Password Trick

The other day I was asked what were some of the worst passwords I had ever seen or heard. Here are my top 5.
1. Password
2. 12345678
3. qwerty
4. your pets name
5. Favorite sport team.

Passwords can be a pain in the neck. From being too easy to being too difficult to remember. Some IT departments I've worked with have required such nonsensical rules of their users that the users end up writing the passwords on a piece of  paper and hiding it in their desk, better yet they have an Excel spread sheet marked "passwords" on their computer! Where's the security there?  Here's a simple trick for a secure password that's very easy to change and remember (you should be changing them on a 90 day cycle anyway).
Pick a word that you can change on a regular basis. I'll start with fish. Add a simple static rule like always capitalizing the 3rd letter.
fish becomes fiSh
Add a simple four digit number that you can keep static, say the year of your favorite persons birthday. (Sorry but I can't give you my age so you'll have to think of your second favorite person) Add it between each of the letters of the word. I'll say 1070.
fiSh becomes 1f0i7S0h - cool huh?
Last and not least add one special character somewhere static. Most will chose the end or beginning, some pros like to add it randomly but lets keep it simple right?
<1f0i7S0h
Thar she blows! We've just brewed up a really strong password with rules that create a template so you never have to think of a really tough one every time you need a new one.

1st Rule - 4 letter word you can change.
2nd - a static rule that never changes.
3rd - a simple four digit number.
4th - add a special character anywhere.


Protecting our data is a never ending process. Next week I'll post some cloud and online backup storage options.

Take Care!

Phishing Attempt and a free plug for OpenDNS

The other day I received an email that looked like it came from PayPal asking me to verify my account details with my username and password. After about 10 seconds I realized it was a phishing attempt. The sender wasn't a skilled phisher because the full URL to his site was actually displayed. Even though the link displayed "PayPal.com" it wasn't the actual website it was about to take me to. A quick way to determine the website is to look at the last two sections of the URL (or link), the "dot com dot net dot org etcetera...". I'll use the following fake URL as an example.
"http://www . paypal . com . craptastic . imtryingtostealfromyou . in". Even though  PayPal is in the link text the actual website you'd visit would be "imtryingtostealfromyou.in". This link was displayed. in the email. A decent attempt would be to hide the link with text but that can be easily debunked as well just by holding the mouse pointer over the link. The actual URL will appear in either the tool tip or the bottom of the browser.

Being the curious guy that I am I wanted to see the phisher's attempt at a the website. I fired up a virtual machine that I use for testing malware and virus "combat". After clicking the link I was immediately given the warning you see in the screenshot to the right. OpenDNS blocked the URL after it had been discovered it was a fraudulent site. Nice going by those guys. I don't make money with OpenDNS or am I affiliated with them (I wish :) ) I just think this is a great free service and highly recommend it.

2010 Anti Virus Results Are In

Without getting into too much detail the best 3 anti-virus products are as follows:

1. G Data high marks in overall detection rates plus a very high rating for malware/spyware detection. Great marks also for processor usage and a low percentage of "false positives". Price $29.99 for a one year one PC license.
2. Avira AntiVir Premium Priced at $53 (and up) Avira Premium provides top notch (ok second rated) protection. 99.3% detection rate and low false positive detection plus a very high score in malware/spyware detection.
3. Panda Anti-Virus Pro $49.95 for a 1 year 3 PC license gets you the 3rd highest Anti-Virus program in our countdown! A little over double that will get you a 3 year license so pricing isn't that bad. A good overall score of 99.2% detection rate but a horrible rate in detecting malware/spyware (67.9% and 40% with script malware**Norton AV scores higher with 97.9% and Microsoft's free Security Essentials scores an 87.1%). There were a lot of false positive detections yet the scanner is fast.

Free Anti-virus (AV) Scores
If the need arises and paying $50+ is a little steep I recommend a few freebies. With that recommendation I advise extreme caution and a vigilant resolve when using free AV. Personally I use Microsoft's Security Essentials and haven't run into any issues so far but I use different web surfing techniques (launching browsers within Sand Boxes* for instance). Here are my top 3 freebies.
1. Avast! Scoring in the high 90's with every detection rate and a 93% in malware/spyware this free (with the option to go pro for 1 PC for $39.95) has the best scores out of the freebie AV products.
2. Microsoft's Security Essentials A small footprint on system resources, very few false positives, and a good overall score of about 96%, Microsoft takes the number 2 spot in the 2010 Free AV Countdown here on Graydentech. I takes a hit with script malware (77%) but it's not horrible.
3. AVG Free 75% malware/spyware detection rates but an extremely low score with script malware**. You get what you pay for on this and frankly I don't recommend it.





*In computer security, a sandbox is a security mechanism for separating running programs. It is often used to execute untested code, or untrusted programs from unverified third-parties, suppliers and untrusted users.

The sandbox typically provides a tightly-controlled set of resources for guest programs to run in, such as scratch space on disk and memory. Network access, the ability to inspect the host system or read from input devices are usually disallowed or heavily restricted. In this sense, sandboxes are a specific example of virtualization.

**Mostly called "drive-by downloads" or crap you can get from visiting a web page. in other words it's not a program you have to install to become infected. It's become fairly popular with crime-ware like "Internet Security 2010". I say popular since it's the biggest problem I've seen lately. It just pops into your machine while you're surfing and it takes a giant crow-bar to remove it's clutches from your system.

Note: these results are from an independent research group (AV-Comparitives dot org) plus a little of my own testing. Full results and tests can be found in the following PDF. AVC Report

Never Share Your Password

More than 100 drivers in Austin, Texas found their cars disabled or the horns honking out of control, after an intruder ran amok in a web-based vehicle-immobilization system normally used to get the attention of consumers delinquent in their auto payments.

Read More http://www.wired.com/threatlevel/2010/03/hacker-bricks-cars/#ixzz0iXEHL7mX

Although the article and it's author are emphasizing the use of "hacking" in order to set the car alarms and horns off. I think the main point of the article should be never share your password. Even though the accused supposedly hacked the system he didn't really do anything but use another co-workers username and password. This is a basic social engineering hack where one user gains access to another users credentials and uses them in a fraudulent manner. This could have been avoided if the co-worker never shared his password. I stress this to everyone I help and work with.