unknown sources. If you have a website for e-commerce transactions or to act as a virtual business card, make sure that the emails come up with a preset subject. If the emails are being sent through server side design instead of the users email client, specify whom it is coming from so you know what emails to trust. Use common sense when looking at your email. If you see a strange email with an attachment, do not open it until you verify whom it came from. This is how most MM worms spread.

Disable preview panes in email clients. Email clients such as Outlook and Outlook Express have a feature that will allow you to preview the message when the email is highlighted. This is a Major security flaw and will instantly unleash a virus if the email is infected.

It is also a good idea to turn off the feature that enables the client to view HTML formatted emails. Most of these viruses and worms pass by using the html function "< i f r a m e s r c >" and run the attached file within the email header.

We will take a quick look at an email with the subject header of "You’re now infected" that will open a file called readme.exe.

"Subject: You’re now infected MIME-Version: 1.0 Content-Type: multipart/related;

type="multipart/alternative";

boundary="====_ABC1234567890DEF_====" X-Priority: 3 X-MSMail-Priority: Normal X-Unsent: 1 To: undisclosed-recipients:;

–====_ABC1234567890DEF_==== Content-Type: multipart/alternative;

boundary="====_ABC0987654321DEF_====" *** (This calls the iframe)

–====_ABC0987654321DEF_==== Content-Type: text/html;

charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

< H T M L > < H E A D > < / H E A D > < B O D Y b g C o l o r = 3 D # f f f f f f > < i f r a m e s r c = 3 D c i d : EA4DMGBP9p height=3D0 width=3D0> *** (This calls readme.exe) < / i f r a m e > < / B O D Y > < / H T M L >

–====_ABC0987654321DEF_====–

–====_ABC1234567890DEF_==== Content-Type: audio/x-wav;

name="readme.exe" *** (This is the virus/worm) Content-Transfer-Encoding: base64 Content-ID: *** (Notice the < i f r a m e s r c = ? >)

PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9u YWwvL0VOIj4NIDxodG1sPg08aGVhZD4NPHRpdGxlPldobydzIHRoZSBiZXN0LS0tLS0tPyAt IHd3dy5lemJvYXJkLmNvbTwvdGl0bGU+DQ0NDTxzY3JpcHQgbGFuZ3VhZ2U9amF2YXNjcmlw dCBzcmM9aHR0cDovL3d3dzEuZXpib2FyZC5jb20vc3BjaC5qcz9jdXN0b21lcmlkPTExNDc0 NTgwODI+PC9zY3JpcHQ+DTxzY3JpcHQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQiPg08IS0tDWZ1 bmN0aW9uIE1NX29wZW5CcldpbmRvdyh0aGVVUkwsd2luTmFtZSxmZWF0dXJlcykgeyAvL3Yy

*** Broken to protect the innocent. (Worm is encoded in Base64)

aHJlZj1odHRwOi8vY2l0YWRlbDMuZXpib2FyZC5jb20vZmNhbGhpc3BvcnRzZnJtMT5Gb290 YmFsbDwvYT4NIA08Zm9udCBjb2xvcj0jRkYwMDAwPiAtIDwvZm9udD4NDTxicj48YnI+PGJy Pjxicj5Qb3dlcmVkIEJ5IDxhIGhyZWY9aHR0cDovL3d3dy5lemJvYXJkLmNvbS8+ZXpib2Fy ZK48L2E+IFZlci4gNi43LjE8YnI+Q29weXJpZ2h0IKkxOTk5LTIwMDEgZXpib2FyZCwgSW5j Lg08L2NlbnRlcj4NPC9ib2R5Pg08L2h0bWw+DQ0NDQoNCj==

–====_ABC1234567890DEF_====–"

Email Servers The first step to minimizing the effect of viruses is to use an email server that filters incoming emails using antivirus software. If the server is kept up to date, it will catch the majority of Mass Mailer (MM) worms. Ask your Internet Service Provider (ISP) if they offer antivirus protection and spam filtering on their email servers. This service is invaluable and should always be included as the first line of defense.

