20120301

Password Trick

The other day I was asked what were some of the worst passwords I had ever seen or heard. Here are my top 5.
1. Password
2. 12345678
3. qwerty
4. your pets name
5. Favorite sport team.

Passwords can be a pain in the neck. From being too easy to being too difficult to remember. Some IT departments I've worked with have required such nonsensical rules of their users that the users end up writing the passwords on a piece of  paper and hiding it in their desk, better yet they have an Excel spread sheet marked "passwords" on their computer! Where's the security there?  Here's a simple trick for a secure password that's very easy to change and remember (you should be changing them on a 90 day cycle anyway).
Pick a word that you can change on a regular basis. I'll start with fish. Add a simple static rule like always capitalizing the 3rd letter.
fish becomes fiSh
Add a simple four digit number that you can keep static, say the year of your favorite persons birthday. (Sorry but I can't give you my age so you'll have to think of your second favorite person) Add it between each of the letters of the word. I'll say 1070.
fiSh becomes 1f0i7S0h - cool huh?
Last and not least add one special character somewhere static. Most will chose the end or beginning, some pros like to add it randomly but lets keep it simple right?
<1f0i7S0h
Thar she blows! We've just brewed up a really strong password with rules that create a template so you never have to think of a really tough one every time you need a new one.

1st Rule - 4 letter word you can change.
2nd - a static rule that never changes.
3rd - a simple four digit number.
4th - add a special character anywhere.


Protecting our data is a never ending process. Next week I'll post some cloud and online backup storage options.

Take Care!

20111231

Phishing Attempt and a free plug for OpenDNS

The other day I received an email that looked like it came from PayPal asking me to verify my account details with my username and password. After about 10 seconds I realized it was a phishing attempt. The sender wasn't a skilled phisher because the full URL to his site was actually displayed. Even though the link displayed "PayPal.com" it wasn't the actual website it was about to take me to. A quick way to determine the website is to look at the last two sections of the URL (or link), the "dot com dot net dot org etcetera...". I'll use the following fake URL as an example.
"http://www . paypal . com . craptastic . imtryingtostealfromyou . in". Even though  PayPal is in the link text the actual website you'd visit would be "imtryingtostealfromyou.in". This link was displayed. in the email. A decent attempt would be to hide the link with text but that can be easily debunked as well just by holding the mouse pointer over the link. The actual URL will appear in either the tool tip or the bottom of the browser.

Being the curious guy that I am I wanted to see the phisher's attempt at a the website. I fired up a virtual machine that I use for testing malware and virus "combat". After clicking the link I was immediately given the warning you see in the screenshot to the right. OpenDNS blocked the URL after it had been discovered it was a fraudulent site. Nice going by those guys. I don't make money with OpenDNS or am I affiliated with them (I wish :) ) I just think this is a great free service and highly recommend it.