Many companies house an internal email server that downloads all of the email from several external email accounts and then runs an internal virus filter. Combining an internal email server with the ISP protection is a perfect for a company with an IT staff. This option adds an extra layer of control, but also adds more administration time. Sample specs for an internal email server are:

Setup #1
* Linux: OS
* Sendmail: mail server
* Fetchmail: Grabs email from external email addresses
* F-prot: Antivirus
* SpamAssassin: Spam Filter

Setup #2
* Win 2003 Server: OS
* Exchange: Email server
* Symantec antivirus: Antivirus
* Exchange Intelligent Message Filter: Spam Filter

Software Updates Keep you software up to date. Some worms and viruses replicate through vulnerabilities in services and software on the target system. Code red is a classic example. In august 2001, the worm used a known buffer overflow vulnerability in Microsoft’s IIS 4.0 and 5.0 contained in the Idq.dll file. This would allow an attacker to run any program they wanted to on the affected system. Another famous worm called Slammer targeted Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000.

When updating your software, make sure to disable features and services that are not needed. Some versions of WinNT had a web server called IIS installed by default. If you do not need the service, make sure it is turned off (Code red is a perfect example). By only enabling services you need, you decrease the risk of attack.

Telecommunications Security Install a firewall on the network. A firewall is a device or software that blocks unwanted traffic from going to or from the internal network. This gives you control of the traffic coming in and going out of your network. At minimum, block ports 135,137,139,445. This stops most network aware viruses and worms from spreading from the Internet. However, it is good practice to block all traffic unless specifically needed.

Security Policies Implementing security policies that cover items such as acceptable use, email retention, and remote access can go a long way to protecting your information infrastructure. With the addition of annual training, employees will be informed enough to help keep the data reliable instead of hinder it. Every individual that has access to your network or data needs to follow these rules. It only takes one incident to compromise the system. Only install proven and scanned software on the system. The most damaging viruses come from installing or even inserting a contaminated disk. Boot sector viruses can be some of the hardest malware to defeat. Simply inserting a floppy disk with a boot sector virus can immediately transfer the virus to the hard drive.

When surfing the Internet, do not download untrusted files. Many websites will install Spyware, Adware, Parasites, or Trojans in the name of "Marketing" on unsuspecting victims computers. Many prey on users that do not read popup windows or download freeware or shareware software. Some sites even use code to take advantage of vulnerability in Internet explorer to automatically download and run unauthorized software without giving you a choice.

Do not install or use P2P programs like Kazaa, Morpheus, or Limewire. These programs install server software on your system; essentially back dooring your system. There are also thousands of infected files floating on those networks that will activate when downloaded.

Backups & Disaster Recovery Planning Keep daily backups offsite. These can be in the form of tape, CD-R, DVD-R, removable hard drives, or even secure file transfers. If data becomes damaged, you would be able to restore from the last known good backup. The most important step while following a backup procedure is to verify that the backup was a success. Too many people just assume that the backup is working only to find out that the drive or media was bad six months earlier when they were infected by a virus or lost a hard drive. If the data that you are trying to archive is less then five gig, DVD-R drives are a great solution. Both the drives and disks have come down in price and are now a viable option. This is also one of the fastest backup methods to process and verify. For larger backups, tape drives and removable hard drives are the best option. If you choose this method, you will need to rotate the backup with five or seven different media (tapes, CD/DVD, removable drives) to get the most out of the process. It is also suggested to take a "master" backup out of the rotation on a scheduled basis and archive offsite in a fireproof safe. This protects the data from fire, flood, and theft.

In the Internet age, understanding that you have to maintain these processes will help you become successful when preventing damage and minimizes the time, costs, and liabilities involved during the disaster recovery phase if you are affected.