20111209

Easy 3 Layered Defense Strategy

The more layers you put between yourself and the internet the better. It's a proven strategy thats been used for hundreds of years. Think of the Middle Ages. A  wall and gate protected the city, a moat protected the walls of the castle, and the castle was built with huge stone walls for the last layer of defense.
Think of the internet as a wilderness mixed with fantastic information, beautiful scenery, and the very rare dangerous animals that if you're not careful could harm you. Some of these beasts are hunting you, others aren't looking for anything in particular but are more predators of opportunity. Now, this doesn't mean you should lock yourself in the castle and never leave. The chances of you running into the hostile "creatures of opportunity" are rather slim but the less protected you are the greater the opportunity to be taken advantage of. There are many mechanisms of protection and A LOT cost money. This article isn't about prices or best technology. This is more of a quick lesson on the act of protection. Note: I haven't paid for an anti-virus, anti-malware, firewall, or perimeter defense in years and I can show you how to do the same.
Your 1st line of defense is easy and free. I'm going to name the technology in this one since it's the only one I use and recommend. It's called OpenDNS. OpenDNS acts as a go-between you and the internet. Very briefly DNS (Domain Name System) is what the computer uses to talk to the internet. It takes the name of the website you type in and translates it to numbers. Computers don't communicate like you and me (not yet), they use numbers. These numbers are how everything communicates on the internet. OpenDNS acts as a gateway between you and the internet. It stores, scans, and determines the safety of internet web addresses for you. Not only does this make the internet a bit faster it makes it safer. So it's a free win win for you. Signup is easy and set up is very well laid out and easy to follow.
Number 2 (or the castle moat) can be the most expensive part of the equation. Some of you may already have it. A router. Routers split up your internet connection between multiple computers and devices turning  your home into a network. Blu-ray players, gaming consoles, printers and even smart phones can benefit from a router. The protection part comes from whats called NAT (Network Address Translation). Basically it hides your computer from the outside network/internet kind of like a two-way mirror. You can see the internet but someone on the internet can't see you without a lot of extra work. It's what a lot of professionals call a hardware firewall. Even if you don't have more than one computer routers can be very beneficial for protection. Some routers can be very expensive depending on what they're used for. A simple wireless NAT router can be as low as $25.   They're easy to set up and you'll rarely have to mess with it more than once a year.
The last layer in our multi-layered defense comes from a software firewall. I use mine to track whats leaving my network. Lets say you get a bug on your system that wants to communicate with its parent on the outside of your network. There are plenty of firewalls to use. A good outbound firewall can stop and even inform you when the software tries to leave your system and communicate with an outside host. I've used several freebies in the 11 years I've been involved with computers and have concluded some of the best are free. Comodo, AShampoo (Windows XP only), and ZoneAlarm are all excellent free firewalls. Of course Windows comes with a firewall if you don't want to download these.
That's it. A multi-layered defense for your castle err..home. Remember the more layers, the more protection. The more protection the safer you're computer is. One last item always practice safe surfing habits. If it looks dangerous or offers look too good to be true, it probably is.



20111206

SCCM Training Notes

Bled for days fighting #sccm reports HTTP Error 500.24 - turns out it wasn't an SCCM error but an IIS 7.5 error. I'm quite the noob when it comes to SCCM, IIS, and the like so I'm learning as I go.
The 500.24 error was due to ASP.NET Impersonation not being enabled. So I opened my site and drilled to the SMSReporting node for my site and enabled ASP.NET Impersonation. I thought I was good to go and ran the SCCM reports again and ran into "HTTP Error 404.3 - Not Found The page you ... are requesting cannot be served because of the extension ...". After banging my head into the wall a few times and looking on Microsofts Technet site I discovered I simply didn't install ASP. I thought I had but rather installed ASP.NET (I'm learning remember?). I installed ASP and ran the reports again and bingo! I'm a happy man this morning.

20111128

SCCM Management Point Default

Why isn't the #SCCM site systems management point "allow devices to use this management point" allowed by default? 

20100615

Finding the Simple Uploader - FaceBook

I've had a couple requests for FaceBook help. Some friends and family (including me) don't like to use the Java enhanced browser plug-in when uploading photos. I always use the simple uploader. It's a tad more secure and in some cases may be even faster than using the default photo upload.






20100327

Lads from Lagos pose as US troops to snare unwary ladies

This is absolutely disgusting.

The Lads from Lagos have struck again, this time posing online as US servicemen at war overseas in order to become "romantically involved" with American women fond of a man in uniform and then "prey on their emotions and patriotism".

“We are seeing a number of scams being perpetrated on the internet, especially on social, dating-type websites where females are the main target,” explained Chris Grey, spokesman for the US Army Criminal Investigation Command.

Full Article

20100326

2010 Anti Virus Results Are In

Without getting into too much detail the best 3 anti-virus products are as follows:

1. G Data high marks in overall detection rates plus a very high rating for malware/spyware detection. Great marks also for processor usage and a low percentage of "false positives". Price $29.99 for a one year one PC license.
2. Avira AntiVir Premium Priced at $53 (and up) Avira Premium provides top notch (ok second rated) protection. 99.3% detection rate and low false positive detection plus a very high score in malware/spyware detection.
3. Panda Anti-Virus Pro $49.95 for a 1 year 3 PC license gets you the 3rd highest Anti-Virus program in our countdown! A little over double that will get you a 3 year license so pricing isn't that bad. A good overall score of 99.2% detection rate but a horrible rate in detecting malware/spyware (67.9% and 40% with script malware**Norton AV scores higher with 97.9% and Microsoft's free Security Essentials scores an 87.1%). There were a lot of false positive detections yet the scanner is fast.

Free Anti-virus (AV) Scores
If the need arises and paying $50+ is a little steep I recommend a few freebies. With that recommendation I advise extreme caution and a vigilant resolve when using free AV. Personally I use Microsoft's Security Essentials and haven't run into any issues so far but I use different web surfing techniques (launching browsers within Sand Boxes* for instance). Here are my top 3 freebies.
1. Avast! Scoring in the high 90's with every detection rate and a 93% in malware/spyware this free (with the option to go pro for 1 PC for $39.95) has the best scores out of the freebie AV products.
2. Microsoft's Security Essentials A small footprint on system resources, very few false positives, and a good overall score of about 96%, Microsoft takes the number 2 spot in the 2010 Free AV Countdown here on Graydentech. I takes a hit with script malware (77%) but it's not horrible.
3. AVG Free 75% malware/spyware detection rates but an extremely low score with script malware**. You get what you pay for on this and frankly I don't recommend it.





*In computer security, a sandbox is a security mechanism for separating running programs. It is often used to execute untested code, or untrusted programs from unverified third-parties, suppliers and untrusted users.

The sandbox typically provides a tightly-controlled set of resources for guest programs to run in, such as scratch space on disk and memory. Network access, the ability to inspect the host system or read from input devices are usually disallowed or heavily restricted. In this sense, sandboxes are a specific example of virtualization.

**Mostly called "drive-by downloads" or crap you can get from visiting a web page. in other words it's not a program you have to install to become infected. It's become fairly popular with crime-ware like "Internet Security 2010". I say popular since it's the biggest problem I've seen lately. It just pops into your machine while you're surfing and it takes a giant crow-bar to remove it's clutches from your system.

Note: these results are from an independent research group (AV-Comparitives dot org) plus a little of my own testing. Full results and tests can be found in the following PDF. AVC Report

20100322

20100318

Never Share Your Password

20100301

Test your speed Columbus

It's not a bad idea to occasionally test your internet speed. Sometimes you'd be surprised how much your download speed has deterriorated. If you're paying for 6 megabytes per second your speed should be very close to it.  The last time I checked I "scored" a new moden from my service provider. Here are a couple places to check:
http://speedtest.connectedoh.org/
http://www.speedtest.net/ (be sure to click the teal button that says 'speed test')

20100224

Critical Adobe Update

A security flaw** in Adobe Reader and Flash Player has prompted an important security update from Adobe for it's Flash Player and Reader programs. If you've upgraded or patched either of these programs yesterday (23feb10) you're good to go. If not get thee to the upgrade site!
Adobe Flash here.
Adobe Reader* here.
Both of the links above will lead you to the Adobe website. Both will also try to add the Google Toolbar. Feel free to leave the check mark in or remove it depending on your preference in toolbars. 


* I don't use the free Adobe Reader it's files are huge and it tends to create a large lag in memory speed. I prefer FoxFire reader by Foxit. (not to be confused with FireFox by Mozilla) which is free as well but smaller and uses less memory. You can get it here.  


** The update (or patch as it can be referred to) patches a security hole in these programs that without the patch could allow an attacker to download and install Malware which can open your PC up to a variety of different attacks.

20100219

Microsoft Excel Quick Tip


Just a quick tip for you MS Excel users. If you want to add contiguous cells without having to go through the hassle of the sum function select the next blank cell after the last number you typed. Now press the alt button and  the +/= button. The cell will populate with the answer. This works left to right and top to bottom.

Note - I tried this with Sun Microsystems free equivalent to MS Office (Open Office) and Google Spreadsheet from Google Docs and it didn't work. 

20100215

Got Fred?

Have you ever heard the expression from the commercial…Got Milk? The next line is “Milk ~ it does a body good.” The same goes with our friend and computer guy, Fred Sager. Fred does a computer good AND relieves a lot of stress and tension from your life. Fred is the person Cornerstone Concierge uses for our own computer issues as well as for our client’s computer problems and concerns. He is prompt in returning phone calls, courteous to us and our clients, and is an expert in his field. He also has many Windows certifications. The next time you have a computer issue, Get Fred!

We always call Fred

Our family seems to always have “computer issues” from printing failures to viruses’. So when things go wrong we always call Fred. Fred has created a wireless network system for our home. He has made our network secure and has set up an external hard drive system. Fred has also helped extended family members with solutions to all of their computer needs. Some of our needs are basic and some are very complex, and Fred always has the answers. The best thing about Fred is that he is able to teach with patience and simplicity.