Resources

Virus Resources F-PROT: http://www.f-prot.com/virusinfo/ McAfee : http://vil.nai.com/vil/default.asp Symantec Norton: http://www.symantec.com/avcenter/ Trend Micro: http://www.trendmicro.com/vinfo/ NIST GOV: http://csrc.nist.gov/virus/

Free software AVG Anti-Virus - http://free.grisoft.com Free F-Prot - http://www.f-prot.com Free for home users

Free online Virus scan BitDefender - http://www.bitdefender.com/scan HouseCall - http://housecall.trendmicro.com McAffe - http://us.mcafee.com/root/mfs Panda ActiveScan - http://www.pandasoftware.es/activescan/activescan-com.asp RAV Antivirus - http://www.ravantivirus.com/scan

Free online Trojan scan TrojanScan - http://www.windowsecurity.com/trojanscan/

Free online Security scan Symanted Security Check - http://security.symantec.com/sscv6 Test my Firewall - http://www.testmyfirewall.com/

More Security Resources Forum of Incident Response and Security Teams: http://www.first.org/ Microsoft: http://www.microsoft.com/technet/security/current.aspx SANS Institute: http://www.sans.org/resources/ Webopedia: http://www.pcwebopedia.com/ Definitions

Adware: *A form of spyware that collects information about the user in order to display advertisements in the Web browser based on the information it collects from the user’s browsing patterns.

Software that is given to the user with advertisements already embedded in the application

Malware: *Short for malicious software, software designed specifically to damage or disrupt a system, such as a virus or a Trojan horse.

Script Kiddie: *A person, normally someone who is not technologically sophisticated, who randomly seeks out a specific weakness over the Internet in order to gain root access to a system without really understanding what it is s/he is exploiting because the weakness was discovered by someone else. A script kiddie is not looking to target specific information or a specific company but rather uses knowledge of a vulnerability to scan the entire Internet for a victim that possesses that vulnerability.

Spyware: *Any software that covertly gathers user information through the user’s Internet connection without his or her knowledge, usually for advertising purposes. Spyware applications are typically bundled as a hidden component of freeware or shareware programs that can be downloaded from the Internet; however, it should be noted that the majority of shareware and freeware applications do not come with spyware. Once installed, the spyware monitors user activity on the Internet and transmits that information in the background to someone else. Spyware can also gather information about e-mail addresses and even passwords and credit card numbers.

Spyware is similar to a Trojan horse in that users unwittingly install the product when they install something else. A common way to become a victim of spyware is to download certain peer-to-peer file swapping products that are available today.

Aside from the questions of ethics and privacy, spyware steals from the user by using the computer’s memory resources and also by eating bandwidth as it sends information back to the spyware’s home base via the user’s Internet connection. Because spyware is using memory and system resources, the applications running in the background can lead to system crashes or general system instability.

Because spyware exists as independent executable programs, they have the ability to monitor keystrokes, scan files on the hard drive, snoop other applications, such as chat programs or word processors, install other spyware programs, read cookies, change the default home page on the Web browser, consistently relaying this information back to the spyware author who will either use it for advertising/marketing purposes or sell the information to another party. Licensing agreements that accompany software downloads sometimes warn the user that a spyware program will be installed along with the requested software, but the licensing agreements may not always be read completely because the notice of a spyware installation is often couched in obtuse, hard-to-read legal disclaimers.

Trojan: *A destructive program that masquerades as a benign application. Unlike viruses, Trojan horses do not replicate themselves but they can be just as destructive. One of the most insidious types of Trojan horse is a program that claims to rid your computer of viruses but instead introduces viruses onto your computer.

The term comes from a story in Homer’s Iliad, in which the Greeks give a giant wooden horse to their foes, the Trojans, ostensibly as a peace offering. But after the Trojans drag the horse inside their city walls, Greek soldiers sneak out of the horse’s hollow belly and open the city gates, allowing their compatriots to pour in and capture Troy.

Virus: *A program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are man made. A simple virus that can make a copy of itself over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of transmitting itself across networks and bypassing security systems.

Since 1987, when a virus infected ARPANET, a large network used by the Defense Department and many universities, many antivirus programs have become available. These programs periodically check your computer system for the best-known types of viruses.

Some people distinguish between general viruses and worms. A worm is a special type of virus that can replicate itself and use memory, but cannot attach itself to other programs.

Worm: *A program or algorithm that replicates itself over a computer network and usually performs malicious actions, such as using up the computer’s resources and possibly shutting the system down.

* Definitions provided by Webopedia

A special thanks goes out to the CISSP community, various Chief Information Security Officer (CISO)s, and to those in the Risk assessment specialty of Information Systems Security for their help in proof reading and suggestions.

Jeremy Martin CISSP,CHS-III,CEH
http://www.infosecwriter.com