Lori Scott

We love Fred's work

"We love Fred's work. He is accessible and comes to your home, eliminatiing a trip to the store, hauling in our computer. He listens to you, he understands the problem, and he fixes it, He gets all of our computer "to do's" done in a short amount of time. And we appreciate that he keeps us up to date via email on any potential computer threats that might be occuring, as well as answering questions we might have that can be simply answered via email."

Dave and Kathy Gruber

20081208

Check Free Hacking Incident

Last week The Register reported CheckFree had been hacked ,directing users to a server in central Europe gathering usernames and passwords.
"Online payment service CheckFree lost control of at least two of its domains on Tuesday in an attack that sent customers to servers run by a notorious crime gang believed to be based in Eastern Europe."
You may use CheckFree's services and not even realize it. Some customers may recieve emails regarding the hack and processes to use in order to be secure. In case you haven't and are wondering if your online payments go through them (CheckFree controls between 70 to 80 percent of the U.S. online bill pay market) please go here.

20071127

Nature Wallpapers

I found some sweet wallpapers for your machines. Thank me later :)
http://blogs.msdn.com/mswanson/articles/wallpaper.aspx

20071004

Elaborate Morphing Trojan - The Storm

Good Morning! It was at least until I read an article about a threat called "Storm". Originally from early this year it seems it's creators have been able to re-engineer it, only better (or worse from another view). This is a silent trojan/worm style infection and as of today there really isn't an anti-virus that can stop it. It's estimated there are close to 25 million+ infected computers throughout the world. It doesn't damage your system but instead joins your system to a network of other infected machines**. This infection also 'sleeps' until it's ready to be used, then once it's finished it goes back to sleep sometimes as a different program***. It rarely causes any strain on your system, instead it does the opposite. It wants your system to be healthy so it can replicate itself to other machines.
What to do.
This goes right back "to if you don't know who it's from don't open it or follow a link inside the email".
Update your anti-virus, your operating system,and get a hardware (AKA a router) and software firewall.
Turn off your broadband connection when you're not using it.
Avoid peer-to-peer programs.

Do your best to protect yourself and others from these kinds of threats. If there's one there's bound to be another sometime soon.


One biggy precaution I like to recommend is occasionally rebuild your system. If you have the ability and your system is backed up on a regular basis (please please please back up your system!) take out the rebuild discs from your computer manufacturer and throw them in. Your system will be wiped clean of everything and you'll basically have a brand new machine. Remember the software you installed after you bought the computer will be gone and you'll have to reinstall it.****


** Why would someone want to infect your system and millions more? One explanation is to build a 'botnet' to attack another computer. Think of it this way. If you're talking to one person it's easy to handle. Another comes in and you're good to go. Maybe even three or four (although I'm going to have to be rude to the fourth guy). Now imagine 10 million people all talking to you at once. You're head would explode. Same basic reasoning behind a botnet attack. The server will shutdown and stop responding costing the company millions. OR even more devious. Those 10 million machines could be used to attack a firewall encryption for a defense grid.

*** A different program? A polymorphic trojan can change it's own programming to appear as another program. Using this system it can appear different to an anti-virus or anti-spyware program.

**** Kind of advanced but you could rebuild your system, reinstall all the software, then make a ghost copy of it. This will make things a lot easier the next time you're rebuilding.

20070829

Geek Squad Weak Mod

I'm doing some work at a clients house when one of their sons asks if I could hook his PSP to the family network. I've never messed with a PSP but I figured if it's wireless it should be the same basic principle as other wireless gear. His mother told me Geek Squad told him they would come out and and connect it to the network.....for $80! I was waiting for one of the systems to reboot so I grabbed hold and went to town. First the Geeks set up the wireless network with security (which was a good idea) but (bad idea) it was 64bit WEP. Sixty......four......double you ee pee. First mistake. Second, the password into the network they set up was in the top ten worst passwords you can use. Now trying to give the Squad some credit I checked the router security to see if 64 was the peak of its protection. No. WPA2. So instead of using a highly encrypted safe scheme Geek Squad decided to use the easiest password with the lightest encryption. Why they even chose to filter the MACs I'll never know. Oh and they broadcast the SSID. Nice. So remember:
Strong password (you don't write down)
WEP Encryption
Turn off broadcasting the SSID
Filter MACS
Turn it off when not using it.

GraydenTech's Fan Box

GraydenTech on Facebook